@codefast/cli 0.12.0 → 0.14.0

package/dist/audit/layers/domain/layering.d.ts

@@ -0,0 +1,46 @@
+import type { LayerViolation } from "#audit/domain/types";
+/**
+ * The key a layer entry and a module path share: the first path segment, without a module extension.
+ *
+ * @remarks `errors.ts`, `errors/` and `errors/taxonomy.ts` all key as `errors`, so a layer entry names
+ * a family directly under the root — a directory, or a lone module sitting flat.
+ *
+ * @since 0.14.0
+ */
+export declare function layerKeyOf(modulePath: string): string;
+/**
+ * Returns why a layer list breaks its contract, or `undefined` when every entry is a family under the root, placed once.
+ *
+ * @since 0.14.0
+ */
+export declare function invalidLayerEntry(layers: ReadonlyArray<ReadonlyArray<string>>): string | undefined;
+/**
+ * Where a module sits: its layer's position from the bottom, and the entry that placed it there.
+ *
+ * @since 0.14.0
+ */
+export interface LayerPlacement {
+    readonly index: number;
+    readonly entry: string;
+}
+/**
+ * A package's layers, bottom to top, answering the placement of any module path under the root.
+ *
+ * @since 0.14.0
+ */
+export declare class LayerMap {
+    #private;
+    constructor(layers: ReadonlyArray<ReadonlyArray<string>>);
+    /** The placement of a root-relative module path, or `undefined` when no layer names its family. */
+    placementOf(modulePath: string): LayerPlacement | undefined;
+}
+/**
+ * Scans one module against its package's layers and returns the violations: the module sitting in no
+ * layer, or a value import or re-export whose target sits in a higher layer, or in none.
+ *
+ * @remarks Type-only imports and re-exports erase at build time and couple nothing, so they pass
+ * whichever way they point. Dynamic `import()` counts as a value import wherever it sits.
+ *
+ * @since 0.14.0
+ */
+export declare function auditLayeringSource(filePath: string, modulePath: string, sourceText: string, layers: LayerMap): Array<LayerViolation>;

