@robomous/ui-core 0.1.1 → 0.2.0

package/src/gates/tokens.test.ts

@@ -0,0 +1,215 @@
+// @vitest-environment node
+/**
+ * `DESIGN.md`'s first principle, machine-enforced: **never a colour in a class
+ * string.** The helpers live in `./index.ts` so consumers run the same scans;
+ * this file keeps their fabricated-input self-tests and runs the repo gates
+ * over this package's own sources.
+ */
+
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { expect, test } from "vitest";
+
+import { brandUsagesIn, colouredClassesIn } from "./index.js";
+
+const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
+
+const SOURCE = /\.(?:ts|tsx|css)$/;
+
+// Fragment for fabricating violating input without this file matching itself.
+const HEX = ["#", "[0-9a-fA-F]{3,8}"].join("");
+
+/**
+ * Assembles a bracketed Tailwind arbitrary-value utility (e.g.
+ * `text-[var(--accent)]`) from its prefix and bracket contents at runtime, for
+ * the same reason `HEX` above is built from fragments: this file scans its
+ * own package, so a fixture spelled out contiguously would trip the very gate
+ * it exists to exercise.
+ */
+const bracket = (prefix: string, inner: string) => `${prefix}-[${inner}]`;
+
+/**
+ * Assembles a `<prefix>-brand<suffix>` utility fixture at runtime, for the
+ * same self-matching reason as `bracket` above.
+ */
+const brand = (prefix: string, suffix = "") => `${prefix}-brand${suffix}`;
+
+test("the scan finds a colour smuggled into a class, and nothing that merely looks like one", () => {
+  expect(colouredClassesIn("a.tsx", `  <div className="bg-[${HEX.slice(0, 1)}eb5a47]" />`)).toEqual(
+    [`a.tsx:1: <div className="bg-[${HEX.slice(0, 1)}eb5a47]" />`],
+  );
+  expect(colouredClassesIn("b.tsx", `  className="${bracket("text", "var(--accent)")}"`)).toEqual([
+    `b.tsx:1: className="${bracket("text", "var(--accent)")}"`,
+  ]);
+  expect(colouredClassesIn("c.tsx", `  className="${bracket("ring", "rgb(0 0 0)")}"`)).toEqual([
+    `c.tsx:1: className="${bracket("ring", "rgb(0 0 0)")}"`,
+  ]);
+
+  // A token utility is the whole point of the rule and must pass.
+  expect(colouredClassesIn("d.tsx", `  className="bg-primary text-primary-foreground"`)).toEqual(
+    [],
+  );
+  // The accent at 10% is a token with an opacity modifier, not a colour.
+  expect(colouredClassesIn("e.tsx", `  className="bg-primary/10 border-primary"`)).toEqual([]);
+  // An arbitrary value that is *not* a colour stays legal — the rule is about
+  // colour, and a one-off `top-[50%]` is not what v1 got wrong.
+  expect(colouredClassesIn("f.tsx", `  className="translate-y-[3px]"`)).toEqual([]);
+  // An inline style carrying a schema-supplied colour is the sanctioned road:
+  // `classColor` answers with whatever the kernel stored, and Tailwind has never
+  // seen it, so no utility could name it.
+  expect(
+    colouredClassesIn("g.tsx", `  style={{ background: classColor(declared, name) }}`),
+  ).toEqual([]);
+  // A docstring explaining the rule must pass, or the gate forbids its own
+  // explanation — the mistake a boundary scan makes when it matches its own prose.
+  expect(colouredClassesIn("h.tsx", `   * Never write \`bg-[${"#"}eb5a47]\`.`)).toEqual([]);
+  // And a CSS custom property *declaration* is where colours are supposed to live.
+  expect(colouredClassesIn("i.css", `  --color-primary: #eb5a47;`)).toEqual([]);
+  // A colour-mix of two tokens names no colour of its own — the preset's own
+  // Button hover step.
+  expect(
+    colouredClassesIn(
+      "x.tsx",
+      'className="hover:bg-[color-mix(in_oklch,var(--secondary),var(--foreground)_5%)]"',
+    ),
+  ).toEqual([]);
+  // A colour-mix that mixes in a literal is still a colour smuggled into a class.
+  expect(
+    colouredClassesIn("x.tsx", `className="${bracket("bg", "color-mix(in_srgb,#fff,var(--x))")}"`)
+      .length,
+  ).toBe(1);
+  // A named CSS colour inside color-mix is still a colour.
+  expect(
+    colouredClassesIn("x.tsx", `className="${bracket("bg", "color-mix(in_oklch,red,var(--x))")}"`)
+      .length,
+  ).toBe(1);
+  // Whatever order the tokens come in, and whichever colour space, two tokens
+  // stay two tokens.
+  expect(
+    colouredClassesIn("x.tsx", 'className="bg-[color-mix(in_srgb,var(--a)_40%,var(--b))]"').length,
+  ).toBe(0);
+});
+
+test("the brand scan counts a usage, and not the comment that states the rule", () => {
+  // A utility usage on any of the six colour-bearing prefixes is counted.
+  expect(brandUsagesIn("a.tsx", `  <span className="${brand("text")}">Robomous</span>`)).toEqual([
+    { file: "a.tsx", at: 1, text: `<span className="${brand("text")}">Robomous</span>` },
+  ]);
+  expect(
+    brandUsagesIn("b.tsx", `  className="h-full ${brand("bg")} transition-transform"`),
+  ).toEqual([
+    { file: "b.tsx", at: 1, text: `className="h-full ${brand("bg")} transition-transform"` },
+  ]);
+  // An opacity modifier is still a usage of the brand colour.
+  expect(brandUsagesIn("c.tsx", `  className="${brand("bg", "/10")}"`).map((u) => u.at)).toEqual([
