@nodii/dev 0.6.16 → 0.6.20

package/dist/figma.js

@@ -1,5 +1,6 @@
 import { readFile } from "node:fs/promises";
-import { CliError, devRequest, encode } from "./core.js";
+import { setTimeout as delay } from "node:timers/promises";
+import { CliError, devAsyncRequest, devRequest, encode } from "./core.js";
 
 /** A Figma file key, or the key inside a figma.com file link (a branch link's branch key). */
 export function figmaFileKey(value) {
@@ -55,7 +56,158 @@ export function resubmitPayload(text, file) {
   return body;
 }
 
-export async function figmaResubmit(id, file, { request = devRequest, read = (f) => readFile(f, "utf8") } = {}) {
+// Async submit, re-submit and dry run (`Prefer: respond-async`): a large set's
+// gate outlasts the edge's 30 s timeout (CS-2470 got a 504 while Dev went on to
+// answer 422), so Dev answers 202 with a job, polled here until it ends. A Dev
+// that ignores the header answers synchronously, which is taken as is.
+const JOB_POLL_MS = [1000, 2000, 3000, 5000];
+// Dev fails a job still running after 20 minutes (SUBMIT_JOB_LOST); stop a little later.
+const JOB_WAIT_MS = 25 * 60_000;
+const JOB_PROGRESS_MS = 15_000;
+const IN_PROGRESS = new Set(["SUBMIT_IN_PROGRESS", "CONFORMANCE_IN_PROGRESS"]);
+const GATEWAY = new Set(["HTTP_502", "HTTP_504"]);
+const TRANSIENT = new Set([...GATEWAY, "HTTP_503", "HTTP_429", "DEV_UNREACHABLE"]);
+const stderrLine = (line) => process.stderr.write(`${line}\n`);
+/** --sync sends the old synchronous call; the default (or --async) runs it as a job in Dev and polls it. */
+export function submitMode(f) {
+  if (f.sync && f.async) throw new CliError("USAGE", "pass --sync or --async, not both", 2);
+  return Boolean(f.sync);
+}
+const DONE = new Set(["succeeded", "failed"]);
+const jobName = (job) => (job.kind === "conformance" ? "dry run" : job.kind === "resubmit" ? "re-submit" : "submit");
+
+export const submitJobPath = (job) => `/api/v1/design/change-sets/${encode(job.changeSetId)}/submit-jobs/${encode(job.id)}`;
+
+/** A finished job as the synchronous call would have answered: `succeeded` is its 200 body, `failed` throws its error. */
+export function jobOutcome(job) {
+  if (job.state === "succeeded") return job.result ?? {};
+  const e = job.error ?? {};
+  if (e.code === "SUBMIT_JOB_LOST")
+    throw new CliError(e.code, `${e.message ?? "Dev lost this job"} (${jobName(job)} job ${job.id} on ${job.changeSetId}). Run the same command again.`, 1, { job });
+  // Never a gateway code: that reads as the edge's gateway on this command's own request.
+  throw new CliError(!e.code || GATEWAY.has(e.code) ? "SUBMIT_JOB_FAILED" : e.code, e.message ?? `Dev's ${jobName(job)} job ${job.id} failed with HTTP ${job.httpStatus}`, 1, e.details ?? { httpStatus: job.httpStatus });
+}
+
+/** Polls a running job (getDesignSubmitJob) with backoff until it ends, printing progress. */
+export async function pollSubmitJob(job, { request = devRequest, sleep = delay, progress = stderrLine, now = Date.now } = {}) {
+  const start = now();
+  let printed = start;
+  let misses = 0;
+  for (let n = 0; !DONE.has(job.state); n++) {
+    if (now() - start > JOB_WAIT_MS)
+      throw new CliError("SUBMIT_JOB_TIMEOUT", `Dev's ${jobName(job)} job ${job.id} is still running after ${Math.round(JOB_WAIT_MS / 60_000)} min; read ${job.changeSetId} with nodii-dev figma changeset show ${job.changeSetId} before running it again.`, 1, { job });
+    await sleep(JOB_POLL_MS[Math.min(n, JOB_POLL_MS.length - 1)]);
+    try {
+      job = { changeSetId: job.changeSetId, ...(await request("GET", submitJobPath(job))).data };
+      misses = 0;
+    } catch (error) {
+      if (error?.code === "SUBMIT_JOB_NOT_FOUND")
+        throw new CliError("SUBMIT_JOB_LOST", `Dev no longer knows ${jobName(job)} job ${job.id} on ${job.changeSetId} (it restarted). Read the set with nodii-dev figma changeset show ${job.changeSetId}, then run the same command again.`, 1, { job });
+      if (!TRANSIENT.has(error?.code)) throw error;
+      // A poll that hit the edge's gateway or a blip retries; the job runs on in Dev.
+      if (++misses > 5)
+        throw new CliError("SUBMIT_JOB_UNREACHABLE", `Lost touch with Dev (${error.code}) while its ${jobName(job)} job ${job.id} on ${job.changeSetId} ran; the job goes on in Dev. Do not send it again yet: read the set with nodii-dev figma changeset show ${job.changeSetId} in a few minutes.`, 1, { job, cause: error.code });
+      progress(`polling ${job.id} again (${error.code})`);
+      continue;
+    }
+    if (!DONE.has(job.state) && now() - printed >= JOB_PROGRESS_MS) {
+      printed = now();
+      progress(`${job.changeSetId}: ${jobName(job)} job ${job.id} still running (${Math.round((printed - start) / 1000)} s)`);
+    }
+  }
+  progress(`${job.changeSetId}: ${jobName(job)} job ${job.id} ${job.state}${job.httpStatus && job.state === "failed" ? ` (HTTP ${job.httpStatus})` : ""} after ${Math.round((now() - start) / 1000)} s`);
+  return jobOutcome(job);
+}
+
+/**
+ * Sends a change-set call with `Prefer: respond-async` and answers as the
+ * synchronous call does. A 409 SUBMIT_IN_PROGRESS or CONFORMANCE_IN_PROGRESS
+ * names the job already running for the set: that one is polled instead.
+ */
+export async function changeSetJob(method, path, body, { changeSetId, kind, send = devAsyncRequest, progress = stderrLine, ...poll } = {}) {
