@kazee-ds/init 0.1.7 → 0.1.9

package/README.md

@@ -1,35 +1,37 @@
-# @kazee-ds/init
-
-Preview-first setup for an existing standalone React or Vue application. Published CLI 0.1.7 pins React/Vue/styles at 0.5.4 and consumer lint at 0.4.2. Verify the available npm versions before installing. Earlier CLI releases targeted private GitLab.
-
-From an existing application, preview with `npm exec --yes --package=@kazee-ds/init@0.1.7 -- kazee-init`; append `--apply` after reviewing the plan.
-
-From the design-system checkout, run:
-
-```sh
-node packages/init/bin/kazee-init.mjs --dir /absolute/path/to/application
-node packages/init/bin/kazee-init.mjs --dir /absolute/path/to/application --apply
-```
-
-Supply `--framework react|vue` or `--package-manager npm|pnpm|yarn` when detection
-is ambiguous or unavailable. Explicit choices do not override conflicting
-lockfiles. Yarn means Classic only; modern Yarn requires the manual guide.
-
-Init adds missing exact Kazee dependencies, merges a public npm scope mapping,
-appends a framework-specific managed section to `AGENTS.md`, and generates
-`kazee-setup.md`. It preserves unrelated configuration and rejects conflicting
-versions, registry mappings, edited managed content, workspaces, Next, and Nuxt.
-
-Preview never writes files. Apply preflights all four files and attempts to
-restore changes after ordinary write failures. Multi-file writes are not
-crash-atomic. Symlinked and hardlinked write targets are rejected.
-
-Public installs need no read credentials. Init neither creates auth entries nor prints existing credentials; unrelated registry settings are preserved.
-No installation, network requests, source edits, lockfile updates, Git operations,
-or CI changes occur inside init.
-
-Follow the generated guide to install dependencies, import CSS once, merge the
-lint config, and run application checks. ESLint 10 and appropriate parsers remain
-the application's responsibility. Bundled versions are not a latest-version query.
-
-See `docs/consumer-init.md` in the repository for verification and limitations.
+# @kazee-ds/init
+
+Version **0.1.9** pins runtime/styles **0.6.0** and lint **0.5.0**, with composition-aware agent templates. Verify publication of these prepared versions before using the registry command. Local commands target the checkout. See [release status](https://gitlab.com/kazee.indonesia/kazee-design-system/-/blob/main/docs/versions.md).
+
+Preview-first setup for an existing standalone React or Vue application. Preserve the application's framework, package manager and configuration. Earlier CLI releases targeted private GitLab.
+
+From an existing application, preview with `npm exec --yes --package=@kazee-ds/init@0.1.9 -- kazee-init`; append `--apply` after reviewing the plan.
+
+From the design-system checkout, run:
+
+```sh
+node packages/init/bin/kazee-init.mjs --dir /absolute/path/to/application
+node packages/init/bin/kazee-init.mjs --dir /absolute/path/to/application --apply
+```
+
+Supply `--framework react|vue` or `--package-manager npm|pnpm|yarn` when detection
+is ambiguous or unavailable. Explicit choices do not override conflicting
+lockfiles. Yarn means Classic only; modern Yarn requires the manual guide.
+
+Init adds missing exact Kazee dependencies, merges a public npm scope mapping,
+appends a framework-specific managed section to `AGENTS.md`, and generates
+`kazee-setup.md`. It preserves unrelated configuration and rejects conflicting
+versions, registry mappings, edited managed content, workspaces, Next, and Nuxt.
+
+Preview never writes files. Apply preflights all four files and attempts to
+restore changes after ordinary write failures. Multi-file writes are not
+crash-atomic. Symlinked and hardlinked write targets are rejected.
+
+Public installs need no read credentials. Init neither creates auth entries nor prints existing credentials; unrelated registry settings are preserved.
+No installation, network requests, source edits, lockfile updates, Git operations,
+or CI changes occur inside init.
+
+Follow the generated guide to install dependencies, import CSS once, merge the
+lint config, and run application checks. ESLint 10 and appropriate parsers remain
+the application's responsibility. Bundled versions are not a latest-version query.
