@dataimago/css-neutral 0.1.0-alpha.12 → 0.1.0-alpha.13

package/README.md

@@ -67,6 +67,112 @@ in CI: it fails on any drift. The shipped outputs are listed in `dist/outputs.js
 (e.g. `https://unpkg.com/@dataimago/css-neutral@<version>/dist/outputs.json`). See
 [`wiki/patterns/new-consumer-checklist.md`](../../wiki/patterns/new-consumer-checklist.md).
 
+## Fonts
+
+The package ships the token fonts as WOFF2 files, so a site or document does not depend on Google's CDN. Everything is under `dist/fonts/`, one directory per script, each with a `fonts.css` of `@font-face` rules and the licence text:
+
+- Noto Sans, upright and italic, variable in weight (100 to 900), width pinned at 100.
+- Noto Sans Mono, upright only, variable in weight (100 to 900).
+- Noto Sans Math, one static weight (400), for equations.
+
+Directories: latin, latin-ext, greek, greek-ext, cyrillic, cyrillic-ext, vietnamese, math. Each `@font-face` uses `font-display: swap`, a weight range read from the font file, and a `unicode-range` on the subset files, so a browser downloads only the scripts a page renders. There is no `local()` source and no preload. Subsets keep every layout feature the kept text uses; `lnum` and `tnum` work in Noto Sans. Noto Sans Mono's digits are monospaced and lining by design, and it has no figure features. `dist/fonts/lang.css` holds the language rules (below). The licence is OFL-1.1; `dist/fonts/` carries each licence file.
+
+This package omits Josefin Sans: its tokens do not name it. `@dataimago/css` ships it.
+
+Combining marks: the `latin` and `latin-ext` files also carry the whole combining-diacritics block (U+0300-036F), a documented addition to Google's ranges, so decomposed accents (for example e + U+0301, or o + U+031B) draw from the same file as their base letter.
+
+### Using them
+
+`dist/fonts/**` is listed in `dist/outputs.json`, so `dataimago-sync` copies it. A key ending in `/` maps a whole directory to a destination ending in `/`.
+
+**A web page.** Map every script you ship and `fonts/lang.css`, then link the CSS files. The browser fetches only what the page renders.
+
+```json
+{ "package": "@dataimago/css-neutral", "version": "<exact version>",
+  "outputs": { "fonts/latin/": "assets/fonts/latin/", "fonts/latin-ext/": "assets/fonts/latin-ext/",
+               "fonts/greek/": "assets/fonts/greek/", "fonts/greek-ext/": "assets/fonts/greek-ext/",
+               "fonts/cyrillic/": "assets/fonts/cyrillic/", "fonts/cyrillic-ext/": "assets/fonts/cyrillic-ext/",
+               "fonts/vietnamese/": "assets/fonts/vietnamese/",
+               "fonts/math/": "assets/fonts/math/", "fonts/lang.css": "assets/fonts/" } }
+```
+
+**A self-contained Quarto output** (`embed-resources: true`). Map only the scripts the work's language needs, for example `fonts/latin/` and `fonts/latin-ext/` (add `fonts/vietnamese/` for Vietnamese text), plus `fonts/math/` if the work has equations and `fonts/lang.css`. List each CSS file under `css:` in `_quarto.yml` and set `html-math-method: mathml`. Quarto then embeds just the files those rules reach.
+
+```yaml
+format:
+  html:
+    embed-resources: true
+    html-math-method: mathml
+    css:
+      - assets/fonts/latin/fonts.css
+      - assets/fonts/latin-ext/fonts.css
+      - assets/fonts/vietnamese/fonts.css
+      - assets/fonts/math/fonts.css
+      - assets/fonts/lang.css
+```
+
+**A translated work in a script the package does not ship** (Arabic, Hebrew, Devanagari, and so on). `lang.css` already names the family. Load it from Google Fonts on the web, or make the files yourself (see "Making a script the package does not ship") and keep them in the work's own repository.
+
+### Other languages
+
+Text in another language must carry a `lang` attribute, or the browser applies its own fallback. In Quarto write `[text]{lang=ar}` for a span, a fenced div `::: {lang=ar}` for a block, or `lang: ar` in the front matter for a whole work. `lang.css` maps each language to a family by `:lang()` and rebinds the display variables on headings and navigation only; the brand mark, code and maths are left alone. The tags `zh-CN`, `zh-SG` and bare `zh` map to Noto Sans SC (bare `zh` is treated as Simplified); `zh-TW`, `zh-HK` and `zh-MO` map to Noto Sans TC. Tag Traditional text `zh-Hant` or a Traditional region.
