@apollion-dsi/core 4.6.1 → 4.6.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/CHANGELOG.md +1451 -0
  2. package/package.json +3 -3
package/CHANGELOG.md ADDED
@@ -0,0 +1,1451 @@
1
+ # @apollion-dsi/core
2
+
3
+ ## 4.6.2
4
+
5
+ ### Patch Changes
6
+
7
+ - bc11147: fix(core): Storybook iframe empty in `storybook dev` — apply relative `publicPath` only on production builds
8
+
9
+ ## 4.6.1
10
+
11
+ ### Patch Changes
12
+
13
+ - fix(core): `Image` e `Svg` emitem `width`/`height` como atributos HTML nativos
14
+
15
+ `width`/`height` são props de dimensão do `SizeFactory` **e** atributos HTML
16
+ nativos de elementos de mídia/vetor (`<img>`, `<svg>`). O `shouldForwardProp`
17
+ global os removia do DOM, então os elementos renderizados saíam sem
18
+ `width`/`height` — o PageSpeed acusa "image elements do not have explicit width
19
+ and height" (risco de CLS) e SVGs "explodem" sem CSS de autor.
20
+ - **`Image`**: `ImageStyle` passa a encaminhar `width`/`height` para o DOM.
21
+ - **`Svg`**: novo `getNativeDims` deriva `width`/`height` nativos de
22
+ `size`/`dimensions` **quando numéricos** e os emite via `attrs`. Valores
23
+ CSS-only (`1em`, `auto`, `calc(...)`, `100%` fluido) seguem só como CSS.
24
+
25
+ Ambos usam o novo predicado compartilhado `shouldForwardDimensionAttrs`, que
26
+ reintroduz só esses dois atributos preservando o resto da regra do DS. Sem
27
+ mudança de layout com CSS: os valores já eram aplicados como estilo; agora
28
+ também chegam como atributos, reservando o espaço.
29
+
30
+ ## 4.6.0
31
+
32
+ ### Minor Changes
33
+
34
+ - Move `styled-components` from `dependencies` to `peerDependencies` (`^6.0.0`) so the consumer app always owns the single `styled-components` instance.
35
+
36
+ Previously the exact pin (`"styled-components": "6.4.1"`) prevented yarn from deduping against an app resolving a different `6.x` patch (e.g. `6.4.3`), installing a second nested copy under `@apollion-dsi/core/node_modules`. Two `styled-components` instances meant two React `ThemeContext`s: `<ApollionProvider>` set the theme on core's context while the app's own `styled()` read its own empty context, so `theme.breakpoints` was `undefined` and any `Grid`/`theme.breakpoints` consumer crashed.
37
+
38
+ Also loosened the `react`/`react-dom` peer ranges from the exact `19.2.6` to `^19.0.0`.
39
+
40
+ Note for consumers: `styled-components` is now a peer — apps must declare it directly (yarn Berry does not auto-install peers). Any app that already writes `styled()` against the Apollion theme already does.
41
+
42
+ ## 4.5.1
43
+
44
+ ### Patch Changes
45
+
46
+ - 461d7a1: fix(core): sync `APOLLION_CORE_VERSION` with package version + README subpaths
47
+ - `APOLLION_CORE_VERSION` was a stale hand-maintained literal: it reported
48
+ `4.1.0` through the 4.2→4.5 releases (the published 4.5.0 build exposed
49
+ `4.1.0` at runtime). Bumped to `4.5.0` and added `src/index.test.ts`, a
50
+ drift guard that fails `validate` whenever the literal and
51
+ `package.json#version` disagree.
52
+ - README "Setup mínimo"/"Theming" still showed the pre-v4 barrel import
53
+ (`import { ApollionProvider } from '@apollion-dsi/core'`), which throws under
54
+ the subpaths-only barrel (ADR-006 §3.7 E7). Rewrote the examples to granular
55
+ subpaths and added an explicit "Imports (v4 — subpaths-only)" section. The
56
+ barrel removal stays intentional; only the docs were out of sync.
57
+
58
+ ## 4.5.0
59
+
60
+ ### Minor Changes
61
+
62
+ - 1ebb3e3: Typography joins the `dimension` density axis — fixed root + `rem` scale (ADR-011)
63
+ - **Fixed root:** `GlobalStyle` emits `html { font-size: 100% }` (16px) instead of
64
+ the fluid `clamp(16px, 1vw + 12px, 28px)`. Product UI keeps stable reading
65
+ density on ultrawide/4K — large screens gain columns/space, not inflated text.
66
+ - **`createFont(input, dimension)`** mirrors `createSpacing`: the same
67
+ `<ApollionProvider dimension>` knob (multipliers `0.20 / 0.25 / 0.32`) now
68
+ drives type size, so spacing and typography scale together. `normal` is 1:1
69
+ with the previous px scale (`small` 16px → `1rem`).
70
+ - **Breaking (type):** `theme.font.fontSize.*` changed `number` → `string` (CSS
71
+ `rem`). Additive `theme.font.fontSizePx.*` carries the effective px for layout
72
+ math (e.g. `height = fontSizePx.small * ratio`). Style code that concatenated a
73
+ manual `px` suffix (`` `${theme.font.fontSize.small}px` ``) must drop it.
74
+ - **Tokens:** font left the axis-invariant `base` set — it is now emitted per
75
+ dimension as `font.<dimension>` sets (symmetric with `spacing.<dimension>`),
76
+ with `font.size.*` carrying the resolved `rem` value for that density.
77
+
78
+ ## 4.4.0
79
+
80
+ ### Minor Changes
81
+
82
+ - 1d0fcc6: feat(form): add `Switch` component — on/off toggle for immediate-effect settings.
83
+
84
+ Mirrors the `Checkbox`/`Radio` anatomy (`DefaultInputInterface`, semantic
85
+ `variant`, `label`/`labelProps`) and adds a `size` axis (`small`/`medium`/`large`).
86
+ Renders a native `<input type="checkbox" role="switch">`, keyboard-focusable
87
+ (Tab + Space), with a sliding thumb. Ships stories, tests (variant × size
88
+ snapshots), `README.mdx` + `README.AI.md`, barrel + generated subpath export
89
+ (`@apollion-dsi/core/form/switch`), and catalog/doc updates.
90
+
91
+ ## 4.3.1
92
+
93
+ ### Patch Changes
94
+
95
+ - ADR-010 follow-up: o elemento `Link` agora mira **AA + margem** (~5:1 contra `baseLight`) ao tornar a cor de acento legível via `readableColor`, garantindo ≥ AA também em superfícies levemente diferentes do `baseLight` — footer (`neutral.5`), cards, etc. A v4.3.0 mirava 4.5:1 contra `baseLight` e caía para ~4.42:1 no footer (sub-AA). `readableColor` ganha cobertura de teste da margem.
96
+
97
+ ## 4.3.0
98
+
99
+ ### Minor Changes
100
+
101
+ - ADR-010: `txtOn` por contraste de luminância (`getContrastColor`) — on-color **dark-mode-stable** para superfícies sólidas (marca + feedback/action + interface.function). Corrige o "escuro-no-escuro" em fundos de marca fixos (`main`) no dark mode: o texto agora deriva da luminância do próprio fundo, não do par `baseLight`/`baseDark` que o dark mode troca.
102
+
103
+ Novos tokens Foundation (aditivos): `bg.brand`, `text.onMain`, `text.onOpposite`, `text.onComplementary`.
104
+
105
+ Novo helper `readableColor(color, background, minRatio?)` (export de `themes/colors`) — ajusta a luminância OKLch de uma cor de acento até passar o piso WCAG contra um fundo, **preservando hue/croma** (diferente de `getContrastColor`). Aplicado no elemento `Link`: links de marca agora ficam legíveis sobre fundos escuros (dark mode) sem perder a cor.
106
+
107
+ ## 4.2.0
108
+
109
+ ### Minor Changes
110
+
111
+ - feat(form): `Checkbox`/`Radio` string labels render with DS typography; new `labelProps`
112
+
113
+ String labels now render through the DS `BaseText` styles instead of raw text,
114
+ and the new optional `labelProps` lets consumers override the label typography
115
+ (`fontSize`, `color`, `fontWeight`, …). `ReactNode` labels are rendered as-is,
116
+ unchanged.
117
+
118
+ - feat(themes): native dark mode in `ApollionProvider` + `useApollionTheme`
119
+ - `ApollionProvider` now implements the mode API its types already advertised:
120
+ the `lightTheme`/`darkTheme` pair, controlled `themeMode` +
121
+ `onThemeModeChange`, `useSystemPreference` (watches `prefers-color-scheme`,
122
+ SSR-safe) and `toggleTheme` via the new `useApollionTheme()` hook. The single
123
+ `theme` prop keeps working unchanged.
124
+ - Dark-mode contrast fixes: the `Tabs` header divider now uses a mode-symmetric
125
+ gray (`grayscale.30`), and `InputSelect` no longer hardcodes white — the
126
+ control and menu follow the same surface tokens as the other inputs
127
+ (`grayscale.0`/`baseLight`).
128
+ - Vendor isolation now also blocks `import type` of vendored libs, enforced
129
+ via `@typescript-eslint/no-restricted-imports` in the package lint config.
130
+ - Internal: the `entities/` folder was dissolved — the SSR-safe window helpers
131
+ (`$window`, `$documentBody`, `canuseDom`) moved into `utils` (still exported
132
+ via `@apollion-dsi/core/utils`); the unused `debounce`/`timer` entities were
133
+ removed (never part of the public API).
134
+ - Storybook: stories renamed to `<Component>.story.tsx` and new `Flex`/`Grid`
135
+ stories (not part of the published bundle).
136
+
137
+ ### Patch Changes
138
+
139
+ - 3321f56: fix(core): correct three DataTable/Calendar visual bugs
140
+ - **DataTable EmptyState** now centers horizontally. The 80%-wide empty block
141
+ was pinned to the left because the flex container (a `BaseContainer`, which
142
+ defaults to `flex-direction: column`) lacked `align-items: center` on its
143
+ cross axis.
144
+ - **DataTable pagination** no longer renders an empty scroll region when the
145
+ page size grows. The virtualizer now targets the element that actually
146
+ scrolls — `CustomScroll`'s inner node, exposed via a new optional
147
+ `scrollableRef` prop — instead of the non-scrolling outer container, so
148
+ `getScrollElement` reads the correct `scrollTop`/`clientHeight` and receives
149
+ scroll events.
150
+ - **Calendar** renders the day number on a day that is simultaneously today and
151
+ selected. A CSS specificity collision painted the number in `primary.base`
152
+ over the selected `primary.base` background (invisible); the today rule now
153
+ excludes selected days so the selected contrast color wins.
154
+
155
+ - b3cf796: fix(core): seed type-aware empty defaults in `Form` so fields mount controlled
156
+
157
+ `Form` passed `defaultValues: { ...initialValues }` to `useForm`, so a field
158
+ without an `initialValues` entry mounted with `value={undefined}` (uncontrolled)
159
+ and flipped to controlled on the first change — triggering React's
160
+ "changing an uncontrolled input to be controlled" warning. The new
161
+ `buildDefaultValues` helper seeds every field with a type-aware empty value
162
+ (`false` for checkbox/radio, `''` otherwise — same convention as `Field` reset),
163
+ with `initialValues` taking precedence. No public API change.
164
+
165
+ ## 4.1.0
166
+
167
+ ### Minor Changes
168
+
169
+ - d18737c: Add `DescriptionList` + widen `Field` hint props to `ReactNode` — closes two open "Gaps Apollion" tracked by DEX-Aggregator.
170
+ - **`DescriptionList`** (`@apollion-dsi/core/data-display/description-list`) — new `data-display` component: semantic key/value list (`<dl>`/`<dt>`/`<dd>`) under an optional title, `direction="row" | "column"`. Both `key` and `value` accept `ReactNode`. Absorbs the recurring "key/value card under a title" pattern that clients reimplemented locally (DEX-Aggregator `InfoCard`, ~210 LOC duplicated across 7 screens). Full doc surface (TSDoc + Storybook + README.mdx + README.AI.md) + unit tests.
171
+ - **`Field` hint props accept `ReactNode`.** `hintText`, `hintSuccessText` and `hintErrorText` widen from `string` to `React.ReactNode` (backward-compatible — `string ⊂ ReactNode`). Unblocks inline hint affordances — an action button ("use max"), a daily-limit `Text` — that previously had to render as a sibling outside `Field`, blocking deletion of the consumer wrapper (DEX-Aggregator `InputTextAdapter`).
172
+
173
+ No breaking change. `@apollion-dsi/tokens` bumps in lockstep (`.changeset/config.json#fixed`).
174
+
175
+ - 063e0e9: Align `@apollion-dsi/tokens` DTCG output with the Design Tokens Format Module 2025.10.
176
+ - **Structured values:** `color` `$value` is now an OKLch object `{ colorSpace, components, hex, alpha? }` and `dimension` is `{ value, unit }` (was bare hex / length strings).
177
+ - **Typed IR:** a single intermediate representation (`src/ir.ts`) drives the JSON/CSS/TS renderers as pure projections.
178
+ - **Reference graph:** JSON emits a `color` primitives layer (structural SSOT) and foundation `bg`/`text` colours reference it via DTCG aliases (`{color.primary.base}`), with inline fallback when a resolved value diverges (e.g. surface inversion).