+
+See `docs/consumer-init.md` in the repository for verification and limitations.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kazee-ds/init",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Preview-first setup for Kazee Design System consumers",
   "type": "module",
   "bin": {

package/src/content.mjs

@@ -1,6 +1,6 @@
 import { readFileSync } from 'node:fs';
 
-export const RELEASE = Object.freeze({ framework: '0.5.4', styles: '0.5.4', lint: '0.4.2' });
+export const RELEASE = Object.freeze({ framework: '0.6.0', styles: '0.6.0', lint: '0.5.0' });
 export const REGISTRY = 'https://registry.npmjs.org/';
 const INIT_VERSION = JSON.parse(
   readFileSync(new URL('../package.json', import.meta.url), 'utf8'),
@@ -15,7 +15,7 @@ export function managedRules(framework) {
   ).replaceAll('\r\n', '\n');
   const other = framework === 'react' ? 'Vue' : 'React';
   const filtered = template.replace(new RegExp(`## ${other} API\\n[\\s\\S]*?(?=\\n## |$)`), '');
-  return `${START}\n<!-- Template revision: 2026-10-28; init ${INIT_VERSION}; ${framework} -->\n${filtered.trim()}\n${END}`;
+  return `${START}\n<!-- Template revision: 2026-10-30; init ${INIT_VERSION}; ${framework} -->\n${filtered.trim()}\n${END}`;
 }
 
 export function installCommand(manager, framework) {

package/templates/AGENTS.md

@@ -1,63 +1,63 @@
-# Kazee Design System consumer rules
-
-Apply these rules to UI work in this application alongside its existing project instructions. Keep the application's established framework, package manager, routing, localization, data flow, and API contracts.
-
-## Check the installed contract first
-
-- Read this application's `package.json` and lockfile before changing UI. Use its installed package version as the API contract.
-- Use the installed version's public catalog. Framework/styles 0.5.4 include the Toast keyboard guard and shared subtle borders; tokens are 0.4.3 and lint is 0.4.2. MCP 0.1.7 retains verified 0.5.1, 0.5.2, 0.5.3 and 0.5.4 catalogs; confirm that exact MCP patch is published before pinning it. Older MCP 0.1.4 labels 0.5.1 as a workspace candidate. Use installed public types if the matching verified catalog is unavailable. Do not assume a component exists in an older version.
-- When Kazee MCP is connected, read `get_catalog_versions`, then `list_components`, `get_component_docs`, and `get_component_examples` using this framework and exact installed version. Otherwise inspect the installed package's public types when uncertain. A prop accepted by React Aria, Reka UI, or another UI library is not automatically supported by Kazee components.
-- Start file discovery in application source, manifests, and the installed Kazee package's public entry points/types. Do not recursively list all of `node_modules` or investigate React Aria/Reka UI internals for routine component usage.
-- Investigate dependency internals only when a concrete type, build, or runtime failure remains unexplained by the public contract. Identify that failure and the relevant file before expanding the search. When the requested behavior, build, and typecheck pass, report the result and any unrun checks instead of continuing speculative API research.
-- Browse states in the public [Storybook](https://kazee-design-system-023417.gitlab.io). The catalog may differ from the installed version; check types before copying an example.
-- Follow the [installation guide](https://gitlab.com/kazee.indonesia/kazee-design-system/-/blob/main/docs/installation.md) for package setup. Reading the guide requires GitLab project access; public npm installation needs no read credentials; historical private GitLab installs require registry access. Storybook is public. Never print, commit, or embed registry tokens in frontend code.
-
-## Kazee MCP
-
-MCP is a read-only reference, not an installer or validator. It needs no token at runtime. Never provide token values to a tool. Candidate catalogs do not establish registry publication. Unknown versions must not be silently replaced with newer APIs. Run the application's actual checks after using examples and report missing or unrun validation.
-
-## Reuse the foundation
-
-- Use Kazee `Button` and `Select` for matching new UI in areas adopting this design system. Preserve existing application abstractions that already wrap them correctly.
-- Import from `@kazee-ds/react` or `@kazee-ds/vue` public entry points. Do not copy package source into the application or import private build files.
