@jmruthers/pace-core 0.6.8 → 0.6.10

package/cursor-rules/02-project-structure.mdc

@@ -14,7 +14,7 @@ This guide defines the standard folder structure and file organization for consu
 ## AI Agent Instructions
 
 **When creating or organizing files, ALWAYS:**
-1. **Organize by feature** - Group components, hooks, and utilities by feature/domain, not by type
+1. **Organize by feature** - Group components, hooks, and utilities by feature, not by type
 2. **Colocate tests** - Place test files next to source files (`Component.test.tsx` next to `Component.tsx`)
 3. **Follow naming conventions** - Components: `PascalCase.tsx`, Hooks: `use*.ts`, Utils: `camelCase.ts`
 4. **Use absolute imports** - Use `@/` path alias for imports, never relative imports for distant files
@@ -74,7 +74,7 @@ your-app/
 
 ## MUST: Organize Components by Feature
 
-**ALWAYS organize components by feature/domain, not by type:**
+**ALWAYS organize components by feature, not by type:**
 
 ```
 src/
@@ -136,30 +136,6 @@ src/
   - where migrations/RLS policies are managed
   - whether the app is expected to add migrations in the future
 
-## SHOULD: Organize by Domain
-
-**For larger apps, SHOULD organize by domain/feature:**
-
-```
-src/
-├── domains/
-│   ├── events/
-│   │   ├── components/
-│   │   ├── hooks/
-│   │   ├── services/
-│   │   └── types.ts
-│   └── users/
-│       ├── components/
-│       ├── hooks/
-│       ├── services/
-│       └── types.ts
-├── shared/              # Shared across domains
-│   ├── components/
-│   ├── hooks/
-│   └── utils/
-└── App.tsx
-```
-
 ## MUST: Keep Root Directory Clean
 
 **Root directory SHOULD only contain:**

package/cursor-rules/05-styling.mdc

@@ -94,18 +94,27 @@ import { Button, Input } from '@jmruthers/pace-core';
 
 ### MUST NOT: Add Custom Styles to pace-core Components
 
-**NEVER add custom styles when pace-core components already provide styling. Use component variants/props instead.**
+**NEVER add custom styles when pace-core components already provide styling. Assume these components already apply the correct layout, structure, and color styles. Use component variants/props instead.**
 
 ```tsx
 // ❌ WRONG: Overriding pace-core component styles
 <Button className="custom-button-style">Click me</Button>
 <Card className="custom-card-layout">Content</Card>
+<Button className="text-red-500 bg-blue-200">Custom styled button</Button>
+<Input className="border-2 border-gray-500" />
 
