@tristan2828/ui-foundation 4.24.0 → 4.25.0

package/conventions/AGENTS.md

@@ -6,7 +6,11 @@ React Router v7, TanStack Query. The shared layer — primitives, the
 `DataTable`/`EntityView`/`EntityForm` composites, the app shell, auth,
 the gateway error seam, design tokens, lint rules — is the npm package
 `@tristan2828/ui-foundation`, updated by bumping its version. Everything in
-`src/` is this app's own.
+`src/` is this app's own. The backend's auth and security layer (sign-in,
+sessions, limits, TOTP, error reporting, deploy checks) is the pip package
+`ui-foundation-backend` (`foundation_backend`), pinned in
+`backend/pyproject.toml` to the same version; never copy one of its
+modules into `backend/app/`.
 
 Contract-first: `openapi.yaml` is the source of truth and is owned by this
 app. In development MSW serves the contract, so there may be no backend at

package/conventions/docs/add-an-entity.md

@@ -605,10 +605,11 @@ asyncio is a `MissingGreenlet` and a 500.
 - **After a commit, read by a `user_id` saved before it, never by the
   `User`.** Take `user_id = user.id` at the top of the handler and use that
   from then on; or `await session.refresh(user)` first, as `_start_session`
-  in `routers/auth.py` does to return it.
+  in `foundation_backend/routers/auth.py` does to return it.
 - **Test signed in for real.** The backend's `client` fixture
   (`tests/conftest.py`) holds a `sessions` row and sends its cookie,
-  so the real `get_current_user` runs (`tests/signed_in.py`). Never stand
+  so the real `get_current_user` runs (`session_cookie` from
+  `foundation_backend.testing.signed_in`). Never stand
   a `User(...)` in for `get_current_user` in an override: a detached user
   never expires, so the test passes and the route fails live.
 

package/dist/api/gateway/auth.js

@@ -28,7 +28,8 @@ export async function loginTotp(input) {
     return { user: res.body };
 }
 // Auto-logs in on success — the backend sets the same session cookie
-// /auth/login does (see backend/app/routers/auth.py's _start_session), so
+// /auth/login does (see _start_session in the backend package's
+// foundation_backend/routers/auth.py), so
 // the gateway shape is identical to login's: a User on 200, AppError
 // otherwise (a duplicate email arrives as kind:'validation' with
 // fieldErrors.email, same as any other field error).

package/dist/error-reporting/reporter.js

@@ -10,8 +10,8 @@ export function resolveErrorReporting(option) {
     return option === true ? {} : option;
 }
 // A query string or fragment in a URL or path, up to a stack frame's
-// trailing :line:col (the backend's scrub, in app/error_reporting.py, is
-// the same rule).
+// trailing :line:col (the backend's scrub, in
+// foundation_backend/error_reporting.py, is the same rule).
 const URL_QUERY = /(\b[a-z][a-z0-9+.-]*:\/\/[^\s?#"'()]+|(?<![\w/])\/[^\s?#"'()]*)[?#][^\s"'()]*?(?=(?::\d+){1,2}(?=[\s"'()]|$)|[\s"'()]|$)/gi;
 export function scrub(text, limit) {
     const cut = text.replace(URL_QUERY, "$1");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tristan2828/ui-foundation",
-  "version": "4.24.0",
+  "version": "4.25.0",
   "description": "Shared UI foundation for contract-first, database-backed React apps: shadcn primitives, DataTable/EntityForm composites, auth, the gateway error seam, design tokens, lint rules and the AI playbook.",
   "license": "MIT",
   "repository": {