@astrale-os/cli 1.0.0-beta.22 → 1.0.0-beta.24

package/src/ui/__tests__/ui.test.ts

@@ -28,6 +28,30 @@ const registry: UiRegistry = {
     },
   ],
 }
+const componentRegistry: UiRegistry = {
+  name: 'astrale-ui',
+  items: [
+    {
+      name: 'component-sidebar',
+      type: 'registry:component',
+      title: 'Component · sidebar',
+      dependencies: ['@astrale-os/ui@^0.3.0-beta.0', 'lucide-react@1.32.0'],
+      files: [
+        {
+          path: 'sidebar.tsx',
+          type: 'registry:component',
+          target: 'components/astrale/component/sidebar/sidebar.tsx',
+        },
+        {
+          path: 'use-mobile.ts',
+          type: 'registry:hook',
+          target: 'components/astrale/component/sidebar/use-mobile.ts',
+        },
+      ],
+      meta: { canonicalAddress: 'component/sidebar', ownership: 'consumer-source' },
+    },
+  ],
+}
 const themeCss = `/* Generated from observatory.astrale-theme.json. Consumer-owned after installation. */
 :root,
 [data-ui-theme='observatory'] {
@@ -257,15 +281,17 @@ function lock(): UiLock {
 }
 
 describe('UI release and runner contracts', () => {
+  /** @evidence TEST-CLI-UI-BETA-DEFAULT */
   test('resolves the default release from the public beta channel', async () => {
     const seen: string[] = []
+    const fallback = mockFetch()
     const fetcher = (async (input: string | URL | Request, init?: RequestInit) => {
       const url = String(input)
+      seen.push(url)
       if (url.endsWith('/@astrale-os/ui/beta')) {
-        seen.push(url)
         return Response.json({ version: '0.3.0-beta.1' })
       }
-      return mockFetch(seen)(input, init)
+      return fallback(input, init)
     }) as typeof fetch
 
     const release = await resolveUiRelease(undefined, fetcher)
@@ -322,6 +348,36 @@ describe('UI release and runner contracts', () => {
     ])
   })
 
+  test('admits an exact consumer-owned component with item-local dependencies and files', async () => {
+    const release = await resolveUiRelease('0.3.0-beta.0', mockFetch([], componentRegistry))
+    expect(release.registry.items).toEqual([
+      expect.objectContaining({
+        name: 'component-sidebar',
+        type: 'registry:component',
+        dependencies: ['@astrale-os/ui@^0.3.0-beta.0', 'lucide-react@1.32.0'],
+        meta: expect.objectContaining({ canonicalAddress: 'component/sidebar' }),
+        files: [
+          expect.objectContaining({
+            type: 'registry:component',
+            target: 'components/astrale/component/sidebar/sidebar.tsx',
+          }),
+          expect.objectContaining({
+            type: 'registry:hook',
+            target: 'components/astrale/component/sidebar/use-mobile.ts',
+          }),
+        ],
+      }),
+    ])
+  })
+
+  test('rejects a component item that targets another registry ownership category', async () => {
+    const invalid = structuredClone(componentRegistry)
+    invalid.items[0]!.files[0]!.target = 'components/astrale/pattern/sidebar/sidebar.tsx'
+    await expect(resolveUiRelease('0.3.0-beta.0', mockFetch([], invalid))).rejects.toMatchObject({
+      code: 'UI_REGISTRY_UNAVAILABLE',
+    })
+  })
+
   test('lists release themes through the public type filter', async () => {
     const themes = await listUi(
       undefined,
@@ -795,8 +851,60 @@ describe('UI initialization transaction', () => {
     )
   })
 
