@multiplatform.one/config 7.11.0 → 7.15.0

package/README.md

@@ -58,29 +58,54 @@ Available presets: `base.json`, `build.json`, `app.json`.
 
 ### Oxlint
 
-Convention rules travel with the package. Consuming apps add one line:
+Convention rules travel with the package. A consuming app extends the preset
+and needs no rules block of its own (MPO-23):
 
 ```json
 {
-  "jsPlugins": ["@multiplatform.one/config/oxlint"]
+  "extends": ["./node_modules/@multiplatform.one/config/oxlint.json"]
 }
 ```
 
-Then enable `mpo-conventions/no-hex-literals` on the globs you want (mpo's
-own `oxlintrc.json` turns it on for `features/**`). Palette modules
-(`themes/base.ts`, `themes/accent.ts`, `*palette*`) are exempt. Comments
-are not visited, so a JSDoc `#025` is not a hit. Widening to `apps/**`
-and `packages/**` is 182 hits on this tree (153 outside tests) — record
-the count, then burn down; do not flip the glob until then.
+oxlint resolves `extends` as a file path, not a package name, hence the
+`node_modules` prefix. The preset loads the plugin, turns
+`no-hex-literals` and `no-raw-typography` on as errors, turns
+`no-chrome-props`, `no-raw-geometry` and `no-child-margin` on as warnings
+while their burndowns run, and exempts specs and `tests/` trees, which assert
+computed colours, from all but `no-raw-typography`. A project that wants its
+own levels keeps the older one-line form,
+`{ "jsPlugins": ["@multiplatform.one/config/oxlint"] }`, and writes its own
+rules block (mpo's own `oxlintrc.json` turns `no-hex-literals` on for
+`apps/**`, `packages/**` and `features/**`, and off for specs and `tests/`
+trees). Palette modules (`themes/base.ts`, `themes/accent.ts`,
+`*palette*`) are exempt. Comments are not visited, so a JSDoc `#025` is not
+a hit. A file no theme token reaches opts out with a `// hex-escape: <reason>`
+line comment; `lint` fails that comment unless the spec table
+`## Colour-literal escapes` has its file and exact reason, and fails a row
+whose comment is gone (MPO-326).
 
 `no-chrome-props` and `no-raw-geometry` ship in the same plugin (MPO-17).
 Enable them the same way when you start that burndown. Drawing-file
 exceptions come from the spec table `## Drawing files`, not from the code.
 
+`no-child-margin` (MPO-23, `00` L9a) fails a non-zero `margin*` prop, long
+or shorthand, on any element nested inside another element's JSX: the parent
+owns the gap. `0` is always legal, the outermost element a file renders is
+left alone, and slots come from the spec table `## Slot margins`. mpo's own
+`oxlintrc.json` runs it as an error over `apps/`, `features/`, `packages/` and
+`public/`, off for specs and `tests/` trees and for a named burndown list: the
+73 files that carried 133 hits when it was switched on. The list may only
+shrink; `scripts/child-margin-ratchet.spec.mjs` fails if it grows, names a
+pattern instead of a file, or keeps a file that no longer violates.
+
 ### Lint (node-script checks)
 