+  let job;
+  let adopted = null;
+  try {
+    const { status, payload } = await send(method, path, body);
+    if (status !== 202) return payload;
+    if (!payload?.data?.id)
+      throw new CliError("SUBMIT_UNCONFIRMED", `Dev took the ${kind === "conformance" ? "dry run" : kind} on ${changeSetId} as a job (202) but named no job; do not send it again yet: read the set with nodii-dev figma changeset show ${changeSetId}.`, 1, { changeSetId, payload });
+    job = { changeSetId, ...payload.data };
+    progress(`${job.changeSetId}: Dev is running the ${jobName(job)} as job ${job.id}; polling`);
+  } catch (error) {
+    if (!IN_PROGRESS.has(error?.code) || !error.details?.job?.id) throw error;
+    job = { changeSetId, ...error.details.job };
+    // A dry run never answers for a submit, nor a submit for a dry run.
+    if ((job.kind === "conformance") !== (kind === "conformance")) throw error;
+    progress(`a ${jobName(job)} is already running: ${job.id}; polling it`);
+    adopted = error;
+  }
+  if (!adopted) return pollSubmitJob(job, { progress, ...poll });
+  // An adopted job ran its own body, so its answer is never this command's: it
+  // ends as the 409 it met, with that job's outcome in the details.
+  let outcome;
+  try {
+    outcome = { result: await pollSubmitJob(job, { progress, ...poll }) };
+  } catch (error) {
+    outcome = { error: { code: error.code, message: error.message, details: error.details } };
+  }
+  // Polling that stopped (lost the edge, or timed out) leaves the job's end unknown.
+  const unknown = !outcome.result && ["SUBMIT_JOB_UNREACHABLE", "SUBMIT_JOB_TIMEOUT"].includes(outcome.error.code);
+  const ended = outcome.result ? "succeeded" : unknown ? `has no known outcome yet (${outcome.error.code})` : `failed (${outcome.error.code})`;
+  throw new CliError(
+    adopted.code,
+    `The ${jobName(job)} already running on ${changeSetId} (job ${job.id}) ${ended}; this command's body was not sent. Read the set with nodii-dev figma changeset show ${changeSetId}, then run it again ${unknown ? "only once that job has ended" : "if it still needs to go"}.`,
+    1,
+    { job, ...outcome },
+  );
+}
+
+// A submit lands an editing set in_review, a re-submit an applying one: only that move
+// from the call's own entry state counts, never a set that was in review already.
+const ENTRY = { submit: "editing", resubmit: "applying" };
+
+/**
+ * A submit or re-submit that met the edge's gateway (502/504) may still have
+ * landed in Dev (CS-2468 did): read the set and say which, never send again.
+ */
+async function afterGatewayTimeout(id, kind, before, error, { sync, request, progress }) {
+  let after = null;
+  try {
+    after = (await request("GET", `/api/v1/design/change-sets/${encode(id)}`)).data;
+  } catch {}
+  const status = error.code.replace("HTTP_", "HTTP ");
+  if (before?.state === ENTRY[kind] && after?.state === "in_review") {
+    progress(`Dev answered ${status} (the edge's gateway), but the submit landed: ${id} is ${after.state}. Its warnings were not returned; run nodii-dev figma changeset show ${id}.`);
+    return { data: after, warnings: [], landedAfterGatewayTimeout: true };
+  }
+  throw new CliError(
+    "SUBMIT_UNCONFIRMED",
+    [
+      `Dev answered ${status} (the edge's gateway timeout)${after ? ` and ${id} is still ${after.state}` : `, and ${id} could not be read`}.`,
+      "Dev may still be working on it: do not send it again yet.",
+      `Check with nodii-dev figma changeset show ${id} in a few minutes; if nothing changed, submit again${sync ? " without --sync, so Dev runs it as a job" : ""}.`,
+    ].join("\n"),
+    1,
+    { changeSetId: id, state: after?.state ?? null, gateway: error.code },
+  );
+}
+
+/** A submit or re-submit, async unless `sync`; a gateway timeout is checked against the set, not resent. */
+async function submitCall(id, kind, body, { sync = false, request = devRequest, progress = stderrLine, ...job } = {}) {
+  const path = `/api/v1/design/change-sets/${encode(id)}/${kind}`;
+  let before = null;
+  try {
+    before = (await request("GET", `/api/v1/design/change-sets/${encode(id)}`)).data;
+  } catch {}
+  try {
+    return sync ? await request("POST", path, body) : await changeSetJob("POST", path, body, { changeSetId: id, kind, request, progress, ...job });
+  } catch (error) {
+    if (!GATEWAY.has(error?.code)) throw error;
+    return afterGatewayTimeout(id, kind, before, error, { sync, request, progress });
+  }
+}
+
+export async function figmaResubmit(id, file, { request = devRequest, read = (f) => readFile(f, "utf8"), ...options } = {}) {
   if (!id || !file) throw new CliError("USAGE", "figma resubmit CHANGE_SET PAYLOAD.json", 2);
   let text;
   try {
@@ -65,7 +217,7 @@ export async function figmaResubmit(id, file, { request = devRequest, read = (f)
   }
   const body = resubmitPayload(text, file);
   try {
-    return await request("POST", `/api/v1/design/change-sets/${encode(id)}/resubmit`, body);
+    return await submitCall(id, "resubmit", body, { request, ...options });
   } catch (error) {
     const say = RESUBMIT_REFUSALS[error?.code];
     if (!say) throw scopeRefusal(error, id) ?? error;
@@ -106,10 +258,10 @@ export function figmaChangeSetText(cs) {
 }
 
