@erclx/canon 5.8.0 → 5.9.0

package/src/standards/list.ts

@@ -0,0 +1,33 @@
+import { readFileSync } from 'node:fs'
+import { parseFrontmatter, readField } from '@/indexes/frontmatter'
+import { resolveAllStandards } from '@/standards/read'
+import { appliesTo } from '@/standards/scope'
+
+export interface StandardEntry {
+  readonly name: string
+  readonly description: string
+  readonly appliesTo: string[]
+  /** The whole file, frontmatter included. */
+  readonly content: string
+  /** The root-labeled path `canon standards <name>` would read. */
+  readonly source: string
+}
+
+/**
+ * Lists every standard a resolve reaches, the first root winning, so a project
+ * standard shows beside the toolkit's and a local override of a package name
+ * shows once, as the local copy.
+ */
+export function listStandardEntries(root: string): StandardEntry[] {
+  return resolveAllStandards(root).map(({ name, path, source }) => {
+    const content = readFileSync(path, 'utf8')
+
+    return {
+      name,
+      description: readField(parseFrontmatter(content), 'description') ?? '',
+      appliesTo: appliesTo(content),
+      content,
+      source,
+    }
+  })
+}

package/src/standards/read.ts

@@ -95,6 +95,19 @@ export function listStandards(root: string): string[] {
   return [...names].sort()
 }
 
+/**
+ * Pairs each listed name with the copy a resolve would read, so a catalog shows
+ * what `canon standards <name>` prints rather than every file a root holds.
+ */
+export function resolveAllStandards(
+  root: string,
+): Array<ResolvedStandard & { readonly name: string }> {
+  return listStandards(root).flatMap((name) => {
+    const resolved = resolveStandard(root, name)
+    return resolved ? [{ name, ...resolved }] : []
+  })
+}
+
 export function readStandard(standard: ResolvedStandard): string {
   return stripFrontmatter(readFileSync(standard.path, 'utf8'))
 }

package/src/standards/scope.ts

@@ -0,0 +1,56 @@
+import { linesOutsideFences } from '@/markdown/scan'
+
+const SCOPE_HEADING = /^##[ \t]+Scope[ \t]*$/
+const ANY_HEADING = /^#{1,6}[ \t]+\S/
+const CODE_SPAN = /`([^`]+)`/g
+
+/** What an attribute standard says of itself, since it names no path. */
+export const ATTRIBUTE_MARKER = 'attribute standard'
+
+export interface Scope {
+  /** The first non-blank line under the heading, which is the statement. */
+  readonly statement: string
+  readonly lines: readonly string[]
+}
+
+export function readScope(text: string): Scope | undefined {
+  const lines = linesOutsideFences(text)
+  const opened = lines.findIndex((line) => SCOPE_HEADING.test(line.trim()))
+  if (opened === -1) return undefined
+
+  const body: string[] = []
+
+  for (const line of lines.slice(opened + 1)) {
+    if (ANY_HEADING.test(line.trim())) break
+    body.push(line)
+  }
+
+  const statement = body.find((line) => line.trim().length > 0)
+
+  return { statement: statement?.trim() ?? '', lines: body }
+}
+
+/**
+ * The paths a scope statement declares: backticked spans in the first sentence
+ * alone. The catalog's `appliesTo` field and the records gate both read the
+ * statement through this, since one sentence read two ways would let a standard
+ * pass the gate while publishing a different jurisdiction to every consumer.
+ */
+export function governedPaths(statement: string): string[] {
+  const [sentence] = statement.split('. ')
+  return [...sentence.matchAll(CODE_SPAN)].map((match) => match[1])
+}
+
+/**
+ * The jurisdiction a standard publishes. The marker is read only where the
+ * first sentence backticks nothing, so a statement naming a path publishes that
+ * path however the rest of it describes itself. An empty array means the
+ * statement did not parse, which consumers report rather than skip.
+ */
+export function appliesTo(text: string): string[] {
+  const statement = readScope(text)?.statement ?? ''
+  const paths = governedPaths(statement)
+
+  if (paths.length === 0 && statement.includes(ATTRIBUTE_MARKER)) return ['*']
+  return paths
+}

package/src/sync/check.ts

@@ -28,7 +28,12 @@ import {
   type StampDomain,
 } from '@/sync/stamp'
 import { isDirectory } from '@/target'
-import { loadManifest } from '@/tooling/manifest'
+import {
+  isWholeStack,
+  loadManifest,
+  type Manifest,
+  resolveChain,
+} from '@/tooling/manifest'
 import { scan } from '@/tooling/scan'
 import { readSkew, type SkewReport } from '@/version/skew'
 