-- Do not bypass these components by importing React Aria or Reka UI directly to recreate their behavior. Keep unrelated existing integrations outside the task unchanged.
-- Import `@kazee-ds/styles/index.css` once at the application's global CSS entry. It includes the tokens; do not add a duplicate token stylesheet.
-- Use the public props for supported component styling. Do not rely on `className` or `style` on Kazee wrappers, or override their internal classes to create undocumented variants. Style application layout on surrounding elements.
-- Common Button variants include `primary`, `secondary`, and `danger`; sizes are `sm`, `md`, and `lg`. Read the exact versioned contract for additional variants, icon-only and pending support. Defaults are `primary` and `md`; use `danger` for destructive actions.
-
-## React API
-
-- Import `Button` and `Select` from `@kazee-ds/react`.
-- Button activation: `onPress`; disabled state: `isDisabled`. Do not substitute `onClick` or `disabled`.
-- Select requires `label` and `options`. Options have a string `id`, a string `label`, and optional `isDisabled`.
-- Controlled Select: `value` (string or `null`) and `onChange` (receives the selected string ID). Uncontrolled Select: `defaultValue`. Do not mix controlled and uncontrolled state.
-- Use only documented public props. Do not invent `isLoading`, `loading`, `asChild`, `href`, or additional variants.
-
-## Vue API
-
-- Import `Button` and `Select` from `@kazee-ds/vue`.
-- Button activation: `@press`; disabled state: `disabled`. Do not substitute React prop names.
-- Select requires `label` and `options`. Options have a string `id`, a string `label`, and optional `isDisabled` (including in Vue).
-- Controlled Select: `v-model` with a string or `undefined`. Uncontrolled Select: `defaultValue`. Do not mix controlled and uncontrolled state.
-- Use only documented public props. Do not invent `loading`, `asChild`, `href`, or additional variants.
-
-## Tokens, themes, and accessibility
-
-- Use existing semantic color variables for new UI adopting the system, such as `--ds-color-surface-default`, `--ds-color-text-default`, and `--ds-color-border-subtle`. Check the installed token CSS before referencing a variable. Do not invent token names or use primitive color variables as semantic colors.
-- Reuse available spacing and radius tokens, such as `--ds-space-4` and `--ds-radius-md`, where they fit. Follow the application's existing conventions for values the foundation does not yet define.
-- Preserve the application's existing theme mechanism. If integrating Kazee light/dark modes, coordinate `data-theme="light"` or `data-theme="dark"` at the document root so portal content receives the same theme. Do not create a second theme toggle or interpolate unchecked tenant input into CSS.
-- Keep Select's visible label and meaningful Button text. React icon-only buttons need an accessible name via the supported `aria-label` prop; verify the installed contract for other cases.
-- Set Button `type="submit"` explicitly when it submits a form; the default is `button`.
-- Preserve keyboard access, focus indication, disabled states, and the application's translations. For pending requests, use existing application feedback and guard request handlers; do not add unsupported loading props to Kazee components.
-
-## When a component or capability is missing
-
-- State the gap. Use an existing suitable application component or an accessible native element for the requested screen, and use available tokens where appropriate.
-- Keep a necessary fallback local to the application. Do not introduce another component library or redesign unrelated screens as part of routine adoption.
-- A shared Kazee component needs a separate contribution in the design-system repository with a shared React/Vue contract and its quality gates. Do not present an application fallback as a published Kazee component.
-
-## Verify the change
-
-- Run the application's relevant build, typecheck, lint, and existing tests using its own scripts. Do not assume design-system monorepo commands exist here.
-- For changed interactions, check Button activation and disabled behavior, Select selection, and keyboard focus. Check existing light/dark modes and responsive layout where affected.
-- Report what was actually verified and any checks that could not run. These instructions guide agent behavior; they do not install lint rules or enforce CI by themselves.
+# Kazee Design System consumer rules
+
+Apply these rules to UI work in this application alongside its existing project instructions. Keep the application's established framework, package manager, routing, localization, data flow, and API contracts.
+
+## Check the installed contract first
+
+- Read this application's `package.json` and lockfile before changing UI. Use its installed package version as the API contract.