+  test('preserves an existing development-only UI dependency during initialization', async () => {
+    const root = await fixture()
+    const manifestPath = path.join(root, 'package.json')
+    const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
+    manifest.devDependencies = { '@astrale-os/ui': '0.3.0-beta.0' }
+    await writeFile(manifestPath, JSON.stringify(manifest))
+
+    await initUi({ path: root, version: '0.3.0-beta.0', install: false }, { fetcher: mockFetch() })
+
+    const written = JSON.parse(await readFile(manifestPath, 'utf8'))
+    expect(written.dependencies['@astrale-os/ui']).toBeUndefined()
+    expect(written.devDependencies['@astrale-os/ui']).toBe('0.3.0-beta.0')
+  })
+
+  test('doctor accepts one exact development dependency and rejects drift or duplication', async () => {
+    const root = await lockedFixture()
+    const manifestPath = path.join(root, 'package.json')
+    const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
+    delete manifest.dependencies['@astrale-os/ui']
+    manifest.devDependencies = { '@astrale-os/ui': '0.3.0-beta.0' }
+    await writeFile(manifestPath, JSON.stringify(manifest))
+    await writeFile(
+      path.join(root, 'components.json'),
+      JSON.stringify({ style: 'base-nova', tailwind: { css: 'src/index.css' } }),
+    )
+    await writeFile(
+      path.join(root, 'src/index.css'),
+      "@import '@astrale-os/ui/theme.css';\n@import '@astrale-os/ui/presets/astrale.css';\n",
+    )
+
+    expect((await doctorUi(root)).healthy).toBe(true)
+
+    manifest.devDependencies['@astrale-os/ui'] = '0.3.0-beta.1'
+    await writeFile(manifestPath, JSON.stringify(manifest))
+    expect((await doctorUi(root)).checks.find(({ check }) => check === 'package')).toMatchObject({
+      ok: false,
+      detail: 'devDependencies:0.3.0-beta.1',
+    })
+
+    manifest.devDependencies['@astrale-os/ui'] = '0.3.0-beta.0'
+    manifest.dependencies['@astrale-os/ui'] = '0.3.0-beta.0'
+    await writeFile(manifestPath, JSON.stringify(manifest))
+    expect((await doctorUi(root)).checks.find(({ check }) => check === 'package')).toMatchObject({
+      ok: false,
+      detail: 'declared in dependencies and devDependencies',
+    })
+  })
+
   test('repeated exact init performs no release fetch while requested drift rejects', async () => {
     const root = await fixture()
+    const manifestPath = path.join(root, 'package.json')
+    const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
+    manifest.dependencies['@astrale-os/ui'] = '0.3.0-beta.0'
+    await writeFile(manifestPath, JSON.stringify(manifest))
     await writeFile(path.join(root, 'astrale-ui.lock.json'), JSON.stringify(lock()))
     await writeFile(
       path.join(root, 'components.json'),
@@ -821,6 +929,11 @@ describe('UI initialization transaction', () => {
     await expect(initUi({ path: root, preset: 'compact' })).rejects.toMatchObject({
       code: 'UI_ITEM_CONFLICT',
     })
+    manifest.dependencies['@astrale-os/ui'] = '0.3.0-beta.1'
+    await writeFile(manifestPath, JSON.stringify(manifest))
+    await expect(initUi({ path: root, preset: 'astrale' })).rejects.toMatchObject({
+      code: 'UI_ITEM_CONFLICT',
+    })
   })
 })
 
@@ -1096,6 +1209,201 @@ describe('UI source operations', () => {
     ).rejects.toBeInstanceOf(UiError)
   })
 
