@gravitee/graphene-core 3.10.0 → 3.11.0-fix-found-211-ajv-unknown-format.338f8cb

package/USAGE_GUIDE.md

@@ -17,6 +17,7 @@ This project uses the Graphene design system (`@gravitee/graphene-core`). Follow
 | `@gravitee/graphene-core/tailwind-theme`                              | Constrained Tailwind v4 theme: resets default palette/spacing/type and maps utilities to Graphene tokens. Use only if the app runs Tailwind for its own code. |
 | `@gravitee/graphene-core/testing`                                     | `renderWithGraphene` plus per-component harnesses (`buttonHarness`, `inputHarness`, …) for tests. See the **Testing** section below.                          |
 | `@gravitee/graphene-core/eslint` / `@gravitee/graphene-core/tsconfig` | Shared tooling configs                                                                                                                                        |
+| `graphene-check-classes` (bin)                                        | Fails if your source uses a class the pre-built bundle does not contain. See **Verifying class coverage** below.                                               |
 
 ## Dependencies (what the host needs)
 
@@ -116,6 +117,63 @@ import graphene from '@gravitee/graphene-core/eslint';
 export default [...graphene, { settings: { 'better-tailwindcss': { entryPoint: './src/app.css' } } }];
 ```
 
+### Verifying class coverage (`graphene-check-classes`)
+
+```bash
+npx graphene-check-classes src
+```
+
+Exits non-zero listing every class your source uses that is not in the pre-built bundle, and the files each one
+came from. Nothing to configure — the checker brings its own Tailwind. Run it in CI next to your typecheck.
+
+```
+graphene-check-classes <source>...        directories or globs; each is reported separately.
+                                          A path that matches nothing is an error, not a pass
+                       --advisory <src>   report but never fail the run
+                       --exclude <glob>   extra exclusion, relative to the current directory
+                                          (stories, tests and markdown are always excluded)
+                       --ignore <class>   never report this class; repeatable or comma-separated
+```
+
+Exit codes: `0` clean, `1` the check failed, `2` the tool could not run — so CI can tell a broken class from a
+broken install.
+
+**Why this needs a tool.** ESLint validates against Tailwind's _generator_; what renders depends on the
+_emitted artifact_. A class can be perfectly valid and still be absent from the bundle, in which case it
+renders as nothing — no error, no warning, a clean typecheck. Two ways that happens:
+
+1. **Outside Graphene's theme entirely** — `bg-yellow-500`, `w-52`. Tailwind's default palette and most of its
+   spacing scale do not exist here (see **Token reference** above), so nothing was ever generated for them.
+2. **A valid Graphene class no Graphene component happens to use**, so nothing ever compiled it. Sizing
+   utilities and arbitrary values are the usual casualties: whether one ships depends on whether some unrelated
+   component reached for the same value. Not worth reasoning about, and not worth keeping a list of — the last
+   list drifted and shipped a regression.
+
+**How it decides.** It compiles the sources you point it at with Tailwind and diffs the emitted class set
+against the bundle. Both sides are real Tailwind output, so there are no extraction heuristics and no guessing
+about dynamic strings Tailwind would not have emitted either. The bundle is resolved from `node_modules`, so the
+answer is correct for the version you have pinned rather than for whatever is on `main`.
+
+**What it cannot see.** Classes assembled at runtime from fragments (`` `bg-${tone}-500` ``) — Tailwind cannot
+see those either, in any pipeline, which is why they are already discouraged. Everything written out in full,
+including inside `cva` variants and `clsx` conditionals, is covered.
+
+**Where it over-reports, and the escape hatch.** Tailwind's scanner reads your files as text, so a class name
+that appears anywhere is discovered — including in a comment. Documenting that `bg-yellow-500` is dead is enough
+to make it a finding. Suppress those with `--ignore bg-yellow-500`; an `--ignore` that stops matching anything
+fails the run, so the list cannot quietly become a set of excused regressions the way a hand-maintained list of
+known-dead classes does.
