cascivo 0.7.1 → 0.7.2

package/dist/{config-C6GdrbvF.mjs → config-D7ddWN_9.mjs}

@@ -25,6 +25,7 @@ var config_exports = /* @__PURE__ */ __exportAll({
 	installHint: () => installHint,
 	isPackageManager: () => isPackageManager,
 	loadConfig: () => loadConfig,
+	pinSpecifier: () => pinSpecifier,
 	resolveConfig: () => resolveConfig
 });
 /**
@@ -152,12 +153,34 @@ function detectPackageManager(cwd = process.cwd(), opts = {}) {
 	}
 	return "npm";
 }
+/**
+* Pin every `@cascivo/*` package to an explicit version specifier.
+*
+* A bare name lets the package manager reuse whatever it already has resolvable. In a pnpm
+* workspace a sibling package's lockfile entry won and `@cascivo/i18n` resolved to **0.2.14**
+* while latest was **0.16.0** — then cascivo warned the adopter about the version it had
+* just installed itself. `add name@latest` (or the registry's known floor) makes the intent
+* explicit instead of leaving it to resolution order.
+*
+* Non-cascivo packages (`@preact/signals-react`) keep their bare name: their version is the
+* app's business, and cascivo has no floor to assert.
+*/
+function pinSpecifier(pkg, floors = {}) {
+	if (!pkg.startsWith("@cascivo/") && pkg !== "cascivo") return pkg;
+	if (pkg.includes("@", 1)) return pkg;
+	const floor = floors[pkg];
+	if (floor?.startsWith(">=")) return `${pkg}@${floor.slice(2)} - x`;
+	return `${pkg}@latest`;
+}
 /** The install subcommand each package manager uses to add dependencies. */
 function installCommand(pm, packages, opts = {}) {
+	const verb = pm === "npm" ? "install" : "add";
+	const devFlag = opts.dev ? [pm === "npm" ? "--save-dev" : "-D"] : [];
+	const specs = packages.map((p) => opts.pin && (p.startsWith("@cascivo/") || p === "cascivo") ? `${p}@${opts.pin}` : pinSpecifier(p, opts.floors ?? {}));
 	return [pm, [
-		pm === "npm" ? "install" : "add",
-		...opts.dev ? [pm === "npm" ? "--save-dev" : "-D"] : [],
-		...packages
+		verb,
+		...devFlag,
+		...specs
 	]];
 }
 /** Human-readable install command a user can copy-paste, e.g. `pnpm add -D cascivo`. */
@@ -168,4 +191,4 @@ function installHint(pm, packages, opts = {}) {
 //#endregion
 export { detectPackageManager as a, isPackageManager as c, config_exports as i, loadConfig as l, DEFAULT_CONFIG as n, installCommand as o, THEMES as r, installHint as s, CASCIVO_HOST as t, __exportAll as u };
 
-//# sourceMappingURL=config-C6GdrbvF.mjs.map
+//# sourceMappingURL=config-D7ddWN_9.mjs.map

package/dist/{config-C6GdrbvF.mjs.map → config-D7ddWN_9.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"config-C6GdrbvF.mjs","names":[],"sources":["../src/utils/config.ts"],"sourcesContent":["import { existsSync, readFileSync } from 'node:fs'\nimport { dirname, join } from 'node:path'\nimport { pathToFileURL } from 'node:url'\n\n/**\n * Canonical (and only) host for hosted cascivo artifacts (registry.json, per-item\n * r/<name>.json, marketplace.json, /llms/*, /context/*). The legacy docs.cascivo.com\n * subdomain is retired and 301s here. Keep in sync with CASCIVO_HOST in packages/mcp.