-CSS-in-apps, features-twin, silent token no-ops, and the LC-65 size-recipe
-pilot run through `runConventionChecks({ roots })`:
+CSS-in-apps, features-twin, silent token no-ops, the LC-65 size-recipe
+pilot, and the size-recipe escape registry run through
+`runConventionChecks({ roots })`. Every `sizeRecipeEscape` site, and every
+`size-recipe-escape:` comment, must be a row in the spec table
+`## Size-recipe escapes` by file and exact reason, and a row whose site is
+gone fails too (MPO-23, `00` L8 E8):
 
 ```ts
 import { runConventionChecks } from "@multiplatform.one/config/lint";

package/lib/index.js

@@ -1,5 +1,5 @@
-import { t as createViteConfig } from "./vite-D6vMjPwv.js";
-import { t as createStorybookViteConfig } from "./storybook-CGNSgSBS.js";
+import { t as createViteConfig } from "./vite-DXXr5In0.js";
+import { t as createStorybookViteConfig } from "./storybook-DFdvDJ_s.js";
 import { n as tamaguiWorkspacePathsFile, t as ensureTamaguiWorkspacePaths } from "./tamaguiWorkspacePaths-ZIcqybtn.js";
 import { createVitestConfig } from "./vitest.js";
 

package/lib/{storybook-CGNSgSBS.js → storybook-DFdvDJ_s.js}

@@ -1,4 +1,4 @@
-import { i as withSingletonDepAliases, r as resolvePackageMainSource, t as discoverPublicPackageRoots } from "./workspacePublicPackages-B4FGgRYG.js";
+import { i as withSingletonDepAliases, r as resolvePackageMainSource, t as discoverPublicPackageRoots } from "./workspacePublicPackages-BuYRXxFs.js";
 import { t as ensureTamaguiWorkspacePaths } from "./tamaguiWorkspacePaths-ZIcqybtn.js";
 import { createRequire } from "node:module";
 import fs from "node:fs";
@@ -131,6 +131,8 @@ function createStorybookViteConfig(options = {}) {
 				"@tamagui/web",
 				"@tamagui/helpers-icon",
 				"tamagui",
+				"@tamagui/animations-css",
+				"@tamagui/react-native-svg",
 				"@tamagui/colors",
 				"@tamagui/config",
 				"@tamagui/config/v5",

package/lib/storybook.js

@@ -1,3 +1,3 @@
-import { t as createStorybookViteConfig } from "./storybook-CGNSgSBS.js";
+import { t as createStorybookViteConfig } from "./storybook-DFdvDJ_s.js";
 
 export { createStorybookViteConfig };

package/lib/{vite-D6vMjPwv.js → vite-DXXr5In0.js}

@@ -1,11 +1,12 @@
-import { i as withSingletonDepAliases, t as discoverPublicPackageRoots } from "./workspacePublicPackages-B4FGgRYG.js";
+import { i as withSingletonDepAliases, t as discoverPublicPackageRoots } from "./workspacePublicPackages-BuYRXxFs.js";
 import { t as ensureTamaguiWorkspacePaths } from "./tamaguiWorkspacePaths-ZIcqybtn.js";
 import { createRequire } from "node:module";
 import fs from "node:fs";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
-import { tamaguiPlugin } from "@tamagui/vite-plugin";
 import dotenv from "dotenv";
+import { transformWithOxc } from "vite";
+import { tamaguiPlugin } from "@tamagui/vite-plugin";
 import createExternal from "vite-plugin-external";
 import i18nextLoader from "vite-plugin-i18next-loader";
 
@@ -54,6 +55,148 @@ function lookupProjectRoot() {
 	}
 }
 
+//#endregion
+//#region src/publicConfig.ts
+const bakedConfigEnvKey = "VITE_MP_CONFIG";
+const publicConfigKeysEnvKey = "VITE_MP_PUBLIC_CONFIG_KEYS";
+/**
+* The `public` key names of a config.json, read rather than imported: a
+* static import puts the file on Vite's configFileDependencies, and every
+* edit then restarts the dev server, re-optimizes deps and 504s each open tab
+* (MPO-247). A read keeps it off that list.
+*/
+function readPublicConfigKeys(file) {
+	const parsed = JSON.parse(fs.readFileSync(file, "utf-8"));
+	const keys = parsed && typeof parsed === "object" ? parsed.public : [];
+	if (!Array.isArray(keys)) return [];
+	return keys.filter((key) => typeof key === "string" && key.length > 0);
+}
+function mergePublicConfigKeys(...lists) {
+	return [...new Set(lists.flat())];
+}
+/**
+* Put the bake on process.env: the values resolved from the environment under
+* VITE_MP_CONFIG and the key NAMES under VITE_MP_PUBLIC_CONFIG_KEYS. Names,
+* never a value, is what lets the SSR node process resolve them from its own
+* environment at request time (@multiplatform.one/platform runtimeConfig.ts).
+*/
+function bakePublicConfig(keys) {
+	process.env[bakedConfigEnvKey] = JSON.stringify(resolveConfig(keys));
+	process.env[publicConfigKeysEnvKey] = JSON.stringify(keys);
+}
+const bakedExpression = /\bprocess\??\.env\??\.(?:VITE_MP_CONFIG|VITE_MP_PUBLIC_CONFIG_KEYS)\b/;
+const nonScriptRequest = /\.(?:json|css|html)(?:$|\?)/;
+const nodeModulesPath = /[\\/]node_modules[\\/]/;
+/**
+* The same replacement vite:define makes, done through oxc so only real
+* `process.env.<KEY>` reads change: a string, an assignment target or a
+* `globalThis.process.env.<KEY>` is left as written.
+*/
+function bakedDefine() {
+	return Object.fromEntries([bakedConfigEnvKey, publicConfigKeysEnvKey].map((key) => [`process.env.${key}`, JSON.stringify(process.env[key] ?? "")]));
+}
+/**
+* The browser caches node_modules files and optimized deps as immutable under
+* a ?v= hash that no define value feeds, so a value inlined there would
+* outlive every reload and restart. Those keep reading the defines vite
+* injects through /@vite/env instead.
+*/
+function browserCached(environment, id) {
+	if (!environment || environment.config.consumer === "server") return false;
+	if (nodeModulesPath.test(id)) return true;
+	return "depsOptimizer" in environment && !!environment.depsOptimizer?.isOptimizedDepFile(id);
+}
+/**
+* Dev-server half of `publicConfigFile`. vite:define freezes its replacement
+* table per environment when the server starts, so this plugin inlines the
+* two baked expressions itself (it runs ahead of vite:define), remembers the
+* modules that carried them, and when config.json changes rebakes,