@@ -253,9 +258,7 @@ export function buildToolingReport(
   stamp: Stamp | undefined,
 ): ToolingReport {
   const chain = stampedChain(stamp, 'tooling')
-  const manifests = chain
-    .map((name) => loadManifest(toolkitRoot, name))
-    .filter((manifest) => manifest !== undefined)
+  const manifests = resolveRecorded(toolkitRoot, chain)
 
   if (manifests.length === 0) return { ...UNMEASURED_TOOLING, chain }
 
@@ -281,6 +284,37 @@ export function buildToolingReport(
   }
 }
 
+/**
+ * Loads each recorded stack whole. When the recorded chain stops short of its
+ * last stack's parent, the install skipped that parent, so the chain is
+ * re-resolved with it as the skip to bring back any per-root configs the
+ * skipped stack still shipped. The re-resolution is kept only when its whole
+ * stacks are exactly the recorded ones.
+ */
+function resolveRecorded(
+  toolkitRoot: string,
+  recorded: readonly string[],
+): Manifest[] {
+  const loaded = recorded
+    .map((name) => loadManifest(toolkitRoot, name))
+    .filter((manifest) => manifest !== undefined)
+
+  const parent = loaded.at(-1)?.parent
+  if (
+    loaded.length !== recorded.length ||
+    parent === undefined ||
+    recorded.includes(parent)
+  ) {
+    return loaded
+  }
+
+  const resolved = resolveChain(toolkitRoot, recorded[0], {
+    skipStack: parent,
+  })
+  const whole = resolved.filter(isWholeStack).map((manifest) => manifest.name)
+  return whole.join('\0') === recorded.join('\0') ? resolved : loaded
+}
+
 /**
  * Whether the target is a toolkit-managed project at all. Seeds are enumerated
  * from the source rather than from what a target installed, so without this gate

package/src/tasks/archive.ts

@@ -84,6 +84,23 @@ export interface ReadyMove {
   readonly to: string
 }
 
+/** A task file rewritten because it linked the task that moved. */
+export interface InboundRelink {
+  readonly file: string
+  readonly links: number
+}
+
+/** A task file the pass could not read or write, left as it was. */
+export interface RelinkFailure {
+  readonly file: string
+  readonly message: string
+}
+
+export interface RepointOutcome {
+  readonly relinked: readonly InboundRelink[]
+  readonly failed: readonly RelinkFailure[]
+}
+
 export interface ArchiveSuccess {
   readonly ok: true
   readonly stem: string
@@ -97,6 +114,10 @@ export interface ArchiveSuccess {
   readonly ready: ReadyMove | undefined
   readonly closed: number
   readonly cut: number
+  /** Every task file whose links to the moved task were rewritten. */
+  readonly relinked: readonly InboundRelink[]
+  /** Every task file the pass could not read or write, left as it was. */
+  readonly relinkFailed: readonly RelinkFailure[]
 }
 
 export interface ArchiveRefused {
@@ -118,6 +139,10 @@ export interface DeclineSuccess {
   readonly indexRegenerated: boolean
   /** Every live plan the task cited that no other live task still holds, in line order. */
   readonly plans: readonly PlanMove[]
+  /** Every task file whose links to the moved task were rewritten. */
+  readonly relinked: readonly InboundRelink[]
+  /** Every task file the pass could not read or write, left as it was. */
+  readonly relinkFailed: readonly RelinkFailure[]
 }
 
 export interface DeclineRefused {
@@ -942,6 +967,7 @@ export async function archiveTask(
       : retargeted,
   )
 
+  const { relinked, failed } = await repointInboundLinks(root, from, to)
   const priorityRowRemoved = await clearPriorityRow(dir, stem)
   const regen = await regenOne(dir, { dryRun: false })
 
@@ -956,6 +982,8 @@ export async function archiveTask(
     ready: ready || undefined,
     closed: closed.length,
     cut: cut.length,
+    relinked,
+    relinkFailed: failed,
   }
 }
 