\n */\nexport const CASCIVO_HOST = 'https://cascivo.com'\n\n/** All first-party themes shipped by @cascivo/themes (selectable via data-theme). */\nexport const THEMES = [\n  'light',\n  'dark',\n  'warm',\n  'flat',\n  'minimal',\n  'midnight',\n  'pastel',\n  'brutalist',\n  'corporate',\n  'terminal',\n  'cyberpunk',\n  'arcade',\n] as const\n\nexport type ThemeName = (typeof THEMES)[number]\n\nexport type RegistryNamespaceConfig =\n  | string\n  | { url: string; headers?: Record<string, string>; params?: Record<string, string> }\n\nexport interface CascadeConfig {\n  /** URL of the registry.json index. */\n  registry: string\n  /** Directory (relative to project root) where components are written. */\n  outputDir: string\n  /** Default theme imported by `cascade init`. */\n  theme: ThemeName\n  /** Namespace → registry URL template (with {name} placeholder) or auth config. */\n  registries?: Record<string, RegistryNamespaceConfig>\n  /** Whether to copy test files (*.contract.test.tsx) when adding components. */\n  tests?: boolean\n}\n\nexport const DEFAULT_CONFIG: CascadeConfig = {\n  // Canonical hosted registry index (served from the landing site, documented in\n  // llms.txt). Prefer this over a branch's GitHub raw URL, which 404s for\n  // unauthenticated/private-repo requests and breaks `cascivo list`/`add`.\n  registry: `${CASCIVO_HOST}/registry.json`,\n  outputDir: 'src/components/ui',\n  theme: 'light',\n}\n\nconst CONFIG_FILES = ['cascivo.config.ts', 'cascivo.config.js', 'cascivo.config.mjs']\n\n/** Apply defaults over a (possibly partial) user config object. */\nexport function resolveConfig(partial: Partial<CascadeConfig> | null | undefined): CascadeConfig {\n  return { ...DEFAULT_CONFIG, ...partial }\n}\n\n/** Let env vars override config — used by the MCP server to pass `outputDir`. */\nexport function applyEnvOverrides(\n  config: CascadeConfig,\n  env: NodeJS.ProcessEnv = process.env,\n): CascadeConfig {\n  return {\n    ...config,\n    ...(env.CASCIVO_REGISTRY ? { registry: env.CASCIVO_REGISTRY } : {}),\n    ...(env.CASCIVO_OUTPUT_DIR ? { outputDir: env.CASCIVO_OUTPUT_DIR } : {}),\n  }\n}\n\n/**\n * Locate and load `cascivo.config.{ts,js,mjs}` from `cwd`. Falls back to the\n * default config when no file is found or the file cannot be loaded. Env vars\n * (`CASCIVO_REGISTRY`, `CASCIVO_OUTPUT_DIR`) take precedence.\n */\nexport async function loadConfig(cwd: string = process.cwd()): Promise<CascadeConfig> {\n  for (const file of CONFIG_FILES) {\n    const path = join(cwd, file)\n    if (!existsSync(path)) continue\n    try {\n      const mod = (await import(pathToFileURL(path).href)) as {\n        default?: Partial<CascadeConfig>\n      }\n      return applyEnvOverrides(resolveConfig(mod.default ?? (mod as Partial<CascadeConfig>)))\n    } catch {\n      // Unloadable config (e.g. unsupported TS syntax) — fall back to defaults.