+* invalidates those modules and reloads every environment. The server never
+* restarts, so the dep optimizer never runs again.
+*/
+function publicConfigPlugin(options) {
+	const file = path.resolve(options.file);
+	const envFile = path.resolve(options.projectRoot, ".env");
+	const inlineKeys = options.keys ?? [];
+	const bakedModules = /* @__PURE__ */ new Map();
+	function readKeys() {
+		return mergePublicConfigKeys(inlineKeys, readPublicConfigKeys(file));
+	}
+	function bake(next) {
+		dotenv.config({
+			path: envFile,
+			quiet: true
+		});
+		bakePublicConfig(next);
+	}
+	let keys = readKeys();
+	bake(keys);
+	function refresh(server) {
+		const label = path.relative(process.cwd(), file);
+		let next;
+		try {
+			next = readKeys();
+		} catch (err) {
+			server.config.logger.warn(`${label}: ${err.message}; keeping the previous public keys`, { timestamp: true });
+			return;
+		}
+		if (next.length === keys.length && next.every((key, i) => key === keys[i])) return;
+		keys = next;
+		bake(keys);
+		for (const [name, ids] of bakedModules) {
+			const environment = server.environments[name];
+			if (!environment) continue;
+			for (const id of ids) {
+				const mod = environment.moduleGraph.getModuleById(id);
+				if (mod) environment.moduleGraph.invalidateModule(mod);
+			}
+		}
+		for (const environment of Object.values(server.environments)) environment.hot.send({
+			type: "full-reload",
+			path: "*"
+		});
+		server.config.logger.info(`${label} changed, reloading with public keys ${keys.join(", ")}`, { timestamp: true });
+	}
+	return {
+		name: "multiplatform-public-config",
+		apply: "serve",
+		async transform(code, id) {
+			if (nonScriptRequest.test(id) || !bakedExpression.test(code)) return;
+			if (browserCached(this.environment, id)) return;
+			let result;
+			try {
+				result = await transformWithOxc(code, id, {
+					lang: "js",
+					sourceType: "module",
+					define: bakedDefine(),
+					tsconfig: false
+				});
+			} catch {
+				return;
+			}
+			const name = this.environment?.name ?? "client";
+			let ids = bakedModules.get(name);
+			if (!ids) {
+				ids = /* @__PURE__ */ new Set();
+				bakedModules.set(name, ids);
+			}
+			ids.add(id);
+			return {
+				code: result.code,
+				map: result.map
+			};
+		},
+		configureServer(server) {
+			server.watcher.add(file);
+			const onChange = (changed) => {
+				if (path.resolve(changed) === file) refresh(server);
+			};
+			server.watcher.on("change", onChange);
+			server.watcher.on("add", onChange);
+		}
+	};
+}
+
 //#endregion
 //#region src/vite.ts
 /**
@@ -66,11 +209,11 @@ function lookupProjectRoot() {
 * @example
 * ```ts
 * // apps/one/vite.config.ts
+* import path from "node:path";
 * import { createViteConfig } from "@multiplatform.one/config/vite";
-* import { public as publicConfigKeys } from "../../features/config.json";
 *
 * export default createViteConfig({
-*   publicConfigKeys,
+*   publicConfigFile: path.resolve(__dirname, "../../packages/config/config.json"),
 *   one: { web: { deploy: "node", defaultRenderMode: "ssr" } },
 *   tamagui: { config: "./config/tamagui.config.ts" },
 *   i18n: { paths: ["../../features/i18n"] },
@@ -79,15 +222,18 @@ function lookupProjectRoot() {
 */
 function createViteConfig(options = {}) {
 	ensureTamaguiWorkspacePaths();
-	const { projectRoot: _projectRoot, publicConfigKeys = [], tamagui = true, i18n = false, one = false, ssr, server, plugins: extraPlugins = [], externalReactRouter, ssrDeps, ssrEntries, ssrCjsExternal, nativeFixes } = options;
+	const { projectRoot: _projectRoot, publicConfigKeys: inlinePublicConfigKeys = [], publicConfigFile, tamagui = true, i18n = false, one = false, ssr, server, plugins: extraPlugins = [], externalReactRouter, ssrDeps, ssrEntries, ssrCjsExternal, nativeFixes } = options;
 	const projectRoot = _projectRoot || findProjectRoot();
+	const publicConfigKeys = publicConfigFile ? mergePublicConfigKeys(inlinePublicConfigKeys, readPublicConfigKeys(publicConfigFile)) : inlinePublicConfigKeys;
 	dotenv.config({ path: path.resolve(projectRoot, ".env") });
-	if (publicConfigKeys.length > 0) {
-		process.env.VITE_MP_CONFIG = JSON.stringify(resolveConfig(publicConfigKeys));
-		process.env.VITE_MP_PUBLIC_CONFIG_KEYS = JSON.stringify(publicConfigKeys);
-	}
+	if (publicConfigKeys.length > 0) bakePublicConfig(publicConfigKeys);
 	const vitePlugins = [];
 	vitePlugins.push(preferBuiltWorkspaceEntryPlugin());
+	if (publicConfigFile) vitePlugins.push(publicConfigPlugin({
+		file: publicConfigFile,
+		projectRoot,
+		keys: inlinePublicConfigKeys
+	}));
 	if (one) {
 		vitePlugins.push(ssrReactNativeAliasPlugin());
 		vitePlugins.push(clientBrokenEsmPlugin());
@@ -257,7 +403,10 @@ function clientBrokenEsmPlugin() {
 				"react-is",
 				"fast-deep-equal",
 				"color",
-				"query-string"
+				"query-string",
+				"react/jsx-runtime",
+				"react/jsx-dev-runtime",
+				"tamagui"
 			];
 			const include = clientEnv.optimizeDeps.include ?? [];
 			for (const dep of extras) if (!include.includes(dep)) include.push(dep);
@@ -482,11 +631,17 @@ function ssrCjsExternalFixPlugin(extras) {
 		configResolved(config) {
 			const external = config.ssr.external ?? [];
 			if (!Array.isArray(external)) return;
-			for (const e of extras) if (!external.includes(e)) external.push(e);
+			for (const e of extras) {
+				if (config.command === "build" && requiresReact(e)) continue;
+				if (!external.includes(e)) external.push(e);
+			}
 			config.ssr.external = external;
 		}
 	};
 }
+function requiresReact(id) {
+	return id === "use-sync-external-store" || id.startsWith("use-sync-external-store/");
+}
 /**
 * Restore Object.prototype methods shadowed by hoisted globals on NATIVE.
 *
@@ -626,4 +781,4 @@ function preferBuiltWorkspaceEntryPlugin() {
 }
 