+  test('records multi-file component targets resolved through the consumer components alias', async () => {
+    const root = await lockedFixture()
+    await writeFile(
+      path.join(root, 'components.json'),
+      JSON.stringify({
+        style: 'base-nova',
+        tailwind: { css: 'src/index.css' },
+        aliases: { components: '@/components' },
+      }),
+    )
+    await writeFile(
+      path.join(root, 'tsconfig.json'),
+      JSON.stringify({
+        compilerOptions: {
+          paths: { '@/*': ['./src/*'], '@/components/*': ['./app/ui/*'] },
+        },
+      }),
+    )
+    await writeFile(
+      path.join(root, 'src/index.css'),
+      "@import '@astrale-os/ui/theme.css';\n@import '@astrale-os/ui/presets/astrale.css';\n",
+    )
+    const sidebar = path.join(root, 'src/components/astrale/component/sidebar/sidebar.tsx')
+    const hook = path.join(root, 'src/components/astrale/component/sidebar/use-mobile.ts')
+
+    const planned = await addUi(
+      ['component/sidebar'],
+      { project: root, dryRun: true, yes: true },
+      {
+        fetcher: mockFetch([], componentRegistry),
+        runner: async () => ({ code: 0, stdout: 'planned', stderr: '' }),
+      },
+    )
+    expect(planned.sources).toEqual([
+      expect.objectContaining({
+        files: [
+          'src/components/astrale/component/sidebar/sidebar.tsx',
+          'src/components/astrale/component/sidebar/use-mobile.ts',
+        ],
+      }),
+    ])
+
+    await addUi(
+      ['component/sidebar'],
+      { project: root, yes: true },
+      {
+        fetcher: mockFetch([], componentRegistry),
+        runner: async () => {
+          await mkdir(path.dirname(sidebar), { recursive: true })
+          await writeFile(sidebar, 'export const Sidebar = true\n')
+          await writeFile(hook, 'export const useMobile = true\n')
+          return { code: 0, stdout: '', stderr: '' }
+        },
+      },
+    )
+
+    const written = JSON.parse(await readFile(path.join(root, 'astrale-ui.lock.json'), 'utf8'))
+    expect(written.items['component/sidebar'].files).toEqual({
+      'src/components/astrale/component/sidebar/sidebar.tsx': digest(
+        'export const Sidebar = true\n',
+      ),
+      'src/components/astrale/component/sidebar/use-mobile.ts': digest(
+        'export const useMobile = true\n',
+      ),
+    })
+    expect((await doctorUi(root)).healthy).toBe(true)
+  })
+
+  test('resolves a components alias through package imports before tsconfig paths', async () => {
+    const root = await lockedFixture()
+    const manifestPath = path.join(root, 'package.json')
+    const manifest = JSON.parse(await readFile(manifestPath, 'utf8'))
+    manifest.imports = { '#app/*': './src/app/*' }
+    await writeFile(manifestPath, JSON.stringify(manifest))
+    await writeFile(
+      path.join(root, 'components.json'),
+      JSON.stringify({
+        style: 'base-nova',
+        tailwind: { css: 'src/index.css' },
+        aliases: { components: '#app/components' },
+      }),
+    )
+
+    const planned = await addUi(
+      ['pattern/chart/line/basic'],
+      { project: root, dryRun: true, yes: true },
+      {
+        fetcher: mockFetch(),
+        runner: async () => ({ code: 0, stdout: 'planned', stderr: '' }),
+      },
+    )
+
+    expect(planned.sources).toEqual([
+      expect.objectContaining({
+        files: ['src/app/components/astrale/pattern/chart/line-basic.tsx'],
+      }),
+    ])
+  })
+
+  test('rejects an unresolved package-import alias before invoking shadcn', async () => {
+    const root = await lockedFixture()
+    await writeFile(
+      path.join(root, 'components.json'),
+      JSON.stringify({
+        style: 'base-nova',
+        tailwind: { css: 'src/index.css' },
+        aliases: { components: '#missing/components' },
+      }),
+    )
+    let invoked = false
+
+    await expect(
+      addUi(
+        ['pattern/chart/line/basic'],
+        { project: root, yes: true },
+        {
+          fetcher: mockFetch(),
+          runner: async () => {
+            invoked = true
+            return { code: 0, stdout: '', stderr: '' }
+          },
+        },
+      ),
+    ).rejects.toMatchObject({ code: 'UI_PROJECT_UNSUPPORTED' })
+    expect(invoked).toBe(false)
+  })
+
+  test('resolves an extended JSONC baseUrl with the pinned shadcn config loader', async () => {
+    const root = await lockedFixture()
+    await writeFile(
+      path.join(root, 'components.json'),
+      JSON.stringify({
+        style: 'base-nova',
+        tailwind: { css: 'src/index.css' },
+        aliases: { components: '@/components' },
+      }),
+    )
+    await mkdir(path.join(root, 'config'), { recursive: true })
+    await writeFile(
+      path.join(root, 'tsconfig.json'),
+      '{\n  // shadcn loads this root config.\n  "extends": "./config/base.json",\n}\n',
+    )
+    await writeFile(
+      path.join(root, 'config/base.json'),
+      '{\n  "compilerOptions": {\n    "baseUrl": "..",\n    "paths": { "@/*": ["frontend/src/*"], },\n  },\n}\n',
+    )
+
+    const planned = await addUi(
+      ['pattern/chart/line/basic'],
+      { project: root, dryRun: true, yes: true },
+      {
+        fetcher: mockFetch(),
+        runner: async () => ({ code: 0, stdout: 'planned', stderr: '' }),
+      },
+    )
+
+    expect(planned.sources).toEqual([
+      expect.objectContaining({
+        files: ['frontend/src/components/astrale/pattern/chart/line-basic.tsx'],
+      }),
+    ])
+  })
+
+  test('rejects an alias mapping outside the project before invoking shadcn', async () => {
+    const root = await lockedFixture()
+    await writeFile(
+      path.join(root, 'components.json'),
+      JSON.stringify({
+        style: 'base-nova',
+        tailwind: { css: 'src/index.css' },
+        aliases: { components: '@/components' },
+      }),
+    )
+    await writeFile(
+      path.join(root, 'tsconfig.json'),
+      JSON.stringify({ compilerOptions: { paths: { '@/*': ['../outside/*'] } } }),
+    )
+    let invoked = false
+
+    await expect(
+      addUi(
+        ['pattern/chart/line/basic'],
+        { project: root, yes: true },
+        {
+          fetcher: mockFetch(),
+          runner: async () => {
+            invoked = true
+            return { code: 0, stdout: '', stderr: '' }
+          },
+        },
+      ),
+    ).rejects.toMatchObject({ code: 'UI_PROJECT_UNSUPPORTED' })
+    expect(invoked).toBe(false)
+  })
+
   test('restores the exact locked UI dependency after shadcn applies its compatible range', async () => {
     const root = await lockedFixture()
     const installed = path.join(root, 'components/astrale/pattern/chart/line-basic.tsx')
@@ -1132,6 +1440,38 @@ describe('UI source operations', () => {
     ).toBe('0.3.0-beta.0')
   })
 