+    1,
+  ]);
+  // A comment line states the rule rather than applying it.
+  expect(brandUsagesIn("d.css", `   * a third \`${brand("bg")}\` is a design decision`)).toEqual(
+    [],
+  );
+  expect(brandUsagesIn("e.tsx", `  // never add ${brand("bg")} here`)).toEqual([]);
+  // Another token on the same prefixes is not the brand.
+  expect(brandUsagesIn("f.tsx", `  className="bg-primary text-primary-foreground"`)).toEqual([]);
+  // The token *name* without a utility prefix is not a usage — tokens.test.ts
+  // asserts LIGHT_THEME.brand's value and must not trip the gate.
+  expect(brandUsagesIn("g.ts", `  expect(COLOR.brand).toBe("#e85d44");`)).toEqual([]);
+});
+
+/** Every tracked source in this repo. */
+function repoSources(): string[] {
+  const listed = spawnSync("git", ["ls-files", "-z"], { cwd: REPO, encoding: "utf8" });
+  expect(listed.status, `git ls-files failed: ${listed.stderr}`).toBe(0);
+  return listed.stdout.split("\0").filter((name) => SOURCE.test(name));
+}
+
+test("no source puts a colour inside a class name", () => {
+  const tracked = repoSources();
+  expect(tracked.length > 0, "the scan found no sources, so it proves nothing").toBeTruthy();
+
+  const offenders = tracked.flatMap((file) =>
+    colouredClassesIn(file, readFileSync(path.join(REPO, file), "utf8")),
+  );
+  expect(
+    offenders,
+    "colour belongs to the token contract — add a token to " +
+      `src/theme/styles.css and name the intent:\n${offenders.join("\n")}`,
+  ).toEqual([]);
+});
+
+/**
+ * This package has zero brand sites: it declares the `--brand` token and never
+ * paints with it. `DESIGN.md` "Where the brand is": brand sites are a consumer
+ * decision — two enumerated sites per consuming app (the wordmark and the
+ * styleguide swatch that displays the value), gated in the consumer's repo.
+ */
+const BRAND_SITES: string[] = [];
+
+test("the brand colour paints nothing here — brand sites are a consumer decision", () => {
+  const tracked = repoSources();
+  expect(tracked.length > 0, "the scan found no sources, so it proves nothing").toBeTruthy();
+
+  const usages = tracked.flatMap((file) =>
+    brandUsagesIn(file, readFileSync(path.join(REPO, file), "utf8")),
+  );
+  expect(
+    usages.map((u) => u.file).sort(),
+    "DESIGN.md 'Where the brand is': this package declares the brand token and never uses it — " +
+      "a brand-coloured site belongs to a consuming app (two enumerated sites per app):\n" +
+      usages.map((u) => `${u.file}:${u.at}: ${u.text}`).join("\n"),
+  ).toEqual(BRAND_SITES);
+});
+
+/**
+ * Lucide is the icon set, and the only one.
+ *
+ * The rule is "one icon library", not "this particular library". So this
+ * guards whichever set is currently *not* in use, and the value below is the
+ * whole of what changes when that decision changes.
+ *
+ * Assembled from fragments so this file never holds the package's name as a
+ * contiguous string, and a repository-wide sweep for it never mistakes its own
+ * guard for a lingering usage.
+ */
+const RETIRED_ICON_PACKAGE = ["@tabler", "icons-react"].join("/");
+
+test("no package declares a second icon set, and no source imports one", () => {
+  const listed = spawnSync("git", ["ls-files", "-z"], { cwd: REPO, encoding: "utf8" });
+  expect(listed.status, `git ls-files failed: ${listed.stderr}`).toBe(0);
+  const tracked = listed.stdout.split("\0").filter(Boolean);
+
+  const manifests = tracked.filter((name) => /(?:^|\/)package\.json$/.test(name));
+  expect(manifests.length > 0, "no manifests were read, so this proves nothing").toBeTruthy();
+  const declaring = manifests.filter((name) =>
+    readFileSync(path.join(REPO, name), "utf8").includes(`"${RETIRED_ICON_PACKAGE}"`),
+  );
+  expect(
+    declaring,
+    `this package draws one icon set, and ${RETIRED_ICON_PACKAGE} is not it. ` +
+      `A second one is a decision for DESIGN.md, not a dependency:\n${declaring.join("\n")}`,
+  ).toEqual([]);
+
+  const sources = tracked.filter((name) => SOURCE.test(name));
+  expect(sources.length > 0, "no sources were read, so this proves nothing").toBeTruthy();
+  const importing = sources.filter((name) =>
+    new RegExp(String.raw`(?:from|require\()\s*["']${RETIRED_ICON_PACKAGE}["']`).test(
+      readFileSync(path.join(REPO, name), "utf8"),
+    ),
+  );
+  expect(importing, `these draw from the retired icon set:\n${importing.join("\n")}`).toEqual([]);
+});
+
+test("the tokens have exactly one home, and it is the stylesheet", () => {
+  const listed = spawnSync("git", ["ls-files", "-z"], { cwd: REPO, encoding: "utf8" });
+  expect(listed.status, `git ls-files failed: ${listed.stderr}`).toBe(0);
+  const configs = listed.stdout
+    .split("\0")
+    .filter((name) => /(?:^|\/)tailwind\.config\.[cm]?[jt]s$/.test(name));
+  expect(
+    configs,
+    "Tailwind v4 is CSS-first: the tokens live in src/theme/styles.css. " +
+      `A config file gives them a second definition that wins for some utilities and not others:\n${configs.join("\n")}`,
+  ).toEqual([]);
+});