 //#endregion
-export { createViteConfig as t };
+export { publicConfigPlugin as n, readPublicConfigKeys as r, createViteConfig as t };

package/lib/vite.js

@@ -1,4 +1,4 @@
-import { t as createViteConfig } from "./vite-D6vMjPwv.js";
-import { n as publicPackageViteSourceAliases, t as discoverPublicPackageRoots } from "./workspacePublicPackages-B4FGgRYG.js";
+import { n as publicConfigPlugin, r as readPublicConfigKeys, t as createViteConfig } from "./vite-DXXr5In0.js";
+import { n as publicPackageViteSourceAliases, t as discoverPublicPackageRoots } from "./workspacePublicPackages-BuYRXxFs.js";
 
-export { createViteConfig, discoverPublicPackageRoots, publicPackageViteSourceAliases };
+export { createViteConfig, discoverPublicPackageRoots, publicConfigPlugin, publicPackageViteSourceAliases, readPublicConfigKeys };

package/lib/{workspacePublicPackages-B4FGgRYG.js → workspacePublicPackages-BuYRXxFs.js}

@@ -75,9 +75,16 @@ import path from "node:path";
 * clause and not the whole rule: `@tanstack/db` references the hook nowhere
 * and is pinned anyway, for the collection registry it holds at module scope.
 *
-* `@tanstack/react-query` references the hook in 25 shipped files and is not
-* listed. That is recorded rather than settled — no split has been observed
-* there, and pinning it reaches further than this measurement does.
+* MPO-290. `@tanstack/react-query` references the hook in 25 shipped files
+* and is deliberately NOT listed. It passes the grep, but a pin only earns its
+* place where a second record can exist, and here none does. Measured at
+* 5.100.7 on 0af30157c: seven workspace packages declare it and the lockfile
+* resolves all seven to one snapshot, `5.100.7(react@19.2.5)`. The hoisted
+* install holds one physical copy. So does the isolated layout an unset
+* NPM_AUTH_TOKEN produced while .npmrc held the linker keys, rebuilt by
+* stripping them from pnpm-workspace.yaml: fourteen links, one realpath. The
+* spec re-checks both halves, so a second version or peer set fails there
+* before it splits an app.
 */
 const CONTEXT_SINGLETONS = [
 	"react-cookie",

package/lint.d.ts

@@ -19,3 +19,11 @@ export function resolveRoots(roots?: ConventionRoots): {
 };
 
 export function runConventionChecks(options?: RunConventionChecksOptions): number;
+
+export type SizeRecipeEscapeSite = {
+  line: number;
+  form: "prop" | "call" | "comment";
+  reason: string | undefined;
+};
+
+export function findSizeRecipeEscapes(src: string): SizeRecipeEscapeSite[];