@orbit-work/ui 0.1.0

package/src/theme/utils/cssSafety.ts

@@ -0,0 +1,92 @@
+/**
+ * CSS 安全过滤 - 防止恶意皮肤注入危险代码
+ *
+ * 防护措施：
+ * 1. 移除 @import（防止外链追踪）
+ * 2. 移除外部 url()（保留 data: URI）
+ * 3. 移除 javascript: 协议
+ *
+ * 边界：本文件只管**安全**（注入/外链/脚本），不管 **DS2 设计合规**。
+ * W5 终扫删掉了这里一份从未接线的 `ALLOWED_PROPERTIES` 属性白名单——它明确放行
+ * border-radius / box-shadow / transform / transition / animation，正是 §5/§7/§9
+ * 要收口的词汇，留着只会让人误以为已有防线。属性维度的 DS2 闸在
+ * `skin.ts` 的 `DS2_SKIN_DENIED_PROPERTIES` / `findDs2DeniedCssProperty`，
+ * 由 `skin-scoped.ts` 的 `findDs2CssViolation` 在 L2/L3 注入前整块剥除。
+ *
+ * 合并记（2026-09-04）：`sanitizeSkinCSSStrict`（lightningcss 增强过滤）连同
+ * `sanitizeSkinCSS` 包装函数一并删除——全仓无消费方（skinScoped 只用 Basic/Report），
+ * lightningcss 也已从依赖撤掉，@vite-ignore 兜路径没有再存在的必要。
+ */
+
+/**
+ * 基础正则过滤（轻量级，零依赖）
+ */
+export function sanitizeSkinCSSBasic(css: string): string {
+  if (!css) return ""
+
+  let sanitized = css
+
+  // 1. 移除 @import 规则
+  sanitized = sanitized.replace(/@import[^;]+;/g, "/* blocked: @import */")
+
+  // 2. 移除外部 url()，保留 data: URI
+  sanitized = sanitized.replace(
+    /url\s*\(\s*['"]?(?!data:)([^'")]+)['"]?\s*\)/gi,
+    (match, url) => `/* blocked: url(${url.substring(0, 50)}...) */`,
+  )
+
+  // 3. 移除 javascript: 协议
+  sanitized = sanitized.replace(/javascript:/gi, "blocked-js:")
+
+  // 4. 移除 expression()（IE 旧语法，仍有风险）
+  sanitized = sanitized.replace(/expression\s*\(/gi, "blocked-expr(")
+
+  return sanitized
+}
+
+/**
+ * 统计 CSS 中的潜在风险
+ */
+export interface CSSSafetyReport {
+  ok: boolean
+  blockedImports: number
+  blockedUrls: number
+  blockedScripts: number
+  warnings: string[]
+}
+
+export function analyzeSkinCSS(css: string): CSSSafetyReport {
+  const report: CSSSafetyReport = {
+    ok: true,
+    blockedImports: 0,
+    blockedUrls: 0,
+    blockedScripts: 0,
+    warnings: [],
+  }
+
+  // 检测 @import
+  const imports = css.match(/@import[^;]+;/g)
+  if (imports) {
+    report.blockedImports = imports.length
+    report.ok = false
+    report.warnings.push(`检测到 ${imports.length} 个 @import 规则，已移除`)
+  }
+
+  // 检测外部 url()
+  const urls = css.match(/url\s*\(\s*['"]?(?!data:)([^'")]+)['"]?\s*\)/gi)
+  if (urls) {
+    report.blockedUrls = urls.length
+    report.ok = false
+    report.warnings.push(`检测到 ${urls.length} 个外部 url()，已移除`)
+  }
+
+  // 检测 javascript:
+  const scripts = css.match(/javascript:/gi)
+  if (scripts) {
+    report.blockedScripts = scripts.length
+    report.ok = false
+    report.warnings.push(`检测到 ${scripts.length} 个 javascript: 协议，已移除`)
+  }
+
+  return report
+}

package/src/theme/utils/skinManager.ts

@@ -0,0 +1,159 @@
+import type { OrbitworkSkin } from "../core/skin"
+import { parseOrbitworkSkin } from "../core/skin"
+
+/**
+ * Export a skin to JSON file
+ * Downloads the skin as a .ow-skin.json file
+ */
+export function exportSkin(skin: OrbitworkSkin): void {
+  const json = JSON.stringify(skin, null, 2)
+  const blob = new Blob([json], { type: "application/json" })
+  const url = URL.createObjectURL(blob)
+  const a = document.createElement("a")
+  a.href = url
+  a.download = `${skin.id}.ow-skin.json`
+  document.body.appendChild(a)
+  a.click()
+  document.body.removeChild(a)
+  URL.revokeObjectURL(url)
+}
+
+/**
+ * Import a skin from JSON file
+ * Returns validated OrbitworkSkin or error message
+ */
+export async function importSkin(file: File): Promise<{ skin?: OrbitworkSkin; error?: string }> {