+
+### Maths
+
+Equations use native MathML in `Noto Sans Math` (`font.family.math` is `Noto Sans Math, math`, so a reader without the font gets the browser's maths face). Set `html-math-method: mathml`. MathJax and KaTeX bring their own fonts, and with `embed-resources` Quarto fetches them from the network unless `self-contained-math` is set. A property that chooses one of them is outside this contract.
+
+### Synthesised oblique
+
+Noto Sans Mono ships upright only. Italic text in them is the browser's synthesised oblique. Noto Sans has a true italic.
+
+### Preloading
+
+Preloading is yours to opt into; the package does not. For the Latin body file, in the page head:
+
+```html
+<link rel="preload" as="font" type="font/woff2" href="/assets/fonts/latin/noto-sans.woff2" crossorigin>
+```
+
+`crossorigin` is required even for a same-origin font, or the browser fetches it twice.
+
+### Caching
+
+File names are stable and change only when a family changes, so serve them with revalidation. That is the default on the hosts these properties use (confirmed 2026-10-31): GitHub Pages sends `cache-control: max-age=600` with an ETag, and Vercel serves static files with `public, max-age=0, must-revalidate`. Do not set a long immutable lifetime.
+
+### The Google alternative
+
+A project that does not sync files can link Google's CDN instead. The house query is shown for reference; css-neutral ships no Josefin Sans, so drop the `family=Josefin+Sans:wght@100..700&` part:
+
+```
+https://fonts.googleapis.com/css2?family=Josefin+Sans:wght@100..700&family=Noto+Sans:ital,wdth,wght@0,100,100..900;1,100,100..900&family=Noto+Sans+Math&family=Noto+Sans+Mono:wght@100..900&display=swap
+```
+
+Add `lang.css` as well. This loads full variable files from Google rather than the subsets, so a self-contained Quarto output becomes much larger. The Google route serves Google's own ranges, so decomposed accents using U+0302, U+0306 or U+031B fall back there (and on sites built from the Quarto website template, which uses that route); the shipped files carry the combining marks in the Latin files.
+
+### Making a script the package does not ship
+
+`subset.mjs` in the dataimago-design repository has an out mode that fetches a pinned upstream file, checks its digest, subsets it and writes `<script>/<family>.woff2`, `<script>/fonts.css` and the licence into a directory outside `packages/`. It refuses a family whose licence reserves the font name.
+
+```bash
+node tools/fonts/subset.mjs --out ../my-work/fonts \
+  --upstream <url pinned to a tag or commit> --sha256 <hex> --script arabic \
+  [--unicode-range "U+0600-06FF, U+200C-200E"] [--style normal|italic] \
+  --licence-url <url> --licence-sha256 <hex> \
+  [--member <path in archive> --member-sha256 <hex>] \
+  [--licence-member <path> --licence-member-sha256 <hex>]
+```
+
+Without the tool, fontTools (the repository pins Python 3.13 and `tools/fonts/requirements.txt`) does the same in two steps. Pin the width axis if the font has one, then subset keeping every layout feature:
+
+```bash
+fonttools varLib.instancer NotoSansArabic[wdth,wght].ttf wdth=100 --no-recalc-timestamp -o instanced.ttf
+pyftsubset instanced.ttf --unicodes="U+0600-06FF,U+200C-200E" --layout-features='*' \
+  --name-IDs='*' --name-languages='*' --notdef-outline --no-recalc-timestamp \
+  --flavor=woff2 --output-file=noto-sans-arabic.woff2
+```
+
+To wrap a file as WOFF2 without subsetting: `fonttools ttLib.woff2 compress -o out.woff2 in.ttf`. (The repository's tool also turns off table transforms so the tables stay byte-identical; the command line does not, so the bytes can differ while the font is the same.) Write the `@font-face` rule with `font-display: swap`, the font's own weight range and `unicode-range`, and no `local()`.
+
 ## Architectural notes
 
 Variant A of the two-tier identity pattern — see [`wiki/decisions/tokens-neutral-sibling.md`](../../wiki/decisions/tokens-neutral-sibling.md) for the full rationale, including the iteration-4 deprecation target (Variant B: neutral-as-base + `@dataimago/dataimago-theme` overlay).

