basalt-ui 1.27.0 → 1.29.0

package/dist/cli/index.js

@@ -12,27 +12,15 @@ import {
 } from "node:fs";
 import { dirname, isAbsolute, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import {
-  checkSource,
-  DEFAULT_GUARD_CONFIG,
-  GENERATED_HEADER_LINE,
-  findAllowAnnotations,
-  guardKindRemedy,
-  GUARD_RULES,
-  guardWaiverHint,
-  neutralizeAllowAnnotation,
-  TOKENS_ONLY_DISABLED_KINDS,
-  unmatchedExemptPatterns
-} from "../guard/index.js";
-import { evaluateGuardHook } from "../guard/guard-hook.js";
-import {
-  PLUGIN_RULE_ID_LIST,
-  RULE_NAMES,
-  SKILL_NAMES,
-  SURFACES,
-  TOKEN_LAYER_BOUNDARY_SURFACES
-} from "../surfaces.js";
-import { buildPaletteCss, deriveSpacing } from "../tokens/index.js";
+import { DEFAULT_GUARD_CONFIG, guardWaiverHint } from "../guard/index.js";
+import { RULE_NAMES, SKILL_NAMES } from "../surfaces.js";
+import { checkTheme } from "./check-theme.js";
+import { doctor } from "./doctor.js";
+import { guardHook } from "./guard-hook.js";
+import { COMMAND_OPTIONS, USAGE, unknownFlag } from "./help.js";
+import { init } from "./init.js";
+import { sync } from "./sync.js";
+import { fontsCss, normalizeColorFunctions, tokensCss } from "./tokens-css.js";
 function exemptRulePaths(entry) {
   if (entry === void 0) return [];
   return Array.isArray(entry) ? entry : entry.paths;
@@ -157,54 +145,13 @@ function shippedAssetPath(install, fromDir, asset) {
   if (install.dir === null) return `./node_modules/basalt-ui/${asset}`;
   return `${relativePosix(fromDir, install.dir)}/${asset}`;
 }
-function hasBasaltProject(dir) {
-  if (existsSync(resolve(dir, MANIFEST_PATH))) return true;
-  const raw = readIfExists(resolve(dir, "package.json"));
-  if (raw === null) return false;
-  try {
-    return JSON.parse(raw).basalt !== void 0;
-  } catch {
-    return false;
-  }
-}
-function descendantProjects(cwd, depth = 2) {
-  if (depth === 0) return [];
-  const out = [];
-  for (const name of subdirNames(cwd, { skipDotDirs: true })) {
-    const dir = resolve(cwd, name);
-    if (hasBasaltProject(dir)) out.push(dir);
-    else out.push(...descendantProjects(dir, depth - 1));
-  }
-  return out;
-}
-function ascendantProject(cwd) {
-  const repoRoot = findRepoRoot(cwd);
-  if (repoRoot === cwd) return null;
-  let current = dirname(cwd);
-  for (; ; ) {
-    if (hasBasaltProject(current)) return current;
-    if (current === repoRoot) return null;
-    const parent = dirname(current);
-    if (parent === current) return null;
-    current = parent;
-  }
-}
 function resolveProjectDir(cwd) {
   const override = process.env["BASALT_CWD"];
-  if (override !== void 0 && override.length > 0) {
-    const dir = isAbsolute(override) ? override : resolve(cwd, override);
-    return { dir, relocatedFrom: dir === cwd ? null : cwd, ambiguous: null };
+  if (override === void 0 || override.length === 0) {
+    return { dir: cwd, relocatedFrom: null };
   }
-  if (hasBasaltProject(cwd)) return { dir: cwd, relocatedFrom: null, ambiguous: null };
-  const declared = collectWorkspacePackages(cwd).packages.filter((pkg) => pkg.dir !== cwd && hasBasaltProject(pkg.dir)).map((pkg) => pkg.dir);
-  const candidates = declared.length > 0 ? declared : descendantProjects(cwd);
-  if (candidates.length === 1) {
-    return { dir: candidates[0], relocatedFrom: cwd, ambiguous: null };
-  }
-  if (candidates.length > 1) return { dir: cwd, relocatedFrom: null, ambiguous: candidates };
-  const above = ascendantProject(cwd);
-  if (above !== null) return { dir: above, relocatedFrom: cwd, ambiguous: null };
-  return { dir: cwd, relocatedFrom: null, ambiguous: null };
+  const dir = isAbsolute(override) ? override : resolve(cwd, override);
+  return { dir, relocatedFrom: dir === cwd ? null : cwd };
 }
 function declaredProfile(cfg, flags) {
   if (flags.includes("--tokens-only")) return "tokens-only";
@@ -214,18 +161,6 @@ function declaredProfile(cfg, flags) {
 function conflictingProfileFlags(flags) {
   return flags.includes("--tokens-only") && flags.includes("--framework");
 }
-function workspaceHasMantine(cwd) {
-  if (hasDependency(cwd, "@mantine/core")) return true;
-  return collectWorkspacePackages(cwd).packages.some(
-    (pkg) => hasDependency(pkg.dir, "@mantine/core")
-  );
-}
-function inferredProfile(cwd, cfg, flags) {
-  if (flags.includes("--tokens-only") || flags.includes("--framework") || cfg.profile !== void 0) {
-    return declaredProfile(cfg, flags);
-  }
-  return !existsSync(resolve(cwd, MANIFEST_PATH)) && !workspaceHasMantine(cwd) ? "tokens-only" : "framework";
-}
 function scannableFiles(cwd, cfg) {
   const exempt = new Set(cfg.exempt ?? defaultExempt(cfg));
   const seen = /* @__PURE__ */ new Set();
@@ -261,354 +196,6 @@ function waiverHintFor(relPath, profile) {
   }
   return `${guardWaiverHint(PLAIN_JSON_HINT_PATH)} (basaltAppPlugin would emit the file instead, but it needs basalt's Vite/React layer, which a tokens-only consumer has opted out of.)`;
 }
-function checkTheme(invocationCwd = process.cwd(), flags = []) {
-  if (conflictingProfileFlags(flags)) {
-    console.error(
-      "basalt-ui check-theme: --tokens-only and --framework are alternatives \u2014 pass one."
-    );
-    return 1;
-  }
-  const project = resolveProjectDir(invocationCwd);
-  if (project.ambiguous !== null) {
-    console.error(
-      `\u2716 basalt-ui check-theme: no basalt config at ${invocationCwd}, and ${project.ambiguous.length} packages below it carry one (${project.ambiguous.map((d) => relativePosix(invocationCwd, d)).join(", ")}) \u2014 run it from one of them, or set BASALT_CWD to pick.`
-    );
-    return 1;
-  }
-  const cwd = project.dir;
-  if (project.relocatedFrom !== null) {
-    console.log(
-      `basalt-ui check-theme: no basalt config at ${project.relocatedFrom} \u2014 running in ${relativePosix(project.relocatedFrom, cwd)}, where it lives.`
-    );
-  }
-  const cfg = readBasaltConfig(cwd);
-  const roots = resolveRoots(cfg);
-  const profile = declaredProfile(cfg, flags);
-  if (profile === "tokens-only") {
-    console.log(
-      `basalt-ui check-theme: tokens-only profile \u2014 ${TOKENS_ONLY_DISABLED_KINDS.size} Mantine-coupled kinds are off; the color and typography kinds still apply. Pass --framework to force the full set.`
-    );
-  }
-  const guardCfg = {
-    spacingSteps: cfg.spacingSteps ?? DEFAULT_GUARD_CONFIG.spacingSteps,
-    rawRadius: cfg.rawRadius ?? DEFAULT_GUARD_CONFIG.rawRadius,
-    forbiddenAccents: cfg.forbiddenAccents ?? DEFAULT_GUARD_CONFIG.forbiddenAccents,
-    mantineShadeIndex: cfg.mantineShadeIndex ?? DEFAULT_GUARD_CONFIG.mantineShadeIndex,
-    rawSurface: cfg.rawSurface ?? DEFAULT_GUARD_CONFIG.rawSurface,
-    cardWithBorder: cfg.cardWithBorder ?? DEFAULT_GUARD_CONFIG.cardWithBorder,
-    offSystemSurfaceVar: cfg.offSystemSurfaceVar ?? DEFAULT_GUARD_CONFIG.offSystemSurfaceVar,
-    rawHtmlLayout: cfg.rawHtmlLayout ?? DEFAULT_GUARD_CONFIG.rawHtmlLayout,
-    inlineSpacing: cfg.inlineSpacing ?? DEFAULT_GUARD_CONFIG.inlineSpacing,
-    inlineDisplay: cfg.inlineDisplay ?? DEFAULT_GUARD_CONFIG.inlineDisplay,
-    rawVisxAxis: cfg.rawVisxAxis ?? DEFAULT_GUARD_CONFIG.rawVisxAxis,
-    rawMotionValue: cfg.rawMotionValue ?? DEFAULT_GUARD_CONFIG.rawMotionValue,
-    unframedChart: cfg.unframedChart ?? DEFAULT_GUARD_CONFIG.unframedChart,
-    chartMissingAriaLabel: cfg.chartMissingAriaLabel ?? DEFAULT_GUARD_CONFIG.chartMissingAriaLabel,
-    rawFormControl: cfg.rawFormControl ?? DEFAULT_GUARD_CONFIG.rawFormControl,
-    sub16InputFont: cfg.sub16InputFont ?? DEFAULT_GUARD_CONFIG.sub16InputFont,
-    allowComment: "theme-allow",
-    exemptRules: resolveExemptRules(cfg),
-    severity: cfg.severity ?? DEFAULT_GUARD_CONFIG.severity,
-    ...profile === "tokens-only" ? { profile: "tokens-only" } : {}
-  };
-  const findings = [];
-  const scanned = scannableFiles(cwd, cfg);
-  for (const rel of scanned) {
-    findings.push(...checkSource(readFileSync(resolve(cwd, rel), "utf8"), rel, guardCfg));
-  }
-  if (scanned.length === 0) {
-    if (cfg.roots === void 0) {
-      console.error(
-        `\u2716 basalt-ui check-theme: 0 files scanned \u2014 no "basalt.roots" configured in package.json, and the built-in default roots (${DEFAULT_ROOTS.join(", ")}) matched zero files. Set "basalt": { "roots": [...] } in package.json to point at your source directories.`
-      );
-    } else {
-      console.error(
-        `\u2716 basalt-ui check-theme: 0 files scanned \u2014 the configured "basalt.roots" (${roots.join(", ")}) matched zero files. Check the paths in "basalt.roots" in package.json.`
-      );
-    }
-    return 1;
-  }
-  if (flags.includes("--audit-allows")) return auditAllows(cwd, cfg, guardCfg, scanned);
-  for (const unmatched of unmatchedExemptPatterns(guardCfg, scanned)) {
-    console.error(
-      `\u26A0 basalt-ui check-theme: "basalt.exemptRules" entry ${unmatched.kind}: "${unmatched.pattern}" ` + (unmatched.reason === "unknown-kind" ? "names no guard kind \u2014 it exempts nothing at all (a typo, or a kind that was renamed)." : "matched none of the scanned files \u2014 it suppresses nothing, and reads as coverage in a config review while enforcing as much as an empty object.")
-    );
-  }
-  if (findings.length === 0) {
-    console.log("\u2713 Theme guard: no off-palette colors.");
-    return 0;
-  }
-  const errors = findings.filter((f) => f.severity === "error");
-  const warnings = findings.filter((f) => f.severity === "warn");
-  const report = (group, heading) => {
-    const byFile = /* @__PURE__ */ new Map();
-    for (const f of group) {
-      const list = byFile.get(f.relPath) ?? [];
-      list.push(f);
-      byFile.set(f.relPath, list);
-    }
-    console.error(heading);
-    for (const [file, vs] of [...byFile].toSorted()) {
-      console.error(file);
-      for (const v of vs.toSorted((a, b) => a.line - b.line)) {
-        console.error(`  ${String(v.line).padStart(4)}  ${v.kind.padEnd(22)} ${v.text}`);
-      }
-      console.error("");
-    }
-  };
-  if (warnings.length > 0) {
-    report(
-      warnings,
-      // Deliberately neutral about WHY a kind is a warning. Two origins reach this block — a kind
-      // in its grace minor, and a consumer's own `basalt.severity` override — and the finding
-      // doesn't carry which. Promising promotion next minor would be wrong for the second.
-      `\u26A0 Theme guard: ${warnings.length} warning(s) \u2014 reported, not fatal. A kind warns while it is in its grace minor, or because \`basalt.severity\` turned it down; fix on your own schedule.
-`
-    );
-  }
-  if (errors.length > 0) {
-    report(errors, `\u2716 Theme guard: ${errors.length} off-palette / off-identity violation(s)
-`);
-  }
-  const presentKinds = [...new Set(findings.map((f) => f.kind))].toSorted();
-  const waiverHints = [
-    ...new Set(findings.map((f) => waiverHintFor(f.relPath, profile)))
-  ].toSorted();
-  console.error(["Fix:", ...presentKinds.map(guardKindRemedy), ...waiverHints].join(" "));
-  if (findings.some((f) => SERIES_MODULE_HINT_RE.test(f.relPath))) {
-    console.error(
-      'Hint: if a flagged file IS your palette/series source, exempt it via "basalt": { "exempt": ["<path>"] } in package.json.'
