@colixsystems/widget-sdk 0.117.0 → 0.118.0

package/dist/host.d.ts

@@ -59,10 +59,14 @@ export function normaliseWidgetStyleFields(
 export function normaliseWidgetStyles(raw: unknown): ThemeWidgetStyles;
 
 /**
- * REQ-THEME-15 host render-boundary helper: folds the theme's per-component
- * tokens into a widget's props as `style` DEFAULTS, with the author's
- * per-instance values winning. Returns the same `props` reference when the theme
- * sets nothing for this widget. Applied by the platform hosts, never by authors.
+ * REQ-THEME-15 host render-boundary helper: folds the widget's declared
+ * `styleSchema` defaults and the theme's per-component tokens into a widget's
+ * props as `style` DEFAULTS, with the author's per-instance values winning.
+ *
+ * sc-6750 — precedence, weakest first: `styleSchema` default ->
+ * palette/`components.<scope>` -> `widgetStyles[manifestId]` -> per-instance
+ * `props.style`. Returns the same `props` reference when neither the theme nor
+ * the schema sets anything. Applied by the platform hosts, never by authors.
  */
 export function applyThemeComponentStyle<T = Record<string, unknown>>(
   manifestId: string,

package/dist/linter.js

@@ -56,152 +56,9 @@ const CONTRACT_RULES = CONTRACT.bannedApis.map((b) =>
   _ruleForIdentifier(b.identifier, b.reason),
 );
 
-// Replace the *content* of comments and string / template literals with
-// spaces so the banned-identifier scan only ever sees executable code. A
-// banned host-escape identifier (`window`, `document`, `eval`, `process`, …)
-// is only dangerous as a real identifier reference — never as prose in a
-// `//` comment or as character data inside a string — so matching the bare
-// word there is a false positive that blocks an otherwise-clean widget (a
-// comment that reads "the hour window the grid renders" must not trip
-// `no-window`).
-//
-// Newlines are preserved verbatim so reported line numbers still line up
-// with the original source. Template-literal `${ … }` expression holes are
-// left intact: real code lives there and must still be scanned (`${window}`
-// is a genuine escape). Backslash escapes inside strings/templates are
-// consumed so an escaped quote (`"\""`) doesn't end the literal early.
-function _stripNonCode(source, { keepStrings = false } = {}) {
-  let out = "";
-  const n = source.length;
-  let mode = "code"; // code | line | block | sq | dq | tmpl
-  // Brace depth, plus a stack of the depths at which an enclosing template
-  // literal resumes — lets a `${ … }` hole (which may itself contain `{}`,
-  // strings, or nested templates) be told apart from the literal text.
-  let braceDepth = 0;
-  const tmplStack = [];
-  const keep = (ch) => {
-    out += ch;
-  };
-  const blank = (ch) => {
-    out += ch === "\n" || ch === "\r" ? ch : " ";
-  };
-  // String / template CONTENT: blanked for the banned-identifier scan
-  // (prose must not trip `no-window`), kept for the host-API-URL scan,
-  // whose whole job is to find a URL literal.