\n      return applyEnvOverrides(resolveConfig(null))\n    }\n  }\n  return applyEnvOverrides(resolveConfig(null))\n}\n\nexport type PackageManager = 'pnpm' | 'yarn' | 'npm' | 'bun'\n\n/** Narrow an arbitrary string to a known PackageManager. */\nexport function isPackageManager(value: string | undefined): value is PackageManager {\n  return value === 'pnpm' || value === 'yarn' || value === 'npm' || value === 'bun'\n}\n\n/**\n * Lock files in probe order. `bun.lock` (bun ≥ 1.2 text lockfile) sits beside the\n * legacy binary `bun.lockb`; `package-lock.json` is npm's marker so a walk that\n * reaches an npm workspace root still resolves to npm rather than the default.\n */\nconst PM_LOCKFILES: readonly [string, PackageManager][] = [\n  ['pnpm-lock.yaml', 'pnpm'],\n  ['yarn.lock', 'yarn'],\n  ['bun.lockb', 'bun'],\n  ['bun.lock', 'bun'],\n  ['package-lock.json', 'npm'],\n]\n\n/** The package manager that invoked this process, from `npm_config_user_agent`. */\nfunction pmFromUserAgent(ua: string | undefined): PackageManager | undefined {\n  if (!ua) return undefined\n  const name = ua.split('/')[0]\n  return isPackageManager(name) ? name : undefined\n}\n\n/** The `packageManager` corepack field of a package.json, if it names a known PM. */\nfunction pmFromPackageJson(dir: string): PackageManager | undefined {\n  try {\n    const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')) as {\n      packageManager?: string\n    }\n    const name = pkg.packageManager?.split('@')[0]\n    return isPackageManager(name) ? name : undefined\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Detect the package manager in use. Precedence, highest first:\n *   1. explicit override (the `--package-manager`/`--pm` flag)\n *   2. `CASCIVO_PACKAGE_MANAGER` env var\n *   3. `npm_config_user_agent` (the PM that spawned the CLI, e.g. `pnpm dlx`)\n *   4. an upward walk from `cwd` for a lock file or `packageManager` field —\n *      this is what makes detection work inside a workspace, where the lock\n *      file lives at the repo root, not in the app subdirectory the user runs\n *      the CLI from. The walk stops after a directory containing `.git`.\n *   5. default `npm`.\n */\nexport function detectPackageManager(\n  cwd: string = process.cwd(),\n  opts: { override?: string; env?: NodeJS.ProcessEnv } = {},\n): PackageManager {\n  const env = opts.env ?? process.env\n\n  if (isPackageManager(opts.override)) return opts.override\n\n  const envPm = env.CASCIVO_PACKAGE_MANAGER\n  if (isPackageManager(envPm)) return envPm\n\n  const uaPm = pmFromUserAgent(env.npm_config_user_agent)\n  if (uaPm) return uaPm\n\n  let current = cwd\n  for (;;) {\n    for (const [file, pm] of PM_LOCKFILES) {\n      if (existsSync(join(current, file))) return pm\n    }\n    const fromField = pmFromPackageJson(current)\n    if (fromField) return fromField\n    // A `.git` directory marks the repo root — do not walk past it.\n    if (existsSync(join(current, '.git'))) break\n    const parent = dirname(current)\n    if (parent === current) break\n    current = parent\n  }\n\n  return 'npm'\n}\n\n/** The install subcommand each package manager uses to add dependencies. */\nexport function installCommand(\n  pm: PackageManager,\n  packages: string[],\n  opts: { dev?: boolean } = {},\n): [string, string[]] {\n  const verb = pm === 'npm' ? 