179
+ - **Composite tokens:** `border` (dimension / strokeStyle), `typography` (fontFamily / fontWeight / number + dimension) and `shadow` (DTCG shadow composite) now ship; values DTCG cannot model (em `letterSpacing`, `textTransform`, `fontStyle`, `100%` radius) travel in `$extensions` under `com.apollion.*`.
180
+
181
+ `@apollion-dsi/core` now exports the `themes/{border,depth,font}` subpaths so tokens consumes them as the single source of truth.
182
+
183
+ CSS/TS outputs for the existing `bg`/`text`/`spacing` layers are byte-identical; JSON is the spec-interop surface.
184
+
185
+ ## 4.0.0
186
+
187
+ ### Major Changes
188
+
189
+ - bd7d6cb: # v4.0.0 — OKLch + Dimension + Token Split
190
+
191
+ The v4 epic per [ADR-006](../packages/core/docs/adr/ADR-006-v4-oklch-dimension-token-split.md) + [PRD-002](../packages/core/docs/prd/PRD-002-v4-epic-execution.md). DS-from-scratch (Q-G grilling 2026-05-24); no consumer migration. Greenfield adoption via [MIGRATION-v4.md](../packages/core/docs/migration/MIGRATION-v4.md).
192
+
193
+ ## Breaking — `@apollion-dsi/core@4.0.0`
194
+ - **Root barrel removed.** `import { Button } from '@apollion-dsi/core'` no longer works. Use granular subpaths (`@apollion-dsi/core/elements/button`). ESLint rule flips warn → error. ADR-001 Slice 6 finalized here. ADR-006 §3.7 E7.
195
+ - **OKLch palette derivation.** All `mount*Colors` helpers + `getOppositeColor` migrated from `color@5` RGB lerp to `culori@4` OKLch lerp. Validated by `spike/culori-oklch-lerp-parity` (0 unexpected regressions; greyscale 19× more uniform in OKLAB L). ADR-006 §2 B1 + §6 S2.
196
+ - **`defaultInputColors.opposite` token value changed.** OKLch hue rotation differs from HSL rotation (the OKLch is the perceptually correct opposite). Audit `theme.colors.opposite.*` consumers.
197
+ - **Dimension axis added.** `<ApollionProvider dimension="compact|normal|spacious">` is a new prop; default `normal` preserves v3.x spacing byte-exact. ADR-006 §6 S3.
198
+ - **`vendors/Color` eliminated.** Internal `color@5` vendor deleted (zero call-sites after S6 migration). `color` + `@types/color` removed from `package.json#dependencies`. WCAG functions migrated to `culori.wcagContrast` + `culori.wcagLuminance` (100% bit-exact parity per `spike/culori-wcag-parity`).
199
+ - **`invertForSurface(theme, surface, mode)` 3-arg signature.** `mode` is additive optional — existing 2-arg calls continue to work; `mode` is a placeholder for future PRD-003 mode-aware inversion. ADR-006 §6 S6.
200
+
201
+ ## Minor — `@apollion-dsi/eslint-config`
202
+ - `culori` + `zod` added to `VENDORED_V4_LIBS` — must import via `vendors/Culori|Zod`.
203
+ - `color` removed from `VENDORED_T2_LIBS` (eliminated).
204
+ - `no-restricted-imports` for `'@apollion-dsi/core'` root: `warn` → `error` (per v4 barrel removal above).
205
+
206
+ ## Major — `@apollion-dsi/tokens@4.0.0` (first release)
207
+
208
+ New package — framework-agnostic design tokens consumed via `runtime/v1` versioned API + `apollion-tokens build` CLI.
209
+ - **Strangler Fig builders** duplicated from core (`colors.ts`, `spacing.ts`); Foundation + Surface re-exported. Parity enforced by `__tests__/parity.test.ts`. ADR-006 §3.1 + §6 S4.
210
+ - **Atomic + idempotent build CLI.** `apollion-tokens build [--check] [--verbose] --config <path> [--out <dir>]`. Emits `dist/{css,json,ts}/*` + `dist/manifest.json` with sha256 audit trail. Rerun byte-identical. `--check` mode for CI gate. ADR-006 §3.5 + §6 S5.
211
+ - **DTCG-compliant JSON output** (tech-radar R1).
212
+ - **`as const` TypeScript output** (tech-radar R4).
213
+ - **CSS `@property` declarations** (tech-radar R3) + custom properties `--apollion-{layer}-{role}-{variant}`.
214
+ - **Sandboxed `apollion.config.mjs` loader** (`node:vm` + zod schema) — threat-model T2+E1 mitigation. ADR-006 §3.8 B3 + §6 S6.
215
+ - **Lockstep version** with `@apollion-dsi/core` via `.changeset/config.json#fixed`.
216
+
217
+ ## Minor — `@apollion-dsi/scripts`
218
+ - `codemods/v4-migrate.mjs` — one-way codemod (Q-G10: no `--revert`; DEX/Jovian/Fanaticofc don't consume v3.x, no legacy to revert). Transforms `invertForSurface` to 3-arg, flags `createTheme` for manual hoist to `apollion.config.mjs`. Transcript JSONL audit log.
219
+ - `verify-no-install-scripts.js` — supply-chain hardening; blocks `preinstall`/`install`/`postinstall` in `@apollion-dsi/*` workspaces (threat-model E2 mitigation).
220
+
221
+ ## Spike validation (preserved local, NOT merged to main)
222
+ - `spike/culori-wcag-parity` — 100.0000% bit-exact culori vs color@5 (262 measurements / 10 palettes). `vendors/Color` elimination LOCKED.
223
+ - `spike/culori-oklch-lerp-parity` — 0 unexpected regressions in 68 deltas; greyscale ramp 19× more uniform in OKLAB L. DECISION ✅ PROCEED.
224
+
225
+ - 879eedd: feat(core)!: ADR-007 S6 — hard cut Formik+Yup vendors (v4.0.0)
226
+
227
+ Completa a migração ADR-007 com a remoção definitiva do legacy stack
228
+ Formik+Yup. Vendors removidos, deps dropped, ESLint VENDORED_LIBS limpo.
229
+
230
+ **Removidos:**
231
+ - `packages/core/src/vendors/Formik/` — 4 arquivos (component.ts, interface.ts, index.ts, README.md).
232
+ - `packages/core/src/vendors/Yup/` — 4 arquivos (mesmo padrão).
233
+ - `formik@2.4.9` removido de `packages/core/package.json#dependencies`.
234
+ - `yup@1.7.1` removido de `packages/core/package.json#dependencies`.
235
+ - `formik` + `yup` removidos de `packages/eslint-config/index.js` `VENDORED_T1_FORM_LIBS`.
236
+ - `yarn.lock` shrunk em ~932 KiB (-9 transitive packages).
237
+
238
+ **Estado pós-S6:**
239
+ - 0 imports diretos de `formik`/`yup` em `packages/core/src/**` e `website/src/**`.
240
+ - `corepack yarn workspace @apollion-dsi/core run check-types`: ✅
241
+ - `corepack yarn workspace @apollion-dsi/core run lint`: ✅
242
+ - `corepack yarn workspace @apollion-dsi/core run validate:tests`: ✅ 317 passed (1 skipped pre-existente), 59 snapshots OK.
243
+ - `corepack yarn workspace @apollion-dsi/website run build`: ✅
244
+ - Bundle form-basic/form-form/form-dynamic: 422 kB First Load JS (unchanged vs S3 — Formik/Yup já eram dead code desde S3).
245
+
246
+ **Status ADR-007:** ✅ Implemented. Todos S0-S6 mergeados.
247
+
248
+ **Achado de sessão:** ADR-006 v4 epic já estava ✅ Implemented (2026-05-25,
249
+ commit `4188501`). O "gate v4.0.0" para S6 era apenas pendência de
250
+ execução, não bloqueio externo. S6 executado imediatamente.
251
+
252
+ **Trabalho restante (fora do escopo ADR-007):**
253
+ 1. `corepack yarn version` — consolida changesets queued, bumpa
254
+ `@apollion-dsi/core@3.0.0 → 4.0.0` (lockstep com `@apollion-dsi/tokens`).
255
+ 2. `corepack yarn release` — npm publish com `--provenance` (ADR-006 §AI-7).
256
+ 3. Visual regression 3-browser full pass na CI antes do release.
257
+
258
+ **Breaking changes consumer-facing (já documentados em MIGRATION-v4.md §1-§8):**
259
+ - `validation` prop em `<Form fields>` agora aceita `ZodTypeAny` (era Yup).
260
+ - `validateOnChange`/`validateOnBlur` booleans → `mode?: Mode` enum.
261
+ - `onError(errors)` recebe `FieldErrors` (era `FormikErrors`).
262
+ - `handleSubmit(values, methods)` recebe `UseFormReturn` no 2º arg (era `FormikHelpers`).
263
+ - `FormRef` type aponta para `UseFormReturn<any>` (era `FormikProps<any>`).
264
+ - `formik` + `yup` removidos de transitive deps — consumers que importavam diretamente do core via barrel devem trocar para `import { z } from 'zod'` / `import { useForm } from 'react-hook-form'` direto.
265
+
266
+ Ver `packages/core/docs/adr/ADR-007-form-stack-rhf-zod.md` §6 Slice 6 +
267
+ `packages/core/MIGRATION-v4.md` para guia consumer-side completo.
268
+
269
+ - e2abc9c: feat(core)!: ADR-008 — router-agnostic polymorphic Link (v4.0.0)
270
+
271
+ `<Link>` deixa de depender de `react-router-dom`. Refactor para polymorphic
272
+ component via prop `as` — default `<a>` nativo; consumer passa
273
+ `as={NextLink}`/`as={RouterLink}`/`as={RemixLink}` para SPA navigation.
274
+
275
+ **Removidos:**
276
+ - `packages/core/src/vendors/ReactRouterDom/` (4 files).
277
+ - `react-router-dom@7.15.0` de `packages/core/package.json#dependencies`.
278
+ - `react-router-dom` de `packages/eslint-config/index.js` `VENDORED_T1_DATA_LIBS`.
279
+ - `<MemoryRouter>` wrapper de `website/pages/_app.jsx` (era só para satisfazer Link RRD-based).
280
+ - Yarn lockfile shrunk **−4.17 MiB** (−4 packages: `react-router-dom`, `react-router`, `cookie`, `set-cookie-parser`).
281
+
282
+ **Refatorados:**
283
+ - `elements/Link/Link.tsx` — single render path; `effectiveAs = isExternal ? 'a' : as`; dropped `getRoute()` helper.
284
+ - `elements/Link/Link.style.ts` — `LinkStyle` + `LinkButtonStyle` base em `baseStyled.a`; styled-components forward `as` prop. Eliminados styles redundantes (`ExternalLinkStyle`, `ExternalLinkButtonStyle`).
285
+ - `elements/Link/Link.interface.ts` — drop `Partial<LinkProps>`; add `as?: React.ElementType` + `to?: any`.
286
+ - `elements/Link/Link.test.tsx` — drop `<Router>` wrapper + `jest.mock('react-router-dom')`.
287
+ - `elements/Link/story.tsx` — drop `MemoryRouter` decorator.
288
+ - `elements/List/story.tsx` — drop `MemoryRouter` decorator (era scaffolding-only).
289
+ - `elements/List/List.tsx` — `<Link to={item.to}>` → `<Link href={item.to}>`.
290
+ - `elements/Link/README.mdx` + `README.AI.md` — rewrite com pattern `as={NextLink}` / `as={RouterLink}`.
291
+ - `hooks/useUnload/README.mdx` — remove exemplo legacy com `<Prompt>` (Prompt nem existe em react-router v6+).
292
+
293
+ **Bundle delta (Next.js First Load JS, website pós-build):**
294
+
295
+ | Page | Pre | Post | Δ |
296
+ | ------------------- | -----: | -----: | -------------: |
297
+ | `form-basic` | 422 kB | 410 kB | −12 kB / −2.8% |
298
+ | `form-form` | 422 kB | 410 kB | −12 kB / −2.8% |
299
+ | `form-input-select` | 411 kB | 399 kB | −12 kB / −2.9% |
300
+ | Shared chunks | 211 kB | 199 kB | −12 kB / −5.7% |
301
+
302
+ **12 kB real savings** em todas pages do website — `react-router-dom` saía amortizado em shared chunks. Aplica também a consumers externos que não usavam RRD (Next.js, Remix). Contraste com ADR-007 (Form migration) que ficou em +1.2%.
303
+
304
+ **Breaking change consumer-facing** (documentado em MIGRATION-v4.md §ADR-008):
305
+ - `<Link to="/x">` sem `as` vira no-op silencioso. Migrar para `<Link as={RouterLink} to="/x">` ou `<Link href="/x">`.
306
+ - `<MemoryRouter>` wrappers que só existiam para satisfazer DS Link podem ser removidos.
307
+
308
+ **Validation:**
309
+ - check-types ✅ / lint ✅ / 317 tests ✅ / 59 snapshots ✅ / core build ✅ / website build ✅
310
+ - 0 imports de `react-router-dom` em `packages/core/src/**` e `website/src/**` (only docs/JSDoc examples remain — legítimos).
311
+
312
+ ROADMAP entry "Router-agnostic Link" → ✅ COMPLETE. ADR-008 Status → ✅ Implemented.
313
+
314
+ Ver `packages/core/docs/adr/ADR-008-router-agnostic-link.md` para análise completa + `packages/core/MIGRATION-v4.md` §ADR-008 para guia consumer-side.
