@homepages/template-kit 0.1.0 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,225 @@
 # @homepages/template-kit
 
+## 0.3.0
+
+### Minor Changes
+
+- bdb4dec: `zod` is now the kit's only dependency of any kind, besides its React peers. ESLint,
+  `@typescript-eslint/parser` and `esbuild` are no longer declared by the kit at all — a
+  linter and a bundler are development tools, and as dependencies they landed in the
+  **production** install of every consumer, including apps that only render a published
+  template and deploy with `npm ci --omit=dev`. For a consuming service that lints, the
+  production dependency graph drops by roughly 125 packages.
+
+  **Action required if you use the ESLint preset or the `check` command** — install the
+  toolchain they run, which they now resolve from your workspace rather than shipping
+  their own copy of:
+
+  ```bash
+  npm i -D eslint @typescript-eslint/parser   # for @homepages/template-kit/eslint
+  npm i -D typescript esbuild                 # for template-kit check (with the two above)
+  ```
+
+  Nothing changes for code that only imports the kit's primitives, schema system or theme
+  tokens. The preset's rules and parser wiring are unchanged; `check`'s stages and rule ids
+  are unchanged — and it now reports a missing tool by name, with the install line, instead
+  of failing obscurely. As a side benefit, `check` runs against _your_ pinned TypeScript,
+  ESLint and esbuild.
+
+- 49177ab: Adds the `check` command: `template-kit check [template] [--all] [--json]`. Runs a
+  template's authoring contract end to end — type errors, the lint preset, the schema and
+  manifest contracts, section-folder structure (contract files present, editor slot
+  markers, hand-CSS hygiene), a render-regression pass (determinism, broken images, and
+  other objective defects), and per-section bundle-size budgets — plus workspace-wide
+  dependency gates (lockfile health, a single copy of React, dependency licenses,
+  vulnerability severity) evaluated once per run. Every failure prints a stable rule id, a
+  file and line, and a one-line fix. Exits non-zero on any failure; pass `--json` for a
+  script-consumable report.
+- 2a30f0b: `template-kit theme` generates your template's `theme.css` from its `theme.ts`.
+
+  `@theme` is a Tailwind directive — it only does anything when a real `.css` file carrying
+  it flows through your Tailwind entry. So the alias layer `compileThemeToCss` produces from
+  your `theme.ts` has to reach that entry as a file. Rather than call the compiler from your
+  own build script (and risk `theme.css` silently drifting from `theme.ts`), run:
+
+  ```
+  template-kit theme            # the template in the current folder
+  template-kit theme <name>     # a named template
+  template-kit theme --all      # every template in the workspace
+  ```
+
+  It reads `templates/<key>/theme.ts` (which must `export const theme: TokenTheme`), validates
+  it, and writes `templates/<key>/theme.css` with a "generated — do not edit" header. Import
+  that file into your Tailwind entry after `@import "tailwindcss"` and the kit's `styles.css`:
+
+  ```css
+  @import "tailwindcss";
+  @import "@homepages/template-kit/styles.css";
+  @import "./theme.css"; /* generated by `template-kit theme` */
+  ```
+
+  Re-run the command whenever you change `theme.ts`; a token you add becomes a working Tailwind
+  utility with nothing else to edit. A missing `theme.ts`, a missing `theme` export, or a theme
+  that fails validation each fail with an actionable message.
+
+- e15de58: Your template now owns its design tokens end to end — and names them itself.
+
+  `TokenTheme` no longer imposes a vocabulary. Instead of satisfying a fixed set of
+  semantic roles (`ink`, `surfaceAlt`, `primaryStrong`, …), you declare whatever tokens
+  your design actually has, under kebab-case names you choose, and `compileThemeToCss`
+  generates the Tailwind `@theme inline` alias layer from them. Declare `lagoon` and
+  `bg-lagoon` exists. Nothing is required, and Tailwind's own defaults (`text-2xl`,
+  `rounded-lg`, `red-500`) still work underneath, so a sparse theme is a working theme.
+