package/dist/bin/dataimago-sync.mjs

@@ -27,6 +27,10 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const LOCAL = 'local-unreleased';
+// Extensions whose files carry a stamp (mirrors kindOf in tools/formats/build-outputs.mjs; the
+// self-test pins the two together). Everything else is binary: copied byte for byte, never stamped.
+const TEXT_EXT = ['.scss', '.css', '.sty', '.tex', '.r', '.json', '.md', '.qmd', '.yml', '.js', '.lua', '.template'];
+const isText = (distPath) => TEXT_EXT.includes(path.extname(distPath.replace(/\.template$/, '')).toLowerCase());
 
 class ConfigError extends Error {}
 
@@ -46,6 +50,11 @@ const USAGE = `dataimago-sync — copy a pinned @dataimago release's design file
   dataimago-sync --config <file>     read design.json from <file>
   dataimago-sync --help              this text
 
+An outputs key ending in "/" copies every file the release lists under it into a destination
+that also ends in "/". That directory is owned by the output; files in it the release does not
+list are reported (--check fails on them) but never deleted. Binary files (fonts, licence text)
+are copied byte for byte and carry no stamp.
+
 Run it from the pinned release: npx -p @dataimago/css@<version> dataimago-sync`;
 
 const FLAGS = new Set(['--check', '--help', '--self-test']);
@@ -117,60 +126,158 @@ function plan(args) {
 