'install' : 'add'\n  const devFlag = opts.dev ? [pm === 'npm' ? '--save-dev' : '-D'] : []\n  return [pm, [verb, ...devFlag, ...packages]]\n}\n\n/** Human-readable install command a user can copy-paste, e.g. `pnpm add -D cascivo`. */\nexport function installHint(\n  pm: PackageManager,\n  packages: string[],\n  opts: { dev?: boolean } = {},\n): string {\n  const [cmd, args] = installCommand(pm, packages, opts)\n  return `${cmd} ${args.join(' ')}`\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASA,MAAa,eAAe;;AAG5B,MAAa,SAAS;CACpB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAqBA,MAAa,iBAAgC;CAI3C,UAAU,GAAG,aAAa;CAC1B,WAAW;CACX,OAAO;AACT;AAEA,MAAM,eAAe;CAAC;CAAqB;CAAqB;AAAoB;;AAGpF,SAAgB,cAAc,SAAmE;CAC/F,OAAO;EAAE,GAAG;EAAgB,GAAG;CAAQ;AACzC;;AAGA,SAAgB,kBACd,QACA,MAAyB,QAAQ,KAClB;CACf,OAAO;EACL,GAAG;EACH,GAAI,IAAI,mBAAmB,EAAE,UAAU,IAAI,iBAAiB,IAAI,CAAC;EACjE,GAAI,IAAI,qBAAqB,EAAE,WAAW,IAAI,mBAAmB,IAAI,CAAC;CACxE;AACF;;;;;;AAOA,eAAsB,WAAW,MAAc,QAAQ,IAAI,GAA2B;CACpF,KAAK,MAAM,QAAQ,cAAc;EAC/B,MAAM,OAAO,KAAK,KAAK,IAAI;EAC3B,IAAI,CAAC,WAAW,IAAI,GAAG;EACvB,IAAI;GACF,MAAM,MAAO,MAAM,OAAO,cAAc,IAAI,CAAC,CAAC;GAG9C,OAAO,kBAAkB,cAAc,IAAI,WAAY,GAA8B,CAAC;EACxF,QAAQ;GAEN,OAAO,kBAAkB,cAAc,IAAI,CAAC;EAC9C;CACF;CACA,OAAO,kBAAkB,cAAc,IAAI,CAAC;AAC9C;;AAKA,SAAgB,iBAAiB,OAAoD;CACnF,OAAO,UAAU,UAAU,UAAU,UAAU,UAAU,SAAS,UAAU;AAC9E;;;;;;AAOA,MAAM,eAAoD;CACxD,CAAC,kBAAkB,MAAM;CACzB,CAAC,aAAa,MAAM;CACpB,CAAC,aAAa,KAAK;CACnB,CAAC,YAAY,KAAK;CAClB,CAAC,qBAAqB,KAAK;AAC7B;;AAGA,SAAS,gBAAgB,IAAoD;CAC3E,IAAI,CAAC,IAAI,OAAO,KAAA;CAChB,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC;CAC3B,OAAO,iBAAiB,IAAI,IAAI,OAAO,KAAA;AACzC;;AAGA,SAAS,kBAAkB,KAAyC;CAClE,IAAI;EAIF,MAAM,OAHM,KAAK,MAAM,aAAa,KAAK,KAAK,cAAc,GAAG,MAAM,CAGtD,CAAC,CAAC,gBAAgB,MAAM,GAAG,CAAC,CAAC;EAC5C,OAAO,iBAAiB,IAAI,IAAI,OAAO,KAAA;CACzC,QAAQ;EACN;CACF;AACF;;;;;;;;;;;;AAaA,SAAgB,qBACd,MAAc,QAAQ,IAAI,GAC1B,OAAuD,CAAC,GACxC;CAChB,MAAM,MAAM,KAAK,OAAO,QAAQ;CAEhC,IAAI,iBAAiB,KAAK,QAAQ,GAAG,OAAO,KAAK;CAEjD,MAAM,QAAQ,IAAI;CAClB,IAAI,iBAAiB,KAAK,GAAG,OAAO;CAEpC,MAAM,OAAO,gBAAgB,IAAI,qBAAqB;CACtD,IAAI,MAAM,OAAO;CAEjB,IAAI,UAAU;CACd,SAAS;EACP,KAAK,MAAM,CAAC,MAAM,OAAO,cACvB,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,GAAG,OAAO;EAE9C,MAAM,YAAY,kBAAkB,OAAO;EAC3C,IAAI,WAAW,OAAO;EAEtB,IAAI,WAAW,KAAK,SAAS,MAAM,CAAC,GAAG;EACvC,MAAM,SAAS,QAAQ,OAAO;EAC9B,IAAI,WAAW,SAAS;EACxB,UAAU;CACZ;CAEA,OAAO;AACT;;AAGA,SAAgB,eACd,IACA,UACA,OAA0B,CAAC,GACP;CAGpB,OAAO,CAAC,IAAI;EAFC,OAAO,QAAQ,YAAY;EAErB,GADH,KAAK,MAAM,CAAC,OAAO,QAAQ,eAAe,IAAI,IAAI,CAAC;EACpC,GAAG;CAAQ,CAAC;AAC7C;;AAGA,SAAgB,YACd,IACA,UACA,OAA0B,CAAC,GACnB;CACR,MAAM,CAAC,KAAK,QAAQ,eAAe,IAAI,UAAU,IAAI;CACrD,OAAO,GAAG,IAAI,GAAG,KAAK,KAAK,GAAG;AAChC"}
+{"version":3,"file":"config-D7ddWN_9.mjs","names":[],"sources":["../src/utils/config.ts"],"sourcesContent":["import { existsSync, readFileSync } from 'node:fs'\nimport { dirname, join } from 'node:path'\nimport { pathToFileURL } from 'node:url'\n\n/**\n * Canonical (and only) host for hosted cascivo artifacts (registry.json, per-item\n * r/<name>.json, marketplace.json, /llms/*, /context/*). The legacy docs.cascivo.com\n * subdomain is retired and 301s here. Keep in sync with CASCIVO_HOST in packages/mcp.