+  try {
+    // Check file extension
+    if (!file.name.endsWith(".ow-skin.json")) {
+      return { error: "文件格式错误，请选择 .ow-skin.json 文件" }
+    }
+
+    // Check file size (max 1MB)
+    if (file.size > 1024 * 1024) {
+      return { error: "文件过大，皮肤文件不应超过 1MB" }
+    }
+
+    // Read file content
+    const text = await file.text()
+
+    // Parse JSON
+    let data: unknown
+    try {
+      data = JSON.parse(text)
+    } catch {
+      return { error: "JSON 格式错误，无法解析" }
+    }
+
+    // Validate skin
+    const validation = parseOrbitworkSkin(data)
+    if (!validation.ok) {
+      return { error: `皮肤验证失败: ${validation.error}` }
+    }
+
+    return { skin: validation.skin }
+  } catch (error) {
+    return {
+      error: error instanceof Error ? error.message : "导入失败，请稍后重试",
+    }
+  }
+}
+
+/**
+ * Import skin from URL
+ * Fetches and validates the skin from a remote URL
+ */
+export async function importSkinFromUrl(url: string): Promise<{ skin?: OrbitworkSkin; error?: string }> {
+  try {
+    const response = await fetch(url)
+    if (!response.ok) {
+      return { error: `网络请求失败: ${response.status} ${response.statusText}` }
+    }
+
+    const data = await response.json()
+
+    // Validate skin
+    const validation = parseOrbitworkSkin(data)
+    if (!validation.ok) {
+      return { error: `皮肤验证失败: ${validation.error}` }
+    }
+
+    return { skin: validation.skin }
+  } catch (error) {
+    return {
+      error: error instanceof Error ? error.message : "导入失败，请检查 URL 是否正确",
+    }
+  }
+}
+
+/**
+ * Share skin as data URL
+ * Returns a data URL that can be shared via QR code or link
+ */
+export function shareSkin(skin: OrbitworkSkin): string {
+  const json = JSON.stringify(skin)
+  const encoded = btoa(encodeURIComponent(json))
+  return `orbitwork://skin/${encoded}`
+}
+
+/**
+ * Import skin from share URL
+ * Parses an orbitwork://skin/... URL
+ */
+export function importSkinFromShareUrl(shareUrl: string): { skin?: OrbitworkSkin; error?: string } {
+  try {
+    if (!shareUrl.startsWith("orbitwork://skin/")) {
+      return { error: "分享链接格式错误" }
+    }
+
+    const encoded = shareUrl.replace("orbitwork://skin/", "")
+    const json = decodeURIComponent(atob(encoded))
+    const data = JSON.parse(json)
+
+    // Validate skin
+    const validation = parseOrbitworkSkin(data)
+    if (!validation.ok) {
+      return { error: `皮肤验证失败: ${validation.error}` }
+    }
+
+    return { skin: validation.skin }
+  } catch (error) {
+    return {
+      error: error instanceof Error ? error.message : "分享链接解析失败",
+    }
+  }
+}
+
+/**
+ * Save custom skins to localStorage
+ */
+export function saveCustomSkins(skins: OrbitworkSkin[]): void {
+  try {
+    const json = JSON.stringify(skins)
+    window.localStorage.setItem("ow-custom-skins", json)
+  } catch (error) {
+    console.error("Failed to save custom skins:", error)
+  }
+}
+
+/**
+ * Load custom skins from localStorage
+ */
+export function loadCustomSkins(): OrbitworkSkin[] {
+  try {
+    const json = window.localStorage.getItem("ow-custom-skins")
+    if (!json) return []
+
+    const data = JSON.parse(json)
+    if (!Array.isArray(data)) return []
+
+    // Validate each skin
+    return data
+      .map((item) => parseOrbitworkSkin(item))
+      .filter((result) => result.ok)
+      .map((result) => result.skin!)