-    );
-  }
-  return errors.length > 0 ? 1 : 0;
-}
-function findingKey(f) {
-  return `${f.relPath}:${f.line}:${f.kind}`;
-}
-function resolveToolBin(dir, name) {
-  let current = dir;
-  for (; ; ) {
-    const candidate = resolve(current, "node_modules/.bin", name);
-    if (existsSync(candidate)) return candidate;
-    const parent = resolve(current, "..");
-    if (parent === current) break;
-    current = parent;
-  }
-  const probe = spawnSync(name, ["--version"], { stdio: "ignore", timeout: 1e4 });
-  return probe.error === void 0 && probe.status === 0 ? name : null;
-}
-function diagnosticCounts(diagnostics, filename) {
-  const counts = /* @__PURE__ */ new Map();
-  for (const d of diagnostics) {
-    if (d.filename !== filename) continue;
-    const code = typeof d.code === "string" ? d.code : "";
-    const rule = /^basalt\((.+)\)$/.exec(code)?.[1];
-    if (rule === void 0) continue;
-    const line = d.labels?.[0]?.span?.line;
-    const key = `${typeof line === "number" ? line : 0}:${rule}`;
-    counts.set(key, (counts.get(key) ?? 0) + 1);
-  }
-  return counts;
-}
-function probePluginRules(cwd, guardCfg, probes, sources) {
-  if (probes.length === 0) return /* @__PURE__ */ new Map();
-  const bin = resolveToolBin(cwd, "oxlint");
-  if (bin === null) return null;
-  const written = [];
-  const probePaths = /* @__PURE__ */ new Map();
-  try {
-    for (const probe of probes) {
-      const probed = neutralizeAllowAnnotation(sources.get(probe.rel) ?? "", probe.line, guardCfg);
-      const dot = probe.rel.lastIndexOf(".");
-      const rel = dot === -1 ? `${probe.rel}.basalt-audit-${probe.slot}` : `${probe.rel.slice(0, dot)}.basalt-audit-${probe.slot}${probe.rel.slice(dot)}`;
-      const abs = resolve(cwd, rel);
-      if (existsSync(abs)) continue;
-      writeFileSync(abs, probed, "utf8");
-      written.push(abs);
-      probePaths.set(probe.slot, rel);
-    }
-    if (probePaths.size === 0) return null;
-    const targets = [...new Set(probes.map((p) => p.rel)), ...probePaths.values()];
-    const run2 = spawnSync(bin, ["--format=json", "--no-error-on-unmatched-pattern", ...targets], {
-      cwd,
-      encoding: "utf8",
-      timeout: 12e4,
-      stdio: ["ignore", "pipe", "ignore"]
-    });
-    if (run2.error !== void 0 || typeof run2.stdout !== "string") return null;
-    let diagnostics;
-    try {
-      diagnostics = JSON.parse(run2.stdout).diagnostics ?? [];
-    } catch {
-      return null;
-    }
-    const verdicts = /* @__PURE__ */ new Map();
-    for (const probe of probes) {
-      const probeRel = probePaths.get(probe.slot);
-      if (probeRel === void 0) continue;
-      const before = diagnosticCounts(diagnostics, probe.rel);
-      const after = diagnosticCounts(diagnostics, probeRel);
-      const revealed = [];
-      for (const [key, count] of after) {
-        if (count <= (before.get(key) ?? 0)) continue;
-        const [line = "", rule = ""] = key.split(":");
-        revealed.push(`${rule}@${line}`);
-      }
-      verdicts.set(probe.slot, revealed.toSorted());
-    }
-    return verdicts;
-  } finally {
-    for (const abs of written) {
-      try {
-        unlinkSync(abs);
-      } catch {
-      }
-    }
-  }
-}
-function auditAllows(cwd, cfg, guardCfg, scanned) {
-  const token = guardCfg.allowComment;
-  const lines = [`
-basalt-ui check-theme --audit-allows \u2014 ${cwd}
-`];
-  let dead = 0;
-  let live = 0;
-  let outOfReach = 0;
-  let unaccountable = 0;
-  const waiverLines = [];
-  const pluginProbes = [];
-  const sources = /* @__PURE__ */ new Map();
-  for (const rel of scanned) sources.set(rel, readFileSync(resolve(cwd, rel), "utf8"));
-  for (const rel of scanned) {
-    const text = sources.get(rel) ?? "";
-    if (!text.includes(token)) continue;
-    const baseline = checkSource(text, rel, guardCfg);
-    const baselineKeys = new Set(
-      baseline.filter((f) => f.kind !== "theme-allow-unscoped").map(findingKey)
-    );
-    const unscopedAt = new Map(
-      baseline.filter((f) => f.kind === "theme-allow-unscoped").map((f) => [f.line, f.token])
-    );
-    for (const site of findAllowAnnotations(text, rel, guardCfg)) {
-      const revealed = checkSource(
-        neutralizeAllowAnnotation(text, site.line, guardCfg),
-        rel,
-        guardCfg
-      ).filter((f) => f.kind !== "theme-allow-unscoped" && !baselineKeys.has(findingKey(f))).map((f) => `${f.kind}@${f.line}`);
-      const note = unscopedAt.get(site.line);
-      if (note !== void 0) unaccountable++;
-      const label = `  ${rel}:${site.line}`.padEnd(52);
-      const suffix = note === void 0 ? "" : ` [${note}]`;
-      if (revealed.length > 0) {
-        live++;
-        waiverLines.push(`${label} suppresses ${[...new Set(revealed)].join(", ")}${suffix}`);
-        continue;
-      }
-      if (site.pluginRules.length > 0 && site.guardKinds.length === 0) {
-        pluginProbes.push({
-          slot: waiverLines.length,
-          rel,
-          line: site.line,
-          ids: site.pluginRules,
-          site: label,
-          suffix
-        });
-        waiverLines.push("");
-        continue;
-      }
-      if (site.guardKinds.length === 0 && site.unknownRules.length > 0) {
-        outOfReach++;
-        waiverLines.push(
-          `${label} scoped to ${site.unknownRules.join(", ")} \u2014 names no guard kind and no plugin rule, so this audit cannot judge it (most likely a typo, which theme-allow-unscoped reports)${suffix}`
-        );
-        continue;
-      }
-      dead++;
-      waiverLines.push(`${label} SUPPRESSES NOTHING \u2014 dead, delete it${suffix}`);
-    }
-  }
-  const pluginVerdicts = probePluginRules(cwd, guardCfg, pluginProbes, sources);
-  for (const probe of pluginProbes) {
-    const revealed = pluginVerdicts?.get(probe.slot);
-    if (revealed === void 0) {
-      outOfReach++;
-      waiverLines[probe.slot] = `${probe.site} scoped to ${probe.ids.join(", ")} \u2014 an oxlint plugin rule, and oxlint could not be run here, so this audit cannot judge it${probe.suffix}`;
-      continue;
-    }
-    if (revealed.length > 0) {
-      live++;
-      waiverLines[probe.slot] = `${probe.site} suppresses ${revealed.join(", ")} (oxlint)${probe.suffix}`;
-      continue;
-    }
-    dead++;
-    waiverLines[probe.slot] = `${probe.site} SUPPRESSES NOTHING \u2014 dead, delete it (proved by re-running oxlint over the file with this annotation neutralized)${probe.suffix}`;
-  }
-  lines.push(`${token} annotations (${waiverLines.length}):`);
-  lines.push(...waiverLines.length === 0 ? ["  (none)"] : waiverLines);
-  const exemptLines = [];
-  let exemptCount = 0;
-  const declared = Object.entries(cfg.exemptRules ?? {});
-  if (declared.length > 0) {
-    const baselineKeys = /* @__PURE__ */ new Set();
-    for (const rel of scanned) {
-      for (const f of checkSource(sources.get(rel) ?? "", rel, guardCfg))
-        baselineKeys.add(findingKey(f));
-    }
-    for (const [kind, entry] of declared) {
-      const reason = exemptRuleReason(entry);
-      for (const pattern of exemptRulePaths(entry)) {
-        exemptCount++;
-        const probeCfg = {
-          ...guardCfg,
-          exemptRules: {
-            ...guardCfg.exemptRules,
-            [kind]: exemptRulePaths(entry).filter((p) => p !== pattern)
-          }
-        };
-        const revealed = /* @__PURE__ */ new Set();
-        for (const rel of scanned) {
-          for (const f of checkSource(sources.get(rel) ?? "", rel, probeCfg)) {
-            if (!baselineKeys.has(findingKey(f))) revealed.add(f.relPath);
-          }
-        }
-        const site = `  ${kind}: "${pattern}"`.padEnd(52);
-        const why = reason === null ? " [no reason recorded]" : ` \u2014 ${reason}`;
-        if (revealed.size === 0) {
-          dead++;
-          const unmatched = unmatchedExemptPatterns(guardCfg, scanned).find(
-            (u) => u.kind === kind && u.pattern === pattern
-          );
-          exemptLines.push(
-            `${site} SUPPRESSES NOTHING \u2014 ` + (unmatched === void 0 ? "the files it matches have no such finding; delete it" : unmatched.reason === "unknown-kind" ? "it names no guard kind (a typo, or a renamed kind)" : "it matches no scanned file at all") + why
-          );
-        } else {
-          live++;
-          exemptLines.push(
-            `${site} suppresses findings in ${[...revealed].toSorted().join(", ")}${why}`
-          );
-        }
-      }
-    }
-  }
-  lines.push(`
-basalt.exemptRules entries (${exemptCount}):`);
-  lines.push(...exemptLines.length === 0 ? ["  (none)"] : exemptLines);
-  lines.push(
-    `
-${live} live, ${dead} dead, ${outOfReach} unjudgeable, ${unaccountable} unaccountable (reported as theme-allow-unscoped by a normal run).`
-  );
-  const includes = cfg.include ?? [];
-  lines.push(
-    `Scope: the ${scanned.length} file(s) check-theme scans \u2014 everything under basalt.roots (${resolveRoots(cfg).join(", ")}), plus each root's sibling index.html and public/ tree, ` + (includes.length === 0 ? "plus anything named in basalt.include (none). " : `plus basalt.include (${includes.join(", ")}). `) + "A waiver in a file none of those reach is not audited \u2014 widen roots, or name it in basalt.include, or accept that nothing polices that file."
-  );
-  if (dead > 0) {
-    lines.push(
-      "A dead waiver is not harmless: it is an exception nobody re-checked, and it will silently cover the next real finding on that line."
-    );
-  }
-  console.log(lines.join("\n"));
-  return dead > 0 ? 1 : 0;
-}
 const BLOCK_BEGIN_PREFIX = "<!-- basalt:begin";
 const BLOCK_END = "<!-- basalt:end -->";
 const MANIFEST_PATH = ".basalt/manifest.json";
@@ -887,16 +474,6 @@ function readManifest(cwd) {
     return { version: 1, files: {} };
   }
 }
-const LEGACY_OXFMT_DEST = "oxfmt.json";
-function migrateLegacyOxfmt(cwd, pkgRoot, manifest) {
-  if (!(LEGACY_OXFMT_DEST in manifest.files)) return;
-  delete manifest.files[LEGACY_OXFMT_DEST];
-  const legacyAbs = resolve(cwd, LEGACY_OXFMT_DEST);
-  const onDisk = readIfExists(legacyAbs);
-  if (onDisk === null) return;
-  const shipped = readSource(pkgRoot, "configs/oxfmt.json");
-  if (shipped !== null && onDisk === shipped) unlinkSync(legacyAbs);
-}
 const RETIREABLE_DEST_PATTERNS = [
   /^\.claude\/rules\/basalt-[a-z0-9-]+\.md$/,
   /^\.claude\/skills\/basalt-[a-z0-9-]+\/SKILL\.md$/
@@ -946,16 +523,6 @@ function removeEmptyParentDir(fileAbs) {
   } catch {
   }
 }
-const DESIGN_VERSION_LINE = /^(> Managed by basalt-ui) \(\d+\.\d+\.\d+\)\./m;
-function migrateDesignVersionLine(cwd) {
-  const dest = resolve(cwd, "DESIGN.md");
-  const onDisk = readIfExists(dest);
-  if (onDisk === null || !DESIGN_VERSION_LINE.test(onDisk)) return;
-  writeFileEnsuringDir(
-    dest,
-    onDisk.replace(DESIGN_VERSION_LINE, "$1 \u2014 run `basalt-ui doctor` for the version.")