\n */\nexport const CASCIVO_HOST = 'https://cascivo.com'\n\n/** All first-party themes shipped by @cascivo/themes (selectable via data-theme). */\nexport const THEMES = [\n  'light',\n  'dark',\n  'warm',\n  'flat',\n  'minimal',\n  'midnight',\n  'pastel',\n  'brutalist',\n  'corporate',\n  'terminal',\n  'cyberpunk',\n  'arcade',\n] as const\n\nexport type ThemeName = (typeof THEMES)[number]\n\nexport type RegistryNamespaceConfig =\n  | string\n  | { url: string; headers?: Record<string, string>; params?: Record<string, string> }\n\nexport interface CascadeConfig {\n  /** URL of the registry.json index. */\n  registry: string\n  /** Directory (relative to project root) where components are written. */\n  outputDir: string\n  /** Default theme imported by `cascade init`. */\n  theme: ThemeName\n  /** Namespace → registry URL template (with {name} placeholder) or auth config. */\n  registries?: Record<string, RegistryNamespaceConfig>\n  /** Whether to copy test files (*.contract.test.tsx) when adding components. */\n  tests?: boolean\n}\n\nexport const DEFAULT_CONFIG: CascadeConfig = {\n  // Canonical hosted registry index (served from the landing site, documented in\n  // llms.txt). Prefer this over a branch's GitHub raw URL, which 404s for\n  // unauthenticated/private-repo requests and breaks `cascivo list`/`add`.\n  registry: `${CASCIVO_HOST}/registry.json`,\n  outputDir: 'src/components/ui',\n  theme: 'light',\n}\n\nconst CONFIG_FILES = ['cascivo.config.ts', 'cascivo.config.js', 'cascivo.config.mjs']\n\n/** Apply defaults over a (possibly partial) user config object. */\nexport function resolveConfig(partial: Partial<CascadeConfig> | null | undefined): CascadeConfig {\n  return { ...DEFAULT_CONFIG, ...partial }\n}\n\n/** Let env vars override config — used by the MCP server to pass `outputDir`. */\nexport function applyEnvOverrides(\n  config: CascadeConfig,\n  env: NodeJS.ProcessEnv = process.env,\n): CascadeConfig {\n  return {\n    ...config,\n    ...(env.CASCIVO_REGISTRY ? { registry: env.CASCIVO_REGISTRY } : {}),\n    ...(env.CASCIVO_OUTPUT_DIR ? { outputDir: env.CASCIVO_OUTPUT_DIR } : {}),\n  }\n}\n\n/**\n * Locate and load `cascivo.config.{ts,js,mjs}` from `cwd`. Falls back to the\n * default config when no file is found or the file cannot be loaded. Env vars\n * (`CASCIVO_REGISTRY`, `CASCIVO_OUTPUT_DIR`) take precedence.\n */\nexport async function loadConfig(cwd: string = process.cwd()): Promise<CascadeConfig> {\n  for (const file of CONFIG_FILES) {\n    const path = join(cwd, file)\n    if (!existsSync(path)) continue\n    try {\n      const mod = (await import(pathToFileURL(path).href)) as {\n        default?: Partial<CascadeConfig>\n      }\n      return applyEnvOverrides(resolveConfig(mod.default ?? (mod as Partial<CascadeConfig>)))\n    } catch {\n      // Unloadable config (e.g. unsupported TS syntax) — fall back to defaults.