+  } catch (error) {
+    console.error("Failed to load custom skins:", error)
+    return []
+  }
+}

package/src/theme/utils/themeApplier.ts

@@ -0,0 +1,75 @@
+import { isDs2SkinDeniedToken } from "../core/skin"
+import type { TenantTheme } from "../core/types"
+
+/**
+ * DS2 闸 (a)：运行时 setProperty 路径与 skin 校验共用同一禁覆盖清单，
+ * 命中即跳过并告警（COMPONENT-RULES §15）。
+ */
+function setThemeProperty(root: HTMLElement, property: string, value: string): void {
+  if (isDs2SkinDeniedToken(property)) {
+    console.warn(`[Orbitwork Theme] ${property} 命中 DS2 禁覆盖清单，已忽略`)
+    return
+  }
+  root.style.setProperty(property, value)
+}
+
+/**
+ * Apply tenant theme to the document
+ * Sets CSS custom properties on :root
+ */
+/**
+ * 落点表：租户主题能改的就是这一张。
+ *
+ * R2 两处修：
+ * ① 原表头两行写 --ow-primary / --ow-primary-hover，而同文件的守门 isDs2SkinDeniedToken
+ *    对 --ow-primary* 必定为真（DS2_SKIN_DENYLIST 含 "--ow-primary*"），这两行永远走
+ *    console.warn 后 return —— 是死代码，且每次切主题固定刷两条警告。整对删除，
+ *    TenantTheme 里的 primary 字段一并退役（留着是个应用不上的承诺）。
+ * ② 原表落点是 --ow-bg-2/-3 与 --ow-line-2/-3（V1 梯队名，v1-naming HARD 禁项，
+ *    且 tokens-tailwind 已不再为它们出类）。改落 DS2 语义名：面 --ow-surface/-2、
+ *    线 --ow-border/--ow-border-strong。
+ *
+ * 注：本表是「租户改哪些 token」的**单一出处** —— applyTenantTheme 与 removeTenantTheme
+ * 都从它派生，原来是两份手抄清单（删除侧照样列着那两个永远没被设上的 --ow-primary*）。
+ */
+const TENANT_THEME_PROPERTIES: ReadonlyArray<[property: string, pick: (t: TenantTheme) => string]> = [
+  ["--ow-bg", (t) => t.colors.bg],
+  ["--ow-surface", (t) => t.colors.surface],
+  ["--ow-surface-2", (t) => t.colors.surface2],
+  ["--ow-text", (t) => t.colors.text],
+  ["--ow-text-2", (t) => t.colors.text2],
+  ["--ow-text-3", (t) => t.colors.text3],
+  ["--ow-border", (t) => t.colors.border],
+  ["--ow-border-strong", (t) => t.colors.borderStrong],
+  ["--ow-font-sans", (t) => t.typography.fontSans],
+  ["--ow-font-mono", (t) => t.typography.fontMono],
+]
+
+export function applyTenantTheme(theme: TenantTheme): void {
+  const root = document.documentElement
+
+  for (const [property, pick] of TENANT_THEME_PROPERTIES) {
+    setThemeProperty(root, property, pick(theme))
+  }
+
+  // Store theme name as data attribute for debugging
+  root.setAttribute("data-tenant-theme", theme.name)
+}
+
+/**
+ * Remove tenant theme overrides
+ * Resets to default design tokens
+ */
+export function removeTenantTheme(): void {
+  const root = document.documentElement
+
+  for (const [property] of TENANT_THEME_PROPERTIES) root.style.removeProperty(property)