+- Use the installed version's public catalog. Framework/styles 0.5.5 include the Toast keyboard guard and shared subtle borders; tokens are 0.4.4 and lint is 0.4.2. MCP 0.1.8 retains verified 0.5.1, 0.5.2, 0.5.3 and 0.5.5 catalogs; confirm that exact MCP patch is published before pinning it. Older MCP 0.1.4 labels 0.5.1 as a workspace candidate. Use installed public types if the matching verified catalog is unavailable. Do not assume a component exists in an older version.
+- When Kazee MCP is connected, read `get_catalog_versions`, then `list_components`, `get_component_docs`, and `get_component_examples` using this framework and exact installed version. Otherwise inspect the installed package's public types when uncertain. A prop accepted by React Aria, Reka UI, or another UI library is not automatically supported by Kazee components.
+- Start file discovery in application source, manifests, and the installed Kazee package's public entry points/types. Do not recursively list all of `node_modules` or investigate React Aria/Reka UI internals for routine component usage.
+- Investigate dependency internals only when a concrete type, build, or runtime failure remains unexplained by the public contract. Identify that failure and the relevant file before expanding the search. When the requested behavior, build, and typecheck pass, report the result and any unrun checks instead of continuing speculative API research.
+- Browse states in the public [Storybook](https://kazee-design-system-023417.gitlab.io). The catalog may differ from the installed version; check types before copying an example.
+- Follow the [installation guide](https://gitlab.com/kazee.indonesia/kazee-design-system/-/blob/main/docs/installation.md) for package setup. Reading the guide requires GitLab project access; public npm installation needs no read credentials; historical private GitLab installs require registry access. Storybook is public. Never print, commit, or embed registry tokens in frontend code.
+
+## Kazee MCP
+
+MCP is a read-only reference, not an installer or validator. It needs no token at runtime. Never provide token values to a tool. Candidate catalogs do not establish registry publication. Unknown versions must not be silently replaced with newer APIs. Run the application's actual checks after using examples and report missing or unrun validation.
+
+## Reuse the foundation
+
+- Use Kazee `Button` and `Select` for matching new UI in areas adopting this design system. Preserve existing application abstractions that already wrap them correctly.
+- Import from `@kazee-ds/react` or `@kazee-ds/vue` public entry points. Do not copy package source into the application or import private build files.
+- Do not bypass these components by importing React Aria or Reka UI directly to recreate their behavior. Keep unrelated existing integrations outside the task unchanged.
+- Import `@kazee-ds/styles/index.css` once at the application's global CSS entry. It includes the tokens; do not add a duplicate token stylesheet.
+- Check the installed version before styling. In versions that expose composition, pass Tailwind classes directly to public parts (for example Select.Trigger), use root className/style in React or class/style in Vue, and use the typed classNames map for compact APIs. Older versions may not forward these props. Do not target undocumented internal DOM selectors. Style application layout with application-owned wrappers.
+- Common Button variants include `primary`, `secondary`, and `danger`; sizes are `sm`, `md`, and `lg`. Read the exact versioned contract for additional variants, icon-only and pending support. Defaults are `primary` and `md`; use `danger` for destructive actions.
+
+## React API
+
+- Import `Button` and `Select` from `@kazee-ds/react`.
+- Button activation: `onPress`; disabled state: `isDisabled`. Do not substitute `onClick` or `disabled`.
+- Select requires `label` and `options`. Options have a string `id`, a string `label`, and optional `isDisabled`.
+- Controlled Select: `value` (string or `null`) and `onChange` (receives the selected string ID). Uncontrolled Select: `defaultValue`. Do not mix controlled and uncontrolled state.
+- Use only documented public props. Do not invent `isLoading`, `loading`, `asChild`, `href`, or additional variants.
+
+## Vue API
+
+- Import `Button` and `Select` from `@kazee-ds/vue`.
+- Button activation: `@press`; disabled state: `disabled`. Do not substitute React prop names.
+- Select requires `label` and `options`. Options have a string `id`, a string `label`, and optional `isDisabled` (including in Vue).
+- Controlled Select: `v-model` with a string or `undefined`. Uncontrolled Select: `defaultValue`. Do not mix controlled and uncontrolled state.
