tekivex-ui 3.18.0 → 3.18.2

package/README.md

@@ -4,7 +4,7 @@
 
 **The React component library that ships with a threat model.**
 
-WCAG 2.1 AAA (audit-firm engagement open) · WAI-ARIA 1.2 · **SecurityCore** (XSS · clickjacking · Trojan Source · CSP · PII · magic-byte MIME · Trusted Types) · **115 production components** (+ 4 experimental, opt-in) · Zero runtime dependencies in core
+WCAG 2.1 AAA target (third-party audit on roadmap, not yet completed) · WAI-ARIA 1.2 · **SecurityCore** (XSS · clickjacking · Trojan Source · CSP · PII · magic-byte MIME · Trusted Types) · **116 production components** (+ 4 experimental, opt-in) · Zero runtime dependencies in core
 
 📄 **[Security Threat Model](./docs/SECURITY-THREAT-MODEL.md)** — the only mainstream React UI library that publishes one. 15 STRIDE-mapped threats with CWE references.
 
@@ -14,7 +14,7 @@ WCAG 2.1 AAA (audit-firm engagement open) · WAI-ARIA 1.2 · **SecurityCore** (X
 [![TypeScript](https://img.shields.io/badge/TypeScript-5.6-3178c6.svg?logo=typescript&logoColor=white)](https://www.typescriptlang.org/)
 [![React](https://img.shields.io/badge/React-18+-61dafb.svg?logo=react&logoColor=white)](https://react.dev/)
 [![WCAG 2.1 AAA](https://img.shields.io/badge/WCAG-2.1%20AAA-00c853.svg)](https://www.w3.org/TR/WCAG21/)
-[![Tests](https://img.shields.io/badge/Tests-1777%20passing-00c853.svg)](#testing)
+[![Tests](https://img.shields.io/badge/Tests-1798%20passing-00c853.svg)](#testing)
 [![SecurityCore](https://img.shields.io/badge/SecurityCore-v3.0-f72585.svg)](./docs/SECURITY-THREAT-MODEL.md)
 [![Socket.dev](https://socket.dev/api/badge/npm/package/tekivex-ui)](https://socket.dev/npm/package/tekivex-ui)
 [![SBOM](https://img.shields.io/badge/SBOM-CycloneDX%201.5-7c5cff.svg)](https://ui.tekivex.com/security/sbom.json)
@@ -35,13 +35,18 @@ npm install tekivex-ui
 
 TekiVex UI is **pre-1.0** and currently maintained by a single developer
 ([007krcs](https://github.com/007krcs)) on `novaai0401@gmail.com`. We
-publish to npm with [provenance attestations](https://docs.npmjs.com/generating-provenance-statements),
 ship a public [CycloneDX SBOM](https://ui.tekivex.com/security/sbom.json),
 a [security threat model](./docs/SECURITY-THREAT-MODEL.md) (15 STRIDE
-threats with CWE refs), and 1,777 tests at the published version — but
+threats with CWE refs), and 1,798 tests at the published version — but
 none of that substitutes for the human-scale risk of any pre-1.0,
 single-maintainer library.
 
+When published from CI, releases carry npm
+[provenance attestations](https://docs.npmjs.com/generating-provenance-statements).
+Local releases (currently the norm during pre-1.0) do not — verify
+provenance status with `npm view tekivex-ui --json | jq '.dist.attestations'`
+if it matters to your supply-chain policy.
+
 **Honest guidance:**
 
 - **Pin your version** (`"tekivex-ui": "3.18.0"`, not `"^3.18.0"`) until v4.0
@@ -49,7 +54,7 @@ single-maintainer library.
 - **Audit the SBOM** at [`ui.tekivex.com/security/sbom.json`](https://ui.tekivex.com/security/sbom.json) — verifies zero runtime deps
 - **Verify the package** with `npm view tekivex-ui` before installing if you're concerned about typosquats (the legitimate name is exactly `tekivex-ui`)
 - **Check Socket.dev** [![Socket.dev](https://socket.dev/api/badge/npm/package/tekivex-ui)](https://socket.dev/npm/package/tekivex-ui) for supply-chain risk score
-- **For regulated-industry teams**: the [design-partner program](./docs/design-partners/README.md) gets a direct Slack channel + priority response + custom-components on demand. Free.
+- **For regulated-industry teams**: we're open to design-partner collaborations with regulated-industry teams — see [`docs/design-partners/README.md`](./docs/design-partners/README.md) for the playbook. No reserved slots, no formal program in place yet; reach out if it fits your situation.
 
 **Expect breaking changes at v4.0** — see [docs/ROADMAP.md](./docs/ROADMAP.md).
 Until then, the API surface marked stable will not break in minor or
@@ -106,7 +111,7 @@ Portal3D, Avatar3D — 14 primitives at source v0.7).
 