package/dist/audit/layers/domain/layering.js

@@ -0,0 +1,191 @@
+/**
+ * The layering rule one package's `src/` follows: a value import never points up the configured layers.
+ */
+import path from "node:path";
+import { parseSync } from "oxc-parser";
+import { isOxcNode, programStatements } from "#core/oxc-node";
+import { firstLineOf, lineOfOffset } from "#core/source-position";
+const MODULE_EXTENSIONS = [".tsx", ".ts", ".js"];
+function withoutModuleExtension(name) {
+    for (const extension of MODULE_EXTENSIONS) {
+        if (name.endsWith(extension)) {
+            return name.slice(0, -extension.length);
+        }
+    }
+    return name;
+}
+/**
+ * The key a layer entry and a module path share: the first path segment, without a module extension.
+ *
+ * @remarks `errors.ts`, `errors/` and `errors/taxonomy.ts` all key as `errors`, so a layer entry names
+ * a family directly under the root — a directory, or a lone module sitting flat.
+ *
+ * @since 0.14.0
+ */
+export function layerKeyOf(modulePath) {
+    const [first = ""] = modulePath.split("/");
+    return withoutModuleExtension(first);
+}
+/**
+ * Returns why a layer list breaks its contract, or `undefined` when every entry is a family under the root, placed once.
+ *
+ * @since 0.14.0
+ */
+export function invalidLayerEntry(layers) {
+    const seen = new Map();
+    for (const layer of layers) {
+        for (const entry of layer) {
+            const trimmed = entry.replace(/\/$/, "");
+            if (trimmed === "" || trimmed.includes("/")) {
+                return `layer entry "${entry}" must name a directory or a module file directly under the root`;
+            }
+            const key = layerKeyOf(trimmed);
+            const earlier = seen.get(key);
+            if (earlier !== undefined) {
+                return `layer entry "${entry}" is already placed by "${earlier}"`;
+            }
+            seen.set(key, entry);
+        }
+    }
+    return undefined;
+}
+/**
+ * A package's layers, bottom to top, answering the placement of any module path under the root.
+ *
+ * @since 0.14.0
+ */
+export class LayerMap {
+    #placementByKey = new Map();
+    constructor(layers) {
+        layers.forEach((layer, index) => {
+            for (const entry of layer) {
+                this.#placementByKey.set(layerKeyOf(entry.replace(/\/$/, "")), { index, entry });
+            }
+        });
+    }
+    /** The placement of a root-relative module path, or `undefined` when no layer names its family. */
+    placementOf(modulePath) {
+        return this.#placementByKey.get(layerKeyOf(modulePath));
+    }
+}
+function sourceValueOf(node) {
+    const source = node.source;
+    return isOxcNode(source) && typeof source.value === "string" ? source.value : undefined;
+}
+function everySpecifierIsTypeOnly(node, kindField) {
+    const specifiers = Array.isArray(node.specifiers) ? node.specifiers.filter(isOxcNode) : [];
+    return specifiers.length > 0 && specifiers.every((specifier) => specifier[kindField] === "type");
+}
+/**
+ * The module a top-level statement imports or re-exports at runtime, or `undefined` when it erases at build time.
+ */
+function valueSpecifierOf(statement) {
+    if (statement.type === "ImportDeclaration") {
+        if (statement.importKind === "type" || everySpecifierIsTypeOnly(statement, "importKind")) {
+            return undefined;
+        }
+        return sourceValueOf(statement);
+    }
+    if (statement.type === "ExportNamedDeclaration") {
+        if (statement.exportKind === "type" || everySpecifierIsTypeOnly(statement, "exportKind")) {
+            return undefined;
+        }
+        return sourceValueOf(statement);
+    }
+    if (statement.type === "ExportAllDeclaration") {
+        return statement.exportKind === "type" ? undefined : sourceValueOf(statement);
+    }
+    return undefined;
+}
+/**
+ * The root-relative module path a specifier names, or `undefined` for one outside the root (a package, a
+ * relative path climbing out).
+ *
+ * @remarks A `#` subpath import maps to the root directly, which is how every package's `#*` imports
+ * field is declared; a relative import resolves against the importing module.
+ */
+function moduleTargetOf(specifier, fromModulePath) {
+    if (specifier.startsWith("#")) {
+        const target = specifier.slice(1);
+        return target === "" ? undefined : target;
+    }
+    if (specifier.startsWith("./") || specifier.startsWith("../")) {
+        const resolved = path.posix.normalize(path.posix.join(path.posix.dirname(fromModulePath), specifier));
+        return resolved.startsWith("../") ? undefined : resolved;
+    }
+    return undefined;
+}
+function collectDynamicImports(node, visit) {
+    if (node.type === "ImportExpression") {
+        const specifier = sourceValueOf(node);
+        if (specifier !== undefined) {
+            visit(node, specifier);
+        }
+    }
+    for (const value of Object.values(node)) {
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (isOxcNode(item)) {
+                    collectDynamicImports(item, visit);
+                }
+            }
+        }
+        else if (isOxcNode(value)) {
+            collectDynamicImports(value, visit);
+        }
+    }
+}
+/**
+ * Scans one module against its package's layers and returns the violations: the module sitting in no
+ * layer, or a value import or re-export whose target sits in a higher layer, or in none.
+ *
+ * @remarks Type-only imports and re-exports erase at build time and couple nothing, so they pass
+ * whichever way they point. Dynamic `import()` counts as a value import wherever it sits.
+ *
+ * @since 0.14.0
+ */
+export function auditLayeringSource(filePath, modulePath, sourceText, layers) {
+    const own = layers.placementOf(modulePath);
+    if (own === undefined) {
+        return [
+            {
+                line: 1,
+                raw: modulePath,
+                reason: `module sits in no configured layer — place "${layerKeyOf(modulePath)}" in one`,
+            },
+        ];
+    }
+    const violations = [];
+    const check = (node, specifier) => {
+        const target = moduleTargetOf(specifier, modulePath);
+        if (target === undefined) {
+            return;
+        }
+        const placement = layers.placementOf(target);
+        if (placement === undefined) {
+            violations.push(violationAt(sourceText, node, `imports "${specifier}", which sits in no configured layer`));
+        }
+        else if (placement.index > own.index) {
+            violations.push(violationAt(sourceText, node, `value import of "${specifier}" points up the layers — ${own.entry} (layer ${String(own.index + 1)}) reaches ${placement.entry} (layer ${String(placement.index + 1)})`));
+        }
+    };
+    const { program } = parseSync(filePath, sourceText);
+    for (const statement of programStatements(program)) {
+        const specifier = valueSpecifierOf(statement);
+        if (specifier !== undefined) {
+            check(statement, specifier);
+        }
+    }
+    if (isOxcNode(program)) {
+        collectDynamicImports(program, check);
+    }
+    violations.sort((a, b) => a.line - b.line);
+    return violations;
+}
+function violationAt(sourceText, node, reason) {
+    return {
+        line: lineOfOffset(sourceText, node.start),
+        raw: firstLineOf(sourceText.slice(node.start, node.end)),
+        reason,
+    };
+}

