@icomponents/react 0.1.0

package/src/i18n/types.ts

@@ -0,0 +1,22 @@
+/**
+ * Контракт локализации: переводы НЕ монолитны. Каждая фича/слайс несёт свой `NamespaceBundle`
+ * (co-located с кодом слайса), а собираются они в composition root — тем же приёмом, что каталог
+ * прав (`createPermissionCatalog`) и список шрифтов (`FontProvider fonts`). Ядро даёт механизм и
+ * свои бандлы; продукт добавляет свои. Ни у кого нет одного общего `locales/*.json`.
+ */
+export const LOCALES = ["ru", "en"] as const;
+export type Locale = (typeof LOCALES)[number];
+
+/** Словарь фичи: ПЛОСКИЙ или вложенный набор строк, один и тот же ключевой состав на каждый язык. */
+export type Messages = Record<string, unknown>;
+
+/**
+ * Вклад одной фичи в i18n: имя неймспейса (= слайс) + словари на каждый язык.
+ * `useTranslation("<ns>")` в компонентах фичи читает ровно этот бандл.
+ */
+export type NamespaceBundle = {
+  /** Имя неймспейса — обычно совпадает со слайсом: "companies", "nav", "audit"… Уникально. */
+  ns: string;
+  /** Словари по языкам. Ключи ОБЯЗАНЫ совпадать между языками (это проверяет тест-страж). */
+  messages: Record<Locale, Messages>;
+};

package/src/i18n/use-translation.ts

@@ -0,0 +1,6 @@
+/**
+ * Реэкспорт хука перевода из ui, чтобы фичи (iam, продуктовые пакеты, apps/web) НЕ тянули
+ * `react-i18next` в свои зависимости — он остаётся деталью реализации пакета ui. Фичи импортируют
+ * `useTranslation` отсюда: `import { useTranslation } from "@icomponents/react/i18n/use-translation"`.
+ */
+export { Trans, useTranslation } from "react-i18next";

package/src/lib/clipboard.test.ts

@@ -0,0 +1,46 @@
+import { afterEach, describe, expect, it } from "bun:test";
+
+import { copyToClipboard } from "./clipboard";
+
+// `navigator` is a read-only global under the bun runtime, so we swap it via a configurable property
+// descriptor (and restore the original after each case) rather than plain assignment.
+const descriptor = Object.getOwnPropertyDescriptor(globalThis, "navigator");
+
+afterEach(() => {
+  if (descriptor) Object.defineProperty(globalThis, "navigator", descriptor);
+  else delete (globalThis as { navigator?: unknown }).navigator;
+});
+
+function stubClipboard(writeText: ((t: string) => Promise<void>) | undefined) {
+  Object.defineProperty(globalThis, "navigator", {
+    configurable: true,
+    value: { clipboard: writeText ? { writeText } : {} },
+  });
+}
+
+describe("copyToClipboard — never hangs, never throws, reports confirmation", () => {
+  it("returns true when the write resolves", async () => {
+    let seen = "";
+    stubClipboard(async (t) => {
+      seen = t;
+    });
+    expect(await copyToClipboard("hello")).toBe(true);
+    expect(seen).toBe("hello");
+  });
+
+  it("returns false when the Clipboard API is absent (no writeText)", async () => {
+    stubClipboard(undefined);
+    expect(await copyToClipboard("x")).toBe(false);
+  });
+
+  it("returns false when the write rejects (blocked/insecure origin)", async () => {
+    stubClipboard(() => Promise.reject(new Error("NotAllowedError")));
+    expect(await copyToClipboard("x")).toBe(false);
+  });
+
+  it("returns false instead of hanging when the write never settles (unfocused doc / headless)", async () => {
+    // A promise that never resolves — the real failure mode. With no timeout this test would hang.
+    stubClipboard(() => new Promise<void>(() => {}));
+    expect(await copyToClipboard("x", 30)).toBe(false);
+  });
+});