-  );
-}
 function writeFileEnsuringDir(abs, content) {
   mkdirSync(dirname(abs), { recursive: true });
   writeFileSync(abs, content);
@@ -1097,36 +664,25 @@ function rootsNotices(state) {
 function stripJsonc(text) {
   let out = "";
   let inString = false;
-  let escaped = false;
-  let i = 0;
-  while (i < text.length) {
+  for (let i = 0; i < text.length; i++) {
     const ch = text[i];
     if (inString) {
       out += ch;
-      if (escaped) escaped = false;
-      else if (ch === "\\") escaped = true;
+      if (ch === "\\") out += text[++i] ?? "";
       else if (ch === '"') inString = false;
-      i += 1;
       continue;
     }
-    if (ch === '"') {
-      inString = true;
-      out += ch;
-      i += 1;
+    if (ch === '"') inString = true;
+    else if (ch === "/" && text[i + 1] === "/") {
+      while (i < text.length && text[i] !== "\n") i++;
       continue;
-    }
-    if (ch === "/" && text[i + 1] === "/") {
-      while (i < text.length && text[i] !== "\n") i += 1;
-      continue;
-    }
-    if (ch === "/" && text[i + 1] === "*") {
-      i += 2;
-      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i += 1;
+    } else if (ch === "/" && text[i + 1] === "*") {
       i += 2;
+      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++;
+      i++;
       continue;
     }
     out += ch;
-    i += 1;
   }
   return out.replace(/,(\s*[}\]])/g, "$1");
 }
@@ -1148,68 +704,39 @@ const LEFTHOOK_CONFIG_NAMES = ["lefthook.yml", "lefthook.yaml", ".lefthook.yml",
 function findLefthookConfig(dir) {
   return LEFTHOOK_CONFIG_NAMES.find((name) => existsSync(resolve(dir, name))) ?? null;
 }
-function yamlUnquote(raw) {
-  return raw.trim().replace(/^['"]|['"]$/g, "");
-}
-function yamlExtendsEntries(text) {
-  const lines = text.split("\n");
+function lefthookDumpRunLines(dump) {
   const out = [];
-  for (const [index, line] of lines.entries()) {
-    const inline = /^extends:\s*\[(.*)\]\s*$/.exec(line ?? "");
-    if (inline !== null) {
-      out.push(...(inline[1] ?? "").split(",").map(yamlUnquote).filter(Boolean));
-      continue;
-    }
-    if (!/^extends:\s*(#.*)?$/.test(line ?? "")) continue;
-    for (const next of lines.slice(index + 1)) {
-      if (/^\s*(#.*)?$/.test(next ?? "")) continue;
-      const item = /^\s*-\s*(.+?)\s*$/.exec(next ?? "");
-      if (item === null) break;
-      out.push(yamlUnquote(item[1] ?? ""));
+  for (const hook of Object.values(dump)) {
+    if (typeof hook !== "object" || hook === null || !("commands" in hook)) continue;
+    const commands = hook.commands;
+    if (typeof commands !== "object" || commands === null) continue;
+    for (const command of Object.values(commands)) {
+      const run2 = command?.run;
+      if (typeof run2 === "string") out.push(run2);
     }
   }
   return out;
 }
-function inspectLefthookSeam(repoRoot) {
+function inspectLefthookGate(repoRoot) {
   const file = findLefthookConfig(repoRoot);
   if (file === null) return { kind: "no-file" };
-  const raw = readIfExists(resolve(repoRoot, file));
-  if (raw === null) return { kind: "no-file" };
-  const entry = yamlExtendsEntries(raw).find((e) => e.endsWith("basalt-ui/configs/lefthook.yml"));
-  if (entry === void 0) return { kind: "unwired", file };
-  return existsSync(resolve(repoRoot, entry)) ? { kind: "ok", file, entry } : { kind: "broken", file, entry };
-}
-const LEFTHOOK_GUARD_RUN = /^\s*run:\s*.*\bcheck-theme\b/m;
-function lefthookDump(repoRoot) {
   const localBin = resolve(repoRoot, "node_modules/.bin/lefthook");
   const bin = existsSync(localBin) ? localBin : "lefthook";
+  let dump = null;
   try {
-    const result = spawnSync(bin, ["dump"], {
+    const result = spawnSync(bin, ["dump", "--format", "json"], {
       cwd: repoRoot,
       encoding: "utf8",
       timeout: 1e4,
       stdio: ["ignore", "pipe", "ignore"]
     });
-    if (result.error !== void 0 || result.status !== 0) return null;
-    return result.stdout;
+    dump = result.error === void 0 && result.status === 0 ? JSON.parse(result.stdout) : null;
   } catch {
-    return null;
+    dump = null;
   }
-}
-function inspectLefthookGate(repoRoot) {
-  const seam = inspectLefthookSeam(repoRoot);
-  if (seam.kind === "no-file") return { kind: "no-file" };
-  if (seam.kind === "ok") return { kind: "extends-ok", file: seam.file, entry: seam.entry };
-  if (seam.kind === "broken") {
-    return { kind: "extends-broken", file: seam.file, entry: seam.entry };
-  }
-  const dump = lefthookDump(repoRoot);
-  if (dump !== null) {
-    return LEFTHOOK_GUARD_RUN.test(dump) ? { kind: "wired", file: seam.file, proof: "dump" } : { kind: "absent", file: seam.file };
-  }
-  const raw = readIfExists(resolve(repoRoot, seam.file)) ?? "";
-  if (LEFTHOOK_GUARD_RUN.test(raw)) return { kind: "wired", file: seam.file, proof: "config" };
-  return { kind: "advisory", file: seam.file };
+  if (dump === null) return { kind: "unreadable", file };
+  const wired = lefthookDumpRunLines(dump).some((run2) => /\bcheck-theme\b/.test(run2));
+  return wired ? { kind: "wired", file } : { kind: "absent", file };
 }
 function mergeOxlintExtends(cwd, presetPath) {
   const abs = resolve(cwd, ".oxlintrc.json");
@@ -1228,571 +755,6 @@ function mergeOxlintExtends(cwd, presetPath) {
   writeFileSync(abs, JSON.stringify(merged, null, indent) + (raw.endsWith("\n") ? "\n" : ""));
   return "added";
 }
-const KEPT_FILE_COST = {
-  ".oxlintrc.json": "the shipped oxlint preset (the basalt/* design rules AND the jsx-a11y / import / promise / unicorn plugins) is NOT active \u2014 nothing else turns it on, and every gate stays green without it. Re-run with `--merge-lint` to splice the extends in, or add it by hand.",
-  "lefthook.yml": "the pre-commit oxlint / oxfmt / check-theme jobs are not wired \u2014 add `extends: [<preset>]` to your own file.",
-  ".github/workflows/check.yml": "CI does not run check-theme or the sync drift gate \u2014 copy those steps into your own workflow.",
-  ".oxfmtrc.json": "your existing formatter config stands; basalt formats nothing on its own.",
-  "DESIGN.md": "the design brief Claude reads is yours, not the seeded one."
-};
-function init(cwd = process.cwd(), scaffoldFlags = {}) {
-  const install = findBasaltInstall(cwd);
-  if (install.dir === null) {
-    console.error(
-      `\u26A0 basalt-ui init: basalt-ui does not resolve from ${cwd} or any directory above it \u2014 the seeded \`extends\` paths and CI steps are being written against the repo root by assumption. Install basalt-ui here (or at the repo root) and re-run \`basalt-ui init\` so they resolve.`
-    );
-  }
-  const rootsState = reconcileRoots(cwd, { write: true });
-  const ctx = renderContext(cwd);
-  const lintScript = `oxlint . && ${ctx.vars.BASALT_BIN} check-theme`;
-  const seededLintScript = patchPackageJson(cwd, (pkg) => {
-    const scripts = pkg["scripts"] ?? {};
-    if (scripts["lint:basalt"] !== void 0) return false;
-    pkg["scripts"] = { ...scripts, "lint:basalt": lintScript };
-    return true;
-  });
-  const manifest = readManifest(cwd);
-  migrateLegacyOxfmt(cwd, ctx.pkgRoot, manifest);
-  const peers = resolvePeerFlags(cwd, scaffoldFlags);
-  const placement = resolvePlacement(cwd);
-  const files = managedFiles(peers, placement);
-  const writtenFiles = [];
-  const keptFiles = [];
-  const missingSources = [];
-  for (const file of files) {
-    const state = unitState(file, cwd, ctx);
-    if (state.desired === null) {
-      missingSources.push(file.source);
-      continue;
-    }
-    const destExists = existsSync(resolve(cwd, file.dest));
-    if (!file.markers && destExists) {
-      manifest.files[file.dest] = sha256(normalizeForLedger(state.desired));
-      keptFiles.push(file.dest);
-      continue;
-    }
-    const hash = writeUnit(file, cwd, state.desired);
-    manifest.files[file.dest] = hash;
-    writtenFiles.push(file.dest);
-  }
-  const pruned = pruneRetiredManagedFiles(cwd, manifest, files);
-  const mergeLint = scaffoldFlags.mergeLint === true ? mergeOxlintExtends(cwd, ctx.vars.OXLINT_PRESET_PATH) : null;
-  manifest.basaltVersion = ctx.vars.BASALT_VERSION;
-  manifest.spacingScale = { ...deriveSpacing(0).scale };
-  writeFileEnsuringDir(resolve(cwd, MANIFEST_PATH), `${JSON.stringify(manifest, null, 2)}
-`);
-  console.log(
-    `basalt-ui init: ${writtenFiles.length} written, ${keptFiles.length} kept, manifest at ${MANIFEST_PATH}`
-  );
-  reportPrune(pruned);
-  if (missingSources.length > 0) {
-    console.log(
-      `basalt-ui init: ${missingSources.length} shipped asset(s) not present, skipped: ${missingSources.join(", ")}`
-    );
-  }
-  if (keptFiles.length > 0) {
-    console.log(`
-Kept (already present \u2014 basalt did not touch them):`);
-    for (const dest of keptFiles) {
-      const cost = KEPT_FILE_COST[dest];
-      console.log(cost === void 0 ? `  \xB7 ${dest}` : `  \xB7 ${dest} \u2014 ${cost}`);
-    }
-  }
-  if (mergeLint !== null) {
-    const mergeMessage = {
-      added: `spliced "${ctx.vars.OXLINT_PRESET_PATH}" into the existing .oxlintrc.json extends`,
-      already: ".oxlintrc.json already extends the shipped preset \u2014 nothing to do",
-      absent: "no existing .oxlintrc.json to merge into (the seeded one already extends the preset)",
-      unreadable: ".oxlintrc.json is not valid JSON \u2014 merge the extends entry by hand",
-      "has-comments": `.oxlintrc.json carries comments; rewriting it would delete them (usually the reason each rule is off). Add "extends": ["${ctx.vars.OXLINT_PRESET_PATH}"] as the first entry by hand.`
-    };
-    console.log(`basalt-ui init: --merge-lint \u2014 ${mergeMessage[mergeLint]}`);
-  }
-  const rootsMessages = rootsNotices(rootsState);
-  for (const line of rootsMessages.log) console.log(`basalt-ui init: ${line}`);
-  for (const line of rootsMessages.error) console.error(`\u26A0 basalt-ui init: ${line}`);
-  if (seededLintScript) {
-    console.log(`basalt-ui init: added the "lint:basalt" script (${lintScript}) to package.json.`);
-  }
-  if (!placement.isPackageRepoRoot) {
-    console.log(
-      `basalt-ui init: skipped lefthook.yml (this package is not the repo root \u2014 repo root detected at ${placement.repoRoot}) \u2014 lefthook only reads config at the repo root; extend ${ctx.vars.LEFTHOOK_PRESET_PATH} from your root lefthook.yml instead, and give its check-theme command \`env: { BASALT_CWD: ${relativePosix(placement.repoRoot, cwd)} }\` so the guard runs where your basalt config actually lives.`
-    );
-    console.log(
-      `basalt-ui init: skipped .github/workflows/check.yml (this package is not the repo root \u2014 repo root detected at ${placement.repoRoot}) \u2014 GitHub Actions only reads .github/ at the repo root; copy the steps from ${shippedAssetPath(install, placement.repoRoot, "configs/check.yml")} into your root CI workflow instead.`
-    );
-  }
-  if (placement.relocatedQueryClient !== null) {
-    console.log(
-      `basalt-ui init: skipped src/query-client.ts (found an existing query client at ${relative(cwd, placement.relocatedQueryClient)}) \u2014 import it from there instead of re-seeding at the original path.`
-    );
-  }
-  if (!peers.hasQuery) {
-    console.log(
-      "basalt-ui init: skipped src/query-client.ts (no @tanstack/react-query dependency detected) \u2014 install it, or re-run with --with-query, to scaffold it."
-    );
-  }
-  if (!peers.hasRouter || !peers.hasQuery) {
-    console.log(
-      "basalt-ui init: skipped src/routes/__root.tsx (needs both @tanstack/react-router and @tanstack/react-query) \u2014 install both, or re-run with --with-router --with-query, to scaffold it."
-    );
-  }
-  console.log(
-    `
-Theme guard hook: add to .claude/settings.json \u2192 hooks.PreToolUse to catch violations before they land:
-  "hooks": {
-    "PreToolUse": [
-      {
-        "matcher": "Write|Edit|MultiEdit",
-        "hooks": [{ "type": "command", "command": "${ctx.vars.BASALT_BIN} guard-hook" }]
-      }
-    ]
-  }`
-  );
-  const presetPlugins = readOxlintPresetPlugins(ctx.pkgRoot);
-  if (presetPlugins.length > 0) {
-    console.log(
-      `
-Lint debt: adopting the shipped oxlint preset on an EXISTING app is not a no-op \u2014 it turns on ${presetPlugins.length} plugins (${presetPlugins.join(", ")}) plus the basalt/* design rules, on code never linted against them. Run \`oxlint .\` now and triage the count before your next commit; turn a rule off in your own .oxlintrc.json with a written reason rather than blanket-disabling a plugin.`
-    );
-  }
-  console.log(
-    "Activate the hooks: `lefthook install` \u2014 the seeded lefthook.yml is inert until the git hooks are written, and looks configured either way."
