@nadicodeai/ui 1.0.2 → 1.1.0

package/dist/eslint/rules/no-shadcn-appearance-override.js

@@ -1,7 +1,22 @@
+/*
+ * The @nadicodeai/ui package contract (`packages/ui/docs/contract.md`):
+ * "Consumers compose structure. Appearance — colour, elevation, radius,
+ * opacity, the primitive's own border — belongs to the package." A caller that
+ * repaints an imported primitive forks its appearance into the call site, where
+ * the next token change does not reach it.
+ *
+ * The theme's palette restriction (design-system, #821) removed the raw
+ * Tailwind palette, so `bg-red-500` is no longer a class anywhere. What it did
+ * NOT remove is repainting with the SEMANTIC roles — `bg-background`,
+ * `text-foreground`, `rounded-xl`, `shadow-lg`, `opacity-50`, `border-0` — all
+ * of which still compile and still fork the primitive. Those are what survives
+ * here; the raw-palette names are gone from the sets below with the palette.
+ */
 import {
   classUtilities,
-  isPackageOwnedPrimitive,
   openingElementClassUtilities,
+  packageOwnedPrimitivesSchema,
+  skipsPackageOwnedPrimitive,
 } from "./jsx-class-utility.js";
 
 function withoutVariants(utility) {
@@ -18,55 +33,6 @@ function isTextLayoutUtility(utility) {
   );
 }
 
-const COLOR_NAMES = new Set([
-  "black",
-  "white",
-  "slate",
-  "gray",
-  "zinc",
-  "neutral",
-  "stone",
-  "red",
-  "orange",
-  "amber",
-  "yellow",
-  "lime",
-  "green",
-  "emerald",
-  "teal",
-  "cyan",
-  "sky",
-  "blue",
-  "indigo",
-  "violet",
-  "purple",
-  "fuchsia",
-  "pink",
-  "rose",
-  "nc",
-  "background",
-  "foreground",
-  "card",
-  "popover",
-  "primary",
-  "secondary",
-  "muted",
-  "accent",
-  "destructive",
-  "border",
-  "input",
-  "ring",
-  "focus",
-]);
-
-function hasColorValue(utility, prefix) {
-  if (!utility.startsWith(prefix)) {
-    return false;
-  }
-  const value = utility.slice(prefix.length).split("/")[0];
-  return value.startsWith("[") || COLOR_NAMES.has(value.split("-")[0]);
-}
-
 function isBorderMechanic(utility) {
   return /^(?:border(?:-(?:[xy]|[trblse]{1,2}|[0-9]+|px|dashed|dotted|double|hidden|none))?)$/.test(
     utility,
@@ -83,18 +49,24 @@ function isRingOrOutlineMechanic(utility) {
   );
 }
 
+/*
+ * A border/ring/outline utility is either one of the enumerated MECHANICS
+ * (width, side, style, inset/offset — structure the caller owns) or it paints.
+ * There is no third case left to test for: the palette restriction means an
+ * unrecognised `border-…` value is not a class, and
+ * `better-tailwindcss/no-unknown-classes` reports it as one. That is what
+ * retired the hand-written colour-name list this rule used to carry.
+ */
 function isAppearanceUtility(utility) {
   const base = withoutVariants(utility);
   return (
     /^appearance-/.test(base) ||
     /^bg-/.test(base) ||
     isBorderRemoval(base) ||
-    (base.startsWith("border") && !isBorderMechanic(base) && hasColorValue(base, "border-")) ||
+    (base.startsWith("border") && !isBorderMechanic(base)) ||
     /^shadow(?:-|$)/.test(base) ||
     /^rounded(?:-|$)/.test(base) ||
-    ((base.startsWith("ring") || base.startsWith("outline")) &&
-      !isRingOrOutlineMechanic(base) &&
-      (hasColorValue(base, "ring-") || hasColorValue(base, "outline-"))) ||
+    ((base.startsWith("ring") || base.startsWith("outline")) && !isRingOrOutlineMechanic(base)) ||
     /^opacity-/.test(base) ||
     (/^text-/.test(base) && !isTypographySize(base) && !isTextLayoutUtility(base))
   );
@@ -123,14 +95,16 @@ export const noShadcnAppearanceOverride = {
       description:
         "Disallow app callers repainting imported shadcn primitives; compose their structural layout only",
     },
-    schema: [],
+    // Default "exempt": inside @nadicodeai/ui the primitives ARE the appearance,
+    // so every utility here would be a false positive.
+    schema: [packageOwnedPrimitivesSchema],
     messages: {
       appearanceOverride:
         "Do not repaint an imported @nadicodeai/ui primitive with {{utility}}; use its semantic variant or package primitive.",
     },
   },
   create(context) {
-    if (isPackageOwnedPrimitive(context.filename)) {
+    if (skipsPackageOwnedPrimitive(context)) {
       return {};
     }
 