+  root.removeAttribute("data-tenant-theme")
+}
+
+/**
+ * Get current tenant theme name
+ */
+export function getCurrentThemeName(): string | null {
+  return document.documentElement.getAttribute("data-tenant-theme")
+}

package/src/tokens/DesktopSurfacesSweep15Source.test.mjs

@@ -0,0 +1,77 @@
+import assert from "node:assert/strict"
+import { readFile } from "node:fs/promises"
+import test from "node:test"
+
+/**
+ * W5 终扫片 15（共享 CSS 片）：desktop-surfaces.css 的 cmt/评审、定时任务、浏览器、
+ * 会话上下文面板、站点五族。断言只锁本片改掉的痕迹，防回流。
+ */
+const surfaces = await readFile(new URL("../../styles/desktop-surfaces.css", import.meta.url), "utf8")
+/** 只看声明，不看注释——注释里逐条记着「原来是什么」，会误伤 doesNotMatch。 */
+const decls = surfaces.replace(/\/\*[\s\S]*?\*\//g, "")
+
+test("死码清除：批注 .cmt-* / 评审 .sa-review__* / .cr-* 三族整族退场", () => {
+  for (const dead of [".cmt-bar", ".cmt-pop", ".cmt-hl", ".sa-review__", ".cr-item", ".cr-ck"]) {
+    assert.ok(!decls.includes(dead), `${dead} 应已整族删除（零消费方死码）`)
+  }
+})
+
+test("死码清除：.browser-toggle 手搓开关退场，开关归口 primitives/Switch", () => {
+  assert.ok(!decls.includes(".browser-toggle"), ".browser-toggle 全族应已删除")
+  assert.doesNotMatch(decls, /\.browser-toggle__thumb/)
+})
+
+test("§9 动效：.cseg__opt 时长走 --ow-dur-1，缓动唯一 --ow-ease-beacon（原 140ms + --ow-ease）", () => {
+  assert.match(
+    decls,
+    /\.cseg__opt \{[^}]*transition: background var\(--ow-dur-1\) var\(--ow-ease-beacon\), color var\(--ow-dur-1\) var\(--ow-ease-beacon\)/s,
+  )
+  assert.doesNotMatch(decls, /140ms/)
+})
+
+test("§6 disabled 逐 token：.cseg__opt:disabled 不再用统一透明度", () => {
+  assert.match(decls, /\.cseg__opt:disabled \{[^}]*color: var\(--ow-disabled-text\)/s)
+  assert.doesNotMatch(decls, /\.cseg__opt:disabled \{[^}]*opacity/s)
+})
+
+// W6 曾把这枚彩色图标章由表外的 38 归到 40；A3-B3 把它整条撤了 —— 三屏页头统一换成
+// composite/PageHead 的「眉标／32px 大标题／说明句」，最后一处消费方（定时任务列表页）
+// 随之退役，全仓零渲染方。§4 也不认这枚：页头标识不是状态，不该独占一枚 info-tint 面。
+test("§7 / §4：.desktop-page-head__icon 彩色图标章整条退役，全仓零消费方", () => {
+  assert.doesNotMatch(decls, /\.desktop-page-head__icon/)
+})
+
+test("§5 立面：.session-ctx-panel 弹层底走 --ow-popover-bg，不用地色 --ow-bg", () => {
+  assert.match(decls, /\.session-ctx-panel \{[^}]*background: var\(--ow-popover-bg\)/s)
+  assert.match(decls, /\.session-ctx-panel \{[^}]*box-shadow: var\(--ow-shadow-pop\)/s)
+})
+
+test("§5／§14 已知坑：会话上下文面板内的行 hover/press 走 pop 档", () => {
+  assert.match(decls, /\.session-ctx-agent:hover \{ background: var\(--ow-hover-pop\); \}/)
+  assert.match(decls, /\.session-ctx-agent:active \{ background: var\(--ow-press-pop\); \}/)
