cascivo 0.5.1 → 0.5.2

package/dist/{drift-Ciw5qeEt.mjs → drift-qTzJ75Ds.mjs}

@@ -1,5 +1,6 @@
 import { t as readFileSafe } from "./fs-m7ZvuBBm.mjs";
-import { i as sha256, l as findComponent, r as readLock, s as fetchRegistry, t as checkPeerVersions } from "./peer-versions-B2bCgko-.mjs";
+import { c as findComponent, n as readLock, o as fetchRegistry, r as sha256 } from "./lock-CW8UuEPJ.mjs";
+import { t as checkPeerVersions } from "./peer-versions-Cep8Brn3.mjs";
 //#region src/commands/drift.ts
 /**
 * `cascivo doctor --drift` — compares installed components against the
@@ -53,4 +54,4 @@ async function runDoctorDrift(config, cwd = process.cwd()) {
 //#endregion
 export { runDoctorDrift };
 
-//# sourceMappingURL=drift-Ciw5qeEt.mjs.map
+//# sourceMappingURL=drift-qTzJ75Ds.mjs.map

package/dist/{drift-Ciw5qeEt.mjs.map → drift-qTzJ75Ds.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"drift-Ciw5qeEt.mjs","names":[],"sources":["../src/commands/drift.ts"],"sourcesContent":["import type { CascadeConfig } from '../utils/config.js'\nimport { readFileSafe } from '../utils/fs.js'\nimport { readLock, sha256 } from '../utils/lock.js'\nimport { checkPeerVersions } from '../utils/peer-versions.js'\nimport { fetchRegistry, findComponent } from '../utils/registry.js'\n\n/**\n * `cascivo doctor --drift` — compares installed components against the\n * registry. Two drift classes:\n *\n *  1. Local-edit drift: an installed file's content no longer matches what\n *     was copied at install time (hand edits, or deleted after install).\n *  2. Peer-version drift: the currently-registered component source needs a\n *     newer `@cascivo/*` peer package (per `peerVersions`) than what's\n *     actually installed in node_modules — the dashboard-feedback failure\n *     mode (DataTable referencing an i18n builtin key an older published\n *     @cascivo/i18n build doesn't have).\n */\nexport async function runDoctorDrift(\n  config: CascadeConfig,\n  cwd: string = process.cwd(),\n): Promise<void> {\n  const lock = await readLock(cwd)\n  if (!lock || Object.keys(lock.items).length === 0) {\n    console.log('No installed components found in cascivo.lock.')\n    return\n  }\n\n  const registry = await fetchRegistry(config.registry)\n  let driftCount = 0\n\n  for (const [name, entry] of Object.entries(lock.items)) {\n    const current = findComponent(registry, name)\n    if (!current) continue\n\n    for (const [path, lockedHash] of Object.entries(entry.files)) {\n      const content = await readFileSafe(path)\n      if (content === null) {\n        console.log(`${name}: ${path} is missing (installed, then deleted)`)\n        driftCount++\n        continue\n      }\n      if (sha256(content) !== lockedHash) {\n        console.log(`${name}: ${path} has local edits (differs from the version installed)`)\n        driftCount++\n      }\n    }\n\n    if (current.peerVersions) {\n      const violations = await checkPeerVersions(cwd, current.peerVersions)\n      for (const v of violations) {\n        const installedDesc = v.installed ? `${v.installed} is installed` : 'it is not installed'\n        console.log(`${name}: needs ${v.pkg} ${v.required}, but ${installedDesc}.`)\n        driftCount++\n      }\n    }\n  }\n\n  if (driftCount > 0) {\n    console.log(`\\n${driftCount} drift issue(s) found.`)\n    process.exitCode = 1\n  } else {\n    console.log('No drift detected — installed components match the registry.')\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAkBA,eAAsB,eACpB,QACA,MAAc,QAAQ,IAAI,GACX;CACf,MAAM,OAAO,MAAM,SAAS,GAAG;CAC/B,IAAI,CAAC,QAAQ,OAAO,KAAK,KAAK,KAAK,CAAC,CAAC,WAAW,GAAG;EACjD,QAAQ,IAAI,gDAAgD;EAC5D;CACF;CAEA,MAAM,WAAW,MAAM,cAAc,OAAO,QAAQ;CACpD,IAAI,aAAa;CAEjB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,KAAK,GAAG;EACtD,MAAM,UAAU,cAAc,UAAU,IAAI;EAC5C,IAAI,CAAC,SAAS;EAEd,KAAK,MAAM,CAAC,MAAM,eAAe,OAAO,QAAQ,MAAM,KAAK,GAAG;GAC5D,MAAM,UAAU,MAAM,aAAa,IAAI;GACvC,IAAI,YAAY,MAAM;IACpB,QAAQ,IAAI,GAAG,KAAK,IAAI,KAAK,sCAAsC;IACnE;IACA;GACF;GACA,IAAI,OAAO,OAAO,MAAM,YAAY;IAClC,QAAQ,IAAI,GAAG,KAAK,IAAI,KAAK,sDAAsD;IACnF;GACF;EACF;EAEA,IAAI,QAAQ,cAAc;GACxB,MAAM,aAAa,MAAM,kBAAkB,KAAK,QAAQ,YAAY;GACpE,KAAK,MAAM,KAAK,YAAY;IAC1B,MAAM,gBAAgB,EAAE,YAAY,GAAG,EAAE,UAAU,iBAAiB;IACpE,QAAQ,IAAI,GAAG,KAAK,UAAU,EAAE,IAAI,GAAG,EAAE,SAAS,QAAQ,cAAc,EAAE;IAC1E;GACF;EACF;CACF;CAEA,IAAI,aAAa,GAAG;EAClB,QAAQ,IAAI,KAAK,WAAW,uBAAuB;EACnD,QAAQ,WAAW;CACrB,OACE,QAAQ,IAAI,8DAA8D;AAE9E"}