+- Use only documented public props. Do not invent `loading`, `asChild`, `href`, or additional variants.
+
+## Tokens, themes, and accessibility
+
+- Use existing semantic color variables for new UI adopting the system, such as `--ds-color-surface-default`, `--ds-color-text-default`, and `--ds-color-border-subtle`. Check the installed token CSS before referencing a variable. Do not invent token names or use primitive color variables as semantic colors.
+- Reuse available spacing and radius tokens, such as `--ds-space-4` and `--ds-radius-md`, where they fit. Follow the application's existing conventions for values the foundation does not yet define.
+- Preserve the application's existing theme mechanism. If integrating Kazee light/dark modes, coordinate `data-theme="light"` or `data-theme="dark"` at the document root so portal content receives the same theme. Do not create a second theme toggle or interpolate unchecked tenant input into CSS.
+- Keep Select's visible label and meaningful Button text. React icon-only buttons need an accessible name via the supported `aria-label` prop; verify the installed contract for other cases.
+- Set Button `type="submit"` explicitly when it submits a form; the default is `button`.
+- Preserve keyboard access, focus indication, disabled states, and the application's translations. For pending requests, use existing application feedback and guard request handlers; do not add unsupported loading props to Kazee components.
+
+## When a component or capability is missing
+
+- State the gap. Use an existing suitable application component or an accessible native element for the requested screen, and use available tokens where appropriate.
+- Keep a necessary fallback local to the application. Do not introduce another component library or redesign unrelated screens as part of routine adoption.
+- A shared Kazee component needs a separate contribution in the design-system repository with a shared React/Vue contract and its quality gates. Do not present an application fallback as a published Kazee component.
+
+## Verify the change
+
+- Run the application's relevant build, typecheck, lint, and existing tests using its own scripts. Do not assume design-system monorepo commands exist here.
+- For changed interactions, check Button activation and disabled behavior, Select selection, and keyboard focus. Check existing light/dark modes and responsive layout where affected.
+- Report what was actually verified and any checks that could not run. These instructions guide agent behavior; they do not install lint rules or enforce CI by themselves.

package/templates/consumer-lint.md

@@ -1,135 +1,135 @@
-# Consumer lint rules
-
-[`@kazee-ds/eslint-config`](../packages/eslint-config) provides a reusable ESLint flat configuration. Published version `0.4.2` implements public-import boundaries and selected component API checks, including Input and extended Button variants. Current React/Vue/styles are `0.5.4`; tokens are `0.4.3`. See the [version matrix](versions.md). It is an ESM package for ESLint 10 and Node 22.16 or later, with TypeScript declarations and no runtime dependencies. Adding `AGENTS.md` alone does not enable these checks.
-
-## Rules
-
-| Rule                   | Reports                                                                                                                                    |
-| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
-| `kazee/public-imports` | Imports from private or nonexistent exports of the four foundation packages, and direct imports from React Aria, React Stately, or Reka UI |
-| `kazee/component-api`  | Selected unsupported props/events and static Button size/variant values on components imported directly from Kazee                         |
-
-The import rule checks static imports, re-exports, literal dynamic imports, and unshadowed literal `require` calls. Public CSS/JSON exports and framework `package.json` exports remain allowed.
-
-The component rule recognizes React JSX imports (including aliases and namespace imports) and Vue SFC `<script setup>` imports used in templates (including aliases, kebab-case names, and namespace imports). It distinguishes local components from imported Kazee components, including React lexical shadowing and Vue template variables.
-
-Examples of reported mistakes:
-
-```tsx
-import { Button } from '@kazee-ds/react';
-
-// Use onPress and isDisabled.
-const save = (
-  <Button onClick={saveWorkspace} disabled={busy}>
-    Save
-  </Button>
-);
-
-// Use an installed supported variant; sm, md, or lg.