+  assert.match(
+    decls,
+    /\.session-ctx-panel__artifacts \[data-slot="attachment"\]:hover \{ background: var\(--ow-hover-pop\) !important; \}/,
+  )
+  assert.doesNotMatch(decls, /\.session-ctx-agent:hover \{ background: var\(--ow-surface\)/)
+})
+
+test("§7 读数：会话上下文面板的条数计数 mono + tabular-nums", () => {
+  assert.match(
+    decls,
+    /\.session-ctx-panel__count \{[^}]*var\(--ow-font-mono\);[^}]*font-variant-numeric: tabular-nums/s,
+  )
+})
+
+test("§6 焦点环：.session-ctx-btn 不再抹平 focus-visible，改出三件套", () => {
+  assert.doesNotMatch(decls, /\.session-ctx-btn:focus, \.session-ctx-btn:focus-visible \{ outline: none/)
+  assert.match(
+    decls,
+    /\.session-ctx-btn:focus-visible \{ outline: var\(--ow-focus-ring-w\) solid var\(--ow-focus-ring\); outline-offset: var\(--ow-focus-ring-offset\); \}/,
+  )
+})
+
+test("R2：.published-sites__state 整族退役——站点页错态归口 primitives/InlineMessage", () => {
+  // 原断言是「去掉 V1 虚线框、错误态不带框」；错态归口原语后整族零消费方，正向翻反向。
+  assert.doesNotMatch(decls, /\.published-sites__state[\s.:>{,]/)
+})

package/src/tokens/SharedStyleSheetsSource.test.mjs

@@ -0,0 +1,90 @@
+import assert from "node:assert/strict"
+import { readFile } from "node:fs/promises"
+import test from "node:test"
+
+const read = (name) => readFile(new URL(`../../styles/${name}`, import.meta.url), "utf8")
+/** 只看声明，不看注释——这些文件的注释里逐条记着「原来是什么」，会误伤 doesNotMatch。 */
+const decls = (css) => css.replace(/\/\*[\s\S]*?\*\//g, "")
+const utilities = await read("utilities.css")
+const tokens = await read("tokens.css")
+const onboarding = await read("onboarding.css")
+const assistant = await read("assistant-settings.css")
+const pet = await read("desktop-pet.css")
+
+// W5 终扫片 12（共享 CSS 片）：utilities / onboarding / assistant-settings / desktop-pet。
+
+test("§2 零裸 hex：.ow-brand-auto 的 divider/cn 四色上移 tokens.css，工具类只做主题切换", () => {
+  assert.doesNotMatch(decls(utilities), /#[0-9A-Fa-f]{3,8}\s*;/)
+  for (const name of [
+    "--ow-brand-divider-light: #D8D5CC",
+    "--ow-brand-divider-dark: var(--ow-gray-70)",
+    "--ow-brand-cn-light: #3A3E46",
+    "--ow-brand-cn-dark: #C9CBD1",
+  ]) {
+    assert.ok(tokens.includes(name), `tokens.css 缺 ${name}`)
+  }
+  assert.match(
+    utilities,
+    /\[data-theme="dark"\] \.ow-brand-auto \{[^}]*var\(--ow-brand-divider-dark\)[^}]*var\(--ow-brand-cn-dark\)/s,
+  )
+})
+
+test("§7 形状：.ow-scrollbar 滑块走 --ow-radius-pill，不写 999px 裸值", () => {
+  assert.doesNotMatch(decls(utilities), /border-radius: 999px/)