+  This also closes the hole that made the old "open palette" a fiction: a brand swatch
+  only became a usable utility once it was added to the kit's shared `styles.css`, so it
+  was never really yours. There is no shared file to edit any more.
+
+  **Upgrading — three changes:**
+
+  1. **Rewrite `theme.ts`.** `colors` and `palette` merge into one open record, and keys
+     become kebab-case (`inkSoft` → `ink-soft`). `fontFaces` moves out of `fonts` to the
+     top level. Emission is verbatim: the key `ink-soft` becomes `--tr-color-ink-soft` and
+     the `text-ink-soft` utility.
+
+     One token yields exactly one utility, so two utility names mean two tokens. If you
+     relied on an alias that pointed two names at one value, declare both.
+
+  2. **Add a `document` block.** The `body` defaults can no longer be assumed — there is no
+     `ink` to guess at — so name the tokens that dress the page:
+
+     ```ts
+     document: { font: "sans", color: "ink", background: "page", fontSize: "base" }
+     ```
+
+     Each reference is validated against your declared tokens: a typo fails at build
+     rather than rendering an unthemed page in silence.
+
+  3. **Import your compiled theme into your Tailwind entry.** `@theme` is a Tailwind
+     directive and is inert outside the build graph, so the theme partial must be
+     `@import`ed by your entry, after the kit's `styles.css`:
+
+     ```css
+     @import "tailwindcss";
+     @import "@homepages/template-kit/styles.css";
+     @import "./theme.css"; /* compileThemeToCss output */
+     ```
+
+  `styles.css` and `base.css` keep their export paths — no import changes. `styles.css`
+  now carries only the breakpoint ladder, the `--spacing` base unit, and the motion
+  defaults.
+
+  The `Image` primitive no longer paints its frame with `bg-surface-alt` (a token your
+  theme may not declare). The fill lives on `.tr-image-frame` in `base.css`; retint it by
+  setting `--tr-image-frame-bg`.
+
+- 57eddee: Migrate the schema system from Zod 3 to Zod 4.
+
+  `zod` is the kit's one runtime dependency, and it now tracks Zod 4 (`"zod": "^4"`).
+  Because the types you author section schemas against are Zod types, bumping Zod a
+  major is a breaking change for authors: your workspace resolves Zod 4 in its
+  lockfile, and the schema/slot types you see in editor tooltips are now Zod 4 types.
+
+  **Action required** — if your workspace declares `zod`, move it to `^4` so a single
+  Zod copy resolves across your workspace and the kit:
+
+  ```bash
+  npm i zod@^4
+  ```
+
+  Nothing else changes. The authoring API is untouched — the slot-type catalog, the
+  source/transform vocabulary, and `SectionProps<typeof schema>` inference are all
+  identical, and every section still materializes to a byte-identical serialized
+  schema. This is a dependency migration, invisible to an author apart from the Zod
+  version in the lockfile.
+
+### Patch Changes
+
+- 6675c4c: `no-hex` no longer reports a `color-mix()` whose colour arguments are all theme-derived.
+  A mix over `var(--…)` references, `transparent`, or `currentColor` carries no palette of
+  its own — it composes a state colour (hover, active, pressed) out of the theme the
+  section was handed — so banning it contradicted the rule's own reason. A hard-coded
+  argument still reports: `color-mix(in srgb, var(--tr-color-primary) 80%, #fff)` and
+  `color-mix(…, white)` are violations, as is a `var()` fallback that bakes a colour
+  (`var(--x, #fff)`). The carve-out is `color-mix()` only — `rgb()`, `oklch()`, and the
+  rest take raw channel values and stay banned outright, so the "a section carries zero
+  palette" guarantee is unchanged.
+- 1749cea: `no-hex` now ships as a **warning**, not an error. Centralized theme colours are
+  encouraged, not gated: a hard-coded colour still squiggles in the editor and the rule
+  still explains how to derive the colour from theme tokens, but it no longer fails
+  `template-kit check` locally or at ingest (both gate on errors only). Every other preset
+  rule stays an error — this is the one advisory rule. The `color-mix()` over theme-derived
+  arguments carve-out is unchanged; it just governs a warning now instead of an error.