 | Feature | TekiVex UI | MUI | Ant Design | Mantine | shadcn/ui |
 |---|:---:|:---:|:---:|:---:|:---:|
-| WCAG **AAA** target (third-party audit-firm engagement open) | ✅ | ❌ | ❌ | ❌ | ❌ |
+| WCAG **AAA** target (third-party audit on roadmap, not yet completed) | ✅ | ❌ | ❌ | ❌ | ❌ |
 | **XSS** — string props sanitised by default across all text components | ✅ | ❌ | ❌ | ❌ | ❌ |
 | **Clickjacking** — `isFramed()` detection + `frame-ancestors` CSP | ✅ | ❌ | ❌ | ❌ | ❌ |
 | **Trojan Source** — bidi/zero-width stripped from text inputs | ✅ | ❌ | ❌ | ❌ | ❌ |
@@ -119,7 +124,7 @@ Portal3D, Avatar3D — 14 primitives at source v0.7).
 | Tamper-evident SHA-256 hash-chained audit trail | ✅ | ❌ | ❌ | ❌ | ❌ |
 | Published threat model | ✅ | ❌ | ❌ | ❌ | ❌ |
 | Full-featured DataGrid — **free** | ✅ | 💰 Pro | Partial | Partial | ❌ |
-| 115 production components — **free** | ✅ | ✅ | ✅ | ✅ | 30 |
+| 116 production components — **free** | ✅ | ✅ | ✅ | ✅ | 30 |
 | Hooks layer (a11y, theme, i18n) | ✅ | ❌ | ❌ | ✅ | ✅ |
 | i18n — 44 locales incl. RTL | ✅ | ✅ | ✅ | Partial | ❌ |
 | Plugin-extensible CSS engine | ✅ | ❌ | ❌ | ❌ | ❌ |
@@ -518,17 +523,17 @@ const aaa   = meetsAAA('#00f5d4', '#0a0a1a');       // → true  (≥ 7:1)
 ```
 
 **What's unique:**
-- 🛡️ **Automatic sanitisation** — no opt-in needed, every prop is safe by default
-- 📋 **Immutable audit trail** — append-only log of all security events for compliance / SIEM
+- 🛡️ **String-prop sanitisation by default** — `sanitizeString` runs on string props across components without opt-in
+- 📋 **Tamper-evident audit trail** — SHA-256 hash-chained append-only log for compliance / SIEM
 - 🎨 **Built-in WCAG checker** — `contrastRatio()`, `meetsAA()`, `meetsAAA()` available anywhere
 
 ---
 
 ## Accessibility
 
-Every component meets **WCAG 2.1 AAA** — the highest accessibility standard:
+We target **WCAG 2.1 AAA** — the highest accessibility standard. Self-tested against the criteria below; **a third-party audit is on the roadmap and has not been completed.** Treat this section as our internal compliance target, not a certification.
 
-- ✅ Contrast ratio ≥ **7:1** for all text (AAA, not just AA's 4.5:1)
+- ✅ Contrast ratio ≥ **7:1** for all text (AAA, not just AA's 4.5:1) — verified via internal `meetsAAA()` helper
 - ✅ Full **keyboard navigation** — Tab, Enter, Space, Arrow keys, Escape
 - ✅ Correct **ARIA roles, states & properties** (WAI-ARIA 1.2)
 - ✅ **Focus management** — focus trap in modals, visible focus rings
@@ -599,7 +604,7 @@ npm install
 # Build the library
 npm run build
 
-# Run all 1777 tests
+# Run all 1798 tests
 npm test
 
 # Run tests with coverage report
@@ -629,11 +634,11 @@ npm run security:audit
 ## Testing
 
 ```
-90 dedicated component test files · 1777 tests · 0 failures · 1 todo
+90 dedicated component test files · 1798 tests · 0 failures · 1 todo
 Coverage: 64.84% lines · 51.10% functions · 56.77% branches · 61.41% statements (ratchet enforced in CI)
 ```
 
-Coverage includes dedicated unit tests for 88 of 115 production components plus smoke coverage for the rest, 7 chart types, headless hooks (incl. useWebSocket / useSSE / useMediaQuery), the TKX CSS engine, the WCAG engine, the security (Shield) engine, the i18n provider, and Indian KYC validators (Aadhaar Verhoeff, PAN, Voter ID, DL).
+Coverage includes dedicated unit tests for 88 of 116 production components plus smoke coverage for the rest, 7 chart types, headless hooks (incl. useWebSocket / useSSE / useMediaQuery), the TKX CSS engine, the WCAG engine, the security (Shield) engine, the i18n provider, and Indian KYC validators (Aadhaar Verhoeff, PAN, Voter ID, DL).
 
 Coverage thresholds are enforced as a CI ratchet in `vitest.config.ts` — the floor never drops between releases. Path to 90/90/85 is documented in [`docs/test-coverage-roadmap.md`](./docs/test-coverage-roadmap.md).
 

package/dist/agent.d.ts

@@ -0,0 +1,3 @@
+// Auto-generated by scripts/emit-dts-shims.mjs — re-exports the per-entry
+// declarations that tsc emits under dist/src/. See package.json exports.
+export * from './src/agent/index';

package/dist/charts.d.ts

@@ -0,0 +1,3 @@
+// Auto-generated by scripts/emit-dts-shims.mjs — re-exports the per-entry
+// declarations that tsc emits under dist/src/. See package.json exports.
+export * from './src/charts/index';

package/dist/experimental.d.ts

@@ -0,0 +1,3 @@
+// Auto-generated by scripts/emit-dts-shims.mjs — re-exports the per-entry
+// declarations that tsc emits under dist/src/. See package.json exports.
+export * from './src/experimental/index';

package/dist/headless.d.ts

@@ -0,0 +1,3 @@
+// Auto-generated by scripts/emit-dts-shims.mjs — re-exports the per-entry
+// declarations that tsc emits under dist/src/. See package.json exports.
+export * from './src/headless/index';

package/dist/i18n.d.ts

@@ -0,0 +1,3 @@
+// Auto-generated by scripts/emit-dts-shims.mjs — re-exports the per-entry
+// declarations that tsc emits under dist/src/. See package.json exports.
+export * from './src/i18n/index';