package/src/harness.test.tsx

@@ -17,7 +17,7 @@
 import { render } from "@testing-library/react";
 import { expect, it, vi } from "vitest";
 
-import { Dialog, DialogContent, DialogTitle } from "./primitives/dialog";
+import { Dialog, DialogContent, DialogTitle } from "./components/dialog";
 
 const unmountFocusReturned = vi.fn();
 

package/src/index.ts

@@ -1,9 +1,9 @@
 /**
  * `@robomous/ui-core` — the Robomous design system.
  *
- * Extracted from Robomous/VisionSet. UI primitives: Radix behaviour under
- * shadcn Nova styling, iconed with lucide; the foundation design tokens; and
- * the status-tone vocabulary. A consumer imports exactly:
+ * Twenty-one React components this package owns outright, the design tokens
+ * they resolve through, and the status-tone vocabulary. A consumer imports
+ * exactly:
  *
  * ```ts
  * import "@robomous/ui-core/styles.css";   // once, in the app's entry
@@ -11,24 +11,22 @@
  * ```
  *
  * The public surface is listed explicitly rather than `export *`, so what this
- * package promises stays auditable. The gates that keep the primitives
- * canonical are published too: `import { ... } from "@robomous/ui-core/gates"`.
+ * package promises stays auditable. The scanners behind this repository's own
+ * design rules are published too, for a consumer to run over its own sources:
+ * `import { ... } from "@robomous/ui-core/gates"`. DESIGN.md names each rule
+ * and the gate that holds it.
  */
 
 // The design tokens, and their prose contract in DESIGN.md.
-export { cssVar, DARK_THEME, LIGHT_THEME, THEME } from "./tokens.js";
+export { cssVar, DARK_THEME, LIGHT_THEME, THEME } from "./theme/tokens.js";
 
