@homepages/template-kit 0.2.0 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,227 @@
 # @homepages/template-kit
 
+## 0.4.0
+
+### Minor Changes
+
+- 94d6458: `template-kit dev`: a full-template published page at `/template/<t>`, scope-aware
+  `/api/screenshot` (section or whole template, with `width`), and a new `/api/inspect`
+  endpoint returning per-slot fill-state (filled / empty / missing + a render
+  cross-check), resolved props, and the null-corpus. Retires `/api/structure-summary`
+  (its outline is now `/api/inspect?format=text`).
+- 47dbbc6: Section-folder static assets are now first-class. `check`'s `bundle-binary-asset` rule
+  flags only an _unreferenced_ binary in a section folder; an asset imported in a component
+  (`import crest from "./assets/crest.svg"` → `<Image src={crest} …>`) or `url()`-referenced
+  from a section stylesheet is allowed. A `declare module "*.svg"` (and the other supported
+  asset extensions) type shim ships so component imports of assets typecheck.
+- 9a3e0e1: Adds a read-only canvas mirror to `template-kit dev`, at `/canvas/<template>`. It frames
+  the **whole template** — every section instance, stacked in one scroll container, exactly
+  as the deliverable renders — in an iframe and paints a hover/select overlay on top: click
+  an editable slot to select it (a gold ring), hover to preview it (a blue ring);
+  non-editable regions select their enclosing section instead. Selection is scoped per
+  section instance, so the same slot name in two sections resolves independently. The
+  overlay is purely visual — it never alters the rendered markup. A mode toggle switches to
+  a clean published render of the full template with no overlay, and the current view —
+  template, mode, and the selected instance/slot — is captured in the URL, so a canvas link
+  reloads and shares exactly what you see.
+
+  The `dev` server gains `GET /api/template-schema?template=<t>`, returning each section
+  instance's editability map (per slot: its type and whether it is user-editable) for the
+  whole template, so a tool can tell which slots are selectable without re-parsing the
+  section schemas. (The per-section `/api/render` response also still carries its own
+  `slotSchema` map.)
+
+- 7f68570: Canvas mirror: exercise slots interactively. Selecting an editable slot opens a
+  side panel with a JSON editor for its value; applying a change re-renders that
+  section instance live. A per-instance fixture picker drives different content —
+  including the empty/missing states from the section's fixture corpus — without
+  editing fixture files.
+- 5a8dcd4: Adds the `dev` command: `template-kit dev [template] [--port <n>]`. A local preview
+  server for a workspace's templates — it renders every section against its fixtures
+  server-side, with the template's theme and compiled Tailwind utilities, exactly the way
+  the platform does. A browser UI gives you a picker (template → section → fixture) and a
+  grid contact sheet of every fixture at each breakpoint, including empty and null states;
+  each section also has a standalone preview at `/sections/<template>/<section>/<fixture>`.
+  Editing a section reloads open previews; editing a theme hot-swaps its stylesheet.
+
+  Endpoints render a section without a browser, for an agent verifying its work from a
+  terminal: `/api/inspect` (a low-context per-slot fill-state view as JSON, with
+  `?format=text` for the rendered outline) and `/api/screenshot` (a full-page PNG). Like
+  `check`, `dev` runs your
+  toolchain — Vite and Tailwind resolved from your workspace, not shipped by the kit:
+
+  ```bash
+  npm i -D vite @vitejs/plugin-react tailwindcss @tailwindcss/cli
+  npm i -D @playwright/test   # optional, for /api/screenshot
+  ```
+
+- 13c3132: Add `template-kit pack <template>` — the per-template submission zip (template
+  source + workspace lockfile + a stamped `pack-manifest.json`), which refuses on a
+  failing `check`, an active link overlay, a missing lockfile, or local-protocol
+  deps. Add the internal `link`/`unlink`/`status` overlay for developing the kit
+  against a real consumer without publishing.
+- bcf6fbb: `@homepages/template-kit/ssr` now also exports `wrapClientModuleSource` (the `"use
+client"` → `IslandMarker` codemod), `findSectionIslands` (recursive `"use client"`
+  component discovery under a section directory), and `islandTransformEsbuildPlugin`
+  (an esbuild `onLoad` plugin that applies the same codemod across a build graph, keyed