-  );
-  console.log(
-    `
-First run: run \`${ctx.vars.BASALT_BIN} check-theme\` next (or \`bun run lint:basalt\`), then tune the per-rule \`basalt.*\` config keys in package.json for anything that fires \u2014 do not mass-\`theme-allow\` findings. Then \`basalt-ui doctor\` to confirm the wiring actually took.`
-  );
-  return 0;
-}
-function readOxlintPresetPlugins(pkgRoot) {
-  const raw = readSource(pkgRoot, "configs/oxlint.json");
-  if (raw === null) return [];
-  try {
-    const plugins = JSON.parse(raw).plugins;
-    return isStringArray(plugins) ? plugins : [];
-  } catch {
-    return [];
-  }
-}
-function parentInstallAdvice(cwd, parent, verb) {
-  return `This repo's install is at ${relativePosix(cwd, parent)} (${parent}) \u2014 run ${verb} there, or set BASALT_CWD to it.`;
-}
-function findManifestAbove(dir) {
-  let current = resolve(dir, "..");
-  for (; ; ) {
-    if (existsSync(resolve(current, MANIFEST_PATH))) return current;
-    const parent = resolve(current, "..");
-    if (parent === current) return null;
-    current = parent;
-  }
-}
-function sync(opts = {}, invocationCwd = process.cwd()) {
-  const syncFlags = opts.flags ?? [];
-  if (conflictingProfileFlags(syncFlags)) {
-    console.error("basalt-ui sync: --tokens-only and --framework are alternatives \u2014 pass one.");
-    return 1;
-  }
-  const project = resolveProjectDir(invocationCwd);
-  if (project.ambiguous !== null) {
-    console.error(
-      `\u2716 basalt-ui sync: no basalt config at ${invocationCwd}, and ${project.ambiguous.length} packages below it carry one (${project.ambiguous.map((d) => relativePosix(invocationCwd, d)).join(", ")}) \u2014 run it from one of them, or set BASALT_CWD to pick.`
-    );
-    return 1;
-  }
-  const cwd = project.dir;
-  if (project.relocatedFrom !== null) {
-    console.log(
-      `basalt-ui sync: no basalt config at ${project.relocatedFrom} \u2014 running in ${relativePosix(project.relocatedFrom, cwd)}, where it lives.`
-    );
-  }
-  if (declaredProfile(readBasaltConfig(cwd), syncFlags) === "tokens-only") {
-    console.log(
-      `basalt-ui sync: ${MANIFEST_PATH}: n/a \u2014 a tokens-only consumer has no scaffold to reconcile. The token layer is refreshed by re-running \`basalt-ui tokens:css\`, and \`tokens:css --check\` is its drift gate. Pass --framework to force the full profile.`
-    );
-    return 0;
-  }
-  if (!existsSync(resolve(cwd, MANIFEST_PATH))) {
-    const elsewhere = findManifestAbove(cwd);
-    const wouldWrite = managedFiles(resolvePeerFlags(cwd, {}), resolvePlacement(cwd)).length;
-    console.error(
-      `\u2716 basalt-ui sync: no ${MANIFEST_PATH} at ${cwd} \u2014 refusing to scaffold. \`sync\` refreshes an EXISTING basalt install; creating one is \`basalt-ui init\`'s decision, and continuing here would write ${wouldWrite} managed file(s) into this directory.` + (elsewhere === null ? " No manifest exists at any ancestor either \u2014 run `basalt-ui init` here if this package really is meant to be a consumer." : ` ${parentInstallAdvice(cwd, elsewhere, "sync")}`)
-    );
-    return 1;
-  }
-  const rootsState = reconcileRoots(cwd, { write: opts.check !== true });
-  const ctx = renderContext(cwd);
-  const manifest = readManifest(cwd);
-  if (!opts.check) {
-    migrateLegacyOxfmt(cwd, ctx.pkgRoot, manifest);
-    migrateDesignVersionLine(cwd);
-  }
-  const peers = resolvePeerFlags(cwd, {});
-  const placement = resolvePlacement(cwd);
-  const files = managedFiles(peers, placement);
-  let updated = 0;
-  let created = 0;
-  let recreated = 0;
-  let skippedDrift = 0;
-  let staleForCheck = 0;
-  const driftLines = [];
-  const missingSources = [];
-  for (const file of files) {
-    const state = unitState(file, cwd, ctx);
-    if (state.desired === null) {
-      missingSources.push(file.source);
-      continue;
-    }
-    const tracked = manifest.files[file.dest] !== void 0;
-    if (file.mode === "seed") {
-      if (state.current === null && !opts.check) {
-        manifest.files[file.dest] = writeUnit(file, cwd, state.desired);
-        if (tracked) recreated++;
-        else created++;
-      }
-      continue;
-    }
-    const kind = classify(state, manifest.files[file.dest]);
-    if (kind === "current") {
-      manifest.files[file.dest] = sha256(normalizeForLedger(state.desired));
-      continue;
-    }
-    if (kind === "drifted" && !opts.force) {
-      driftLines.push(diffSummary(file, state));
-      staleForCheck++;
-      skippedDrift++;
-      continue;
-    }
-    staleForCheck++;
-    if (opts.check) continue;
-    manifest.files[file.dest] = writeUnit(file, cwd, state.desired);
-    if (kind !== "missing") updated++;
-    else if (tracked) recreated++;
-    else created++;
-  }
-  const pruned = pruneRetiredManagedFiles(cwd, manifest, files, {
-    dryRun: opts.check === true,
-    force: opts.force === true
-  });
-  staleForCheck += pruned.removed.length + pruned.drifted.length;
-  if (!placement.isPackageRepoRoot) {
-    console.log(
-      `basalt-ui sync: skipped lefthook.yml (this package is not the repo root \u2014 repo root detected at ${placement.repoRoot}) \u2014 lefthook only reads config at the repo root; extend node_modules/basalt-ui/configs/lefthook.yml from your root lefthook.yml instead.`
-    );
-    console.log(
-      `basalt-ui sync: skipped .github/workflows/check.yml (this package is not the repo root \u2014 repo root detected at ${placement.repoRoot}) \u2014 GitHub Actions only reads .github/ at the repo root; extend node_modules/basalt-ui/configs/check.yml from your root CI workflow instead.`
-    );
-  }
-  if (placement.relocatedQueryClient !== null) {
-    console.log(
-      `basalt-ui sync: skipped src/query-client.ts (found an existing query client at ${relative(cwd, placement.relocatedQueryClient)}) \u2014 import it from there instead of re-seeding at the original path.`
-    );
-  }
-  const rootsMessages = rootsNotices(rootsState);
-  for (const line of rootsMessages.log) console.log(`basalt-ui sync: ${line}`);
-  for (const line of rootsMessages.error) console.error(`\u26A0 basalt-ui sync: ${line}`);
-  const install = findBasaltInstall(cwd);
-  const lefthookSeam = inspectLefthookSeam(placement.repoRoot);
-  if (lefthookSeam.kind === "broken") {
-    console.error(
-      `\u26A0 basalt-ui sync: ${lefthookSeam.file} extends "${lefthookSeam.entry}", which does not exist \u2014 lefthook merges a missing extends target into ZERO commands and still exits 0, so there is no pre-commit gate. Repoint it at "${shippedAssetPath(install, placement.repoRoot, "configs/lefthook.yml")}".`
-    );
-  }
-  const oxlintrcRaw = readIfExists(resolve(cwd, ".oxlintrc.json"));
-  const oxlintEntry = oxlintrcRaw === null ? null : basaltPresetEntry(parseJsonc(oxlintrcRaw)?.["extends"]);
-  if (oxlintEntry !== null && !existsSync(resolve(cwd, oxlintEntry))) {
-    console.error(
-      `\u26A0 basalt-ui sync: .oxlintrc.json extends "${oxlintEntry}", which does not exist \u2014 oxlint refuses to start on a missing extends target (\`NotFound\`). Repoint it at "${shippedAssetPath(install, cwd, "configs/oxlint.json")}".`
-    );
-  }
-  if (opts.check) {
-    if (driftLines.length > 0) {
-      console.error("basalt-ui sync --check: locally-drifted managed files:");
-      for (const l of driftLines) console.error(l);
-    }
-    const retired = [...pruned.removed, ...pruned.drifted];
-    if (retired.length > 0) {
-      console.error(
-        `basalt-ui sync --check: ${retired.length} retired rule/skill file(s) still present: ${retired.join(", ")} \u2014 run \`basalt-ui sync\`.`
-      );
-    }
-    if (staleForCheck > 0) {
-      console.error(`basalt-ui sync --check: ${staleForCheck} managed file(s) out of date.`);
-      return 1;
-    }
-    console.log("\u2713 basalt-ui sync --check: all managed files current.");
-    return 0;
-  }
-  manifest.basaltVersion = ctx.vars.BASALT_VERSION;
-  manifest.spacingScale = { ...deriveSpacing(0).scale };
-  writeFileEnsuringDir(resolve(cwd, MANIFEST_PATH), `${JSON.stringify(manifest, null, 2)}
-`);
-  console.log(
-    `basalt-ui sync: ${updated} updated, ${created} created, ${recreated} recreated, ${skippedDrift} skipped (drift), ${pruned.removed.length} retired.`
-  );
-  reportPrune(pruned);
-  if (driftLines.length > 0) {
-    console.log("Locally-edited files were skipped (run with --force to overwrite):");
-    for (const l of driftLines) console.log(l);
-  }
-  if (missingSources.length > 0) {
-    console.log(
-      `basalt-ui sync: ${missingSources.length} shipped asset(s) not present, skipped: ${missingSources.join(", ")}`
-    );
-  }
-  return 0;
-}
-const COVERAGE_BLOCK_OPEN = "<!-- basalt:coverage -->";
-const COVERAGE_BLOCK_CLOSE = "<!-- /basalt:coverage -->";
-const COVERAGE_BLOCK_RE = /<!-- basalt:coverage -->[\s\S]*?<!-- \/basalt:coverage -->/;
-function coverageFor(rule) {
-  const specs = Object.values(SURFACES).filter(
-    (s) => s.kind === "doctrine" && s.rule === rule
-  );
-  const unique = (values) => [...new Set(values)].toSorted();
-  return {
-    guardKinds: unique(specs.flatMap((s) => [...s.guardKinds])),
-    pluginRules: unique(specs.flatMap((s) => [...s.pluginRules])),
-    // NOT sorted, and not deduped across surfaces by content: an advisory law is a sentence, and
-    // its order is the order the spec argues it in.
-    advisoryLaws: specs.flatMap((s) => [...s.advisoryLaws ?? []])
-  };
-}
-function coverageBlock(rule) {
-  const { guardKinds, pluginRules, advisoryLaws } = coverageFor(rule);
-  const backedBy = [
-    guardKinds.length > 0 ? `guard kinds \u2014 ${guardKinds.join(", ")}` : "guard kinds \u2014 none",
-    pluginRules.length > 0 ? `oxlint rules \u2014 ${pluginRules.map((id) => `basalt/${id}`).join(", ")}` : "oxlint rules \u2014 none"
-  ].join(" \xB7 ");
-  const lines = [
-    COVERAGE_BLOCK_OPEN,
-    "<!-- GENERATED from src/surfaces.ts \u2014 `basalt-ui check-coverage --write`. Do not hand-edit. -->",
-    `<!-- backed by: ${backedBy} -->`
-  ];
-  if (advisoryLaws.length === 0) lines.push("<!-- not guarded: \u2014 -->");
-  else for (const law of advisoryLaws) lines.push(`<!-- not guarded: ${law} -->`);
-  lines.push(COVERAGE_BLOCK_CLOSE);
-  return lines.join("\n");
-}
-function readCoverageBlock(text) {
-  return COVERAGE_BLOCK_RE.exec(text)?.[0] ?? null;
-}
-function applyCoverageBlock(text, block) {
-  if (COVERAGE_BLOCK_RE.test(text)) return text.replace(COVERAGE_BLOCK_RE, block);
-  const frontmatter = /^---\n[\s\S]*?\n---\n/.exec(text);
-  if (frontmatter === null) return `${block}
-
-${text}`;
-  const end = frontmatter[0].length;
