jamdesk 1.1.202 → 1.1.203

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jamdesk",
-  "version": "1.1.202",
+  "version": "1.1.203",
   "description": "CLI for Jamdesk — build, preview, and deploy documentation sites from MDX. Dev server with hot reload, 50+ components, OpenAPI support, AI search, and Mintlify migration",
   "keywords": [
     "jamdesk",

package/vendored/app/globals.css

@@ -42,6 +42,44 @@
  */
 @import "../themes/jam/variables.css";
 
+/*
+ * MDX wraps a button's label in a paragraph, and our prose <p> styling then
+ * recolours it — defeating the colour the author put on the button itself.
+ *
+ * Observed in production: a customer wrote
+ *   <button className="bg-[#ED8200] text-black">Submit Feedback</button>
+ * and remark turned the label into `<p class="text-theme-text-secondary
+ * leading-7 mb-4">`. That class sets colour directly, so it beats the
+ * `text-black` the <p> would otherwise have INHERITED from the button:
+ * 1.40:1 against the orange in dark mode, 3.79:1 in light. Both fail WCAG AA;
+ * the author's own intent was 7.79:1 and correct. `mb-4` also made the button
+ * 65px tall with the label sitting above centre.
+ *
+ * Scoped to `> p:only-child` — the exact "MDX wrapped my label" shape. A
+ * button that deliberately contains a styled paragraph alongside other content
+ * is untouched, so this cannot silently override a real authoring choice.
+ *
+ * Must be UNLAYERED, and that is load-bearing — it has to outrank two
+ * different things at once:
+ *   - `text-theme-text-secondary`, a utility in `@layer utilities`
+ *   - `.prose p { margin: 0.5rem 0 0.8rem }` in themes/base.css, which the
+ *     @import above pulls in UNLAYERED
+ * Nothing inside a layer can beat that second one — an unlayered rule wins
+ * over every layer regardless of specificity, which is exactly why an earlier
+ * version of this block sat in `@layer utilities`, fixed the colour, and left
+ * the button still 63px tall with 12.8px of dead space under the label.
+ * Unlayered, `button > p:only-child` (0,1,2) also outranks `.prose p` (0,1,1)
+ * on its own terms, so no `!important` is needed.
+ *
+ * Verified that no platform component renders a <button> whose only child is
+ * a <p>, so the unlayered reach costs us nothing.
+ */
+button > p:only-child {
+  color: inherit;
+  margin: 0;
+  line-height: inherit;
+}
+
 /*
  * Light/Dark mode image utilities
  * These utilities enable showing different images based on theme.

package/vendored/lib/strip-event-handlers.ts

@@ -79,6 +79,44 @@ export function isEventHandlerProp(name: string): boolean {
   return EVENT_HANDLER_PROP.test(name);
 }
 
+/**
+ * Attributes that only mean something on a `<form>`. When a form is downgraded
+ * to a `<div>` (see `neutralizeDeadForm`) these would become invalid DOM
+ * attributes and draw React warnings, so they go with it.
+ */
+const FORM_ONLY_PROPS = new Set([
+  'method',
+  'encType',
+  'target',
+  'noValidate',
+  'acceptCharset',
+]);
+
+/**
+ * A `<form>` whose only submit path was an `on*` handler we just stripped, and
+ * which has no `action`, is downgraded to a `<div>`.
+ *
+ * WHY, and why the tag rather than the submit button:
+ * with the handler gone the browser falls back to NATIVE submission, and with
+ * no `action` that targets the current URL — so a reader who fills the form in
+ * is navigated to `?<field>=<whatever they typed>`, the page reloads, their
+ * input goes nowhere, and their free text is left in the URL, in history, and
+ * in CDN logs. That is strictly worse than the form doing nothing.
+ *
+ * Observed in production: a customer's feedback snippet POSTed JSON to their
+ * own Lambda from `onSubmit`, whose FIRST statement was `e.preventDefault()`.
+ * Stripping the handler removed the very thing suppressing the native submit.
+ *
+ * Neutralizing the submit BUTTON would not close it. HTML implicit submission
+ * fires on Enter in a form with a single text field whether or not a submit
+ * button exists, so the form element itself has to go. Children render exactly
+ * as before; only the submission path disappears.
+ *
+ * Deliberately narrow: it fires only when a handler was actually removed AND
+ * there is no `action`. A form with an `action` still works natively and is
+ * left alone, and a form that never had a handler is not this bug.
+ */
+
 /** JSX factory callees emitted by the MDX/React compilers. */
 const JSX_CALLEES = new Set(['_jsx', '_jsxs', '_jsxDEV']);
 