\n      return applyEnvOverrides(resolveConfig(null))\n    }\n  }\n  return applyEnvOverrides(resolveConfig(null))\n}\n\nexport type PackageManager = 'pnpm' | 'yarn' | 'npm' | 'bun'\n\n/** Narrow an arbitrary string to a known PackageManager. */\nexport function isPackageManager(value: string | undefined): value is PackageManager {\n  return value === 'pnpm' || value === 'yarn' || value === 'npm' || value === 'bun'\n}\n\n/**\n * Lock files in probe order. `bun.lock` (bun ≥ 1.2 text lockfile) sits beside the\n * legacy binary `bun.lockb`; `package-lock.json` is npm's marker so a walk that\n * reaches an npm workspace root still resolves to npm rather than the default.\n */\nconst PM_LOCKFILES: readonly [string, PackageManager][] = [\n  ['pnpm-lock.yaml', 'pnpm'],\n  ['yarn.lock', 'yarn'],\n  ['bun.lockb', 'bun'],\n  ['bun.lock', 'bun'],\n  ['package-lock.json', 'npm'],\n]\n\n/** The package manager that invoked this process, from `npm_config_user_agent`. */\nfunction pmFromUserAgent(ua: string | undefined): PackageManager | undefined {\n  if (!ua) return undefined\n  const name = ua.split('/')[0]\n  return isPackageManager(name) ? name : undefined\n}\n\n/** The `packageManager` corepack field of a package.json, if it names a known PM. */\nfunction pmFromPackageJson(dir: string): PackageManager | undefined {\n  try {\n    const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')) as {\n      packageManager?: string\n    }\n    const name = pkg.packageManager?.split('@')[0]\n    return isPackageManager(name) ? name : undefined\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Detect the package manager in use. Precedence, highest first:\n *   1. explicit override (the `--package-manager`/`--pm` flag)\n *   2. `CASCIVO_PACKAGE_MANAGER` env var\n *   3. `npm_config_user_agent` (the PM that spawned the CLI, e.g. `pnpm dlx`)\n *   4. an upward walk from `cwd` for a lock file or `packageManager` field —\n *      this is what makes detection work inside a workspace, where the lock\n *      file lives at the repo root, not in the app subdirectory the user runs\n *      the CLI from. The walk stops after a directory containing `.git`.\n *   5. default `npm`.\n */\nexport function detectPackageManager(\n  cwd: string = process.cwd(),\n  opts: { override?: string; env?: NodeJS.ProcessEnv } = {},\n): PackageManager {\n  const env = opts.env ?? process.env\n\n  if (isPackageManager(opts.override)) return opts.override\n\n  const envPm = env.CASCIVO_PACKAGE_MANAGER\n  if (isPackageManager(envPm)) return envPm\n\n  const uaPm = pmFromUserAgent(env.npm_config_user_agent)\n  if (uaPm) return uaPm\n\n  let current = cwd\n  for (;;) {\n    for (const [file, pm] of PM_LOCKFILES) {\n      if (existsSync(join(current, file))) return pm\n    }\n    const fromField = pmFromPackageJson(current)\n    if (fromField) return fromField\n    // A `.git` directory marks the repo root — do not walk past it.\n    if (existsSync(join(current, '.git'))) break\n    const parent = dirname(current)\n    if (parent === current) break\n    current = parent\n  }\n\n  return 'npm'\n}\n\n/**\n * Pin every `@cascivo/*` package to an explicit version specifier.\n *\n * A bare name lets the package manager reuse whatever it already has resolvable. In a pnpm\n * workspace a sibling package's lockfile entry won and `@cascivo/i18n` resolved to **0.2.14**\n * while latest was **0.16.0** — then cascivo warned the adopter about the version it had\n * just installed itself. `add name@latest` (or the registry's known floor) makes the intent\n * explicit instead of leaving it to resolution order.