package/src/lib/clipboard.ts

@@ -0,0 +1,29 @@
+/**
+ * Copy `text` to the clipboard, resolving to whether the write was CONFIRMED. Never throws, and —
+ * critically — never hangs.
+ *
+ * `navigator.clipboard.writeText` is deceptively unreliable: it rejects when the Clipboard API is
+ * blocked or absent (insecure origin, permission policy), and it can hang FOREVER (never settling)
+ * when the document isn't focused — a background tab, or a headless browser. An `await` on it therefore
+ * risks stranding the caller mid-handler, so the user is told nothing at all: neither success nor
+ * failure. That silent stall is exactly the failure mode this guards against.
+ *
+ * Contract: a `false` result means "not copied" — the caller MUST still surface the value some other
+ * way (e.g. show the link in a toast) so the action never fails silently.
+ */
+export async function copyToClipboard(text: string, timeoutMs = 1000): Promise<boolean> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  try {
+    const write = navigator.clipboard?.writeText(text);
+    if (!write) return false; // no Clipboard API at all
+    const timeout = new Promise<never>((_, reject) => {
+      timer = setTimeout(() => reject(new Error("clipboard write timed out")), timeoutMs);
+    });
+    await Promise.race([write, timeout]);
+    return true;
+  } catch {
+    return false;
+  } finally {
+    clearTimeout(timer);
+  }
+}

package/src/lib/cookies.ts

@@ -0,0 +1,39 @@
+/**
+ * Cookie utility functions using manual document.cookie approach
+ * Replaces js-cookie dependency for better consistency
+ */
+
+const DEFAULT_MAX_AGE = 60 * 60 * 24 * 7; // 7 days
+
+/**
+ * Get a cookie value by name
+ */
+export function getCookie(name: string): string | undefined {
+  if (typeof document === "undefined") return undefined;
+
+  const value = `; ${document.cookie}`;
+  const parts = value.split(`; ${name}=`);
+  if (parts.length === 2) {
+    const cookieValue = parts.pop()?.split(";").shift();
+    return cookieValue;
+  }
+  return undefined;
+}
+
+/**
+ * Set a cookie with name, value, and optional max age
+ */
+export function setCookie(name: string, value: string, maxAge: number = DEFAULT_MAX_AGE): void {
+  if (typeof document === "undefined") return;
+
+  document.cookie = `${name}=${value}; path=/; max-age=${maxAge}`;
+}
+
+/**
+ * Remove a cookie by setting its max age to 0
+ */
+export function removeCookie(name: string): void {
+  if (typeof document === "undefined") return;
+
+  document.cookie = `${name}=; path=/; max-age=0`;
+}

package/src/lib/format-cell.test.ts

@@ -0,0 +1,57 @@
+import { describe, expect, it } from "bun:test";
+
+import { formatCellDate, toCellPrimitive } from "./format-cell";
+
+const isPrimitive = (v: unknown) => ["string", "number", "boolean"].includes(typeof v);
+
+describe("formatCellDate (date-ish cell columns)", () => {
+  it("turns a Date into a stable display string, never a Date/object", () => {
+    const out = formatCellDate(new Date("2026-07-05T11:36:00.000Z"));
+    expect(typeof out).toBe("string");
+    expect(out).toBe("2026-07-05T11:36:00.000Z");
+    expect(out).not.toBeInstanceOf(Date);
+  });
+  it("passes an already-formatted string through readably (no corruption)", () => {
+    expect(formatCellDate("1970-01-01T00:00:00.000Z")).toBe("1970-01-01T00:00:00.000Z");
+  });
+  it("returns the '—' fallback for null and undefined", () => {
+    expect(formatCellDate(null)).toBe("—");
+    expect(formatCellDate(undefined)).toBe("—");
+  });
+  it("returns the '—' fallback for an Invalid Date instead of throwing", () => {
+    expect(formatCellDate(new Date("not-a-date"))).toBe("—");
+  });
+  it("always returns a primitive", () => {
+    for (const v of [new Date(), "x", 5, true, null, undefined, { a: 1 }]) {
+      expect(isPrimitive(formatCellDate(v))).toBe(true);
+    }
+  });
+});
+
+describe("toCellPrimitive (generic non-date cell guard)", () => {
+  it("passes primitive strings/numbers/booleans through unchanged (no corruption of parameter/actor text)", () => {
+    expect(toCellPrimitive("per_minute")).toBe("per_minute");
+    expect(toCellPrimitive(5)).toBe(5);
+    expect(toCellPrimitive(false)).toBe(false);
+  });
+  it("formats a leaked Date to a display string", () => {
+    expect(toCellPrimitive(new Date("2026-07-05T11:36:00.000Z"))).toBe("2026-07-05T11:36:00.000Z");
+  });
+  it("returns the '—' fallback for null/undefined", () => {
+    expect(toCellPrimitive(null)).toBe("—");
+    expect(toCellPrimitive(undefined)).toBe("—");
+  });
+  it("returns the '—' fallback for a blank/empty string (never-blank-cell — AC-F4-4)", () => {
+    expect(toCellPrimitive("")).toBe("—");
+  });
+  it("returns a safe string for any other object, never a raw object", () => {
+    const out = toCellPrimitive({ nested: true });
+    expect(typeof out).toBe("string");
+    expect(isPrimitive(out)).toBe(true);
+  });
+  it("always returns a primitive", () => {
+    for (const v of [new Date(), "x", 5, true, null, undefined, { a: 1 }, [1, 2]]) {
+      expect(isPrimitive(toCellPrimitive(v))).toBe(true);
+    }
+  });
+});