@@ -1106,6 +1134,8 @@ export function linkTo(taskDir: string, plan: string): string {
 const MARKDOWN_LINK_PATTERN = /(\]\()([^)\s]+)/g
 /** The capture group makes `split` keep each code span, at the odd positions. */
 const INLINE_CODE_PATTERN = /(`+[^`]*`+)/
+/** A reference-style definition, whose target is the whole line past the label. */
+const REFERENCE_DEFINITION_PATTERN = /^(\s{0,3}\[[^\]]+\]:[ \t]*)(\S+)[ \t]*$/
 const BARE_ORIGIN_PATTERN =
   /^((?:Plan|Ready|Groundwork|Intake):[ \t]*)([^\s[\]()]+)[ \t]*$/
 
@@ -1113,12 +1143,18 @@ function isRelativeTarget(target: string): boolean {
   return !/^(?:[a-z][a-z0-9+.-]*:|\/|#)/i.test(target)
 }
 
+function splitSuffix(target: string): { path: string; suffix: string } {
+  const suffixAt = target.search(/[#?]/)
+
+  return suffixAt === -1
+    ? { path: target, suffix: '' }
+    : { path: target.slice(0, suffixAt), suffix: target.slice(suffixAt) }
+}
+
 function rebaseTarget(target: string, fromDir: string, toDir: string): string {
   if (!isRelativeTarget(target)) return target
 
-  const suffixAt = target.search(/[#?]/)
-  const path = suffixAt === -1 ? target : target.slice(0, suffixAt)
-  const suffix = suffixAt === -1 ? '' : target.slice(suffixAt)
+  const { path, suffix } = splitSuffix(target)
   if (path === '') return target
 
   const rebased = relative(toDir, resolve(fromDir, path)).split(sep).join('/')
@@ -1166,6 +1202,132 @@ export function rebaseRelativeLinks(
     .join('\n')
 }
 
+/**
+ * A link resolving to `from`, rewritten to read `to` from the citing file's own
+ * folder. Resolution decides the match, so a link naming the same stem in
+ * another folder is left as written.
+ */
+function repointTarget(
+  target: string,
+  fileDir: string,
+  from: string,
+  to: string,
+): string | undefined {
+  if (!isRelativeTarget(target)) return undefined
+
+  const { path, suffix } = splitSuffix(target)
+  if (path === '' || resolve(fileDir, path) !== from) return undefined
+
+  return `${relative(fileDir, to).split(sep).join('/')}${suffix}`
+}
+
+function repointLinks(
+  text: string,
+  fileDir: string,
+  from: string,
+  to: string,
+): { text: string; links: number } {
+  const lines = text.split('\n')
+  const fenced = fenceMask(lines)
+  let links = 0
+
+  const repointed = lines.map((line, index) => {
+    if (fenced[index]) return line
+
+    const definition = REFERENCE_DEFINITION_PATTERN.exec(line)
+    if (definition) {
+      const next = repointTarget(definition[2], fileDir, from, to)
+      if (next === undefined) return line
+
+      links += 1
+      return `${definition[1]}${next}`
+    }
+
+    return line
+      .split(INLINE_CODE_PATTERN)
+      .map((part, position) =>
+        position % 2 === 1
+          ? part
+          : part.replace(
+              MARKDOWN_LINK_PATTERN,
+              (whole: string, open: string, target: string) => {
+                const next = repointTarget(target, fileDir, from, to)
+                if (next === undefined) return whole
+
+                links += 1
+                return `${open}${next}`
+              },
+            ),
+      )
+      .join('')
+  })
+
+  return { text: repointed.join('\n'), links }
+}
+
+/**
+ * Rewrites every link in the task folders that resolves to the moved task, so
+ * a citation follows the file. The moved file and the reserved siblings are
+ * skipped: the first was rebased on its own, and `citedStem` reads a blocker in
+ * `priority.md` only while its target carries no `/`. Fenced samples and code
+ * spans stay verbatim, the way `rebaseRelativeLinks` leaves them.
+ *
+ * It runs after the rename and ahead of the ordering-row removal and the index
+ * regen, which the unattended post-merge hook cannot redo once the task has
+ * moved. A read or write that fails is therefore reported in `failed` and never
+ * thrown, so the steps after it always run.
+ */
+export async function repointInboundLinks(
+  root: string,
+  from: string,
+  to: string,
+): Promise<RepointOutcome> {
+  const moved = resolve(from)
+  const destination = resolve(to)
+  const relinked: InboundRelink[] = []
+  const failed: RelinkFailure[] = []
+
+  for (const dir of [tasksDir(root), archiveDir(root), declinedDir(root)]) {
+    if (!existsSync(dir)) continue
+
+    let names: string[]
+    try {
+      names = (await readdir(dir)).filter((name) => name.endsWith('.md'))
+    } catch (error) {
+      failed.push({ file: dir, message: describeError(error) })
+      continue
+    }
+    names.sort()
+
+    for (const name of names) {
+      const file = join(dir, name)
+      if (isReservedStem(name.slice(0, -'.md'.length))) continue
+      if (resolve(file) === destination) continue
+
+      try {
+        const repointed = repointLinks(
+          await readFile(file, 'utf8'),
+          dir,
+          moved,
+          destination,
+        )
+        if (repointed.links === 0) continue
+
+        await writeFile(file, repointed.text)
+        relinked.push({ file, links: repointed.links })
+      } catch (error) {
+        failed.push({ file, message: describeError(error) })
+      }
+    }
+  }
+
+  return { relinked, failed }
+}
+
+function describeError(error: unknown): string {
+  return error instanceof Error ? error.message : String(error)
+}
+
 async function clearPriorityRow(dir: string, stem: string): Promise<boolean> {
   const path = join(dir, 'priority.md')
   if (!existsSync(path)) return false
@@ -1239,6 +1401,7 @@ export async function declineTask(
   )
   await writeFile(to, declined)
 