+
+### Which tier should run it
+
+| | |
+| --- | --- |
+| **Tier 1** — no Tailwind of your own | Run it over all your source. Every class you write has to already be in the bundle, which is exactly what this measures. |
+| **Tier 2** — your own Tailwind pipeline | Do not run it over all your source: your pipeline compiles your classes, so reason 2 does not apply to you and a full run reports classes that render fine. Reason 1 still applies — `tailwind-theme` is the same constrained theme, so `bg-yellow-500` and `w-52` are ungeneratable in your build too — but `better-tailwindcss/no-unknown-classes` from the shared ESLint config above already flags those at the point of use, which is the better place. Reach for this tool only for source your own Tailwind does not scan. |
+
+The one thing neither tier has to check is Graphene's own components: the bundle is compiled from Graphene's
+source, so it cannot be missing a class Graphene uses.
+
 ### Colors (semantic)
 
 Maps to CSS variables from Graphene themes. Use utilities like `bg-*`, `text-*`, `border-*`:

package/dist/composed/JsonSchemaForm/form-bindings/jsonSchemaResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jsonSchemaResolver.d.ts","sourceRoot":"","sources":["../../../../src/composed/JsonSchemaForm/form-bindings/jsonSchemaResolver.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAA2B,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAqBpF,iBAAS,kBAAkB,CAAC,YAAY,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChG,MAAM,EAAE,UAAU,EAClB,OAAO,GAAE,yBAA8B,GACtC,QAAQ,CAAC,YAAY,CAAC,CA+DxB;AA2LD,OAAO,EAAE,kBAAkB,EAAE,CAAC"}
+{"version":3,"file":"jsonSchemaResolver.d.ts","sourceRoot":"","sources":["../../../../src/composed/JsonSchemaForm/form-bindings/jsonSchemaResolver.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAA2B,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAmCpF,iBAAS,kBAAkB,CAAC,YAAY,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChG,MAAM,EAAE,UAAU,EAClB,OAAO,GAAE,yBAA8B,GACtC,QAAQ,CAAC,YAAY,CAAC,CA+DxB;AA2LD,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/index.js

@@ -21698,7 +21698,7 @@ var $z = [
 	"[&_ol]:mb-2 [&_ol]:list-decimal [&_ol]:pl-5",
 	"[&_li]:mb-0.5",
 	"[&_a]:text-primary [&_a]:underline [&_a]:underline-offset-2",
-	"[&_code]:rounded [&_code]:bg-muted [&_code]:px-1 [&_code]:py-0.5 [&_code]:font-mono [&_code]:text-xs",
+	"[&_code]:rounded-sm [&_code]:bg-muted [&_code]:px-1 [&_code]:py-0.5 [&_code]:font-mono [&_code]:text-xs",
 	"[&_pre]:mb-3 [&_pre]:overflow-x-auto [&_pre]:rounded-md [&_pre]:bg-muted [&_pre]:p-3",
 	"[&_pre_code]:bg-transparent [&_pre_code]:p-0 [&_pre_code]:text-xs",
 	"[&_table]:mb-3 [&_table]:w-full [&_table]:text-xs",
@@ -34772,7 +34772,9 @@ var fZ = new nZ.default({
 	strict: !1,
 	allErrors: !0
 });
-(0, rZ.default)(fZ), fZ.removeKeyword("id"), fZ.addKeyword({
+(0, rZ.default)(fZ);
+for (let e of ["text", "gio-code-editor"]) fZ.addFormat(e, !0);
+fZ.removeKeyword("id"), fZ.addKeyword({
 	keyword: "id",
 	validate: () => !0
 });

package/dist/styles/_probe-preset.css

@@ -0,0 +1,19 @@
+/* Theme surface the class-portability checker compiles against, shipped as
+ * `dist/styles/_probe-preset.css`. Internal to `graphene-check-classes`; no `exports` mapping.
+ *
+ * Must declare everything that decides whether a utility can be *generated* — variants, `@utility`,
+ * every `@theme` key — and nothing else. Token values and `base-layer` are omitted because they
+ * cannot change the class set: Tailwind emits `w-2` because `--spacing-2` is declared, not because
+ * the var resolves.
+ *
+ * Tracks `_dist-entry.css` — what the bundle is actually compiled from — and `preset.css`, its one
+ * import that expands into further theme surface. Drift is NOT self-correcting. Over-declaring here
+ * is caught by `yarn test:tier1`: `packages/core` starts emitting a class its own bundle lacks.
