@nadicodeai/ui 0.19.2 → 0.21.0

package/docs/consuming-cross-repo.md

@@ -42,9 +42,37 @@ partials beside it. The package declares its own built component sources; Tailwi
 normal automatic detection covers the consumer application. The app still owns
 its PostCSS configuration, theme provider, and persisted mode preference.
 
-If the app needs bundled Geist files rather than its framework's font loader,
-that asset import is one of the intentional direct-API cases described above.
-Font loading is an asset decision, not a second design stylesheet.
+That stylesheet also delivers the brand typeface. The design-system CSS module
+declares the `@font-face` rules for Geist and Geist Mono and loads the packaged
+woff2 files, so a consuming app must not add its own font loader for those two
+families. A framework loader on top registers a second, differently sourced face
+for the same family names, which downloads the fonts twice and leaves no defined
+winner. Import files under `@nadicodeai/design-system/assets/fonts/*` only when
+the consumer wants the faces without the CSS module; that is one of the
+intentional direct-API cases described above.
+
+## Strict ESLint interface
+
+The package exports the same design-system rules used by this repository. Add
+the flat config after the consumer's framework and TypeScript configs:
+
+```js
+import nadicodeai from "@nadicodeai/ui/eslint";
+
+export default [
+  // Framework, parser, and TypeScript configs first.
+  ...nadicodeai.configs["flat/strict"],
+];
+```
+
+Every rule in this config is an error. The config rejects generated `nc-*`
+utilities that do not exist in the installed design-system release, arbitrary
+radius values that exactly duplicate a generated token, source deep imports,
+raw design values, native visible controls, and appearance overrides on shared
+UI primitives. An arbitrary radius remains valid when no generated radius has
+the same value. Consumers may compose domain-specific components from the
+public UI package; the rules govern package boundaries and design values, not
+the shape of a consumer's JSX tree.
 
 ## NadicodeAI logo
 

package/docs/contract.md

@@ -26,6 +26,7 @@ Agent work surfaces (chat, composer, tool approval, artifacts, threads, diffs, t
 - **Auth routes are consumer-owned shadcn block work.** Login, signup, OTP, two-factor, magic-link, and provider-button flows start from the selected shadcn block/example in the consuming app, with app-owned Better Auth behavior. Do not ship generic auth, signup, OTP, federated-login, or provider abstractions from this package unless a later explicit boundary decision replaces the selected shadcn block.
 - **Reusable sections and compositions live here after proof.** Bento grids, media mounts, demo surfaces, page frames, section intros, CTA bands, proof slots, benefits grids, generic shells, and homepage/use-case sections belong in `@nadicodeai/ui` when a second concrete consumer, a plan-approved shared component, or a named validation slice proves the package boundary. Website, portal, and sibling Nadia routes pass data and media children into existing compositions instead of rebuilding layout locally.
 - **Brand renderers live here for React consumers.** Logo geometry, asset generation, and usage semantics are owned by [`design-system/DESIGN.md`, "Brand media authority"](../../../design-system/DESIGN.md#brand-media-authority). `BrandLockup` supplies the approved horizontal lockup. `BrandMark` serves tight spaces and `BrandWordmark` serves placements where the name must read by itself. All three render the package's public neutral geometry seam with React-scoped SVG ids, dynamic theme paint, and accessible names. Consuming routes use these adapters; they never import raw logo assets, draw brand SVG inline, mask or recolor assets, or create another lockup rule.
+- **Third-party brand marks are generated, never hand-drawn and never hand-edited.** Other companies' marks live in `@nadicodeai/ui/src/components/brand-icons/`, emitted from an explicit allow-list by `@nadicodeai/ui/scripts/build-brand-icons.mjs` and exported through the `@nadicodeai/ui/components/brand-icons` subpath. They are identity images, not UI icons: a brand mark is exempt from the currentColor stroke system and from the raw-literal rule, it never stands in for a UI icon, and a UI icon never stands in for a brand. Marks drawn as one silhouette are stripped to `currentColor` by the generator; every other mark keeps its official colors verbatim. To add a brand, edit the generator's allow-list and run `npm run generate:brand-icons -w @nadicodeai/ui`; hand edits to the generated directory are lost and `@nadicodeai/ui/tests/guards/brand-icons-codegen.test.ts` fails on them. Use is nominative only — naming a platform, an integration, or a provider — never adjacent to endorsement or partnership wording. The full decision, including the licensing and trademark posture, is [ADR 0042](../../../docs/adr/0042-third-party-brand-marks-are-generated-identity-images.md).
 - **No fake proof APIs.** Components may support future testimonials, logos, stats, and proof slots, but they must render nothing public when the proof is absent. Do not ship placeholder customer names, metrics, or logos.
 