+  assert.match(utilities, /\.ow-scrollbar::-webkit-scrollbar-thumb \{[^}]*border-radius: var\(--ow-radius-pill\)/s)
+})
+
+test("§7 真圆件：信标点/待命环/pending 点走 --ow-radius-pill，不再写死 50%", () => {
+  // R2：形状表是 px 表——真圆件（正方形上 999px 与 50% 同形）一律走 token；
+  // checkRadiusLiteral 已补 % / rem 分支，裸 50% 现在会报错。
+  assert.match(utilities, /\.ow-beacon \{[^}]*border-radius: var\(--ow-radius-pill\)/s)
+  assert.match(utilities, /\.ow-pending-dot \{[^}]*border-radius: var\(--ow-radius-pill\)/s)
+  assert.doesNotMatch(utilities, /border-radius: 50%/)
+})
+
+/**
+ * R2 T5b：引导层整份按原型（template 2975–2999）改写，三处旧结构随之退役——
+ * 右上 ✕（原型脚部只有「跳过」）、三点进度（改行末 mono 「1 / 5」）、
+ * 700/19 的标题（原型是 --ow-fs-subtitle/500）。断言跟着换口径。
+ */
+test("§2/§5 引导层：不引灰阶原语，也不再有右上 ✕ 与三点进度", () => {
+  assert.doesNotMatch(decls(onboarding), /--ow-gray-\d/)
+  assert.doesNotMatch(onboarding, /\.onboarding-tour__close/)
+  assert.doesNotMatch(onboarding, /\.onboarding-tour__dots/)
+})
+
+test("§7 引导气泡：296 宽 · padding 16 · 槽 10 · radius-lg · popover 面", () => {
+  assert.match(onboarding, /\.onboarding-tour__card \{[^}]*width: 296px;/s)
+  assert.match(onboarding, /\.onboarding-tour__card \{[^}]*padding: var\(--ow-space-4, 16px\);/s)
+  assert.match(onboarding, /\.onboarding-tour__card \{[^}]*gap: 10px;/s)
+  assert.match(onboarding, /\.onboarding-tour__card \{[^}]*border-radius: var\(--ow-radius-lg\);/s)
+  assert.match(onboarding, /\.onboarding-tour__card \{[^}]*background: var\(--ow-popover-bg\);/s)
+  // 计数是读数：mono ＋ tabular-nums（§7）
+  assert.match(onboarding, /\.onboarding-tour__count \{[^}]*var\(--ow-font-mono\)/s)
+  assert.match(onboarding, /\.onboarding-tour__count \{[^}]*font-variant-numeric: tabular-nums;/s)
+})
+
+test("§3/§4：引导两层遮罩走 token，高亮环走 --ow-stage-accent（不占状态极，也不借焦点环）", () => {
+  // 第一层：整屏 scrim；第二层：环外 9999px 挖洞，色走 --ow-navy 的 color-mix，不写裸 rgba
+  assert.match(onboarding, /\.onboarding-tour \{[^}]*background: var\(--ow-scrim\);/s)
+  assert.match(onboarding, /--ow-tour-veil: color-mix\(in srgb, var\(--ow-navy\) 42%, transparent\);/)
+  assert.doesNotMatch(decls(onboarding), /rgba\(/)
+  assert.match(onboarding, /--ow-tour-ring: var\(--ow-stage-accent\);/)
+  assert.match(onboarding, /\.onboarding-tour__ring \{[^}]*box-shadow: 0 0 0 9999px var\(--ow-tour-veil\);/s)
+  // 装饰环不得借焦点语义色，也不得点信标黄
+  assert.doesNotMatch(decls(onboarding), /--ow-focus-ring\b/)
+  assert.doesNotMatch(decls(onboarding), /--ow-beacon\b/)
+  assert.doesNotMatch(decls(onboarding), /var\(--ow-primary[)-]/)