-const other = (
-  <Button variant="unsupported" size="xl">
-    Save
-  </Button>
-);
-```
-
-```vue
-<script setup lang="ts">
-import { Button, Select } from '@kazee-ds/vue';
-</script>
-
-<template>
-  <!-- Use disabled and @press. -->
-  <Button :is-disabled="busy" @click="save">Save</Button>
-  <!-- Use v-model for controlled selection. -->
-  <Select :value="workspace" label="Workspace" :options="options" />
-</template>
-```
-
-The rule rejects selected unsupported props. Coverage varies by component and version; consult installed public types rather than treating this rule as a complete API schema. Apply application layout and feedback outside the component. It reports diagnostics only; it does not autofix events, change application state, or rewrite imports.
-
-## Enable in a consuming application
-
-Configure public npm access without read credentials using the [installation guide](installation.md). Keep the application's existing ESLint configuration, parsers, plugins, package manager, and lockfile, then install:
-
-```sh
-npm install --save-dev --save-exact @kazee-ds/eslint-config@0.4.2
-```
-
-Merge the configuration object into the application's existing flat config, after its framework/parser setup:
-
-```js
-import { consumerConfig } from '@kazee-ds/eslint-config';
-
-// Add this object to your existing exported flat-config array.
-const kazeeRules = consumerConfig({
-  files: ['src/**/*.{js,jsx,ts,tsx,vue}'],
-});
-```
-
-`kazeeRules` must actually be included in the exported configuration; declaring it alone does not enable anything. Adjust `files` to the application's source directories (for example `app/` or `components/`). Scope it to areas adopting Kazee if the application still has unrelated headless-library integrations. The config intentionally forbids those imports in its selected files.
-
-Use an ESLint 10 flat-config setup with a parser that supports the application's syntax: a TypeScript/JSX parser for React, or `vue-eslint-parser` with its TypeScript parser configured for Vue SFCs. The rules use `context.sourceCode` and Vue parser services; they do not configure parsers or add the general framework lint rules themselves.
-
-Run the application's lint command and ensure it runs in the consuming project's CI. Update the lint package version and lockfile when adopting a different Kazee contract. Existing applications that copied the earlier standalone file can switch their config import to `@kazee-ds/eslint-config`, then remove the unused copy. The monorepo's old `tooling/eslint/consumer.mjs` entry point remains a re-export for compatibility.
-
-### Complete React/TypeScript example
-
-The following minimal `eslint.config.mjs` assumes ESLint 10 and `typescript-eslint` are already installed. Merge the Kazee config into the application's fuller rules rather than discarding its existing checks.
-
-```js
-import tseslint from 'typescript-eslint';
-import { consumerConfig } from '@kazee-ds/eslint-config';
-
-export default [
-  { ignores: ['dist/**', 'node_modules/**'] },
-  ...tseslint.configs.recommended,
-  {
-    files: ['src/**/*.{ts,tsx}'],
-    languageOptions: { parserOptions: { ecmaFeatures: { jsx: true } } },
-  },
-  consumerConfig({ files: ['src/**/*.{ts,tsx}'] }),
-];
-```
-
-### Complete Vue/TypeScript example
-
-This minimal `eslint.config.mjs` assumes ESLint 10, `eslint-plugin-vue`, and `typescript-eslint` are already installed. The application owns the parsers; installing Kazee's lint package does not replace them.
-
-```js
-import tseslint from 'typescript-eslint';
-import vue from 'eslint-plugin-vue';
-import { consumerConfig } from '@kazee-ds/eslint-config';
-
-export default [
-  { ignores: ['dist/**', 'node_modules/**'] },
-  ...tseslint.configs.recommended,
-  ...vue.configs['flat/recommended'],
-  {
-    files: ['**/*.vue'],
-    languageOptions: { parserOptions: { parser: tseslint.parser } },
-  },
-  consumerConfig({ files: ['src/**/*.{ts,vue}'] }),
-];
-```
-
-## Verification in this repository
-
-```sh
-pnpm test:consumer-lint
-pnpm lint
-```
-
-The test suite checks valid usage, reported mistakes, and false-positive cases. It lives in `packages/eslint-config/test` and runs through the normal package tests in CI's `unit-and-packages` job; `test:consumer-lint` remains a focused alias. The root configuration consumes the workspace package for applications and the existing token/style source scope; it keeps headless imports available to the React/Vue package implementations themselves. Manual sandbox projects are excluded from the root lint command, and can be checked separately with a config using the same rules and appropriate parsers.