315
+
316
+ ### Minor Changes
317
+
318
+ - 32f7a1d: feat(themes): ADR-002 Slice 2 — Semantic alias layer
319
+
320
+ Adds `theme.semantic` — the intent-named token layer that mirrors Aplica DS
321
+ taxonomy (`semantic.<category>.<group>.<state>.<property>`) and derives
322
+ from the existing structural theme without breaking it.
323
+
324
+ Public API:
325
+ - `theme.semantic.color.feedback.{success|danger|warning|information}.{bg|txtOn|border}`
326
+ - `theme.semantic.color.interface.function.{primary|secondary|tertiary}.normal.{bg|txtOn}`
327
+ - `theme.semantic.color.brand.{first|second|third}.default.{surface|txtOn}`
328
+ - `theme.semantic.dimension.spacing.{zero..giant}` (pre-resolved CSS strings)
329
+ - `createSemantic(input)` helper — pure, idempotent, no side-effects
330
+ - Granular subpath import: `@apollion-dsi/core/themes/semantic`
331
+
332
+ Backward-compatible: `theme.colors.*`, `theme.spacing(...)` and all other
333
+ structural tokens remain untouched. Components migrate at their own pace.
334
+
335
+ Also fixes a latent regression in `scripts/generate-exports.js` that would
336
+ overwrite `package.json#sideEffects` (currently `false` since the v3.0.0
337
+ side-effects-free refactor) back to the legacy allow-list.
338
+
339
+ See `packages/core/docs/adr/ADR-002-layered-theme-aliases-and-surface.md`
340
+ §3, §6 (Slice 2), §9 (grill-with-docs validations).
341
+
342
+ - 2dadba5: feat(themes): ADR-002 Slice 3 — Foundation alias layer
343
+
344
+ Adds `theme.foundation` — ergonomic short aliases over Semantic, designed
345
+ as the **default layer for product code** (DEX, Jovian, Fanaticofc).
346
+
347
+ Public API:
348
+ - `theme.foundation.bg.{primary, secondary, tertiary, success, danger, warning, info}`
349
+ - `theme.foundation.text.{onPrimary, onSecondary, onTertiary, onSuccess, onDanger, onWarning, onInfo}`
350
+ - `theme.foundation.spacing.{xs, sm, md, lg, xl, xxl}` (pre-resolved CSS strings)
351
+ - `createFoundation(semantic)` helper — pure, idempotent (ADR-002 §9 contract)
352
+ - Subpath import: `@apollion-dsi/core/themes/foundation`
353
+ - Cheatsheet: `packages/core/src/themes/Foundation/README.md`
354
+
355
+ Layer-of-choice rule (CONCEPTS.md §3):
356
+ - Product code → Foundation
357
+ - Core components → Semantic
358
+ - Engine internals → Structural (unchanged)
359
+
360
+ Backward-compatible: no breaking change. Existing `theme.colors.*`,
361
+ `theme.spacing(...)`, `theme.semantic.*` remain intact.
362
+
363
+ Storybook MDX cheatsheet deferred (themes folder has no story precedent
364
+ in repo) — replaced by Markdown cheatsheet co-located with the layer.
365
+
366
+ See `packages/core/docs/adr/ADR-002-layered-theme-aliases-and-surface.md`
367
+ §3, §6 (Slice 3).
368
+
369
+ - 820a612: feat(themes): ADR-002 Slice 4 — Surface inversion (positive / negative)
370
+
371
+ Adds contextual surface inversion for Semantic + Foundation **without
372
+ touching Structural**, resolving the "dark card on light page" hack
373
+ documented in ADR-002 §2.
374
+
375
+ Public API:
376
+ - `<SurfaceProvider surface="positive" | "negative">` — lightweight wrapper
377
+ for subtree inversion (preferred). Uses styled-components theme function
378
+ pattern (ADR-002 §9 grill-with-docs §1).
379
+ - `invertForSurface(theme, surface)` — pure, idempotent helper (ADR-002 §9).
380
+ - `ApollionProvider` now accepts `surface` prop for app-wide inversion.
381
+ - New type: `SurfaceMode = 'positive' | 'negative'`.
382
+ - Subpath import: `@apollion-dsi/core/themes/surface`.
383
+ - Quick docs: `packages/core/src/themes/Surface/README.md`.
384
+
385
+ Semantics of inversion (v1):
386
+ - Structural (`theme.colors.*`, `theme.spacing(...)`) untouched.
387
+ - `foundation.bg.{primary,secondary,tertiary}` → `colors.baseDark`.
388
+ - `foundation.bg.<feedback>` → `colors.<feedback>.dark` (hue preserved).
389
+ - `foundation.text.*` → `colors.baseLight` (always).
390
+ - `semantic.color.brand.{n}.default.surface` → `colors.<brand>.dark`.
391
+ - `semantic.color.feedback.<state>.border` → `colors.<state>.base`.
392
+
393
+ Tests: 17 new cases including WCAG contrast sanity checks and subtree
394
+ isolation (negative does not leak to siblings).
395
+
396
+ Limitations (v1, deferred to ADR-003 / v4 epic):
397
+ - Inversion is deterministic and ignores `themeMode` — Apollion v3.x has
398
+ no algorithmic mode resolution yet. v4 will introduce "negative within
399
+ the current mode" semantics per Aplica DS Mode × Surface matrix.
400
+
401
+ Refs:
402
+ - packages/core/docs/adr/ADR-002-layered-theme-aliases-and-surface.md §3.2, §6, §9
403
+ - packages/core/src/themes/Surface/README.md (full cheatsheet)
404
+
405
+ 🎉 ADR-002 epic complete (Slices 1-4 shipped, 3.0.0 → 3.3.0).
406
+
407
+ - 75961a1: feat: novo `Calendar` primitive + `InputDate` reescrito com popover Apollion-styled
408
+
409
+ Substitui o antigo wrapper de `<input type="date">` nativo por um popover
410
+ Apollion-styled. Resolve dois problemas distintos:
411
+ 1. **Bug crítico no `form/Input`**: o default `value = ''` em
412
+ `Input.tsx:27` forçava todos os Inputs ao modo controlled mesmo quando
413
+ o consumer passava apenas `defaultValue`. Afetava `InputDate`,
414
+ `InputCurrency`, `InputMask`, etc. — sintoma reportado era "valor não
415
+ atualiza ao selecionar". Fix cirúrgico + regressão em `Input.test.tsx`.
416
+ 2. **Visual inconsistente cross-browser do `InputDate`**: o picker nativo
417
+ variava de UA pra UA e Safari Desktop não tinha picker nenhum.
418
+
419
+ Mudanças:
420
+ - **Novo:** `elements/Calendar` — primitive de grid headless sobre
421
+ `react-day-picker@9`. Modos `single`/`multiple`/`range`, locale via
422
+ `date-fns` (default `ptBR`), `disabled`/`hidden` via `Matcher`. Não
423
+ cuida de posicionamento — é grid puro. Stories Default/Range/Locale/MinMax.
424
+ - **Refatorado:** `form/InputDate` — `Input[type=text readOnly]` + popover
425
+ com `@floating-ui/react` + `Paper` + `Calendar`. API **drop-in**:
426
+ `onChange: (e: ChangeEvent<HTMLInputElement>) => void` preservado via
427
+ synthetic event (`target.value` em ISO `yyyy-MM-dd`). Adicional
428
+ `onValueChange: (iso) => void` para código novo. Novas props: `locale`,
429
+ `displayFormat`, `minDate`, `maxDate`, `disabledDates`.
430
+ - **Fix:** `form/Input` deixa de forçar `value=""` quando consumer omite
431
+ `value`. Permite `defaultValue` funcionar.
432
+ - **Novo ícone:** `calendar` em `icons/Icons/categoryInterface.tsx`.
433
+ - **Deps:** `react-day-picker@9.5.0`, `date-fns@4.1.0`. ~25 KB gzip.
434
+ - **Subpath export:** `@apollion-dsi/core/elements/calendar` registrado em
435
+ `package.json#exports`.
436
+
437
+ Sem breaking change. Consumers existentes do `InputDate` (zero hoje em
438
+ DEX/Jovian/Fanaticofc) continuam funcionando — `onValueChange` é o caminho
439
+ novo recomendado.
440
+
441
+ Ver `docs/ROADMAP.md` §🟡 Next ("Calendar primitive + InputDate refactor"
442
+ ✅ COMPLETE 2026-05-27).
443
+
444
+ - fba9a41: feat(core): DataTable absorbs faceted filters (per-column drill-down)
445
+
446
+ ROADMAP §🟡 Next "DataTable absorption gaps" — 3rd sub-feature
447
+ shipped (after pagination + tree expansion). Remaining: column
448
+ reordering + detail-panel expansion (deferred — conflicts with
449
+ fixed-row-height virtualizer).
450
+
451
+ Shipped across 4 vertical slices (+ 2 visual baseline commits):
452
+ - **S1** (`552e1ca`) — Vendor extension: added `getFacetedRowModel`,
453
+ `getFacetedUniqueValues`, `getFacetedMinMaxValues` runtime exports
454
+ and `ColumnFiltersState`, `FilterFn` type re-exports to
455
+ `vendors/TanstackReactTable/`. Wrapper test grew from 15 to 21
456
+ invariant cases (`TanstackReactTable.test.ts`).
457
+ - **S2** (`865525c` + baseline `90ce176`) — DataTable wiring + filter
458
+ UI + bonus dead-code fix. New `DataTable.filters.tsx` houses three
459
+ pure sub-components anchored in `<Dropdown>` popovers off the
460
+ header filter icon: - `SelectFilter` — multi-select checkboxes with counts (uses
461
+ `getFacetedUniqueValues()`). - `RangeFilter` — 2 number inputs (uses
462
+ `getFacetedMinMaxValues()` for placeholders). Apply debounced
463
+ 200ms. - `TextFilter` — single input. Case-insensitive contains. Apply
464
+ debounced 200ms. - `VARIANT_FILTER_FN` resolver maps
465
+ `'select' → 'arrIncludesSome'`, `'range' → 'inNumberRange'`,
466
+ `'text' → 'includesString'`. Consumer overrides via
467
+ `Column.filterFn`.
468
+
469
+ New styled `HeaderControls` grouper centralizes the filter + sort
470
+ icon alignment in the header cell. Filter icon click stops
471
+ propagation so it does NOT toggle sort. `useReactTable` spreads
472
+ faceted helpers + columnFilters state conditionally on
473
+ `hasAnyFilter` (derived from `columns.some(c =>
474
+
475
+ c.filterVariant && !c.disableFilters)`) — zero overhead when no
476
+ column opts in.
477
+
478
+ **Bonus fix:** activates `Column.disableFilters` (was no-op for
479
+ multiple cycles). Now hides the filter icon AND sets
480
+ `enableColumnFilter: false` on the corresponding ColumnDef.
481
+
482
+ Filter icon: `ellipsisH` (3-dot more-options) — DS icon registry
483
+ has no `filter`/`funnel` icon; `ellipsisH` reads as "open options".
484
+ A dedicated SVG can land later without changing the public API.
485
+
486
+ Existing 5 DataTable visual baselines regen'd: the `<HeaderControls>`
487
+ wrapper shifts the sort icon's spacing by `theme.spacing('xs')` on
488
+ any sortable column, even when no filter chrome is rendered. The
489
+ functional behavior is unchanged — click on the header still
490
+ toggles sort.
491
+
492
+ - **S3** (`2ce44ef` + baseline `b9fa130`) — New `FacetedFiltering`
493
+ story with 4 columns showcasing all three variants + a
494
+ `disableFilters` override. 9 new jsdom-observable smoke tests
495
+ (mounts per variant, header text co-exists with chrome,
496
+ `disableFilters` honored, controlled / initialColumnFilters,
497
+ consumer filterFn override, default-off path).
498
+ - **S4** (this commit) — README.mdx adds "Filtros por coluna
499
+ (faceted)" section with variant table, controlled + uncontrolled
500
+ examples, `filterFn` override pattern, and the i18n / pipeline /
501
+ drill-down notes. README.AI.md grows by 5 rows (Column-level
502
+ `filterVariant` + `filterFn` + DataTable-level
503
+ `initialColumnFilters`, `columnFilters`, `onColumnFiltersChange`).
504
+ `disableFilters` description corrected (was "exclude from global
505
+ filter" — actually it opts the column out of the per-column filter
506
+ pipeline AND hides the filter icon).
507
+
508
+ New props on `DataTableProps` (all optional, default-off):
509
+ - `initialColumnFilters?: ColumnFiltersState` — uncontrolled init.
510
+ - `columnFilters?: ColumnFiltersState` — controlled state.
511
+ - `onColumnFiltersChange?: OnChangeFn<ColumnFiltersState>` — controlled
512
+ callback; also fires in uncontrolled mode as observer (via reused
513
+ `useHybridState` helper from S2/S3 #8).
514
+
515
+ New props on `Column<T>`:
516
+ - `filterVariant?: 'select' | 'range' | 'text'` — opt-in switch +
517
+ drives UI choice.
518
+ - `filterFn?: FilterFn<T> | string` — custom filter logic override.
519
+
520
+ Non-breaking for existing consumers — all new props default-off. The
521
+ `Column.disableFilters` activation is technically observable but the
522
+ declared semantics were already what the docs said; the no-op was the
523
+ bug.