+  `islandKey(sectionKey, <file-basename>)`). All three are the same primitives
+  `template-kit dev`'s Vite plugin already used internally, now exposed so a build-time
+  consumer — the publish renderer bundle's esbuild pass, or a native-import loader hook —
+  can wrap island modules identically without duplicating the codemod. `esbuild` stays a
+  devDependency of the kit; `islandTransformEsbuildPlugin` imports its `Plugin` type only.
+- b76f822: Add the node-only `@homepages/template-kit/ssr` subpath: the shared section SSR helper (`loadSectionBundle`, `renderSectionHtml`) that renders a section + fixture to the exact HTML the publisher emits, plus island detection (`isClientComponentFile`, `hasClientDirective`) and key derivation (`islandKey`) for a section's `"use client"` components.
+
+## 0.3.0
+
+### Minor Changes
+
+- bdb4dec: `zod` is now the kit's only dependency of any kind, besides its React peers. ESLint,
+  `@typescript-eslint/parser` and `esbuild` are no longer declared by the kit at all — a
+  linter and a bundler are development tools, and as dependencies they landed in the
+  **production** install of every consumer, including apps that only render a published
+  template and deploy with `npm ci --omit=dev`. For a consuming service that lints, the
+  production dependency graph drops by roughly 125 packages.
+
+  **Action required if you use the ESLint preset or the `check` command** — install the
+  toolchain they run, which they now resolve from your workspace rather than shipping
+  their own copy of:
+
+  ```bash
+  npm i -D eslint @typescript-eslint/parser   # for @homepages/template-kit/eslint
+  npm i -D typescript esbuild                 # for template-kit check (with the two above)
+  ```
+
+  Nothing changes for code that only imports the kit's primitives, schema system or theme
+  tokens. The preset's rules and parser wiring are unchanged; `check`'s stages and rule ids
+  are unchanged — and it now reports a missing tool by name, with the install line, instead
+  of failing obscurely. As a side benefit, `check` runs against _your_ pinned TypeScript,
+  ESLint and esbuild.
+
+- 49177ab: Adds the `check` command: `template-kit check [template] [--all] [--json]`. Runs a
+  template's authoring contract end to end — type errors, the lint preset, the schema and
+  manifest contracts, section-folder structure (contract files present, editor slot
+  markers, hand-CSS hygiene), a render-regression pass (determinism, broken images, and
+  other objective defects), and per-section bundle-size budgets — plus workspace-wide
+  dependency gates (lockfile health, a single copy of React, dependency licenses,
+  vulnerability severity) evaluated once per run. Every failure prints a stable rule id, a
+  file and line, and a one-line fix. Exits non-zero on any failure; pass `--json` for a
+  script-consumable report.
+- 2a30f0b: `template-kit theme` generates your template's `theme.css` from its `theme.ts`.
+
+  `@theme` is a Tailwind directive — it only does anything when a real `.css` file carrying
+  it flows through your Tailwind entry. So the alias layer `compileThemeToCss` produces from
+  your `theme.ts` has to reach that entry as a file. Rather than call the compiler from your
+  own build script (and risk `theme.css` silently drifting from `theme.ts`), run:
+
+  ```
+  template-kit theme            # the template in the current folder
+  template-kit theme <name>     # a named template
+  template-kit theme --all      # every template in the workspace
+  ```
+
+  It reads `templates/<key>/theme.ts` (which must `export const theme: TokenTheme`), validates
+  it, and writes `templates/<key>/theme.css` with a "generated — do not edit" header. Import
+  that file into your Tailwind entry after `@import "tailwindcss"` and the kit's `styles.css`:
+
+  ```css
+  @import "tailwindcss";
+  @import "@homepages/template-kit/styles.css";
+  @import "./theme.css"; /* generated by `template-kit theme` */
+  ```
+
+  Re-run the command whenever you change `theme.ts`; a token you add becomes a working Tailwind
+  utility with nothing else to edit. A missing `theme.ts`, a missing `theme` export, or a theme
+  that fails validation each fail with an actionable message.
+
+- e15de58: Your template now owns its design tokens end to end — and names them itself.
+
+  `TokenTheme` no longer imposes a vocabulary. Instead of satisfying a fixed set of
+  semantic roles (`ink`, `surfaceAlt`, `primaryStrong`, …), you declare whatever tokens
+  your design actually has, under kebab-case names you choose, and `compileThemeToCss`