+  test('restores a development-only UI dependency without retaining shadcn duplication', async () => {
+    const root = await lockedFixture()
+    const manifestPath = path.join(root, 'package.json')
+    const initial = JSON.parse(await readFile(manifestPath, 'utf8'))
+    delete initial.dependencies['@astrale-os/ui']
+    initial.devDependencies = { '@astrale-os/ui': '0.3.0-beta.0' }
+    await writeFile(manifestPath, JSON.stringify(initial))
+    const installed = path.join(root, 'components/astrale/pattern/chart/line-basic.tsx')
+
+    await addUi(
+      ['pattern/chart/line/basic'],
+      { project: root, yes: true },
+      {
+        fetcher: mockFetch(),
+        runner: async (_file, args) => {
+          if (args[0] === 'dlx') {
+            await mkdir(path.dirname(installed), { recursive: true })
+            await writeFile(installed, 'export const Chart = true\n')
+            const changed = JSON.parse(await readFile(manifestPath, 'utf8'))
+            changed.dependencies['@astrale-os/ui'] = '^0.3.0-beta.0'
+            await writeFile(manifestPath, JSON.stringify(changed))
+          }
+          return { code: 0, stdout: '', stderr: '' }
+        },
+      },
+    )
+
+    const written = JSON.parse(await readFile(manifestPath, 'utf8'))
+    expect(written.dependencies['@astrale-os/ui']).toBeUndefined()
+    expect(written.devDependencies['@astrale-os/ui']).toBe('0.3.0-beta.0')
+  })
+
   test('rolls back item and package state when restoring the locked dependency fails', async () => {
     const root = await lockedFixture()
     const manifestPath = path.join(root, 'package.json')
@@ -1190,10 +1530,22 @@ describe('UI source operations', () => {
     expect(invoked).toBe(false)
   })
 