package/src/lib/format-cell.ts

@@ -0,0 +1,63 @@
+// Defensive render-boundary belt: guarantees a PRIMITIVE reaches a table <td>.
+// A raw non-primitive (e.g. a Date) rendered as a React child throws
+// "Objects are not valid as a React child", which trips the page CatchBoundary
+// to a 500. These helpers format/guard the value at the render boundary rather
+// than trusting the upstream shape. Mirrors packages/audit/src/ui/lib/format.ts
+// (formatEventTimestamp) and the ISO-slice convention in clients-credentials.
+// The "—" fallback mirrors the existing empty-cell convention across the console.
+
+export type CellPrimitive = string | number | boolean;
+
+const EMPTY = "—";
+
+function safeString(value: unknown): string {
+  try {
+    const s = String(value);
+    return s.length > 0 ? s : EMPTY;
+  } catch {
+    return EMPTY;
+  }
+}
+
+/**
+ * Date-ish columns (tenant-users `createdAt`, config-history `timestamp`).
+ * - Date             → stable ISO display string (same shape the backends already
+ *                      emit via `.toISOString()`); Invalid Date → the "—" fallback.
+ * - string           → passed through readably (no corruption of the already
+ *                      formatted upstream value; keeps ISSUE-015 seed value as-is).
+ * - number / boolean → stringified.
+ * - null / undefined → the "—" fallback.
+ * - any other object → a safe string (never a raw object).
+ * ALWAYS returns a primitive string.
+ */
+export function formatCellDate(value: unknown): string {
+  if (value === null || value === undefined) return EMPTY;
+  if (value instanceof Date) {
+    return Number.isNaN(value.getTime()) ? EMPTY : value.toISOString();
+  }
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  return safeString(value);
+}
+
+/**
+ * Generic guard for every OTHER cell in the affected tables. Guarantees a
+ * primitive can never reach <td>.
+ * - non-empty string / number / boolean → passed through unchanged (no
+ *                               corruption of non-date text such as
+ *                               `parameter` / `actor`); an empty string
+ *                               returns the "—" fallback instead.
+ * - Date                      → formatCellDate (display string).
+ * - null / undefined          → the "—" fallback.
+ * - any other object          → a safe string.
+ * ALWAYS returns a primitive.
+ */
+export function toCellPrimitive(value: unknown): CellPrimitive {
+  if (value === null || value === undefined) return EMPTY;
+  // An empty string is a blank cell — render the "—" empty-value convention
+  // (never-blank-cell, NFR-NO-RAW-OBJECT), matching the null/undefined fallback.
+  if (typeof value === "string") return value.length > 0 ? value : EMPTY;
+  if (typeof value === "number" || typeof value === "boolean") return value;
+  if (value instanceof Date) return formatCellDate(value);
+  return safeString(value);
+}