package/dist/audit/layers/output.d.ts

@@ -0,0 +1,7 @@
+import type { LayersAuditResult } from "#audit/domain/types";
+/**
+ * Human-readable layering report.
+ *
+ * @since 0.14.0
+ */
+export declare function presentLayersAuditResult(result: LayersAuditResult): void;

package/dist/audit/layers/output.js

@@ -0,0 +1,21 @@
+import { logger } from "#core/logger";
+/**
+ * Human-readable layering report.
+ *
+ * @since 0.14.0
+ */
+export function presentLayersAuditResult(result) {
+    for (const file of result.files) {
+        logger.out(`\n${file.relativePath}`);
+        for (const { line, raw, reason } of file.violations) {
+            logger.out(`  ${line}: ${raw} → ${reason}`);
+        }
+    }
+    const allowlistSuffix = result.allowlistedCount > 0 ? ` (${result.allowlistedCount} allowlisted)` : "";
+    if (result.violationCount > 0) {
+        logger.out(`\n✖ ${result.violationCount} layering violation(s)${allowlistSuffix}`);
+    }
+    else {
+        logger.out(`✓ Every value import points down the layers across ${result.scannedFileCount} file(s) in ${result.packageCount} package(s)${allowlistSuffix}`);
+    }
+}

package/dist/audit/layers/prepare.d.ts

@@ -0,0 +1,25 @@
+import type { LayersAuditPackage } from "#audit/layers/cli-schema";
+import type { AuditCommandPrelude } from "#audit/prepare";
+import { AppError } from "#core/errors";
+import type { Filesystem } from "#core/filesystem/filesystem";
+import type { Result } from "#core/result";
+/**
+ * The shared audit prelude plus the layered packages `audit.layers.packages` names, resolved to their roots.
+ *
+ * @since 0.14.0
+ */
+export type LayersAuditPrelude = AuditCommandPrelude & {
+    readonly packages: ReadonlyArray<LayersAuditPackage>;
+};
+/**
+ * Loads config and resolves every package `audit.layers.packages` names to the root its layers sit under.
+ *
+ * @remarks A configured name no workspace package carries, an entry nested below the root or placed
+ * twice, and a root that does not exist are each reported here, before anything is scanned.
+ *
+ * @since 0.14.0
+ */
+export declare function prepareLayersAudit(fs: Filesystem, args: {
+    readonly currentWorkingDirectory: string;
+    readonly rawTarget: string | undefined;
+}): Promise<Result<LayersAuditPrelude, AppError>>;