 // ✅ CORRECT: Use pace-core component variants/props
 <Button variant="default">Click me</Button>
 <Card>Content</Card>
+<Button variant="destructive">Delete</Button>
+<Input type="text" />
 ```
 
+**Exceptions:**
+- Only override styles when absolutely necessary and document why
+- Prefer using component props/variants over className overrides
+- If you must override, do it inside the component file, not at the call site
+
 ### MUST: Rely on pace-core core.css
 
 **MUST rely on pace-core `core.css` for typography, spacing, and visual presentation:**
@@ -156,7 +165,10 @@ import { Button, Input } from '@jmruthers/pace-core';
 
 ### MUST: Prefer Semantic HTML (Limit `<div>`)
 
-**ALWAYS prefer semantic HTML elements** (`<main>`, `<section>`, `<article>`, `<header>`, `<footer>`, `<nav>`, lists, etc.).
+**ALWAYS prefer semantic HTML elements** (`<main>`, `<section>`, `<article>`, `<header>`, `<footer>`, `<nav>`, `<h1>`, `<h2>`, `<h3>`, `<h4>`, `<h5>`, `<h6>`, `<p>`, `<ul>`, `<ol>`, `<li>`, `<a>`, `<strong>`, `<em>`, `<u>`, `<pre>`, `<code>`, `<blockquote>`, `<hr>`, `<small>`, etc.) instead of styling-focused `<div>` or `<span>` wrappers.
+
+**Note:** `<img>` elements can remain as-is; do not convert to `<figure>` elements. These semantic elements already have their styling defined in `core.css`.
+
 Using semantic elements improves accessibility, maintainability, and consistency.
 
 #### `<div>` usage policy
@@ -169,7 +181,7 @@ Using semantic elements improves accessibility, maintainability, and consistency
 
 #### Severity guidance (for audits)
 
-- **HIGH/BLOCKER**: `<div>` used in place of landmark/semantic structure (e.g., main page wrapper that should be `<main>`, navigation that should be `<nav>`, lists that should be `<ul>/<ol>`).
+- **HIGH/BLOCKER**: `<div>` used in place of landmark/semantic structure (e.g., main page wrapper that should be `<main>`, navigation that should be `<nav>`, lists that should be `<ul>/<ol>`, headings that should be `<h1>`-`<h6>`, paragraphs that should be `<p>`).
 - **MEDIUM**: `<div>` used as a generic wrapper inside semantic structure where it could be a fragment or semantic element.
 - **LOW**: `<div>` used for unavoidable third-party structure with a comment justifying it.
 
@@ -180,12 +192,25 @@ Using semantic elements improves accessibility, maintainability, and consistency
 <div className="page">
   <div className="nav">...</div>
   <div className="content">...</div>
+  <div className="heading">Title</div>
+  <div className="text">Paragraph text</div>
+  <div className="list">
+    <div className="item">Item 1</div>
+    <div className="item">Item 2</div>
+  </div>
 </div>
 
 // ✅ CORRECT: Semantic structure
 <main>
   <nav>...</nav>
-  <section>...</section>
+  <section>
+    <h1>Title</h1>
+    <p>Paragraph text</p>
+    <ul>
+      <li>Item 1</li>
+      <li>Item 2</li>
+    </ul>
+  </section>
 </main>
 
 // ✅ ACCEPTABLE: Layout-only wrapper (no semantic fit)
@@ -199,18 +224,31 @@ Using semantic elements improves accessibility, maintainability, and consistency
 
 ### MUST NOT: Apply Typography Styles Directly
 
-**MUST NOT apply typography styles directly to elements:**
+**MUST NOT apply typography styles directly to elements. All typography for semantic elements (`body`, `h1`, `h2`, `h3`, `h4`, `h5`, `h6`, `p`, `a`, `strong`, `em`, `u`, `pre`, `code`, `blockquote`, `hr`, `small`, `ul`, `ol`, `li`) is defined in `pace-core core.css`.**
+
+**Prohibited typography classes:**
+- `text-*` (e.g., `text-2xl`, `text-sm`, `text-base`)
+- `font-*` (e.g., `font-bold`, `font-semibold`, `font-normal`)
+- `leading-*` (e.g., `leading-relaxed`, `leading-tight`)
+- `tracking-*` (e.g., `tracking-wide`, `tracking-tighter`)
+- `uppercase`, `lowercase`, `capitalize`
+- Color classes on typography elements (e.g., `text-gray-500`, `text-primary`, `text-main-600`)
+- Margin/padding classes used solely for text spacing (e.g., `mb-2`, `mt-4`, `pb-1`, `pt-3`) — unless clearly needed for layout structure
 
 ```tsx
 // ❌ WRONG: Direct typography styling
 <h1 className="text-2xl font-bold">Title</h1>
-<p className="text-gray-500 leading-relaxed">Description</p>
+<p className="text-gray-500 leading-relaxed mb-4">Description</p>
 <label className="text-sm uppercase">Label</label>
+<a className="text-blue-500">Link</a>
+<ul className="mb-4">List</ul>
 
 // ✅ CORRECT: Typography defined in pace-core core.css
 <h1>Title</h1>
 <p>Description</p>
 <label>Label</label>
+<a>Link</a>
+<ul>List</ul>
 ```
 
 ### MUST: Use pace-core Typography
@@ -222,7 +260,21 @@ Using semantic elements improves accessibility, maintainability, and consistency
 <h1>Heading 1</h1>
 <h2>Heading 2</h2>
 <h3>Heading 3</h3>
+<h4>Heading 4</h4>
+<h5>Heading 5</h5>
+<h6>Heading 6</h6>
 <p>Paragraph text</p>
+<a>Link text</a>
+<strong>Bold text</strong>
+<em>Italic text</em>
+<u>Underlined text</u>
+<pre>Preformatted text</pre>
+<code>Code text</code>
+<blockquote>Quote text</blockquote>
+<hr />
+<small>Small text</small>
+<ul><li>List item</li></ul>
+<ol><li>Ordered item</li></ol>
 <label>Form label</label>
 ```
 
@@ -235,11 +287,37 @@ Using semantic elements improves accessibility, maintainability, and consistency
 <h1 className="text-3xl font-bold mb-4">Title</h1>
 <p style={{ fontSize: '14px', color: 'gray' }}>Text</p>
 <label className="uppercase tracking-wide">Label</label>
+<a className="text-primary hover:text-primary-600">Link</a>
+<ul className="mb-2 mt-4">List</ul>
 
