@colixsystems/widget-sdk 0.276.0 → 0.277.1

package/README.md

@@ -86,7 +86,17 @@ See the design reference for the full architecture: [`docs/architecture/widget-m
 
 ## Status
 
-`v0.276.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+`v0.277.1` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+
+### What's new in 0.277.1
+
+**`hand-rolled-write-gate` no longer fires on `theme.typography.roles`.** The rule looked for `.roles` / `.groupIds` anywhere in the file, so a writing widget that called `useUser()` and styled its text with `theme.typography.roles[name]` was flagged on the `useUser()` line and, through the publish gate, refused. It now reads only the value `useUser()` returns: the identifier it is assigned to (`user.roles`, `user?.groupIds`), a destructured `{ roles }` or `{ groupIds }`, or `useUser().roles` inline. Gating a write on `user.roles` without `useCanWrite` still warns.
+
+### What's new in 0.277.0
+
+**`validateManifest` refuses `manifest.actions` in ESM too.** The CommonJS build the backend runs has refused a widget-declared action since actions became their own marketplace deliverable, but the ESM build the CLI and the Builder import still validated the old shape. So `appstudio-widget lint` passed a manifest the publish step then rejected. Both builds now give the same error, which names `@colixsystems/action-sdk` as the replacement. The `actions` field in `index.d.ts` is marked `@deprecated`. This is a breaking change for a manifest that still declares `actions`, so it ships as a minor version. A widget already published with them still loads: `defineWidget` ignores the retired key.
+
+**Every CommonJS module is generated from its ESM source.** `linter.cjs`, `manifest.cjs`, `navigation.cjs`, `theme-appearance.cjs`, `theme-background.cjs`, `theme-components.cjs`, `lucideIconName.cjs`, `bundled-assets.cjs` and the new `source-mask.cjs` are now produced by `scripts/generate-cjs.js` alongside `contract.cjs`, rather than kept by hand. Edit the `.js` file, then run `npm run generate:cjs`. `cjs-generated.test.js` fails when a `.cjs` is stale or hand-edited. The exports map is unchanged.
 
 ### What's new in 0.276.0 (contract 1.226.0)
 

package/dist/bundled-assets.cjs

@@ -1,9 +1,13 @@
+// GENERATED from bundled-assets.js by scripts/generate-cjs.js — DO NOT EDIT.
+// Change bundled-assets.js, then run `npm run generate:cjs` in packages/widget-sdk.
+"use strict";
+
+const { CONTRACT } = require("./contract.cjs");
+
 // The files a widget package ships in its assets/ directory: which names and
 // types are allowed. Pure and filesystem-free, so the CLI, the dev server, the
 // first-party packer and the backend all apply one rule set.
-// CommonJS twin of bundled-assets.js for the backend. Keep both in lockstep.
 
-const { CONTRACT } = require("./contract.cjs");
 
 const RULES = CONTRACT.bundledAssets;
 const BUNDLED_ASSET_DIRECTORY = RULES.directory;

package/dist/bundled-assets.js

@@ -1,7 +1,6 @@
 // The files a widget package ships in its assets/ directory: which names and
 // types are allowed. Pure and filesystem-free, so the CLI, the dev server, the
 // first-party packer and the backend all apply one rule set.
-// Keep bundled-assets.cjs in lockstep.
 
 import { CONTRACT } from "./contract.js";
 

package/dist/contract.cjs

@@ -1,10 +1,11 @@
-// GENERATED from contract.js by scripts/contract-cjs.js — DO NOT EDIT.
-// Change contract.js, then run `npm run generate:contract` in packages/widget-sdk.
+// GENERATED from contract.js by scripts/generate-cjs.js — DO NOT EDIT.
+// Change contract.js, then run `npm run generate:cjs` in packages/widget-sdk.
+"use strict";
 
 // The widget SDK contract: the ONE source the linter, the AI agents, the
 // compiler and both hosts read. `contract.cjs` is GENERATED from `contract.js`
-// (`npm run generate:contract`) for CommonJS consumers — never edit it by hand;
-// contract-cjs-generated.test.js fails when it is stale.
+// (`npm run generate:cjs`) for CommonJS consumers — never edit it by hand;
+// cjs-generated.test.js fails when it is stale.
 
 // REQ-AI-AGENT-DESIGN (sc-3696): the ONE cross-platform elevation vocabulary.
 // `shadow*` applies on iOS + react-native-web, `elevation` drives Android.

package/dist/contract.js

@@ -1,7 +1,7 @@
 // The widget SDK contract: the ONE source the linter, the AI agents, the
 // compiler and both hosts read. `contract.cjs` is GENERATED from `contract.js`
-// (`npm run generate:contract`) for CommonJS consumers — never edit it by hand;
-// contract-cjs-generated.test.js fails when it is stale.
+// (`npm run generate:cjs`) for CommonJS consumers — never edit it by hand;
+// cjs-generated.test.js fails when it is stale.
 
 // REQ-AI-AGENT-DESIGN (sc-3696): the ONE cross-platform elevation vocabulary.
 // `shadow*` applies on iOS + react-native-web, `elevation` drives Android.

package/dist/define-widget.js

@@ -16,7 +16,7 @@ export function defineWidget(opts) {
   if (typeof component !== "function") {
     throw new TypeError("defineWidget: component must be a function");
   }
-  const result = validateManifest(manifest);
+  const result = validateManifest(withoutRetiredActions(manifest));
   if (!result.ok) {
     const msg = `Invalid widget manifest:\n  - ${result.errors.join("\n  - ")}`;
     throw new Error(msg);
@@ -27,3 +27,10 @@ export function defineWidget(opts) {
     _kind: "appstudio-widget-module",
   };
 }
+
+// Publishing refuses `actions`; a widget published before then must still load.
+function withoutRetiredActions(manifest) {
+  if (manifest === null || typeof manifest !== "object" || !("actions" in manifest)) return manifest;
+  const { actions: _retired, ...loadable } = manifest;
+  return loadable;
+}

package/dist/index.d.ts

@@ -455,9 +455,8 @@ export interface WidgetManifest {
    */
   datastoreTemplate?: WidgetDatastoreTemplate;
   /**
-   * Optional server-side actions (REQ-WIDGET-ACTION). Operators enable them
-   * per tenant from the Properties Panel; each runs in the existing
-   * isolated-vm action runner. See `WidgetManifestAction`.
+   * @deprecated Refused by `validateManifest` and at publish: ship the
+   * automation as a marketplace Action (`@colixsystems/action-sdk`).
    */
   actions?: WidgetManifestAction[];
   /**