+{"version":3,"file":"drift-qTzJ75Ds.mjs","names":[],"sources":["../src/commands/drift.ts"],"sourcesContent":["import type { CascadeConfig } from '../utils/config.js'\nimport { readFileSafe } from '../utils/fs.js'\nimport { readLock, sha256 } from '../utils/lock.js'\nimport { checkPeerVersions } from '../utils/peer-versions.js'\nimport { fetchRegistry, findComponent } from '../utils/registry.js'\n\n/**\n * `cascivo doctor --drift` — compares installed components against the\n * registry. Two drift classes:\n *\n *  1. Local-edit drift: an installed file's content no longer matches what\n *     was copied at install time (hand edits, or deleted after install).\n *  2. Peer-version drift: the currently-registered component source needs a\n *     newer `@cascivo/*` peer package (per `peerVersions`) than what's\n *     actually installed in node_modules — the dashboard-feedback failure\n *     mode (DataTable referencing an i18n builtin key an older published\n *     @cascivo/i18n build doesn't have).\n */\nexport async function runDoctorDrift(\n  config: CascadeConfig,\n  cwd: string = process.cwd(),\n): Promise<void> {\n  const lock = await readLock(cwd)\n  if (!lock || Object.keys(lock.items).length === 0) {\n    console.log('No installed components found in cascivo.lock.')\n    return\n  }\n\n  const registry = await fetchRegistry(config.registry)\n  let driftCount = 0\n\n  for (const [name, entry] of Object.entries(lock.items)) {\n    const current = findComponent(registry, name)\n    if (!current) continue\n\n    for (const [path, lockedHash] of Object.entries(entry.files)) {\n      const content = await readFileSafe(path)\n      if (content === null) {\n        console.log(`${name}: ${path} is missing (installed, then deleted)`)\n        driftCount++\n        continue\n      }\n      if (sha256(content) !== lockedHash) {\n        console.log(`${name}: ${path} has local edits (differs from the version installed)`)\n        driftCount++\n      }\n    }\n\n    if (current.peerVersions) {\n      const violations = await checkPeerVersions(cwd, current.peerVersions)\n      for (const v of violations) {\n        const installedDesc = v.installed ? `${v.installed} is installed` : 'it is not installed'\n        console.log(`${name}: needs ${v.pkg} ${v.required}, but ${installedDesc}.`)\n        driftCount++\n      }\n    }\n  }\n\n  if (driftCount > 0) {\n    console.log(`\\n${driftCount} drift issue(s) found.`)\n    process.exitCode = 1\n  } else {\n    console.log('No drift detected — installed components match the registry.')\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAkBA,eAAsB,eACpB,QACA,MAAc,QAAQ,IAAI,GACX;CACf,MAAM,OAAO,MAAM,SAAS,GAAG;CAC/B,IAAI,CAAC,QAAQ,OAAO,KAAK,KAAK,KAAK,CAAC,CAAC,WAAW,GAAG;EACjD,QAAQ,IAAI,gDAAgD;EAC5D;CACF;CAEA,MAAM,WAAW,MAAM,cAAc,OAAO,QAAQ;CACpD,IAAI,aAAa;CAEjB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,KAAK,GAAG;EACtD,MAAM,UAAU,cAAc,UAAU,IAAI;EAC5C,IAAI,CAAC,SAAS;EAEd,KAAK,MAAM,CAAC,MAAM,eAAe,OAAO,QAAQ,MAAM,KAAK,GAAG;GAC5D,MAAM,UAAU,MAAM,aAAa,IAAI;GACvC,IAAI,YAAY,MAAM;IACpB,QAAQ,IAAI,GAAG,KAAK,IAAI,KAAK,sCAAsC;IACnE;IACA;GACF;GACA,IAAI,OAAO,OAAO,MAAM,YAAY;IAClC,QAAQ,IAAI,GAAG,KAAK,IAAI,KAAK,sDAAsD;IACnF;GACF;EACF;EAEA,IAAI,QAAQ,cAAc;GACxB,MAAM,aAAa,MAAM,kBAAkB,KAAK,QAAQ,YAAY;GACpE,KAAK,MAAM,KAAK,YAAY;IAC1B,MAAM,gBAAgB,EAAE,YAAY,GAAG,EAAE,UAAU,iBAAiB;IACpE,QAAQ,IAAI,GAAG,KAAK,UAAU,EAAE,IAAI,GAAG,EAAE,SAAS,QAAQ,cAAc,EAAE;IAC1E;GACF;EACF;CACF;CAEA,IAAI,aAAa,GAAG;EAClB,QAAQ,IAAI,KAAK,WAAW,uBAAuB;EACnD,QAAQ,WAAW;CACrB,OACE,QAAQ,IAAI,8DAA8D;AAE9E"}

package/dist/index.mjs

@@ -2,7 +2,8 @@