+
+## 0.2.0
+
+### Minor Changes
+
+- e64d4d7: `base.css` no longer ships a reset — Tailwind's preflight (from your entry's
+  `@import "tailwindcss"`) already is one, and the two were duplicating each other. It
+  now carries only the three declarations preflight does not make: font-smoothing,
+  `button { cursor: pointer }`, and `svg { max-width: 100% }`.
+
+  **`base.css` now requires a Tailwind entry on the page.** If a page loads `base.css`
+  without an `@import "tailwindcss"` entry present — a standalone preview, an embed, a
+  hand-written CSS page — it renders fully unreset (UA body margin, bulleted lists,
+  underlined links, unconstrained inline images), and nothing errors to tell you.
+  Confirm every page that loads `base.css` also loads a Tailwind entry.
+
+  `base.css` also no longer references any theme token. The `body` document defaults
+  (font, color, background, size) are now emitted by `compileThemeToCss`, alongside the
+  `:root` block that defines those tokens. **Regenerate and republish your compiled theme
+  CSS.** If you upgrade `base.css` but keep serving a previously-compiled theme
+  stylesheet, that stylesheet still only has the old `:root` block — `body` silently
+  loses `font-family`, `color`, `background`, and `font-size` page-wide, because
+  `base.css` no longer carries them as a fallback. The compiled output's content hash
+  changes.
+
+  The `--tr-space-*` scale is removed — Tailwind's own spacing scale (`p-4`, `gap-6`)
+  was never aliased to it. Any of your CSS still referencing `var(--tr-space-*)` (e.g.
+  `padding: var(--tr-space-4)`) now points at an undefined custom property, which is
+  invalid at computed-value time, so the declaration drops. The `scroll-behavior` /
+  `scroll-padding-top` policy is removed; set it in your own template stylesheet if you
+  have a sticky header.
+
+- a24174f: Every rule-id now resolves to a page. The lint preset and `template-kit check` share one
+  id namespace (`template-kit/<id>`), and each of those ids — all 28 — now has a page at
+  `docs/rules/<id>.md` giving the rule, the reason it exists, and a before/after fix you can
+  copy.
+
+  The docs ship **inside the tarball**, so the loop closes with no network: hit
+  `template-kit/no-hex`, read `node_modules/@homepages/template-kit/docs/rules/no-hex.md`,
+  fix it. That matters most for the coding agents authoring against this kit — an agent that
+  can resolve a failure to its own reference page fixes the violation instead of guessing at
+  it.
+
+  Each ESLint rule also carries `meta.docs.url` pointing at its page, so an editor's "show
+  documentation for this rule" lands on the same file.
+
+  Start at `docs/rules/INDEX.md`. `docs/rules/server-vs-client.md` explains the one concept
+  several rules assume — that server-vs-client is a **per-file** fact, decided by the
+  `"use client"` directive prologue, not by an import graph.
+
+### Patch Changes
+
+- be1507d: Fixed `no-css-import-from-render-path`, which banned the one legal way to get a
+  third-party stylesheet into a section.
+
+  A **bare** `.css` specifier in the render path — `import "swiper/css"` in `Renderer.tsx`,
+  in a marked enhancer, or in any module either one imports — is how a package's CSS reaches
+  the section's cascade layer: the build bundles that import graph precisely to harvest it.
+  The rule flagged it anyway, and its `Fix:` hint sent you to `@import` the stylesheet from
+  `styles.css`, which is never legal there (hand-written CSS is wrapped in `@layer`, where a
+  browser drops an `@import` silently).
+
+  The rule now reports only a **local** stylesheet import — a relative or absolute specifier.
+  That is the real defect: the build already collects every `.css` file in the section folder
+  by filename, so importing one from code ships its rules twice and can corrupt the cascade.
+
+  If you worked around the old rule by moving a package's CSS into a stylesheet `@import`,
+  move it back into the module that needs it — see `docs/rules/no-css-import-from-render-path.md`
+  and `docs/rules/no-bare-css-import.md`, which are the two halves of the same mental model.
+
 ## 0.1.0
 