 // Scoped design locks (DEC-0032, MW1-57.6 to 57.9). A scope is written
-// kind:id on the command line: component:NODE, page:NODE, foundations, or
-// create:PAGE:NAME. A node id from a figma.com link (12-34) is Figma's 12:34.
+// kind:id on the command line: component:NODE, page:NODE, section:NODE,
+// foundations, or create:PAGE:NAME. A node id from a figma.com link (12-34) is Figma's 12:34.
 const nodeId = (text) => (/^\d+-\d+$/.test(text) ? text.replace("-", ":") : text);
-const SCOPE_USAGE = "--scope component:NODE_ID | page:NODE_ID | foundations | create:PAGE_ID:NAME";
+const SCOPE_USAGE = "--scope component:NODE_ID | page:NODE_ID | section:NODE_ID | foundations | create:PAGE_ID:NAME";
 
 export function parseScope(value) {
   const text = typeof value === "string" ? value.trim() : "";
@@ -119,7 +271,7 @@ export function parseScope(value) {
   if (create && create[2].trim() && create[2].trim().length <= 200)
     return { kind: "create", pageId: nodeId(create[1]), name: create[2].trim() };
   // Dev takes a scope at a top-level node: a plain id, never an instance's (I1:2;3:4).
-  const node = text.match(/^(component|page):(\d+[:-]\d+)$/);
+  const node = text.match(/^(component|page|section):(\d+[:-]\d+)$/);
   if (!node) throw bad();
   return { kind: node[1], nodeId: nodeId(node[2]) };
 }
@@ -185,6 +337,11 @@ export function conformanceLines(r) {
     lines.push(`${r.libraryUpdatePending.length} node(s) behind a library republish (not failures; accept the library update in this file, MW6-17):`);
     for (const f of r.libraryUpdatePending) lines.push(`  ${f.nodeId}\t${f.check ?? "libraryUpdatePending"}\t${f.detail}`);
   }
+  // Email is outside the app-UI gate (Dev issue 116): counted, never silent.
+  if (r.outOfScope?.length) {
+    lines.push(`out of scope: ${r.outOfScopeNodes ?? "?"} node(s) in ${r.outOfScope.length} part(s), not checked (email: the Email kit, email bodies, the block palette):`);
+    for (const f of r.outOfScope) lines.push(`  ${f.nodeId}\toutOfScope\t${f.detail}`);
+  }
   // Warnings never refuse: STALE_FIGMA_VERSION is one (Dev issue 92, until
   // Dev issue 107). With staleVersion, its wait is printed below instead.
   const warnings = (r.warnings ?? []).filter((f) => !(r.staleVersion && f.check === "STALE_FIGMA_VERSION"));
@@ -314,12 +471,15 @@ export const figmaScopeSetText = (id, data) =>
     ...(data?.released?.length ? [`Released for other sets: ${data.released.map(scopeText).join(", ")}`] : []),
   ].join("\n");
 