+})
+
+test("§7 形状：「已自定义」是纯文字分类标，走直角 tag 档而非 999 胶囊", () => {
+  assert.match(assistant, /\.assistant-advanced__active \{[^}]*border-radius: var\(--ow-radius-tag\)/s)
+})
+
+test("§9 唯一缓动：桌宠加载骨架呼吸走 --ow-ease-beacon，无裸缓动、无 .2s/.15s/.18s 裸时长", () => {
+  assert.doesNotMatch(decls(pet), /ease-in-out|\bease-out\b|(?<![\d.])\.\d+s\b|\b0\.\d+s\b/)
+  // R2 归并：桌宠自带的 ow-pet-skeleton 帧与共享 ow-breathe 逐字节同体，已删帧改挂共享那一支
+  assert.match(pet, /animation: ow-breathe var\(--ow-dur-spin\) var\(--ow-ease-beacon\) infinite/)
+  // 退役的是「帧」不是注释里的追溯记载——按 @keyframes 规则形状断言
+  assert.doesNotMatch(pet, /@keyframes ow-pet-skeleton\s*\{/)
+})

package/src/tokens/TailwindThemeSupplySource.test.mjs

@@ -0,0 +1,129 @@
+import assert from "node:assert/strict"
+import { readFile } from "node:fs/promises"
+import test from "node:test"
+
+/**
+ * 出类面（@theme inline）与守卫面必须同向。
+ *
+ * R2 之前它们是反的：check-ds2 按 HARD 拦 `text-ow-fg-1` / `border-ow-line-1`（v1-naming）、
+ * `bg-ow-primary`（primary-nonpole）、`shadow-ow-shadow-1|2`（grounded-shadow）、
+ * `disabled:opacity-disabled`（disabled），而 tokens-tailwind.css 一边照常把这些类发出去。
+ * 「一边禁用、一边供货」的结果是：谁都能写，写了才发现被守卫拦——或者更糟，写在
+ * 守卫扫不到的地方（apps/、screens/）就一直活着。
+ */
+const theme = await readFile(new URL("../../styles/tokens-tailwind.css", import.meta.url), "utf8")
+const tokens = await readFile(new URL("../../styles/tokens.css", import.meta.url), "utf8")
+
+test("@theme 不再发 check-ds2 按 HARD 拦的那批类", () => {
+  const banned = [
+    // v1-naming：V1 梯队
+    /--color-ow-fg-\d/,
+    /--color-ow-fg-link\b/,
+    /--color-ow-line-\d/,
+    /--color-ow-bg-\d/,
+    // primary-nonpole：行动极不做通用色档
+    /--color-ow-primary\b/,
+    /--color-ow-primary-/,
+    /--color-primary\b/,
+    // grounded-shadow：贴地零影
+    /--shadow-ow-shadow-\d/,
+    /--shadow-md\b/,
+    // disabled：统一透明度禁用态
+    /--opacity-disabled\b/,
+  ]
+  const hits = banned.filter((re) => re.test(theme)).map(String)
+  assert.deepEqual(hits, [])
+})
+
+test("shadcn 兼容别名指向 DS2 语义名，不再挂在 V1 梯队上", () => {
+  // globals.css 的 `@apply border-border` 与 `@apply bg-background text-foreground`
+  // 是全库唯一消费方——这三条一错，整个应用的地、字与默认边就都是 V1 值。
+  const expected = {
+    "--color-background": "--ow-bg",
+    "--color-foreground": "--ow-text",
+    "--color-card": "--ow-surface",
+    "--color-popover": "--ow-popover-bg",
+    "--color-secondary": "--ow-surface-2",
+    "--color-muted": "--ow-surface-2",
+    "--color-accent": "--ow-surface-2",
+    "--color-border": "--ow-border",
+    "--color-input": "--ow-input-border",