 ## Accessibility Invariant
@@ -38,8 +39,17 @@ The source tree, barrels, and package exports own the current reusable section v
 
 ## Consumer Boundary
 
-Consumers own routing, auth, app data, server actions, runtime adapters, permission decisions, analytics, and app-specific copy. The package owns the presentational structure and state vocabulary only. [`migration/nadia-consumer-readiness.md`](migration/nadia-consumer-readiness.md) owns migration order and readiness; [`terminal-tui-semantics.md`](terminal-tui-semantics.md) owns TUI semantics.
+Consumers own routing, auth, app data, server actions, runtime adapters, permission decisions, analytics, and app-specific copy. The package owns the presentational structure and state vocabulary only. [`terminal-tui-semantics.md`](terminal-tui-semantics.md) owns TUI semantics.
 
 App source composes layout, data, behavior, and semantic content around package components. It does not restyle an imported component root: appearance changes enter through the component's typed variant or are added to the owning package component. App `className` values on package components are limited to structural layout and sizing. App source uses semantic roles such as `bg-background` and `text-foreground`; raw Tailwind palette colors and canonical `nc-*` color utilities stay behind package-owned primitives such as `BrandField`. Visible controls come from `@nadicodeai/ui`, while hidden inputs remain valid form transport. The root ESLint rules `nadicodeai/no-shadcn-appearance-override`, `nadicodeai/no-raw-color-utility`, and `nadicodeai/no-native-visible-control` enforce this boundary.
 
 When this package is read from an installed npm package, follow the [consumer setup guide](consuming-cross-repo.md) for setup and public import paths. The styling invariant above remains the authority for component implementation.
+
+The public strict ESLint config enforces only properties that can be decided
+from one source file and the installed generated tokens. It does not infer
+that two JSX trees represent the same product pattern. Repeated patterns stay
+governed by a named owning component, typed variants or slots, and explicit
+package or Portal-kit imports. A new repeated pattern is consolidated at its
+owner and pinned with a focused source or rendering test; generic JSX
+similarity warnings are outside this contract because they cannot distinguish
+valid domain composition from a fork without false positives.

package/llms.txt

@@ -15,7 +15,6 @@ Use this file as a map; read the owning document before changing behavior.
 - Agent work surfaces: `docs/agent-work-surfaces.md`.
 - Product compositions and sections: `docs/product-compositions.md` and
   `docs/product-sections.md`.
-- Consumer migration: `docs/migration/nadia-consumer-readiness.md`.
 - Terminal and TUI semantics: `docs/terminal-tui-semantics.md`.
 - Maintenance workflow and live shadcn or AI Elements discovery:
   `docs/agents/nadicodeai-ui.md`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nadicodeai/ui",
-  "version": "0.19.2",
+  "version": "0.21.0",
   "type": "module",
   "publishConfig": {
     "access": "public"
@@ -14,6 +14,7 @@
       "import": "./dist/index.js"
     },
     "./globals.css": "./dist/styles/globals.css",
+    "./eslint": "./dist/eslint/index.js",
     "./ai-elements": {
       "types": "./dist/ai-elements.d.ts",
       "import": "./dist/ai-elements.js"
@@ -53,8 +54,9 @@
   ],
   "scripts": {
     "dev": "node scripts/dev-build.mjs --watch",
-    "build": "rm -rf dist && tsc -p tsconfig.build.json && node scripts/fix-dist-imports.mjs && node scripts/build-styles.mjs",
+    "build": "rm -rf dist && tsc -p tsconfig.build.json && node scripts/fix-dist-imports.mjs && node scripts/build-styles.mjs && node scripts/build-eslint.mjs",
     "build:fast": "node scripts/dev-build.mjs",
+    "generate:brand-icons": "node scripts/build-brand-icons.mjs",
     "prepack": "npm run build",
     "lint": "eslint --max-warnings=0",
     "typecheck": "tsc --noEmit",
@@ -63,7 +65,7 @@
   },
   "dependencies": {
     "@base-ui/react": "^1.6.0",
-    "@nadicodeai/design-system": "0.19.2",
+    "@nadicodeai/design-system": "0.21.0",
     "@rive-app/react-webgl2": "^4.29.1",
     "@streamdown/cjk": "^1.0.3",
     "@streamdown/code": "^1.1.1",
@@ -102,6 +104,10 @@
     "tailwindcss": "^4.3.1"
   },
   "devDependencies": {
+    "@iconify-json/logos": "^1.2.11",
+    "@iconify/utils": "^3.1.4",
+    "@stryker-mutator/core": "9.6.1",
+    "@stryker-mutator/vitest-runner": "9.6.1",
     "@tailwindcss/postcss": "^4.3.1",
     "@testing-library/react": "^16.3.2",
     "@types/react": "^19",