+ * Under-declaring is silent — a theme key those files gain and this one does not simply stops being
+ * discoverable, and every enforced target still passes, because `packages/core` passes by
+ * construction. `assertProbeParity` in `scripts/check-tier1-classes.mjs` is what holds the three
+ * files together; keep it in sync when the import list here changes. */
+
+@import 'tw-animate-css';
+@import './theme-directives.css';
+@import './tailwind-theme.css';

package/dist/styles/theme-directives.css

@@ -0,0 +1,84 @@
+@import './custom-variants.css';
+
+@theme inline {
+  /* ── Map semantic tokens to Tailwind utilities ──── */
+  --color-background: var(--background);
+  --color-foreground: var(--foreground);
+  --color-card: var(--card);
+  --color-card-foreground: var(--card-foreground);
+  --color-popover: var(--popover);
+  --color-popover-foreground: var(--popover-foreground);
+  --color-primary: var(--primary);
+  --color-primary-foreground: var(--primary-foreground);
+  --color-secondary: var(--secondary);
+  --color-secondary-foreground: var(--secondary-foreground);
+  --color-muted: var(--muted);
+  --color-muted-foreground: var(--muted-foreground);
+  --color-accent: var(--accent);
+  --color-accent-foreground: var(--accent-foreground);
+  --color-destructive: var(--destructive);
+  --color-destructive-foreground: var(--destructive-foreground);
+  --color-success: var(--success);
+  --color-success-foreground: var(--success-foreground);
+  --color-warning: var(--warning);
+  --color-warning-foreground: var(--warning-foreground);
+  --color-highlight: var(--highlight);
+  --color-highlight-foreground: var(--highlight-foreground);
+  --color-badge-default-foreground: var(--badge-default-foreground);
+  --color-badge-destructive-foreground: var(--badge-destructive-foreground);
+  --color-badge-success-foreground: var(--badge-success-foreground);
+  --color-badge-warning-foreground: var(--badge-warning-foreground);
+  --color-badge-highlight-foreground: var(--badge-highlight-foreground);
+  --color-border: var(--border);
+  --color-input: var(--input);
+  --color-ring: var(--ring);
+
+  /* ── Sidebar colors ──────────────────────────────── */
+  --color-sidebar: var(--sidebar-background);
+  --color-sidebar-foreground: var(--sidebar-foreground);
+  --color-sidebar-border: var(--sidebar-border);
+  --color-sidebar-accent: var(--sidebar-accent);
+  --color-sidebar-accent-foreground: var(--sidebar-accent-foreground);
+  --color-sidebar-primary: var(--sidebar-primary);
+  --color-sidebar-primary-foreground: var(--sidebar-primary-foreground);
+  --color-sidebar-ring: var(--sidebar-ring);
+
+  /* ── Typography ─────────────────────────────────── */
+  --font-sans: var(--graphene-font-sans);
+
+  /* ── Layout dimensions ──────────────────────────── */
+  --spacing-topnav: var(--topnav-height);
+  --spacing-content: var(--content-padding);
+  --spacing-sidebar-height: var(--sidebar-height);
+  --container-content: var(--content-max-width);
+  --max-width-content: var(--content-max-width);
+  --max-width-focused: var(--content-focused-width);
+
+  /* ── Animations ──────────────────────────────────── */
+  --animate-accordion-down: accordion-down 0.2s ease-out;
+  --animate-accordion-up: accordion-up 0.2s ease-out;
+
+  /* ── Radius ──────────────────────────────────────── */
+  --radius-sm: calc(var(--radius) - 0.125rem);
+  --radius-md: var(--radius);
+  --radius-lg: calc(var(--radius) + 0.125rem);
+  --radius-xl: calc(var(--radius) + 0.375rem);
+}
+
+@keyframes accordion-down {
+  from {
+    height: 0;
+  }
+  to {
+    height: var(--radix-accordion-content-height);
+  }
+}
+
+@keyframes accordion-up {
+  from {
+    height: var(--radix-accordion-content-height);
+  }
+  to {
+    height: 0;
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gravitee/graphene-core",
-  "version": "3.10.0",