 import { a as detectPackageManager, c as isPackageManager, l as loadConfig, n as DEFAULT_CONFIG$1, o as installCommand, r as THEMES, s as installHint, t as CASCIVO_HOST, u as __exportAll } from "./config-C6GdrbvF.mjs";
 import { n as resolveOutputPath, r as writeFileSafe, t as readFileSafe } from "./fs-m7ZvuBBm.mjs";
 import { r as fetchTextRetry, t as fetchJson } from "./http-CJZ5W0Fa.mjs";
-import { a as updateLockEntry, c as fileName, i as sha256, l as findComponent, n as createLock, o as writeLock, r as readLock, s as fetchRegistry, t as checkPeerVersions } from "./peer-versions-B2bCgko-.mjs";
+import { a as writeLock, c as findComponent, i as updateLockEntry, n as readLock, o as fetchRegistry, r as sha256, s as fileName, t as createLock } from "./lock-CW8UuEPJ.mjs";
+import { n as readInstalledPackageVersion, r as compareVersions, t as checkPeerVersions } from "./peer-versions-Cep8Brn3.mjs";
 import { createRequire } from "node:module";
 import { argv, stdin, stdout } from "node:process";
 import { pathToFileURL } from "node:url";
@@ -956,6 +957,8 @@ async function create(args, cwd = process.cwd()) {
 //#region src/commands/doctor.ts
 var doctor_exports = /* @__PURE__ */ __exportAll({
 	checkProjectDependencies: () => checkProjectDependencies,
+	checkSignalsCompat: () => checkSignalsCompat,
+	checkSsrConfig: () => checkSsrConfig,
 	isAdopterProject: () => isAdopterProject,
 	runDoctor: () => runDoctor,
 	stripCommentsAndStrings: () => stripCommentsAndStrings
@@ -1011,6 +1014,85 @@ function checkProjectDependencies(cwd) {
 	});
 	return findings;
 }
+/**
+* Checks the installed `@preact/signals-react` against the installed React.
+* React 19 removed the `__SECRET_INTERNALS…` export that signals-react 2.x
+* imports, so a 2.x runtime on React 19 dies with a `SyntaxError` at module
+* evaluation (the 2026-07-20 report's blocker #2). cascivo peer-depends on
+* `>=3.0.0`, but a lockfile carried over from an earlier install can still pin
+* 2.x — this turns that into a diagnosed condition with a fix. Returns null when
+* either package is absent/unreadable (nothing reliable to advise on) or the
+* pairing is fine.
+*/
+async function checkSignalsCompat(cwd) {
+	const [signals, react] = await Promise.all([readInstalledPackageVersion(cwd, "@preact/signals-react"), readInstalledPackageVersion(cwd, "react")]);
+	if (signals === null) return null;
+	let signalsBelow3;
+	try {
+		signalsBelow3 = compareVersions(signals, "3.0.0") < 0;
+	} catch {
+		return null;
+	}
+	if (!signalsBelow3) return null;
+	const hint = installHint(detectPackageManager(cwd), ["@preact/signals-react@^3"]);
+	let reactMajor = null;
+	if (react !== null) {
+		const m = /^(\d+)\./.exec(react.trim());
+		reactMajor = m ? Number(m[1]) : null;
+	}
+	if (reactMajor !== null && reactMajor >= 19) return {
+		severity: "error",
+		detail: `@preact/signals-react ${signals} cannot run on React ${react} — React 19 removed an internal signals 2.x imports, so it fails at module load. Upgrade to signals-react 3.x.`,
+		hint
+	};
+	return {
+		severity: "warning",
+		detail: `@preact/signals-react ${signals} is below the required 3.x floor. It works on React 18 today but breaks the moment you move to React 19; upgrade now.`,
+		hint
+	};
+}
+/** Vite SSR frameworks whose default setup needs `ssr.noExternal` for cascivo. */
+const VITE_SSR_MARKERS = [
+	"@tanstack/react-start",
+	"vite-ssr",
+	"@remix-run/dev"
+];
+const VITE_CONFIG_FILES = [
+	"vite.config.ts",
+	"vite.config.js",
+	"vite.config.mjs",
+	"vite.config.mts"
+];
+/**
+* Advisory: on a Vite SSR framework, cascivo's per-component `.css` side-effect
+* imports crash a bare server-side ESM loader unless the packages are marked
+* `ssr.noExternal` (or the `cascivoSsr()` plugin is used). This warns when a known
+* Vite SSR framework is present but no vite config mentions either — the exact
+* cliff the 2026-07-20 report hit (blocker #1). A text match, not a gate. Returns
+* null when there's no Vite SSR framework or the config already handles it.