   const manifest = readJson(path.join(pkgRoot, 'dist', 'outputs.json'), 'outputs.json (is the package built?)');
   const available = Object.keys(manifest.files ?? {});
+  const dirKeys = [...new Set(available.flatMap((k) => k.split('/').slice(0, -1).map((_, i, parts) => parts.slice(0, i + 1).join('/') + '/')))].sort();
+  const realRoot = fs.realpathSync(consumerRoot);
   const steps = [];
+  const dirs = [];
   const problems = [];
+
+  /** Resolve a consumer-relative spec to an absolute path inside the root, or record why not. */
+  const inside = (key, destSpec, asDir) => {
+    if (typeof destSpec !== 'string' || destSpec === '' || path.isAbsolute(destSpec)) {
+      problems.push(`destination for "${key}" must be a relative path inside the consumer, got ${JSON.stringify(destSpec)}`);
+      return null;
+    }
+    const abs = path.resolve(consumerRoot, destSpec);
+    const rel = path.relative(consumerRoot, abs);
+    if (rel.startsWith('..') || path.isAbsolute(rel)) {
+      problems.push(`destination for "${key}" escapes the consumer root: ${destSpec}`);
+      return null;
+    }
+    if (rel === '' && asDir) {
+      problems.push(`destination for "${key}" is the consumer root; give a sub-directory`);
+      return null;
+    }
+    return { abs, rel };
+  };
+
   for (const [key, destSpec] of Object.entries(design.outputs)) {
+    if (key.endsWith('/')) {
+      const members = available.filter((k) => k.startsWith(key));
+      if (!members.length) {
+        problems.push(`${design.package} does not ship "${key}". Available outputs:\n    ${[...dirKeys, ...available].join('\n    ')}`);
+        continue;
+      }
+      if (typeof destSpec !== 'string' || !destSpec.endsWith('/')) {
+        problems.push(`destination for directory output "${key}" must end in "/", got ${JSON.stringify(destSpec)}`);
+        continue;
+      }
+      const d = inside(key, destSpec, true);
+      if (!d) continue;
+      dirs.push({ key, dest: d.abs, rel: d.rel });
+      for (const m of members) {
+        const dest = path.join(d.abs, m.slice(key.length));
+        steps.push({ key: m, src: path.join(pkgRoot, 'dist', m), dest, rel: path.relative(consumerRoot, dest), dirKey: key });
+      }
+      continue;
+    }
     if (!available.includes(key)) {
-      problems.push(`${design.package} does not ship "${key}". Available outputs:\n    ${available.join('\n    ')}`);
+      problems.push(`${design.package} does not ship "${key}". Available outputs:\n    ${[...dirKeys, ...available].join('\n    ')}`);
       continue;
     }
     if (typeof destSpec !== 'string' || destSpec === '' || path.isAbsolute(destSpec)) {
       problems.push(`destination for "${key}" must be a relative path inside the consumer, got ${JSON.stringify(destSpec)}`);
       continue;
     }
-    const dest = path.resolve(consumerRoot, destSpec.endsWith('/') ? path.join(destSpec, path.basename(key)) : destSpec);
-    const rel = path.relative(consumerRoot, dest);
-    if (rel.startsWith('..') || path.isAbsolute(rel)) {
-      problems.push(`destination for "${key}" escapes the consumer root: ${destSpec}`);
-      continue;
-    }
-    if (rel === '' || (fs.existsSync(dest) && fs.statSync(dest).isDirectory())) {
+    const d = inside(key, destSpec.endsWith('/') ? path.join(destSpec, path.basename(key)) : destSpec, false);
+    if (!d) continue;
+    if (d.rel === '' || (fs.existsSync(d.abs) && fs.statSync(d.abs).isDirectory())) {
       problems.push(`destination for "${key}" is a directory: write "${destSpec.replace(/\/?$/, '/')}" to put the file inside it`);
       continue;
     }
-    if (steps.some((s) => s.dest === dest)) {
-      problems.push(`two outputs are mapped to the same destination: ${rel}`);
-      continue;
+    steps.push({ key, src: path.join(pkgRoot, 'dist', key), dest: d.abs, rel: d.rel });
+  }
+
+  const exists = (p) => { try { fs.lstatSync(p); return true; } catch { return false; } };
+  // A directory output owns its destination.
+  const within = (child, parent) => child === parent || child.startsWith(parent + path.sep);
+  for (let i = 0; i < dirs.length; i++) {
+    for (let j = i + 1; j < dirs.length; j++) {
+      if (within(dirs[i].dest, dirs[j].dest) || within(dirs[j].dest, dirs[i].dest)) {
+        problems.push(`directory outputs "${dirs[i].key}" and "${dirs[j].key}" share or nest destinations (${dirs[i].rel}, ${dirs[j].rel}); a directory owns its destination`);
+      }
     }
-    steps.push({ key, src: path.join(pkgRoot, 'dist', key), dest, rel });
+  }
+  for (const s of steps) {
+    if (s.dirKey) continue;
+    const owner = dirs.find((d) => within(s.dest, d.dest));
+    if (owner) problems.push(`"${s.key}" is mapped into ${s.rel}, which directory output "${owner.key}" owns`);
+  }
+  for (const s of steps) {
+    if (s.dirKey && exists(s.dest) && fs.statSync(s.dest).isDirectory()) {
+      problems.push(`"${s.key}" would be written to ${s.rel}, which is an existing directory`);
+    }
+    const blocked = steps.find((o) => o !== s && within(o.dest, s.dest));
+    if (blocked) problems.push(`"${s.key}" is mapped to ${s.rel}, which is a parent directory of ${blocked.rel}`);
+  }
+  const seen = new Set();
+  for (const s of steps) {
+    if (seen.has(s.dest)) problems.push(`two outputs are mapped to the same destination: ${s.rel}`);
+    seen.add(s.dest);
+  }
+
+  // Resolve symlinks: the nearest existing ancestor of every destination must stay inside the root.
+  const escapes = (dest) => {
+    let at = dest;
+    while (!exists(at)) at = path.dirname(at);
+    let real;
+    try { real = fs.realpathSync(at); } catch { return true; }
+    return !within(real, realRoot);
+  };
+  for (const target of [...dirs.map((d) => ({ key: d.key, dest: d.dest })), ...steps]) {
+    if (escapes(target.dest)) problems.push(`destination for "${target.key}" resolves outside the consumer root through a symlink`);
   }
   if (problems.length) throw new ConfigError(problems.join('\n  '));
-  return { steps, design, local };
+
+  // Files under a directory destination that the release does not list (symlinks are never followed).
+  const listed = new Set(steps.map((s) => s.dest));
+  const extras = [];
+  const walk = (dir) => {
+    let entries;
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      const p = path.join(dir, e.name);
+      if (e.isSymbolicLink()) extras.push(path.relative(consumerRoot, p));
+      else if (e.isDirectory()) walk(p);
+      else if (!listed.has(p)) extras.push(path.relative(consumerRoot, p));
+    }
+  };
+  for (const d of dirs) if (exists(d.dest)) walk(d.dest);
+  return { steps, design, local, extras };
 }
 