 ### Minor Changes

package/README.md

@@ -1,21 +1,32 @@
 # @homepages/template-kit
 
 The authoring surface for HomePages marketing-section templates: schema system,
-contract primitives, theme tokens, and the `template-kit` CLI.
+contract primitives, the theme system, and the `template-kit` CLI.
 
 **Status: 0.0.x.** The **schema system** (the section authoring contract and the closed
-vocabulary it validates against), the **contract primitives**, and the **theme tokens**
+vocabulary it validates against), the **contract primitives**, and the **theme system**
 are complete — a section is authorable end to end against the kit. The `template-kit`
-CLI's commands are still being extracted.
+CLI's `check` and `theme` commands are implemented — see
+[Checking a workspace](#checking-a-workspace) and
+[Generating a theme](#generating-a-theme) below; its other commands arrive with the
+surfaces they drive.
 
 ## Install
 
 ```bash
 npm install @homepages/template-kit react react-dom
+npm install -D typescript eslint @typescript-eslint/parser esbuild   # the authoring toolchain
 ```
 
 React 19 is a **peer dependency** — the kit never bundles its own copy.
 
+The kit has exactly **one runtime dependency** (`zod`). The authoring toolchain the
+[`check` command](docs/check.md) and the [ESLint preset](docs/eslint.md) run on is
+yours: both resolve TypeScript, ESLint, the parser and esbuild from your workspace, so
+your pinned versions are the ones that judge your code. The kit does not depend on them
+at all — which is why a linter never lands in the production install of an app that
+merely renders a published template.
+
 ## Authoring a section
 
 A section is four files: `schema.ts` (slots + options), `fill-spec.ts` (how AI
@@ -64,24 +75,64 @@ Full contract: **[docs/primitives.md](docs/primitives.md)**.
 | `@homepages/template-kit` | Authoring API — schema system, primitives, marker contract, theme types, and the golden fixtures |
 | `@homepages/template-kit/island-runtime` | Browser loader that hydrates a page's islands |
 | `@homepages/template-kit/browser` | Browser helpers for published pages (site config, signed ingest) |
-| `@homepages/template-kit/styles.css` | Tailwind v4 theme tokens, the breakpoint ladder, kit source registration |
-| `@homepages/template-kit/base.css` | The page's base stylesheet: layer order, reset, `.tr-section`, universal tokens |
+| `@homepages/template-kit/styles.css` | The global Tailwind preamble: the breakpoint ladder, the spacing base unit, the motion defaults, kit source registration |
+| `@homepages/template-kit/base.css` | Cascade-layer order, the three reset gaps Tailwind's preflight leaves, `.tr-section`, and the motion tokens |
 | `@homepages/template-kit/eslint` | ESLint flat-config preset |
 | `@homepages/template-kit/tsconfig` | tsconfig preset (`"extends"`) |
 
 The authoring API has **no subpath imports** — one specifier for everything you
 write a section against. The two CSS entries are the deliberate exception.
 
