@colixsystems/widget-sdk 0.104.0 → 0.105.0

package/README.md

@@ -68,8 +68,13 @@ See the design reference for the full architecture: [`docs/architecture/widget-m
 
 ## Status
 
-`v0.104.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+`v0.105.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
 
+### What's new in 0.105.0 (contract unchanged)
+
+**New linter rule `sdk-export-not-imported` — self-containment now covers the SDK surface, not just `React` (sc-5897).** `react-not-imported` (0.62.0) enforced that a referenced `React` global must be imported, but there was no equivalent rule for the SDK's own exports: source that called `useFilestoreFile(id)` — or rendered `<View>` — without naming it in `import { … } from "@colixsystems/widget-sdk"` linted clean, bundled clean, and threw `ReferenceError: useFilestoreFile is not defined` at render. The two failures are one bug, so they now share one detector, keyed off the names `CONTRACT.hooks` and `CONTRACT.primitives` already enumerate — a hook added to the contract is covered with no second list to maintain.
+
+The scan is AST-free, so it flags only the three reference forms text can decide with certainty: a call `NAME(`, a member read `NAME.` (`StyleSheet.create`), and a JSX element `<NAME`. Any other occurrence of the word — an import specifier, a local declaration or destructure, a property key, JSX text, a comment or string — means a binding the scan cannot see may exist, and the name is abandoned rather than flagged. `error` severity with no opt-out, matching `react-not-imported`. Author fix: add the name to your SDK import. `CONTRACT` is unchanged (no new field).
 ### What's new in 0.104.0 (contract 1.79.0)
 
 **Each corner can be rounded on its own — the `cornerRadius` property type.** A radius was a single number, so every rounded surface was rounded on all four corners: a card that meets the screen edge, a tab rounded only on top, or a bubble with one squared corner had no expression.

package/dist/linter.cjs

@@ -714,43 +714,129 @@ function _lucideIconRules(source) {
   return findings;
 }
 