-export const figmaSubmit = (id, payload, { request = devRequest } = {}) =>
-  changeSetCall(id, request)("POST", `/api/v1/design/change-sets/${encode(id)}/submit`, payload);
+/** A submit, async unless `sync` (options: sync, request, send, progress, sleep). */
+export const figmaSubmit = (id, payload, { request = devRequest, ...options } = {}) =>
+  changeSetCall(id, (method, path, body) => submitCall(id, "submit", body, { request, ...options }))(
+    "POST", `/api/v1/design/change-sets/${encode(id)}/submit`, payload);
 
-/** checkDesignConformance: the submit gate's dry run on a change set; changes no state. Body: { figmaVersion?, items? }. */
-export const figmaConformance = (id, body = {}, { request = devRequest } = {}) =>
-  changeSetCall(id, request)("POST", `/api/v1/design/change-sets/${encode(id)}/conformance`, body);
+/** checkDesignConformance: the submit gate's dry run on a change set; changes no state. Body: { figmaVersion?, items? }. Async unless `sync`. */
+export const figmaConformance = (id, body = {}, { request = devRequest, sync = false, ...options } = {}) =>
+  changeSetCall(id, (method, path, b) => (sync ? request(method, path, b) : changeSetJob(method, path, b, { changeSetId: id, kind: "conformance", request, ...options })))(
+    "POST", `/api/v1/design/change-sets/${encode(id)}/conformance`, body);
 
 export const figmaLogWrite = (id, tool, nodeIds, { request = devRequest } = {}) =>
   changeSetCall(id, request)("POST", `/api/v1/design/change-sets/${encode(id)}/writes`, { tool, nodeIds });

package/dist/vendor/ds-conformance.mjs

@@ -1,5 +1,6 @@
 // ds-conformance.mjs: the design-system conformance check (DEC-0034 MW6-14 to
-// MW6-17, as amended by DEC-0035, DEC-0036 and DEC-0045).
+// MW6-17, as amended by DEC-0035, DEC-0036 and DEC-0045, and scoped by
+// Dev issue 116).
 //
 // Canonical source: design-system `infra/figma/ds-conformance.mjs`. Every copy
 // (Dev's submit gate, nodii-clis' `design check`) vendors these
@@ -20,13 +21,16 @@
 //             remote component, from the same file for a local one), or
 //             null when it can't be resolved
 //     options: { library?: boolean, declaredRoles?: string[] }
-//     returns { version, findings, staleOverrides, libraryUpdatePending },
-//     each a list of { nodeId, check, detail }; only `findings` fail
+//     returns { version, findings, staleOverrides, libraryUpdatePending,
+//     outOfScope, outOfScopeNodes }, each list a list of { nodeId, check,
+//     detail }; only `findings` fail. `outOfScope` lists the roots of what
+//     the app-UI gate doesn't check (the Email kit), `outOfScopeNodes` how
+//     many nodes they hold
 //   neededMains(nodes, mains, options) -> componentIds still to fetch; call
 //     it until it returns [] (each round can reveal instances inside slot
 //     content).
 
-export const VERSION = "1.0.3";
+export const VERSION = "1.0.4";
 