+*/
+function checkSsrConfig(cwd) {
+	let deps = {};
+	try {
+		const pkg = JSON.parse(readFileSync(join(cwd, "package.json"), "utf8"));
+		deps = {
+			...pkg.dependencies,
+			...pkg.devDependencies
+		};
+	} catch {
+		return null;
+	}
+	const framework = VITE_SSR_MARKERS.find((m) => deps[m] !== void 0);
+	if (framework === void 0) return null;
+	for (const file of VITE_CONFIG_FILES) {
+		const path = join(cwd, file);
+		if (!existsSync(path)) continue;
+		const config = readFileSync(path, "utf8");
+		if (/noExternal/.test(config) && /@cascivo/.test(config)) return null;
+		if (/cascivoSsr/.test(config)) return null;
+	}
+	return `${framework} is a Vite SSR framework, but no vite config marks the cascivo packages ssr.noExternal — an unconfigured SSR build crashes with \`Unknown file extension ".css"\`. Add \`ssr: { noExternal: [/^@cascivo\\//] }\` (or the cascivoSsr() plugin from @cascivo/vite-plugin). Recipe: https://cascivo.com/docs/using-with-vite-ssr.md`;
+}
 const BANNED_HOOKS = [
 	"useState",
 	"useEffect",
@@ -2436,20 +2518,26 @@ async function run(args) {
 		case "doctor": {
 			const ci = rest.includes("--ci");
 			if (rest.includes("--drift")) {
-				const { runDoctorDrift } = await import("./drift-Ciw5qeEt.mjs");
+				const { runDoctorDrift } = await import("./drift-qTzJ75Ds.mjs");
 				await runDoctorDrift(await loadConfig());
 			} else {
 				const cwd = process.cwd();
 				const result = await runDoctor(cwd);
-				const { checkProjectDependencies, isAdopterProject } = await Promise.resolve().then(() => doctor_exports);
-				const deps = isAdopterProject(cwd) ? checkProjectDependencies(cwd) : [];
+				const { checkProjectDependencies, checkSignalsCompat, checkSsrConfig, isAdopterProject } = await Promise.resolve().then(() => doctor_exports);
+				const adopter = isAdopterProject(cwd);
+				const deps = adopter ? checkProjectDependencies(cwd) : [];
 				const missingRequired = deps.filter((d) => d.required);
-				if (result.passed && deps.length === 0) console.log("No violations found.");
+				const signalsCompat = adopter ? await checkSignalsCompat(cwd) : null;
+				const signalsError = signalsCompat?.severity === "error";
+				const ssrHint = adopter ? checkSsrConfig(cwd) : null;
+				if (result.passed && deps.length === 0 && signalsCompat === null && ssrHint === null) console.log("No violations found.");
 				else {
 					for (const v of result.violations) console.error(`[${v.rule}] ${v.detail}\n  ${v.file}`);
 					for (const d of missingRequired) console.error(`[missing-dependency] ${d.package} is not in package.json — copied cascivo source needs it. Install: ${d.hint}`);
+					if (signalsCompat) (signalsError ? console.error : console.log)(`[${signalsError ? "signals-incompatible" : "signals-outdated"}] ${signalsCompat.detail} Upgrade: ${signalsCompat.hint}`);
+					if (ssrHint) console.log(`[ssr-config] ${ssrHint}`);
 					for (const d of deps.filter((x) => !x.required)) console.log(`[optional] ${d.package} is not installed; add it when a component or chart needs it: ${d.hint}`);
-					if (ci && (result.violations.length > 0 || missingRequired.length > 0)) process.exitCode = 1;
+					if (ci && (result.violations.length > 0 || missingRequired.length > 0 || signalsError)) process.exitCode = 1;
 				}
 			}
 			break;