-
-Version `0.1.0` was published and reinstalled from GitLab in isolated React and Vue consumers. Valid usage passed, incorrect APIs/private imports were rejected, and declarations, typechecks, and builds passed. See the [release and verification record](decisions/0007-eslint-config-private-release.md) for evidence and limits.
-
-## Limits
-
-- This is not full prop/type validation. Keep framework typechecking and interaction tests.
-- Computed import paths, JSX spreads, Vue `v-bind` objects, dynamic directive arguments, and dynamic size/variant values are not evaluated.
-- Components re-exported through an application barrel, Vue Options API registration, globally registered components, and dynamic `<component :is>` usage are outside the initial component rule's scope.
-- Rules do not inspect CSS values, prove a global stylesheet import exists, or require every native Button/Select to be replaced.
-- These checks guide code usage, not whether an agent read its instruction file or searched dependency internals.
-
-See the [agent setup guide](agent-setup.md) for complementary instructions.
+# Consumer lint rules
+
+[`@kazee-ds/eslint-config`](../packages/eslint-config) provides a reusable ESLint flat configuration. Prepared version `0.5.0` supports the `0.6.0` React/Vue/styles composition contract; tokens stay `0.4.4`. These versions are unpublished candidates. The preceding verified lint release is `0.4.2`. See the [version matrix](versions.md). The package targets ESLint 10 and Node 22.16 or later, with TypeScript declarations and no runtime dependencies. Adding `AGENTS.md` alone does not enable these checks.
+
+## Rules
+
+| Rule                   | Reports                                                                                                                                    |
+| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
+| `kazee/public-imports` | Imports from private or nonexistent exports of the four foundation packages, and direct imports from React Aria, React Stately, or Reka UI |
+| `kazee/component-api`  | Selected unsupported props/events and static Button size/variant values on components imported directly from Kazee                         |
+
+The import rule checks static imports, re-exports, literal dynamic imports, and unshadowed literal `require` calls. Public CSS/JSON exports and framework `package.json` exports remain allowed.
+
+The component rule recognizes React JSX imports (including aliases and namespace imports) and Vue SFC `<script setup>` imports used in templates (including aliases, kebab-case names, and namespace imports). It distinguishes local components from imported Kazee components, including React lexical shadowing and Vue template variables.
+
+Examples of reported mistakes:
+
+```tsx
+import { Button } from '@kazee-ds/react';
+
+// Use onPress and isDisabled.
+const save = (
+  <Button onClick={saveWorkspace} disabled={busy}>
+    Save
+  </Button>
+);
+
+// Use an installed supported variant; sm, md, or lg.
+const other = (
+  <Button variant="unsupported" size="xl">
+    Save
+  </Button>
+);
+```
+
+```vue
+<script setup lang="ts">
+import { Button, Select } from '@kazee-ds/vue';
+</script>
+
+<template>
+  <!-- Use disabled and @press. -->
+  <Button :is-disabled="busy" @click="save">Save</Button>
+  <!-- Use v-model for controlled selection. -->
+  <Select :value="workspace" label="Workspace" :options="options" />
+</template>
+```
+
+The rule rejects selected unsupported props. Coverage varies by component and version; consult installed public types rather than treating this rule as a complete API schema. The unpublished composition update allows root className/style (React), class/style (Vue), and typed classNames maps; earlier published versions can still reject these. Public compound parts accept their documented styling props. Framework callback, variant, accessible-name and import checks remain active. It reports diagnostics only; it does not autofix events, change application state, or rewrite imports.
+
+## Enable in a consuming application
+
+Configure public npm access without read credentials using the [installation guide](installation.md). Keep the application's existing ESLint configuration, parsers, plugins, package manager, and lockfile, then install:
+
+```sh
+npm install --save-dev --save-exact @kazee-ds/eslint-config@0.5.0
+```
+
+Merge the configuration object into the application's existing flat config, after its framework/parser setup:
+
+```js
+import { consumerConfig } from '@kazee-ds/eslint-config';
+
+// Add this object to your existing exported flat-config array.
