@askewly/design 0.4.0 → 0.4.1

package/dist/kickstart.js

@@ -1,8 +1,10 @@
-import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { builtinModules } from "node:module";
 import path from "node:path";
 import { createInterface } from "node:readline/promises";
 import { stdin, stdout } from "node:process";
 import { verifyDir } from "./verify.js";
+const BUILTIN_MODULES = new Set(builtinModules);
 export class KickstartError extends Error {
 }
 const REGISTRY_BASE = "https://ui.askewly.com";
@@ -309,6 +311,49 @@ function destFor(file, srcRoot) {
         return path.join(srcRoot, "lib", libMatch[1]);
     return path.join(srcRoot, "components", path.basename(p));
 }
+// ---------------------------------------------------------------------------
+// What the transplanted code actually needs installed.
+//
+// A registry item's declared `dependencies` is a lower bound, not the answer:
+// shadcn's own button.json declares only `radix-ui` while button.tsx imports
+// `class-variance-authority`. Following the printed `npm i` therefore left cva
+// missing and the first fresh build failed (M27). The authority is the source
+// we just wrote to disk, so read the imports out of it.
+// ---------------------------------------------------------------------------
+const SPECIFIER = /(?:\bfrom\s*|\brequire\s*\(\s*|\bimport\s*\(\s*|^\s*import\s+)(['"])([^'"]+)\1/gm;
+/** Bare npm package names imported by a source file, folded to their install name. */
+export function importedPackages(content) {
+    const found = new Set();
+    for (const match of content.matchAll(SPECIFIER)) {
+        const spec = match[2];
+        // Relative paths and the project's own `@/` alias are not packages.
+        if (spec.startsWith(".") || spec.startsWith("/") || spec.startsWith("@/"))
+            continue;
+        if (spec.startsWith("node:"))
+            continue;
+        if (BUILTIN_MODULES.has(spec.split("/")[0]))
+            continue;
+        const parts = spec.split("/");
+        // `radix-ui/react-slot` installs as `radix-ui`; `@scope/pkg/sub` as `@scope/pkg`.
+        found.add(spec.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0]);
+    }
+    return [...found];
+}
+/**
+ * The symbol a consumer imports to render the block.
+ *
+ * Derived from the transplanted page rather than declared in the registry:
+ * a meta field would mean regenerating and redeploying all 56 assets for a
+ * defect the CLI can close on its own. `…Demo` exports are the block's own
+ * showcase wrapper, never the entry point.
+ */
+export function blockExportName(pageSource) {
+    for (const match of pageSource.matchAll(/^\s*export\s+function\s+([A-Za-z_$][\w$]*)/gm)) {
+        if (!match[1].endsWith("Demo"))
+            return match[1];
+    }
+    return null;
+}
 export async function fetchBlock(blockName, registryBase) {
     const block = await fetchJson(`${registryBase}/r/${blockName}.json`);
     if (block.meta?.tier !== "block") {
@@ -321,6 +366,16 @@ export async function transplantBlock(block, targetDir) {
     const written = [];
     const npmDeps = new Set(["clsx", "tailwind-merge"]);
     const visited = new Set();
+    function write(file) {
+        const dest = destFor(file, srcRoot);
+        const content = rewriteImports(file.content);
+        mkdirSync(path.dirname(dest), { recursive: true });
+        writeFileSync(dest, content);
+        written.push(dest);
+        // The file we just wrote is the authority on what must be installed.
+        for (const pkg of importedPackages(content))
+            npmDeps.add(pkg);
+    }
     async function resolve(item) {
         for (const dep of item.dependencies ?? [])
             npmDeps.add(dep.split("@").slice(0, dep.startsWith("@") ? 2 : 1).join("@"));
@@ -332,21 +387,13 @@ export async function transplantBlock(block, targetDir) {
             visited.add(key);
             const child = await fetchJson(url);
             await resolve(child);
-            for (const file of child.files ?? []) {
-                const dest = destFor(file, srcRoot);
-                mkdirSync(path.dirname(dest), { recursive: true });
-                writeFileSync(dest, rewriteImports(file.content));
-                written.push(dest);
-            }
+            for (const file of child.files ?? [])
+                write(file);
         }
     }
     await resolve(block);
-    for (const file of block.files ?? []) {
-        const dest = destFor(file, srcRoot);
-        mkdirSync(path.dirname(dest), { recursive: true });
-        writeFileSync(dest, rewriteImports(file.content));
-        written.push(dest);
-    }
+    for (const file of block.files ?? [])
+        write(file);
     // cn() — shadcn init would have created it; transplant guarantees it (M18 step-5 friction).
     const utils = path.join(srcRoot, "lib", "utils.ts");
     if (!existsSync(utils)) {
@@ -401,10 +448,15 @@ export async function runKickstart(dir, opts) {
         throw new KickstartError("transplanted block bypasses the token system — fix before continuing");
     }
     console.log(`verify PASS — ${files} block file(s), no color literals`);
-    // 7. handoff
+    // 7. handoff — every line here must be true of the project that now exists on
+    //    disk. A printed step the reader cannot follow is worse than no step.
+    const pagePath = path.join(blockDir, "page.tsx");
+    const exportName = existsSync(pagePath) ? blockExportName(readFileSync(pagePath, "utf8")) : null;
     console.log(`\nNext steps:`);
     console.log(`  1. npm i ${[...result.npmDeps].sort().join(" ")}`);
     console.log(`  2. import "./askewly-brand.css" after \`@import "tailwindcss";\` in your global stylesheet`);
-    console.log(`  3. render the block: import { SaasAppShell } from "@/components/blocks/${opts.block}/page"`);
+    console.log(exportName
+        ? `  3. render the block: import { ${exportName} } from "@/components/blocks/${opts.block}/page"`
+        : `  3. render the block from "@/components/blocks/${opts.block}/page" — open it to see which component it exports`);
     console.log(`  4. wire routing yourself — the block deliberately ships none (block-contract §3)`);
 }