-  const str = keepStrings ? keep : blank;
-  let i = 0;
-  while (i < n) {
-    const ch = source[i];
-    const nx = source[i + 1];
-    if (mode === "code") {
-      if (ch === "/" && nx === "/") {
-        mode = "line";
-        blank(ch);
-        blank(nx);
-        i += 2;
-      } else if (ch === "/" && nx === "*") {
-        mode = "block";
-        blank(ch);
-        blank(nx);
-        i += 2;
-      } else if (ch === "'") {
-        mode = "sq";
-        str(ch);
-        i += 1;
-      } else if (ch === '"') {
-        mode = "dq";
-        str(ch);
-        i += 1;
-      } else if (ch === "`") {
-        mode = "tmpl";
-        str(ch);
-        i += 1;
-      } else if (ch === "{") {
-        braceDepth += 1;
-        keep(ch);
-        i += 1;
-      } else if (ch === "}") {
-        braceDepth -= 1;
-        if (
-          tmplStack.length > 0 &&
-          tmplStack[tmplStack.length - 1] === braceDepth
-        ) {
-          tmplStack.pop();
-          mode = "tmpl";
-          str(ch);
-        } else {
-          keep(ch);
-        }
-        i += 1;
-      } else {
-        keep(ch);
-        i += 1;
-      }
-    } else if (mode === "line") {
-      if (ch === "\n") {
-        mode = "code";
-        keep(ch);
-      } else {
-        blank(ch);
-      }
-      i += 1;
-    } else if (mode === "block") {
-      if (ch === "*" && nx === "/") {
-        mode = "code";
-        blank(ch);
-        blank(nx);
-        i += 2;
-      } else {
-        blank(ch);
-        i += 1;
-      }
-    } else if (mode === "sq" || mode === "dq") {
-      const quote = mode === "sq" ? "'" : '"';
-      if (ch === "\\") {
-        str(ch);
-        if (i + 1 < n) str(nx);
-        i += 2;
-      } else if (ch === quote) {
-        mode = "code";
-        str(ch);
-        i += 1;
-      } else if (ch === "\n") {
-        // A bare newline terminates an unterminated string in JS; bail back
-        // to code so malformed input can't blank the rest of the file.
-        mode = "code";
-        keep(ch);
-        i += 1;
-      } else {
-        str(ch);
-        i += 1;
-      }
-    } else {
-      // mode === "tmpl"
-      if (ch === "\\") {
-        str(ch);
-        if (i + 1 < n) str(nx);
-        i += 2;
-      } else if (ch === "`") {
-        mode = "code";
-        str(ch);
-        i += 1;
-      } else if (ch === "$" && nx === "{") {
-        // Enter an expression hole. Remember the brace depth the template
-        // resumes at, then count the `{` so its matching `}` is recognised.
-        tmplStack.push(braceDepth);
-        braceDepth += 1;
-        mode = "code";
-        keep(ch);
-        keep(nx);
-        i += 2;
-      } else {
-        str(ch);
-        i += 1;
-      }
-    }
-  }
-  return out;
-}
+// sc-6086: moved to source-mask.js so the packer's scanner masks source the
+// same way this linter does. Alias kept — the rules below read _stripNonCode.
+import { stripNonCode as _stripNonCode } from "./source-mask.js";
 
