cursedbelt 5.75.0 → 5.76.0

package/dist/scripts/guardrailsEnforce.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guardrailsEnforce.d.ts","sourceRoot":"","sources":["../../scripts/guardrailsEnforce.ts"],"names":[],"mappings":";AAuPA,UAAU,SAAS;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB;;;sEAGkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,IAAI;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;CACzD;AAED,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,EAAO,GAAG,MAAM,EAAE,CA6B9D;AAgwCD,iGAAiG;AACjG,wBAAgB,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAE3D;AAoHD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAIpE;AAw0BD,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,GAAG,IAAI,CAEpF;AAID,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,CAoBhE;AAyKD,kGAAkG;AAClG,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAatE;AAqDD,UAAU,MAAM;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACb;AA0BD,+FAA+F;AAC/F,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAgBpD;AAID,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO5E;AA0FD,eAAO,MAAM,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAgCtC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAiE,CAAC;AAEtH,0EAA0E;AAC1E,eAAO,MAAM,SAAS,EAAE,SAAS,MAAM,EAAwE,CAAC;AAShH,eAAO,MAAM,uBAAuB,aAAkD,CAAC;AAGvF,MAAM,WAAW,SAAS;IACzB,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACb;AAED;2FAC2F;AAC3F,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CA+C3F;AAED,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAmGhC,wBAAgB,0BAA0B,CAAC,SAAS,GAAE,MAAwB,GAAG,MAAM,EAAE,CAyBxF"}
+{"version":3,"file":"guardrailsEnforce.d.ts","sourceRoot":"","sources":["../../scripts/guardrailsEnforce.ts"],"names":[],"mappings":";AA6PA,UAAU,SAAS;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB;;;sEAGkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,IAAI;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;CACzD;AAED,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,EAAO,GAAG,MAAM,EAAE,CA6B9D;AAgwCD,iGAAiG;AACjG,wBAAgB,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAE3D;AAoHD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAIpE;AAg4BD,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,GAAG,IAAI,CAEpF;AAID,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,CAoBhE;AAyKD,kGAAkG;AAClG,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAatE;AAqDD,UAAU,MAAM;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACb;AA0BD,+FAA+F;AAC/F,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAgBpD;AAID,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO5E;AA0FD,eAAO,MAAM,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAiCtC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAiE,CAAC;AAEtH,0EAA0E;AAC1E,eAAO,MAAM,SAAS,EAAE,SAAS,MAAM,EAAwE,CAAC;AAShH,eAAO,MAAM,uBAAuB,aAAkD,CAAC;AAGvF,MAAM,WAAW,SAAS;IACzB,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACb;AAED;2FAC2F;AAC3F,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CA+C3F;AAED,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAmGhC,wBAAgB,0BAA0B,CAAC,SAAS,GAAE,MAAwB,GAAG,MAAM,EAAE,CAyBxF"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt",
-	"version": "5.75.0",
+	"version": "5.76.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The React design system of the cursedbelt split — components, styles, theme. cursedbelt-core below it; server tier in cursedbelt-server.",

package/scripts/guardrailsEnforce.spec.ts

@@ -1066,6 +1066,53 @@ describe('no-native-select — the OS draws its list (owner, 2026-10-10)', () =>
   });
 });
 