package/src/lib/handle-server-error.test.ts

@@ -0,0 +1,85 @@
+import { describe, expect, it } from "bun:test";
+
+import { errorToMessage } from "./handle-server-error";
+
+describe("errorToMessage (pure toast-boundary extractor — ISSUE-006 / NFR-NO-RAW-OBJECT)", () => {
+  it("returns a plain object body's message", () => {
+    expect(errorToMessage({ message: "boom" })).toBe("boom");
+  });
+
+  it("returns an Error instance's message", () => {
+    expect(errorToMessage(new Error("kapow"))).toBe("kapow");
+  });
+
+  it("unwraps a structured Eden validation-body error value (never [object Object])", () => {
+    const out = errorToMessage({
+      status: 422,
+      value: { type: "validation", message: "Expected number to be greater or equal to 1" },
+    });
+    expect(out).toBe("Expected number to be greater or equal to 1");
+    expect(out).not.toBe("[object Object]");
+  });
+
+  it("REJECTS a stringified '[object Object]' .message and falls through to the validation summary (live decimal-422 regression, G22)", () => {
+    // Eden/Elysia collapse a structured 422 validation body into an Error whose .message is
+    // literally "[object Object]"; the extractor must reject it and use the body's own summary.
+    const out = errorToMessage(
+      {
+        status: 422,
+        message: "[object Object]",
+        value: { type: "validation", summary: "value must be an integer" },
+      },
+      "Не удалось применить лимит"
+    );
+    expect(out).toBe("value must be an integer");
+    expect(out).not.toBe("[object Object]");
+  });
+
+  it("REJECTS an Error whose message is '[object Object]' and uses the localized fallback", () => {
+    const out = errorToMessage(new Error("[object Object]"), "Не удалось применить лимит");
+    expect(out).toBe("Не удалось применить лимит");
+    expect(out).not.toBe("[object Object]");
+  });
+
+  it("unwraps a plain {message} server body carried under .value", () => {
+    expect(errorToMessage({ status: 403, value: { message: "Forbidden" } })).toBe("Forbidden");
+  });
+
+  it("returns a string body carried directly under .value", () => {
+    expect(errorToMessage({ status: 400, value: "raw string error" })).toBe("raw string error");
+  });
+
+  it("maps a 204 to the no-content message", () => {
+    expect(errorToMessage({ status: 204 })).toBe("No content.");
+  });
+
+  it("falls back to the provided fallback when no message can be extracted, never [object Object]", () => {
+    const out = errorToMessage(
+      { status: 500, value: { unexpected: true } },
+      "Не удалось применить лимит"
+    );
+    expect(out).toBe("Не удалось применить лимит");
+    expect(out).not.toBe("[object Object]");
+  });
+
+  it("uses the default fallback when called with one argument", () => {
+    expect(errorToMessage(null)).toBe("Something went wrong!");
+    expect(errorToMessage(undefined)).toBe("Something went wrong!");
+    expect(errorToMessage({ foo: 1 })).toBe("Something went wrong!");
+  });
+
+  it("NEVER returns [object Object] for any object input", () => {
+    for (const input of [
+      { a: 1 },
+      { value: { b: 2 } },
+      { value: [1, 2] },
+      new Error("x"),
+      { message: 5 },
+    ]) {
+      const out = errorToMessage(input);
+      expect(typeof out).toBe("string");
+      expect(out.length).toBeGreaterThan(0);
+      expect(out).not.toBe("[object Object]");
+    }
+  });
+});

package/src/lib/handle-server-error.ts

@@ -0,0 +1,39 @@
+import { toast } from "sonner";
+
+// Pure toast-boundary extractor. Mirrors the F1 defensive belt
+// (format-cell.ts / toCellPrimitive): always yields a PRIMITIVE string so a raw
+// object/Error can never reach toast text as "[object Object]" (NFR-NO-RAW-OBJECT).
+// Kept side-effect-free so it is unit-testable without a DOM/toast harness.
+export function errorToMessage(error: unknown, fallback = "Something went wrong!"): string {
+  // A usable message is a non-empty string that is not a useless stringified object. Eden/Elysia
+  // put "[object Object]" into an Error's `.message` for a structured validation (422) body — that
+  // must be REJECTED here so we fall through to the structured body's own message/summary or the
+  // localized fallback, never surfacing "[object Object]" to the user (NFR-NO-RAW-OBJECT).
+  const ok = (s: unknown): s is string =>
+    typeof s === "string" && s.length > 0 && !/^\[object [A-Za-z]/.test(s);
+
+  if (ok(error)) return error;
+
+  if (error && typeof error === "object") {
+    if ("message" in error && ok(error.message)) return error.message;
+    if ("value" in error && ok(error.value)) return error.value;
+    if ("value" in error && error.value && typeof error.value === "object") {
+      if ("message" in error.value && ok(error.value.message)) return error.value.message;
+      // Elysia/TypeBox validation body carries a human `summary` when there's no plain message.
+      if ("summary" in error.value && ok(error.value.summary)) return error.value.summary;
+    }
+    if ("status" in error && Number(error.status) === 204) {
+      return "No content.";
+    }
+  }
+
+  return fallback;
+}
+
+export function handleServerError(error: unknown) {
+  if (process.env.NODE_ENV !== "production") {
+    console.log(error);
+  }
+
+  toast.error(errorToMessage(error));
+}