 function sync(args) {
-  const { steps, design, local } = plan(args);
+  const { steps, design, local, extras } = plan(args);
   for (const { key, src, dest, rel } of steps) {
     let bytes = fs.readFileSync(src);
-    if (local) bytes = Buffer.from(localize(bytes.toString('utf8'), key, design.package, local.version, local.sha));
+    if (local && isText(key)) bytes = Buffer.from(localize(bytes.toString('utf8'), key, design.package, local.version, local.sha));
     fs.mkdirSync(path.dirname(dest), { recursive: true });
-    fs.writeFileSync(dest, bytes);
+    const tmp = `${dest}.dataimago-sync-tmp-${process.pid}`;
+    try {
+      fs.writeFileSync(tmp, bytes);
+      fs.renameSync(tmp, dest);
+    } catch (e) {
+      fs.rmSync(tmp, { force: true });
+      throw e;
+    }
     console.log(`  ✓ ${rel}  ← ${design.package}@${local ? `${LOCAL}(${local.sha})` : design.version} dist/${key}`);
   }
+  for (const rel of extras) console.warn(`  ! ${rel}: not in ${design.package}@${local ? `${LOCAL}(${local.sha})` : design.version}; sync never deletes, remove it`);
   if (local) console.log(`\n⚠ local, unreleased design files: \`dataimago-sync --check\` fails until you re-sync from a release.`);
   return 0;
 }
 
 function check(args) {
-  const { steps, design } = plan(args.filter((a) => a !== '--check'));
+  const { steps, design, extras } = plan(args.filter((a) => a !== '--check'));
   const failures = [];
-  for (const { src, dest, rel } of steps) {
+  for (const { key, src, dest, rel } of steps) {
     if (!fs.existsSync(dest)) { failures.push(`${rel}: missing`); continue; }
     const have = fs.readFileSync(dest);
     // The marker lives in the stamp: line 1, or the leading _meta object of a JSON file.
-    if (have.subarray(0, 1024).includes(LOCAL)) { failures.push(`${rel}: written by --from (local, unreleased); re-sync from a release`); continue; }
+    if (isText(key) && have.subarray(0, 1024).includes(LOCAL)) { failures.push(`${rel}: written by --from (local, unreleased); re-sync from a release`); continue; }
     if (!have.equals(fs.readFileSync(src))) failures.push(`${rel}: differs from ${design.package}@${design.version}`);
   }
+  for (const rel of extras) failures.push(`${rel}: not in ${design.package}@${design.version}; sync never deletes, remove it`);
   for (const f of failures) console.error(`  ✗ ${f}`);
   if (failures.length) {
     console.error(`\n✗ dataimago-sync --check: ${failures.length} file(s) out of sync. Run: npx -p ${design.package}@${design.version} dataimago-sync`);
@@ -211,6 +318,7 @@ async function selfTest() {
   }
   const { stamp, stampJson } = await import(stampUrl);
   const assert = (await import('node:assert/strict')).default;
+  const { randomBytes } = await import('node:crypto');
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'di-sync-'));
 
   // A fake published package: <tmp>/pkg with dist/{quarto/a.scss, dataviz/p.json, outputs.json, bin/}.
@@ -218,6 +326,9 @@ async function selfTest() {
     const files = {
       'quarto/a.scss': stamp({ kind: 'scss', pkg: name, version, distPath: 'quarto/a.scss', body: '$x: 1 !default;\n' }),
       'dataviz/p.json': stampJson({ pkg: name, version, distPath: 'dataviz/p.json', data: { a: '#E69F00' } }),
+      'fonts/latin/fonts.css': stamp({ kind: 'css', pkg: name, version, distPath: 'fonts/latin/fonts.css', body: '@font-face { font-family: "Noto Sans"; src: url(x.woff2) format("woff2"); }\n' }),
+      'fonts/latin/x.woff2': Buffer.concat([Buffer.from([0xff, 0x00, 0xfe, 0x80]), randomBytes(28)]),
+      'fonts/latin/OFL.txt': 'SIL Open Font License 1.1\n',
     };
     fs.mkdirSync(path.join(root, 'dist', 'bin'), { recursive: true });
     fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({ name, version }));
@@ -334,6 +445,157 @@ async function selfTest() {
   assert.equal(r.status, 2);
   assert.ok(!exists('same.txt'));
 