+  const { relinked, failed } = await repointInboundLinks(root, from, to)
   const priorityRowRemoved = await clearPriorityRow(dir, stem)
   const backlogRowRemoved = await clearBacklogRow(dir, stem)
   const regen = await regenOne(dir, { dryRun: false })
@@ -1252,5 +1415,7 @@ export async function declineTask(
     backlogRowRemoved,
     indexRegenerated: regen.action === 'written',
     plans: plans.moves,
+    relinked,
+    relinkFailed: failed,
   }
 }

package/src/tooling/inject.ts

@@ -8,9 +8,10 @@ import { resolveSurfacePath } from '@/surface-root'
 import { mergeSections, pruneSections } from '@/tooling/gitignore'
 import {
   ancestorsFirst,
+  configFiles,
   configPaths,
-  listFiles,
   type Manifest,
+  seedFiles,
 } from '@/tooling/manifest'
 import {
   applyScripts,
@@ -36,7 +37,7 @@ export async function injectConfigs(
   const isSubfolder = isSubfolderTarget(target)
 
   for (const manifest of ancestorsFirst(chain)) {
-    const files = listFiles(manifest.configsDir).filter(
+    const files = configFiles(manifest).filter(
       (rel) => !(isSubfolder && isWithheldInSubfolder(rel)),
     )
     if (files.length === 0) continue
@@ -106,7 +107,7 @@ export async function injectSeeds(
   const shadowed = configPaths(chain)
 
   for (const manifest of ancestorsFirst(chain)) {
-    const files = listFiles(manifest.seedsDir).filter(
+    const files = seedFiles(manifest).filter(
       (rel) =>
         !shadowed.has(rel) && !(isSubfolder && isWithheldInSubfolder(rel)),
     )

package/src/tooling/manifest.ts

@@ -18,6 +18,18 @@ export interface Manifest {
   readonly scriptOverrides: Readonly<Record<string, string>>
   readonly gitignore: readonly GitignoreSection[]
   readonly devPackages: readonly string[]
+  /**
+   * Config paths this stack still ships into a folder that skips it, read
+   * from `[sync] per_root`. Each is a per-root entry point a subfolder needs
+   * as much as the repository root does.
+   */
+  readonly perRoot?: readonly string[]
+  /**
+   * Set only on a stack kept in a chain that skips it. The stack then ships
+   * these configs and nothing else: no seeds, scripts, dependencies, or
+   * gitignore entries.
+   */
+  readonly onlyConfigs?: readonly string[]
 }
 