package/src/lib/random-id.ts

@@ -0,0 +1,13 @@
+/**
+ * A random id for client-side idempotency keys / correlation ids. Prefers `crypto.randomUUID()`, but
+ * that is only defined in a **secure context** (https or localhost) — on a plain-http dev/preview stand
+ * it is `undefined` and a bare `crypto.randomUUID()` throws, silently breaking every mutation. This
+ * falls back to a timestamp+random token so client mutations work everywhere. (Server code runs under
+ * Bun/Node where `crypto.randomUUID` is always available, so it can call it directly.)
+ */
+export function randomId(): string {
+  if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") {
+    return crypto.randomUUID();
+  }
+  return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+}

package/src/lib/show-submitted-data.tsx

@@ -0,0 +1,14 @@
+import { toast } from "sonner";
+
+export function showSubmittedData(
+  data: unknown,
+  title: string = "You submitted the following values:"
+) {
+  toast.message(title, {
+    description: (
+      <pre className="mt-2 w-full overflow-x-auto rounded-md bg-slate-950 p-4">
+        <code className="text-white">{JSON.stringify(data, null, 2)}</code>
+      </pre>
+    ),
+  });
+}

package/src/lib/utils.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, it } from "bun:test";
+
+import { getDisplayNameInitials } from "./utils";
+
+/**
+ * Инициалы попадают в аватар пользователя — на каждый экран, где есть шапка. Функция маленькая,
+ * но её граничные случаи (пустая строка, одно слово, лишние пробелы) видны сразу и всем,
+ * а тестов у неё до сих пор не было.
+ */
+describe("getDisplayNameInitials", () => {
+  it("два слова — первые буквы первого и последнего", () => {
+    expect(getDisplayNameInitials("Ada Lovelace")).toBe("AL");
+  });
+
+  it("три слова — берётся первое и ПОСЛЕДНЕЕ, среднее игнорируется", () => {
+    expect(getDisplayNameInitials("Иван Иванович Петров")).toBe("ИП");
+  });
+
+  it("одно слово — первые две буквы", () => {
+    expect(getDisplayNameInitials("Ada")).toBe("AD");
+  });
+
+  it("слово из одной буквы — возвращает её одну, не падает", () => {
+    expect(getDisplayNameInitials("A")).toBe("A");
+  });
+
+  it("пустая строка и одни пробелы — вопросительный знак", () => {
+    expect(getDisplayNameInitials("")).toBe("?");
+    expect(getDisplayNameInitials("   ")).toBe("?");
+  });
+
+  it("лишние пробелы по краям и внутри не создают пустых частей", () => {
+    expect(getDisplayNameInitials("  Ada   Lovelace  ")).toBe("AL");
+  });
+});

package/src/lib/utils.ts

@@ -0,0 +1,78 @@
+import { type ClassValue, clsx } from "clsx";
+import { twMerge } from "tailwind-merge";
+
+export function cn(...inputs: ClassValue[]) {
+  return twMerge(clsx(inputs));
+}
+
+export function sleep(ms: number = 1000) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/**
+ * Generates page numbers for pagination with ellipsis
+ * @param currentPage - Current page number (1-based)
+ * @param totalPages - Total number of pages
+ * @returns Array of page numbers and ellipsis strings
+ *
+ * Examples:
+ * - Small dataset (≤5 pages): [1, 2, 3, 4, 5]
+ * - Near beginning: [1, 2, 3, 4, '...', 10]
+ * - In middle: [1, '...', 4, 5, 6, '...', 10]
+ * - Near end: [1, '...', 7, 8, 9, 10]
+ */
+export function getPageNumbers(currentPage: number, totalPages: number) {
+  const maxVisiblePages = 5; // Maximum number of page buttons to show
+  const rangeWithDots = [];
+
+  if (totalPages <= maxVisiblePages) {
+    // If total pages is 5 or less, show all pages
+    for (let i = 1; i <= totalPages; i++) {
+      rangeWithDots.push(i);
+    }
+  } else {
+    // Always show first page
+    rangeWithDots.push(1);
+
+    if (currentPage <= 3) {
+      // Near the beginning: [1] [2] [3] [4] ... [10]
+      for (let i = 2; i <= 4; i++) {
+        rangeWithDots.push(i);
+      }
+      rangeWithDots.push("...", totalPages);
+    } else if (currentPage >= totalPages - 2) {
+      // Near the end: [1] ... [7] [8] [9] [10]
+      rangeWithDots.push("...");
+      for (let i = totalPages - 3; i <= totalPages; i++) {
+        rangeWithDots.push(i);
+      }
+    } else {
+      // In the middle: [1] ... [4] [5] [6] ... [10]
+      rangeWithDots.push("...");
+      for (let i = currentPage - 1; i <= currentPage + 1; i++) {
+        rangeWithDots.push(i);
+      }
+      rangeWithDots.push("...", totalPages);
+    }
+  }
+
+  return rangeWithDots;
+}
+
+/**
+ * Initials from a display name: first character of the first word + first
+ * character of the last word. One word only: first two characters. Empty: `?`.
+ */
+export function getDisplayNameInitials(displayName: string): string {
+  // Индексный доступ читается через `?.`/`??`, а не через «мы же проверили length»: при
+  // `noUncheckedIndexedAccess` (так собирают продукты, вендорящие этот пакет) компилятор
+  // из проверки длины НЕ выводит, что parts[0] определён, и файл перестаёт типизироваться.
+  const parts = displayName.trim().split(/\s+/).filter(Boolean);
+  if (parts.length === 0) return "?";
+  if (parts.length === 1) {
+    return (parts[0] ?? "").slice(0, 2).toUpperCase();
+  }
+  const first = parts[0]?.[0] ?? "";
+  const last = parts[parts.length - 1]?.[0] ?? "";
+  return (first + last).toUpperCase();
+}