 // Extra rules that don't map 1:1 to a banned identifier in the contract:
 // host-internal imports that widgets must never touch.

package/dist/source-mask.js

@@ -0,0 +1,162 @@
+// sc-6086: the shared source masker, extracted verbatim from linter.js so the
+// linter, the packer's import scanner, and the dev-server guard all agree on
+// what is code and what is a comment or string literal (CLAUDE.md §3).
+//
+// Length-preserving: every blanked character becomes a space and newlines are
+// kept, so an index into the mask is the SAME index in the original source.
+// That is what lets a caller match against the mask and splice the original.
+
+// Replace the *content* of comments and string / template literals with
+// spaces so the banned-identifier scan only ever sees executable code. A
+// banned host-escape identifier (`window`, `document`, `eval`, `process`, …)
+// is only dangerous as a real identifier reference — never as prose in a
+// `//` comment or as character data inside a string — so matching the bare
+// word there is a false positive that blocks an otherwise-clean widget (a
+// comment that reads "the hour window the grid renders" must not trip
+// `no-window`).
+//
+// Newlines are preserved verbatim so reported line numbers still line up
+// with the original source. Template-literal `${ … }` expression holes are
+// left intact: real code lives there and must still be scanned (`${window}`
+// is a genuine escape). Backslash escapes inside strings/templates are
+// consumed so an escaped quote (`"\""`) doesn't end the literal early.
+export function stripNonCode(
+  source,
+  { keepStrings = false, keepTemplates = keepStrings } = {},
+) {
+  let out = "";
+  const n = source.length;
+  let mode = "code"; // code | line | block | sq | dq | tmpl
+  // Brace depth, plus a stack of the depths at which an enclosing template
+  // literal resumes — lets a `${ … }` hole (which may itself contain `{}`,
+  // strings, or nested templates) be told apart from the literal text.
+  let braceDepth = 0;
+  const tmplStack = [];
+  const keep = (ch) => {
+    out += ch;
+  };
+  const blank = (ch) => {
+    out += ch === "\n" || ch === "\r" ? ch : " ";
+  };
+  // String / template CONTENT: blanked for the banned-identifier scan
+  // (prose must not trip `no-window`), kept for the host-API-URL scan,
+  // whose whole job is to find a URL literal.
+  const str = keepStrings ? keep : blank;
+  // An import specifier is always a quoted string, never a template literal —
+  // so the import scanner keeps quoted content and blanks templates, which is
+  // what stops an `import … from "./x"` line inside a backtick block from
+  // reading as a real statement.
+  const tmplStr = keepTemplates ? keep : blank;
+  let i = 0;
+  while (i < n) {
+    const ch = source[i];
+    const nx = source[i + 1];
+    if (mode === "code") {
+      if (ch === "/" && nx === "/") {
+        mode = "line";
+        blank(ch);
+        blank(nx);
+        i += 2;
+      } else if (ch === "/" && nx === "*") {
+        mode = "block";
+        blank(ch);
+        blank(nx);
+        i += 2;
+      } else if (ch === "'") {
+        mode = "sq";
+        str(ch);
+        i += 1;
+      } else if (ch === '"') {
+        mode = "dq";
+        str(ch);
+        i += 1;
+      } else if (ch === "`") {
+        mode = "tmpl";
+        tmplStr(ch);
+        i += 1;
+      } else if (ch === "{") {
+        braceDepth += 1;
+        keep(ch);
+        i += 1;
+      } else if (ch === "}") {
+        braceDepth -= 1;
+        if (
+          tmplStack.length > 0 &&
+          tmplStack[tmplStack.length - 1] === braceDepth
+        ) {
+          tmplStack.pop();
+          mode = "tmpl";
+          str(ch);
+        } else {
+          keep(ch);
+        }
+        i += 1;
+      } else {
+        keep(ch);
+        i += 1;
+      }
+    } else if (mode === "line") {
+      if (ch === "\n") {
+        mode = "code";
+        keep(ch);
+      } else {
+        blank(ch);
+      }
+      i += 1;
+    } else if (mode === "block") {
+      if (ch === "*" && nx === "/") {
+        mode = "code";
+        blank(ch);
+        blank(nx);
+        i += 2;
+      } else {
+        blank(ch);
+        i += 1;
+      }
+    } else if (mode === "sq" || mode === "dq") {
+      const quote = mode === "sq" ? "'" : '"';
+      if (ch === "\\") {
+        str(ch);
+        if (i + 1 < n) str(nx);
+        i += 2;
+      } else if (ch === quote) {
+        mode = "code";
+        str(ch);
+        i += 1;
+      } else if (ch === "\n") {
+        // A bare newline terminates an unterminated string in JS; bail back
+        // to code so malformed input can't blank the rest of the file.
+        mode = "code";
+        keep(ch);
+        i += 1;
+      } else {
+        str(ch);
+        i += 1;
+      }
+    } else {
+      // mode === "tmpl"
+      if (ch === "\\") {
+        tmplStr(ch);
+        if (i + 1 < n) tmplStr(nx);
+        i += 2;
+      } else if (ch === "`") {
+        mode = "code";
+        tmplStr(ch);
+        i += 1;
+      } else if (ch === "$" && nx === "{") {
+        // Enter an expression hole. Remember the brace depth the template
+        // resumes at, then count the `{` so its matching `}` is recognised.
+        tmplStack.push(braceDepth);
+        braceDepth += 1;
+        mode = "code";
+        keep(ch);
+        keep(nx);
+        i += 2;
+      } else {
+        tmplStr(ch);
+        i += 1;
+      }
+    }
+  }
+  return out;
+}