+    "--color-ring": "--ow-focus-ring",
+  }
+  for (const [key, token] of Object.entries(expected)) {
+    assert.match(theme, new RegExp(`${key}: var\\(${token}\\);`), `${key} 应指向 ${token}`)
+  }
+})
+
+// R2：--ow-focus-border 是焦点色的第三个口径（暗档 #ECEBE5，既不是 outline 版的
+// --ow-focus-ring #F7F6F1，也不是 box-shadow 版的环色），已随 ring 改指一并退役。
+test("焦点只剩一个色源：--ow-focus-ring", () => {
+  assert.doesNotMatch(tokens, /--ow-focus-border\s*:/)
+  assert.doesNotMatch(theme, /--color-ow-focus-border\b/)
+  // box-shadow 版的环色必须引 --ow-focus-ring，不许另取一个色
+  for (const m of tokens.matchAll(/--ow-focus-shadow: ([^;]+);/g)) {
+    assert.match(m[1], /var\(--ow-focus-ring\)/, `--ow-focus-shadow 环色应引 --ow-focus-ring，实为 ${m[1]}`)
+  }
+})
+
+// R2：生成器不再产出被守卫禁用的名字（禁消费就不该继续供货）。
+test("tokens.css 不再产出 V1 中性梯队与一批零消费死 token", () => {
+  for (const dead of [
+    "--ow-n-50",
+    "--ow-n-1000",
+    "--ow-red-500",
+    "--ow-green-600",
+    "--ow-error-disabled",
+    "--ow-shadow-focus",
+    "--ow-shadow-inset",
+    // 注：--ow-accent-contrast 虽同为零消费，但 tokens/ds2-spec.json 有值，
+    // 删了会变成 drift-miss（「规格有名、实现未落地」），故保留在实现里。
+    "--ow-radius-text-btn",
+    "--ow-radius-input",
+    "--ow-radius-button",
+    "--ow-opacity-disabled",
+    "--ow-fg-link",
+    "--ow-fg-on-dark",
+    "--ow-font:",
+  ]) {
+    assert.ok(!tokens.includes(`${dead.replace(/:$/, "")}:`), `${dead} 应已删除`)
+  }
+})
+
+// R2：8px 这一档原先挂了五个在用的名字（sm/action/control/input/button），
+// 「改按钮圆角」在树上没有唯一落点。收成两层：刻度名 + 角色名。
+test("圆角只剩「刻度名 + 角色名」两层", () => {
+  for (const scale of [
+    "--ow-radius-2xs",
+    "--ow-radius-xs",
+    "--ow-radius-sm",
+    "--ow-radius-md",
+    "--ow-radius-lg",
+    "--ow-radius-xl",
+    "--ow-radius-pill",
+  ]) {
+    assert.match(tokens, new RegExp(`${scale}:`), `刻度名 ${scale} 缺失`)
+  }
+  for (const role of [
+    "--ow-radius-action",
+    "--ow-radius-control",
+    "--ow-radius-menu",
+    "--ow-radius-card",
+    "--ow-radius-modal",
+    "--ow-radius-tag",
+    "--ow-radius-chip",
+    "--ow-radius-key",
+  ]) {
+    assert.match(tokens, new RegExp(`${role}:`), `角色名 ${role} 缺失`)
+  }
+})
+
+// R2：浅档 --ow-border 曾被排在语义段之后的 legacy 别名反压（生效的是标着 deprecated 的那条），
+// 暗档又没有对应 legacy 段——两档结构不对称。
+test("tokens.css 里同一档不再重复声明 --ow-border", () => {
+  const blocks = tokens.split(/(?=\/\* ═+ )/)
+  for (const block of blocks) {
+    const count = (block.match(/^\s*--ow-border:/gm) ?? []).length
+    assert.ok(count <= 1, `同一档里 --ow-border 声明了 ${count} 次`)
+  }
+})