524
+
525
+ 40 suites · 318 tests passing. Coverage 69.72 / 50.57 / 56.65 / 69.42
526
+ (vs floors 68/48/53/67).
527
+
528
+ - 3a90653: feat(core): DataTable absorbs pagination + expandable tree rows
529
+
530
+ ROADMAP §🟡 Next "DataTable absorption gaps" — 2 of 4 sub-features
531
+ shipped this cycle. The remaining 2 (column reordering, faceted
532
+ filters) stay open for future cycles; detail-panel expansion is
533
+ documented as a separate gap (conflicts with the fixed-row-height
534
+ virtualizer).
535
+
536
+ Shipped across 4 vertical slices:
537
+ - **S1** (`e53fec6`) — Vendor extension: added `getPaginationRowModel`
538
+ - `getExpandedRowModel` runtime exports and `PaginationState`,
539
+ `ExpandedState`, `OnChangeFn` type re-exports to
540
+ `vendors/TanstackReactTable/`. Closed the pre-existing wrapper-test
541
+ gap (15 invariant cases mirror FloatingUI / TanstackReactVirtual S1
542
+ pattern).
543
+ - **S2** (`ac54bd8` + baseline `3d3a45e`) — Pagination: opt-in via
544
+ `paginated: true`. New `PaginationRow` styled + `PaginationControls`
545
+ pure component (`"Mostrando X-Y de Z"` + Anterior / page indicator /
546
+ Próximo + page-size dropdown). Hybrid state pattern via new
547
+ `useHybridState<T>` helper that unifies controlled/uncontrolled in a
548
+ single `[value, setValue]` callsite. New `Paginated` story + 1
549
+ visual baseline. 8 new tests.
550
+ - **S3** (`808d162` + baseline `763bbe6`) — Expandable tree: opt-in
551
+ via `getSubRows` callback. New `buildExpandColumnDef` helper mirrors
552
+ `buildSelectableColumnDef`; expand toggle column injected leftmost
553
+ (read order: "control the tree → select what you see → consume
554
+ data"). Chevron indented by `row.depth * 16px`. `useHybridState`
555
+ reused for `ExpandedState`. New `Expandable` story + 1 baseline. 5
556
+ new tests.
557
+ - **S4** (this commit) — README.mdx adds "Paginação client-side" +
558
+ "Linhas expansíveis (modo tree)" sections with controlled +
559
+ uncontrolled examples. README.AI.md props table extended with the
560
+ 10 new props. ROADMAP entry stays in `🟡 Next` annotated with the
561
+ shipped sub-features.
562
+
563
+ New props on `DataTableProps` (all optional, default-off):
564
+
565
+ Pagination:
566
+ - `paginated?: boolean` — opt-in flag.
567
+ - `initialPagination?: Partial<PaginationState>` — uncontrolled init.
568
+ - `pagination?: PaginationState` — controlled state.
569
+ - `onPaginationChange?: OnChangeFn<PaginationState>` — controlled
570
+ callback; also fires in uncontrolled mode as observer.
571
+ - `pageSizeOptions?: number[]` — default `[10, 25, 50, 100]`. Empty
572
+ or single-element hides the page-size selector.
573
+
574
+ Expandable (tree mode):
575
+ - `getSubRows?: (row: T, index: number) => T[] | undefined` — opt-in.
576
+ - `expandedColumnWidth?: number` — defaults to
577
+ `selectableColumnWidth`.
578
+ - `initialExpanded?: ExpandedState` — uncontrolled init (use `true`
579
+ to expand all).
580
+ - `expanded?: ExpandedState` — controlled state.
581
+ - `onExpandedChange?: OnChangeFn<ExpandedState>` — controlled callback.
582
+
583
+ Non-breaking for existing consumers — all new props default-off, none
584
+ of the 21 existing DataTable visual baselines drift, public API of
585
+ `DataTableProps` is purely additive.
586
+
587
+ Strings (`"Mostrando X-Y de Z"`, `"Anterior"`, `"Próximo"`,
588
+ `"{N} / página"`) hardcoded PT-BR — consistent with `EmptyTable`'s
589
+ default `"Nada foi encontrado"`. Apollion has no i18n layer today;
590
+ documented gap.
591
+
592
+ 40 suites · 302 tests passing. Coverage `70.46 / 50.95 / 57.73 /
593
+ 70.17` (vs floors `68 / 48 / 53 / 67`).
594
+
595
+ - 5fca933: feat(core): swap `react-window` for `@tanstack/react-virtual` in DataTable
596
+
597
+ ROADMAP §🟡 Next "Migrate ReactWindow → @tanstack/react-virtual" closes
598
+ across 4 vertical slices:
599
+ - **S1** (`456b13e`) — Scaffolded `vendors/TanstackReactVirtual/`
600
+ re-exporting `useVirtualizer` + `Virtualizer` + `VirtualItem` from
601
+ `@tanstack/react-virtual@^3.13.26`. 3 wrapper-invariant unit tests
602
+ modeled on ADR-005 S2.
603
+ - **S2** (`e04e6c4`) — Refactored `DataTable.tsx` virtualization block
604
+ to use the hook via a small internal `VirtualizedRows` wrapper. The
605
+ public `renderRow({ index, style })` callsite contract stayed
606
+ stable. Dropped the file-level `@ts-ignore` and the inline
607
+ `@ts-ignore TS2786` over the JSX block. Replaced
608
+ `outerElementType={VitualScrollbar}` with direct
609
+ `<VitualScrollbar ref={parentRef}>`. Added 4 jsdom-observable
610
+ characterization tests (mount / headers / empty state). Refreshed
611
+ one visual-regression baseline (`components-datatable--bordered`,
612
+ 0.19% pixel drift on transform-vs-absolute border rendering).
613
+ - **S3** (`04d9f7e`) — Added 8 wide-scope smoke tests: header chrome
614
+ (title / hasHeader gating / search placeholder), header checkbox
615
+ select-all + deselect cycles via `onRowSelect`, spacing-menu
616
+ rendering, sortable-header click cycle.
617
+ - **S4** (this commit) — Removed `vendors/ReactWindow/` and the
618
+ `react-window` + `@types/react-window` deps. Flipped the
619
+ `VENDORED_T1_UI_LIBS` allow-list in `@apollion-dsi/eslint-config`
620
+ to replace `'react-window'` with `'@tanstack/react-virtual'` so the
621
+ vendor-isolation rule keeps catching future direct imports outside
622
+ `src/vendors/**`.
623
+
624
+ Why the swap (driver):
625
+ 1. **Same family as `@tanstack/react-table`** (already vendored). One
626
+ fewer mental model, one fewer audit surface.
627
+ 2. **React 19 + TS 6 compatibility.** `react-window` is class-component
628
+ with an incompatible type shape — required `@ts-ignore TS2786` at
629
+ the JSX site. Hook surface removes that debt.
630
+ 3. **Variable-row-height unlocked.** `useVirtualizer` exposes
631
+ `estimateSize: (i) => number` + opt-in `measureElement`. Future
632
+ DataTable variable-row work (ROADMAP §🟡 "DataTable absorption
633
+ gaps") needs no further vendor swap.
634
+
635
+ Non-breaking for consumers — `DataTable<T>` public API
636
+ (`data` / `columns` / `height` / `striped` / `bordered` / `hasHeader` /
637
+ `onRowSelect` / `renderRow`-like callbacks via `Column.Cell`) stays
638
+ identical. Bundle delta: react-window 1.8.11 + @types/react-window
639
+ 1.8.8 (~7 KB shipped + types) out, @tanstack/react-virtual 3.13.26 +
640
+ @tanstack/virtual-core 3.16.0 (~12 KB shipped) in. Net node_modules
641
+ freed: 929 KiB.
642
+
643
+ Coverage at the end of the swap: statements 69.95 / branches 49.69 /
644
+ functions 56.08 / lines 69.63 — comfortably above the ratchet floors
645
+ (68 / 48 / 53 / 67). +1 vendor test suite + 1 DataTable test suite (12
646
+ cases total).
647
+
648
+ - ea3dc3a: feat(core): swap `@tippyjs/react/headless` for `@floating-ui/react` in Tooltip + Dropdown
649
+
650
+ ROADMAP §🟡 Next "Migrate TippyHeadless → @floating-ui/react" closes
651
+ across 4 vertical slices, all landed in the same day:
652
+ - **S1** (`f75e428`) — Scaffolded `vendors/FloatingUI/` re-exporting
653
+ the runtime surface from `@floating-ui/react@^0.27.19`: 10 hooks
654
+ (`useFloating`, `useInteractions`, `useClick`, `useHover`,
655
+ `useFocus`, `useDismiss`, `useRole`), 2 components
656
+ (`FloatingPortal`, `FloatingFocusManager`), 5 middleware (`arrow`,
657
+ `offset`, `flip`, `shift`, `autoUpdate`), 4 types (`Placement`,
658
+ `Strategy`, `MiddlewareData`, `OpenChangeReason`). 29 wrapper-
659
+ invariant unit tests (singleton + runtime shape + type re-exports).
660
+ - **S2** (`d61a111`) — Refactored `Tooltip.tsx` from `<Tippy
661
+ render={…}>` to `useFloating + useInteractions([useHover(restMs: 40),
662
+ useFocus(), useDismiss(), useRole({ role: 'tooltip' })])`. Added
663
+ `useFocus` per Q2 of the grill so the tooltip also opens on Tab
664
+ focus (a11y AAA). Arrow positioning is now inline at the callsite,
665
+ reading `middlewareData.arrow.{x, y}` (Q3 option a). Tooltip gained
666
+ its first `.test.tsx` (6 cases on the controlled `visible` path —
667
+ jsdom can't observe uncontrolled hover/focus). Dropped the
668
+ `@ts-ignore TS2786`.
669
+ - **S3** (`681f73b`) — Refactored `Dropdown.tsx` to `useFloating +
670
+ useInteractions([useClick({ enabled: !function-children }),
671
+ useHover({ enabled: hoverable }), useDismiss(), useRole({ role })])`.
672
+ Per Q1.a: `role: 'menu'` when `options` prop is passed, `role:
673
+ 'dialog'` when arbitrary `content` — `useRole(context, { role })`
674
+ injects the correct `aria-haspopup` and the floating-element role.
675
+ Wraps the floating element in `<FloatingPortal>` +
676
+ `<FloatingFocusManager modal={false} initialFocus={-1}>` (no trap,
677
+ no auto-focus jump — preserves the legacy click-and-pick UX).
678
+ Existing 5 tests in `Dropdown.test.tsx` pass unchanged. Dropped
679
+ the `@ts-ignore TS2786`.
680
+ - **S4** (this commit) — Removed `vendors/TippyHeadless/` and the
681
+ `@tippyjs/react` dep. Flipped the `VENDORED_T1_UI_LIBS` allow-list
682
+ in `@apollion-dsi/eslint-config` to replace
683
+ `'@tippyjs/react/headless'` with `'@floating-ui/react'` so the
684
+ vendor-isolation rule keeps catching future direct imports outside
685
+ `src/vendors/**`. Removed the corresponding ROADMAP entry per the
686
+ new convention (drop completed items instead of striking them
687
+ through — see `7c2d253`).
688
+
689
+ Why the swap (driver):
690
+ 1. **`tippy.js` sem release ≥ 18 meses.** `floating-ui` is the de
691
+ facto successor, maintained by the original Popper author whose
692
+ library `tippy.js` already wrapped internally. Same family, zero
693
+ functional regression in the consumer-facing surface.
694
+ 2. **Explicit a11y.** Tippy didn't dictate ARIA. `useRole(context, {
695
+ role })` injects `role="tooltip" | "menu" | "dialog"` plus the
696
+ matching `aria-haspopup` / `aria-describedby` linkage via prop
697
+ getters. A11y is now code, not hope.
698
+ 3. **Composição visível.** `<Tippy interactive onClickOutside={…}>`
699
+ packaged hover/click/focus/dismiss into a single opaque boolean.
700
+ floating-ui demands `useInteractions([useClick, useHover, useFocus,
701
+ useDismiss, useRole])` — the reader knows exactly which behaviors
702
+ are wired. Tested invariants per `enabled` flag.
703
+ 4. **Type ergonomics.** Pure hooks — no `@ts-ignore TS2786` (which
704
+ was required in 2 sites with React 19 + TS 6).
705
+
706
+ Non-breaking for consumers — `TooltipProps` and `DropdownProps`
707
+ public surface unchanged. `interactive?: boolean` on `Tooltip` is
708
+ kept as a `@deprecated` legacy no-op because floating-ui's tooltip is
709
+ inherently interactive (hover/focus on the floating element doesn't
710
+ trigger dismiss). `position` props now type as `Placement` from
711
+ `@floating-ui/react` — same 12 string-literal values as Tippy.
712
+
713
+ Bundle delta:
714
+ - Out: `@tippyjs/react@4.2.6` + transitive `tippy.js@6.3.7` (~2.23 MiB
715
+ on disk, ~16 KB shipped).
716
+ - In: `@floating-ui/react@0.27.19` + transitive `@floating-ui/react-
717
+ dom`, `@floating-ui/utils`, `tabbable` (~911 KiB on disk, ~11 KB
718
+ shipped).
719
+ - Net: ~5 KB shipped reduction; ~1.32 MiB node_modules freed.
720
+
721
+ Coverage at the end of the swap: statements 70.25 / branches 49.97 /
722
+ functions 57.37 / lines 70.01 — comfortably above the ratchet floors
723
+ (68 / 48 / 53 / 67). +1 vendor test suite (29 cases) + 1 Tooltip test
724
+ suite (6 cases).