+  "version": "3.11.0-fix-found-211-ajv-unknown-format.338f8cb",
   "type": "module",
   "description": "Gravitee's Graphene design system: accessible React components, design tokens, icons, and shared ESLint/TypeScript configs. Built on shadcn/ui and Tailwind.",
   "keywords": [
@@ -53,6 +53,7 @@
     "./tsconfig": "./tsconfig.shared.json"
   },
   "bin": {
+    "graphene-check-classes": "./scripts/check-classes.mjs",
     "graphene-sync-ai-rules": "./scripts/sync-ai-rules.mjs"
   },
   "files": [
@@ -61,6 +62,7 @@
     "eslint.config.shared.mjs",
     "eslint.legacy.shared.cjs",
     "tsconfig.shared.json",
+    "scripts/check-classes.mjs",
     "scripts/sync-ai-rules.mjs",
     "USAGE_GUIDE.md"
   ],
@@ -77,6 +79,7 @@
   },
   "dependencies": {
     "@base-ui/react": "1.4.1",
+    "@tailwindcss/cli": "4.3.0",
     "@types/json-schema": "7.0.15",
     "ajv": "8.20.0",
     "ajv-formats": "3.0.1",
@@ -85,16 +88,19 @@
     "cmdk": "1.1.1",
     "date-fns": "4.1.0",
     "lucide-react": "1.14.0",
+    "postcss": "8.5.26",
     "radix-ui": "1.4.3",
     "react-day-picker": "9.14.0",
     "react-dropzone": "15.0.0",
     "react-resizable-panels": "4.11.1",
     "sonner": "2.0.7",
     "tailwind-merge": "3.6.0",
+    "tw-animate-css": "1.4.0",
     "vaul": "1.1.2"
   },
   "peerDependencies": {
     "@fontsource/dm-sans": ">=5.0.0",
+    "@gravitee/graphene-core": "3.11.0-fix-found-211-ajv-unknown-format.338f8cb",
     "@monaco-editor/react": "^4.7.0",
     "@tanstack/react-table": "^8.0.0",
     "@testing-library/dom": ">=10.0.0",

package/scripts/check-classes.mjs

@@ -0,0 +1,409 @@
+#!/usr/bin/env node
+/**
+ * Fails if a class the given source uses is absent from the pre-built
+ * `@gravitee/graphene-core/styles` bundle, where it would silently render as nothing.
+ *
+ * Rationale and limits: USAGE_GUIDE.md → "Verifying class coverage".
+ *
+ * Compiles the source with Tailwind and diffs the emitted class set against the bundle's — real
+ * Tailwind output on both sides, so no extraction heuristics. Twice per target, unioned:
+ *
+ *   1. Graphene's theme, the one the bundle was built with. Finds classes the bundle didn't ship.
+ *   2. Tailwind's stock theme, plus Graphene's variants so `data-open:` still parses. Finds classes
+ *      Graphene's theme cannot generate at all. Pass 1 is blind to these — under `--color-*:
+ *      initial` there is no `yellow-500`, so `bg-yellow-500` emits nothing and the diff has nothing
+ *      to compare — yet they are just as dead in the bundle, and just as silent.
+ *
+ * Both passes only *discover* candidate names; bundle membership is the sole test. What discovery
+ * cannot narrow is Tailwind's own scan, which reads comments and string literals as readily as
+ * `className` — so a class named only in prose is still a finding. `--ignore` is the escape hatch,
+ * and it is checked for staleness so it cannot quietly rot into a list of excused regressions.
+ *
+ * Requires the installed `@gravitee/graphene-core` to have a built `dist/` — always true for a
+ * published install; in this repo, run `yarn build` first.
+ *
+ * Exit codes: 0 clean, 1 the check failed, 2 the tool could not run.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, isAbsolute, join, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import postcss from 'postcss';
+
+const require = createRequire(import.meta.url);
+
+// Resolved from this file, not the caller's cwd, so the answer is always about the copy of Graphene
+// the caller actually has installed.
+const PKG_ROOT = fileURLToPath(new URL('..', import.meta.url));
+const PKG = JSON.parse(readFileSync(join(PKG_ROOT, 'package.json'), 'utf8'));
+const fromExports = (subpath) => {
+  const target = PKG.exports[subpath];
+  // Conditional exports would need a resolver; these two entries are plain strings by design.