-  return `${text.slice(0, end)}
-${block}
-${text.slice(end)}`;
-}
-function reconcileCoverageBlocks(pkgRoot, mode) {
-  const failures = [];
-  const notes = [];
-  for (const rule of RULE_NAMES) {
-    const rel = `agent/rules/basalt-${rule}.md`;
-    const path = resolve(pkgRoot, rel);
-    if (!existsSync(path)) continue;
-    const text = readFileSync(path, "utf8");
-    const current = readCoverageBlock(text);
-    const expected = coverageBlock(rule);
-    if (mode === "check") {
-      if (current === null) notes.push(`${rel}: no <!-- basalt:coverage --> block yet`);
-      else if (current !== expected) {
-        failures.push(
-          `${rel}: coverage block is out of sync with SURFACES (check-coverage --write)`
-        );
-      }
-      continue;
-    }
-    if (current === expected) {
-      notes.push(`${rel}: unchanged`);
-      continue;
-    }
-    writeFileSync(path, applyCoverageBlock(text, expected), "utf8");
-    notes.push(`${rel}: ${current === null ? "block inserted" : "block updated"}`);
-  }
-  return { failures, notes };
-}
-const AGENT_LINE_BUDGETS = {
-  "agent/rules/basalt-tokens.md": 160,
-  "agent/rules/basalt-mantine.md": 180,
-  "agent/rules/basalt-charts.md": 140,
-  "agent/rules/basalt-state.md": 160,
-  "agent/rules/basalt-controls.md": 160,
-  "agent/rules/basalt-batteries.md": 220,
-  "agent/skills/basalt-app/SKILL.md": 100,
-  "agent/skills/basalt-design/SKILL.md": 100,
-  "agent/skills/basalt-charts/SKILL.md": 100,
-  "agent/templates/CLAUDE-block.md.tpl": 40,
-  "agent/templates/DESIGN.md.tpl": 45
-};
-const AGENT_RULE_TOTAL_BUDGET = 1050;
-function checkCoverage(flags = []) {
-  const pkgRoot = packageRoot();
-  const failures = [];
-  const notes = [];
-  const allSpecs = Object.entries(SURFACES);
-  const doctrineSpecs = Object.values(SURFACES).filter(
-    (s) => s.kind === "doctrine"
-  );
-  const validGuardKinds = new Set(Object.keys(GUARD_RULES));
-  for (const [key, spec] of allSpecs) {
-    if (spec.kind !== "doctrine") continue;
-    for (const kind of spec.guardKinds) {
-      if (!validGuardKinds.has(kind)) {
-        failures.push(
-          `SURFACES['${key}'].guardKinds includes '${kind}' which is not in GUARD_RULES`
-        );
-      }
-    }
-  }
-  for (const rule of RULE_NAMES) {
-    const rulePath = resolve(pkgRoot, `agent/rules/basalt-${rule}.md`);
-    if (!existsSync(rulePath)) {
-      failures.push(
-        `Missing rule file: agent/rules/basalt-${rule}.md (derived from SURFACES doctrine rules)`
-      );
-    }
-  }
-  for (const skill of SKILL_NAMES) {
-    const skillPath = resolve(pkgRoot, `agent/skills/${skill}/SKILL.md`);
-    if (!existsSync(skillPath)) {
-      failures.push(
-        `Missing skill file: agent/skills/${skill}/SKILL.md (derived from SURFACES doctrine skills)`
-      );
-    }
-  }
-  let pkgExports = /* @__PURE__ */ new Set();
-  try {
-    const consumerPkgPath = resolve(pkgRoot, "package.json");
-    const consumerPkg = JSON.parse(readFileSync(consumerPkgPath, "utf8"));
-    pkgExports = new Set(Object.keys(consumerPkg.exports ?? {}));
-  } catch {
-    failures.push(`Cannot read package.json at ${pkgRoot}`);
-  }
-  for (const key of Object.keys(SURFACES)) {
-    if (key.startsWith("#") || key === ".") continue;
-    if (!pkgExports.has(key)) {
-      failures.push(
-        `SURFACES key '${key}' is a JS subpath but has no entry in package.json exports`
-      );
-    }
-  }
-  for (const exportKey of pkgExports) {
-    if (exportKey === "." || exportKey === "./styles.css" || exportKey.startsWith("./configs/"))
-      continue;
-    if (!Object.hasOwn(SURFACES, exportKey)) {
-      failures.push(`package.json exports key '${exportKey}' has no matching SURFACES entry`);
-    }
-  }
-  for (const [key, spec] of allSpecs) {
-    if (spec.forbiddenImports.length === 0) continue;
-    if (!("globs" in spec) || spec.globs === void 0) {
-      failures.push(
-        `SURFACES['${key}'] has non-empty forbiddenImports but no globs field (required for oxlint emission)`
-      );
-    }
-  }
-  const REQUIRED_MANTINE_BANS = ["@mantine/core", "@mantine/hooks", "@mantine/*"];
-  for (const [key, spec] of allSpecs) {
-    if (spec.layer !== "headless") continue;
-    if (TOKEN_LAYER_BOUNDARY_SURFACES.has(key)) continue;
-    for (const required of REQUIRED_MANTINE_BANS) {
-      const hasBan = spec.forbiddenImports.some((fi) => fi.spec === required);
-      if (!hasBan) {
-        failures.push(
-          `SURFACES['${key}'] is headless but missing Mantine ban for '${required}' in forbiddenImports`
-        );
-      }
-    }
-  }
-  let peerDependencies = {};
-  let peerDependenciesMeta = {};
-  try {
-    const frameworkPkg = JSON.parse(readFileSync(resolve(pkgRoot, "package.json"), "utf8"));
-    peerDependencies = frameworkPkg.peerDependencies ?? {};
-    peerDependenciesMeta = frameworkPkg.peerDependenciesMeta ?? {};
-  } catch {
-    failures.push(`Cannot read package.json peerDependencies at ${pkgRoot}`);
-  }
-  for (const spec of doctrineSpecs) {
-    for (const peer of spec.optionalPeers ?? []) {
-      if (!(peer in peerDependencies)) {
-        failures.push(
-          `SURFACES doctrine optionalPeer '${peer}' is not listed in package.json peerDependencies`
-        );
-      }
-      if (peerDependenciesMeta[peer]?.optional !== true) {
-        failures.push(
-          `SURFACES doctrine optionalPeer '${peer}' is not marked optional in package.json peerDependenciesMeta`
-        );
-      }
-    }
-  }
-  const surfacesPerPluginRule = /* @__PURE__ */ new Map();
-  for (const [key, spec] of allSpecs) {
-    if (spec.kind !== "doctrine") continue;
-    for (const id of spec.pluginRules) {
-      surfacesPerPluginRule.set(id, [...surfacesPerPluginRule.get(id) ?? [], key]);
-    }
-  }
-  for (const id of PLUGIN_RULE_ID_LIST) {
-    const owners = surfacesPerPluginRule.get(id) ?? [];
-    if (owners.length === 1) continue;
-    failures.push(
-      owners.length === 0 ? `Plugin rule 'basalt/${id}' maps to no surface \u2014 add it to one surface's pluginRules` : `Plugin rule 'basalt/${id}' maps to ${owners.length} surfaces (${owners.join(", ")}) \u2014 exactly one`
-    );
-  }
-  for (const [rel, budget] of Object.entries(AGENT_LINE_BUDGETS)) {
-    const abs = resolve(pkgRoot, rel);
-    if (!existsSync(abs)) continue;
-    const lines = readFileSync(abs, "utf8").split("\n").length - 1;
-    if (lines > budget) failures.push(`${rel}: ${lines} lines exceeds its ${budget}-line budget`);
-  }
-  const ruleTotal = RULE_NAMES.reduce((sum, rule) => {
-    const abs = resolve(pkgRoot, `agent/rules/basalt-${rule}.md`);
-    return existsSync(abs) ? sum + readFileSync(abs, "utf8").split("\n").length - 1 : sum;
-  }, 0);
-  if (ruleTotal > AGENT_RULE_TOTAL_BUDGET) {
-    failures.push(
-      `agent/rules/*.md: ${ruleTotal} lines total exceeds the ${AGENT_RULE_TOTAL_BUDGET}-line budget`
-    );
-  }
-  const surfacedGuardKinds = /* @__PURE__ */ new Set();
-  for (const spec of doctrineSpecs) {
-    for (const kind of spec.guardKinds) surfacedGuardKinds.add(kind);
-  }
-  for (const kind of Object.keys(GUARD_RULES)) {
-    if (surfacedGuardKinds.has(kind)) continue;
-    failures.push(
-      `Guard kind '${kind}' maps to no surface \u2014 add it to one surface's guardKinds so the generated coverage headers name it`
-    );
-  }
-  const write = flags.includes("--write");
-  const check = flags.includes("--check");
-  if (write && check) {
-    failures.push("--write and --check are alternatives; pass one");
-  } else if (write || check) {
-    const result = reconcileCoverageBlocks(pkgRoot, write ? "write" : "check");
-    failures.push(...result.failures);
-    notes.push(...result.notes);
-  }
-  for (const note of notes) {
-    console.log(`  ${note}`);
-  }
-  if (failures.length === 0) {
-    console.log("\u2713 check-coverage: all 11 assertions pass.");
-    return 0;
-  }
-  console.error(`\u2716 check-coverage: ${failures.length} failure(s)`);
-  for (const f of failures) {
-    console.error(`  ${f}`);
-  }
-  return 1;
-}
 function subdirNames(base, options = {}) {
   let entries;
   try {
@@ -1865,817 +827,6 @@ function collectWorkspacePackages(cwd) {
 function isStringArray(value) {
   return Array.isArray(value) && value.every((entry) => typeof entry === "string");
 }
-function majorOf(range) {
-  if (typeof range !== "string") return null;
-  const match = range.match(/\d+/);
-  return match === null ? null : Number(match[0]);
-}
-function aiMajorAt(dir) {
-  const raw = readIfExists(resolve(dir, "package.json"));
-  if (raw === null) return null;
-  try {
-    const pkg = JSON.parse(raw);
-    return majorOf(
-      pkg.dependencies?.["ai"] ?? pkg.devDependencies?.["ai"] ?? pkg.peerDependencies?.["ai"]
-    );
-  } catch {
-    return null;
-  }
-}
-function resolveAiMajorSkewReason(cfg) {
-  const raw = cfg.aiMajorSkewReason;
-  if (raw === void 0) return { reason: null, presentButInvalid: false };
-  if (typeof raw === "string" && raw.trim().length > 0) {
-    return { reason: raw, presentButInvalid: false };
-  }
-  return { reason: null, presentButInvalid: true };
-}
-function doctor(invocationCwd = process.cwd(), flags = []) {
-  if (conflictingProfileFlags(flags)) {
-    console.error("basalt-ui doctor: --tokens-only and --framework are alternatives \u2014 pass one.");
-    return 1;
-  }
-  const project = resolveProjectDir(invocationCwd);
-  if (project.ambiguous !== null) {
-    console.error(
-      `
-basalt-ui doctor \u2014 ${invocationCwd}
-
-  \u2716 no basalt config at ${invocationCwd}, and ${project.ambiguous.length} packages below it carry one (${project.ambiguous.map((d) => relativePosix(invocationCwd, d)).join(", ")}) \u2014 run doctor from one of them, or set BASALT_CWD to pick.
-
-1 hard failure(s), 0 warning(s).
-`
-    );
-    return 1;
-  }
-  const cwd = project.dir;
-  const cfg = readBasaltConfig(cwd);
-  const result = { hardFailures: 0, warnings: 0, skipped: 0 };
-  const lines = [`
-basalt-ui doctor \u2014 ${cwd}
-`];
-  function pass(msg) {
-    lines.push(`  \u2713 ${msg}`);
-  }
-  function warn(msg) {
-    lines.push(`  \u26A0 ${msg}`);
-    result.warnings++;
-  }
-  function skip(msg) {
-    lines.push(`  \u2298 SKIPPED \u2014 ${msg}`);
-    result.skipped++;
-  }
-  function fail(msg) {
-    lines.push(`  \u2716 ${msg}`);
-    result.hardFailures++;
-  }
-  if (project.relocatedFrom !== null) {
-    lines.push(
-      `  \u2192 no basalt config at ${project.relocatedFrom} \u2014 reporting on ${relativePosix(project.relocatedFrom, cwd)}, where it lives.