725
+
726
+ ### Patch Changes
727
+
728
+ - 032f81c: docs: ADR-002 Slice 1 — CONCEPTS.md + README lineage
729
+
730
+ Adds conceptual reference document covering the Layer Cake (Structural →
731
+ Semantic → Foundation), 3-group communication model (Abstraction / Intent /
732
+ Consumer), Learning Spiral with three personas, bilingual glossary (PT-BR /
733
+ EN-US), and the Apollion ⇄ Aplica DS vocabulary map.
734
+
735
+ Credits Fernando Poe (co-author of Apollion 2020, author of
736
+ [Aplica DS](https://aplica.me/en/)) in a new Lineage & Acknowledgements
737
+ section of the README.
738
+
739
+ Doc-only. Zero API change.
740
+
741
+ See `packages/core/docs/adr/ADR-002-layered-theme-aliases-and-surface.md` §6
742
+ (Migration Plan, Slice 1).
743
+
744
+ - c056ee3: chore(core,eslint-config): ADR-004 backfill — vendor `react-day-picker` + `date-fns` + InputDate hardening
745
+
746
+ Pattern-guardian audit do commit `75961a1 Input Date` (Calendar primitive +
747
+ InputDate refactor) flagueou 4 desvios vs Apollion gold standard. Backfill
748
+ consolidado neste PR:
749
+
750
+ **V1 — ADR-004 backfill (2 novos vendors, vendor count 16 → 18):**
751
+ - **ReactDayPicker** (T1 UI, 4 files)
752
+ - Absorbed runtime: `DayPicker`
753
+ - Absorbed types: `DayPickerProps`, `Mode`, `DateRange`, `Matcher`,
754
+ `PropsSingle`, `PropsSingleRequired`, `PropsRange`, `PropsRangeRequired`
755
+ - Gap intencional: `useDayPicker` hook, `Modifier` API, plugins `addons`
756
+ — reabsorver quando `InputDateTime`/`TimePicker` (ROADMAP) precisar.
757
+ - **DateFns** (util tier, 4 files, novo `VENDORED_DATE_LIBS` na eslint-config)
758
+ - Absorbed runtime: `format`, `parse`, `parseISO`, `isValid`
759
+ - Absorbed locales: `ptBR`, `enUS`
760
+ - Absorbed types: `Locale`
761
+ - Gap intencional: `addDays`/`subDays`/aritmética, `formatDistance`/
762
+ formatação relativa, locales adicionais — adicionar conforme demanda.
763
+
764
+ Sites migrados (8 files): Calendar.tsx, Calendar.interface, Calendar.test,
765
+ Calendar/story, InputDate.tsx, InputDate.interface, InputDate.test,
766
+ InputDate/story.
767
+
768
+ **V2 — `parseInputDate` removido** do barrel `form/InputDate/index.ts`:
769
+ re-export vazava `date-fns` na public surface do DS (anti-pattern
770
+ ADR-004). Sem consumers conhecidos. Consumers que precisem importam
771
+ direto de `date-fns` no próprio package.
772
+
773
+ **V3 — `InputDate.handleKeyDown` a11y**: rewrite blocklist → allowlist.
774
+ Antes: `preventDefault` em tudo exceto Tab/Enter/Space — Esc, ArrowUp/Down/
775
+ Left/Right, Home, End, PageUp/Down ficavam swallowed, quebrando
776
+ `useDismiss({ escapeKey: true })`. Agora: `preventDefault` só em printable
777
+ chars (`key.length === 1 && key !== ' '`); named keys bubblam livremente.
778
+ WCAG 2.1.1 ok.
779
+
780
+ **V4 — `buildSyntheticEvent` extraído** para `form/InputDate/buildSyntheticEvent.ts`:
781
+ helper com cast-chain `as unknown as ChangeEvent` é fragile sob mudança
782
+ de shape em majors do React. Novo arquivo dedicado + 6 testes de contrato
783
+ runtime detectam drift cedo.
784
+
785
+ **Determinismo visual**: `Calendar/story.tsx` agora pin `FIXED_TODAY`
786
+ constant + `today`/`month` props nas 4 stories — baseline não drifta
787
+ diariamente conforme `new Date()` muda (era 0.5%+ por dia, acima do
788
+ threshold 0.1%).
789
+
790
+ Backward-compatible runtime API. Validate verde
791
+ (54 visual tests, 352+ unit tests, lint, typecheck, build).
792
+
793
+ Refs:
794
+ - `packages/core/docs/adr/ADR-004-vendor-isolation-policy.md` (status
795
+ atualizado: 18 vendors após backfill)
796
+ - `docs/ROADMAP.md` §"Calendar primitive + InputDate refactor" (hardening
797
+ block adicionado)
798
+ - `packages/core/src/vendors/ReactDayPicker/README.md` + DateFns/README.md
799
+
800
+ - d032437: docs(core): ADR-004 / PRD-001 S0 — vendor isolation scaffold
801
+
802
+ Approves ADR-004 (Vendor Isolation Policy) and PRD-001 (Vendor Isolation
803
+ Execution). Adds the infrastructure that makes `packages/core/src/vendors/`
804
+ internal-only:
805
+ - `esbuild.js` skips `vendors/` in `findEntryPoints` so wrappers never
806
+ become bundle entry points.
807
+ - `scripts/check-vendors-not-published.js` (new) asserts the invariant
808
+ post-build: no `lib/vendors/**` and no `./vendors/*` keys in
809
+ `package.json#exports`. Wired into `validate.sh`.
810
+ - `docs/CONCEPTS.md` gets a new §8 Vendor Isolation covering the canonical
811
+ shape (`component.ts` / `interface.ts` / `index.ts` / `README.md`), hard
812
+ rules, and rationale.
813
+ - `ROADMAP.md` moves vendor isolation to 🔴 Now.
814
+
815
+ `generate-exports.js` needed no change: its allow-list (`LEAF_CATEGORIES`,
816
+ `UTIL_CATEGORIES`) already excludes `vendors/` by construction.
817
+
818
+ No vendor wrappers in this slice. No API surface change. Doc + infra only.
819
+
820
+ See `packages/core/docs/adr/ADR-004-vendor-isolation-policy.md` §6 (Migration
821
+ Plan, Slice 0) and `packages/core/docs/prd/PRD-001-vendor-isolation-execution.md`.
822
+
823
+ - 00e0525: feat(core,eslint-config): ADR-004 Slice 1 — T2 utils vendoring
824
+
825
+ Vendor 8 T2 utility libs (re-export wrappers only) into
826
+ `packages/core/src/vendors/<Lib>/`, migrating all direct imports across
827
+ the core, and add a `no-restricted-imports` ESLint rule (severity `warn`)
828
+ that enforces the policy in `@apollion-dsi/eslint-config`.
829
+
830
+ **Vendored libs (T2 utils, 8 wrappers × 4 files):**
831
+ - Nanoid (4 sites)
832
+ - LodashDebounce (2)
833
+ - ObjectHash (1)
834
+ - Deepmerge (1)
835
+ - Color (3 — incl. Surface.test.tsx)
836
+ - FastDeepEqual (1)
837
+ - EmotionIsPropValid (2)
838
+ - StyledNormalize (1)
839
+
840
+ **Each vendor ships with:**
841
+ - `component.ts` — typed re-export of the absorbed surface
842
+ - `interface.ts` — DS-owned contract (skeleton for S1; full opinionated
843
+ shape will land per-lib in S2-S4 where DS opinion matters more)
844
+ - `index.ts` — barrel
845
+ - `README.md` — skeleton with `## What this vendor wraps` etc. — full
846
+ pass in S5
847
+
848
+ **ESLint rule (`@apollion-dsi/eslint-config`):**
849
+ - Path-scoped to `packages/core/src/**/*.{ts,tsx}`
850
+ - Allows direct upstream imports inside `packages/core/src/vendors/**`
851
+ - Severity `warn` in S1-S5 (grace period); flips to `error` in S6
852
+ - Other workspaces unaffected (paths don't match)
853
+
854
+ **Backward-compatible:** vendors are internal (esbuild skips the folder,
855
+ generate-exports.js doesn't list them, validate.sh's
856
+ `check-vendors-not-published.js` keeps the invariant). Consumer-side import
857
+ surface (`@apollion-dsi/core/elements/button` etc.) unchanged.
858
+
859
+ Bundle delta target: ≤ 0 KB gzip (re-exports are inlined by esbuild).
860
+
861
+ Refs:
862
+ - `packages/core/docs/adr/ADR-004-vendor-isolation-policy.md` §6 Slice 1
863
+ - `packages/core/docs/prd/PRD-001-vendor-isolation-execution.md` §S1
864
+
865
+ - 1c87be8: feat(core,eslint-config): ADR-004 S2 — T1 UI primitives vendoring
866
+
867
+ Vendor 4 T1 UI primitive libs into `packages/core/src/vendors/<Lib>/`
868
+ and migrate 12 direct import sites. Extends the ESLint
869
+ `no-restricted-imports` rule (warn) to cover the new vendors.
870
+
871
+ **Vendored libs (T1 UI, 4 × 4 files):**
872
+ - FramerMotion (6 sites: Modal, Notification × 3, Flex.style, Base.style)
873
+ - Absorbed: `motion`, `AnimatePresence`, `MotionConfig`, `useReducedMotion`, `MotionProps`
874
+ - Gap: gestures, drag, useAnimate, useScroll, layoutGroup (intentional — DS doesn't expose full expressiveness)
875
+ - TippyHeadless (3 sites: Dropdown, Tooltip × 2)
876
+ - Absorbed: `Tippy` default + `TippyProps`
877
+ - Uses headless entry only (no embedded CSS)
878
+ - ReactContentLoader (2 sites: ComposedSkeleton × 2)
879
+ - Absorbed: `ContentLoader`, `BulletList`, `Code`, `Facebook`, `List`, `IContentLoaderProps`
880
+ - ReactWindow (1 site: DataTable)
881
+ - Absorbed: `FixedSizeList` only
882
+
883
+ Backward-compatible. Bundle delta target ≤ +0.1 KB gzip per ADR-004 §6.
884
+ Snapshot tests Modal/Notification (framer consumers) inalterados.
885
+
886
+ Refs:
887
+ - `packages/core/docs/adr/ADR-004-vendor-isolation-policy.md` §6 Slice 2
888
+ - `packages/core/docs/prd/PRD-001-vendor-isolation-execution.md` §S2
889
+
890
+ - d1192da: feat(core,eslint-config): ADR-004 S3 — T1 form/validation vendoring
891
+
892
+ Vendor 3 T1 form/validation libs into `packages/core/src/vendors/<Lib>/`
893
+ and migrate 13 direct import sites. Slice mais opinativo do épico
894
+ ADR-004 — `interface.ts` faz o exercício real de "contrato ideal do DS,
895
+ não espelho da lib" (ADR-004 §6 S3).
896
+
897
+ **Vendored libs (T1 form/validation, 3 × 4 files):**
898
+ - **Formik** (4 sites: Form.{interface,tsx,helpers}, Field.interface)
899
+ - Absorbed runtime: `useFormik` apenas (DS expõe `Form`/`Field`/`FieldGroup` próprios)
900
+ - Absorbed types: `FormikErrors`, `FormikHelpers`, `FormikProps`, `FormikSharedConfig`
901
+ - Gap intencional: `<Field>`, `<FieldArray>`, `<ErrorMessage>`, `Formik`, `FormikProvider`, `useFormikContext`, `useField`, `withFormik`, wizards
902
+ - **Yup** (4 sites: Form.{interface,tsx,helpers}, story.tsx)
903
+ - Absorbed: namespace inteiro via `export *` — preserva padrão `import * as Yup`
904
+ - Justificativa: Yup é DSL; restringir builders quebra expressividade
905
+ - **ReactSelect** (5 sites: InputSelect.{tsx,interface}, DropdownIndicator)
906
+ - Sync + `/async` consolidados em 1 wrapper
907
+ - Absorbed runtime: `DefaultSelect`, `AsyncSelect`, `components`
908
+ - Absorbed types: `DropdownIndicatorProps`, `ReactSelectProps` (re-export renomeado de `Props`)
909
+ - Gap: `Creatable`, `formatGroupLabel`, `MenuListProps`, `MultiValue`, sortable
910
+
911
+ ESLint rule estendida para cobrir `formik`, `react-select`,
912
+ `react-select/async`, `yup` com severidade `warn` (flips em S6).
913
+
914
+ Backward-compatible. Bundle delta target ≤ +0.1 KB gzip em `lib/form/form/`.
915
+
916
+ Refs:
917
+ - `packages/core/docs/adr/ADR-004-vendor-isolation-policy.md` §6 Slice 3
918
+ - `packages/core/docs/prd/PRD-001-vendor-isolation-execution.md` §S3
919
+
920
+ - 3194fba: feat(core,eslint-config): ADR-004 S4 — T1 data/routing vendoring
921
+
922
+ Vendor 2 T1 data/routing libs into `packages/core/src/vendors/<Lib>/`
923
+ and migrate 7 direct import sites.