package/skills/nadicodeai-ui/SKILL.md

@@ -49,7 +49,7 @@ import { AgentChat } from "@nadicodeai/ui/components/agent-chat";
 - Use package product components for shared settings, shell, installer, plugin-boundary, agent chat, artifact, file, diff, and redacted terminal summary UI.
 - Use first-party shadcn registry source in the consuming app for generic data tables, command palettes, and chart cards; do not import a NadicodeAI package abstraction for those patterns.
 - Keep routes, data, auth, server actions, persistence, permission decisions, runtime adapters, analytics, and product-specific copy in the consuming app.
-- Follow `docs/migration/nadia-consumer-readiness.md`: web admin or portal first, installer second, desktop shell third, desktop chat last, TUI through `docs/terminal-tui-semantics.md`.
+- Render TUI surfaces through `docs/terminal-tui-semantics.md`.
 - Fixtures must be synthetic or redacted and cover provider, model, plugin, approval, diff, terminal, installer recovery, queued, streaming, and interrupted states. Do not use generic SaaS/card-grid filler, secrets, environment values, raw terminal output, hidden reasoning, user memory, fake customers, or fake proof metrics.
 
 ## Forms

package/docs/migration/nadia-consumer-readiness.md

@@ -1,180 +0,0 @@
-# Nadia Consumer Readiness
-
-This guide records the first consumer-readiness path for shared Nadia product UI.
-The components are presentational package surface. Consuming apps still own
-routes, auth, data loading, mutations, persistence, runtime adapters, permission
-decisions, analytics, and product-specific copy.
-
-## Required Setup
-
-Complete [`../consuming-cross-repo.md`](../consuming-cross-repo.md) before
-starting a migration; it owns consumer setup. Component styling must satisfy
-[`../contract.md`](../contract.md).
-
-Use public package subpaths:
-
-```tsx
-import { DashboardShell } from "@nadicodeai/ui/components/dashboard-shell";
-import { AgentChat } from "@nadicodeai/ui/components/agent-chat";
-```
-
-Use first-party shadcn registry source directly in the consuming app for generic
-data tables, command palettes, and chart cards. Do not migrate those patterns
-through a NadicodeAI package wrapper.
-
-## Consumer Mapping
-
-### Toast
-
-The imperative toast API is package-owned. Import it from the
-`@nadicodeai/ui/components/toast` subpath, and mount `<Toaster />` from
-`@nadicodeai/ui/components/sonner` once at the app root.
-
-```tsx
-import { toast } from "@nadicodeai/ui/components/toast";
-
-showToast(message, "success"); // → toast.success(message)
-showToast(message, "error"); //   → toast.error(message)
-```
-
-Per-toast duration is a sonner option passed as the second argument.
-Consumers must not depend on `sonner` directly.
-
-### Confirm flows
-
-`ConfirmDialog` from `@nadicodeai/ui/components/confirm-dialog` takes `open`,
-`onConfirm`, `onCancel`, `title`, and optional `description`, `confirmLabel`,
-`cancelLabel`, `destructive`, `loading`. `useConfirmAction` from
-`@nadicodeai/ui/hooks` replaces bespoke delete-confirm hooks:
-
-```tsx
-useConfirmAction({ onConfirm }); // (value) => Promise<void> | void
-// → { request, cancel, confirm, isBusy, isOpen, pending }
-```
-
-| Old (`useConfirmDelete`) | New (`useConfirmAction`) |
-| --- | --- |
-| `onDelete` | `onConfirm` |
-| `requestDelete` | `request` |
-| `isDeleting` | `isBusy` |
-| `pendingId` | `pending` |
-
-A throw inside `onConfirm` keeps the dialog open and the hook swallows it —
-surface errors from inside `onConfirm` yourself, with a toast or an inline
-alert. Non-delete confirms (restart, reset, reload) use the same component
-with either plain boolean state or the same hook.
-
-### Typography
-
-The package ships no `Text`/`Heading` component — the same boundary that
-keeps `DataTable` and `CommandPalette` out. The type scale is design-system
-CSS consumed as classes on raw elements: `nc-type-display-xl/lg/md/sm`,
-`nc-type-title-lg/md/sm`, `nc-type-body-lg/md/sm` (plus `-strong` variants
-for `body-md`/`body-sm`), `nc-type-caption` (plus `-strong` and `-mono`),
-`nc-type-code`, and `nc-type-button-md/lg`.
-
-| Old usage | New usage |
-| --- | --- |
-| Page-level heading | `<h1 className="nc-type-title-lg">` (or a `display-*` class at hero scale) |