-`
-    );
-  }
-  const manifestAbs = resolve(cwd, MANIFEST_PATH);
-  const manifestExists = existsSync(manifestAbs);
-  const parentInstall = manifestExists ? null : findManifestAbove(cwd);
-  const profile = inferredProfile(cwd, cfg, flags);
-  if (profile === "tokens-only") {
-    lines.push(
-      "  profile: tokens-only \u2014 checking the token layer only. The scaffold checks below are not\n  applicable; `basalt-ui init` is NOT the fix here, it places a Mantine doctrine you have no\n  use for. Pass --framework to force the full profile.\n"
-    );
-    if (cfg.profile === void 0) {
-      lines.push(
-        '  \u2192 inferred (no .basalt/manifest.json and no @mantine/core in this workspace). Write it\n    down as "basalt": { "profile": "tokens-only" } in package.json \u2014 check-theme does not\n    infer it, so today it still reports the Mantine-only kinds against this repo.\n'
-      );
-    }
-  }
-  if (profile === "tokens-only") {
-    pass(`${MANIFEST_PATH}: n/a \u2014 a tokens-only consumer has no scaffold to reconcile`);
-  } else if (manifestExists) {
-    pass(`${MANIFEST_PATH} exists`);
-  } else if (parentInstall !== null) {
-    fail(
-      `${MANIFEST_PATH} missing here, but this is not an unscaffolded consumer. ${parentInstallAdvice(cwd, parentInstall, "doctor")} \`basalt-ui init\` is NOT the fix: it would scaffold a SECOND consumer beside the real one.`
-    );
-  } else {
-    fail(`${MANIFEST_PATH} missing \u2014 run \`basalt-ui init\` to scaffold the consumer repo`);
-  }
-  const install = findBasaltInstall(cwd);
-  const installedVersion = install.version;
-  if (install.dir === null) {
-    fail(
-      `basalt-ui does not resolve from ${cwd}, any directory above it, or any workspace package \u2014 so every version check below is unrunnable, \`extends: [<preset>]\` cannot resolve, and \`bunx basalt-ui\` will silently fetch a DIFFERENT copy from npm instead of your pinned one. Add basalt-ui as a dependency here (or at the repo root) and re-run.`
-    );
-  } else if (install.how === "cwd") {
-    pass(
-      `basalt-ui resolves at ./node_modules/basalt-ui (${installedVersion ?? "unknown version"})`
-    );
-  } else {
-    pass(
-      `basalt-ui resolves at ${relativePosix(cwd, install.dir)} (${installedVersion ?? "unknown version"}, found via the ${install.how}) \u2014 seeded \`extends\` paths and CI steps must use that path, not ./node_modules/basalt-ui.`
-    );
-  }
-  if (profile === "framework" && manifestExists && installedVersion === null) {
-    skip(
-      "installed-vs-manifest version \u2014 basalt-ui did not resolve, so there is nothing to compare"
-    );
-  }
-  if (manifestExists && installedVersion !== null) {
-    const manifestVersion = readManifest(cwd).basaltVersion;
-    if (manifestVersion === void 0) {
-      warn(
-        `${MANIFEST_PATH} records no basaltVersion (written by an older basalt-ui) \u2014 run \`basalt-ui sync\` to refresh the doctrine and stamp the manifest.`
-      );
-    } else if (manifestVersion !== installedVersion) {
-      warn(
-        `installed basalt-ui (${installedVersion}) differs from the version that last synced (${manifestVersion}) \u2014 the placed doctrine is stale; run \`basalt-ui sync\`.`
-      );
-    } else {
-      pass(`installed basalt-ui (${installedVersion}) matches the manifest's basaltVersion`);
-    }
-  }
-  const cliVersion = readFrameworkVersion(packageRoot());
-  const cliIsTheInstall = installedVersion === null || installedVersion === cliVersion;
-  if (profile === "tokens-only") {
-    pass("spacing scale: n/a \u2014 a tokens-only consumer renders no basalt Mantine theme");
-  } else if (!manifestExists) {
-    skip(
-      `spacing scale \u2014 no ${MANIFEST_PATH} records the scale this app last synced with, so there is nothing to compare against`
-    );
-  } else if (!cliIsTheInstall) {
-    pass(
-      `spacing scale not compared \u2014 this CLI (${cliVersion}) is not the installed basalt-ui (${installedVersion}), so its scale is not the one the app renders with`
-    );
-  } else {
-    const recorded = readManifest(cwd).spacingScale;
-    const current = deriveSpacing(0).scale;
-    if (recorded === void 0) {
-      pass("spacing scale not yet recorded \u2014 `basalt-ui sync` will stamp it");
-    } else {
-      const steps = [.../* @__PURE__ */ new Set([...Object.keys(current), ...Object.keys(recorded)])].toSorted();
-      const moved = steps.filter((step) => recorded[step] !== current[step]).map((step) => `${step} ${recorded[step] ?? "(none)"}\u2192${current[step] ?? "(removed)"}`);
-      if (moved.length > 0) {
-        warn(
-          `the spacing scale moved since the last sync (${moved.join(", ")}) \u2014 every surface in an app calling createBasaltTheme() bare shifts with it. Review the app visually, then run \`basalt-ui sync\` to record the new scale.`
-        );
-      } else {
-        pass("spacing scale matches the last sync");
-      }
-    }
-  }
-  if (installedVersion === null) {
-    skip("CLI-vs-installed version \u2014 basalt-ui did not resolve, so there is no installed version");
-  } else if (installedVersion !== cliVersion) {
-    warn(
-      `running CLI version (${cliVersion}) differs from the installed basalt-ui version at ${install.dir === null ? "node_modules" : relativePosix(cwd, install.dir)} (${installedVersion}) \u2014 likely a stale \`bunx basalt-ui\` fetch from npm; run the local bin (\`node_modules/.bin/basalt-ui\`, or a package.json script) so the pinned copy is the one that runs.`
-    );
-  } else {
-    pass(`CLI version (${cliVersion}) matches the installed basalt-ui`);
-  }
-  if (profile === "tokens-only") {
-    pass("guard-scan: n/a \u2014 the theme guard is a Mantine-app check");
-  } else {
-    const scanned = scannableFiles(cwd, cfg);
-    if (scanned.length === 0) {
-      fail(
-        `guard-scan: check-theme would scan 0 files \u2014 the roots (${resolveRoots(cfg).join(", ")}) match nothing under ${cwd}, so the palette guard is a no-op that still exits green in every gate that does not run it. Set "basalt": { "roots": [...] } in package.json.`
-      );
-    } else {
-      pass(
-        `guard-scan: check-theme covers ${scanned.length} file(s) under ${resolveRoots(cfg).join(", ")}`
-      );
-    }
-  }
-  if (profile === "tokens-only") {
-    pass("oxlint-preset: n/a \u2014 the shipped preset is a Mantine/React preset");
-  } else {
-    const oxlintrcRaw = readIfExists(resolve(cwd, ".oxlintrc.json"));
-    if (oxlintrcRaw === null) {
-      fail(
-        ".oxlintrc.json missing \u2014 the shipped oxlint preset (the basalt/* design rules) is not active. " + (parentInstall === null ? "Run `basalt-ui init` to seed it." : `${parentInstallAdvice(cwd, parentInstall, "doctor")} The preset is seeded once, at the install \u2014 not per package.`)
-      );
-    } else {
-      const parsed = parseJsonc(oxlintrcRaw);
-      if (parsed === null) {
-        skip(
-          ".oxlintrc.json does not parse as JSON/JSONC \u2014 cannot tell whether it extends the preset"
-        );
-      } else {
-        const entry = basaltPresetEntry(parsed["extends"]);
-        const correct = shippedAssetPath(install, cwd, "configs/oxlint.json");
-        if (entry === null) {
-          fail(
-            `.oxlintrc.json does NOT extend the shipped preset \u2014 every basalt/* design rule is off and oxlint reports green without them. Add "extends": ["${correct}"], or re-run \`basalt-ui init --merge-lint\` to splice it in.`
-          );
-        } else if (!existsSync(resolve(cwd, entry)) && entry === correct && install.dir !== null) {
-          fail(
-            `.oxlintrc.json extends "${entry}", which does not exist (${resolve(cwd, entry)}) \u2014 basalt-ui resolves there but ships no \`configs/oxlint.json\` at that path, so oxlint refuses to start (\`NotFound\`) and nothing is linted. Reinstall basalt-ui.`
-          );
-        } else if (!existsSync(resolve(cwd, entry))) {
-          fail(
-            `.oxlintrc.json extends "${entry}", which does not exist (${resolve(cwd, entry)}) \u2014 oxlint refuses to start on a missing extends target (\`NotFound\`), so nothing is linted at all. Repoint it at "${correct}", where basalt-ui actually resolves.`
-          );
-        } else {
-          pass(`.oxlintrc.json extends the shipped basalt-ui oxlint preset (${entry})`);
-        }
-      }
-    }
-  }
-  const repoRoot = findRepoRoot(cwd);
-  const lefthookGate = profile === "tokens-only" ? { kind: "n/a" } : inspectLefthookGate(repoRoot);
-  const lefthookCorrect = shippedAssetPath(install, repoRoot, "configs/lefthook.yml");
-  if (lefthookGate.kind === "n/a") {
-    pass("lefthook-preset: n/a \u2014 a tokens-only consumer wires its own hooks");
-  } else if (lefthookGate.kind === "no-file") {
-    pass(`lefthook-preset: n/a \u2014 no lefthook config at ${repoRoot}`);
-  } else if (lefthookGate.kind === "extends-ok") {
-    pass(`${lefthookGate.file} extends the shipped lefthook preset (${lefthookGate.entry})`);
-  } else if (lefthookGate.kind === "wired") {
-    pass(
-      `lefthook-preset: ${lefthookGate.file} does not extend the shipped preset, but a pre-commit command runs check-theme directly \u2014 the gate exists (read from ` + (lefthookGate.proof === "dump" ? "`lefthook dump`, so extends/include/root: are all resolved)." : "the config text; `lefthook dump` was not runnable here, so an `include:` or a remote config was not consulted).")
-    );
-  } else if (lefthookGate.kind === "extends-broken") {
-    fail(
-      `${lefthookGate.file} extends "${lefthookGate.entry}", which does not exist (${resolve(repoRoot, lefthookGate.entry)}) \u2014 lefthook merges a missing extends target into ZERO commands and still exits 0, so this repo has no pre-commit gate and \`lefthook dump\` looks clean. Repoint it at "${lefthookCorrect}".`
-    );
-  } else if (lefthookGate.kind === "absent") {
-    warn(
-      `${lefthookGate.file}: \`lefthook dump\` resolves the merged config and NO pre-commit command runs check-theme \u2014 the theme guard is not gating commits. Either add "extends: [${lefthookCorrect}]", or add your own command running \`${basaltBinCommand(install, cwd)} check-theme\` (with \`root:\` if it must run in a subdirectory).`
-    );
-  } else {
-    warn(
-      `${lefthookGate.file} names no basalt gate and \`lefthook dump\` could not be run here, so this check cannot tell a missing gate from one wired through an \`include:\` or a remote config it never read \u2014 treat it as advisory. If the guard really is unwired, add "extends: [${lefthookCorrect}]" or your own command running \`${basaltBinCommand(install, cwd)} check-theme\`.`
-    );
-  }
-  if (profile === "framework") {
-    const appDir = findAppPluginDir(cwd, cfg);
-    const iconsIn = appDir ?? cwd;
-    const icons = readAppIconsOption(iconsIn);
-    const here = appDir === null || appDir === cwd ? "" : `${relativePosix(cwd, appDir)}/`;
-    const publicDir = resolve(iconsIn, "public");
-    if (appDir === null && !existsSync(publicDir)) {
-      pass("app icons: no `basaltAppPlugin(` under this project and no public/ \u2014 nothing to check");
-    } else if (icons.kind === "none") {
-      pass("basaltAppPlugin is configured with no icons \u2014 nothing to check");
-    } else if (!existsSync(publicDir)) {
-      skip(
-        `app icons \u2014 ${here === "" ? "this package" : here.replace(/\/$/, "")} configures basaltAppPlugin, but there is no \`public/\` beside its vite config, so the files it references cannot be located. Use Vite's public-dir convention, or set \`icons: false\` if this app ships none.`
-      );
-    } else if (icons.kind === "explicit") {
-      const missing = icons.sources.filter(
-        (src) => !existsSync(resolve(publicDir, src.replace(/^\//, "")))
-      );
-      if (missing.length > 0) {
-        warn(
-          `basaltAppPlugin declares icon(s) that are not in ${here}public/: ${missing.join(", ")} \u2014 the manifest and the head links will point at a 404. Place them, or drop them from the \`icons\` array.`
-        );
-      } else {
-        pass(
-          `${here}public/ has all ${icons.sources.length} icon file(s) basaltAppPlugin's \`icons\` option names`
-        );
-      }
-    } else {
-      const dir = icons.kind === "default" ? icons.dir : null;
-      const iconRoot = dir === null ? publicDir : resolve(publicDir, dir.replace(/^\//, ""));
-      const shown = dir === null ? `${here}public/` : `${here}public/${dir.replace(/^\//, "")}`;
-      const missingIcons = DEFAULT_APP_ICON_FILES.filter((f) => !existsSync(resolve(iconRoot, f)));
-      if (missingIcons.length > 0) {
-        warn(
-          `${shown} is missing basaltAppPlugin icon file(s): ${missingIcons.join(", ")} \u2014 generate them (e.g. via realfavicongenerator.net) and place them at the ${shown} root, or name the icons this app really has via the plugin's \`icons\` array.`
-        );
-      } else {
-        pass(`${shown} has all of basaltAppPlugin's default icon files`);
-      }
-    }
-  }
-  const workspaceWalk = collectWorkspacePackages(cwd);
-  const aiMajors = workspaceWalk.packages.map((pkg) => ({ name: pkg.name, major: aiMajorAt(pkg.dir) })).filter((entry) => entry.major !== null);
-  const { reason: aiMajorSkewReason, presentButInvalid: aiMajorSkewReasonInvalid } = resolveAiMajorSkewReason(cfg);
-  if (aiMajors.length > 0) {
-    const distinctMajors = new Set(aiMajors.map((entry) => entry.major));
-    if (distinctMajors.size > 1) {
-      const summary = aiMajors.map((entry) => `${entry.name}@ai${entry.major}`).join(", ");
-      if (aiMajorSkewReason !== null) {
-        pass(
-          `ai package major version mismatch across workspace packages: ${summary} \u2014 exempted via basalt.aiMajorSkewReason: "${aiMajorSkewReason}"`
-        );
-      } else if (aiMajorSkewReasonInvalid) {
-        fail(
-          `ai package major version mismatch across workspace packages: ${summary} \u2014 basalt.aiMajorSkewReason is present but is not a non-empty string (a bare \`true\` is not accepted); the exemption must carry a written reason, e.g. \`aiMajorSkewReason: "apps/api on ai@5, apps/dashboard on ai@7, neutralized by a producer-side TransformStream"\`.`
-        );
-      } else {
-        fail(`ai package major version mismatch across workspace packages: ${summary}`);