package/dist/audit/layers/prepare.js

@@ -0,0 +1,66 @@
+import path from "node:path";
+import { invalidLayerEntry } from "#audit/layers/domain/layering";
+import { prepareRepoRootAuditWith } from "#audit/prepare";
+import { AppError, messageFrom } from "#core/errors";
+import { err, ok } from "#core/result";
+import { listWorkspacePackageDirectories } from "#core/workspace/resolver";
+import { packageJsonFileName } from "#core/workspace/well-known-files";
+const DEFAULT_LAYERS_ROOT = "src";
+async function workspacePackageDirectoriesByName(rootDir, fs) {
+    const layout = await listWorkspacePackageDirectories(rootDir, fs, true);
+    const byName = new Map();
+    for (const directory of layout.packageDirectoryPathsAbsolute) {
+        const manifestPath = path.join(directory, packageJsonFileName);
+        if (!fs.existsSync(manifestPath)) {
+            continue;
+        }
+        const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+        if (typeof manifest === "object" && manifest !== null && "name" in manifest && typeof manifest.name === "string") {
+            byName.set(manifest.name, directory);
+        }
+    }
+    return byName;
+}
+/**
+ * Loads config and resolves every package `audit.layers.packages` names to the root its layers sit under.
+ *
+ * @remarks A configured name no workspace package carries, an entry nested below the root or placed
+ * twice, and a root that does not exist are each reported here, before anything is scanned.
+ *
+ * @since 0.14.0
+ */
+export async function prepareLayersAudit(fs, args) {
+    return prepareRepoRootAuditWith(fs, args, async (config, rootDir) => {
+        const layersConfig = config.audit?.layers;
+        const allowlist = layersConfig?.allowlist ?? [];
+        const configured = Object.entries(layersConfig?.packages ?? {});
+        if (configured.length === 0) {
+            return ok({ allowlist, packages: [] });
+        }
+        let directoryByName;
+        try {
+            directoryByName = await workspacePackageDirectoriesByName(rootDir, fs);
+        }
+        catch (caughtError) {
+            return err(new AppError("INFRA_FAILURE", messageFrom(caughtError), caughtError));
+        }
+        const packages = [];
+        for (const [name, packageConfig] of configured) {
+            const directory = directoryByName.get(name);
+            if (directory === undefined) {
+                return err(new AppError("VALIDATION_ERROR", `audit.layers.packages["${name}"]: no workspace package has that name`));
+            }
+            const invalid = invalidLayerEntry(packageConfig.layers);
+            if (invalid !== undefined) {
+                return err(new AppError("VALIDATION_ERROR", `audit.layers.packages["${name}"]: ${invalid}`));
+            }
+            const rootPath = path.join(directory, packageConfig.root ?? DEFAULT_LAYERS_ROOT);
+            if (!fs.existsSync(rootPath)) {
+                return err(new AppError("NOT_FOUND", `Not found: ${rootPath}`));
+            }
+            packages.push({ name, rootPath: fs.canonicalPathSync(rootPath), layers: packageConfig.layers });
+        }
+        packages.sort((left, right) => left.name.localeCompare(right.name));
+        return ok({ allowlist, packages });
+    });
+}

package/dist/audit/layers/run.d.ts

@@ -0,0 +1,19 @@
+import type { LayersAuditResult } from "#audit/domain/types";
+import type { LayersAuditPackage } from "#audit/layers/cli-schema";
+import { AppError } from "#core/errors";
+import type { Filesystem } from "#core/filesystem/filesystem";
+import type { Result } from "#core/result";
+/**
+ * Scans every layered package the target reaches for value imports that point up its layers.
+ *
+ * @remarks The target narrows the scan: the repo root reaches every package, a package directory
+ * reaches that package, and a path under a package's root reaches the modules beneath it.
+ *
+ * @since 0.14.0
+ */
+export declare function runLayersAudit(fs: Filesystem, args: {
+    readonly rootDir: string;
+    readonly targetPath: string;
+    readonly allowlist: ReadonlyArray<string>;
+    readonly packages: ReadonlyArray<LayersAuditPackage>;
+}): Result<LayersAuditResult, AppError>;

package/dist/audit/layers/run.js

@@ -0,0 +1,62 @@
+import path from "node:path";
+import { auditLayeringSource, LayerMap } from "#audit/layers/domain/layering";
+import { AppError, messageFrom } from "#core/errors";
+import { err, ok } from "#core/result";
+import { walkTsxFiles } from "#core/workspace/typescript-walk";
+/**
+ * Scans every layered package the target reaches for value imports that point up its layers.
+ *
+ * @remarks The target narrows the scan: the repo root reaches every package, a package directory
+ * reaches that package, and a path under a package's root reaches the modules beneath it.
+ *
+ * @since 0.14.0
+ */
+export function runLayersAudit(fs, args) {
+    try {
+        const allowlist = new Set(args.allowlist);
+        const files = [];
+        let violationCount = 0;
+        let allowlistedCount = 0;
+        let scannedFileCount = 0;
+        let packageCount = 0;
+        for (const layeredPackage of args.packages) {
+            const targetInsideRoot = isWithin(layeredPackage.rootPath, args.targetPath);
+            if (!targetInsideRoot && !isWithin(args.targetPath, layeredPackage.rootPath)) {
+                continue;
+            }
+            packageCount++;
+            const layers = new LayerMap(layeredPackage.layers);
+            const scanRoot = targetInsideRoot ? args.targetPath : layeredPackage.rootPath;
+            const filesToScan = fs.statSync(scanRoot).isFile() ? [scanRoot] : walkTsxFiles(scanRoot, fs);
+            for (const absolutePath of filesToScan) {
+                scannedFileCount++;
+                const relativePath = toPosixPath(path.relative(args.rootDir, absolutePath));
+                const modulePath = toPosixPath(path.relative(layeredPackage.rootPath, absolutePath));
+                const content = fs.readFileSync(absolutePath, "utf8");
+                const remaining = auditLayeringSource(absolutePath, modulePath, content, layers).filter(({ raw }) => {
+                    const isAllowed = allowlist.has(raw) || allowlist.has(`${relativePath}:${raw}`);
+                    if (isAllowed) {
+                        allowlistedCount++;
+                    }
+                    return !isAllowed;
+                });
+                if (remaining.length === 0) {
+                    continue;
+                }
+                violationCount += remaining.length;
+                files.push({ relativePath, violations: remaining });
+            }
+        }
+        return ok({ files, violationCount, allowlistedCount, scannedFileCount, packageCount });
+    }
+    catch (caughtError) {
+        return err(new AppError("INFRA_FAILURE", messageFrom(caughtError), caughtError));
+    }
+}
+function isWithin(parentPath, childPath) {
+    const relative = path.relative(parentPath, childPath);
+    return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}
+function toPosixPath(filePath) {
+    return filePath.split(path.sep).join("/");
+}