+  generates the Tailwind `@theme inline` alias layer from them. Declare `lagoon` and
+  `bg-lagoon` exists. Nothing is required, and Tailwind's own defaults (`text-2xl`,
+  `rounded-lg`, `red-500`) still work underneath, so a sparse theme is a working theme.
+
+  This also closes the hole that made the old "open palette" a fiction: a brand swatch
+  only became a usable utility once it was added to the kit's shared `styles.css`, so it
+  was never really yours. There is no shared file to edit any more.
+
+  **Upgrading — three changes:**
+
+  1. **Rewrite `theme.ts`.** `colors` and `palette` merge into one open record, and keys
+     become kebab-case (`inkSoft` → `ink-soft`). `fontFaces` moves out of `fonts` to the
+     top level. Emission is verbatim: the key `ink-soft` becomes `--tr-color-ink-soft` and
+     the `text-ink-soft` utility.
+
+     One token yields exactly one utility, so two utility names mean two tokens. If you
+     relied on an alias that pointed two names at one value, declare both.
+
+  2. **Add a `document` block.** The `body` defaults can no longer be assumed — there is no
+     `ink` to guess at — so name the tokens that dress the page:
+
+     ```ts
+     document: { font: "sans", color: "ink", background: "page", fontSize: "base" }
+     ```
+
+     Each reference is validated against your declared tokens: a typo fails at build
+     rather than rendering an unthemed page in silence.
+
+  3. **Import your compiled theme into your Tailwind entry.** `@theme` is a Tailwind
+     directive and is inert outside the build graph, so the theme partial must be
+     `@import`ed by your entry, after the kit's `styles.css`:
+
+     ```css
+     @import "tailwindcss";
+     @import "@homepages/template-kit/styles.css";
+     @import "./theme.css"; /* compileThemeToCss output */
+     ```
+
+  `styles.css` and `base.css` keep their export paths — no import changes. `styles.css`
+  now carries only the breakpoint ladder, the `--spacing` base unit, and the motion
+  defaults.
+
+  The `Image` primitive no longer paints its frame with `bg-surface-alt` (a token your
+  theme may not declare). The fill lives on `.tr-image-frame` in `base.css`; retint it by
+  setting `--tr-image-frame-bg`.
+
+- 57eddee: Migrate the schema system from Zod 3 to Zod 4.
+
+  `zod` is the kit's one runtime dependency, and it now tracks Zod 4 (`"zod": "^4"`).
+  Because the types you author section schemas against are Zod types, bumping Zod a
+  major is a breaking change for authors: your workspace resolves Zod 4 in its
+  lockfile, and the schema/slot types you see in editor tooltips are now Zod 4 types.
+
+  **Action required** — if your workspace declares `zod`, move it to `^4` so a single
+  Zod copy resolves across your workspace and the kit:
+
+  ```bash
+  npm i zod@^4
+  ```
+
+  Nothing else changes. The authoring API is untouched — the slot-type catalog, the
+  source/transform vocabulary, and `SectionProps<typeof schema>` inference are all
+  identical, and every section still materializes to a byte-identical serialized
+  schema. This is a dependency migration, invisible to an author apart from the Zod
+  version in the lockfile.
+
+### Patch Changes
+
+- 6675c4c: `no-hex` no longer reports a `color-mix()` whose colour arguments are all theme-derived.
+  A mix over `var(--…)` references, `transparent`, or `currentColor` carries no palette of
+  its own — it composes a state colour (hover, active, pressed) out of the theme the
+  section was handed — so banning it contradicted the rule's own reason. A hard-coded
+  argument still reports: `color-mix(in srgb, var(--tr-color-primary) 80%, #fff)` and
+  `color-mix(…, white)` are violations, as is a `var()` fallback that bakes a colour
+  (`var(--x, #fff)`). The carve-out is `color-mix()` only — `rgb()`, `oklch()`, and the
+  rest take raw channel values and stay banned outright, so the "a section carries zero
+  palette" guarantee is unchanged.
+- 1749cea: `no-hex` now ships as a **warning**, not an error. Centralized theme colours are
+  encouraged, not gated: a hard-coded colour still squiggles in the editor and the rule
+  still explains how to derive the colour from theme tokens, but it no longer fails
+  `template-kit check` locally or at ingest (both gate on errors only). Every other preset
+  rule stays an error — this is the one advisory rule. The `color-mix()` over theme-derived
+  arguments carve-out is unchanged; it just governs a warning now instead of an error.
+
 ## 0.2.0
 