package/dist/theme-components.cjs

@@ -245,6 +245,51 @@ function normaliseWidgetStyles(raw) {
   return out;
 }
 
+// Defaults are static manifest config; clone the structured ones so a widget
+// mutating props.style can never corrupt the shared manifest default. Mirrors
+// cloneDefault in property-schema.js.
+function cloneStyleDefault(value) {
+  if (value === null || typeof value !== "object") return value;
+  return JSON.parse(JSON.stringify(value));
+}
+
+// sc-6750: one styleSchema leaf's declared default, with the SAME nesting
+// semantics resolveLeaf (property-schema.js) gives the property side — an
+// `object` def whose own default is absent still contributes its children's.
+function styleLeafDefault(def) {
+  if (!isPlainObject(def)) return undefined;
+  if (def.default !== undefined) return cloneStyleDefault(def.default);
+  if (def.type !== "object" || !isPlainObject(def.properties)) return undefined;
+  const nested = {};
+  for (const [child, childDef] of Object.entries(def.properties)) {
+    if (!isUsableStyleKey(child)) continue;
+    const value = styleLeafDefault(childDef);
+    if (value !== undefined) nested[child] = value;
+  }
+  return Object.keys(nested).length > 0 ? nested : undefined;
+}
+
+/**
+ * sc-6750 — the widget author's OWN declared style baseline: each
+ * `styleSchema` leaf's `default`.
+ *
+ * The weakest layer by design, seeded beneath every theme layer: a widget's
+ * declared default must never out-rank the workspace theme, or every already-
+ * published widget would stop following the theme it follows today.
+ *
+ * @returns {Record<string, unknown>} field → declared default; `{}` when none.
+ */
+function styleSchemaDefaults(styleSchema) {
+  if (!isPlainObject(styleSchema)) return {};
+  const out = {};
+  for (const [field, def] of Object.entries(styleSchema)) {
+    if (!isUsableStyleKey(field)) continue;
+    const value = styleLeafDefault(def);
+    if (value !== undefined) out[field] = value;
+  }
+  return out;
+}
+
 /**
  * The per-component style fields that apply to one widget, keyed by the
  * `styleSchema` field name the widget actually reads. A widget may sit in more
@@ -255,12 +300,19 @@ function normaliseWidgetStyles(raw) {
  * before a value becomes a widget's style, and a host that folded the theme in
  * without normalising must not be able to hand a widget malformed input.
  *
- * @returns {Record<string, string|number>|null} null when nothing applies.
+ * Layered weakest-first: the widget's own `styleSchema` defaults, then the
+ * component scopes, then `widgetStyles[manifestId]`. The caller spreads the
+ * per-instance `props.style` last, so the full order is
+ * styleSchema default -> palette/scopes -> widgetStyles -> props.style.
+ *
+ * @returns {Record<string, unknown>|null} null when nothing applies.
  */
 function componentStyleFor(manifestId, components, styleSchema, widgetStyles) {
   if (typeof manifestId !== "string") return null;
   const validated = normaliseThemeComponents(components);
-  const out = {};
+  // sc-6750: the author's declared defaults are the WEAKEST layer, so they go
+  // in first and every theme layer below overwrites them.
+  const out = styleSchemaDefaults(styleSchema);
   for (const [scope, definition] of Object.entries(CONTRACT.themeComponents)) {
     const tokens = validated[scope];
     if (!tokens) continue;
@@ -305,20 +357,28 @@ function componentStyleFor(manifestId, components, styleSchema, widgetStyles) {
 }
 