+  // TEXT_EXT must stay inside what build-outputs' kindOf stamps, and binaries must stay outside it.
+  const { kindOf } = await import(new URL('./build-outputs.mjs', import.meta.url));
+  // True iff: an extension is in TEXT_EXT exactly when kindOf stamps it (non-binary).
+  const { KIND_BY_EXT, BINARY_EXT } = await import(new URL('./build-outputs.mjs', import.meta.url));
+  const kindFor = (ext) => kindOf(ext === '.template' ? 'x.md.template' : `x${ext}`);
+  for (const ext of TEXT_EXT) {
+    if (ext === '.template') continue; // an alias for the inner extension, not a kind of its own
+    assert.ok(ext in KIND_BY_EXT, `TEXT_EXT ${ext} maps to a stamp kind`);
+    assert.notEqual(kindFor(ext), 'binary', `kindOf stamps ${ext}`);
+  }
+  assert.ok(TEXT_EXT.includes('.template'), '.template is a text extension');
+  for (const ext of Object.keys(KIND_BY_EXT)) assert.ok(TEXT_EXT.includes(ext), `${ext} is stamped by kindOf, so TEXT_EXT must list it`);
+  for (const ext of BINARY_EXT) {
+    assert.ok(!TEXT_EXT.includes(ext), `${ext} is binary for sync`);
+    assert.equal(kindFor(ext), 'binary', `kindOf calls ${ext} binary`);
+  }
+
+  // Directory-output helpers: a clean consumer with the given outputs.
+  const fontsOut = { 'fonts/latin/': 'assets/fonts/latin/' };
+  const fresh = (outputs) => {
+    fs.rmSync(consumer, { recursive: true, force: true });
+    fs.mkdirSync(consumer, { recursive: true });
+    writeDesign({ ...base, outputs });
+  };
+  const bytes = (rel) => fs.readFileSync(path.join(consumer, rel));
+  const distBytes = (root, key) => fs.readFileSync(path.join(root, 'dist', key));
+
+  // (l) a directory output copies every listed file, byte-identical.
+  fresh(fontsOut);
+  r = run();
+  assert.equal(r.status, 0, r.stderr);
+  for (const f of ['fonts.css', 'x.woff2', 'OFL.txt']) {
+    assert.deepEqual(bytes(`assets/fonts/latin/${f}`), distBytes(path.join(tmp, 'pkg'), `fonts/latin/${f}`), f);
+  }
+  assert.equal(run('--check').status, 0);
+  // A directory key nothing lives under is "not shipped" and lists directory keys too.
+  fresh({ 'fonts/greek/': 'assets/fonts/greek/' });
+  r = run();
+  assert.equal(r.status, 2);
+  assert.match(r.stderr, /fonts\/greek\//);
+  assert.match(r.stderr, /fonts\/latin\//);
+
+  // (m) a directory output's destination must end in /.
+  fresh({ 'fonts/latin/': 'assets/fonts' });
+  r = run();
+  assert.equal(r.status, 2);
+  assert.ok(!exists('assets'), 'nothing written');
+
+  // (n) a directory owns its destination.
+  fresh({ 'fonts/latin/': 'assets/fonts/latin/', 'dataviz/p.json': 'assets/fonts/latin/p.json' });
+  r = run();
+  assert.equal(r.status, 2);
+  assert.ok(!exists('assets'), 'nothing written when a file lands in a directory output');
+  fresh({ 'quarto/': 'assets/fonts/latin/', 'fonts/latin/': 'assets/fonts/' });
+  r = run();
+  assert.equal(r.status, 2);
+  assert.ok(!exists('assets'), 'nothing written when directory outputs nest');
+
+  // (n2) a file output at a directory destination's ancestor, and a member landing on a directory.
+  fresh({ 'fonts/latin/x.woff2': 'assets/f', 'fonts/latin/': 'assets/f/latin/' });
+  r = run();
+  assert.equal(r.status, 2, r.stderr);
+  assert.ok(!exists('assets'), 'nothing written when a file is an ancestor of a directory destination');
+  fresh(fontsOut);
+  fs.mkdirSync(path.join(consumer, 'assets/fonts/latin/x.woff2'), { recursive: true });
+  r = run();
+  assert.equal(r.status, 2, r.stderr);
+  assert.ok(!exists('assets/fonts/latin/fonts.css'), 'nothing written when a member lands on a directory');
+
+  // (o) a stale file is named and kept: sync warns, --check fails.
+  fresh(fontsOut);
+  assert.equal(run().status, 0);