 ### Minor Changes

package/README.md

@@ -1,21 +1,48 @@
 # @homepages/template-kit
 
 The authoring surface for HomePages marketing-section templates: schema system,
-contract primitives, theme tokens, and the `template-kit` CLI.
+contract primitives, the theme system, and the `template-kit` CLI.
 
 **Status: 0.0.x.** The **schema system** (the section authoring contract and the closed
-vocabulary it validates against), the **contract primitives**, and the **theme tokens**
+vocabulary it validates against), the **contract primitives**, and the **theme system**
 are complete — a section is authorable end to end against the kit. The `template-kit`
-CLI's commands are still being extracted.
+CLI's `check`, `theme`, `dev`, and `pack` commands are implemented — see
+[Checking a workspace](#checking-a-workspace), [Generating a theme](#generating-a-theme),
+and [Previewing a workspace](#previewing-a-workspace) below — and `new` / `new-section`
+scaffold a template or a section into a workspace (see [docs/new.md](docs/new.md)).
+
+## Quick start
+
+The fastest way to start is the workspace scaffolder — it creates a workspace with a
+working starter template and the full toolchain already wired:
+
+```bash
+npm create homepages-workspace <name>
+cd <name>
+npm install
+npm run dev        # preview the starter; the island hydrates
+```
+
+Add more templates with `npx template-kit new <template>` and sections with
+`npx template-kit new-section <template>/<section>` — see [docs/new.md](docs/new.md).
+Prefer to wire a workspace by hand? See **Install** below.
 
 ## Install
 
 ```bash
 npm install @homepages/template-kit react react-dom
+npm install -D typescript eslint @typescript-eslint/parser esbuild   # the authoring toolchain
 ```
 
 React 19 is a **peer dependency** — the kit never bundles its own copy.
 
+The kit has exactly **one runtime dependency** (`zod`). The authoring toolchain the
+[`check` command](docs/check.md) and the [ESLint preset](docs/eslint.md) run on is
+yours: both resolve TypeScript, ESLint, the parser and esbuild from your workspace, so
+your pinned versions are the ones that judge your code. The kit does not depend on them
+at all — which is why a linter never lands in the production install of an app that
+merely renders a published template.
+
 ## Authoring a section
 
 A section is four files: `schema.ts` (slots + options), `fill-spec.ts` (how AI
@@ -64,7 +91,7 @@ Full contract: **[docs/primitives.md](docs/primitives.md)**.
 | `@homepages/template-kit` | Authoring API — schema system, primitives, marker contract, theme types, and the golden fixtures |
 | `@homepages/template-kit/island-runtime` | Browser loader that hydrates a page's islands |
 | `@homepages/template-kit/browser` | Browser helpers for published pages (site config, signed ingest) |
-| `@homepages/template-kit/styles.css` | Tailwind v4 theme tokens, the breakpoint ladder, kit source registration |
+| `@homepages/template-kit/styles.css` | The global Tailwind preamble: the breakpoint ladder, the spacing base unit, the motion defaults, kit source registration |
 | `@homepages/template-kit/base.css` | Cascade-layer order, the three reset gaps Tailwind's preflight leaves, `.tr-section`, and the motion tokens |
 | `@homepages/template-kit/eslint` | ESLint flat-config preset |
 | `@homepages/template-kit/tsconfig` | tsconfig preset (`"extends"`) |
@@ -72,18 +99,21 @@ Full contract: **[docs/primitives.md](docs/primitives.md)**.
 The authoring API has **no subpath imports** — one specifier for everything you
 write a section against. The two CSS entries are the deliberate exception.
 
-`styles.css` does **not** import Tailwind. Import it *after* Tailwind in your entry:
+`styles.css` does **not** import Tailwind. Import it *after* Tailwind in your entry, then
+your generated theme after that:
 
 ```css
 @import "tailwindcss";
 @import "@homepages/template-kit/styles.css";
+@import "./theme.css";                 /* generated by `template-kit theme` from theme.ts */
 ```
 
-Two `@import "tailwindcss"` in one graph double-emits preflight. `base.css` is not part
-of that entry — it loads as its own stylesheet on the page. `base.css` ships no reset
-of its own — it depends on the preflight your entry's `@import "tailwindcss"` brings.
-Both must be on the page. Full contract:
-**[docs/theme-and-css.md](docs/theme-and-css.md)**.
+Two `@import "tailwindcss"` in one graph double-emits preflight. Your generated theme
+belongs in this entry and nowhere else: it carries an `@theme` block, a Tailwind directive
+that is inert outside the build graph. `base.css` is not part of that entry — it loads as
+its own stylesheet on the page. `base.css` ships no reset of its own — it depends on the
+preflight your entry's `@import "tailwindcss"` brings. Both must be on the page. Full
+contract: **[docs/theme-and-css.md](docs/theme-and-css.md)**.
 