+  if (typeof target !== 'string') fail(`export '${subpath}' is not a plain path. This build cannot be probed.`);
+  return join(PKG_ROOT, target);
+};
+
+const CORE_BUNDLE = fromExports('./styles');
+const STYLES_DIR = dirname(fromExports('./tailwind-theme'));
+const PROBE_PRESET = join(STYLES_DIR, '_probe-preset.css');
+const CUSTOM_VARIANTS = join(STYLES_DIR, 'custom-variants.css');
+
+// Not shipped, so not part of the contract. Bare directories are handed to Tailwind for its own
+// file detection rather than an extension list, which is why markdown has to be excluded here: a
+// docs page demoing `h-[200px]` in a code block is not a component that will render unstyled.
+const DEFAULT_EXCLUDES = [
+  '**/*.stories.{ts,tsx,js,jsx,mdx}',
+  '**/*.{test,spec}.{ts,tsx,js,jsx}',
+  '**/__test__/**',
+  '**/__tests__/**',
+  '**/*.{md,mdx}',
+];
+
+const HELP = `Usage: graphene-check-classes <source>... [options]
+
+Fails if any class your source uses is absent from the pre-built
+@gravitee/graphene-core/styles bundle, where it would silently render as nothing.
+
+  <source>                A directory or glob to check. Repeatable; reported separately.
+                          Must exist — a path that resolves to nothing is an error, not a pass.
+  --advisory <source>     Same, but never fails the run. Repeatable.
+  --advisory-note <text>  Printed alongside advisory results (e.g. a tracking issue URL).
+  --exclude <glob>        Extra exclusion, relative to the current directory. Repeatable.
+                          Stories, tests and markdown are always excluded — they are not shipped.
+  --ignore <class>        Never report this class. Repeatable, or comma-separated. An ignore
+                          that stops matching anything fails the run, so the list cannot rot.
+
+Example:
+  graphene-check-classes src --advisory src/legacy --ignore bg-yellow-500`;
+
+function fail(message) {
+  console.error(`graphene-check-classes: ${message}`);
+  process.exit(2);
+}
+
+function parseArgs(argv) {
+  const enforced = [];
+  const advisory = [];
+  const excludes = [];
+  const ignores = new Set();
+  let advisoryNote = '';
+
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    const value = () => {
+      const next = argv[++i];
+      if (next === undefined) fail(`${arg} requires a value`);
+      return next;
+    };
+    if (arg === '--advisory') advisory.push(value());
+    else if (arg === '--advisory-note') advisoryNote = value();
+    // Resolved here rather than passed through: Tailwind resolves `@source not` against the probe
+    // stylesheet, which lives in node_modules, so a relative glob would silently match nothing.
+    else if (arg === '--exclude') excludes.push(toAbsoluteGlob(value()));
+    else if (arg === '--ignore') {
+      for (const name of value().split(',')) {
+        if (name.trim()) ignores.add(name.trim());
+      }
+    } else if (arg === '--help' || arg === '-h') {
+      console.log(HELP);
+      process.exit(0);
+    } else if (arg.startsWith('-')) fail(`unknown option ${arg}`);
+    else enforced.push(arg);
+  }
+
+  if (enforced.length === 0 && advisory.length === 0) {
+    fail('no sources given. Usage: graphene-check-classes <source>... (see --help)');
+  }
+  return { advisory, advisoryNote, enforced, excludes, ignores };
+}
+
+/**
+ * The CLI, plus a directory to compile from. Tailwind resolves `@import 'tailwindcss'` relative to
+ * the stylesheet, so the probe cannot live in the OS temp dir; writing it inside the `node_modules`
+ * that provides `tailwindcss` makes that resolution work wherever the package manager put it.
+ */
+function resolveTailwind() {
+  let cliPkgPath;
+  try {
+    cliPkgPath = require.resolve('@tailwindcss/cli/package.json');
+  } catch {
+    fail("could not resolve '@tailwindcss/cli'. Reinstall @gravitee/graphene-core, or add it yourself.");
+  }
+  const cliPkg = JSON.parse(readFileSync(cliPkgPath, 'utf8'));
+  const bin = typeof cliPkg.bin === 'string' ? cliPkg.bin : cliPkg.bin.tailwindcss;
+  const cli = join(dirname(cliPkgPath), bin);
+
+  // Prefer whatever `tailwindcss` this script sees; fall back to the CLI's own copy when a strict
+  // package manager has nested it out of reach.