 export interface ChainOptions {
@@ -50,7 +62,28 @@ export function listFiles(dir: string): string[] {
  * `injectSeeds` both read this, so the report and the write cannot disagree.
  */
 export function configPaths(chain: readonly Manifest[]): Set<string> {
-  return new Set(chain.flatMap((manifest) => listFiles(manifest.configsDir)))
+  return new Set(chain.flatMap(configFiles))
+}
+
+/**
+ * The config paths a manifest ships, narrowed to `onlyConfigs` on a stack the
+ * chain skipped. `scan` and `injectConfigs` both read this, so the diff and
+ * the write cannot disagree on what a skipped stack still carries.
+ */
+export function configFiles(manifest: Manifest): string[] {
+  const files = listFiles(manifest.configsDir)
+  const only = manifest.onlyConfigs
+  return only === undefined ? files : files.filter((rel) => only.includes(rel))
+}
+
+/** The seed paths a manifest ships. A skipped stack ships none. */
+export function seedFiles(manifest: Manifest): string[] {
+  return manifest.onlyConfigs === undefined ? listFiles(manifest.seedsDir) : []
+}
+
+/** Whether the chain carries this stack whole rather than skipped. */
+export function isWholeStack(manifest: Manifest): boolean {
+  return manifest.onlyConfigs === undefined
 }
 
 /**
@@ -100,6 +133,7 @@ export function loadManifest(
   const parent =
     typeof stackTable.extends === 'string' ? stackTable.extends : ''
   const scriptsTable = asTable(parsed.scripts)
+  const perRoot = readStrings(asTable(parsed.sync).per_root)
   const dir = join(toolingDir(root), stack)
 
   return {
@@ -112,6 +146,7 @@ export function loadManifest(
     scriptOverrides: pickStrings(asTable(scriptsTable.override)),
     gitignore: readGitignoreSections(asTable(parsed.gitignore)),
     devPackages: readDevPackages(parsed.dependencies),
+    ...(perRoot.length > 0 ? { perRoot } : {}),
   }
 }
 
@@ -120,8 +155,11 @@ export function loadManifest(
  * values before child values reverse the result. Replaces the seventeen
  * copies of `grep '^extends' | cut -d'"' -f2` the bash carried.
  *
- * A stack matching `skipStack` truncates the chain at that point, mirroring
- * the `[ "$stack" = "${SKIP_STACK:-}" ] && return` guard.
+ * A stack matching `skipStack` drops from the chain along with every
+ * ancestor past it, except that one declaring `[sync] per_root` stays as a
+ * restricted manifest shipping those configs alone. A `--skip base` subfolder
+ * keeps its own verify entry point that way, while husky, prettier, and the
+ * rest stay single at the repository root.
  */
 export function resolveChain(
   root: string,
@@ -131,22 +169,35 @@ export function resolveChain(
   const chain: Manifest[] = []
   const seen = new Set<string>()
   let current: string | undefined = stack
+  let isSkipping = false
 
   while (current !== undefined) {
-    if (current === options.skipStack) break
+    if (current === options.skipStack) isSkipping = true
     if (seen.has(current)) break
     seen.add(current)
 
     const manifest: Manifest | undefined = loadManifest(root, current)
     if (!manifest) break
 
-    chain.push(manifest)
+    if (!isSkipping) chain.push(manifest)
+    else if (manifest.perRoot !== undefined) chain.push(restrict(manifest))
     current = manifest.parent
   }
 
   return chain
 }
 
+function restrict(manifest: Manifest): Manifest {
+  return {
+    ...manifest,
+    onlyConfigs: manifest.perRoot,
+    scripts: {},
+    scriptOverrides: {},
+    gitignore: [],
+    devPackages: [],
+  }
+}
+
 function asTable(value: unknown): Record<string, unknown> {
   if (typeof value !== 'object' || value === null || Array.isArray(value)) {
     return {}
@@ -177,9 +228,12 @@ function readGitignoreSections(
 }
 
 function readDevPackages(dependencies: unknown): string[] {
-  const dev = asTable(asTable(dependencies).dev)
-  if (!Array.isArray(dev.packages)) return []
-  return dev.packages.filter(
+  return readStrings(asTable(asTable(dependencies).dev).packages)
+}
+
+function readStrings(value: unknown): string[] {
+  if (!Array.isArray(value)) return []
+  return value.filter(
     (entry): entry is string => typeof entry === 'string' && entry !== '',
   )
 }

package/src/tooling/scan.ts

@@ -4,9 +4,10 @@ import { resolveSurfacePath } from '@/surface-root'
 import { mergeSections } from '@/tooling/gitignore'
 import {
   ancestorsFirst,
+  configFiles,
   configPaths,
-  listFiles,
   type Manifest,
+  seedFiles,
 } from '@/tooling/manifest'
 import {
   collectDeps,
@@ -83,7 +84,7 @@ export function scan(chain: readonly Manifest[], target: string): ScanResult {
   const seenConfigs = new Set<string>()
 
   for (const manifest of chain) {
-    for (const rel of listFiles(manifest.configsDir)) {
+    for (const rel of configFiles(manifest)) {
       if (seenConfigs.has(rel)) continue
       seenConfigs.add(rel)
 