-`styles.css` does **not** import Tailwind. Import it *after* Tailwind in your entry:
+`styles.css` does **not** import Tailwind. Import it *after* Tailwind in your entry, then
+your generated theme after that:
 
 ```css
 @import "tailwindcss";
 @import "@homepages/template-kit/styles.css";
+@import "./theme.css";                 /* generated by `template-kit theme` from theme.ts */
+```
+
+Two `@import "tailwindcss"` in one graph double-emits preflight. Your generated theme
+belongs in this entry and nowhere else: it carries an `@theme` block, a Tailwind directive
+that is inert outside the build graph. `base.css` is not part of that entry — it loads as
+its own stylesheet on the page. `base.css` ships no reset of its own — it depends on the
+preflight your entry's `@import "tailwindcss"` brings. Both must be on the page. Full
+contract: **[docs/theme-and-css.md](docs/theme-and-css.md)**.
+
+## Rules
+
+The lint preset and the `template-kit check` CLI share one id namespace,
+`template-kit/<id>`. A rule-id printed by either resolves to a page —
+`docs/rules/<id>.md` — giving the rule, the reason it exists, and a before/after fix.
+Start at **[docs/rules/INDEX.md](docs/rules/INDEX.md)**; the full doc set is routed
+from **[docs/INDEX.md](docs/INDEX.md)**.
+
+## Generating a theme
+
+```bash
+template-kit theme          # infer the template from cwd, or the workspace's one template
+template-kit theme --all    # generate every template's theme.css
+```
+
+`theme` compiles a template's `theme.ts` into `templates/<key>/theme.css` — the file your
+Tailwind entry imports. The output is generated: don't hand-edit it, and re-run the
+command whenever `theme.ts` changes. Full contract:
+**[docs/theme-and-css.md](docs/theme-and-css.md#generating-themecss)**.
+
+## Checking a workspace
+
+```bash
+template-kit check          # infer the template from cwd, or the workspace's one template
+template-kit check --all    # check every template
+template-kit check --json   # machine-readable report
 ```
 
-Two `@import "tailwindcss"` in one graph double-emits preflight. `base.css` is not part
-of that entry — it loads as its own stylesheet on the page. Full contract:
-**[docs/theme-and-css.md](docs/theme-and-css.md)**.
+`check` typechecks, lints, and validates a template's schema/fill-spec/fixtures/manifest
+contracts, runs a determinism render probe, and enforces per-section byte budgets —
+plus workspace-wide dependency gates (lockfile health, a single React, license and
+vulnerability checks) evaluated once per run. It exits non-zero on any failure and is
+the same gate the platform re-runs when you submit a template. Full contract:
+**[docs/check.md](docs/check.md)**.
 