 ## Rules
 
@@ -93,6 +123,52 @@ The lint preset and the `template-kit check` CLI share one id namespace,
 Start at **[docs/rules/INDEX.md](docs/rules/INDEX.md)**; the full doc set is routed
 from **[docs/INDEX.md](docs/INDEX.md)**.
 
+## Generating a theme
+
+```bash
+template-kit theme          # infer the template from cwd, or the workspace's one template
+template-kit theme --all    # generate every template's theme.css
+```
+
+`theme` compiles a template's `theme.ts` into `templates/<key>/theme.css` — the file your
+Tailwind entry imports. The output is generated: don't hand-edit it, and re-run the
+command whenever `theme.ts` changes. Full contract:
+**[docs/theme-and-css.md](docs/theme-and-css.md#generating-themecss)**.
+
+## Previewing a workspace
+
+```bash
+template-kit dev              # serve every template in the workspace
+template-kit dev <template>   # preselect one template in the picker
+template-kit dev --port 4000  # choose the port (default 5180)
+```
+
+`dev` starts a local server that renders every section against its fixtures the same way
+the platform does — with your template's theme and compiled Tailwind — and reloads as you
+edit. A browser UI gives you a picker and a grid contact sheet across breakpoints; each
+section also has a standalone page, and so does the whole template at
+`/template/<template>`. Three endpoints let an agent verify a render from a terminal:
+`/api/inspect` (per-slot fill-state as JSON), `/api/render` (the full structured render
+payload), and `/api/screenshot` (a full-page PNG, section or whole template). Like
+`check`, it runs **your** toolchain — Vite and Tailwind resolved from your workspace,
+installed with `npm i -D vite @vitejs/plugin-react tailwindcss @tailwindcss/cli` — not
+shipped by the kit. Full contract: **[docs/dev.md](docs/dev.md)**.
+
+## Checking a workspace
+
+```bash
+template-kit check          # infer the template from cwd, or the workspace's one template
+template-kit check --all    # check every template
+template-kit check --json   # machine-readable report
+```
+
+`check` typechecks, lints, and validates a template's schema/fill-spec/fixtures/manifest
+contracts, runs a determinism render probe, and enforces per-section byte budgets —
+plus workspace-wide dependency gates (lockfile health, a single React, license and
+vulnerability checks) evaluated once per run. It exits non-zero on any failure and is
+the same gate the platform re-runs when you submit a template. Full contract:
+**[docs/check.md](docs/check.md)**.
+
 ## Development
 
 ```bash
@@ -101,11 +177,13 @@ npm run check     # typecheck + lint + build + island-size gate + test + publint
 ```
 
 `npm run verify:consumer` is the boundary gate: it packs the kit, installs the
-tarball into a scratch project, and asserts that types resolve; that a real section
+tarball into scratch projects, and asserts that a service which pins the kit and
+deploys with `npm ci --omit=dev` installs no ESLint or esbuild package at all, with
+`dependencies` carrying nothing but `zod`; that types resolve; that a real section
 triple typechecks against the installed package, with a misspelled property fact or
-slot key still failing to compile; that Tailwind's cross-package `@source` scan
-reaches the shipped `dist`; and that only one React ends up in the tree. Run it
-before every release.
+slot key still failing to compile; that the ESLint preset lints using the consumer's
+own parser; that Tailwind's cross-package `@source` scan reaches the shipped `dist`;
+and that only one React ends up in the tree. Run it before every release.
 
 The island loader (`@homepages/template-kit/island-runtime`) has its own gate,
 `npm run size:islands`: it must stay under 3072 B gzip and never import
@@ -131,9 +209,10 @@ token anywhere, and adding one would silently disable OIDC.
 
 3. **Merge the Version Packages PR.** That merge publishes to npm.
 
-Semver contract: the platform vocabulary (slot types, sources, transforms,
-tokens) is closed and versioned. A breaking change to it is a **major**; a new
-optional capability is a **minor**.
+Semver contract: the platform vocabulary (slot types, sources, transforms) is
+closed and versioned. A breaking change to it is a **major**; a new optional
+capability is a **minor**. Design tokens are *not* part of that vocabulary —
+your template names its own.
 