 /** @typedef {{ nodeId: string, check: string, detail: string }} Finding */
 /**
@@ -118,13 +122,30 @@ const TEXT_STYLE_FIELDS = new Set([
 const STYLE_FIELD = /^(inherit)?(Fill|Stroke|Text|Effect|Grid)StyleId$/i;
 
 const SURFACE_NAME = /^Surface \//;
+// Email is out of the app-UI gate's scope (Dev issue 116): the Email kit's
+// twelve registered parts (DESIGN-SYSTEM-33), an email (a frame named Email
+// that places only those parts), and the template editor's block palette.
+const EMAIL_KIT =
+  /^Email ?\/ ?(Header|Alert strip|Heading|Amount block|Button|Link fallback|Divider|Key-value row|Security note|Code box|QR pay block|Footer)$/i;
+const EMAIL_FRAME = /^email\b/i;
+const BLOCK_PALETTE = /^(email )?blocks? (panel|palette)$/i;
+// A column of a table, grid or list; a page named "List Page" is no column.
+const TABLE_CONTAINER = /table|list|grid/i;
+const NOT_A_TABLE = /\blist page\b/i;
 const CUSTOMER_HEADER =
   /^(customer|client|contact|lead|applicant|candidate)s?( name)?$/i;
 const EXTERNAL_PLANE = /customer portal|partner room|external/i;
 // The viewer's own record (R5): the App Frame sidebar footer, the user menu
 // and the profile. Not any footer: a dialog or table footer can list others.
 const SELF_CONTAINER =
-  /sidebar ?footer|user button|user menu|account menu|profile/i;
+  /sidebar ?footer|user button|user menu|account menu|profile|\b(my|own) (account|tokens?|security|sessions?|settings|notification settings|records?)\b/i;
+// A frame the screen marks as the viewer's own: "[self]", "(self)", a
+// trailing "· self", or "(you)".
+const SELF_MARK = /\[self\]|\(self\)|·\s*self\s*$|\(you\)/i;
+// Where the screens show who the viewer is: the App Frame footer, the user
+// and account menus, and frames marked self or named my/own.
+const VIEWER_PLACE =
+  /sidebar ?footer|user button|user menu|account menu|\b(my|own) (profile|account|tokens?|security|sessions?|settings)\b/i;
 const SELF_TEXT = /\(you\)|^you$/i;
 const SIGNED_IN = /^(signed in( as\b.*)?|not you\?.*)$/i;
 // The signed-in account card (Account Context, kind=Account) shows the
@@ -143,6 +164,16 @@ const PHONE = /(?<![\w.+\-/])\+?\(?\d[\d ().-]{7,}\d(?![\w\-/])/g;
 const LOCAL_PHONE = /^(\(\d{3,5}\)[ .-]?|\d{3,5}[ .-])\d{3,5}([ .-]\d{2,5})?$/;
 const DATE = /^(\d{4}-\d{2}-\d{2}|\d{1,2}[-/.]\d{1,2}[-/.]\d{2,4})/;
 const ROLE_ANNOTATION = /\[role:([a-z0-9._-]+)\]/gi;
+// otherPersonRevealed is about people (Dev issue 116): a value is judged
+// by the field it fills. A tenant's business contact (support phone or
+// email, caller or sender id, business address) is not personal.
+const BUSINESS_FIELD =
+  /\b(support|help ?desk|helpline|hotline|toll[- ]free|caller id|sender( id)?|sending (address|domain|number)|from (address|email|number)|reply[- ]to|business|tenant)\b/i;
+// A person's field wins: "Support agent" is a person.
+const PERSON_FIELD =
+  /\b(user|member|customer|recipient|applicant|employee|candidate|assignee|owner|invitee|requester|reviewer|agent|engineer|staff|rep|manager|person|personal|your|my)\b/i;
+// A field's frame names its label: field/Caller ID, select/Sender ID.
+const FIELD_FRAME = /^(field|select|input|textarea|kv|detail|row) ?\/ ?(.+)$/i;
 