-      }
-    } else {
-      const [major] = distinctMajors;
-      if (aiMajorSkewReason !== null) {
-        warn(
-          `basalt.aiMajorSkewReason ("${aiMajorSkewReason}") is declared but the ai package major already matches across all ${aiMajors.length} workspace package(s) declaring it (ai@${major}) \u2014 the exemption is no longer needed and can be deleted.`
-        );
-      } else {
-        pass(
-          `ai package major matches across ${aiMajors.length} workspace package(s) declaring it (ai@${major})`
-        );
-      }
-    }
-  } else if (workspaceWalk.hasWorkspacesField) {
-    pass("ai-major-parity: no workspace package declares the ai dependency \u2014 nothing to compare");
-  }
-  lines.push("");
-  if (result.hardFailures === 0 && result.warnings === 0 && result.skipped === 0) {
-    lines.push("All checks passed.");
-  } else {
-    const parts = [];
-    if (result.hardFailures > 0) parts.push(`${result.hardFailures} hard failure(s)`);
-    if (result.skipped > 0) parts.push(`${result.skipped} check(s) SKIPPED (could not run)`);
-    parts.push(`${result.warnings} warning(s)`);
-    lines.push(`${parts.join(", ")}.`);
-  }
-  lines.push("");
-  if (result.hardFailures > 0 || result.skipped > 0) {
-    console.error(lines.join("\n"));
-    return 1;
-  }
-  console.log(lines.join("\n"));
-  return 0;
-}
-function info(flags) {
-  const pkgRoot = packageRoot();
-  let pkgName = "basalt-ui";
-  let pkgVersion = "0.0.0";
-  let peerDeps = {};
-  let peerMeta = {};
-  let pkgExports = {};
-  try {
-    const pkg = JSON.parse(readFileSync(resolve(pkgRoot, "package.json"), "utf8"));
-    pkgName = pkg.name ?? pkgName;
-    pkgVersion = pkg.version ?? pkgVersion;
-    peerDeps = pkg.peerDependencies ?? {};
-    peerMeta = pkg.peerDependenciesMeta ?? {};
-    pkgExports = pkg.exports ?? {};
-  } catch {
-  }
-  const optionalPeerSet = new Set(
-    Object.entries(peerMeta).filter(([, m]) => m.optional === true).map(([name]) => name)
-  );
-  const publishedExportKeys = new Set(Object.keys(pkgExports));
-  const subpaths = [];
-  for (const [key, spec] of Object.entries(SURFACES)) {
-    if (key.startsWith("#")) continue;
-    if (!publishedExportKeys.has(key)) continue;
-    const docSpec = spec.kind === "doctrine" ? spec : null;
-    const specPeers = docSpec !== null && "optionalPeers" in docSpec && Array.isArray(docSpec.optionalPeers) ? docSpec.optionalPeers : [];
-    const optionalPeers = specPeers.filter((p) => optionalPeerSet.has(p) && p in peerDeps).map((p) => `${p}@${peerDeps[p]}`);
-    subpaths.push({
-      path: `basalt-ui${key === "." ? "" : key.slice(1)}`,
-      description: spec.description ?? `basalt-ui${key === "." ? "" : key} subpath`,
-      layer: spec.layer,
-      rule: docSpec?.rule ?? null,
-      skills: docSpec?.skill ?? [],
-      optionalPeers
-    });
-  }
-  const output = { name: pkgName, version: pkgVersion, subpaths };
-  if (flags.includes("--json")) {
-    console.log(JSON.stringify(output, null, 2));
-    return 0;
-  }
-  console.log(`
-basalt-ui v${pkgVersion} \u2014 published surface
-`);
-  const COL = { path: 32, layer: 18, rule: 18, skills: 36 };
-  const header = [
-    "SUBPATH".padEnd(COL.path),
-    "LAYER".padEnd(COL.layer),
-    "RULE".padEnd(COL.rule),
-    "SKILLS".padEnd(COL.skills),
-    "OPTIONAL PEERS"
-  ].join("  ");
-  console.log(header);
-  console.log("-".repeat(header.length));
-  for (const row of output.subpaths) {
-    const line = [
-      row.path.padEnd(COL.path),
-      row.layer.padEnd(COL.layer),
-      (row.rule ?? "\u2014").padEnd(COL.rule),
-      (row.skills.join(", ") || "\u2014").padEnd(COL.skills),
-      row.optionalPeers.join(", ") || "\u2014"
-    ].join("  ");
-    console.log(line);
-  }
-  console.log("");
-  return 0;
-}
-const DEFAULT_APP_ICON_FILES = [
-  "favicon.ico",
-  "favicon.svg",
-  "favicon-96x96.png",
-  "apple-touch-icon.png",
-  "web-app-manifest-192x192.png",
-  "web-app-manifest-512x512.png"
-];
-const VITE_CONFIG_FILES = [
-  "vite.config.ts",
-  "vite.config.mts",
-  "vite.config.cts",
-  "vite.config.js",
-  "vite.config.mjs",
-  "vite.config.cjs"
-];
-function findAppPluginDir(cwd, cfg) {
-  const seen = /* @__PURE__ */ new Set();
-  const candidates = [];
-  const add = (dir) => {
-    if (seen.has(dir)) return;
-    seen.add(dir);
-    candidates.push(dir);
-  };
-  add(cwd);
-  for (const root of resolveRoots(cfg)) {
-    let current = resolve(cwd, root);
-    while (current !== cwd && !relative(cwd, current).startsWith("..")) {
-      add(current);
-      const parent = dirname(current);
-      if (parent === current) break;
-      current = parent;
-    }
-  }
-  for (const dir of candidates) {
-    const configPath = VITE_CONFIG_FILES.map((f) => resolve(dir, f)).find((f) => existsSync(f));
-    if (configPath === void 0) continue;
-    if (readIfExists(configPath)?.includes("basaltAppPlugin(") === true) return dir;
-  }
-  return null;
-}
-function balancedSpan(text, open) {
-  const pairs = { "(": ")", "{": "}", "[": "]" };
-  const closer = pairs[text[open]];
-  if (closer === void 0) return null;
-  let depth = 0;
-  for (let i = open; i < text.length; i++) {
-    const ch = text[i];
-    if (ch === text[open]) depth++;
-    else if (ch === closer) {
-      depth--;
-      if (depth === 0) return text.slice(open, i + 1);
-    }
-  }
-  return null;
-}
-function readAppIconsOption(cwd) {
-  const configPath = VITE_CONFIG_FILES.map((f) => resolve(cwd, f)).find((f) => existsSync(f));
-  if (configPath === void 0) return { kind: "unknown" };
-  const text = readIfExists(configPath);
-  if (text === null) return { kind: "unknown" };
-  const call = text.indexOf("basaltAppPlugin(");
-  if (call === -1) return { kind: "unknown" };
-  const args = balancedSpan(text, call + "basaltAppPlugin".length);
-  if (args === null) return { kind: "unknown" };
-  const key = args.search(/\bicons\s*:/);
-  if (key === -1) return { kind: "default", dir: null };
-  const valueStart = args.indexOf(":", key) + 1;
-  const rest = args.slice(valueStart).trimStart();
-  if (rest.startsWith("false")) return { kind: "none" };
-  const offset = args.length - rest.length;
-  if (rest.startsWith("[")) {
-    const list = balancedSpan(args, offset);
-    if (list === null) return { kind: "unknown" };
-    const sources = [...list.matchAll(/\bsrc\s*:\s*['"`]([^'"`]+)['"`]/g)].map(
-      (m) => m[1]
-    );
-    return sources.length === 0 ? { kind: "none" } : { kind: "explicit", sources };
-  }
-  if (rest.startsWith("{")) {
-    const obj = balancedSpan(args, offset);
-    if (obj === null) return { kind: "unknown" };
-    const dir = /\bdir\s*:\s*['"`]([^'"`]+)['"`]/.exec(obj);
-    return { kind: "default", dir: dir === null ? null : dir[1] };
-  }
-  return { kind: "unknown" };
-}
-function flagValue(flags, name) {
-  const i = flags.indexOf(name);
-  if (i === -1) return void 0;
-  const value = flags[i + 1];
-  return value === void 0 || value.startsWith("--") ? void 0 : value;
-}
-function generatedHeader(version, command, flags) {
-  const shown = flags.filter((f) => f !== "--check");
-  const invocation = shown.length === 0 ? command : `${command} ${shown.join(" ")}`;
-  return `${GENERATED_HEADER_LINE}
-/* basalt-ui ${version} \u2014 \`basalt-ui ${invocation}\` */
-`;
-}
-const PROVENANCE_VERSION = /^(\/\* basalt-ui )(\d+\.\d+\.\d+\S*)( — `basalt-ui (?:tokens:css|fonts:css)[^`]*` \*\/)$/;
-function provenanceVersion(css) {
-  const match = PROVENANCE_VERSION.exec(css.split("\n")[1] ?? "");
-  return match === null ? null : match[2];
-}
-function withoutProvenanceVersion(css) {
-  const lines = css.split("\n");
-  const line = lines[1];
-  if (line === void 0) return css;
-  const match = PROVENANCE_VERSION.exec(line);
-  if (match === null) return css;
-  lines[1] = `${match[1]}<version>${match[3]}`;
-  return lines.join("\n");
-}
-function versionTriple(version) {
-  const match = /^(\d+)\.(\d+)\.(\d+)/.exec(version);
-  return match === null ? null : [Number(match[1]), Number(match[2]), Number(match[3])];
-}
-function describeVersionSkew(onDisk, current) {
-  const a = versionTriple(onDisk);
-  const b = versionTriple(current);
-  if (a === null || b === null) return "a different";
-  for (let i = 0; i < 3; i++) {
-    const left = a[i];
-    const right = b[i];
-    if (left < right) return "an older";
-    if (left > right) return "a newer";
-  }
-  return "a different";
-}
-function normalizeColorFunctions(css) {
-  return css.replace(/\b(rgba?|hsla?)\(([^()]*)\)/g, (_match, fn, args) => {
-    const parts = args.split(",").map((part) => normalizeCssNumber(part.trim()));
-    return `${fn}(${parts.join(", ")})`;
-  });
-}
-function normalizeCssNumber(arg) {
-  if (!/^\d+\.\d+$/.test(arg)) return arg;
-  return arg.replace(/\.?0+$/, "");
-}
-const SCHEME_CLASS_SENTINEL = "data-basalt-scheme-class";
-function emitGeneratedCss(content, flags, cwd, command) {
-  const out = flagValue(flags, "--out");
-  const check = flags.includes("--check");
-  if (out === void 0) {
-    if (check) {
-      console.error(
-        `${command}: --check needs --out <path> \u2014 there is nothing to compare stdout to.`
-      );
-      return 1;
-    }
-    process.stdout.write(content);
-    return 0;
-  }
-  const target = isAbsolute(out) ? out : resolve(cwd, out);
-  const shown = relative(cwd, target) || target;
-  if (check) {
-    const onDisk = readIfExists(target);
-    if (onDisk === null) {
-      console.error(
-        `\u2716 ${command} --check: ${shown} does not exist \u2014 run without --check to write it.`
-      );
-      return 1;
-    }
-    if (withoutProvenanceVersion(onDisk) === withoutProvenanceVersion(content)) {
-      const diskVersion = provenanceVersion(onDisk);
-      const currentVersion = provenanceVersion(content);
-      const skew = diskVersion !== null && currentVersion !== null && diskVersion !== currentVersion ? ` (Its provenance line names basalt-ui ${diskVersion}, ${describeVersionSkew(diskVersion, currentVersion)} release than the ${currentVersion} that just ran \u2014 only that version token is excluded from the comparison. Re-run without --check whenever you want it refreshed.)` : "";
-      console.log(`\u2713 ${command} --check: ${shown} is up to date.${skew}`);
-      return 0;
-    }
-    const diskLines = onDisk.split("\n");
-    const wantLines = content.split("\n");
-    const provenanceOnly = diskLines.length === wantLines.length && diskLines.every((line, i) => i === 1 || line === wantLines[i]) && diskLines[1] !== wantLines[1];
-    if (provenanceOnly) {
-      console.error(
-        `\u2716 ${command} --check: ${shown}'s \`@generated\` provenance line does not match the command that produced this content \u2014 the token values agree, line 2 does not.
-  on disk: ${diskLines[1]}
-  emitted: ${wantLines[1]}
-Line 1 tells the reader to regenerate with line 2, so line 2 is gated: run the emitted invocation without --check and commit the result, or change the flags this check runs with to the ones the file was really built from. Only the version token is exempt.`
-      );
-      return 1;
-    }
-    console.error(
-      `\u2716 ${command} --check: ${shown} differs from what \`basalt-ui ${command}\` emits today (on disk ${diskLines.length} lines, emitted ${wantLines.length}) \u2014 re-run the same command without --check and commit the result. Only the \`@generated\` provenance line's VERSION token is excluded from this comparison, so a release alone never trips it \u2014 but its flags do.`
-    );
-    return 1;
-  }
-  mkdirSync(dirname(target), { recursive: true });
-  writeFileSync(target, content);
-  console.log(`wrote ${content.split("\n").length} lines \u2192 ${shown}`);
-  return 0;
-}
-function tokensCss(flags, cwd = process.cwd()) {
-  const attribute = flagValue(flags, "--selector-attribute");
-  const schemeClass = flagValue(flags, "--selector-class");
-  const lightClass = flagValue(flags, "--light-class");
-  const darkValue = flagValue(flags, "--dark-value");
-  const lightValue = flagValue(flags, "--light-value");
-  const defaultScheme = flagValue(flags, "--default-scheme");
-  const only = flagValue(flags, "--only");
-  if (defaultScheme !== void 0 && !["dark", "light", "none"].includes(defaultScheme)) {
-    console.error(
-      `tokens:css: --default-scheme must be dark, light or none (got '${defaultScheme}')`
-    );
-    return 1;
-  }
-  if (only !== void 0 && !["core", "all"].includes(only)) {
-    console.error(`tokens:css: --only must be core or all (got '${only}')`);
-    return 1;
-  }
-  if (schemeClass !== void 0 && attribute !== void 0) {
-    console.error(
-      "tokens:css: --selector-class and --selector-attribute are alternatives \u2014 pass one."
-    );
-    return 1;
-  }
-  if (schemeClass !== void 0 && /[^\w-]/.test(schemeClass)) {
-    console.error(
-      `tokens:css: --selector-class must be a plain CSS class name (got '${schemeClass}')`
-    );
-    return 1;
-  }
-  if (lightClass !== void 0 && /[^\w-]/.test(lightClass)) {
-    console.error(`tokens:css: --light-class must be a plain CSS class name (got '${lightClass}')`);
-    return 1;
-  }
-  const resolvedDarkValue = schemeClass !== void 0 ? schemeClass : darkValue;
-  const resolvedLightValue = schemeClass !== void 0 ? lightClass ?? "light" : lightValue;
-  const resolvedAttribute = schemeClass !== void 0 ? SCHEME_CLASS_SENTINEL : attribute;
-  const scheme = {
-    ...resolvedAttribute === void 0 ? {} : { attribute: resolvedAttribute },
-    ...resolvedDarkValue === void 0 ? {} : { darkValue: resolvedDarkValue },
-    ...resolvedLightValue === void 0 ? {} : { lightValue: resolvedLightValue }
-  };
-  let css = buildPaletteCss({
-    ...Object.keys(scheme).length === 0 ? {} : { scheme },
-    ...defaultScheme === void 0 ? {} : { defaultScheme },
-    ...flags.includes("--media-fallback") ? { mediaFallback: true } : {},
-    ...only === void 0 ? {} : { only },
-    // The tokens-only consumer is exactly the one who writes these names by hand, so they are also
-    // the one who wants the deprecated camelCase aliases gone — and this command is their only
-    // entry point. Without the flag the CLI and the API could disagree about what basalt's tokens
-    // are, which is the one thing this command is documented never to allow.