+  fs.writeFileSync(path.join(consumer, 'assets/fonts/latin/old.woff2'), 'stale');
+  r = run();
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout + r.stderr, /old\.woff2/);
+  assert.ok(exists('assets/fonts/latin/old.woff2'), 'sync never deletes');
+  r = run('--check');
+  assert.equal(r.status, 1);
+  assert.match(r.stderr, /old\.woff2/);
+  assert.match(r.stderr, /sync never deletes/);
+  // A symlink inside the destination is an extra too, and is left alone.
+  fs.rmSync(path.join(consumer, 'assets/fonts/latin/old.woff2'));
+  fs.symlinkSync(tmp, path.join(consumer, 'assets/fonts/latin/link'));
+  r = run('--check');
+  assert.equal(r.status, 1);
+  assert.match(r.stderr, /link/);
+  assert.equal(run().status, 0);
+  assert.ok(fs.lstatSync(path.join(consumer, 'assets/fonts/latin/link')).isSymbolicLink());
+
+  // (p) a byte edit and a deletion both fail --check.
+  fresh(fontsOut);
+  assert.equal(run().status, 0);
+  const woff = path.join(consumer, 'assets/fonts/latin/x.woff2');
+  const edited = fs.readFileSync(woff);
+  edited[5] ^= 0x01;
+  fs.writeFileSync(woff, edited);
+  r = run('--check');
+  assert.equal(r.status, 1);
+  assert.match(r.stderr, /x\.woff2/);
+  assert.equal(run().status, 0);
+  fs.rmSync(woff);
+  r = run('--check');
+  assert.equal(r.status, 1);
+  assert.match(r.stderr, /x\.woff2/);
+
+  // (q) --from leaves binaries byte-identical and localizes only stamped text.
+  fresh(fontsOut);
+  r = run('--from', path.join(tmp, 'checkout'));
+  assert.equal(r.status, 0, r.stderr);
+  const co = path.join(tmp, 'checkout', 'packages', 'css');
+  assert.deepEqual(bytes('assets/fonts/latin/x.woff2'), distBytes(co, 'fonts/latin/x.woff2'));
+  assert.deepEqual(bytes('assets/fonts/latin/OFL.txt'), distBytes(co, 'fonts/latin/OFL.txt'));
+  assert.match(bytes('assets/fonts/latin/fonts.css').toString('utf8').split('\n')[0], new RegExp(LOCAL));
+  assert.equal(run('--check').status, 1);
+
+  // (r) a symlink that resolves outside the consumer root is refused, for directory and file outputs.
+  const outside = path.join(tmp, 'outside');
+  fs.mkdirSync(outside, { recursive: true });
+  fresh(fontsOut);
+  fs.symlinkSync(outside, path.join(consumer, 'assets'));
+  r = run();
+  assert.equal(r.status, 2);
+  assert.deepEqual(fs.readdirSync(outside), [], 'nothing written outside the root');
+  fresh({ 'dataviz/p.json': 'assets/p.json' });
+  fs.symlinkSync(outside, path.join(consumer, 'assets'));
+  r = run();
+  assert.equal(r.status, 2);
+  assert.deepEqual(fs.readdirSync(outside), [], 'nothing written outside the root via a file output');
+
+  // (r2) a symlink under a directory output's destination that leaves the root is refused, writing nothing.
+  fresh({ 'fonts/': 'assets/fonts/' });
+  fs.mkdirSync(path.join(consumer, 'assets/fonts'), { recursive: true });
+  fs.symlinkSync(outside, path.join(consumer, 'assets/fonts/latin'));
+  r = run();
+  assert.equal(r.status, 2, r.stderr);
+  assert.deepEqual(fs.readdirSync(outside), [], 'nothing written outside the root via a member');
+  assert.ok(!exists('assets/fonts/dataviz'), 'nothing written at all');
+
+  // (s) writes are atomic per file: no temp file survives a sync.
+  fresh(fontsOut);
+  assert.equal(run().status, 0);
+  const leftovers = [];
+  (function walk(d) {
+    for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+      if (e.isDirectory()) walk(path.join(d, e.name));
+      else if (e.name.includes('.dataimago-sync-tmp')) leftovers.push(e.name);
+    }
+  })(consumer);
+  assert.deepEqual(leftovers, []);
+
   fs.rmSync(tmp, { recursive: true, force: true });
   console.log('dataimago-sync self-test: all checks passed');
 }