 /** "I12:34;56:78" -> ["12:34", "56:78"]; "12:34" -> ["12:34"]. */
 const segments = (id) => (id.startsWith("I") ? id.slice(1) : id).split(";");
@@ -325,6 +356,25 @@ function analyse(entry, mains, library = false) {
   };
   const componentLabel = (inst) =>
     setOf(inst)?.name ?? componentOf(inst)?.name ?? inst.name;
+  // What the app-UI gate leaves out: each root, outermost first (byId is in
+  // document order, so a parent is decided before its children).
+  /** @type {Map<string, string>} */
+  const scopeRoots = new Map();
+  /** @type {Map<string, "kit" | "other" | "none">} */
+  const placedMemo = new Map();
+  const out = new Set();
+  for (const n of byId.values()) {
+    const p = parent.get(n.id);
+    if (p && out.has(p.id)) {
+      out.add(n.id);
+      continue;
+    }
+    const why = outOfScopeRoot(n, parent, componentLabel, placedMemo);
+    if (why) {
+      out.add(n.id);
+      scopeRoots.set(n.id, why);
+    }
+  }
   return {
     root,
     components,
@@ -340,7 +390,54 @@ function analyse(entry, mains, library = false) {
     componentOf,
     setOf,
     componentLabel,
+    out,
+    scopeRoots,
+  };
+}
+
+const emailKitPart = (n, parent, componentLabel) =>
+  (n.type === "INSTANCE" && EMAIL_KIT.test(componentLabel(n) ?? "")) ||
+  ((n.type === "COMPONENT" || n.type === "COMPONENT_SET") &&
+    (EMAIL_KIT.test(n.name ?? "") ||
+      (n.type === "COMPONENT" &&
+        EMAIL_KIT.test(parent.get(n.id)?.name ?? ""))));
+/**
+ * Why a node and everything in it is outside the app-UI gate, or null: an
+ * Email kit part, an email made of them (a frame named Email whose only
+ * placed parts, at any depth, are the kit's), or the template editor's
+ * block palette.
+ */
+function outOfScopeRoot(n, parent, componentLabel, memo) {
+  if (emailKitPart(n, parent, componentLabel))
+    return `Email kit part ${n.type === "INSTANCE" ? componentLabel(n) : n.name}`;
+  if (n.type !== "FRAME" && n.type !== "GROUP" && n.type !== "SECTION")
+    return null;
+  if (BLOCK_PALETTE.test(n.name ?? "")) return `email block palette ${n.name}`;
+  // Every part placed in it, at any depth, is the kit's.
+  /** @returns {"kit" | "other" | "none"} */
+  const placed = (x) => {
+    const hit = memo.get(x.id);
+    if (hit) return hit;
+    let kind = /** @type {"kit" | "other" | "none"} */ ("none");
+    if (emailKitPart(x, parent, componentLabel)) kind = "kit";
+    else if (x.type === "INSTANCE") kind = "other";
+    else
+      for (const c of x.children ?? []) {
+        const k = placed(c);
+        if (k === "other") {
+          kind = "other";
+          break;
+        }
+        if (k === "kit") kind = "kit";
+      }
+    memo.set(x.id, kind);
+    return kind;
   };
+  // An email is named so; an editor's workspace around it, or an app screen
+  // holding a kit part, stays in scope.
+  return EMAIL_FRAME.test(n.name ?? "") && placed(n) === "kit"
+    ? `email ${n.name}`
+    : null;
 }
 
 /** Component ids whose mains the check still needs. */
@@ -350,7 +447,7 @@ export function neededMains(nodes, mains = {}, options = {}) {
     if (!entry?.document) continue;
     const a = analyse(entry, mains, Boolean(options.library));
     for (const n of a.byId.values()) {
-      if (n.type !== "INSTANCE" || !n.componentId) continue;
+      if (n.type !== "INSTANCE" || !n.componentId || a.out.has(n.id)) continue;
       if (Object.prototype.hasOwnProperty.call(mains, n.componentId)) continue;
       // The screen's own instances (for overrides and slot content), and
       // every table header cell (for its fill).
@@ -423,7 +520,8 @@ function textOf(n) {
  *   mains?: Record<string, NodesEntry | null>,
  *   options?: { library?: boolean, declaredRoles?: string[] } }} input
  * @returns {{ version: string, findings: Finding[], staleOverrides: Finding[],
- *   libraryUpdatePending: Finding[] }}
+ *   libraryUpdatePending: Finding[], outOfScope: Finding[],
+ *   outOfScopeNodes: number }}
  */
 export function checkConformance({
   nodes,
@@ -440,6 +538,9 @@ export function checkConformance({
   const staleOverrides = [];
   /** @type {Finding[]} */
   const libraryUpdatePending = [];
+  /** @type {Finding[]} */
+  const outOfScope = [];
+  const outNodes = new Set();
   const seen = new Set();
   const push = (list, nodeId, check, detail) => {
     const key = `${nodeId}|${check}|${detail}`;
@@ -454,12 +555,46 @@ export function checkConformance({
       labelRoles.set(label.trim().toLowerCase(), r);
   const librarySetNames = new Set();
   const usedRoles = new Set();
+  const analyses = Object.values(nodes ?? {})
+    .filter((entry) => entry?.document)
+    .map((entry) => analyse(entry, mains, library));
+  // The viewer (R5): the email and phone the screens show in the viewer's
+  // own places (the App Frame footer, a frame marked self). The same value
+  // anywhere else is still the viewer's own.
+  const viewer = new Set();
+  for (const a of analyses)
+    for (const n of a.byId.values()) {
+      if (n.type !== "TEXT" || a.out.has(n.id)) continue;
+      const ids = identifiers(textOf(n));
+      if (ids.length === 0) continue;
+      if (
+        a
+          .ancestors(n)
+          .some(
+            (x) =>
+              VIEWER_PLACE.test(x.name ?? "") || SELF_MARK.test(x.name ?? ""),
+          )
+      )
+        for (const id of ids) viewer.add(id);
+    }
 
