@colixsystems/widget-sdk 0.277.0 → 0.277.2

package/README.md

@@ -86,7 +86,15 @@ See the design reference for the full architecture: [`docs/architecture/widget-m
 
 ## Status
 
-`v0.277.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+`v0.277.2` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+
+### What's new in 0.277.2
+
+**`<MarkdownInput>` shows list numbers and bullets on web.** The editor declares its own list markers, so a host page whose stylesheet resets list styles no longer hides them.
+
+### What's new in 0.277.1
+
+**`hand-rolled-write-gate` no longer fires on `theme.typography.roles`.** The rule looked for `.roles` / `.groupIds` anywhere in the file, so a writing widget that called `useUser()` and styled its text with `theme.typography.roles[name]` was flagged on the `useUser()` line and, through the publish gate, refused. It now reads only the value `useUser()` returns: the identifier it is assigned to (`user.roles`, `user?.groupIds`), a destructured `{ roles }` or `{ groupIds }`, or `useUser().roles` inline. Gating a write on `user.roles` without `useCanWrite` still warns.
 
 ### What's new in 0.277.0
 

package/dist/linter.cjs

@@ -1589,13 +1589,22 @@ function _rawUseMemoIntoDatastoreQueryRules(source) {
 // `.roles` re-implements the table ACL client-side and drifts from it the
 // moment the ACL changes; `useCanWrite(tableId)` reads the same rule the
 // write endpoint enforces. Flags only when the file has NOT already reached
-// for it.
+// for it, and only on useUser()'s own value: `theme.typography.roles` is a
+// style read (sc-15204).
+function _readsUserRoles(code) {
+  const named = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*useUser\s*\(\s*\)/.exec(code);
+  if (named && new RegExp(`\\b${named[1].replace(/\$/g, "\\$")}\\??\\.(groupIds|roles)\\b`).test(code)) return true;
+  const destructured = /\b(?:const|let|var)\s*\{([^}]*)\}\s*=\s*useUser\s*\(\s*\)/.exec(code);
+  if (destructured && /\b(groupIds|roles)\b/.test(destructured[1])) return true;
+  return /\buseUser\s*\(\s*\)\s*\??\.(groupIds|roles)\b/.test(code);
+}
+
 function _handRolledWriteGateRules(source) {
   const code = _stripNonCode(source);
   if (/\buseCanWrite\s*\(/.test(code)) return [];
   const userCall = /\buseUser\s*\(\s*\)/.exec(code);
   if (!userCall) return [];
-  if (!/\.(groupIds|roles)\b/.test(code)) return [];
+  if (!_readsUserRoles(code)) return [];
   const hasWrite =
     /\.(create|update)\s*\(/.test(code) ||
     /\buseDatastoreMutation\s*\(/.test(code);

package/dist/linter.js

@@ -1584,13 +1584,22 @@ function _rawUseMemoIntoDatastoreQueryRules(source) {
 // `.roles` re-implements the table ACL client-side and drifts from it the
 // moment the ACL changes; `useCanWrite(tableId)` reads the same rule the
 // write endpoint enforces. Flags only when the file has NOT already reached
-// for it.
+// for it, and only on useUser()'s own value: `theme.typography.roles` is a
+// style read (sc-15204).
+function _readsUserRoles(code) {
+  const named = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*useUser\s*\(\s*\)/.exec(code);
+  if (named && new RegExp(`\\b${named[1].replace(/\$/g, "\\$")}\\??\\.(groupIds|roles)\\b`).test(code)) return true;
+  const destructured = /\b(?:const|let|var)\s*\{([^}]*)\}\s*=\s*useUser\s*\(\s*\)/.exec(code);
+  if (destructured && /\b(groupIds|roles)\b/.test(destructured[1])) return true;
+  return /\buseUser\s*\(\s*\)\s*\??\.(groupIds|roles)\b/.test(code);
+}
+
 function _handRolledWriteGateRules(source) {
   const code = _stripNonCode(source);
   if (/\buseCanWrite\s*\(/.test(code)) return [];
   const userCall = /\buseUser\s*\(\s*\)/.exec(code);
   if (!userCall) return [];
-  if (!/\.(groupIds|roles)\b/.test(code)) return [];
+  if (!_readsUserRoles(code)) return [];
   const hasWrite =
     /\.(create|update)\s*\(/.test(code) ||
     /\buseDatastoreMutation\s*\(/.test(code);

package/dist/markdown-editor-css.js

@@ -2,7 +2,8 @@
 //
 // Kept apart from the editor module so the web host can style the field
 // before the lazily loaded editor arrives, and the native WebView page can
-// paint the same rules from the tokens it is sent.
+// paint the same rules from the tokens it is sent. List markers are declared
+// outright: a host stylesheet reset (Tailwind preflight) strips them.
 
 // Theme values are written into a stylesheet, so nothing may close the rule.
 const clean = (value) => String(value == null ? "" : value).replace(/[{}<>;\\]/g, "");
@@ -30,6 +31,8 @@ ${s} .ProseMirror h1{font-size:${px(t.headingSizes[1])};line-height:1.3}
 ${s} .ProseMirror h2{font-size:${px(t.headingSizes[2])};line-height:1.3}
 ${s} .ProseMirror h3{font-size:${px(t.headingSizes[3])};line-height:1.3}
 ${s} .ProseMirror ul,${s} .ProseMirror ol{margin:0 0 ${px(t.blockGap)};padding-left:1.4em}
+${s} .ProseMirror ul{list-style-type:disc}
+${s} .ProseMirror ol{list-style-type:decimal}
 ${s} .ProseMirror li p{margin:0}
 ${s} .ProseMirror code{font-family:ui-monospace,Menlo,monospace;font-size:${px(t.codeSize)};color:${t.mutedColor}}
 ${s} .ProseMirror pre{margin:0 0 ${px(t.blockGap)};padding:${px(t.blockGap)};border:1px solid ${t.border};border-radius:${px(t.radius)};white-space:pre-wrap}