 // ✅ CORRECT: No typography styling - pace-core handles it
 <h1>Title</h1>
 <p>Text</p>
 <label>Label</label>
+<a>Link</a>
+<ul>List</ul>
+```
+
+### MUST NOT: Use Margin/Padding for Text Spacing
+
+**MUST NOT use margin/padding classes (`mb-*`, `mt-*`, `pb-*`, `pt-*`, `mx-*`, `my-*`, `px-*`, `py-*`) solely for text spacing on typography elements. These are allowed only when clearly needed for layout structure:**
+
+```tsx
+// ❌ WRONG: Margin/padding for text spacing
+<p className="mb-4">Paragraph with bottom margin</p>
+<h2 className="mt-8 mb-2">Heading with margins</h2>
+<ul className="mb-4">List with bottom margin</ul>
+
+// ✅ CORRECT: No spacing classes - pace-core handles typography spacing
+<p>Paragraph</p>
+<h2>Heading</h2>
+<ul>List</ul>
+
+// ✅ ACCEPTABLE: Margin/padding for layout structure (not typography spacing)
+<section className="mb-8">
+  <h2>Section Title</h2>
+  <p>Content</p>
+</section>
 ```
 
 ## React Structure Rules

package/cursor-rules/06-security-rbac.mdc

@@ -21,7 +21,8 @@ This guide enforces the **mandatory RBAC contract** and security patterns betwee
 3. **Use RESOURCE_NAMES constants** - Never use string literals in `useResourcePermissions` calls
 4. **Validate all inputs** - Always validate user input with Zod schemas before processing
 5. **Never expose internals** - Never show SQL errors, stack traces, or internal details to users
-6. **Use helper functions in RLS** - Always use STABLE SECURITY DEFINER helper functions, never subqueries
+6. **Use helper functions in RLS** - Always use STABLE SECURITY DEFINER helper functions (when querying RLS-protected tables), never subqueries
+7. **Secure SECURITY DEFINER functions** - All SECURITY DEFINER functions must have `SET search_path TO public`, schema-qualified references, and documented rationale
 7. **Sanitize logs** - Never log passwords, tokens, or sensitive data
 
 **Decision Tree: Security & Permissions**
@@ -433,6 +434,9 @@ Before committing RBAC-related code, verify:
 - [ ] All RLS policies for authenticated users include super-admin checks
 - [ ] All `is_super_admin()` calls use explicit parameter (`safe_get_user_id_for_rls()`)
 - [ ] No security-critical functions use fallback strategies
+- [ ] All SECURITY DEFINER functions have `SET search_path TO public` (MANDATORY)
+- [ ] All SECURITY DEFINER functions schema-qualify table/function references
+- [ ] All SECURITY DEFINER functions document why SECURITY DEFINER is needed
 - [ ] ESLint rules pass without errors
 
 ## MUST: Include Super-Admin Checks in RLS Policies
@@ -509,6 +513,125 @@ END;
 $$;
 ```
 