 ## Development
 
@@ -91,11 +142,13 @@ npm run check     # typecheck + lint + build + island-size gate + test + publint
 ```
 
 `npm run verify:consumer` is the boundary gate: it packs the kit, installs the
-tarball into a scratch project, and asserts that types resolve; that a real section
+tarball into scratch projects, and asserts that a service which pins the kit and
+deploys with `npm ci --omit=dev` installs no ESLint or esbuild package at all, with
+`dependencies` carrying nothing but `zod`; that types resolve; that a real section
 triple typechecks against the installed package, with a misspelled property fact or
-slot key still failing to compile; that Tailwind's cross-package `@source` scan
-reaches the shipped `dist`; and that only one React ends up in the tree. Run it
-before every release.
+slot key still failing to compile; that the ESLint preset lints using the consumer's
+own parser; that Tailwind's cross-package `@source` scan reaches the shipped `dist`;
+and that only one React ends up in the tree. Run it before every release.
 
 The island loader (`@homepages/template-kit/island-runtime`) has its own gate,
 `npm run size:islands`: it must stay under 3072 B gzip and never import
@@ -121,9 +174,10 @@ token anywhere, and adding one would silently disable OIDC.
 
 3. **Merge the Version Packages PR.** That merge publishes to npm.
 
-Semver contract: the platform vocabulary (slot types, sources, transforms,
-tokens) is closed and versioned. A breaking change to it is a **major**; a new
-optional capability is a **minor**.
+Semver contract: the platform vocabulary (slot types, sources, transforms) is
+closed and versioned. A breaking change to it is a **major**; a new optional
+capability is a **minor**. Design tokens are *not* part of that vocabulary —
+your template names its own.
 
 ### Bumping the version by hand
 

package/dist/base.css

@@ -7,52 +7,47 @@
  *
  * Contains:
  *   - The cascade-layer order declaration above — the one place it is stated
- *   - The @layer base reset
- *   - Document defaults (html/body)
+ *   - The three reset gaps Tailwind's preflight leaves (below)
  *   - The section box model (.tr-section, emitted by the <Section> primitive)
- *   - Universal tokens: the spacing scale and motion
+ *   - The <Image> frame's placeholder fill (.tr-image-frame)
+ *   - Universal tokens: motion
  *
- * NOT here: anything a template owns. Colors, fonts, type, radii, shadows and
- * layout all come from your theme.ts, compiled by compileThemeToCss into a
- * `:root { --tr-*: … }` block. Component styling is Tailwind utilities written
- * on the elements themselves.
+ * REQUIRES A TAILWIND ENTRY ON THE PAGE. Your entry's `@import "tailwindcss"` brings
+ * Tailwind's preflight, and preflight does the reset: box-sizing, margin/padding,
+ * list-style, the button and anchor resets, display:block on replaced elements. This
+ * file only fills the three gaps preflight leaves. Ship base.css without a Tailwind
+ * entry and you get an unreset page.
+ *
+ * NOT here: anything a template owns. Colors, fonts, type, radii, shadows and layout
+ * — and the `body` document defaults that apply them — all come from your theme.ts,
+ * compiled by compileThemeToCss. This file references no theme token at all.
  */
 
-/* ----- Reset (lightweight; assumes modern browsers) --------------------- *
+/* ----- Reset gaps ------------------------------------------------------- *
+ * The three declarations Tailwind's preflight does NOT make. Each is load-bearing:
+ * delete one and your page changes.
+ *
  * Wrapped in `@layer base` so Tailwind's utilities (which compile into
- * `@layer utilities`) win over these element defaults. Unlayered, a rule like
- * `a { color: inherit }` would beat the layered `.text-ink` utility outright —
- * unlayered always wins over layered in the cascade.
+ * `@layer utilities`) win over these element defaults. Unlayered, `button { cursor:
+ * pointer }` would beat a layered `.cursor-default` utility outright — unlayered
+ * always wins over layered in the cascade.
  */
 
 @layer base {
-  *, *::before, *::after { box-sizing: border-box; }
-  html, body { margin: 0; padding: 0; }
+  /* preflight carries no font-smoothing rule at all */
   body { -webkit-font-smoothing: antialiased; -moz-osx-font-smoothing: grayscale; }
-  img, svg, video { display: block; max-width: 100%; }