package/dist/eslint/rules/no-unpinned-vercel-functions-import.js

@@ -1,11 +1,33 @@
+// The standard tool was checked first: core `no-restricted-imports` takes
+// `paths[].importNames` / `allowImportNames`, so a per-symbol allowlist is
+// within its vocabulary. What it cannot do is bind that allowlist to a file.
+// The ban would live in the shared options and each allowed module would need a
+// file-scoped override — and flat config replaces rule options instead of
+// merging them, so every one of those overrides must restate the whole shared
+// object (the package-source patterns, the raw-logo patterns, the portal's kit
+// barrel) to keep them alive. That is one copy of the ban list per allowed
+// module, where a single stale copy silently reopens a boundary; the same
+// last-wins failure `tests/module-boundary-imports.test.ts` exists to catch. A
+// plugin rule keeps the module-to-symbol map in one place and carries the
+// incident and the remediation in its message.
+//
+// Static `import` declarations only. The rule's provenance is a real production
+// crash — `ipAddress()` duck-typed its input and threw on the device-authorize
+// route (docs/solutions/portal-device-authorize-vercel-headers-crash.md) — and
+// that crash arrived through a plain named import, which is also the only form
+// that can prove which symbols it binds. The rule used to also flag any string
+// literal or template literal spelling the package name anywhere in a file,
+// reaching dynamic `import()`, `require`, and re-exports; nothing in this
+// repository writes those forms, and the catch-all fired on any quoted mention
+// of the name.
 const PACKAGE_NAME = "@vercel/functions";
 
 // Third-party helpers stay behind owned, single-purpose capability seams. Pin
 // the full workspace-relative suffix so a same-named file in another workspace
 // cannot acquire a platform dependency by shadowing an allowed module.
 const ALLOWED_IMPORTS = new Map([
-  ["portal/src/lib/server/db.ts", new Set(["attachDatabasePool"])],
-  ["portal/src/lib/server/deferred-work.ts", new Set(["waitUntil"])],
+  ["apps/portal/src/lib/server/db.ts", new Set(["attachDatabasePool"])],
+  ["apps/portal/src/lib/server/deferred-work.ts", new Set(["waitUntil"])],
 ]);
 
 function matchesPackage(value) {
@@ -38,7 +60,7 @@ export const noUnpinnedVercelFunctionsImport = {
   meta: {
     type: "problem",
     docs: {
-      description: "Confine @vercel/functions imports to pinned edge modules and symbols",
+      description: "Confine static @vercel/functions imports to pinned edge modules and symbols",
     },
     messages: {
       banned:
@@ -75,26 +97,6 @@ export const noUnpinnedVercelFunctionsImport = {
           report(node, node.source.value);
         }
       },
-      // Everything except a static import is judged by the quoted reference
-      // itself, whatever expression carries it: dynamic import(), require in
-      // any callee shape (bare, module.require, createRequire), export ...
-      // from, or a bare string that smuggles the specifier to a loader. Only
-      // static named imports can prove which symbols they bind, so only they
-      // get the allowlist path above.
-      Literal(node) {
-        if (!matchesPackage(node.value)) {
-          return;
-        }
-        if (node.parent.type === "ImportDeclaration") {
-          return;
-        }
-        report(node, node.value);
-      },
-      TemplateLiteral(node) {
-        if (node.expressions.length === 0 && matchesPackage(node.quasis[0]?.value.cooked)) {
-          report(node, node.quasis[0].value.cooked);
-        }
-      },
     };
   },
 };