+## MUST: Use SECURITY DEFINER Only When Necessary
+
+**SECURITY DEFINER is REQUIRED when helper functions query tables with RLS policies.** Without it, calling these functions from RLS policies creates circular dependencies.
+
+**Decision Tree:**
+```
+1. Does this helper function query tables with RLS policies?
+   ├─ YES → SECURITY DEFINER required (to avoid circular RLS)
+   │         └─ Continue to security requirements
+   └─ NO → Continue to step 2
+
+2. Does this function need elevated privileges?
+   ├─ YES → SECURITY DEFINER may be appropriate (document why)
+   │         └─ Continue to security requirements
+   └─ NO → SECURITY DEFINER not needed
+            └─ Use STABLE or IMMUTABLE only
+
+3. Security requirements (MANDATORY for SECURITY DEFINER):
+   ├─ SET search_path TO public ✅ MANDATORY
+   ├─ Schema-qualify all references ✅ MANDATORY
+   ├─ Use STABLE/IMMUTABLE when possible ✅ REQUIRED
+   ├─ Owned by appropriate role ✅ RECOMMENDED
+   └─ Document why in COMMENT ✅ REQUIRED
+```
+
+**✅ CORRECT: SECURITY DEFINER with all security requirements:**
+
+```sql
+-- ✅ CORRECT: SECURITY DEFINER required (queries RLS-protected table)
+CREATE OR REPLACE FUNCTION check_user_organisation_access(p_organisation_id UUID)
+RETURNS boolean
+LANGUAGE plpgsql
+STABLE                    -- ✅ Performance optimization
+SECURITY DEFINER          -- ✅ Required: queries rbac_organisation_roles (has RLS)
+SET search_path TO public -- ✅ MANDATORY: prevents search path hijacking
+AS $$
+BEGIN
+  -- ✅ Schema-qualified reference
+  RETURN EXISTS (
+    SELECT 1 FROM public.rbac_organisation_roles
+    WHERE user_id = auth.uid()
+    AND organisation_id = p_organisation_id
+  );
+END;
+$$;
+
+-- ✅ Document why SECURITY DEFINER is needed
+COMMENT ON FUNCTION check_user_organisation_access(UUID) IS 
+  'Checks if current user has access to organisation. SECURITY DEFINER required because function queries public.rbac_organisation_roles which has RLS policies. Without SECURITY DEFINER, this would create circular RLS dependency. STABLE for RLS policy performance. SET search_path TO public prevents search path hijacking.';
+```
+
+**✅ CORRECT: No SECURITY DEFINER needed (pure computation):**
+
+```sql
+-- ✅ CORRECT: No SECURITY DEFINER needed (no RLS-protected queries)
+CREATE OR REPLACE FUNCTION calculate_total(p_amount NUMERIC, p_tax_rate NUMERIC)
+RETURNS NUMERIC
+LANGUAGE plpgsql
+STABLE  -- ✅ STABLE for performance, but no SECURITY DEFINER needed
+AS $$
+BEGIN
+  RETURN p_amount * (1 + p_tax_rate);  -- Pure computation, no table queries
+END;
+$$;
+```
+
+**MUST NOT:**
+- Use SECURITY DEFINER without `SET search_path TO public` (security risk)
+- Use unqualified table/function references in SECURITY DEFINER functions (security risk)
+- Use SECURITY DEFINER for functions that don't query RLS-protected tables (unnecessary)
+- Create SECURITY DEFINER functions without documenting why (maintenance risk)
+
+```sql
+-- ❌ FORBIDDEN: Missing SET search_path (security risk)
+CREATE OR REPLACE FUNCTION bad_function()
+RETURNS boolean
+LANGUAGE plpgsql
+STABLE
+SECURITY DEFINER  -- Missing SET search_path TO public!
+AS $$
+BEGIN
+  RETURN EXISTS (SELECT 1 FROM rbac_organisation_roles);
+END;
+$$;
+
+-- ❌ FORBIDDEN: Unqualified reference (security risk)
+CREATE OR REPLACE FUNCTION bad_function()
+RETURNS boolean
+LANGUAGE plpgsql
+STABLE
+SECURITY DEFINER
+SET search_path TO public
+AS $$
+BEGIN
+  RETURN EXISTS (SELECT 1 FROM rbac_organisation_roles);  -- Should be public.rbac_organisation_roles
+END;
+$$;
+
+-- ❌ FORBIDDEN: SECURITY DEFINER without justification
+CREATE OR REPLACE FUNCTION pure_computation(x NUMERIC)
+RETURNS NUMERIC
+LANGUAGE plpgsql
+STABLE
+SECURITY DEFINER  -- Not needed! Function doesn't query RLS-protected tables
+AS $$
+BEGIN
+  RETURN x * 2;  -- Pure computation, no table queries
+END;
+$$;
+```
+
+**Security Checklist for SECURITY DEFINER Functions:**
+- [ ] `SET search_path TO public` is present (MANDATORY)
+- [ ] All table/function references are schema-qualified (e.g., `public.table_name`)
+- [ ] Function is marked `STABLE` or `IMMUTABLE` when possible
+- [ ] Function ownership uses least-privilege role (not superuser unless necessary)
+- [ ] COMMENT documents why SECURITY DEFINER is needed
+- [ ] Function actually queries RLS-protected tables (justification for SECURITY DEFINER)
+
 ## Reference
 