-  test('restores declared files and package state after a partial shadcn failure', async () => {
+  test('restores alias-resolved files and package state after a partial shadcn failure', async () => {
     const root = await lockedFixture()
-    const first = path.join(root, 'components/astrale/pattern/chart/line-basic.tsx')
-    const second = path.join(root, 'components/astrale/pattern/chart/summary.tsx')
+    await writeFile(
+      path.join(root, 'components.json'),
+      JSON.stringify({
+        style: 'base-nova',
+        tailwind: { css: 'src/index.css' },
+        aliases: { components: '@/components' },
+      }),
+    )
+    await writeFile(
+      path.join(root, 'tsconfig.json'),
+      JSON.stringify({ compilerOptions: { paths: { '@/*': ['./src/*'] } } }),
+    )
+    const first = path.join(root, 'src/components/astrale/pattern/chart/line-basic.tsx')
+    const second = path.join(root, 'src/components/astrale/pattern/chart/summary.tsx')
     await mkdir(path.dirname(first), { recursive: true })
     await writeFile(first, 'consumer original\n')
     const twoFileRegistry: UiRegistry = {

package/src/ui/lock.ts

@@ -32,7 +32,7 @@ export function parseUiLock(value: unknown): UiLock {
   }
   for (const [address, item] of Object.entries(lock.items)) {
     if (
-      !/^(?:(?:pattern|block)\/[a-z0-9-]+\/[a-z0-9-/]+|theme\/[a-z][a-z0-9]*(?:-[a-z0-9]+)*)$/u.test(
+      !/^(?:component\/[a-z][a-z0-9]*(?:-[a-z0-9]+)*|(?:pattern|block)\/[a-z0-9-]+\/[a-z0-9-/]+|theme\/[a-z][a-z0-9]*(?:-[a-z0-9]+)*)$/u.test(
         address,
       ) ||
       !isRecord(item) ||

package/src/ui/operations.ts

@@ -17,6 +17,7 @@ import {
   assertSupportedUiProject,
   discoverUiProject,
   projectRelative,
+  resolveUiRegistryTarget,
   type UiProject,
 } from './project'
 import {
@@ -134,8 +135,45 @@ function activateTheme(current: string, statement: string): string {
     .replace(/^\n/u, '')
 }
 