-// sc-2353 — widget source must be self-contained. The automatic JSX runtime
-// binds jsx/jsxs from react/jsx-runtime but never `React` itself, so a widget
-// that reaches for the bare `React` global (React.createElement / React.Fragment
-// / React.memo / React.useMemo) without importing it renders fine until a
-// non-initial code path hits the reference, then throws "React is not defined".
-// The platform does NOT inject a React binding — require an explicit
-// `import React from "react"` (or `import * as React`) whenever the source
-// references React, so the bundle is self-contained on both hosts and survives
-// a download → re-upload round-trip. Plain JSX needs no React import.
-const _REACT_DEFAULT_IMPORT_RE = /\bimport\s+(?:React\b|\*\s+as\s+React\b)/;
-const _REACT_MEMBER_USE_RE = /\bReact\s*\./;
-function _reactInScopeRules(source) {
+// sc-2353 / sc-5897 — widget source must be SELF-CONTAINED: every identifier it
+// references needs a binding in that file. Two rules share ONE detector here
+// because they are one bug with one cause (CLAUDE.md §3):
+//
+//   * `react-not-imported` (sc-2353) — the automatic JSX runtime binds
+//     jsx/jsxs from react/jsx-runtime but never `React` itself, so source that
+//     reaches for the bare `React` global (React.createElement / React.Fragment
+//     / React.memo) renders fine until a non-initial code path hits the
+//     reference, then throws "React is not defined". The platform does NOT
+//     inject a React binding. Plain JSX needs no React import.
+//   * `sdk-export-not-imported` (sc-5897) — an SDK hook or primitive referenced
+//     as a bare identifier (`useFilestoreFile(id)`, `<View>`) with no import
+//     throws the same ReferenceError. It used to lint clean and surface only at
+//     the render.smoke gate, where "<name> is not defined" is softenable — so
+//     it was demoted to an advisory warning and burned repair turns instead of
+//     being rejected deterministically here.
+//
+// The scan is AST-free, so it flags ONLY the three reference forms text can
+// decide with certainty — a call `NAME(`, a member read `NAME.`, and a JSX
+// element `<NAME`. Any OTHER occurrence of the word (an import specifier, a
+// declaration, a destructured local, a property key, JSX text) means a binding
+// this scan cannot see may exist, so the name is abandoned rather than flagged:
+// missing a real bug is recoverable, a false `error` with no opt-out blocks a
+// legitimate publish.
+const _IDENTIFIER_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+
+// CONTRACT enumerates the SDK's public hooks and primitives, so a name added
+// there is covered here without a second hand-maintained list.
+const _SDK_EXPORT_NAMES = Array.from(
+  new Set(
+    [...CONTRACT.hooks, ...CONTRACT.primitives]
+      .map((entry) => entry && entry.name)
+      .filter((name) => typeof name === "string" && _IDENTIFIER_RE.test(name)),
+  ),
+);
+
+// The only words that may legally precede an expression. A DECLARATION keyword
+// (`function`/`const`/`import`/`new`/`as`/…) is absent by design, and so is
+// every other identifier: `Call useTheme() now` is not valid JS, so a word lead
+// outside this set means the match sits in JSX text, not in code.
+const _EXPRESSION_LEAD_WORDS = new Set([
+  "return",
+  "await",
+  "typeof",
+  "void",
+  "delete",
+  "yield",
+  "throw",
+  "case",
+  "in",
+  "of",
+  "do",
+  "else",
+  "instanceof",
+]);
+
+// 1-based line of the first unbound reference to `name`, or 0 when the name is
+// bound, never referenced, or referenced in a form this scan cannot decide.
+function _unboundReferenceLine(code, name) {
+  if (!code.includes(name)) return 0;
+  // `NAME(…) {` is a function / method DEFINITION, not a call.
+  if (new RegExp(`\\b${name}\\s*\\([^()]*\\)\\s*\\{`).test(code)) return 0;
+  const word = new RegExp(`\\b${name}\\b`, "g");
+  let firstIndex = -1;
+  let match;
+  while ((match = word.exec(code))) {
+    const before = code.slice(0, match.index).replace(/\s+$/, "");
+    // `obj.NAME` / `obj?.NAME` / `{...NAME}` — never this binding.
+    if (before.endsWith(".")) continue;
+    const lead = before.slice(-1);
+    if (/[A-Za-z0-9_$]/.test(lead)) {
+      const leadWord = (before.match(/[A-Za-z_$][A-Za-z0-9_$]*$/) || [""])[0];
+      if (!_EXPRESSION_LEAD_WORDS.has(leadWord)) return 0;
+    } else if (lead === ">" && !before.endsWith("=>")) {
+      // A `>` that is not an arrow closes a JSX tag, so what follows is text.
+      return 0;
+    }
+    const after = code.slice(match.index + name.length).replace(/^\s+/, "");
+    const isReference =
+      /<\s*\/?$/.test(before) || after.startsWith("(") || after.startsWith(".");
+    if (!isReference) return 0;
+    if (firstIndex < 0) firstIndex = match.index;
+  }
+  if (firstIndex < 0) return 0;
+  return code.slice(0, firstIndex).split(/\r?\n/).length;
+}
+
+function _selfContainedReferenceRules(source) {
   const findings = [];
   const code = _stripNonCode(source);
-  if (!_REACT_MEMBER_USE_RE.test(code)) return findings;
-  if (_REACT_DEFAULT_IMPORT_RE.test(code)) return findings;
-  const codeLines = code.split(/\r?\n/);
   const sourceLines = source.split(/\r?\n/);
-  let line = 0;
-  for (let i = 0; i < codeLines.length; i += 1) {
-    if (_REACT_MEMBER_USE_RE.test(codeLines[i])) {
-      line = i + 1;
-      break;
-    }
+  const snippetAt = (line) => (sourceLines[line - 1] || "").trim().slice(0, 200);
+
+  const reactLine = _unboundReferenceLine(code, "React");
+  if (reactLine) {
+    findings.push({
+      rule: "react-not-imported",
+      severity: "error",
+      label:
+        "source references the `React` global (e.g. React.createElement / " +
+        "React.Fragment) but never imports it — widget source must be " +
+        'self-contained. Add `import React from "react";` at the top, or drop ' +
+        "the bare `React` reference in favour of a JSX fragment `<>…</>` and the " +
+        "SDK hooks (useState / useMemo / …) and primitives (View / Text / …).",
+      line: reactLine,
+      snippet: snippetAt(reactLine),
+    });
+  }
+
+  for (const name of _SDK_EXPORT_NAMES) {
+    const line = _unboundReferenceLine(code, name);
+    if (!line) continue;
+    findings.push({
+      rule: "sdk-export-not-imported",
+      severity: "error",
+      label:
+        `\`${name}\` is used but never imported — it throws ` +
+        `"${name} is not defined" at render. Import it from ` +
+        '"@colixsystems/widget-sdk"; widget source must be self-contained.',
+      line,
+      snippet: snippetAt(line),
+    });
   }
-  findings.push({
-    rule: "react-not-imported",
-    severity: "error",
-    label:
-      "source references the `React` global (e.g. React.createElement / " +
-      "React.Fragment) but never imports it — widget source must be " +
-      'self-contained. Add `import React from "react";` at the top, or drop ' +
-      "the bare `React` reference in favour of a JSX fragment `<>…</>` and the " +
-      "SDK hooks (useState / useMemo / …) and primitives (View / Text / …).",
-    line,
-    snippet: (sourceLines[line - 1] || "").trim().slice(0, 200),
-  });
   return findings;
 }
 