-  button { background: none; border: 0; padding: 0; cursor: pointer; font: inherit; color: inherit; }
-  a { color: inherit; text-decoration: none; }
-  ul, ol { margin: 0; padding: 0; list-style: none; }
-  h1, h2, h3, h4, h5, h6, p { margin: 0; }
-}
-
-/* ----- Document defaults ------------------------------------------------ */
-
-html { scroll-behavior: smooth; scroll-padding-top: var(--tr-header-height); }
-body {
-  font-family: var(--tr-font-sans);
-  color: var(--tr-color-ink);
-  background: var(--tr-color-background);
-  font-size: var(--tr-text-base);
-  line-height: 1.5;
+  /* Tailwind v4 deliberately leaves buttons at the UA default `cursor: default` */
+  button { cursor: pointer; }
+  /* preflight caps max-width on img and video, but not on svg */
+  svg { max-width: 100%; }
 }
 
 /* ----- Primitives ------------------------------------------------------- */
 
-/* The full-bleed section root, emitted by the <Section> primitive. Always 100%
- * wide with zero padding/margin, so adjacent sections butt edge-to-edge and a page
- * composes as a vertical stack with no framework-injected whitespace. A section
- * brings its own background and internal padding. */
+/* The full-bleed section root, emitted by the <Section> primitive. Always 100% wide
+ * with zero padding/margin, so adjacent sections butt edge-to-edge and a page composes
+ * as a vertical stack with no framework-injected whitespace. A section brings its own
+ * background and internal padding. */
 .tr-section {
   display: block;
   width: 100%;
@@ -60,24 +55,17 @@ body {
   margin: 0;
 }
 
+/* The <Image> frame's placeholder fill, showing while an image is absent or loading.
+ * It is a plain class rather than a `bg-*` utility on the primitive because a template
+ * names its own tokens — there is no colour token this primitive may assume exists.
+ * Retint it by setting --tr-image-frame-bg in your theme's layout tokens. */
+.tr-image-frame {
+  background-color: var(--tr-image-frame-bg, oklch(0.97 0 0));
+}
+
 /* ----- Universal tokens ------------------------------------------------- */
 
 :root {
-  /* Spacing scale */
-  --tr-space-1: 0.25rem;
-  --tr-space-2: 0.5rem;
-  --tr-space-3: 0.75rem;
-  --tr-space-4: 1rem;
-  --tr-space-5: 1.25rem;
-  --tr-space-6: 1.5rem;
-  --tr-space-8: 2rem;
-  --tr-space-10: 2.5rem;
-  --tr-space-12: 3rem;
-  --tr-space-16: 4rem;
-  --tr-space-20: 5rem;
-  --tr-space-24: 6rem;
-  --tr-space-32: 8rem;
-
   /* Motion */
   --tr-duration-fast: 150ms;
   --tr-duration-base: 250ms;

package/dist/cli/check/config.js

@@ -0,0 +1,37 @@
+//#region src/cli/check/config.ts
+const CHECK_CONFIG = {
+	size: {
+		/** Gzipped bytes of a section's renderer bundle, React excluded. */
+		rendererBundleGzip: 50 * 1024,
+		/** Gzipped bytes of a section's stylesheet, including CSS pulled in from packages. */
+		sectionCssGzip: 50 * 1024
+	},
+	audit: { 
+	/** A vulnerability at or above this severity fails the check. */
+failOn: ["high", "critical"] },
+	/**
+	* A package whose license is not on this list fails the check. A missing
+	* license field, or a bespoke "SEE LICENSE IN …", is a denial — not a pass.
+	*/
+	licenseAllowlist: [
+		"MIT",
+		"ISC",
+		"Apache-2.0",
+		"BSD-2-Clause",
+		"BSD-3-Clause",
+		"0BSD",
+		"Unlicense",
+		"CC0-1.0"
+	],
+	/**
+	* The license gate walks the *shipped* dependency graph of every third-party
+	* package a template pulls in — this is the first-party exception to that.
+	* The kit itself is `UNLICENSED` by design (it is not published for reuse
+	* outside this platform) and every workspace depends on it, so without this
+	* exemption the gate would deny the kit on a stock, correct workspace.
+	*/
+	licenseExemptions: ["@homepages/template-kit"]
+};
+
+//#endregion
+export { CHECK_CONFIG };

package/dist/cli/check/css.js

@@ -0,0 +1,117 @@
+import { loadEsbuild } from "./resolve-tool.js";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { readdir } from "node:fs/promises";
+
+//#region src/cli/check/css.ts
+/**
+* Every `.css` file anywhere in a section folder (the folder is free-form —
+* an author may nest CSS under components/, enhancers/, wherever), in
+* published order: `styles.css` first (the conventional root-level home),
+* then every other file sorted by path. `snapshots/` and `node_modules/` are
+* skipped — generated or not authored, never hand-CSS.
+*/
+async function sectionCssFiles(dir) {
+	if (!existsSync(dir)) return [];
+	const found = [];