+const kazeeRules = consumerConfig({
+  files: ['src/**/*.{js,jsx,ts,tsx,vue}'],
+});
+```
+
+`kazeeRules` must actually be included in the exported configuration; declaring it alone does not enable anything. Adjust `files` to the application's source directories (for example `app/` or `components/`). Scope it to areas adopting Kazee if the application still has unrelated headless-library integrations. The config intentionally forbids those imports in its selected files.
+
+Use an ESLint 10 flat-config setup with a parser that supports the application's syntax: a TypeScript/JSX parser for React, or `vue-eslint-parser` with its TypeScript parser configured for Vue SFCs. The rules use `context.sourceCode` and Vue parser services; they do not configure parsers or add the general framework lint rules themselves.
+
+Run the application's lint command and ensure it runs in the consuming project's CI. Update the lint package version and lockfile when adopting a different Kazee contract. Existing applications that copied the earlier standalone file can switch their config import to `@kazee-ds/eslint-config`, then remove the unused copy. The monorepo's old `tooling/eslint/consumer.mjs` entry point remains a re-export for compatibility.
+
+### Complete React/TypeScript example
+
+The following minimal `eslint.config.mjs` assumes ESLint 10 and `typescript-eslint` are already installed. Merge the Kazee config into the application's fuller rules rather than discarding its existing checks.
+
+```js
+import tseslint from 'typescript-eslint';
+import { consumerConfig } from '@kazee-ds/eslint-config';
+
+export default [
+  { ignores: ['dist/**', 'node_modules/**'] },
+  ...tseslint.configs.recommended,
+  {
+    files: ['src/**/*.{ts,tsx}'],
+    languageOptions: { parserOptions: { ecmaFeatures: { jsx: true } } },
+  },
+  consumerConfig({ files: ['src/**/*.{ts,tsx}'] }),
+];
+```
+
+### Complete Vue/TypeScript example
+
+This minimal `eslint.config.mjs` assumes ESLint 10, `eslint-plugin-vue`, and `typescript-eslint` are already installed. The application owns the parsers; installing Kazee's lint package does not replace them.
+
+```js
+import tseslint from 'typescript-eslint';
+import vue from 'eslint-plugin-vue';
+import { consumerConfig } from '@kazee-ds/eslint-config';
+
+export default [
+  { ignores: ['dist/**', 'node_modules/**'] },
+  ...tseslint.configs.recommended,
+  ...vue.configs['flat/recommended'],
+  {
+    files: ['**/*.vue'],
+    languageOptions: { parserOptions: { parser: tseslint.parser } },
+  },
+  consumerConfig({ files: ['src/**/*.{ts,vue}'] }),
+];
+```
+
+## Verification in this repository
+
+```sh
+pnpm test:consumer-lint
+pnpm lint
+```
+
+The test suite checks valid usage, reported mistakes, and false-positive cases. It lives in `packages/eslint-config/test` and runs through the normal package tests in CI's `unit-and-packages` job; `test:consumer-lint` remains a focused alias. The root configuration consumes the workspace package for applications and the existing token/style source scope; it keeps headless imports available to the React/Vue package implementations themselves. Manual sandbox projects are excluded from the root lint command, and can be checked separately with a config using the same rules and appropriate parsers.
+
+Version `0.1.0` was published and reinstalled from GitLab in isolated React and Vue consumers. Valid usage passed, incorrect APIs/private imports were rejected, and declarations, typechecks, and builds passed. See the [release and verification record](decisions/0007-eslint-config-private-release.md) for evidence and limits.
+
+## Limits
+
+- This is not full prop/type validation. Keep framework typechecking and interaction tests.
+- Computed import paths, JSX spreads, Vue `v-bind` objects, dynamic directive arguments, and dynamic size/variant values are not evaluated.
+- Components re-exported through an application barrel, Vue Options API registration, globally registered components, and dynamic `<component :is>` usage are outside the initial component rule's scope.
+- Rules do not inspect CSS values, prove a global stylesheet import exists, or require every native Button/Select to be replaced.
+- These checks guide code usage, not whether an agent read its instruction file or searched dependency internals.
+
+See the [agent setup guide](agent-setup.md) for complementary instructions.