924
+
925
+ **Vendored libs (T1 data/routing, 2 × 4 files):**
926
+ - **ReactRouterDom** (5 sites: Link.style, Link.interface, Link.test,
927
+ List/story, Link/story)
928
+ - Absorbed runtime: `Link`, `MemoryRouter` (stories + tests apenas)
929
+ - Absorbed types: `LinkProps`
930
+ - Gap intencional: tudo o mais. Decisão consciente (ADR-004 §9 Q3):
931
+ DS não deve ditar router. Reabsorver é diff por símbolo + entrada
932
+ de roadmap. `BrowserRouter`, `Route`, `Routes`, `Outlet`,
933
+ `useNavigate`, `useLocation`, `useParams`, `NavLink`, `Navigate`
934
+ não absorvidos.
935
+ - **TanstackReactTable** (2 sites: DataTable.tsx multi-import + DataTable.interface)
936
+ - Absorbed runtime: `useReactTable`, `flexRender`, `getCoreRowModel`,
937
+ `getSortedRowModel`, `getFilteredRowModel`
938
+ - Absorbed types: `ColumnDef`, `Row`, `RowSelectionState`,
939
+ `SortingState`
940
+ - Gap: `getExpandedRowModel`, `getGroupedRowModel`,
941
+ `getPaginationRowModel`, `getFacetedRowModel` + types `Cell`,
942
+ `Header`, `Table`, `RowModel`, `Column`, etc. — features que
943
+ DataTable do core não suporta hoje.
944
+
945
+ ESLint rule estendida (warn) cobrindo `@tanstack/react-table` e
946
+ `react-router-dom`.
947
+
948
+ Backward-compatible. Validate target verde (180+ tests, snapshots
949
+ inalterados em DataTable/Link).
950
+
951
+ Refs:
952
+ - `packages/core/docs/adr/ADR-004-vendor-isolation-policy.md` §6 Slice 4
953
+ - `packages/core/docs/prd/PRD-001-vendor-isolation-execution.md` §S4
954
+
955
+ - f359982: docs(core): ADR-004 S5 — Vendor README full pass
956
+
957
+ Preenche os 17 vendor READMEs (skeleton → completo) com 3 seções
958
+ padronizadas + atualiza ROADMAP com 6 entradas derivadas de gaps:
959
+
960
+ **Cada vendor README agora tem:**
961
+ - `## What this vendor wraps` — npm link + versão exata + tabela
962
+ símbolo → tipo → uso no core
963
+ - `## DS Absorption Gap` — bullet do que ficou fora + rationale + link
964
+ ROADMAP quando candidato
965
+ - `## Replacement candidates` — libs concorrentes com trade-off explícito
966
+ - "When to consider" + triggers de troca quantificados
967
+
968
+ **Novas entradas em ROADMAP.md (🟡 Next):**
969
+ 1. Migrate ReactWindow → @tanstack/react-virtual (Low burn, consolida ecosystem)
970
+ 2. Migrate TippyHeadless → @floating-ui/react (Medium burn, sucessor natural)
971
+ 3. Router-agnostic Link — remove react-router-dom dep (Medium, candidato ADR-006)
972
+ 4. DataTable absorption gaps (expandable rows, pagination, etc.)
973
+ 5. FormWizard absorption + Combobox replacement evaluation
974
+ 6. Zod/Valibot evaluation paired with form library refactor
975
+
976
+ **Resolve numbering conflict:**
977
+ - ADR-003 (file) = Visual regression (não "v4 epic")
978
+ - ADR-005 = styled-components facade (placeholder)
979
+ - ADR-006 = v4 epic (OKLch + Dimension + token-only) — renomeado de "ADR-003"
980
+
981
+ Remove entrada duplicada "Visual regression suite (Chromatic)" de 🟡 Next
982
+ (agora coberta por ADR-003).
983
+
984
+ Doc-only. Sem mudança de código/API. Patch bump.
985
+
986
+ Refs:
987
+ - packages/core/docs/adr/ADR-004-vendor-isolation-policy.md §6 Slice 5
988
+ - packages/core/docs/prd/PRD-001-vendor-isolation-execution.md §S5
989
+
990
+ - 5d17ebc: feat(core, eslint-config): ADR-005 — styled-components vendor facade
991
+
992
+ Closes the Vendor Isolation epic (ADR-004 §5 leftover). styled-components
993
+ becomes vendor #18 under `packages/core/src/vendors/StyledComponents/`,
994
+ following the same canonical 4-file shape used by the other vendors.
995
+
996
+ **Core (`@apollion-dsi/core`):**
997
+ - New `vendors/StyledComponents/{component.ts, interface.ts, index.ts,
998
+ README.md, StyledComponents.test.ts}`. Wrapper re-exports the surface
999
+ consumed by the core (runtime: `styled`, `css`, `keyframes`,
1000
+ `ThemeProvider`, `StyleSheetManager`, `createGlobalStyle`, `useTheme`;
1001
+ types: `CSSObject`, `DefaultTheme`, `Interpolation`, `IStyledComponent`,
1002
+ `RuleSet`, `Styled`).
1003
+ - `DefaultTheme extends Theme` augmentation moved out of
1004
+ `src/typings/index.d.ts` into the co-located `vendors/StyledComponents/
1005
+ interface.ts`. `typings/index.d.ts` reduced to `@testing-library/jest-dom` - the legacy `react-table` module declaration.
1006
+ - 62 sites under `src/**/*.{ts,tsx}` codemoded from `import ... from
1007
+ 'styled-components'` to the vendor wrapper via the new
1008
+ `scripts/migrate-styled-components-imports.js` helper. READMEs in
1009
+ `containers/Base/README.{mdx,AI.md}` preserved — consumer-facing examples
1010
+ must keep showing `from 'styled-components'`.
1011
+ - `@types/styled-components@5.1.36` removed from `devDependencies` — dead
1012
+ for `styled-components@6.x`, which ships its own `dist/index.d.ts`.
1013
+ - Vendor test verifies (a) singleton — wrapper re-exports identical
1014
+ upstream runtime references, (b) `Theme` `satisfies DefaultTheme` at
1015
+ compile time, (c) `useTheme()` returns the `Theme`-shaped object injected
1016
+ by `<ApollionProvider>`.
1017
+
1018
+ **ESLint config (`@apollion-dsi/eslint-config`):**
1019
+ - New `VENDORED_STYLED_LIBS = ['styled-components']` group folded into
1020
+ `VENDORED_LIBS`. The existing `no-restricted-imports` rule now blocks
1021
+ direct `from 'styled-components'` in `packages/core/src/**` (vendor
1022
+ directory remains exempt). Severity `error` from day one — the codemod
1023
+ guarantees zero violations before the rule activates, so the
1024
+ warn-intermediate phase originally proposed in ADR-005 §6 S3 was
1025
+ skipped (documented in ADR-005 §11.2).
1026
+
1027
+ Non-breaking: consumer-facing API and `ApollionProvider` behavior
1028
+ unchanged. See `packages/core/docs/adr/ADR-005-styled-components-vendor-facade.md`
1029
+ §11 for the full set of deviations between the planned and executed slices.
1030
+
1031
+ - 6545751: docs(core): ADR-007 — Zod v4 idiomatic corrections + shadow-PoC S1 wording
1032
+
1033
+ Atualiza ADR-007 (Form stack migration) com correções pós grill-with-docs
1034
+ (2026-05-27) sobre as APIs externas reais:
1035
+ - **§S1 wording:** clarifica que S1 é **shadow-PoC em arquivo novo**
1036
+ (`poc-rhf-zod.tsx`), NÃO migração do example atual. Examples atuais usam
1037
+ `<Form>` do DS que ainda é Formik-backed em S0/S1 — migrar example exige
1038
+ S2 (DS Form refactor) primeiro. Shadow-PoC destrava sem reverter ordem.
1039
+ - **§S2 + §7 PoC code:** validation API muda de `validateOnChange`/
1040
+ `validateOnBlur` booleans → `mode?: Mode` direto (breaking aceito em
1041
+ v4.0.0). Mode type vendored em S0 follow-up.
1042
+ - **§7 Yup→Zod mapping:** atualizado para Zod v4 idiomatic:
1043
+ - `z.string().email()` → `z.email()` (top-level)
1044
+ - `Yup.string().required()` → `z.string().min(1, 'msg')`
1045
+ - `Yup.boolean().required()` → `z.boolean().refine((v) => v === true, ...)`
1046
+ - `z.ZodIssueCode.custom` → `'custom'` string literal
1047
+ - Nota sobre `z.unknown()` não ser optional por default em v4.
1048
+ - **§7 BasicFormExample concrete mapping** adicionado — fonte de verdade
1049
+ do S1 PoC schema.
1050
+ - **§7 Zod v4 breaking changes table** adicionada com 10 entries cobrindo
1051
+ todas as APIs usadas no PoC.
1052
+ - **§8 Risks #6 atualizado:** validation API direct mode (não mais
1053
+ mapping interno boolean→enum).
1054
+ - **§8 Risks #9 + #10 adicionados:** Zod v4 `z.unknown()` não-optional
1055
+ por default; `.refine()` removeu type narrowing via predicate.
1056
+ - **§S0 marcado MERGED** com commits + 3 changesets gerados.
1057
+ - **Status do ADR:** 📝 Proposed → 🚧 In Progress.
1058
+
1059
+ Doc-lock cross-checked contra `.d.ts` locais de `react-hook-form@7.76.1`,
1060
+ `@hookform/resolvers@5.4.0` e `zod@4.4.3`, suplementado com WebFetch de
1061
+ zod.dev/v4/changelog.
1062
+
1063
+ - 36eaf4a: feat(core): ADR-007 S0 follow-up — expose `Mode` type in ReactHookForm vendor
1064
+
1065
+ Adiciona `Mode` (`'onSubmit' | 'onBlur' | 'onChange' | 'onTouched' | 'all'`)
1066
+ ao surface re-exportado de `vendors/ReactHookForm/interface.ts`. Necessário
1067
+ para `Form.interface.ts#FormCommonInterface['mode']` em S2 — substitui o par
1068
+ booleano legado `validateOnChange?`/`validateOnBlur?` do Formik (decisão
1069
+ fixada via tech-radar pass 2026-05-27).
1070
+
1071
+ Surface change pequena, isolada à interface do vendor. Zero impacto
1072
+ runtime — só types.
1073
+
1074
+ Ver `packages/core/src/vendors/ReactHookForm/README.md` para tabela
1075
+ atualizada.
1076
+
1077
+ - 802828f: feat(core): ADR-007 S0 — react-hook-form vendor scaffold
1078
+
1079
+ Adds `packages/core/src/vendors/ReactHookForm/` (4 arquivos no padrão
1080
+ ADR-004): re-export tipado de `useForm`, `Controller`, `useFormContext`,
1081
+ `useFieldArray` + bridge adapter `zodResolver` (de `@hookform/resolvers/zod`)
1082
+ co-localizado para evitar dois call-sites distintos.
1083
+
1084
+ Deps adicionadas (exact pin, latest stable):
1085
+ - `react-hook-form@7.76.1`
1086
+ - `@hookform/resolvers@5.4.0`
1087
+
1088
+ Vendor wrapper isolado — ainda não consumido pelo core (S2 migra
1089
+ `form/Form/Form.tsx`). Zero impacto runtime nesta slice. `vendors/Zod/`
1090
+ já existe desde ADR-006 S6 e cobre a surface de schema requerida — sem
1091
+ duplicação.
1092
+
1093
+ Pre-flight verificado: lint, check-types e prettier verdes; sem violações
1094
+ da regra `no-restricted-imports` (codemod do core acontece em S2).
1095
+
1096
+ Ver `packages/core/docs/adr/ADR-007-form-stack-rhf-zod.md` §6 Slice 0
1097
+ e `docs/ROADMAP.md` §🟡 Next "Form stack migration — Formik+Yup → RHF+Zod".
1098
+
1099
+ - e14469c: feat(core): ADR-007 S2 — DS Form internals migrated Formik+Yup → RHF+Zod
1100
+
1101
+ Migra os 4 arquivos core do `form/` do stack Formik+Yup para React Hook
1102
+ Form + Zod, dentro do escopo de [vendors/ReactHookForm](src/vendors/ReactHookForm)
1103
+ e [vendors/Zod](src/vendors/Zod) (ADR-004 vendor isolation). Single
1104
+ commit no padrão "vertical-slice":
1105
+
1106
+ **Arquivos migrados:**
1107
+ - **`form/Form/Form.tsx`** — `useFormik({...})` → `useForm<any>({ resolver: zodResolver(schema), mode: mode ?? 'onSubmit', defaultValues })`. `useImperativeHandle(ref, () => methods)` agora expõe `UseFormReturn<any>` no lugar de `FormikProps<any>`. `Field` continua recebendo `value`/`errors`/`setFieldValue` via prop (paradigma controlled preservado via `methods.watch()` e `methods.setValue`).
1108
+ - **`form/Form/Form.helpers.ts`** — `getValidationSchema` agora constrói `z.object(shape)`. Default fallback p/ fields sem `validation`: `z.unknown().optional()` (Zod v4 requer `.optional()` explícito — `z.unknown()` não é optional por default em object schemas, mudança vs v3). `prepareSubmit` assinatura aceita `UseFormReturn<any>` no lugar de `FormikHelpers`.
1109
+ - **`form/Form/Form.interface.ts`** — types swap inteiro:
1110
+ - `FormRef = FormikProps<any>` → `FormRef = UseFormReturn<any>` (breaking API ref — major bump em v4)
1111
+ - `validateOnChange?: boolean` + `validateOnBlur?: boolean` → **REMOVIDOS**. Substituídos por `mode?: Mode` enum (`'onSubmit' | 'onBlur' | 'onChange' | 'onTouched' | 'all'`), default `'onSubmit'`. Mapping legacy em MIGRATION-v4.md (ADR-007 §S5).