package/dist/audit/prepare.d.ts

@@ -28,4 +28,16 @@ export declare function resolveRepoRelativePath(rootDir: string, maybeRelative:
 export declare function prepareRepoRootAudit(fs: Filesystem, args: {
     readonly currentWorkingDirectory: string;
     readonly rawTarget: string | undefined;
-}, selectAllowlist: (config: CodefastConfig) => ReadonlyArray<string>): Promise<Result<AuditCommandPrelude, AppError>>;
+}, selectAllowlist: (config: CodefastConfig) => ReadonlyArray<string>): Promise<Result<AuditCommandPrelude, AppError>>;
+/**
+ * Loads config and resolves the repo root as the scan target, taking whatever the caller selects from the config.
+ *
+ * @remarks The selection runs with the root resolved, so it may read the workspace and refuse a
+ * config that names what the workspace does not hold, before anything is scanned.
+ *
+ * @since 0.14.0
+ */
+export declare function prepareRepoRootAuditWith<Selected extends Pick<AuditCommandPrelude, "allowlist">>(fs: Filesystem, args: {
+    readonly currentWorkingDirectory: string;
+    readonly rawTarget: string | undefined;
+}, select: (config: CodefastConfig, rootDir: string) => Promise<Result<Selected, AppError>>): Promise<Result<Omit<AuditCommandPrelude, "allowlist"> & Selected, AppError>>;

package/dist/audit/prepare.js

@@ -19,6 +19,17 @@ export function resolveRepoRelativePath(rootDir, maybeRelative) {
  * @since 0.11.0
  */
 export async function prepareRepoRootAudit(fs, args, selectAllowlist) {
+    return prepareRepoRootAuditWith(fs, args, (config) => Promise.resolve(ok({ allowlist: selectAllowlist(config) })));
+}
+/**
+ * Loads config and resolves the repo root as the scan target, taking whatever the caller selects from the config.
+ *
+ * @remarks The selection runs with the root resolved, so it may read the workspace and refuse a
+ * config that names what the workspace does not hold, before anything is scanned.
+ *
+ * @since 0.14.0
+ */
+export async function prepareRepoRootAuditWith(fs, args, select) {
     let rootDir;
     try {
         rootDir = fs.canonicalPathSync(resolveProjectRoot(args.currentWorkingDirectory, fs).rootDir);
@@ -34,9 +45,13 @@ export async function prepareRepoRootAudit(fs, args, selectAllowlist) {
     if (!fs.existsSync(targetPath)) {
         return err(new AppError("NOT_FOUND", `Not found: ${targetPath}`));
     }
+    const selected = await select(loadedOutcome.value.config, rootDir);
+    if (!selected.ok) {
+        return selected;
+    }
     return ok({
         rootDir,
         targetPath: fs.canonicalPathSync(targetPath),
-        allowlist: selectAllowlist(loadedOutcome.value.config),
+        ...selected.value,
     });
 }