-function manifestDependencies(manifest: Record<string, unknown>): Record<string, string> {
-  return { ...(manifest.dependencies as Record<string, string> | undefined) }
+type ManifestDependencySection = 'dependencies' | 'devDependencies'
+
+function manifestDependencies(
+  manifest: Record<string, unknown>,
+  section: ManifestDependencySection = 'dependencies',
+): Record<string, string> {
+  return { ...(manifest[section] as Record<string, string> | undefined) }
+}
+
+function uiDependencySection(
+  manifest: Record<string, unknown>,
+  fallback: ManifestDependencySection = 'dependencies',
+): ManifestDependencySection {
+  const runtime = Object.hasOwn(manifestDependencies(manifest), UI_PACKAGE)
+  const development = Object.hasOwn(manifestDependencies(manifest, 'devDependencies'), UI_PACKAGE)
+  if (runtime && development) {
+    throw new UiError(
+      'UI_PROJECT_UNSUPPORTED',
+      UI_PACKAGE + ' must be declared in exactly one dependency section.',
+      'Remove it from either dependencies or devDependencies, then retry.',
+    )
+  }
+  if (development) return 'devDependencies'
+  if (runtime) return 'dependencies'
+  return fallback
+}
+
+function setUiDependency(
+  manifest: Record<string, unknown>,
+  section: ManifestDependencySection,
+  version: string,
+): void {
+  const other = section === 'dependencies' ? 'devDependencies' : 'dependencies'
+  manifest[section] = { ...manifestDependencies(manifest, section), [UI_PACKAGE]: version }
+  const otherDependencies = manifestDependencies(manifest, other)
+  if (Object.hasOwn(otherDependencies, UI_PACKAGE)) {
+    delete otherDependencies[UI_PACKAGE]
+    manifest[other] = otherDependencies
+  }
 }
 
 function domainRegistryPackagePath(project: UiProject): string {
@@ -294,6 +332,10 @@ export async function initUi(
   }
   if ((await exists(project.uiLockPath)) && !options.force) {
     const lock = await readUiLock(project.uiLockPath)
+    const dependencySection = uiDependencySection(project.packageJson)
+    const dependencyVersion = manifestDependencies(project.packageJson, dependencySection)[
+      UI_PACKAGE
+    ]
     const css = (await readOptional(project.cssPath)) ?? ''
     const components = await readOptional(project.componentsPath)
       .then((value) => (value ? (JSON.parse(value) as Record<string, unknown>) : undefined))
@@ -301,6 +343,7 @@ export async function initUi(
     const requestedVersion = options.version?.replace(/^v/u, '')
     const desired =
       (!requestedVersion || requestedVersion === lock.package.version) &&
+      dependencyVersion === lock.package.version &&
       (!options.preset || options.preset === lock.preset) &&
       css.includes(UI_PACKAGE + '/theme.css') &&
       css.includes(UI_PACKAGE + '/presets/' + lock.preset + '.css') &&
@@ -362,10 +405,7 @@ export async function initUi(
 
   try {
     const manifest = { ...project.packageJson }
-    manifest.dependencies = {
-      ...manifestDependencies(manifest),
-      [UI_PACKAGE]: release.version,
-    }
+    setUiDependency(manifest, uiDependencySection(manifest), release.version)
     await writeDomainRegistryWorkspace(project, manifest)
     await writeJson(project.packageJsonPath, manifest)
 