 - **RBAC Contract**: `packages/core/docs/rbac/RBAC_CONTRACT.md` - Complete contract documentation

package/dist/{DataTable-6RMSCQJ6.js → DataTable-SAXFG4XI.js}

@@ -1,15 +1,13 @@
-export { ActionButtons, BulkOperationsDropdown, ColumnFactory, ColumnVisibilityDropdown, DataTable, DataTableCore, DataTableErrorBoundary, DataTableModals, DataTableToolbar, EditableRow, EmptyState, EnhancedPaginationControls, GroupingDropdown, ImportModal, LoadingState, PaginationControls, SortIndicator, UnifiedTableBody, announce, announceBulkOperation, announceFilterChange, announceLoadingState, announcePaginationChange, announceSearchResults, announceSelectionChange, announceSortChange, average, calculateAllDepths, calculateAllIndentation, calculateIndentation, calculateOptimalPageSize, cleanupLiveRegion, count, createHierarchicalStructure, defaultDataTableFeatures, exportToCSV, exportToCSVWithTableRows, generateCSVContent, getAriaSortState, getAriaSortValue, getCellRenderer, getColumnHeaderText, getHierarchicalSortConfig, getPageSizeOptions, getPaginationBinding, getRowDepth, getRowDescription, getRowIdSafe, getSortButtonLabel, groupHierarchicalData, hasValidRowId, initializeLiveRegion, isHierarchicalSortableColumn, max, min, normalizeDataTableFeatures, shouldShowColumnForRow, sortHierarchicalDataByStructure, sortHierarchicalDataWithSorting, sum, validateHierarchicalData, validatePaginationConfig } from './chunk-NKHKXPI4.js';
-import './chunk-GS5672WG.js';
-export { CircuitBreaker, DEFAULT_FALLBACK_CONFIG, DataChunkManager, DataTableError, DataTableErrorType, ErrorRecoveryManager, MemoryMonitor, SearchIndex, VisibilityTracker, chunkData, debounce, determinePaginationMode, getOptimalPageSizeOptions, safeExecute, throttle, useDataTablePerformance } from './chunk-S7DKJPLT.js';
-import './chunk-EF2UGZWY.js';
-import './chunk-C7NSAPTL.js';
-import './chunk-T5CVK4R3.js';
-import './chunk-LX6U42O3.js';
-import './chunk-AHU7G2R5.js';
+export { ActionButtons, BulkOperationsDropdown, ColumnFactory, ColumnVisibilityDropdown, DataTable, DataTableCore, DataTableErrorBoundary, DataTableModals, DataTableToolbar, EditableRow, EmptyState, EnhancedPaginationControls, GroupingDropdown, ImportModal, LoadingState, PaginationControls, SortIndicator, UnifiedTableBody, announce, announceBulkOperation, announceFilterChange, announceLoadingState, announcePaginationChange, announceSearchResults, announceSelectionChange, announceSortChange, average, calculateAllDepths, calculateAllIndentation, calculateIndentation, calculateOptimalPageSize, cleanupLiveRegion, count, createHierarchicalStructure, defaultDataTableFeatures, exportToCSV, exportToCSVWithTableRows, findSelectLabel, generateCSVContent, getAriaSortState, getAriaSortValue, getCellRenderer, getColumnHeaderText, getHierarchicalSortConfig, getPageSizeOptions, getPaginationBinding, getRowDepth, getRowDescription, getRowIdSafe, getSortButtonLabel, groupHierarchicalData, hasValidRowId, initializeLiveRegion, isHierarchicalSortableColumn, max, min, normalizeDataTableFeatures, shouldShowColumnForRow, sortHierarchicalDataByStructure, sortHierarchicalDataWithSorting, sum, validateHierarchicalData, validatePaginationConfig } from './chunk-MPY44PWB.js';
+import './chunk-KYURMOQM.js';
+export { CircuitBreaker, DEFAULT_FALLBACK_CONFIG, DataChunkManager, DataTableError, DataTableErrorType, ErrorRecoveryManager, MemoryMonitor, SearchIndex, VisibilityTracker, chunkData, debounce, determinePaginationMode, getOptimalPageSizeOptions, safeExecute, throttle, useDataTablePerformance } from './chunk-BCTXBU6U.js';
+import './chunk-3GWSPISD.js';
+import './chunk-Y4PF6HIM.js';
+import './chunk-LNHFAF4X.js';
+import './chunk-NIU6DPQV.js';
 import './chunk-4SXLQIZO.js';
-import './chunk-A3W6LW53.js';
-import './chunk-OJ4SKRSV.js';
-import './chunk-7ILTDCL2.js';
-import './chunk-HF6O3O37.js';
-import './chunk-TTRFSOKR.js';
+import './chunk-DDMPHZ3D.js';
+import './chunk-UZNAFKGW.js';
+import './chunk-RMLY6KB5.js';
+import './chunk-BTHN5MKC.js';
 import './chunk-3RG5ZIWI.js';