-export { inlineLink } from "./lib/button.js";
-export { cn } from "./lib/cn.js";
-export { menuSurface } from "./lib/menu.js";
-export { twoLineTrigger } from "./lib/select.js";
-export { progressAria } from "./lib/progress.js";
+export { cn } from "cn";
 
 // The one home for status colour outside the Badge.
-export { STATUS_INK, TONE_BORDER, TONE_FILL, type StatusTone } from "./statusTone.js";
+export { STATUS_INK, TONE_BORDER, TONE_FILL, type StatusTone } from "./theme/statusTone.js";
 
-// Primitives — Radix behaviour under shadcn Nova styling, iconed with lucide.
-export { Button, buttonVariants } from "./primitives/button.js";
+// The components — Radix and Base UI behaviour, iconed with lucide.
+export { Button, buttonVariants } from "./components/button.js";
 export {
   Card,
   CardAction,
@@ -37,10 +35,10 @@ export {
   CardFooter,
   CardHeader,
   CardTitle,
-} from "./primitives/card.js";
-export { Input } from "./primitives/input.js";
-export { Textarea } from "./primitives/textarea.js";
-export { Label } from "./primitives/label.js";
+} from "./components/card.js";
+export { Input } from "./components/input.js";
+export { Textarea } from "./components/textarea.js";
+export { Label } from "./components/label.js";
 export {
   Field,
   FieldContent,
@@ -52,7 +50,7 @@ export {
   FieldSeparator,
   FieldSet,
   FieldTitle,
-} from "./primitives/field.js";
+} from "./components/field.js";
 export {
   InputGroup,
   InputGroupAddon,
@@ -60,7 +58,7 @@ export {
   InputGroupInput,
   InputGroupText,
   InputGroupTextarea,
-} from "./primitives/input-group.js";
+} from "./components/input-group.js";
 export {
   Combobox,
   ComboboxChip,
@@ -78,13 +76,44 @@ export {
   ComboboxTrigger,
   ComboboxValue,
   useComboboxAnchor,
-} from "./primitives/combobox.js";
-export { Badge, badgeVariants } from "./primitives/badge.js";
-export { Alert, AlertAction, AlertDescription, AlertTitle } from "./primitives/alert.js";
-export { Dialog, DialogClose, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogOverlay, DialogPortal, DialogTitle, DialogTrigger } from "./primitives/dialog.js";
-export { Sheet, SheetClose, SheetContent, SheetDescription, SheetFooter, SheetHeader, SheetTitle, SheetTrigger } from "./primitives/sheet.js";
-export { Tabs, TabsContent, TabsList, tabsListVariants, TabsTrigger } from "./primitives/tabs.js";
-export { Select, SelectContent, SelectGroup, SelectItem, SelectLabel, SelectScrollDownButton, SelectScrollUpButton, SelectSeparator, SelectTrigger, SelectValue } from "./primitives/select.js";
+} from "./components/combobox.js";
+export { Badge, badgeVariants } from "./components/badge.js";
+export { Alert, AlertAction, AlertDescription, AlertTitle } from "./components/alert.js";
+export {
+  Dialog,
+  DialogClose,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogOverlay,
+  DialogPortal,
+  DialogTitle,
+  DialogTrigger,
+} from "./components/dialog.js";
+export {
+  Sheet,
+  SheetClose,
+  SheetContent,
+  SheetDescription,
+  SheetFooter,
+  SheetHeader,
+  SheetTitle,
+  SheetTrigger,
+} from "./components/sheet.js";
+export { Tabs, TabsContent, TabsList, tabsListVariants, TabsTrigger } from "./components/tabs.js";
+export {
+  Select,
+  SelectContent,
+  SelectGroup,
+  SelectItem,
+  SelectLabel,
+  SelectScrollDownButton,
+  SelectScrollUpButton,
+  SelectSeparator,
+  SelectTrigger,
+  SelectValue,
+} from "./components/select.js";
 export {
   DropdownMenu,
   DropdownMenuCheckboxItem,
@@ -101,11 +130,12 @@ export {
   DropdownMenuSubContent,
   DropdownMenuSubTrigger,
   DropdownMenuTrigger,
-} from "./primitives/dropdown-menu.js";
-export { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "./primitives/tooltip.js";
-export { Progress } from "./primitives/progress.js";
-export { Skeleton } from "./primitives/skeleton.js";
-export { Toaster } from "./primitives/sonner.js";
+} from "./components/dropdown-menu.js";
+export { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "./components/tooltip.js";
+export { Progress } from "./components/progress.js";
+export { Separator } from "./components/separator.js";
+export { Skeleton } from "./components/skeleton.js";
+export { Toaster } from "./components/sonner.js";
 export { toast } from "sonner";
 export {
   Table,
@@ -116,4 +146,4 @@ export {
   TableHead,
   TableHeader,
   TableRow,
-} from "./primitives/table.js";
+} from "./components/table.js";