package/dist/eslint/rules/server-action-discipline.js

@@ -0,0 +1,182 @@
+/**
+ * A Next.js server action is a POST endpoint with a function's syntax: anything
+ * on the internet can call it with any arguments. So an exported server action
+ * must resolve its viewer before it acts, and must parse whatever the client
+ * sent before it trusts it.
+ *
+ * Standard tools checked first. `@next/eslint-plugin-next` is already on
+ * through `eslint-config-next`, and none of its rules read a server action's
+ * body — the set is script, head, font and image hygiene. `typescript-eslint`
+ * can type the argument but cannot require that a call happened. The tier-1
+ * option — a `defineAction` wrapper that makes an unvalidated or unauthorized
+ * action untypeable — was tried and rejected for this change: Next binds the
+ * exported function itself, so adopting it rewrites all 62 exported actions in
+ * the same diff that retires the guard.
+ *
+ * The rule reads one function at a time — no whole-tree scan, no cross-file
+ * dataflow, no exception ledger. A deliberately public action carries an inline
+ * `eslint-disable-next-line` with its reason, which is reviewed in the diff that
+ * adds it rather than in a list somewhere else.
+ */
+
+/** Every helper that resolves the viewer and refuses an unauthorized one. */
+const AUTH_CALLS = new Set([
+  "customerActionContext",
+  "getPortalSession",
+  "installationActionContext",
+  "partnerActionContext",
+  "requirePlatformAdminViewer",
+  "requirePlatformOrPartnerViewer",
+  "requirePortalAdmin",
+  "requirePortalViewer",
+  "requireViewerForPage",
+  "resolveDeviceApprover",
+  "resolvePortalAccessState",
+]);
+
+/**
+ * A schema's `parse`/`safeParse`. `JSON.parse` turns a string into an object
+ * and asserts nothing about its shape, so it is not validation and is excluded
+ * by name.
+ */
+const VALIDATION_CALLS = new Set(["parse", "safeParse"]);
+
+function hasUseServer(body) {
+  return (body ?? []).some(
+    (statement) =>
+      statement.type === "ExpressionStatement" &&
+      statement.expression.type === "Literal" &&
+      statement.expression.value === "use server",
+  );
+}
+
+function calleeName(node) {
+  if (node.callee.type === "Identifier") return node.callee.name;
+  if (node.callee.type === "MemberExpression" && node.callee.property.type === "Identifier") {
+    if (node.callee.object.type === "Identifier" && node.callee.object.name === "JSON") {
+      return undefined;
+    }
+    return node.callee.property.name;
+  }
+  return undefined;
+}
+
+/**
+ * How a module-level function reaches the outside, which is what decides
+ * whether Next binds it as a POST endpoint. All five spellings bind the same
+ * way, so the rule reads all five: `export async function a`, `export default
+ * async function a`, `export const a = async () => {}`, `export const a =
+ * async function () {}`, and a bare declaration later named in `export { a }`.
+ * Returns the identifier to report on, or undefined when the function is not a
+ * module-level export.
+ */
+function exportedIdentifier(node) {
+  const parent = node.parent;
+  if (!parent) return undefined;
+  // export [default] async function a() {}
+  if (parent.type === "ExportNamedDeclaration" || parent.type === "ExportDefaultDeclaration") {
+    return node.id ?? node;
+  }
+  // export const a = async () => {} / async function () {}
+  if (parent.type === "VariableDeclarator" && parent.id.type === "Identifier") {
+    const declaration = parent.parent;
+    if (declaration?.parent?.type === "ExportNamedDeclaration") return parent.id;
+    // A bare `const a = async () => {}` that a later `export { a }` names.
+    if (declaration?.parent?.type === "Program") return parent.id;