-  for (const entry of Object.values(nodes ?? {})) {
-    if (!entry?.document) continue;
-    const a = analyse(entry, mains, library);
+  for (const a of analyses) {
     for (const set of Object.values(a.componentSets))
       if (set?.remote) librarySetNames.add(set.name);
+    for (const [nodeId, why] of a.scopeRoots) {
+      let count = 0;
+      for (const n of indexTree(a.byId.get(nodeId)).byId.values()) {
+        if (!outNodes.has(n.id)) count++;
+        outNodes.add(n.id);
+      }
+      if (count > 0)
+        push(
+          outOfScope,
+          nodeId,
+          "outOfScope",
+          `${why}: ${count} node${count === 1 ? "" : "s"} outside the app-UI gate (email, Dev issue 116)`,
+        );
+    }
     // Every (node, field) the screen overrode on an instance it placed.
     /** @type {Map<string, { fields: Set<string>, from: any }>} */
     const overrideFields = new Map();
@@ -481,12 +616,16 @@ export function checkConformance({
     // not; one equal to the main's value is a stale mark (DEC-0035).
     for (const [id, { fields, from }] of overrideFields) {
       const node = a.byId.get(id);
-      if (!node || !a.shown(node)) continue;
+      if (!node || !a.shown(node) || a.out.has(id)) continue;
       const base = baselineInstance(a, mains, from, node);
       if (!base) continue;
       const mainNode = a.mainNodeFor(base, id);
       if (!mainNode) continue;
       const mainStyles = mains[base.componentId]?.styles ?? {};
+      // Slot content a library part ships by default: its value there is
+      // the library's, not this file's (DEC-0047).
+      /** @type {ReturnType<typeof defaultSlotContent> | undefined} */
+      let slotDefault;
       const differ = [];
       const equal = [];
       for (const field of [...fields].sort()) {
@@ -494,7 +633,20 @@ export function checkConformance({
         if (exemptPaint(a, from, node, field)) continue;
         const mine = fieldValue(node, field, a.styles);
         const theirs = fieldValue(mainNode, field, mainStyles);
-        if (sameValue(mine, theirs)) equal.push(field);
+        if (sameValue(mine, theirs)) {
+          equal.push(field);
+          continue;
+        }
+        if (slotDefault === undefined)
+          slotDefault = defaultSlotContent(a, mains, node);
+        if (
+          slotDefault &&
+          sameValue(
+            mine,
+            fieldValue(slotDefault.node, field, slotDefault.styles),
+          )
+        )
+          equal.push(field);
         else
           differ.push(
             `${field} ${shortValue(mine)} (main ${shortValue(theirs)})`,
@@ -518,7 +670,7 @@ export function checkConformance({
     }
 
     for (const n of a.byId.values()) {
-      if (!a.shown(n)) continue;
+      if (!a.shown(n) || a.out.has(n.id)) continue;
       const own = !a.composed(n);
 