+	const walk = async (d) => {
+		for (const entry of await readdir(d, { withFileTypes: true })) {
+			const full = join(d, entry.name);
+			if (entry.isDirectory()) {
+				if (entry.name === "snapshots" || entry.name === "node_modules") continue;
+				await walk(full);
+			} else if (entry.isFile() && entry.name.endsWith(".css")) found.push(full);
+		}
+	};
+	await walk(dir);
+	const own = join(dir, "styles.css");
+	const rest = found.filter((f) => f !== own).sort();
+	return (existsSync(own) ? [own] : []).concat(rest);
+}
+const CSS_ASSET_LOADERS = {
+	".svg": "dataurl",
+	".png": "dataurl",
+	".jpg": "dataurl",
+	".jpeg": "dataurl",
+	".gif": "dataurl",
+	".webp": "dataurl",
+	".woff": "dataurl",
+	".woff2": "dataurl",
+	".ttf": "dataurl",
+	".eot": "dataurl"
+};
+/**
+* A section's third-party package CSS — discovered by the bundler, not
+* declared. An author writes `import "swiper/css"` in Renderer.tsx exactly
+* as in React; this runs a CSS-only esbuild pass rooted at Renderer.tsx and
+* returns the emitted stylesheet (empty string if there is none).
+*
+* A relative CSS import in the render path is a lint error
+* (`no-css-import-from-render-path`, already enforced by ESLint) — this pass
+* does not re-implement that rejection, it only has to not crash on one.
+*
+* `platform: "neutral"` defaults `mainFields` to `[]`, which cannot resolve a
+* package that ships only a CJS `main` (no `exports` map) — `mainFields`
+* is set explicitly so such a package still resolves to its ESM `module`
+* build where one exists.
+*/
+async function compileSectionPackageCss(workspaceRoot, sectionDir) {
+	const renderer = join(sectionDir, "Renderer.tsx");
+	if (!existsSync(renderer)) return "";
+	const { build } = await loadEsbuild(workspaceRoot);
+	const css = (await build({
+		entryPoints: [renderer],
+		bundle: true,
+		write: false,
+		minify: true,
+		outdir: join(workspaceRoot, "node_modules", ".template-kit", "check-css"),
+		format: "esm",
+		target: "es2022",
+		platform: "neutral",
+		mainFields: ["module", "main"],
+		jsx: "automatic",
+		external: [
+			"react",
+			"react-dom",
+			"react/jsx-runtime"
+		],
+		loader: { ...CSS_ASSET_LOADERS },
+		absWorkingDir: workspaceRoot,
+		logLevel: "silent"
+	})).outputFiles?.find((f) => f.path.endsWith(".css"));
+	return css ? css.text : "";
+}
+/**
+* The 1-based line of the first top-level `@import`, or `undefined` if there
+* is none. Comment-aware: an `@import` mentioned inside a CSS block comment
+* is prose (e.g. a header warning authors not to write one), not a rule — a
+* naive line-regex would false-fire on it.
+*/
+function findImportLine(css) {
+	const lines = css.split("\n");
+	let inComment = false;
+	for (let i = 0; i < lines.length; i++) {
+		let line = lines[i];
+		if (inComment) {
+			const close = line.indexOf("*/");
+			if (close === -1) continue;
+			line = line.slice(close + 2);
+			inComment = false;
+		}
+		for (;;) {
+			const open = line.indexOf("/*");
+			if (open === -1) break;
+			const close = line.indexOf("*/", open + 2);
+			if (close === -1) {
+				line = line.slice(0, open);
+				inComment = true;
+				break;
+			}
+			line = line.slice(0, open) + line.slice(close + 2);
+		}
+		if (/^\s*@import\b/.test(line)) return i + 1;
+	}
+}
+
+//#endregion
+export { CSS_ASSET_LOADERS, compileSectionPackageCss, findImportLine, sectionCssFiles };

package/dist/cli/check/diagnostics.js

@@ -0,0 +1,32 @@
+//#region src/cli/check/diagnostics.ts
+function location(d) {
+	if (!d.file) return "";
+	return d.line === void 0 ? d.file : `${d.file}:${d.line}`;
+}
+function formatOne(d) {
+	const where = location(d);
+	return `${where ? `  ${where}\n` : ""}    [${d.ruleId}] ${d.message}\n    fix: ${d.fix}\n`;
+}
+function formatHuman(report) {
+	const parts = [];
+	for (const [key, t] of Object.entries(report.templates)) {
+		if (t.ok) {
+			parts.push(`✓ ${key}\n`);
+			continue;
+		}
+		parts.push(`✗ ${key} — ${String(t.diagnostics.length)} problem(s)\n`);
+		for (const d of t.diagnostics) parts.push(formatOne(d));
+	}
+	if (!report.workspace.ok) {
+		parts.push(`✗ workspace — ${String(report.workspace.diagnostics.length)} problem(s)\n`);
+		for (const d of report.workspace.diagnostics) parts.push(formatOne(d));
+	}
+	if (report.ok) parts.push("check passed\n");
+	return parts.join("");
+}
+function toJson(report) {
+	return JSON.stringify(report, null, 2);
+}
+
+//#endregion
+export { formatHuman, toJson };