@@ -114,14 +152,34 @@ export function recmaStripEventHandlers() {
       const props = node.arguments[1];
       if (!props || props.type !== 'ObjectExpression') return;
 
+      const tag = node.arguments[0];
+      const isForm =
+        tag && tag.type === 'Literal' && tag.value === 'form';
+      let strippedHandler = false;
+      let hasAction = false;
+
       props.properties = props.properties.filter((prop) => {
         // A SpreadElement here is an identifier spread (`{...handlers}`) — an
         // object-literal spread was already flattened into this same properties
         // list by the MDX compiler. Structural, so keep it (RESIDUAL SCOPE 1).
         if (prop.type !== 'Property') return true;
         const name = propKeyName(prop);
-        return !name || !isEventHandlerProp(name);
+        if (!name) return true;
+        if (name === 'action') hasAction = true;
+        if (!isEventHandlerProp(name)) return true;
+        strippedHandler = true;
+        return false;
       });
+
+      if (isForm && strippedHandler && !hasAction) {
+        (tag as { value: string; raw?: string }).value = 'div';
+        delete (tag as { raw?: string }).raw;
+        props.properties = props.properties.filter((prop) => {
+          if (prop.type !== 'Property') return true;
+          const name = propKeyName(prop);
+          return !name || !FORM_ONLY_PROPS.has(name);
+        });
+      }
     });
   };
 }
@@ -144,13 +202,46 @@ export function babelStripEventHandlers() {
     visitor: {
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       JSXOpeningElement(path: any) {
+        const isForm =
+          path.node.name?.type === 'JSXIdentifier' &&
+          path.node.name.name === 'form';
+        let strippedHandler = false;
+        let hasAction = false;
+
+        path.node.attributes = path.node.attributes.filter(
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          (attr: any) => {
+            if (
+              attr.type !== 'JSXAttribute' ||
+              attr.name?.type !== 'JSXIdentifier'
+            ) {
+              return true;
+            }
+            if (attr.name.name === 'action') hasAction = true;
+            if (!isEventHandlerProp(attr.name.name)) return true;
+            strippedHandler = true;
+            return false;
+          },
+        );
+
+        if (!isForm || !strippedHandler || hasAction) return;
+
+        // Downgrade to <div> — see neutralizeDeadForm above. The closing tag
+        // is renamed too. Under the `react` preset that lowers JSX to `_jsx`
+        // calls this is unobservable (the closing element is discarded), so it
+        // reads like dead code — but leaving a mismatched AST would emit
+        // `<div>…</form>` for any consumer that preserves JSX, and a test
+        // transpiles with JSX preserved specifically to pin it.
+        path.node.name.name = 'div';
+        const closing = path.parent?.closingElement;
+        if (closing?.name?.type === 'JSXIdentifier') closing.name.name = 'div';
         path.node.attributes = path.node.attributes.filter(
           // eslint-disable-next-line @typescript-eslint/no-explicit-any
           (attr: any) =>
             !(
               attr.type === 'JSXAttribute' &&
               attr.name?.type === 'JSXIdentifier' &&
-              isEventHandlerProp(attr.name.name)
+              FORM_ONLY_PROPS.has(attr.name.name)
             ),
         );
       },

package/vendored/workspace-package-lock.json

@@ -2925,9 +2925,9 @@
       "license": "MIT"
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.417",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.417.tgz",
-      "integrity": "sha512-4T+DTDWuMPM4aHlHwWdAVCVWwp7LDilnhzkj+c/Lbj91XSQrLuOmZSLtS9Q4iIqjlPUbPOnC624zDVVHCHaolQ==",
+      "version": "1.5.418",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.418.tgz",
+      "integrity": "sha512-UzS26r3AEbG5wSoGVpJKqwHIU9zwQN7LHdVIThDrJpS0I5KdlXFMEb8543fhc9dVnIIAST6ar8rhwa00AL5MlA==",
       "license": "ISC"
     },
     "node_modules/enhanced-resolve": {