@@ -1195,7 +1281,7 @@ function lintSource(source, options) {
   findings.push(..._translationApiRules(source));
   findings.push(..._handBuiltPageUrlRules(source));
   findings.push(..._lucideIconRules(source));
-  findings.push(..._reactInScopeRules(source));
+  findings.push(..._selfContainedReferenceRules(source));
   findings.push(..._imagePercentHeightRules(source));
   // sc-4913 — soft warning: a measured width that includes the widget's own
   // padding wraps the last grid column into an empty one.

package/dist/linter.js

@@ -835,43 +835,129 @@ function _lucideIconRules(source) {
   return findings;
 }
 
-// sc-2353 — widget source must be self-contained. The automatic JSX runtime
-// binds jsx/jsxs from react/jsx-runtime but never `React` itself, so a widget
-// that reaches for the bare `React` global (React.createElement / React.Fragment
-// / React.memo / React.useMemo) without importing it renders fine until a
-// non-initial code path hits the reference, then throws "React is not defined".
-// The platform does NOT inject a React binding — require an explicit
-// `import React from "react"` (or `import * as React`) whenever the source
-// references React, so the bundle is self-contained on both hosts and survives
-// a download → re-upload round-trip. Plain JSX needs no React import.
-const _REACT_DEFAULT_IMPORT_RE = /\bimport\s+(?:React\b|\*\s+as\s+React\b)/;
-const _REACT_MEMBER_USE_RE = /\bReact\s*\./;
-function _reactInScopeRules(source) {
+// sc-2353 / sc-5897 — widget source must be SELF-CONTAINED: every identifier it
+// references needs a binding in that file. Two rules share ONE detector here
+// because they are one bug with one cause (CLAUDE.md §3):
+//
+//   * `react-not-imported` (sc-2353) — the automatic JSX runtime binds
+//     jsx/jsxs from react/jsx-runtime but never `React` itself, so source that
+//     reaches for the bare `React` global (React.createElement / React.Fragment
+//     / React.memo) renders fine until a non-initial code path hits the
+//     reference, then throws "React is not defined". The platform does NOT
+//     inject a React binding. Plain JSX needs no React import.
+//   * `sdk-export-not-imported` (sc-5897) — an SDK hook or primitive referenced
+//     as a bare identifier (`useFilestoreFile(id)`, `<View>`) with no import
+//     throws the same ReferenceError. It used to lint clean and surface only at
+//     the render.smoke gate, where "<name> is not defined" is softenable — so
+//     it was demoted to an advisory warning and burned repair turns instead of
+//     being rejected deterministically here.
+//
+// The scan is AST-free, so it flags ONLY the three reference forms text can
+// decide with certainty — a call `NAME(`, a member read `NAME.`, and a JSX
+// element `<NAME`. Any OTHER occurrence of the word (an import specifier, a
+// declaration, a destructured local, a property key, JSX text) means a binding
+// this scan cannot see may exist, so the name is abandoned rather than flagged:
+// missing a real bug is recoverable, a false `error` with no opt-out blocks a
+// legitimate publish.
+const _IDENTIFIER_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+
+// CONTRACT enumerates the SDK's public hooks and primitives, so a name added
+// there is covered here without a second hand-maintained list.
+const _SDK_EXPORT_NAMES = Array.from(
+  new Set(
+    [...CONTRACT.hooks, ...CONTRACT.primitives]
+      .map((entry) => entry && entry.name)
+      .filter((name) => typeof name === "string" && _IDENTIFIER_RE.test(name)),
+  ),
+);
+
+// The only words that may legally precede an expression. A DECLARATION keyword
+// (`function`/`const`/`import`/`new`/`as`/…) is absent by design, and so is
+// every other identifier: `Call useTheme() now` is not valid JS, so a word lead
+// outside this set means the match sits in JSX text, not in code.
+const _EXPRESSION_LEAD_WORDS = new Set([
+  "return",
+  "await",
+  "typeof",
+  "void",
+  "delete",
+  "yield",
+  "throw",
+  "case",
+  "in",
+  "of",
+  "do",
+  "else",
+  "instanceof",
+]);
+
+// 1-based line of the first unbound reference to `name`, or 0 when the name is
+// bound, never referenced, or referenced in a form this scan cannot decide.
+function _unboundReferenceLine(code, name) {
+  if (!code.includes(name)) return 0;
+  // `NAME(…) {` is a function / method DEFINITION, not a call.
+  if (new RegExp(`\\b${name}\\s*\\([^()]*\\)\\s*\\{`).test(code)) return 0;