package/dist/audit/publish/cli-result.d.ts

@@ -1,6 +1,6 @@
 import type { PublishAuditResult } from "#audit/domain/types";
 /**
- * Exit `1` when any `#/` import or unshipped publish target remains.
+ * Exit `1` when any `#/` import, unshipped publish target, or unreachable stylesheet source remains.
  *
  * @since 0.12.0
  */

package/dist/audit/publish/cli-result.js

@@ -1,11 +1,11 @@
 import { CLI_EXIT_GENERAL_ERROR, CLI_EXIT_SUCCESS } from "#core/exit-codes";
 /**
- * Exit `1` when any `#/` import or unshipped publish target remains.
+ * Exit `1` when any `#/` import, unshipped publish target, or unreachable stylesheet source remains.
  *
  * @since 0.12.0
  */
 export function exitCodeForPublishAuditResult(result) {
-    return result.legacyImportCount > 0 || result.unshipped.length > 0 ? CLI_EXIT_GENERAL_ERROR : CLI_EXIT_SUCCESS;
+    return isCleanPublishAudit(result) ? CLI_EXIT_SUCCESS : CLI_EXIT_GENERAL_ERROR;
 }
 /**
  * Machine-readable publish audit summary for `--json`.
@@ -15,8 +15,11 @@ export function exitCodeForPublishAuditResult(result) {
 export function formatPublishAuditJsonOutput(result, rootDir) {
     return JSON.stringify({
         schemaVersion: 1,
-        ok: result.legacyImportCount === 0 && result.unshipped.length === 0,
+        ok: isCleanPublishAudit(result),
         cwd: rootDir,
         result,
     });
+}
+function isCleanPublishAudit(result) {
+    return result.legacyImportCount === 0 && result.unshipped.length === 0 && result.unreachableStylesheets.length === 0;
 }

package/dist/audit/publish/domain/stylesheet-sources.d.ts

@@ -0,0 +1,22 @@
+/** Reads the paths a stylesheet registers with Tailwind's `@source` and checks them against a shipped file list. */
+import type { StylesheetSource } from "#audit/domain/types";
+/**
+ * Every path a stylesheet registers with `@source`, with the line it sits on.
+ *
+ * @since 0.13.0
+ */
+export declare function scanStylesheetSources(content: string): Array<StylesheetSource>;
+/**
+ * Whether a stylesheet's `@source` paths all miss the files its package ships.
+ *
+ * @remarks Paths are package-relative and POSIX. A path that leaves the package names another package's files, which
+ * this tarball cannot vouch for, so it is not judged. One reachable path is enough: a workspace-only lane beside the
+ * published one is expected.
+ *
+ * @param stylesheetPath - The stylesheet, relative to its package root.
+ * @param sources - What {@link scanStylesheetSources} found in it.
+ * @param shippedFiles - Every file the package's tarball ships, relative to the package root.
+ *
+ * @since 0.13.0
+ */
+export declare function missesShippedFiles(stylesheetPath: string, sources: ReadonlyArray<StylesheetSource>, shippedFiles: ReadonlyArray<string>): boolean;