@@ -109,7 +110,7 @@ export function scan(chain: readonly Manifest[], target: string): ScanResult {
   const seenSeeds = configPaths(chain)
 
   for (const manifest of chain) {
-    for (const rel of listFiles(manifest.seedsDir)) {
+    for (const rel of seedFiles(manifest)) {
       if (seenSeeds.has(rel)) continue
       seenSeeds.add(rel)
 

package/src/tooling/stamp.ts

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { writeChainStamp } from '@/sync/stamp'
-import type { Manifest } from '@/tooling/manifest'
+import { isWholeStack, type Manifest } from '@/tooling/manifest'
 import { readPackage } from '@/tooling/package'
 
 /**
@@ -33,12 +33,21 @@ export async function recordToolingChain(
   await writeChainStamp(
     target,
     { domain: 'tooling', toolkitRoot },
-    chain.map((manifest) => manifest.name),
+    recordedStacks(chain),
     now,
   )
   return true
 }
 
+/**
+ * The stack names a chain stamp records. A skipped stack kept for its
+ * per-root configs stays out, since the report re-resolves each recorded name
+ * as a whole manifest and would then measure every config the skip withheld.
+ */
+export function recordedStacks(chain: readonly Manifest[]): string[] {
+  return chain.filter(isWholeStack).map((manifest) => manifest.name)
+}
+
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value)
 }

package/src/tooling/subfolder.ts

@@ -1,7 +1,7 @@
 import { existsSync, readdirSync, realpathSync } from 'node:fs'
 import { basename, join, relative } from 'node:path'
 import { gitEnv } from '@/git-env'
-import { listFiles, type Manifest } from '@/tooling/manifest'
+import { isWholeStack, type Manifest, seedFiles } from '@/tooling/manifest'
 
 /**
  * The path the generated subfolder spell config is written to. Written
@@ -83,11 +83,15 @@ export function hasSpellConfig(target: string): boolean {
 export function subfolderSpellConfig(
   chain: readonly Manifest[],
 ): string | undefined {
-  if (chain.some((manifest) => manifest.name === 'base')) return undefined
+  if (
+    chain.some((manifest) => manifest.name === 'base' && isWholeStack(manifest))
+  ) {
+    return undefined
+  }
 
   const lists = new Set<string>()
   for (const manifest of chain) {
-    for (const rel of listFiles(manifest.seedsDir)) {
+    for (const rel of seedFiles(manifest)) {
       if (rel.startsWith('.cspell/') && rel.endsWith('.txt')) lists.add(rel)
     }
   }

package/tooling/astro/reference.md

@@ -69,7 +69,7 @@ The social card is a route the project keeps rather than a page a render writes
 - `card.config.mjs`: a second Astro config whose `srcDir` points at `./card-src`, which the main config's page router never reads. That is what excludes the card from the published build structurally rather than by a filename convention, the same mechanism `scenarios.astro` reaches for with `import.meta.env.DEV`. Its base port is `4421` plus `WORKTREE_PORT_OFFSET`, outside the band `astro.config.mjs` serves from, so a card server and a dev server of one worktree never contend.
 - `card-src/pages/og-card.astro`: the route, shipped as a working placeholder so it serves before any pick has been taken. It imports the project's own global stylesheet, which is what lets the composition read real tokens and real fonts instead of typed copies. It reads `--color-background` and `--color-text`, the names `canon design css` emits, and sets no `font-family` at all so the card inherits the project's body font rather than reading a font token the design system does not emit.
 - `scripts/check-card-exclusion.sh`: fails when the route's `<meta name="og-card-marker">` tag reaches `dist/`, and fails when the route dropped that tag, since the marker is what the leak test reads for.
-- `bun run card:dev` serves the route. `bun run card:check` runs the exclusion check, which the web layer's `scripts/verify.sh` also runs after its build stage whenever the script is installed.
+- `bun run card:dev` serves the route. `bun run card:check` runs the exclusion check, which base's verify runner, `scripts/verify.ts`, also runs after its build stage whenever the script is installed.
 
 ### Why each piece is shaped that way
 

package/tooling/base/configs/scripts/verify.json

@@ -0,0 +1,3 @@
+{
+  "require": ["format", "check:format", "check:spell", "check:shell"]
+}