+describe('typed-field-outside-a-form — Enter submits (owner, 2026-10-11; forge task 3043)', () => {
+  // vault's Settings before 3043: a password beside a click-only button, no <form> anywhere.
+  const clickOnly = `<SecretInput value={pw} onChange={setPw} label="Master password" />
+    <Input value={hint} onChange={(e) => setHint(e.target.value)} />
+    <Button disabled={!pw} onClick={onSave}>Save</Button>`;
+
+  test('flags each typed field in a file where nothing handles Enter', () => {
+    expect(check('typed-field-outside-a-form', clickOnly)).toHaveLength(2);
+    expect(check('typed-field-outside-a-form', `<input value={v} onChange={set} />\n<OtpInput length={6} />`)).toHaveLength(2);
+  });
+
+  test('a form, a submit or Enter handler, a self-submitting code or an autosave answers it', () => {
+    for (const handled of [
+      `<form className="contents" onSubmit={submit}>${clickOnly}</form>`,
+      `${clickOnly}\n<Wizard onSubmit={finish} />`,
+      `<SecretInput value={pw} onEnter={unlock} />`,
+      `<OtpInput length={6} onComplete={verify} />`,
+      `<Input onKeyDown={(e) => { if (e.key === "Enter") save(); }} />`,
+      `const autosave = useAutosave<Draft>({ save });\n<Input value={title} />`,
+    ]) {
+      expect(check('typed-field-outside-a-form', handled)).toHaveLength(0);
+    }
+  });
+
+  test('a field with nothing to submit is not one, and a comment naming one is not one', () => {
+    expect(check('typed-field-outside-a-form', `<Input type="search" value={q} onChange={setQ} />`)).toHaveLength(0);
+    expect(check('typed-field-outside-a-form', `<input type="checkbox" checked={on} />\n<input type={"range"} />`)).toHaveLength(0);
+    expect(check('typed-field-outside-a-form', `<Input value={url} readOnly />`)).toHaveLength(0);
+    expect(check('typed-field-outside-a-form', `// a <Input> used to sit here\n<Button onClick={go}>Go</Button>`)).toHaveLength(0);
+    // `readOnly={false}` is an editable field.
+    expect(check('typed-field-outside-a-form', `<Input value={v} readOnly={false} />`)).toHaveLength(1);
+  });
+
+  test('a field whose form is in its parent says so', () => {
+    const source = `{/* guardrails-ignore typed-field-outside-a-form: rendered inside AccountForm's <form> */}
+    <SecretInput value={pw} onChange={setPw} />`;
+    expect(check('typed-field-outside-a-form', source)).toHaveLength(0);
+  });
+
+  test('specs and the kit\'s own components are fixtures, not screens', () => {
+    expect(RULES['typed-field-outside-a-form'].check('src/App.spec.tsx', clickOnly)).toHaveLength(0);
+    expect(RULES['typed-field-outside-a-form'].check('libs/cursedbelt/src/react/components/SecretInput.tsx', clickOnly)).toHaveLength(0);
+    expect(RULES['typed-field-outside-a-form'].check('src/server/page.ts', clickOnly)).toHaveLength(0);
+    expect(APP_RULES).toContain('typed-field-outside-a-form');
+  });
+});
+
 describe('no-native-dialog', () => {
   test('flags each of the three native dialogs', () => {
     expect(check('no-native-dialog', `if (!window.confirm("sure?")) return;`)).toHaveLength(1);
@@ -1292,6 +1339,8 @@ describe('--all-app-rules (task 2219: a new belt rule reaches every app by itsel
     const rows: Record<string, number> = Object.fromEntries(APP_RULES.map((name) => [name, 0]));
     rows['no-hardcoded-colors'] = 2;
     rows['no-raw-inputs'] = 1;
+    // The same <input>, with no form in its file: Enter has nothing to submit (forge task 3043).
+    rows['typed-field-outside-a-form'] = 1;
     for (const [name, count] of Object.entries(overrides)) {
       if (count === undefined) delete rows[name];
       else rows[name] = count;

package/scripts/guardrailsEnforce.ts

@@ -118,6 +118,12 @@
 //     `PropertyPicker` / `ChoiceMenu` instead; a use where the OS picker is genuinely better says
 //     why with `// guardrails-ignore no-native-select: <why>` on the line above. Ratcheted per app.
 //
+//   typed-field-outside-a-form — owner, 2026-10-11: Enter submits. A typed field in a file with no
+//     `<form` / `onSubmit` / `onEnter` / `onComplete` / `"Enter"` handler is a field beside a
+//     click-only button. Search, checkbox-like and read-only inputs are not matched; a field whose
+//     form is in its parent says so with `// guardrails-ignore typed-field-outside-a-form: <why>`.
+//     Ratcheted per app.
+//
 //   no-native-dialog — DESIGN.md core mandate: no `window.confirm` / `window.prompt` /
 //     `window.alert`. The browser draws them outside the page, so no stylesheet reaches
 //     them; they block the main thread; a browser can SUPPRESS a repeat dialog, after
@@ -2062,6 +2068,62 @@ const noNativeSelect: Rule = {
 	},
 };
 