 /**
- * Fold the theme's per-component tokens into a widget's props as `style`
- * DEFAULTS. The author's per-instance REQ-THEME-13 values are spread last and
- * therefore always win — the theme token is the app-wide baseline, the
- * Properties Panel is the final word.
+ * Fold the widget's declared `styleSchema` defaults and the theme's
+ * per-component tokens into a widget's props as `style` DEFAULTS. The author's
+ * per-instance REQ-THEME-13 values are spread last and therefore always win —
+ * the theme token is the app-wide baseline, the Properties Panel the final word.
+ *
+ * sc-6750: a `styleSchema` leaf's own `default` is resolved here too, as the
+ * BOTTOM layer. It is the widget author's baseline, so a workspace theme still
+ * out-ranks it and a field the author never defaulted follows the theme exactly
+ * as before — precedence: styleSchema default -> palette/`components.<scope>`
+ * -> `widgetStyles[manifestId]` -> per-instance `props.style`.
  *
- * Returns the SAME `props` reference when the theme sets nothing for this
- * widget, so an unthemed app takes no extra render work and behaves exactly as
- * it did before REQ-THEME-15.
+ * Returns the SAME `props` reference when neither the theme nor the schema sets
+ * anything for this widget, so an unthemed app with no declared style defaults
+ * takes no extra render work and behaves exactly as it did before REQ-THEME-15.
  *
  * @param {string} manifestId — the widget's canonical manifest id.
  * @param {object} theme — the resolved widget theme (`workspace.theme`); its
  *   `components` slice is read.
  * @param {object} props — the widget's resolved props (post-`resolveProps`).
- * @returns {object} props, with `style` folded when the theme applies.
+ * @param {object} [styleSchema] — the widget's declared style fields; their
+ *   `default`s form the bottom style layer.
+ * @returns {object} props, with `style` folded when anything applies.
  */
 function applyThemeComponentStyle(manifestId, theme, props, styleSchema) {
   const themed = componentStyleFor(

package/dist/theme-components.js

@@ -237,6 +237,51 @@ export function normaliseWidgetStyles(raw) {
   return out;
 }
 
+// Defaults are static manifest config; clone the structured ones so a widget
+// mutating props.style can never corrupt the shared manifest default. Mirrors
+// cloneDefault in property-schema.js.
+function cloneStyleDefault(value) {
+  if (value === null || typeof value !== "object") return value;
+  return JSON.parse(JSON.stringify(value));
+}
+
+// sc-6750: one styleSchema leaf's declared default, with the SAME nesting
+// semantics resolveLeaf (property-schema.js) gives the property side — an
+// `object` def whose own default is absent still contributes its children's.
+function styleLeafDefault(def) {
+  if (!isPlainObject(def)) return undefined;
+  if (def.default !== undefined) return cloneStyleDefault(def.default);
+  if (def.type !== "object" || !isPlainObject(def.properties)) return undefined;
+  const nested = {};
+  for (const [child, childDef] of Object.entries(def.properties)) {
+    if (!isUsableStyleKey(child)) continue;
+    const value = styleLeafDefault(childDef);
+    if (value !== undefined) nested[child] = value;
+  }
+  return Object.keys(nested).length > 0 ? nested : undefined;
+}
+
+/**
+ * sc-6750 — the widget author's OWN declared style baseline: each
+ * `styleSchema` leaf's `default`.
+ *
+ * The weakest layer by design, seeded beneath every theme layer: a widget's
+ * declared default must never out-rank the workspace theme, or every already-
+ * published widget would stop following the theme it follows today.
+ *
+ * @returns {Record<string, unknown>} field → declared default; `{}` when none.
+ */
+function styleSchemaDefaults(styleSchema) {
+  if (!isPlainObject(styleSchema)) return {};
+  const out = {};
+  for (const [field, def] of Object.entries(styleSchema)) {
+    if (!isUsableStyleKey(field)) continue;
+    const value = styleLeafDefault(def);
+    if (value !== undefined) out[field] = value;
+  }
+  return out;
+}
+
 /**
  * The per-component style fields that apply to one widget, keyed by the
  * `styleSchema` field name the widget actually reads. A widget may sit in more
@@ -247,12 +292,19 @@ export function normaliseWidgetStyles(raw) {
  * before a value becomes a widget's style, and a host that folded the theme in
  * without normalising must not be able to hand a widget malformed input.
  *
- * @returns {Record<string, string|number>|null} null when nothing applies.
+ * Layered weakest-first: the widget's own `styleSchema` defaults, then the
+ * component scopes, then `widgetStyles[manifestId]`. The caller spreads the
+ * per-instance `props.style` last, so the full order is
+ * styleSchema default -> palette/scopes -> widgetStyles -> props.style.
+ *
+ * @returns {Record<string, unknown>|null} null when nothing applies.
  */
 function componentStyleFor(manifestId, components, styleSchema, widgetStyles) {
   if (typeof manifestId !== "string") return null;
   const validated = normaliseThemeComponents(components);
-  const out = {};
+  // sc-6750: the author's declared defaults are the WEAKEST layer, so they go
+  // in first and every theme layer below overwrites them.
+  const out = styleSchemaDefaults(styleSchema);
   for (const [scope, definition] of Object.entries(CONTRACT.themeComponents)) {
     const tokens = validated[scope];
     if (!tokens) continue;
@@ -297,20 +349,28 @@ function componentStyleFor(manifestId, components, styleSchema, widgetStyles) {
 }
 