-| Section header (the dominant H2 `variant="sm"` pattern) | `<h2 className="nc-type-title-sm">` |
-| Body copy | `<p className="nc-type-body-md">` |
-| Fine print / labels | `nc-type-caption` |
-| Code | `nc-type-code` |
-
-### Segmented control
-
-Single-select segmented UI is the existing `ToggleGroup`:
-
-```tsx
-<ToggleGroup spacing={0} variant="outline">
-  <ToggleGroupItem value="day">Day</ToggleGroupItem>
-  <ToggleGroupItem value="week">Week</ToggleGroupItem>
-</ToggleGroup>
-```
-
-Base UI's `ToggleGroup` is single-select by default (`toggleMultiple`
-defaults to `false`), and its value is an array. Controlled usage is
-`value={[current]}` with:
-
-```tsx
-onValueChange={(next) => {
-  if (next.length) setCurrent(next[0]);
-}}
-```
-
-The length guard preserves radio semantics by ignoring deselection of the
-active item. A label-plus-group row ("FilterGroup") is an app-level flex
-composition, not package surface.
-
-### Copy affordances
-
-Copy-to-clipboard UI is the AI Elements surface — a sanctioned public path.
-Use `Snippet`/`SnippetCopyButton` and `CodeBlockCopyButton` from
-`@nadicodeai/ui/ai-elements`.
-
-| Old | New |
-| --- | --- |
-| `CommandBlock(label, code)` | `Snippet` with `SnippetCopyButton` |
-| Bare `CopyButton(text)` | `SnippetCopyButton` inside a `Snippet`, or an app-local `Button` when no snippet chrome is wanted |
-
-### Breakpoints
-
-`useIsMobile()` (fixed 768) and `useBelowBreakpoint(px)` (true strictly below
-`px`) both ship from `@nadicodeai/ui/hooks`.
-
-## Migration Order
-
-1. Web admin or portal validation slice.
-2. Installer and bootstrap flows.
-3. Desktop shell and plugin boundary surfaces.
-4. Desktop chat and runtime work surfaces.
-5. TUI consumers through the terminal semantic mapping document.
-
-Desktop chat is last because it carries runtime-sensitive approval, streaming,
-queue, attachment, file, diff, and terminal states. Terminal consumers should
-mirror `docs/terminal-tui-semantics.md` instead of importing a DOM runtime.
-
-## Readiness Gates
-
-- The consumer satisfies the canonical setup in
-  [`../consuming-cross-repo.md`](../consuming-cross-repo.md).
-- Product components are imported from `@nadicodeai/ui/components/*` public
-  subpaths, not `src/*`.
-- At least one local shell, bento, settings, installer, plugin, or chat
-  layout responsibility is removed from the consumer.
-- Routes, data, auth, copy, persistence, and runtime behavior remain app-owned.
-- Fixtures use synthetic or redacted provider, model, plugin, approval, diff,
-  terminal, installer, and agent-work scenarios.
-- No fixture contains secrets, environment values, raw terminal output, hidden
-  reasoning, user memory, fake customers, fake proof metrics, or generic SaaS
-  filler.
-
-## First Validation Slice
-
-The in-repo portal is the first real consumer slice. It already imports package
-CSS at `portal/src/app/layout.tsx`. Its shell now consumes
-`@nadicodeai/ui/components/dashboard-shell` and keeps portal-owned route
-definitions, access checks, data, and Italian copy in `portal/`.
-
-This validates the package boundary because the shared component owns responsive
-dashboard chrome, mobile navigation trigger, content containment, and sidebar
-structure while the portal keeps the Nadia Agents activation domain.
-
-## Fixture Expectations
-
-Use NadicodeAI-relevant synthetic/redacted fixtures:
-
-- Data and settings: provider rows, model choices, plugin status, session state,
-  loading, permission, error, empty, and recovery copy.
-- Auth and installer: activation-shaped states, expired or invalid pairing,
-  retry and recovery actions, no live OTPs or secrets.
-- Shell and plugin: realistic navigation hierarchy, permission badges, disabled,
-  warning, error, unsafe, and contained-overflow states.
-- Agent, file, diff, and terminal: approval choices, tool failure, redacted
-  terminal summaries, changed-file hierarchy, interrupted, queued, and streaming
-  states.
-
-Brand and marketing components remain part of the same package surface. Consumer
-migrations should not hide or replace `PageFrame`, `SectionIntro`, `Bento`,
-`MediaMount`, `DemoSurface`, `HeroSplit`, `NavBar`, `Footer`, `BrandWordmark`,
-or the existing marketing sections.