+// ── typed-field-outside-a-form ──────────────────────────────────────────────
+// The owner, 2026-10-11, on auth's emailed code: *"I entered an email code and pressed enter key
+// and nothing happened … Make sure other pages like the email password form let's hitting enter
+// submit it too as applicable."* Auth was fixed in auth e958057 and vault's Settings in forge task
+// 3043 — both the same shape: a typed field beside a click-only button, with no `<form>`, so Enter
+// (the browser's implicit submission) had nothing to submit.
+//
+// A file with a typed field — `<input>`, `<Input`, `<SecretInput`, `<OtpInput` — must handle Enter
+// SOMEWHERE: a `<form`, an `onSubmit=`, an `onEnter=`, an `onComplete=` (OtpInput submits itself
+// at its last digit), a key handler naming `"Enter"`, or a `useAutosave(` — an editor that saves
+// as you type has nothing to submit (vault's EntryEditor, forge task 3016.5). It is FILE-scoped on purpose: a field
+// whose form is in its parent file cannot be seen from here, so it would take an opt-out, and the
+// rule has to be quiet enough that an opt-out means something. Fields with nothing to submit are
+// not matched — `type="search"` (a live filter), a checkbox/radio/range/color/file/hidden input,
+// and a `readOnly` one. A field genuinely without an action says why on the line above:
+// `// guardrails-ignore typed-field-outside-a-form: <why>`. Ratcheted per app.
+const TYPED_FIELD_RE = /<(?:input|Input|SecretInput|OtpInput)\b/g;
+const ENTER_HANDLED_RE = /<form\b|\bonSubmit\s*=|\bonEnter\s*=|\bonComplete\s*=|["'`]Enter["'`]|\buseAutosave\s*(?:<[^>]*>\s*)?\(/;
+const NOTHING_TO_SUBMIT_RE =
+	/\btype\s*=\s*(?:\{\s*)?["'`](?:search|checkbox|radio|range|color|file|hidden|button|submit|reset|image)["'`]|\breadOnly\b(?!\s*=\s*\{\s*false\s*\})/;
+const TYPED_FIELD_IGNORE_RE = /guardrails-ignore\s+typed-field-outside-a-form\s*:/;
+
+/** The attribute text of the JSX tag opening at `start` — up to its `>`, skipping `{…}` expressions. */
+function tagText(source: string, start: number): string {
+	let depth = 0;
+	for (let i = start + 1; i < source.length && i < start + 2000; i++) {
+		const c = source[i];
+		if (c === "{") depth++;
+		else if (c === "}") depth--;
+		else if (c === ">" && depth === 0) return source.slice(start, i + 1);
+	}
+	return source.slice(start, start + 2000);
+}
+
+const typedFieldOutsideAForm: Rule = {
+	name: "typed-field-outside-a-form",
+	description:
+		"Owner, 2026-10-11: Enter must submit. A typed field (`<input>`, `Input`, `SecretInput`, `OtpInput`) in a file with no `<form`, `onSubmit`, `onEnter`, `onComplete` or `\"Enter\"` key handler is a field beside a click-only button, where Enter does nothing. Wrap the field and its button in `<form onSubmit>` (`className=\"contents\"` keeps a flex/grid parent's layout) and make the button `type=\"submit\"`. A field whose form is in its parent, or that truly has no action, says why on the line above: `// guardrails-ignore typed-field-outside-a-form: <why>`.",
+	check(filePath, source) {
+		const unix = filePath.replace(/\\/g, "/");
+		if (/(^|\/)(?:packages|libs)\/cursedbelt\/src\/react\/components\//.test(unix)) return [];
+		if (isTestSource(unix) || !/\.[jt]sx$/.test(unix)) return [];
+		const scannable = blankComments(source);
+		if (ENTER_HANDLED_RE.test(scannable)) return [];
+		const lines = source.split("\n");
+		const out: Violation[] = [];
+		for (const match of scannable.matchAll(TYPED_FIELD_RE)) {
+			if (NOTHING_TO_SUBMIT_RE.test(tagText(scannable, match.index ?? 0))) continue;
+			const line = lineOf(source, match.index ?? 0);
+			if (TYPED_FIELD_IGNORE_RE.test(lines[line - 1] ?? "") || TYPED_FIELD_IGNORE_RE.test(blockAbove(lines, line))) continue;
+			out.push({ file: filePath, line, snippet: lines[line - 1]?.trim() ?? "" });
+		}
+		return out;
+	},
+};
+
 // ── no-native-dialog ────────────────────────────────────────────────────────
 // `window.confirm` / `window.prompt` / `window.alert` — and their bare global
 // forms — are the browser's own chrome, and cursedbelt has shipped styled,
@@ -2966,6 +3028,7 @@ export const RULES: Record<string, Rule> = {
 	[noSelectAsActionMenu.name]: noSelectAsActionMenu,
 	[noNativeDialog.name]: noNativeDialog,
 	[noNativeSelect.name]: noNativeSelect,
+	[typedFieldOutsideAForm.name]: typedFieldOutsideAForm,
 	[noFastTooltip.name]: noFastTooltip,
 	[noRawPassword.name]: noRawPassword,
 	[noRawNav.name]: noRawNav,