package/dist/dataviz/dataimago-dataviz.css

@@ -1,4 +1,4 @@
-/* @dataimago/css-neutral@0.1.0-alpha.12 dist/dataviz/dataimago-dataviz.css · sha256:4fb36e2401c1cd21f57d50c017ac080377c3943362a5b6c5ce2cd658080e4499 · generated from tokens; do not edit · restore: npx -p @dataimago/css-neutral@0.1.0-alpha.12 dataimago-sync */
+/* @dataimago/css-neutral@0.1.0-alpha.13 dist/dataviz/dataimago-dataviz.css · sha256:4fb36e2401c1cd21f57d50c017ac080377c3943362a5b6c5ce2cd658080e4499 · generated from tokens; do not edit · restore: npx -p @dataimago/css-neutral@0.1.0-alpha.13 dataimago-sync */
 /* dataimago data-viz palette (Okabe-Ito). Categorical colour is never the only channel. */
 :root, [data-bs-theme="light"], body.quarto-light {
   --color-dataviz-okabe-ito-orange: #E69F00;

package/dist/dataviz/dataimago-dataviz.json

@@ -1,11 +1,11 @@
 {
   "_meta": {
     "package": "@dataimago/css-neutral",
-    "version": "0.1.0-alpha.12",
+    "version": "0.1.0-alpha.13",
     "path": "dist/dataviz/dataimago-dataviz.json",
     "sha256": "28160e151fca196be3e36790d6b67db232d8df060e8d9556b29dfee50f4b278b",
     "note": "generated from tokens; do not edit",
-    "restore": "npx -p @dataimago/css-neutral@0.1.0-alpha.12 dataimago-sync"
+    "restore": "npx -p @dataimago/css-neutral@0.1.0-alpha.13 dataimago-sync"
   },
   "okabe-ito": {
     "orange": "#E69F00",

package/dist/dataviz/dataimago-dataviz.tex

@@ -1,4 +1,4 @@
-% @dataimago/css-neutral@0.1.0-alpha.12 dist/dataviz/dataimago-dataviz.tex · sha256:d7be36cb429ce8a1f19c95a7da8f57a7fcfda85fd2b0113e086913d37e9fa645 · generated from tokens; do not edit · restore: npx -p @dataimago/css-neutral@0.1.0-alpha.12 dataimago-sync
+% @dataimago/css-neutral@0.1.0-alpha.13 dist/dataviz/dataimago-dataviz.tex · sha256:d7be36cb429ce8a1f19c95a7da8f57a7fcfda85fd2b0113e086913d37e9fa645 · generated from tokens; do not edit · restore: npx -p @dataimago/css-neutral@0.1.0-alpha.13 dataimago-sync
 % dataimago data-viz palette (Okabe-Ito), light mode, for PSTricks and TikZ. Requires xcolor.
 \definecolor{di-dataviz-okabe-ito-orange}{HTML}{E69F00}
 \definecolor{di-dataviz-okabe-ito-sky-blue}{HTML}{56B4E9}

package/dist/dataviz/dataimago_dataviz.R

@@ -1,4 +1,4 @@
-# @dataimago/css-neutral@0.1.0-alpha.12 dist/dataviz/dataimago_dataviz.R · sha256:6443982f105b0f5e4a9d90ac2d1f6ce9fce2db4e8e8148b47f71bfc438940055 · generated from tokens; do not edit · restore: npx -p @dataimago/css-neutral@0.1.0-alpha.12 dataimago-sync
+# @dataimago/css-neutral@0.1.0-alpha.13 dist/dataviz/dataimago_dataviz.R · sha256:6443982f105b0f5e4a9d90ac2d1f6ce9fce2db4e8e8148b47f71bfc438940055 · generated from tokens; do not edit · restore: npx -p @dataimago/css-neutral@0.1.0-alpha.13 dataimago-sync
 # dataimago data-viz palette (Okabe-Ito). Categorical colour is never the only channel:
 # pair it with marker shape, line type or a label.
 

package/dist/fonts/cyrillic/OFL-NotoSans.txt

@@ -0,0 +1,93 @@
+Copyright 2022 The Noto Project Authors (https://github.com/notofonts/latin-greek-cyrillic)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.