@@ -461,14 +501,17 @@ export async function initUi(
 async function pinUiDependency(
   project: UiProject,
   version: string,
+  section: ManifestDependencySection,
   runner: UiRunner,
 ): Promise<void> {
   const manifest = JSON.parse(await readFile(project.packageJsonPath, 'utf8')) as Record<
     string,
     unknown
   >
-  if (manifestDependencies(manifest)[UI_PACKAGE] === version) return
-  manifest.dependencies = { ...manifestDependencies(manifest), [UI_PACKAGE]: version }
+  const current = manifestDependencies(manifest, section)[UI_PACKAGE]
+  const other = section === 'dependencies' ? 'devDependencies' : 'dependencies'
+  if (current === version && manifestDependencies(manifest, other)[UI_PACKAGE] === undefined) return
+  setUiDependency(manifest, section, version)
   await writeJson(project.packageJsonPath, manifest)
   const result = await runner(project.manager, ['install'], project.root)
   if (result.code !== 0) {
@@ -663,6 +706,7 @@ export async function addUi(
     return addLocalTheme(localThemes[0]!, project, options)
   }
   const { lock, release } = await lockedRelease(project, dependencies.fetcher)
+  const dependencySection = uiDependencySection(project.packageJson)
   const items = addresses.map((address) => findItem(release, address))
   const themes = items.filter((item) => item.type === 'registry:theme')
   if (themes.length > 1) {
@@ -681,13 +725,19 @@ export async function addUi(
     return addReleasedTheme(themes[0]!, itemDocuments[0]!, project, options)
   }
   await rejectLocalChanges(project, lock, items, options.overwrite === true)
-  const targets = (
+  const declaredTargets = items.flatMap((item) =>
+    item.files.flatMap((file) => (file.target ? [file.target] : [])),
+  )
+  const resolvedTargets = new Map(
     await Promise.all(
-      items.flatMap((item) =>
-        item.files
-          .filter((file) => file.target)
-          .map((file) => assertSafePlannedTarget(project, file.target!)),
+      declaredTargets.map(
+        async (target) => [target, await resolveUiRegistryTarget(project, target)] as const,
       ),
+    ),
+  )
+  const targets = (
+    await Promise.all(
+      [...resolvedTargets.values()].map((target) => assertSafePlannedTarget(project, target)),
     )
   ).filter((target, index, all) => all.indexOf(target) === index)
   const invocation = shadcnInvocation(project.manager, release.compatibility.shadcn, [
@@ -731,7 +781,12 @@ export async function addUi(
           throw new UiError('UI_TOOL_FAILED', 'The pinned shadcn operation omitted an item file.')
         }
       }
-      await pinUiDependency(project, lock.package.version, dependencies.runner ?? defaultUiRunner)
+      await pinUiDependency(
+        project,
+        lock.package.version,
+        dependencySection,
+        dependencies.runner ?? defaultUiRunner,
+      )
       const theme = themes[0]
       const themeTarget = theme?.files[0]?.target
       if (themeTarget) {
@@ -754,7 +809,9 @@ export async function addUi(
       sources: itemDocuments.map((item) => ({
         address: item.meta.canonicalAddress,
         dependencies: item.dependencies ?? [],
-        files: item.files.map((file) => file.target).filter(Boolean),
+        files: item.files
+          .map((file) => (file.target ? resolvedTargets.get(file.target) : undefined))
+          .filter(Boolean),
       })),
       command: [invocation.file, ...invocation.args],
       output: result.stdout,
@@ -776,7 +833,7 @@ export async function addUi(
       const files: Record<string, string> = {}
       for (const file of item.files) {
         if (!file.target) continue
-        const target = await safeTarget(project, file.target)
+        const target = await safeTarget(project, resolvedTargets.get(file.target)!)
         files[projectRelative(project, target)] = digest(await readFile(target))
       }
       lock.items[item.meta.canonicalAddress] = {
@@ -821,11 +878,24 @@ export async function doctorUi(
       detail: error instanceof Error ? error.message : String(error),
     })
   }
-  const dependencies = manifestDependencies(project.packageJson)
+  const runtimeVersion = manifestDependencies(project.packageJson)[UI_PACKAGE]
+  const developmentVersion = manifestDependencies(project.packageJson, 'devDependencies')[
+    UI_PACKAGE
+  ]
+  const declarations = [runtimeVersion, developmentVersion].filter(
+    (version): version is string => typeof version === 'string',
+  )
+  const packageVersion = declarations.length === 1 ? declarations[0] : undefined
   checks.push({
     check: 'package',
-    ok: typeof dependencies[UI_PACKAGE] === 'string',
-    detail: dependencies[UI_PACKAGE],
+    ok: declarations.length === 1 && (!lock || packageVersion === lock.package.version),
+    detail:
+      declarations.length > 1
+        ? 'declared in dependencies and devDependencies'
+        : packageVersion === undefined
+          ? 'missing'
+          : (runtimeVersion === packageVersion ? 'dependencies:' : 'devDependencies:') +
+            packageVersion,
   })
   const css = (await readOptional(project.cssPath)) ?? ''
   checks.push({ check: 'theme', ok: css.includes(UI_PACKAGE + '/theme.css') })