 ### Bumping the version by hand
 

package/dist/asset-modules.d.ts

@@ -0,0 +1,81 @@
+//#region src/asset-modules.d.ts
+declare module "*.svg" {
+  const src: string;
+  export default src;
+}
+declare module "*.png" {
+  const src: string;
+  export default src;
+}
+declare module "*.jpg" {
+  const src: string;
+  export default src;
+}
+declare module "*.jpeg" {
+  const src: string;
+  export default src;
+}
+declare module "*.gif" {
+  const src: string;
+  export default src;
+}
+declare module "*.webp" {
+  const src: string;
+  export default src;
+}
+declare module "*.avif" {
+  const src: string;
+  export default src;
+}
+declare module "*.ico" {
+  const src: string;
+  export default src;
+}
+declare module "*.woff" {
+  const src: string;
+  export default src;
+}
+declare module "*.woff2" {
+  const src: string;
+  export default src;
+}
+declare module "*.ttf" {
+  const src: string;
+  export default src;
+}
+declare module "*.otf" {
+  const src: string;
+  export default src;
+}
+declare module "*.eot" {
+  const src: string;
+  export default src;
+}
+declare module "*.mp4" {
+  const src: string;
+  export default src;
+}
+declare module "*.webm" {
+  const src: string;
+  export default src;
+}
+declare module "*.mov" {
+  const src: string;
+  export default src;
+}
+declare module "*.mp3" {
+  const src: string;
+  export default src;
+}
+declare module "*.wav" {
+  const src: string;
+  export default src;
+}
+declare module "*.pdf" {
+  const src: string;
+  export default src;
+}
+declare module "*.zip" {
+  const src: string;
+  export default src;
+}

package/dist/base.css

@@ -9,6 +9,7 @@
  *   - The cascade-layer order declaration above — the one place it is stated
  *   - The three reset gaps Tailwind's preflight leaves (below)
  *   - The section box model (.tr-section, emitted by the <Section> primitive)
+ *   - The <Image> frame's placeholder fill (.tr-image-frame)
  *   - Universal tokens: motion
  *
  * REQUIRES A TAILWIND ENTRY ON THE PAGE. Your entry's `@import "tailwindcss"` brings
@@ -54,6 +55,14 @@
   margin: 0;
 }
 
+/* The <Image> frame's placeholder fill, showing while an image is absent or loading.
+ * It is a plain class rather than a `bg-*` utility on the primitive because a template
+ * names its own tokens — there is no colour token this primitive may assume exists.
+ * Retint it by setting --tr-image-frame-bg in your theme's layout tokens. */
+.tr-image-frame {
+  background-color: var(--tr-image-frame-bg, oklch(0.97 0 0));
+}
+
 /* ----- Universal tokens ------------------------------------------------- */
 
 :root {

package/dist/cli/check/config.js

@@ -0,0 +1,41 @@
+//#region src/cli/check/config.ts
+const CHECK_CONFIG = {
+	size: {
+		/** Gzipped bytes of a section's renderer bundle, React excluded. */
+		rendererBundleGzip: 50 * 1024,
+		/** Gzipped bytes of a section's stylesheet, including CSS pulled in from packages. */
+		sectionCssGzip: 50 * 1024,
+		/** Gzipped bytes of a section's largest island (browser) bundle, React excluded. */
+		islandBundleGzip: 50 * 1024,
+		/** Raw bytes of a section's static assets (svg/images/fonts). RAW, not gzip — images/fonts are already compressed. */
+		assets: 250 * 1024
+	},
+	audit: { 
+	/** A vulnerability at or above this severity fails the check. */
+failOn: ["high", "critical"] },
+	/**
+	* A package whose license is not on this list fails the check. A missing
+	* license field, or a bespoke "SEE LICENSE IN …", is a denial — not a pass.
+	*/
+	licenseAllowlist: [
+		"MIT",
+		"ISC",
+		"Apache-2.0",
+		"BSD-2-Clause",
+		"BSD-3-Clause",
+		"0BSD",
+		"Unlicense",
+		"CC0-1.0"
+	],
+	/**
+	* The license gate walks the *shipped* dependency graph of every third-party
+	* package a template pulls in — this is the first-party exception to that.
+	* The kit itself is `UNLICENSED` by design (it is not published for reuse
+	* outside this platform) and every workspace depends on it, so without this
+	* exemption the gate would deny the kit on a stock, correct workspace.
+	*/
+	licenseExemptions: ["@homepages/template-kit"]
+};
+
+//#endregion
+export { CHECK_CONFIG };