+  let tailwindPkgPath;
+  for (const from of [require, createRequire(cliPkgPath)]) {
+    try {
+      tailwindPkgPath = from.resolve('tailwindcss/package.json');
+      break;
+    } catch {
+      /* try the next resolution root */
+    }
+  }
+  if (!tailwindPkgPath) fail("could not resolve 'tailwindcss'. Reinstall @gravitee/graphene-core.");
+
+  // `<…>/node_modules/tailwindcss/package.json` → `<…>/node_modules`
+  return { cli, scratchParent: dirname(dirname(tailwindPkgPath)) };
+}
+
+const { cli: TAILWIND_CLI, scratchParent: SCRATCH_PARENT } = resolveTailwind();
+
+/** Consume `.` then class-name characters, treating `\x` as one literal character. */
+const CLASS_TOKEN = /\.((?:\\.|[^\s.{},:>+~()[\]"'\\])+)/g;
+
+/**
+ * The utility each rule was generated for, unescaped to match what an author writes in `className`:
+ * `.bg-primary\/\[0\.08\]` → `bg-primary/[0.08]`. Walks rule nodes rather than regexing the file, so
+ * decimals in declaration values (`0.375rem`) are never read as class selectors.
+ *
+ * Only the *leftmost* class in each selector counts. Every other one is a class the utility is
+ * aimed at rather than a class being asked for: the `.group\/row` in `:is(:where(.group\/row):hover
+ * *)`, the `svg.lucide-check` in `[&>svg.lucide-check]:hidden`. Those are never utilities, carry no
+ * CSS of their own, and can only be in the bundle if some Graphene component happens to target the
+ * same name — so counting them reports classes nobody can act on. Verified against the shipped
+ * bundle: leftmost-only drops exactly 26 names, all of them `group`/`peer` markers or third-party
+ * hooks (`rdp-button_next`), and no real utility. Applied to both sides, so it stays symmetric.
+ *
+ * Rules nested under another rule are skipped entirely. Tailwind writes variants as nested CSS
+ * (`.group-has-\[\>svg\]\/alert\:col-start-2 { &:is(:where(.group\/alert):has(>svg) *) { … } }`) and
+ * only flattens them when minifying, so the inner rule is the same utility seen twice — with the
+ * targeted class now leftmost. Without this the probe and the minified bundle disagree about their
+ * own output. The test has to walk the whole ancestor chain rather than check the immediate parent:
+ * a responsive variant nests rule → `@media` → rule, which is how bare `peer` got through.
+ */
+function emittedClasses(css) {
+  const found = new Set();
+  postcss.parse(css).walkRules((rule) => {
+    for (let node = rule.parent; node; node = node.parent) {
+      if (node.type === 'rule') return;
+    }
+    for (const selector of rule.selectors) {
+      const first = selector.match(CLASS_TOKEN);
+      if (first) found.add(first[0].slice(1).replace(/\\(.)/g, '$1'));
+    }
+  });
+  return found;
+}
+
+/** Compile `sourceGlobs` under `themeImports` and return the classes Tailwind emits. */
+function compile(themeImports, sourceGlobs, excludes) {
+  const work = mkdtempSync(join(SCRATCH_PARENT, '.graphene-classes-'));
+  let tailwindError;
+  try {
+    const entry = join(work, 'probe.css');
+    writeFileSync(
+      entry,
+      [
+        // `source(none)` disables Tailwind's automatic source detection, which would otherwise walk
+        // out to the project root and pull in code the caller did not ask about.
+        `@import 'tailwindcss' source(none);`,
+        ...themeImports.map((file) => `@import '${file}';`),
+        ...sourceGlobs.map((glob) => `@source '${glob}';`),
+        ...excludes.map((glob) => `@source not '${glob}';`),
+        '',
+      ].join('\n'),
+    );
+    const out = join(work, 'probe.out.css');
+    try {
+      execFileSync(process.execPath, [TAILWIND_CLI, '-i', entry, '-o', out], { stdio: 'pipe' });
+    } catch (error) {
+      tailwindError = error;
+    }
+    if (!tailwindError) return emittedClasses(readFileSync(out, 'utf8'));
+  } finally {
+    rmSync(work, { recursive: true, force: true });
+  }
+
+  // Reported out here, not from the `catch` above: `fail()` calls process.exit(), which skips
+  // pending `finally` blocks, so failing inline would strand the scratch directory in the caller's
+  // node_modules — the one place it has to live and the last place they would look. A Tailwind
+  // failure is the tool not running, not a verdict about the caller's classes; hence exit 2.