package/src/secure-context.contract.test.ts

@@ -0,0 +1,63 @@
+import { describe, expect, it } from "bun:test";
+
+import { Glob } from "bun";
+
+/**
+ * Страж: клиентский код НЕ зовёт `crypto.randomUUID()` напрямую.
+ *
+ * `crypto.randomUUID` определён только в **secure context** — https или localhost. На стенде по
+ * обычному http (`http://moon:3000`, любой preview без TLS) его нет, и вызов бросает TypeError ДО
+ * fetch. Мутация не уходит, ошибки на экране нет: кнопка нажимается, и не происходит ничего. Человек
+ * жмёт ещё раз.
+ *
+ * Это ровно тот молчаливый провал, который запрещён. Ловится он дёшево — здесь, а не в браузере на
+ * стенде: e2e (`billing.e2e.ts`) нашёл его в биллинге уже после того, как `randomId()` был написан
+ * специально ради этой ловушки — и всё равно один экран звал `crypto.randomUUID()` мимо него.
+ *
+ * Серверный код (Bun/Node) — можно: там `crypto.randomUUID` есть всегда.
+ */
+const REPO = new URL("../../..", import.meta.url).pathname;
+
+/** Каталоги, чей код исполняется В БРАУЗЕРЕ. */
+const CLIENT_ROOTS = [
+  "packages/ui/src",
+  "packages/iam/src/features",
+  "packages/billing/src/ui",
+  "packages/dashboard/src/ui",
+  "apps/web/src/client",
+];
+
+/** Единственное место, где вызов законен, — сам `randomId()` с его fallback'ом. */
+const ALLOWED = ["lib/random-id.ts"];
+
+/** Только браузерные файлы слайса: `server/`, `application/`, `db/` крутятся под Bun. */
+const SERVER_DIR = /(^|\/)(server|application|db|domain|bin)\//;
+
+/** Ищем ВЫЗОВ, а не упоминание: комментарий, объясняющий правило, — не нарушение правила. */
+function stripComments(src: string): string {
+  return src.replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/.*$/gm, "");
+}
+
+describe("secure context: клиентские мутации работают и без https", () => {
+  it("ни один браузерный файл не зовёт crypto.randomUUID() напрямую — только randomId()", async () => {
+    const offenders: string[] = [];
+
+    for (const root of CLIENT_ROOTS) {
+      const cwd = `${REPO}/${root}`;
+      try {
+        for await (const rel of new Glob("**/*.{ts,tsx}").scan({ cwd })) {
+          if (/\.test\.tsx?$/.test(rel)) continue;
+          if (SERVER_DIR.test(rel)) continue;
+          if (ALLOWED.some((a) => rel.endsWith(a))) continue;
+
+          const src = stripComments(await Bun.file(`${cwd}/${rel}`).text());
+          if (src.includes("crypto.randomUUID(")) offenders.push(`${root}/${rel}`);
+        }
+      } catch {
+        // каталога нет в этом продукте
+      }
+    }
+
+    expect(offenders).toEqual([]);
+  });
+});