package/dist/audit/publish/domain/stylesheet-sources.js

@@ -0,0 +1,64 @@
+/** Reads the paths a stylesheet registers with Tailwind's `@source` and checks them against a shipped file list. */
+import path from "node:path";
+import { createAnyGlobMatcher } from "#core/glob";
+import { lineOfOffset } from "#core/source-position";
+// A plain `@source "<path>";` — `@source not …` excludes paths and `@source inline(…)` names classes, so neither
+// registers files.
+const SOURCE_DIRECTIVE = /@source\s+(["'])([^"']+)\1\s*;/g;
+// A string or a comment. Strings match first, so the `/**/` of a quoted glob is never read as a comment.
+const STRING_OR_COMMENT = /("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*')|\/\*[\s\S]*?\*\//g;
+const GLOB_CHARACTERS = /[*?[\]{}]/;
+/**
+ * Every path a stylesheet registers with `@source`, with the line it sits on.
+ *
+ * @since 0.13.0
+ */
+export function scanStylesheetSources(content) {
+    // Blanking comments keeps every offset in place, so a commented-out directive drops out and lines still count.
+    const code = content.replaceAll(STRING_OR_COMMENT, (match, quoted) => quoted ?? match.replaceAll(/[^\n]/g, " "));
+    const found = [];
+    for (const match of code.matchAll(SOURCE_DIRECTIVE)) {
+        const pattern = match[2];
+        if (pattern !== undefined) {
+            found.push({ line: lineOfOffset(code, match.index), pattern });
+        }
+    }
+    return found;
+}
+/**
+ * Whether a stylesheet's `@source` paths all miss the files its package ships.
+ *
+ * @remarks Paths are package-relative and POSIX. A path that leaves the package names another package's files, which
+ * this tarball cannot vouch for, so it is not judged. One reachable path is enough: a workspace-only lane beside the
+ * published one is expected.
+ *
+ * @param stylesheetPath - The stylesheet, relative to its package root.
+ * @param sources - What {@link scanStylesheetSources} found in it.
+ * @param shippedFiles - Every file the package's tarball ships, relative to the package root.
+ *
+ * @since 0.13.0
+ */
+export function missesShippedFiles(stylesheetPath, sources, shippedFiles) {
+    const patterns = sources.flatMap((source) => packagePatternsFor(stylesheetPath, source.pattern));
+    if (patterns.length === 0) {
+        return false;
+    }
+    const isReached = createAnyGlobMatcher(patterns, { dot: true });
+    return !shippedFiles.some(isReached);
+}
+// Tailwind resolves a `@source` path against the stylesheet's directory; a path without a glob is a file or a
+// directory, and a directory registers everything beneath it.
+function packagePatternsFor(stylesheetPath, pattern) {
+    if (path.posix.isAbsolute(pattern)) {
+        return [];
+    }
+    const resolved = path.posix.normalize(path.posix.join(path.posix.dirname(stylesheetPath), pattern));
+    if (resolved === ".." || resolved.startsWith("../")) {
+        return [];
+    }
+    if (GLOB_CHARACTERS.test(resolved)) {
+        return [resolved];
+    }
+    const withoutTrailingSlash = resolved.replace(/\/+$/, "");
+    return withoutTrailingSlash === "." ? ["**"] : [withoutTrailingSlash, `${withoutTrailingSlash}/**`];
+}

package/dist/audit/publish/output.js

@@ -14,11 +14,20 @@ export function presentPublishAuditResult(result) {
     for (const { packageName, field, subpath, target } of result.unshipped) {
         logger.out(`\n${packageName}: ${field}["${subpath}"] → ${target} is not shipped by "files"`);
     }
-    const problems = result.legacyImportCount + result.unshipped.length;
+    for (const { packageName, stylesheet, sources, missingFilesEntries } of result.unreachableStylesheets) {
+        logger.out(`\n${packageName}: ${stylesheet} registers no file the tarball ships`);
+        for (const { line, pattern } of sources) {
+            logger.out(`  ${line}: @source "${pattern}"`);
+        }
+        if (missingFilesEntries.length > 0) {
+            logger.out(`  not on disk: ${missingFilesEntries.join(", ")} — build the package first`);
+        }
+    }
+    const problems = result.legacyImportCount + result.unshipped.length + result.unreachableStylesheets.length;
     if (problems > 0) {
-        logger.out(`\n✖ ${result.legacyImportCount} legacy "#/" import(s), ${result.unshipped.length} unshipped target(s)`);
+        logger.out(`\n✖ ${result.legacyImportCount} legacy "#/" import(s), ${result.unshipped.length} unshipped target(s), ${result.unreachableStylesheets.length} stylesheet(s) registering nothing shipped`);
     }
     else {
-        logger.out(`✓ No "#/" imports across ${result.scannedFileCount} file(s); every publish target ships across ${result.packageCount} package(s)`);
+        logger.out(`✓ No "#/" imports across ${result.scannedFileCount} file(s); every publish target and stylesheet source ships across ${result.packageCount} package(s)`);
     }
 }

package/dist/audit/publish/run.d.ts

@@ -4,7 +4,8 @@ import type { Filesystem } from "#core/filesystem/filesystem";
 import type { Result } from "#core/result";
 /**
  * Reports what would break a consumer's install: a `#/`-prefixed import Node's ESM resolver rejects on
- * the floor, and an `exports`/`imports` target the slimmed publish manifest does not ship.
+ * the floor, an `exports`/`imports` target the slimmed publish manifest does not ship, and a shipped
+ * stylesheet whose `@source` paths reach none of the files that do ship.
  *
  * @since 0.12.0
  */