+  fail(`Tailwind could not compile the probe for ${sourceGlobs.join(', ')}:\n${tailwindError.message}`);
+}
+
+const GLOB_CHARS = /[*?[\]{}]/;
+
+/** Anchor a caller-supplied glob to the current directory; `@source not` resolves from node_modules. */
+function toAbsoluteGlob(glob) {
+  return isAbsolute(glob) ? glob : join(process.cwd(), glob);
+}
+
+/** Absolute `@source` glob plus the exclusions that apply to it. */
+function sourceSpec(target, extraExcludes) {
+  const abs = isAbsolute(target) ? target : resolve(process.cwd(), target);
+  const literal = abs.slice(0, GLOB_CHARS.test(abs) ? abs.search(GLOB_CHARS) : abs.length);
+  // A bare directory is handed to Tailwind as-is so its own file detection applies; anything with
+  // glob syntax is the caller's business and passes through untouched. `dirname` alone would climb
+  // one level too far for the common `src/**/*.tsx` shape, whose literal prefix is already a
+  // directory — that only skews `locate`'s search root, but it skews it wider than the target.
+  const base = !GLOB_CHARS.test(abs) ? abs : literal.endsWith(sep) ? literal.slice(0, -1) : dirname(literal);
+  return {
+    base,
+    excludes: [...DEFAULT_EXCLUDES.map((glob) => join(base, glob)), ...extraExcludes],
+    glob: abs,
+  };
+}
+
+/**
+ * A target that resolves to nothing must be an error. Returning "0 classes, all present" for a
+ * renamed directory turns the CI gate into a green light that checks nothing — the exact shape of
+ * silent regression this tool exists to catch.
+ */
+function assertTargetExists(target, spec) {
+  try {
+    statSync(spec.base);
+  } catch {
+    fail(`source '${target}' does not exist (looked for ${spec.base}).`);
+  }
+}
+
+/** Characters that can continue a Tailwind class, so a match touching one is part of a longer name. */
+const CLASS_CHAR = /[\w\-./:%[\]]/;
+
+/** Does `className` appear in `text` as a whole class rather than as a prefix of a longer one? */
+function containsClass(text, className) {
+  const escaped = className.replace(/[.*+?^${}()|[\]\\/]/g, '\\$&');
+  return new RegExp(`(?<!${CLASS_CHAR.source})${escaped}(?!${CLASS_CHAR.source})`).test(text);
+}
+
+/** Where a missing class is written. Best-effort: returns nothing outside a git repository. */
+function locate(base, className) {
+  let hits;
+  try {
+    // `--untracked` matters more than it looks: the file you just created and have not added yet is
+    // exactly when you most need to be told where the dead class is.
+    hits = execFileSync('git', ['grep', '-l', '-F', '--untracked', '-e', className, '--', base], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+  } catch {
+    return [];
+  }
+  return (
+    hits
+      .split('\n')
+      .filter(Boolean)
+      .filter((f) => !f.includes('.stories.') && !f.includes('.test.') && !f.includes('.spec.'))
+      .filter((f) => !/(^|\/)__tests?__\//.test(f))
+      // git's own `-w` bounds on word characters, which does not bound a Tailwind class: it happily
+      // matches `[&_code]:rounded` inside `[&_code]:rounded-sm`, and `gap-x` inside `gap-x-4`. Confirm
+      // each candidate here instead, where the boundary can be spelled correctly.