+  const word = new RegExp(`\\b${name}\\b`, "g");
+  let firstIndex = -1;
+  let match;
+  while ((match = word.exec(code))) {
+    const before = code.slice(0, match.index).replace(/\s+$/, "");
+    // `obj.NAME` / `obj?.NAME` / `{...NAME}` — never this binding.
+    if (before.endsWith(".")) continue;
+    const lead = before.slice(-1);
+    if (/[A-Za-z0-9_$]/.test(lead)) {
+      const leadWord = (before.match(/[A-Za-z_$][A-Za-z0-9_$]*$/) || [""])[0];
+      if (!_EXPRESSION_LEAD_WORDS.has(leadWord)) return 0;
+    } else if (lead === ">" && !before.endsWith("=>")) {
+      // A `>` that is not an arrow closes a JSX tag, so what follows is text.
+      return 0;
+    }
+    const after = code.slice(match.index + name.length).replace(/^\s+/, "");
+    const isReference =
+      /<\s*\/?$/.test(before) || after.startsWith("(") || after.startsWith(".");
+    if (!isReference) return 0;
+    if (firstIndex < 0) firstIndex = match.index;
+  }
+  if (firstIndex < 0) return 0;
+  return code.slice(0, firstIndex).split(/\r?\n/).length;
+}
+
+function _selfContainedReferenceRules(source) {
   const findings = [];
   const code = _stripNonCode(source);
-  if (!_REACT_MEMBER_USE_RE.test(code)) return findings;
-  if (_REACT_DEFAULT_IMPORT_RE.test(code)) return findings;
-  const codeLines = code.split(/\r?\n/);
   const sourceLines = source.split(/\r?\n/);
-  let line = 0;
-  for (let i = 0; i < codeLines.length; i += 1) {
-    if (_REACT_MEMBER_USE_RE.test(codeLines[i])) {
-      line = i + 1;
-      break;
-    }
+  const snippetAt = (line) => (sourceLines[line - 1] || "").trim().slice(0, 200);
+
+  const reactLine = _unboundReferenceLine(code, "React");
+  if (reactLine) {
+    findings.push({
+      rule: "react-not-imported",
+      severity: "error",
+      label:
+        "source references the `React` global (e.g. React.createElement / " +
+        "React.Fragment) but never imports it — widget source must be " +
+        'self-contained. Add `import React from "react";` at the top, or drop ' +
+        "the bare `React` reference in favour of a JSX fragment `<>…</>` and the " +
+        "SDK hooks (useState / useMemo / …) and primitives (View / Text / …).",
+      line: reactLine,
+      snippet: snippetAt(reactLine),
+    });
+  }
+
+  for (const name of _SDK_EXPORT_NAMES) {
+    const line = _unboundReferenceLine(code, name);
+    if (!line) continue;
+    findings.push({
+      rule: "sdk-export-not-imported",
+      severity: "error",
+      label:
+        `\`${name}\` is used but never imported — it throws ` +
+        `"${name} is not defined" at render. Import it from ` +
+        '"@colixsystems/widget-sdk"; widget source must be self-contained.',
+      line,
+      snippet: snippetAt(line),
+    });
   }
-  findings.push({
-    rule: "react-not-imported",
-    severity: "error",
-    label:
-      "source references the `React` global (e.g. React.createElement / " +
-      "React.Fragment) but never imports it — widget source must be " +
-      'self-contained. Add `import React from "react";` at the top, or drop ' +
-      "the bare `React` reference in favour of a JSX fragment `<>…</>` and the " +
-      "SDK hooks (useState / useMemo / …) and primitives (View / Text / …).",
-    line,
-    snippet: (sourceLines[line - 1] || "").trim().slice(0, 200),
-  });
   return findings;
 }
 
@@ -1372,8 +1458,9 @@ export function lintSource(source, options) {
   findings.push(..._translationApiRules(source));
   findings.push(..._handBuiltPageUrlRules(source));
   findings.push(..._lucideIconRules(source));
-  // sc-2353 — widget source must be self-contained (reference React ⇒ import it).
-  findings.push(..._reactInScopeRules(source));
+  // sc-2353 / sc-5897 — widget source must be self-contained: a referenced
+  // `React` global or SDK export with no import throws at render.
+  findings.push(..._selfContainedReferenceRules(source));
   // sc-3493 — soft warning: percentage height on an <Image> collapses to 0.
   findings.push(..._imagePercentHeightRules(source));
   // sc-4913 — soft warning: a measured width that includes the widget's own

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@colixsystems/widget-sdk",
-  "version": "0.104.0",
+  "version": "0.105.0",
   "description": "Common widget interface for AppStudio. Implements WidgetManifest, WidgetContext, property schema, and helper hooks.",
   "type": "module",
   "main": "./dist/index.js",