1112
+ - `validation?: any | (() => any)` → `validation?: ZodTypeAny`
1113
+ - `onError?: (errors: FormikErrors<...>) => void` → `onError?: (errors: FieldErrors<...>) => void`
1114
+ - Workaround `const a = Yup.string().required()` (tree-shake legacy) removido.
1115
+ - **`form/Field/Field.interface.ts`** — `setFieldValue?: FormikHelpers<any>['setFieldValue']` → `setFieldValue?: UseFormSetValue<any>`. Nome da prop preservado para minimizar blast-radius nos primitives (`InputDate`, `InputSelect`, etc. continuam chamando `setFieldValue(name, value)` — assinatura compat). Renome `FormikBaseInterface` → `FormBaseInterface`.
1116
+ - **`form/Form/story.tsx`** (Storybook) — `Yup.string().required('Required')` → `z.string().min(1, 'Required')`; `Yup.string().email()` → `z.email()`. Import de `vendors/Yup` removido.
1117
+
1118
+ **Estado pós-S2:**
1119
+ - `yarn workspace @apollion-dsi/core run validate:tests`: ✅ 317 passed (1 skipped pre-existente), 59 snapshots OK.
1120
+ - `yarn workspace @apollion-dsi/core run check-types`: ✅ verde.
1121
+ - `yarn workspace @apollion-dsi/core run lint`: ✅ zero violations.
1122
+ - `yarn workspace @apollion-dsi/core run build` (esbuild + tsc + Storybook): ✅ verde.
1123
+ - `yarn workspace @apollion-dsi/website run build` (Next.js): ✅ verde.
1124
+
1125
+ **Website examples (`BasicFormExample`, `FormExample`, `DynamicFormExample`) ainda usam Yup schemas:**
1126
+
1127
+ Type check passa via casting permissivo (`validation as ZodSchema`), mas runtime de submit no website QUEBRA (Yup schema sem `.parse()` → `zodResolver` throws). Render OK; submit broken until S3 migra os examples. Esperado per ADR-007 §S2 critério.
1128
+
1129
+ **Bundle delta:** ainda não visível (Yup permanece importado pelos examples website até S3). Re-measure em S3 com examples + smoke pages atualizadas.
1130
+
1131
+ Storybook stories (`Form/story.tsx`) já migradas — Storybook submit funciona end-to-end.
1132
+
1133
+ **Vendors antigos `vendors/Formik/` + `vendors/Yup/`:** preservados sem uso interno até S6 (hard cut em v4.0.0). 0 imports de `formik`/`yup` em `packages/core/src/**` fora dos próprios vendor dirs.
1134
+
1135
+ Ver `packages/core/docs/adr/ADR-007-form-stack-rhf-zod.md` §6 Slice 2.
1136
+
1137
+ - 81cd55b: feat(website): ADR-007 S3 — migrate 8 form examples Yup → Zod + cleanup PoC/smoke
1138
+
1139
+ Completa a migração end-to-end Formik+Yup → RHF+Zod no website:
1140
+
1141
+ **6 example files migrados:**
1142
+ - `website/src/examples/Components/Form/Form/index.tsx` — `BasicFormExample`, `FormExample` (15 fields), `DynamicFormExample` (8 fields + conditional).
1143
+ - `website/src/examples/Components/Form/Field/index.tsx` — `FieldFormExample` (UploadCard).
1144
+ - `website/src/examples/Components/Form/Inputs/Input/index.tsx` — `InputFormExample`.
1145
+ - `website/src/examples/Components/Form/Inputs/InputDate/index.tsx` — `InputDateFormExample`.
1146
+ - `website/src/examples/Components/Form/Inputs/InputMask/index.tsx` — `InputMaskDateExample`.
1147
+ - `website/src/examples/Components/Form/Inputs/InputSelect/index.tsx` — `InputSelectExampleButton`.
1148
+
1149
+ **Mapping aplicado** (consistente com MIGRATION-v4.md ADR-007 §S5):
1150
+
1151
+ | Yup pattern | Zod v4 equivalent |
1152
+ | ------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
1153
+ | `Yup.string().required('msg')` | `z.string().min(1, 'msg')` |
1154
+ | `Yup.string().email('m1').required('m2')` | `z.email('m1')` (top-level v4) |
1155
+ | `Yup.boolean().required('msg')` | `z.boolean()` (matches Yup loose `.required` semantics) |
1156
+ | `Yup.number().required('msg')` | `z.coerce.number()` (HTML inputs return string) |
1157
+ | `Yup.mixed().test('hasFile', 'm', fn)` | `z.unknown().refine(fn, { message: 'm' })` |
1158
+ | `Yup.mixed().test(date).required()` | `z.string().min(1, 'Required').refine(dateValid, { message: 'm' })` |
1159
+ | `Yup.string().required()` on InputSelect/FieldGroup (object/array stores) | `z.unknown().refine((v) => !!v, { message: 'Required' })` (preserve Yup permissive coercion) |
1160
+
1161
+ **Cleanup:**
1162
+ - ❌ `website/src/examples/Components/Form/Form/poc-rhf-zod.tsx` — deletado (shadow-PoC obsoleto; `BasicFormExample` agora cobre o mesmo pattern via DS `<Form>` migrado).
1163
+ - ❌ `website/pages/docs/smoke-form-poc-rhf-zod.mdx` — deletado (instrumentação S1).
1164
+ - ❌ `website/pages/docs/smoke-form-basic-formik.mdx` — deletado (instrumentação S1).
1165
+
1166
+ **Bundle re-measurement (Next.js First Load JS):**
1167
+
1168
+ | Page | Pre-S0 (Formik+Yup) | Post-S3 (RHF+Zod) | Δ |
1169
+ | -------------- | ------------------: | ----------------: | ------------: |
1170
+ | `form-basic` | 417 kB | 422 kB | +5 kB / +1.2% |
1171
+ | `form-dynamic` | 417 kB | 422 kB | +5 kB / +1.2% |
1172
+ | `form-form` | 417 kB | 422 kB | +5 kB / +1.2% |
1173
+
1174
+ **Δ NEGATIVO vs ADR-007 target** (≥15% redução; alvo 21%). Análise honesta:
1175
+ - Zod v4 com features atuais (`z.email`, `z.coerce`, `z.refine`, `z.string().min`) ship mais bytes que o subset de Yup usado previamente.
1176
+ - Formik (~13kB) → RHF (~10kB) shrink ~3kB.
1177
+ - Yup (~15kB) → Zod (~15-18kB) wash or slight growth.
1178
+ - Net: bundle parity, com leve growth devido a Zod ser mais "feature-rich" em runtime.
1179
+
1180
+ **Benefícios do migration (realizados, independente do bundle):**
1181
+ - ✅ Ecosystem alignment 2024-2026+: RHF + Zod dominantes em TS-first stacks.
1182
+ - ✅ TypeScript SSOT via `z.infer<typeof schema>` (Yup exigia tipo manual `Values<T>`).
1183
+ - ✅ Future-proofing: Formik+Yup com manutenção decrescente, React 19/20 risk.
1184
+ - ✅ Vendor isolation paga: refactor cirúrgico em 4 arquivos core + 6 examples.
1185
+ - ✅ Apollion como gold-standard do ecosystem mantém alinhamento com mercado.
1186
+
1187
+ **Acceptance Criteria ADR-007:**
1188
+ - ✅ 0 imports diretos de `formik`/`yup` em `packages/core/src/**` e `website/src/**` (fora dos vendors).
1189
+ - ✅ 0 imports diretos de `react-hook-form`/`zod`/`@hookform/resolvers/zod` em core fora de `vendors/`.
1190
+ - ⚠️ Bundle delta target ≥15%: **NÃO atingido** (medição real: +1.2% growth). Documentado como finding honesto. Justificativa do migration permanece válida (ecosystem + maintenance + TS).
1191
+ - ✅ `yarn validate` verde nos 4 workspaces.
1192
+ - ✅ 317 tests passed (1 skipped pre-existente), 59 snapshots OK.
1193
+
1194
+ Vendors `vendors/Formik/` + `vendors/Yup/` permanecem sem uso interno até S6 hard cut em v4.0.0.
1195
+
1196
+ Ver `packages/core/docs/adr/ADR-007-form-stack-rhf-zod.md` §6 Slice 3.
1197
+
1198
+ - c57c548: docs(core): ADR-007 S4+S5 — README sweep + MIGRATION-v4.md draft
1199
+
1200
+ **S4 — README + AI docs sweep (12 arquivos):**
1201
+
1202
+ MDX docs (4):
1203
+ - `form/Form/README.mdx` — exemplos Yup → Zod v4 idiomatic.
1204
+ - `form/Field/README.mdx` — exemplos Yup → Zod; "(Formik)" → "(RHF + Zod)".
1205
+ - `form/InputDate/README.mdx` — `Yup.mixed().test(date)` → `z.string().min(1).refine(date)`.
1206
+ - `form/InputMask/README.mdx` — mesma migration de date validator.
1207
+
1208
+ AI docs (8):
1209
+ - `form/Form/README.AI.md` — reescrita full (purpose, props table com `mode`,
1210
+ examples Zod, do-not section atualizada).
1211
+ - `form/Field/README.AI.md` — referências "Formik" → "RHF + Zod"; exemplo
1212
+ inside-form com Zod.
1213
+ - `form/Checkbox/README.AI.md`, `form/InputCurrency/README.AI.md`,
1214
+ `form/InputDate/README.AI.md`, `form/InputMask/README.AI.md`,
1215
+ `form/InputRange/README.AI.md`, `form/InputSelect/README.AI.md`,
1216
+ `form/TextArea/README.AI.md` — `<related>` section "Form orquestra
1217
+ validação Yup" → "Zod"; exemplos Yup migrados onde presentes.
1218
+
1219
+ **DEPRECATED headers nos vendors antigos:**
1220
+ - `vendors/Formik/README.md` — ⚠️ DEPRECATED header apontando ReactHookForm
1221
+ - ADR-007 §S6.
1222
+ - `vendors/Yup/README.md` — ⚠️ DEPRECATED header apontando Zod + ADR-007 §S6.
1223
+
1224
+ **S5 — MIGRATION-v4.md draft:**
1225
+
1226
+ Cria `packages/core/MIGRATION-v4.md` com seção "Form stack migration"
1227
+ cobrindo:
1228
+ - §1 Resumo do impacto (7 surfaces com migration cost por linha).
1229
+ - §2 Mapping Yup → Zod v4 (cheat sheet com 20+ patterns).
1230
+ - §3 `validateOnChange`/`validateOnBlur` → `mode` (com diff blocks).
1231
+ - §4 `onError` callback shape (FormikErrors → FieldErrors).
1232
+ - §5 `handleSubmit` second arg (FormikHelpers → UseFormReturn method map).
1233
+ - §6 Ref imperativa (FormikProps → UseFormReturn).
1234
+ - §7 Type inference (`z.infer<typeof schema>` SSOT vs `Values<T>` manual).
1235
+ - §8 Migration steps consumer-side (7 passos).
1236
+ - §9 Bundle delta esperado (medição real + análise honesta).
1237
+ - §10 Refs (ADR-007, ADR-004, Zod v4 changelog, RHF docs).
1238
+
1239
+ Status DRAFT — finalizado no merge final do épico v4.0.0.
1240
+
1241
+ **ADR-007 status atualizado:** S0-S5 marcados ✅; S6 (hard cut) ⏳ gated pelo
1242
+ épico v4.0.0 (ADR-006). Acceptance criteria atualizado com checkboxes
1243
+ reais; finding de bundle delta documentado honestamente (NÃO atingido
1244
+ target; justificativa migration permanece válida).
1245
+
1246
+ Vendors `Formik`/`Yup` permanecem (sem uso interno) até S6 hard cut.
1247
+
1248
+ Ver `packages/core/docs/adr/ADR-007-form-stack-rhf-zod.md` §6 Slice 4 + 5
1249
+ - §10 Acceptance Criteria atualizado.
1250
+
1251
+ - e55019a: chore(security): bump Storybook 8.6.9 → 8.6.18 + force `uuid` to 11.1.1
1252
+
1253
+ DevDeps-only — no consumer-facing API change. Closes three security
1254
+ advisories surfaced by `yarn audit-dependencies` (after the audit pipeline
1255
+ itself was migrated off the broken `audit-ci@7.1.0` Yarn Berry handler in
1256
+ the same cycle):
1257
+ - **High** — Storybook manager bundle env-var exposure during build
1258
+ (GHSA-8452-54wp-rmv6, fixed in `storybook >=8.6.15`).
1259
+ - **High** — Storybook Dev Server WebSocket Hijacking
1260
+ (GHSA-mjf5-7g4m-gx5w, fixed in `storybook >=8.6.17`).
1261
+ - **Moderate** — `uuid` missing buffer bounds check in v3/v5/v6
1262
+ (GHSA-w5hq-g745-h8pq, fixed in `uuid >=11.1.1`). Forced via root
1263
+ `resolutions` since `@storybook/addon-actions` + `jest-junit` would
1264
+ otherwise keep transitive `uuid@8.3.2` / `uuid@9.0.1`.
1265
+
1266
+ Verified:
1267
+ - `yarn install` clean.