+    return undefined;
+  }
+  // A bare `async function a() {}` that a later `export { a }` names.
+  if (parent.type === "Program") return node.id ?? undefined;
+  return undefined;
+}
+
+/** @type {import("eslint").Rule.RuleModule} */
+export const serverActionDiscipline = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "An exported server action resolves its viewer and parses its client input.",
+    },
+    schema: [],
+    messages: {
+      missingAuth:
+        "Server action '{{name}}' calls no viewer check. Resolve the viewer first (requirePortalViewer, customerActionContext, partnerActionContext, …), or disable this rule inline with the reason it is public.",
+      missingValidation:
+        "Server action '{{name}}' takes client input and never parses it. Run the Zod schema's parse/safeParse before trusting the argument.",
+    },
+  },
+  create(context) {
+    const moduleIsServer = hasUseServer(context.sourceCode.ast.body);
+    /**
+     * One frame per function, holding only the calls written in that function's
+     * own body. A call parked inside a nested callback is not a call the action
+     * itself makes, so it does not count for the action.
+     * @type {Array<Set<string>>}
+     */
+    const callStack = [];
+    /**
+     * Candidates are judged at `Program:exit` rather than when each function
+     * closes, because `export { a }` can name a declaration written above it.
+     * @type {Array<{ identifier: object, name: string, calls: Set<string>, hasParams: boolean, inlineExported: boolean }>}
+     */
+    const candidates = [];
+    /** Names an `export { … }` specifier list makes public. @type {Set<string>} */
+    const specifierExports = new Set();
+
+    function enter() {
+      callStack.push(new Set());
+    }
+
+    function exit(node) {
+      const calls = callStack.pop() ?? new Set();
+      if (!node.async) return;
+      if (!(moduleIsServer || hasUseServer(node.body?.body))) return;
+      const identifier = exportedIdentifier(node);
+      if (!identifier) return;
+      const parent = node.parent;
+      const inlineExported =
+        parent?.type === "ExportNamedDeclaration" ||
+        parent?.type === "ExportDefaultDeclaration" ||
+        parent?.parent?.parent?.type === "ExportNamedDeclaration";
+      candidates.push({
+        identifier,
+        name: identifier.name ?? "default",
+        calls,
+        hasParams: node.params.length > 0,
+        inlineExported,
+      });
+    }
+
+    return {
+      FunctionDeclaration: enter,
+      "FunctionDeclaration:exit": exit,
+      FunctionExpression: enter,
+      "FunctionExpression:exit": exit,
+      ArrowFunctionExpression: enter,
+      "ArrowFunctionExpression:exit": exit,
+      ExportNamedDeclaration(node) {
+        for (const specifier of node.specifiers ?? []) {
+          const local = specifier.local;
+          if (local?.type === "Identifier") specifierExports.add(local.name);
+        }
+      },
+      CallExpression(node) {
+        const name = calleeName(node);
+        if (!name) return;
+        callStack.at(-1)?.add(name);
+      },
+      "Program:exit"() {
+        for (const candidate of candidates) {
+          if (!candidate.inlineExported && !specifierExports.has(candidate.name)) continue;
+          const { identifier, name, calls, hasParams } = candidate;
+          if (![...AUTH_CALLS].some((call) => calls.has(call))) {
+            context.report({ node: identifier, messageId: "missingAuth", data: { name } });
+          }
+          if (hasParams && ![...VALIDATION_CALLS].some((call) => calls.has(call))) {
+            context.report({ node: identifier, messageId: "missingValidation", data: { name } });
+          }
+        }
+      },
+    };
+  },
+};