 /**
- * Fold the theme's per-component tokens into a widget's props as `style`
- * DEFAULTS. The author's per-instance REQ-THEME-13 values are spread last and
- * therefore always win — the theme token is the app-wide baseline, the
- * Properties Panel is the final word.
+ * Fold the widget's declared `styleSchema` defaults and the theme's
+ * per-component tokens into a widget's props as `style` DEFAULTS. The author's
+ * per-instance REQ-THEME-13 values are spread last and therefore always win —
+ * the theme token is the app-wide baseline, the Properties Panel the final word.
+ *
+ * sc-6750: a `styleSchema` leaf's own `default` is resolved here too, as the
+ * BOTTOM layer. It is the widget author's baseline, so a workspace theme still
+ * out-ranks it and a field the author never defaulted follows the theme exactly
+ * as before — precedence: styleSchema default -> palette/`components.<scope>`
+ * -> `widgetStyles[manifestId]` -> per-instance `props.style`.
  *
- * Returns the SAME `props` reference when the theme sets nothing for this
- * widget, so an unthemed app takes no extra render work and behaves exactly as
- * it did before REQ-THEME-15.
+ * Returns the SAME `props` reference when neither the theme nor the schema sets
+ * anything for this widget, so an unthemed app with no declared style defaults
+ * takes no extra render work and behaves exactly as it did before REQ-THEME-15.
  *
  * @param {string} manifestId — the widget's canonical manifest id.
  * @param {object} theme — the resolved widget theme (`workspace.theme`); its
  *   `components` slice is read.
  * @param {object} props — the widget's resolved props (post-`resolveProps`).
- * @returns {object} props, with `style` folded when the theme applies.
+ * @param {object} [styleSchema] — the widget's declared style fields; their
+ *   `default`s form the bottom style layer.
+ * @returns {object} props, with `style` folded when anything applies.
  */
 export function applyThemeComponentStyle(manifestId, theme, props, styleSchema) {
   const themed = componentStyleFor(