1268
+ - `yarn workspace @apollion-dsi/core build-storybook` succeeds.
1269
+ - Visual regression suite (chromium, 133/133) idempotent — matches the
1270
+ pre-push hook default.
1271
+ - `yarn audit-dependencies` no longer reports any of the three
1272
+ advisories above.
1273
+
1274
+ - 51f71f6: fix(core): emit `.d.ts` for every subpath entry (v4 build follow-up)
1275
+
1276
+ `packages/core/tsconfig.json` used `files: ["src/index.ts"]` as its only
1277
+ entry point. After ADR-006 §3.7 E7 emptied the root barrel in v4.0.0,
1278
+ that entry walks to nothing — `tsc --emitDeclarationOnly` produced a
1279
+ single `lib/index.d.ts` while `esbuild` emitted 217 `.esm.js` files for
1280
+ every subpath barrel discovered via `findEntryPoints`. Consumers
1281
+ importing `@apollion-dsi/core/themes/colors`, `@apollion-dsi/core/elements/
1282
+ button`, etc. got runtime JS but `any`-typed modules — which only became
1283
+ visible when `@apollion-dsi/tokens` validate started failing with TS7016
1284
+ "Could not find a declaration file" against the published subpaths.
1285
+
1286
+ The same bug also reduced `yarn check-types` to a near no-op: since
1287
+ `src/index.ts` no longer imported anything, `tsc --noEmit` only checked
1288
+ that one file and silently ignored real type errors in the remaining 200+
1289
+ modules of the source tree.
1290
+
1291
+ Switches the config to `include: ["src/**/*"]` with explicit excludes for
1292
+ test files (`*.test.{ts,tsx}`, `__tests__/**`) and Storybook stories
1293
+ (`story.{ts,tsx}`, `__stories__/**`) — neither of which should ship type
1294
+ declarations. Post-fix:
1295
+ - `lib/` carries 430 `.d.ts` files (covering all 217 ESM entries plus
1296
+ pure-type interface files), matching the surface declared in
1297
+ `package.json#exports`.
1298
+ - `lib/vendors/StyledComponents/` ships `.d.ts` only (`component.d.ts`,
1299
+ `interface.d.ts`, `index.d.ts`) — `scripts/check-vendors-not-published.js`
1300
+ remains green (the script only forbids `.js` under `lib/vendors/`).
1301
+ - `yarn check-types` now type-checks the entire `src/**` tree.
1302
+ - No new TypeScript errors surfaced — the existing source tree was
1303
+ internally consistent; it just wasn't being checked.
1304
+
1305
+ Pure build-config fix. No runtime change, no public API change. Patch
1306
+ bump.
1307
+
1308
+ - 0a1baeb: chore(core): coverage re-baseline — exclude boilerplate, honest floors
1309
+
1310
+ Apply coverage exclusions em `packages/core/jest.config.js` +
1311
+ `packages/relay/jest.config.js` para boilerplate sem business logic
1312
+ testável:
1313
+ - `/vendors/` — wrappers re-export-only (re-exports a 100% statements
1314
+ - 0-50% functions noise via IIFE wrappers ts-jest).
1315
+ - `*.story.tsx` — Storybook stories (visual coverage via visual-gate).
1316
+ - `*.interface.ts` — type-only files (compile a empty JS = 100% padding).
1317
+ - `*.style.ts` — styled-components (testados via component renders).
1318
+ - `/index.ts` (barrels) — re-exports puros.
1319
+
1320
+ **Impact:** revela coverage real do código com lógica testável.
1321
+
1322
+ | Métrica core | Pre-exclusões | Post-exclusões | Δ |
1323
+ | ------------ | ------------: | -------------: | ------: |
1324
+ | Statements | 69.8% | 61.75% | -8.05pp |
1325
+ | Branches | 50.63% | 50.74% | +0.11pp |
1326
+ | Functions | 56.2% | 48.25% | -7.95pp |
1327
+ | Lines | 69.41% | 62.3% | -7.11pp |
1328
+
1329
+ Drop em statements/functions/lines reflete REMOÇÃO de files inflados
1330
+ (re-exports a 100%, types a 100%) — não regressão real. Branches estável
1331
+ porque excluídos não tinham branches significativos.
1332
+
1333
+ **Thresholds rebaselined** (core/jest.config.js):
1334
+ - `branches`: 48 → 50 (sobe acompanhando actuals)
1335
+ - `functions`: 53 → 47 (cai — honest baseline)
1336
+ - `lines`: 67 → 61
1337
+ - `statements`: 68 → 60
1338
+
1339
+ Buffer ~1-2pp do actuals real. Relay thresholds unchanged (actuals
1340
+ post-exclusion ainda passam).
1341
+
1342
+ **Path para 80% goal** (adoption-readiness, decisão @fedbalves 2026-05-27):
1343
+
1344
+ Top gaps onde testes reais teriam impacto:
1345
+ - `hooks/*` — useDrag/useClipboard/useScript/useProgress/useIntersect/
1346
+ useFileDialog todos <30% statements.
1347
+ - `form/UploadCard` (21%), `form/InputSelect` (51%), `form/InputRange` (55%).
1348
+ - `entities/*` (32%).
1349
+ - `containers/Scroll` (63%).
1350
+ - `elements/Svg` (38%), `elements/Label` (52%).
1351
+
1352
+ Ratchet path: +5pp incremental atrás de feature work TDD-vertical (per
1353
+ strategy original do ROADMAP).
1354
+
1355
+ Ver `docs/ROADMAP.md` §🟡 Next "Coverage ratchet to 80%" — entrada
1356
+ atualizada com baseline honesta + path detalhado.
1357
+
1358
+ - 6d1371e: docs: factual drift sweep + AI-friendly doc surface
1359
+
1360
+ Sincroniza documentação com estado de `main` pós-v3.x (ADR-002 +
1361
+ ADR-004 shipped, ADR-005 escrito) e introduz camada AI-readable
1362
+ (`README.AI.md`, `AGENTS.md`, `llms.txt` por sub-package).
1363
+
1364
+ **Drift corrigido (BLOCKER):**
1365
+ - Root README + core README: Storybook `9` → `8.x` (real: 8.6.9).
1366
+ - ROADMAP: ADR-005 "placeholder/não escrita" → "Proposed" linkando ao
1367
+ arquivo já existente.
1368
+ - `website/README.md`: era boilerplate de Docusaurus 2 — substituído
1369
+ por descrição real (Next 15 + Nextra 2 + copyStorybook).
1370
+ - `website/pages/index.mdx`: remove `npm install` (yarn-only) e
1371
+ amplia scope para citar 3-layer theme + vendor isolation.
1372
+ - `packages/scripts/README.MD`: rebrand de `@captalys-platform/scripts`
1373
+ → `@apollion-dsi/scripts`; atualiza stack (webpack 5, Babel 7,
1374
+ Jest 30, TS 6); remove `.editorconfig.js`.
1375
+
1376
+ **Novas concept pages no website (IMPORTANT):**
1377
+ - `concept-semantic-tokens.mdx` — explica Foundation/Semantic/Structural
1378
+ (ADR-002).
1379
+ - `concept-surface-inversion.mdx` — `surface="negative"` + limitação
1380
+ mode-agnostic (ADR-002 S4 / refinada em ADR-006).
1381
+ - `concept-vendor-policy.mdx` — política de vendor isolation pública
1382
+ (ADR-004).
1383
+
1384
+ Source canônica em `packages/core/concept/`; thin re-exports em
1385
+ `website/pages/docs/`; entradas em `_meta.json`.
1386
+
1387
+ **AI-friendly doc layer:**
1388
+ - Raiz `README.AI.md` — navegação + decision tree + ADR matrix.
1389
+ - Raiz `AGENTS.md` — contrato operacional p/ agentes (hard rules,
1390
+ per-component checklist, skill triggers).
1391
+ - `packages/eslint-config/llms.txt`, `packages/relay/llms.txt`,
1392
+ `packages/scripts/llms.txt` — indexação token-otimizada por package
1393
+ (espelhando o padrão já em `packages/core/llms.txt`).
1394
+
1395
+ Doc-only. Sem mudança de API/código. Patch bump em todos os
1396
+ publishable packages para sincronizar versões.
1397
+
1398
+ - e55019a: chore(security): close 7 pre-existing CVEs revealed by audit-dependencies fix
1399
+
1400
+ Follow-up to the `audit-ci@7.1.0` → `yarn npm audit` migration earlier in
1401
+ this cycle. The native audit pipeline surfaced 7 vulnerabilities that the
1402
+ broken handler had been printing as `undefined` and never failing on.
1403
+ All closed in this changeset. `yarn audit-dependencies` → 0 findings.
1404
+
1405
+ | # | CVE | Pkg | Severity | Strategy |
1406
+ | --- | ------------------- | ---------------- | -------- | ------------------------------------------------------------------------------------------------------------------- |
1407
+ | 1 | GHSA-3xgq-45jj-v275 | `cross-spawn` | High | Root resolution `cross-spawn: ^7.0.6` (was transitive 5.1.0 via `execa@0.8.0` → `clipboardy` → `title` → `nextra`). |
1408
+ | 2 | GHSA-qjx8-664m-686j | `js-cookie` | High | Direct upgrade in `packages/relay`: `3.0.5` → `3.0.7`. |
1409
+ | 3 | GHSA-37ch-88jc-xwx2 | `path-to-regexp` | High | Direct upgrade in `packages/relay`: `express 4.21.2` → `4.22.2` (express 4.22 ships path-to-regexp 0.1.13). |
1410
+ | 4 | GHSA-7mvr-c777-76hp | `playwright` | High | Direct upgrade in `packages/core`: `@playwright/test 1.49.1` → `1.60.0`. |
1411
+ | 5 | GHSA-qx2v-qp2m-jg93 | `postcss` | Moderate | Root resolution `postcss: ^8.5.10` (Next 15 pinned 8.4.31; css-loader already uses 8.5.15). |
1412
+ | 6 | GHSA-6rw7-vpxm-498p | `qs` | Moderate | Closed by item 3 (express 4.22.2 bundles body-parser 1.20.5 → qs 6.15.2). |
1413
+ | 7 | GHSA-q8mj-m7cp-5q26 | `qs` | Moderate | Closed by item 3 (same). |
1414
+
1415
+ **Verified post-remediation:**
1416
+ - `corepack yarn audit-dependencies` → exit 0, no audit suggestions.
1417
+ - `corepack yarn workspace @apollion-dsi/core run validate` → green (types + prettier + lint + tests + build + check-vendors-not-published + visual gate). Visual regression suite chromium **133/133 passing** with `@playwright/test@1.60.0` — no baseline drift from the playwright bump.
1418
+ - `corepack yarn workspace @apollion-dsi/relay run validate` → green (3 test suites / 11 tests / 0 failures).
1419
+ - `corepack yarn workspace @apollion-dsi/website run build` → green.
1420
+
1421
+ **Exploit-surface notes:**
1422
+ - Express, body-parser, qs, path-to-regexp are all in `@apollion-dsi/relay#devDependencies` (test fixtures for the GraphQL relay environment) — realistic exploit surface was zero. Upgraded anyway because the fix was free.
1423
+ - Playwright cert verification (item 4) only matters during `npx playwright install` — also low exploit surface in a single-machine setup, but upgrading was free.
1424
+ - cross-spawn ReDoS reachable only during `nextra` doc generation, dev-only.
1425
+
1426
+ - 29081ae: chore(visual): regenerate firefox + webkit baselines (post ADR-006 OKLch)
1427
+
1428
+ DevDeps-only — no consumer-facing API change. Refreshes the 124 stale
1429
+ firefox + webkit baselines that drifted after `d57c47c feat(v4-s2): OKLch
1430
+ lerp via culori` updated only chromium baselines (the pre-push hook is
1431
+ chromium-only, so firefox + webkit drift went unnoticed). Restores the
1432
+ multi-browser net at 399/399 green and idempotent on darwin-arm64.
1433
+ - **Median diff absorbed:** 0.53 %; **max:** 10.35 % on
1434
+ `Layouts/SideBarLayout › Default` firefox — `primary.dark` shifted from
1435
+ `rgb(20, 70, 88)` (pre-OKLch RGB lerp) to `rgb(7, 46, 60)` (OKLch lerp).
1436
+ Same code, new perceptually-uniform color math.
1437
+ - **Net-new baselines:** `Components/Button › AllDimensions` and
1438
+ `Components/Card › AllDimensions` firefox + webkit captured for the first
1439
+ time (story count 131 → 133).
1440
+ - **PER_STORY_THRESHOLD escalations** (firefox skeleton shimmer sub-pixel
1441
+ drift — pre-existing class documented in `__image_snapshots__/AUDIT.md`):
1442
+ - `components-textpreset--default`: 0.5 % (re-emergence of the S2 entry,
1443
+ handled per AUDIT's predicted path).
1444
+ - `components-scenario-rect--default`: 1 % (new entry — same root cause).
1445
+
1446
+ Verified:
1447
+ - `VISUAL_BROWSERS="chromium firefox webkit" yarn workspace @apollion-dsi/core run test-storybook`
1448
+ is 399/399 green on two consecutive fresh runs (~80 s each, no `-u`).
1449
+ - Pre-push hook (chromium-only) behavior unchanged — closes the same gate.
1450
+ - SHA-256 of regenerated PNGs differs from `HEAD` (real pixel updates, not
1451
+ no-op mtime touches).