package/dist/eslint/rules/shadcn-composition.js

@@ -0,0 +1,131 @@
+/*
+ * The four composition conventions the shadcn primitives are built to, checked
+ * where they are composed:
+ *
+ * - an overlay carries its title, so a screen reader announces what opened
+ *   (`className="sr-only"` when the title is not drawn);
+ * - a `SelectItem` sits inside a `SelectGroup`, which is what gives the listbox
+ *   its accessible grouping;
+ * - an `AvatarImage` has an `AvatarFallback` beside it, or the avatar is blank
+ *   until the image loads;
+ * - a lucide icon inside a `Button` carries `data-icon`, the hook the button's
+ *   own spacing rules key on.
+ *
+ * Standard tool checked (ADR 0057 tier 2): `jsx-a11y` covers roles and ARIA on
+ * intrinsic elements and says nothing about these composed components;
+ * `no-restricted-syntax` selects a node by its own shape, and every one of
+ * these is a statement about an ancestor or a descendant. Replaces the JSX half
+ * of the retired @nadicodeai/ui composition-conventions scanner (#822); stock
+ * upstream shapes carry an inline disable with the reason at the site.
+ */
+import { packageOwnedPrimitivesSchema, skipsPackageOwnedPrimitive } from "./jsx-class-utility.js";
+
+const OVERLAY_TITLES = {
+  AlertDialogContent: "AlertDialogTitle",
+  DialogContent: "DialogTitle",
+  DrawerContent: "DrawerTitle",
+  SheetContent: "SheetTitle",
+};
+
+function elementName(node) {
+  if (node?.type === "JSXElement") return elementName(node.openingElement);
+  if (node?.type !== "JSXOpeningElement") return undefined;
+  if (node.name.type === "JSXIdentifier") return node.name.name;
+  if (node.name.type === "JSXMemberExpression") return node.name.property.name;
+  return undefined;
+}
+
+function hasAttribute(node, attributeName) {
+  return node.attributes.some(
+    (attribute) =>
+      attribute.type === "JSXAttribute" &&
+      attribute.name.type === "JSXIdentifier" &&
+      attribute.name.name === attributeName,
+  );
+}
+
+/**
+ * True when `tagName` is rendered anywhere below this element — through a
+ * conditional or a map as much as directly, so the whole subtree is walked
+ * rather than the JSX children alone.
+ */
+function hasDescendant(node, tagName, root = node) {
+  if (!node || typeof node.type !== "string") return false;
+  if (node !== root && node.type === "JSXElement" && elementName(node) === tagName) return true;
+  for (const [key, value] of Object.entries(node)) {
+    if (key === "parent") continue;
+    if (Array.isArray(value)) {
+      if (value.some((child) => hasDescendant(child, tagName, root))) return true;
+    } else if (value && typeof value === "object" && hasDescendant(value, tagName, root)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function ancestorNames(node, sourceCode) {
+  return sourceCode
+    .getAncestors(node)
+    .filter((ancestor) => ancestor.type === "JSXElement")
+    .map((ancestor) => elementName(ancestor))
+    .filter(Boolean);
+}
+
+function isIconTag(tagName) {
+  return tagName === "Icon" || tagName.endsWith("Icon");
+}
+
+export const shadcnComposition = {
+  meta: {
+    type: "problem",
+    docs: {
+      description: "Require the shadcn primitives' composition conventions where they are composed",
+    },
+    schema: [packageOwnedPrimitivesSchema],
+    messages: {
+      overlayTitle:
+        '{{tag}} must include {{title}}; use className="sr-only" when the title is visually hidden.',
+      selectGroup: "SelectItem must be rendered inside SelectGroup.",
+      avatarFallback: "AvatarImage requires an AvatarFallback in the same Avatar.",
+      buttonIcon: "An icon inside Button must carry data-icon.",
+    },
+  },
+  create(context) {
+    if (skipsPackageOwnedPrimitive(context)) {
+      return {};
+    }
+
+    return {
+      JSXOpeningElement(node) {
+        const tag = elementName(node);
+        if (!tag) return;
+        const element = node.parent;
+
+        const title = OVERLAY_TITLES[tag];
+        if (title && !hasDescendant(element, title)) {
+          context.report({ node, messageId: "overlayTitle", data: { tag, title } });
+        }
+
+        if (tag === "Avatar" && hasDescendant(element, "AvatarImage")) {
+          if (!hasDescendant(element, "AvatarFallback")) {
+            context.report({ node, messageId: "avatarFallback" });
+          }
+          return;
+        }
+
+        if (tag !== "SelectItem" && tag !== "AvatarImage" && !isIconTag(tag)) return;
+
+        const ancestors = ancestorNames(node, context.sourceCode);
+        if (tag === "SelectItem" && !ancestors.includes("SelectGroup")) {
+          context.report({ node, messageId: "selectGroup" });
+        }
+        if (tag === "AvatarImage" && !ancestors.includes("Avatar")) {
+          context.report({ node, messageId: "avatarFallback" });
+        }
+        if (isIconTag(tag) && ancestors.includes("Button") && !hasAttribute(node, "data-icon")) {
+          context.report({ node, messageId: "buttonIcon" });
+        }
+      },
+    };
+  },
+};

package/dist/hooks/index.d.ts

@@ -1,4 +1,4 @@
-export { useBelowBreakpoint } from "./use-below-breakpoint";
-export { useConfirmAction } from "./use-confirm-action";
-export * from "./use-mobile";
+export { useBelowBreakpoint } from "./use-below-breakpoint.js";
+export { useConfirmAction } from "./use-confirm-action.js";
+export * from "./use-mobile.js";
 //# sourceMappingURL=index.d.ts.map