package/src/theme/imports.test.ts

@@ -0,0 +1,160 @@
+// @vitest-environment node
+/**
+ * Everything `styles.css` imports really resolves — packages and siblings both.
+ *
+ * The stylesheet ships as **source**: `exports["./styles.css"]` hands a consumer
+ * the file itself, and the consumer's Tailwind build is what resolves the
+ * `@import`s in it. So a package named there is a genuine runtime dependency of
+ * this one, and a sibling named there is a file that has to be published. Get
+ * either wrong and every consumer breaks while `pnpm lint`, `pnpm build` and
+ * `pnpm test` all stay green — nothing in this repository compiles CSS, so
+ * nothing here would otherwise notice. A rule nothing checks is a preference;
+ * this is the check.
+ *
+ * Both halves matter, and they fail differently. A missing **package** is a
+ * dependency that was dropped from `package.json` because a grep for
+ * `from "..."` never sees a CSS `@import`. A missing **sibling** is a file that
+ * exists on the author's disk but was never committed, or was left out of
+ * `files` — so it resolves here and nowhere else.
+ *
+ * Package resolution goes through the package's own `exports` map with the
+ * `style` condition first, because that is the condition a CSS bundler asks for
+ * and some packages expose their stylesheet under no other — Node's own
+ * `import.meta.resolve` asks for `import`/`require` and would report a
+ * correctly installed package as missing.
+ */
+
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { expect, test } from "vitest";
+
+const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
+const MODULES = path.join(REPO, "node_modules");
+const STYLESHEET_DIR = path.join(REPO, "src/theme");
+const STYLESHEET = readFileSync(path.join(STYLESHEET_DIR, "styles.css"), "utf8");
+
+/** The conditions a CSS bundler offers, most specific first. */
+const CONDITIONS = ["style", "default", "import", "require"];
+
+/** Every `@import` specifier in the stylesheet, in source order. */
+function importsIn(css: string): string[] {
+  return [...css.matchAll(/^\s*@import\s+["']([^"']+)["']/gm)].map((match) => match[1]);
+}
+
+/** A URL needs no filesystem, so it is not this gate's business. */
+const isRemote = (spec: string) => /^https?:/.test(spec);
+
+/** `"./tailwind.css"`, `"../a/b.css"` — resolved against the stylesheet itself. */
+const isRelative = (spec: string) => /^\.{1,2}\//.test(spec);
+
+/** `"@scope/pkg/a/b"` → `["@scope/pkg", "./a/b"]`; `"pkg"` → `["pkg", "."]`. */
+function splitSpecifier(spec: string): [name: string, subpath: string] {
+  const segments = spec.split("/");
+  const name = spec.startsWith("@") ? segments.slice(0, 2).join("/") : segments[0];
+  const rest = spec.slice(name.length);
+  return [name, rest === "" ? "." : `.${rest}`];
+}
+
+/** The first branch of a conditional export any of `CONDITIONS` selects. */
+function pickCondition(node: unknown): string | null {
+  if (typeof node === "string") return node;
+  if (node === null || typeof node !== "object") return null;
+  const branches = node as Record<string, unknown>;
+  for (const condition of CONDITIONS) {
+    if (condition in branches) {
+      const picked = pickCondition(branches[condition]);
+      if (picked !== null) return picked;
+    }
+  }
+  return null;
+}
+
+/** Where a package's `exports` (or its legacy fields) send one subpath. */
+function targetOf(manifest: Record<string, unknown>, subpath: string): string | null {
+  const map = manifest.exports;
+  if (map === undefined) {
+    // No exports map: "." is the package's own stylesheet field, and any other
+    // subpath is a plain path inside the package.
+    if (subpath !== ".") return subpath;
+    return (manifest.style as string) ?? (manifest.main as string) ?? null;
+  }
+  if (typeof map === "string") return subpath === "." ? map : null;
+  const entries = map as Record<string, unknown>;