package/dist/verify.js

@@ -30,6 +30,21 @@ const LINE_COMMENT_EXTENSIONS = new Set(["ts", "tsx", "js", "jsx"]);
 // Two SVG shapes: paired <svg>…</svg> and self-closing <svg … />.
 const SVG_PAIRED = /<svg\b[\s\S]*?<\/svg\s*>/gi;
 const SVG_SELF_CLOSING = /<svg\b[^>]*\/>/gi;
+/**
+ * CSS attribute selectors whose value is a hex color, e.g. the Tailwind
+ * arbitrary variant `[&_.recharts-cartesian-grid_line[stroke='#ccc']]:stroke-border`.
+ *
+ * The hex there is a *match target*, not a color the file paints with: it names
+ * a value some third-party library already emitted so the rule can override it
+ * with a token. Flagging it inverts the gate — the line doing the token work is
+ * the line getting reported.
+ *
+ * Deliberately narrow: an attribute name, an `=` (optionally prefixed by a CSS
+ * match operator), and a *quoted* hex. Tailwind arbitrary values like
+ * `bg-[#ccc]` have no `=` and no quotes, so they stay violations. The optional
+ * backslashes cover selectors written inside a same-quoted JS string.
+ */
+const ATTR_SELECTOR_HEX = /\[[A-Za-z_-][\w:.-]*\s*[~^|*$]?=\s*\\?(['"])#[0-9a-fA-F]{3,8}\\?\1\s*[iIsS]?\s*\]/g;
 /**
  * Blanks regions whose color literals are not rendered output — comments and
  * SVG markup — while preserving every character position and newline, so
@@ -109,7 +124,7 @@ export function maskIgnoredRegions(source, ext) {
     // Pass 2 — SVG markup, matched against the comment-masked text so a commented
     // out `</svg>` cannot terminate a block early.
     let masked = chars.join("");
-    for (const pattern of [SVG_PAIRED, SVG_SELF_CLOSING]) {
+    for (const pattern of [SVG_PAIRED, SVG_SELF_CLOSING, ATTR_SELECTOR_HEX]) {
         masked = masked.replace(pattern, (match) => match.replace(/[^\n]/g, " "));
     }
     return masked;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askewly/design",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Query, inject, and verify the Askewly Design system (tokens, UI vocabulary, recipes) from your terminal or coding agent.",
   "license": "MIT",
   "homepage": "https://ui.askewly.com",