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@colixsystems/widget-sdk",
-  "version": "0.117.0",
+  "version": "0.118.0",
   "description": "Common widget interface for AppStudio. Implements WidgetManifest, WidgetContext, property schema, and helper hooks.",
+  "homepage": "https://github.com/Colix-AB/AppStudio",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -48,7 +49,7 @@
   ],
   "scripts": {
     "build": "node scripts/build.js",
-    "test": "node --test src/__tests__/contract.test.js src/__tests__/vetted-imports-audit.test.js src/__tests__/hooks-users.test.js src/__tests__/hooks-groups.test.js src/__tests__/hooks-invites.test.js src/__tests__/hooks-schema.test.js src/__tests__/hooks-assets-by-tag.test.js src/__tests__/hooks-filestore-upload.test.js src/__tests__/hooks-filestore-file.test.js src/__tests__/hooks-mutation.test.js src/__tests__/hooks-payments.test.js src/__tests__/hooks-record-permissions.test.js src/__tests__/hooks-geolocation.test.js src/__tests__/hooks-section-empty.test.js src/__tests__/hooks-widget-event.test.js src/__tests__/hooks-widget-input.test.js src/__tests__/hooks-identification.test.js src/__tests__/hooks-subscription.test.js src/__tests__/hooks-volatile-query-key.test.js src/__tests__/linter-users-scope.test.js src/__tests__/linter-comments.test.js src/__tests__/linter-translation-api.test.js src/__tests__/linter-page-url.test.js src/__tests__/linter-image-height.test.js src/__tests__/linter-hardcoded-design.test.js src/__tests__/linter-measured-padding.test.js src/__tests__/linter-payment-error.test.js src/__tests__/linter-platform.test.js src/__tests__/linter-react-import.test.js src/__tests__/lucide-icon-names.test.js src/__tests__/lucideIconName.test.js src/__tests__/manifest-actions.test.js src/__tests__/widget-translations.test.js src/__tests__/hooks-translate.test.js src/__tests__/devserver.test.js src/__tests__/host-externals.test.js src/__tests__/datetimepicker.test.js src/__tests__/property-schema-resolve.test.js src/__tests__/corner-radius.test.js src/__tests__/theme-components-parity.test.js src/__tests__/navigation-parity.test.js src/__tests__/theme-depth-tokens.test.js src/__tests__/interaction-lift.test.js src/__tests__/toast-host.test.js src/__tests__/overlay-tokens.test.js src/__tests__/hooks-domain-error-mapping.test.js src/__tests__/linter-datastore-error.test.js src/__tests__/linter-write-gating.test.js src/__tests__/hooks-speech-to-text.test.js src/__tests__/hooks-camera.test.js src/__tests__/hooks-bound-columns.test.js src/__tests__/hooks-stable-query.test.js src/__tests__/hooks-can-write.test.js src/__tests__/widget-route.test.js"
+    "test": "node --test src/__tests__/contract.test.js src/__tests__/vetted-imports-audit.test.js src/__tests__/hooks-users.test.js src/__tests__/hooks-groups.test.js src/__tests__/hooks-invites.test.js src/__tests__/hooks-schema.test.js src/__tests__/hooks-assets-by-tag.test.js src/__tests__/hooks-filestore-upload.test.js src/__tests__/hooks-filestore-file.test.js src/__tests__/hooks-mutation.test.js src/__tests__/hooks-payments.test.js src/__tests__/hooks-record-permissions.test.js src/__tests__/hooks-geolocation.test.js src/__tests__/hooks-section-empty.test.js src/__tests__/hooks-widget-event.test.js src/__tests__/hooks-widget-input.test.js src/__tests__/hooks-identification.test.js src/__tests__/hooks-subscription.test.js src/__tests__/hooks-volatile-query-key.test.js src/__tests__/linter-users-scope.test.js src/__tests__/linter-comments.test.js src/__tests__/linter-translation-api.test.js src/__tests__/linter-page-url.test.js src/__tests__/linter-image-height.test.js src/__tests__/linter-hardcoded-design.test.js src/__tests__/linter-measured-padding.test.js src/__tests__/linter-payment-error.test.js src/__tests__/linter-platform.test.js src/__tests__/linter-react-import.test.js src/__tests__/lucide-icon-names.test.js src/__tests__/lucideIconName.test.js src/__tests__/manifest-actions.test.js src/__tests__/widget-translations.test.js src/__tests__/hooks-translate.test.js src/__tests__/devserver.test.js src/__tests__/flatten-entry.test.js src/__tests__/host-externals.test.js src/__tests__/datetimepicker.test.js src/__tests__/property-schema-resolve.test.js src/__tests__/corner-radius.test.js src/__tests__/theme-components-parity.test.js src/__tests__/navigation-parity.test.js src/__tests__/theme-depth-tokens.test.js src/__tests__/interaction-lift.test.js src/__tests__/toast-host.test.js src/__tests__/overlay-tokens.test.js src/__tests__/hooks-domain-error-mapping.test.js src/__tests__/linter-datastore-error.test.js src/__tests__/linter-write-gating.test.js src/__tests__/hooks-speech-to-text.test.js src/__tests__/hooks-camera.test.js src/__tests__/hooks-bound-columns.test.js src/__tests__/hooks-stable-query.test.js src/__tests__/hooks-can-write.test.js src/__tests__/widget-route.test.js"
   },
   "engines": {
     "node": ">=18"
@@ -83,5 +84,8 @@
     "sdk",
     "low-code"
   ],
-  "license": "MIT"
+  "license": "MIT",
+  "devDependencies": {
+    "@babel/parser": "^7.29.7"
+  }
 }