+  if (subpath in entries) return pickCondition(entries[subpath]);
+  // An exports map that is conditions all the way down is shorthand for ".".
+  if (subpath === "." && !Object.keys(entries).some((key) => key.startsWith("."))) {
+    return pickCondition(entries);
+  }
+  return null;
+}
+
+/** The file a specifier lands on, or why it lands nowhere. */
+function resolveStyleImport(spec: string): { file: string } | { reason: string } {
+  const [name, subpath] = splitSpecifier(spec);
+  const root = path.join(MODULES, ...name.split("/"));
+  const manifestPath = path.join(root, "package.json");
+  if (!existsSync(manifestPath)) {
+    return { reason: `${name} is not installed — it is missing from package.json dependencies` };
+  }
+  const target = targetOf(JSON.parse(readFileSync(manifestPath, "utf8")), subpath);
+  if (target === null) {
+    return { reason: `${name} declares no export for ${subpath}` };
+  }
+  const file = path.join(root, target);
+  if (!existsSync(file)) {
+    return { reason: `${name} exports ${subpath} as ${target}, which does not exist` };
+  }
+  return { file };
+}
+
+test("every package the stylesheet imports is installed and exports the file it names", () => {
+  const specs = importsIn(STYLESHEET).filter((spec) => !isRemote(spec) && !isRelative(spec));
+  expect(specs.length > 0, "the stylesheet named no packages, so this proves nothing").toBe(true);
+
+  const broken = specs
+    .map((spec) => ({ spec, result: resolveStyleImport(spec) }))
+    .filter((entry) => "reason" in entry.result)
+    .map((entry) => `@import "${entry.spec}": ${(entry.result as { reason: string }).reason}`);
+
+  expect(
+    broken,
+    "styles.css ships as source and the consumer's Tailwind build resolves these, so an " +
+      "unresolvable @import breaks every consumer and nothing in this repository compiles " +
+      `CSS to catch it:\n${broken.join("\n")}`,
+  ).toEqual([]);
+});
+
+test("every sibling the stylesheet imports exists and is committed", () => {
+  const specs = importsIn(STYLESHEET).filter(isRelative);
+  expect(specs.length > 0, "the stylesheet named no siblings, so this proves nothing").toBe(true);
+
+  const broken = specs.flatMap((spec) => {
+    const file = path.resolve(STYLESHEET_DIR, spec);
+    if (!existsSync(file)) {
+      return [`@import "${spec}": ${path.relative(REPO, file)} does not exist`];
+    }
+    // On disk is not enough. `files: ["src"]` publishes what the working tree
+    // holds, so an uncommitted sibling packs fine here and is absent from the
+    // clone CI builds and publishes from — the failure lands on consumers only.
+    const tracked = spawnSync("git", ["ls-files", "--error-unmatch", file], {
+      cwd: REPO,
+      encoding: "utf8",
+    });
+    if (tracked.status !== 0) {
+      return [
+        `@import "${spec}": ${path.relative(REPO, file)} exists but is not tracked by git — ` +
+          "commit it, or the published package will not carry it",
+      ];
+    }
+    return [];
+  });
+
+  expect(
+    broken,
+    "styles.css ships as source, so a sibling it imports has to reach the consumer with it:\n" +
+      broken.join("\n"),
+  ).toEqual([]);
+});

package/src/{statusTone.test.ts → theme/statusTone.test.ts}

@@ -13,7 +13,11 @@ describe("status tones", () => {
     expect(STATUS_INK.warning).toBe("text-amber-700 dark:text-amber-400");
     expect(STATUS_INK.success).toBe("text-emerald-700 dark:text-emerald-400");
     expect(STATUS_INK.info).toBe("text-sky-700 dark:text-sky-400");
-    for (const v of [...Object.values(TONE_FILL), ...Object.values(TONE_BORDER), ...Object.values(STATUS_INK)]) {
+    for (const v of [
+      ...Object.values(TONE_FILL),
+      ...Object.values(TONE_BORDER),
+      ...Object.values(STATUS_INK),
+    ]) {
       expect(v).not.toMatch(/\b(?:bg|border|text)-(?:success|warning)\b/);
     }
   });