+      .filter((f) => {
+        try {
+          return containsClass(readFileSync(f, 'utf8'), className);
+        } catch {
+          return false;
+        }
+      })
+  );
+}
+
+/** Every class the source needs, from both discovery passes (see header). */
+function classesRequiredBy(spec) {
+  const constrained = compile([PROBE_PRESET], [spec.glob], spec.excludes);
+  const stockTheme = compile([CUSTOM_VARIANTS], [spec.glob], spec.excludes);
+  return new Set([...constrained, ...stockTheme]);
+}
+
+const { advisory, advisoryNote, enforced, excludes, ignores } = parseArgs(process.argv.slice(2));
+
+for (const [label, path] of [
+  ['bundle', CORE_BUNDLE],
+  ['probe preset', PROBE_PRESET],
+]) {
+  try {
+    statSync(path);
+  } catch {
+    fail(`${label} not found at ${path}. @gravitee/graphene-core@${PKG.version} looks unbuilt — run \`yarn build\`.`);
+  }
+}
+
+const shipped = emittedClasses(readFileSync(CORE_BUNDLE, 'utf8'));
+console.log(`@gravitee/graphene-core@${PKG.version} — ${shipped.size} classes emitted by its /styles bundle\n`);
+
+const usedIgnores = new Set();
+
+/** Compile one target and split what it needs into reported misses and ignored ones. */
+function evaluate(target) {
+  const spec = sourceSpec(target, excludes);
+  assertTargetExists(target, spec);
+  const required = classesRequiredBy(spec);
+  const absent = [...required].filter((c) => !shipped.has(c)).sort();
+  for (const className of absent) {
+    if (ignores.has(className)) usedIgnores.add(className);
+  }
+  return {
+    ignored: absent.filter((c) => ignores.has(c)),
+    missing: absent.filter((c) => !ignores.has(c)),
+    required,
+    spec,
+  };
+}
+
+const suffix = (ignored) => (ignored.length ? ` (${ignored.length} ignored)` : '');
+
+let failed = false;
+
+for (const target of enforced) {
+  const { ignored, missing, required, spec } = evaluate(target);
+
+  if (missing.length === 0) {
+    console.log(`  ✓ ${target} — ${required.size} classes, all present in the bundle${suffix(ignored)}`);
+    continue;
+  }
+
+  failed = true;
+  console.log(`  ✗ ${target} — ${missing.length} class(es) absent from the bundle${suffix(ignored)}:\n`);
+  for (const className of missing) {
+    console.log(`      ${className}`);
+    for (const file of locate(spec.base, className)) console.log(`        ${file}`);
+  }
+  console.log('');
+}
+
+// A bare count, never fatal, so the enforced results above stay readable in CI output.
+for (const target of advisory) {
+  const { ignored, missing } = evaluate(target);
+  const status = missing.length === 0 ? `✓ ${target} — 0 missing` : `! ${target} — ${missing.length} missing`;
+  console.log(`  ${status}${suffix(ignored)} (advisory, not enforced${advisoryNote ? ` — ${advisoryNote}` : ''})`);
+}
+
+// An ignore list nobody prunes is the "documented list of known-dead classes" this check replaced.
+// Once a class is genuinely fixed or genuinely gone, its ignore has to go with it.
+const staleIgnores = [...ignores].filter((c) => !usedIgnores.has(c)).sort();
+if (staleIgnores.length > 0) {
+  failed = true;
+  const noun = staleIgnores.length === 1 ? 'entry' : 'entries';
+  console.log(`\n  ✗ ${staleIgnores.length} --ignore ${noun} matched nothing and should be dropped:\n`);
+  for (const className of staleIgnores) console.log(`      ${className}`);
+}
+
+if (failed) {
+  console.log(
+    [
+      '',
+      'These classes render as no-ops for anyone importing the pre-built',
+      '@gravitee/graphene-core/styles without running Tailwind over Graphene themselves.',
+      '',
+      "Fix by preference order (Graphene's spacing scale is sparse — 0 0.5 1 1.5 2 2.5 3 3.5 4 5 6",
+      '7 8 9 10 12 16 20 24 32 40 44 48 56 64 72 80 96 px — so other two-digit steps (w-52, w-60,',
+      'and friends) do NOT exist here):',
+      '  1. Use a standard utility that is actually on that scale (w-[2.5rem] → w-10).',
+      '  2. Move one-off structural values into an inline `style`.',
+      '  3. If the utility is genuinely common, ask for it in the bundle:',
+      `     ${PKG.bugs.url}`,
+      '',
+      'If the name is not a class at all — prose in a comment, a string that happens to look like',
+      'one — `--ignore <class>` suppresses it, and fails later if it ever stops matching.',
+    ].join('\n'),
+  );
+  process.exit(1);
+}
+
+console.log('\nAll enforced sources are portable against this bundle.');