@duffcloudservices/cms 0.13.0 → 0.13.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@duffcloudservices/cms",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "Vue 3 composables and Vite plugins for DCS CMS integration",
   "type": "module",
   "exports": {
@@ -58,7 +58,7 @@
   },
   "dependencies": {
     "js-yaml": "^4.1.0",
-    "@duffcloudservices/cms-core": "0.8.0"
+    "@duffcloudservices/cms-core": "0.8.1"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",

package/src/components/PreviewRibbon.vue

@@ -84,9 +84,18 @@
 </template>
 
 <script setup lang="ts">
-import { platformFetch } from '@duffcloudservices/cms-core'
 import { ref, computed, onMounted, onBeforeUnmount, watch } from 'vue'
 
+/*
+ * NO cms-core VALUE imports in this file. The `./components` export ships RAW SFC
+ * source (tsup builds no .vue), so consumer sites type-check this file directly —
+ * and cms-core is a transitive dep pnpm's strict layout never exposes to them.
+ * A value import here is TS2307 in every fleet site's type-check gate (measured on
+ * the 0.13.0 canary, 2026-08-10; kept/boogie-babies/bryans/mi-handyman all red).
+ * `import type` is erased and safe. The C-298 layer-2 guard this file needs from
+ * platformFetch is inlined below at its single call site instead.
+ */
+
 /* ------------------------------------------------------------------ */
 /*  Props                                                              */
 /* ------------------------------------------------------------------ */
@@ -235,15 +244,22 @@ onMounted(async () => {
     const base =
       (import.meta.env as Record<string, string | undefined>)
         .VITE_API_BASE_URL ?? 'https://portal.duffcloudservices.com'
-    // C-298 layer 2: the `catch { /* non-critical */ }` below is a swallow site; the
-    // wrapper's console error is what makes an HTML body visible at all here.
-    const res = await platformFetch(
-      `${base}/api/v1/release-notes/latest`,
-      { headers: { Accept: 'application/json' } },
-    )
+    // C-298 layer 2, INLINED (see the no-cms-core-value-imports note at the top of
+    // this <script>): the `catch { /* non-critical */ }` below is a swallow site, so
+    // a non-JSON (HTML-shell) body must go LOUD here before it can be swallowed.
+    const url = `${base}/api/v1/release-notes/latest`
+    const res = await fetch(url, { headers: { Accept: 'application/json' } })
     if (res.ok) {
-      const data = await res.json()
-      if (data.version) resolvedVersion.value = data.version
+      const ct = res.headers?.get?.('content-type') ?? ''
+      if (!/\bjson\b/i.test(ct)) {
+        console.error(
+          `[dcs-cms] PreviewRibbon: ${url} returned content-type "${ct}" — ` +
+            'an HTML body here means a platform misroute (C-298); refusing to parse it.',
+        )
+      } else {
+        const data = await res.json()
+        if (data.version) resolvedVersion.value = data.version
+      }
     }
   } catch {
     /* non-critical */

package/src/components/raw-source-imports.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, it } from 'vitest'
+import { readFileSync, readdirSync } from 'node:fs'
+import { join } from 'node:path'
+
+/**
+ * The `./components` export ships RAW SFC source (tsup builds no .vue), so every
+ * consumer site type-checks these files directly — against a dependency tree where
+ * cms-core is TRANSITIVE and pnpm's strict layout never exposes it. A VALUE import
+ * of cms-core in any raw-shipped .vue is therefore TS2307 in every fleet site's
+ * type-check gate, invisible to this package's own checks (cms-core resolves fine
+ * HERE — that is exactly why only a consumer-shaped gate or this test can see it).
+ *
+ * Measured on the 0.13.0 canary (2026-08-10): one value import in PreviewRibbon.vue
+ * would have redded CI on kept (the payer), boogie-babies, bryans and mi-handyman.
+ * `import type` is erased at compile time and stays allowed.
+ */
+describe('raw-source .vue exports must not value-import cms-core', () => {
+  const dir = __dirname
+  const vueFiles = readdirSync(dir).filter((f) => f.endsWith('.vue'))
+
+  it('finds the raw-shipped component set (non-vacuity)', () => {
+    expect(vueFiles.length).toBeGreaterThan(0)
+    expect(vueFiles).toContain('PreviewRibbon.vue')
+  })
+
+  for (const file of vueFiles) {
+    it(`${file} has no cms-core value import`, () => {
+      const src = readFileSync(join(dir, file), 'utf8')
+      const valueImports = Array.from(src.matchAll(/^\s*import\s+(?!type\b)[^;'"]*['"]@duffcloudservices\/cms-core['"]/gm))
+      expect(
+        valueImports.map((m) => m[0].trim()),
+        `${file} value-imports cms-core — this ships as raw source and breaks every consumer site's type-check (see header comment)`,
+      ).toEqual([])
+    })
+  }
+
+  it('kill-test: the guard regex catches the 0.13.0 defect shape', () => {
+    const bad = "import { platformFetch } from '@duffcloudservices/cms-core'"
+    const good = "import type { PlatformFetchOptions } from '@duffcloudservices/cms-core'"
+    const re = /^\s*import\s+(?!type\b)[^;'"]*['"]@duffcloudservices\/cms-core['"]/gm
+    expect(Array.from(bad.matchAll(re)).length).toBe(1)
+    expect(Array.from(good.matchAll(re)).length).toBe(0)
+  })
+})