       if (n.type === "INSTANCE")
@@ -670,14 +822,17 @@ export function checkConformance({
         revealedByPermission(a, n)
       )
         continue;
-      for (const m of text.matchAll(EMAIL)) {
+      const business = businessField(a, n);
+      for (const m of business ? [] : text.matchAll(EMAIL)) {
         const local = m[0].split("@")[0] ?? "";
         if (MASKED.test(local) || ROLE_MAILBOX.test(local)) continue;
+        if (viewer.has(m[0].toLowerCase())) continue;
         push(findings, n.id, "otherPersonRevealed", `unmasked email ${m[0]}`);
       }
-      for (const m of text.matchAll(PHONE)) {
+      for (const m of business ? [] : text.matchAll(PHONE)) {
         const digits = m[0].replace(/\D/g, "");
-        if (DATE.test(m[0]) || MASKED.test(m[0])) continue;
+        if (DATE.test(m[0]) || MASKED.test(m[0]) || viewer.has(digits))
+          continue;
         const phoneShaped =
           m[0].startsWith("+") || LOCAL_PHONE.test(m[0].trim());
         if (phoneShaped && digits.length >= 10 && digits.length <= 15)
@@ -703,14 +858,19 @@ export function checkConformance({
       if (
         header.type !== "TEXT" ||
         !CUSTOMER_HEADER.test(textOf(header)) ||
-        !a.shown(header)
+        !a.shown(header) ||
+        a.out.has(header.id)
       )
         continue;
       // A column header sits in a table, list or grid; a "Customer" form
       // label does not head anything.
       const table = a
         .ancestors(header)
-        .find((x) => /table|list|grid/i.test(x.name ?? ""));
+        .find(
+          (x) =>
+            TABLE_CONTAINER.test(x.name ?? "") &&
+            !NOT_A_TABLE.test(x.name ?? ""),
+        );
       // The header's cell bounds its column, unless the parent is the whole
       // header row: then the header text's own box does.
       const cell = a.parent.get(header.id);
@@ -723,7 +883,13 @@ export function checkConformance({
           : header.absoluteBoundingBox;
       if (!table || !box) continue;
       for (const n of indexTree(table).byId.values()) {
-        if (n.type !== "TEXT" || n.id === header.id || !a.shown(n)) continue;
+        if (
+          n.type !== "TEXT" ||
+          n.id === header.id ||
+          !a.shown(n) ||
+          a.out.has(n.id)
+        )
+          continue;
         if (!screenText(a, n, overridden)) continue;
         const b = n.absoluteBoundingBox;
         const text = textOf(n);
@@ -760,7 +926,74 @@ export function checkConformance({
         `declared role ${role.role} has no ${role.componentName} instance`,
       );
   }
-  return { version: VERSION, findings, staleOverrides, libraryUpdatePending };
+  return {
+    version: VERSION,
+    findings,
+    staleOverrides,
+    libraryUpdatePending,
+    outOfScope,
+    outOfScopeNodes: outNodes.size,
+  };
+}
+
+/** The emails (lower-cased) and phone digits a text shows. */
+function identifiers(text) {
+  return [
+    ...[...text.matchAll(EMAIL)].map((m) => m[0].toLowerCase()),
+    ...[...text.matchAll(PHONE)].map((m) => m[0].replace(/\D/g, "")),
+  ];
+}
+
+/**
+ * The labels of the field a text fills: its field frame's name
+ * (field/Caller ID), a Field instance's label, and its own layer name.
+ */
+function fieldLabels(a, n) {
+  const labels = [];
+  if (n.name && n.name !== n.characters) labels.push(n.name);
+  for (const x of a.ancestors(n).slice(0, 4)) {
+    const m = FIELD_FRAME.exec(x.name ?? "");
+    if (m) labels.push(m[2]);
+    for (const [prop, v] of Object.entries(x.componentProperties ?? {}))
+      if (/^label\b/i.test(prop) && typeof v?.value === "string")
+        labels.push(v.value);
+  }
+  return labels;
+}
+/** A business contact field (support, caller id, sender, business address). */
+function businessField(a, n) {
+  const labels = fieldLabels(a, n);
+  return (
+    labels.some((l) => BUSINESS_FIELD.test(l)) &&
+    !labels.some((l) => PERSON_FIELD.test(l))
+  );
+}
+
+/**
+ * The node a library part's main draws, by default, where `node` sits in
+ * slot content: the nearest slot above it, in the instance that owns that
+ * slot, matched by the layer names from the slot down. Null when the node
+ * isn't in slot content, the owner's main can't be read, or its default
+ * content has no such layer.
+ */
+function defaultSlotContent(a, mains, node) {
+  const up = a.ancestors(node);
+  const slotAt = up.findIndex((x) => x.type === "SLOT");
+  if (slotAt === -1) return null;
+  const slot = up[slotAt];
+  const owner = up.slice(slotAt + 1).find((x) => x.type === "INSTANCE");
+  const tree = owner ? a.mainTree(owner.componentId) : null;
+  if (!owner || !tree) return null;
+  const main = mains[owner.componentId];
+  const names = [...up.slice(0, slotAt).reverse(), node].map((x) => x.name);
+  let level = [...tree.byId.values()].filter(
+    (x) => x.type === "SLOT" && x.name === slot.name,
+  );
+  for (const name of names)
+    level = level.flatMap((x) =>
+      (x.children ?? []).filter((c) => c.name === name),
+    );
+  return level[0] ? { node: level[0], styles: main.styles ?? {} } : null;
 }
 
 /**
@@ -865,7 +1098,12 @@ function handDrawnButton(n) {
 }
 function isSelf(a, n) {
   const up = a.ancestors(n);
-  if (up.some((x) => SELF_CONTAINER.test(x.name ?? ""))) return true;
+  if (
+    up.some(
+      (x) => SELF_CONTAINER.test(x.name ?? "") || SELF_MARK.test(x.name ?? ""),
+    )
+  )
+    return true;
   const accountCard = (x) => {
     const set =
       x.type === "INSTANCE"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodii/dev",
-  "version": "0.6.16",
+  "version": "0.6.20",
   "description": "Agent CLI for Nodii Dev, reached through the platform edge",
   "type": "module",
   "bin": {