-    ...flags.includes("--no-legacy-aliases") ? { legacyAliases: false } : {}
-  });
-  if (schemeClass !== void 0) {
-    css = css.replace(
-      new RegExp(`\\[${SCHEME_CLASS_SENTINEL}='([\\w-]+)'\\]`, "g"),
-      (_match, value) => `.${value}`
-    );
-  }
-  const version = readFrameworkVersion(packageRoot());
-  const content = `${generatedHeader(version, "tokens:css", flags)}${normalizeColorFunctions(css)}
-`;
-  return emitGeneratedCss(content, flags, cwd, "tokens:css");
-}
-function readShippedFontDecls(pkgRoot) {
-  const css = readSource(pkgRoot, "dist/styles.css") ?? readSource(pkgRoot, "src/styles.css");
-  if (css === null) return [];
-  const decls = [];
-  for (const match of css.matchAll(/(--basalt-font[\w-]*)\s*:\s*([^;]+);/g)) {
-    decls.push({
-      name: match[1],
-      value: match[2].replace(/\s+/g, " ").trim()
-    });
-  }
-  return decls;
-}
-function fontsCss(flags, cwd = process.cwd()) {
-  const pkgRoot = packageRoot();
-  const decls = readShippedFontDecls(pkgRoot);
-  if (decls.length === 0) {
-    console.error(
-      "fonts:css: could not read the shipped font stacks from styles.css \u2014 this is a packaging bug in basalt-ui, not a config error."
-    );
-    return 1;
-  }
-  const body = `:root {
-${decls.map((d) => `  ${d.name}: ${d.value};`).join("\n")}
-}
-`;
-  const header = generatedHeader(readFrameworkVersion(pkgRoot), "fonts:css", flags);
-  return emitGeneratedCss(`${header}${body}`, flags, cwd, "fonts:css");
-}
-async function guardHook(cwd = process.cwd()) {
-  let raw;
-  try {
-    if (typeof globalThis["Bun"] !== "undefined") {
-      raw = await globalThis["Bun"].stdin.text();
-    } else {
-      const chunks = [];
-      for await (const chunk of process.stdin) chunks.push(chunk);
-      raw = Buffer.concat(chunks).toString("utf8");
-    }
-  } catch {
-    process.stdout.write(
-      '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}\n'
-    );
-    return 0;
-  }
-  let payload;
-  try {
-    payload = JSON.parse(raw);
-  } catch {
-    process.stdout.write(
-      '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}\n'
-    );
-    return 0;
-  }
-  const cfg = readBasaltConfig(cwd);
-  const guardCfg = {
-    spacingSteps: cfg.spacingSteps ?? DEFAULT_GUARD_CONFIG.spacingSteps,
-    rawRadius: cfg.rawRadius ?? DEFAULT_GUARD_CONFIG.rawRadius,
-    forbiddenAccents: cfg.forbiddenAccents ?? DEFAULT_GUARD_CONFIG.forbiddenAccents,
-    mantineShadeIndex: cfg.mantineShadeIndex ?? DEFAULT_GUARD_CONFIG.mantineShadeIndex,
-    rawSurface: cfg.rawSurface ?? DEFAULT_GUARD_CONFIG.rawSurface,
-    cardWithBorder: cfg.cardWithBorder ?? DEFAULT_GUARD_CONFIG.cardWithBorder,
-    offSystemSurfaceVar: cfg.offSystemSurfaceVar ?? DEFAULT_GUARD_CONFIG.offSystemSurfaceVar,
-    rawHtmlLayout: cfg.rawHtmlLayout ?? DEFAULT_GUARD_CONFIG.rawHtmlLayout,
-    inlineSpacing: cfg.inlineSpacing ?? DEFAULT_GUARD_CONFIG.inlineSpacing,
-    inlineDisplay: cfg.inlineDisplay ?? DEFAULT_GUARD_CONFIG.inlineDisplay,
-    rawVisxAxis: cfg.rawVisxAxis ?? DEFAULT_GUARD_CONFIG.rawVisxAxis,
-    rawMotionValue: cfg.rawMotionValue ?? DEFAULT_GUARD_CONFIG.rawMotionValue,
-    unframedChart: cfg.unframedChart ?? DEFAULT_GUARD_CONFIG.unframedChart,
-    chartMissingAriaLabel: cfg.chartMissingAriaLabel ?? DEFAULT_GUARD_CONFIG.chartMissingAriaLabel,
-    rawFormControl: cfg.rawFormControl ?? DEFAULT_GUARD_CONFIG.rawFormControl,
-    sub16InputFont: cfg.sub16InputFont ?? DEFAULT_GUARD_CONFIG.sub16InputFont,
-    allowComment: "theme-allow",
-    exemptRules: resolveExemptRules(cfg),
-    severity: cfg.severity ?? DEFAULT_GUARD_CONFIG.severity,
-    // Same detection check-theme uses: the hook must never block an edit over advice the app
-    // cannot take ("use @mantine/core's Select") in a repo with no Mantine.
-    ...declaredProfile(cfg, []) === "tokens-only" ? { profile: "tokens-only" } : {}
-  };
-  const roots = cfg.roots ?? DEFAULT_ROOTS;
-  const exempt = new Set(cfg.exempt ?? defaultExempt(cfg));
-  const isInScope = (filePath) => {
-    const abs = isAbsolute(filePath) ? filePath : resolve(cwd, filePath);
-    const rel = relative(cwd, abs).replace(/\\/g, "/");
-    if (rel === "" || rel.startsWith("..")) return false;
-    if (SKIP.test(rel) || exempt.has(rel)) return false;
-    return roots.some((root) => {
-      const r = root.replace(/\\/g, "/").replace(/\/+$/, "");
-      return rel === r || rel.startsWith(`${r}/`);
-    });
-  };
-  const result = evaluateGuardHook(payload, guardCfg, { isInScope });
-  if (result.permissionDecision === "deny" && result.reason !== void 0) {
-    process.stdout.write(
-      JSON.stringify({
-        hookSpecificOutput: {
-          hookEventName: "PreToolUse",
-          permissionDecision: "deny",
-          permissionDecisionReason: result.reason
-        }
-      }) + "\n"
-    );
-  } else {
-    process.stdout.write(
-      '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}\n'
-    );
-  }
-  return 0;
-}
-const COMMAND_FLAGS = {
-  init: ["--with-router", "--with-query", "--merge-lint"],
-  sync: ["--force", "--check", "--tokens-only", "--framework"],
-  "check-theme": ["--audit-allows", "--tokens-only", "--framework"],
-  "check-coverage": ["--write", "--check"],
-  info: ["--json"],
-  doctor: ["--tokens-only", "--framework"],
-  "guard-hook": [],
-  "tokens:css": [
-    "--out",
-    "--check",
-    "--selector-attribute",
-    "--selector-class",
-    "--light-class",
-    "--dark-value",
-    "--light-value",
-    "--default-scheme",
-    "--media-fallback",
-    "--only",
-    "--no-legacy-aliases"
-  ],
-  "fonts:css": ["--out", "--check"]
-};
-const VALUE_FLAGS = /* @__PURE__ */ new Set([
-  "--out",
-  "--selector-attribute",
-  "--selector-class",
-  "--light-class",
-  "--dark-value",
-  "--light-value",
-  "--default-scheme",
-  "--only"
-]);
-function unknownFlag(cmd, flags) {
-  const allowed = COMMAND_FLAGS[cmd];
-  if (allowed === void 0) return null;
-  for (let i = 0; i < flags.length; i++) {
-    const flag = flags[i];
-    if (!flag.startsWith("-")) continue;
-    if (!allowed.includes(flag)) return flag;
-    if (VALUE_FLAGS.has(flag)) i++;
-  }
-  return null;
-}
-const USAGE = "Usage: basalt-ui <--version | init [--with-router] [--with-query] [--merge-lint] |\n                  sync [--force] [--check] [--tokens-only|--framework] |\n                  check-theme [--audit-allows] | check-coverage [--write|--check] |\n                  info [--json] |\n                  doctor [--tokens-only|--framework] | guard-hook | tokens:css | fonts:css | help>\n\ncheck-theme [--tokens-only|--framework] [--audit-allows]\n  --audit-allows reports instead of scanning: every `theme-allow` annotation and every\n  `basalt.exemptRules` entry, with what each one still suppresses \u2014 proved by re-running the\n  guard with that one waiver neutralized, not by reading its text. Exits 1 on a waiver that\n  suppresses nothing (dead), which is what makes it usable as a CI gate.\n\ntokens:css [--out <path>] [--check] [--selector-attribute <attr> | --selector-class <class>]\n           [--light-class <class>] [--dark-value <v>] [--light-value <v>]\n           [--default-scheme <dark|light|none>] [--media-fallback] [--only <core|all>]\n           [--no-legacy-aliases]\n  Emit the --vx-* stylesheet (stdout unless --out). Defaults reproduce basalt-ui/tokens.css.\n  --selector-class emits `:root.dark` instead of an attribute selector (the Tailwind convention).\n  --check writes nothing and exits 1 when --out differs from what would be emitted (a CI gate).\n  --no-legacy-aliases drops the deprecated camelCase spellings (--vx-accentFill and friends),\n  which are emitted by default as aliases of the canonical kebab-case names.\n\nfonts:css [--out <path>] [--check]\n  Emit the shipped --basalt-font-* stacks as plain CSS \u2014 the typeface half of the token layer,\n  otherwise reachable only by importing styles.css.\n\ndoctor [--tokens-only|--framework]\n  Auto-detects a tokens-only consumer (no manifest + no @mantine/core) and checks only what\n  applies. A check that cannot RUN is reported as SKIPPED and exits non-zero.\n\nsync [--force] [--check] [--tokens-only|--framework]\n  Refreshes an EXISTING install; it never creates one (that is init). A tokens-only consumer\n  has no scaffold to reconcile, so sync reports n/a and exits 0 there \u2014 as doctor does.\n\ncheck-theme / doctor / sync all resolve their project the same way: they honour BASALT_CWD, and\nrelocate to the single package below the cwd carrying a basalt config when invoked from a repo\nroot that has none \u2014 several carrying one is ambiguous and exits 1 in ALL THREE.\n--tokens-only and --framework are alternatives; passing both is an error.\n\nEvery subcommand accepts --help / -h to print this message and exit without running.\n--version / -v prints the resolved package version and exits 0 \u2014 the one command that proves\nWHICH basalt-ui ran, which a `bunx` cache can otherwise make a lie. An unknown command or an\nunrecognized flag exits 1 and names what it did not understand; neither is ever ignored.";
 function run(argv, cwd = process.cwd()) {
   const [cmd, ...flags] = argv;
   if (cmd === "help" || cmd === "--help" || cmd === "-h" || flags.includes("--help") || flags.includes("-h")) {
@@ -2689,8 +840,9 @@ function run(argv, cwd = process.cwd()) {
   if (cmd !== void 0) {
     const bad = unknownFlag(cmd, flags);
     if (bad !== null) {
+      const accepted = Object.keys(COMMAND_OPTIONS[cmd] ?? {}).map((k) => `--${k}`);
       console.error(
-        `basalt-ui ${cmd}: unrecognized flag '${bad}'. Accepted: ${(COMMAND_FLAGS[cmd] ?? []).join(" ") || "(none)"} --help
+        `basalt-ui ${cmd}: unrecognized flag '${bad}'. Accepted: ${accepted.join(" ") || "(none)"} --help
 `
       );
       return 1;
@@ -2710,10 +862,6 @@ function run(argv, cwd = process.cwd()) {
       );
     case "check-theme":
       return checkTheme(cwd, flags);
-    case "check-coverage":
-      return checkCoverage(flags);
-    case "info":
-      return info(flags);
     case "doctor":
       return doctor(cwd, flags);
     case "guard-hook":
@@ -2732,28 +880,64 @@ function run(argv, cwd = process.cwd()) {
   }
 }
 export {
-  COVERAGE_BLOCK_CLOSE,
-  COVERAGE_BLOCK_OPEN,
+  DEFAULT_ROOT,
+  DEFAULT_ROOTS,
   MANIFEST_PATH,
+  ROOT_PLACEMENT,
   RULE_NAMES,
+  SERIES_MODULE_HINT_RE,
   SKILL_NAMES,
-  applyCoverageBlock,
-  checkCoverage,
+  SKIP,
+  basaltBinCommand,
+  basaltPresetEntry,
   checkTheme,
-  coverageBlock,
-  coverageFor,
+  classify,
+  conflictingProfileFlags,
+  declaredProfile,
+  defaultExempt,
+  diffSummary,
   doctor,
+  exemptRulePaths,
+  exemptRuleReason,
+  findBasaltInstall,
+  findRepoRoot,
   fontsCss,
   guardHook,
-  info,
   init,
+  inspectLefthookGate,
+  isStringArray,
   managedFiles,
+  mergeOxlintExtends,
   normalizeColorFunctions,
   normalizeForLedger,
-  readCoverageBlock,
-  reconcileCoverageBlocks,
+  packageRoot,
+  parseJsonc,
+  patchPackageJson,
+  pruneRetiredManagedFiles,
+  readBasaltConfig,
+  readFrameworkVersion,
+  readIfExists,
+  readManifest,
+  readSource,
+  reconcileRoots,
+  relativePosix,
+  renderContext,
+  reportPrune,
+  resolveExemptRules,
+  resolvePeerFlags,
+  resolvePlacement,
+  resolveProjectDir,
+  resolveRoots,
   retiredManagedDests,
+  rootsNotices,
   run,
+  scannableFiles,
+  sha256,
+  shippedAssetPath,
   sync,
-  tokensCss
+  tokensCss,
+  unitState,
+  waiverHintFor,
+  writeFileEnsuringDir,
+  writeUnit
 };