\n *\n * Non-cascivo packages (`@preact/signals-react`) keep their bare name: their version is the\n * app's business, and cascivo has no floor to assert.\n */\nexport function pinSpecifier(pkg: string, floors: Record<string, string> = {}): string {\n  if (!pkg.startsWith('@cascivo/') && pkg !== 'cascivo') return pkg\n  if (pkg.includes('@', 1)) return pkg // already carries an explicit version\n  const floor = floors[pkg]\n  // `>=x.y.z` is not an installable specifier on its own; widen it to a range the package\n  // manager understands, so a known floor is honoured rather than silently ignored.\n  if (floor?.startsWith('>=')) return `${pkg}@${floor.slice(2)} - x`\n  return `${pkg}@latest`\n}\n\n/** The install subcommand each package manager uses to add dependencies. */\nexport function installCommand(\n  pm: PackageManager,\n  packages: string[],\n  opts: { dev?: boolean; floors?: Record<string, string>; pin?: string } = {},\n): [string, string[]] {\n  const verb = pm === 'npm' ? 'install' : 'add'\n  const devFlag = opts.dev ? [pm === 'npm' ? '--save-dev' : '-D'] : []\n  const specs = packages.map((p) =>\n    opts.pin && (p.startsWith('@cascivo/') || p === 'cascivo')\n      ? `${p}@${opts.pin}`\n      : pinSpecifier(p, opts.floors ?? {}),\n  )\n  return [pm, [verb, ...devFlag, ...specs]]\n}\n\n/** Human-readable install command a user can copy-paste, e.g. `pnpm add -D cascivo`. */\nexport function installHint(\n  pm: PackageManager,\n  packages: string[],\n  opts: { dev?: boolean } = {},\n): string {\n  const [cmd, args] = installCommand(pm, packages, opts)\n  return `${cmd} ${args.join(' ')}`\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AASA,MAAa,eAAe;;AAG5B,MAAa,SAAS;CACpB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAqBA,MAAa,iBAAgC;CAI3C,UAAU,GAAG,aAAa;CAC1B,WAAW;CACX,OAAO;AACT;AAEA,MAAM,eAAe;CAAC;CAAqB;CAAqB;AAAoB;;AAGpF,SAAgB,cAAc,SAAmE;CAC/F,OAAO;EAAE,GAAG;EAAgB,GAAG;CAAQ;AACzC;;AAGA,SAAgB,kBACd,QACA,MAAyB,QAAQ,KAClB;CACf,OAAO;EACL,GAAG;EACH,GAAI,IAAI,mBAAmB,EAAE,UAAU,IAAI,iBAAiB,IAAI,CAAC;EACjE,GAAI,IAAI,qBAAqB,EAAE,WAAW,IAAI,mBAAmB,IAAI,CAAC;CACxE;AACF;;;;;;AAOA,eAAsB,WAAW,MAAc,QAAQ,IAAI,GAA2B;CACpF,KAAK,MAAM,QAAQ,cAAc;EAC/B,MAAM,OAAO,KAAK,KAAK,IAAI;EAC3B,IAAI,CAAC,WAAW,IAAI,GAAG;EACvB,IAAI;GACF,MAAM,MAAO,MAAM,OAAO,cAAc,IAAI,CAAC,CAAC;GAG9C,OAAO,kBAAkB,cAAc,IAAI,WAAY,GAA8B,CAAC;EACxF,QAAQ;GAEN,OAAO,kBAAkB,cAAc,IAAI,CAAC;EAC9C;CACF;CACA,OAAO,kBAAkB,cAAc,IAAI,CAAC;AAC9C;;AAKA,SAAgB,iBAAiB,OAAoD;CACnF,OAAO,UAAU,UAAU,UAAU,UAAU,UAAU,SAAS,UAAU;AAC9E;;;;;;AAOA,MAAM,eAAoD;CACxD,CAAC,kBAAkB,MAAM;CACzB,CAAC,aAAa,MAAM;CACpB,CAAC,aAAa,KAAK;CACnB,CAAC,YAAY,KAAK;CAClB,CAAC,qBAAqB,KAAK;AAC7B;;AAGA,SAAS,gBAAgB,IAAoD;CAC3E,IAAI,CAAC,IAAI,OAAO,KAAA;CAChB,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC;CAC3B,OAAO,iBAAiB,IAAI,IAAI,OAAO,KAAA;AACzC;;AAGA,SAAS,kBAAkB,KAAyC;CAClE,IAAI;EAIF,MAAM,OAHM,KAAK,MAAM,aAAa,KAAK,KAAK,cAAc,GAAG,MAAM,CAGtD,CAAC,CAAC,gBAAgB,MAAM,GAAG,CAAC,CAAC;EAC5C,OAAO,iBAAiB,IAAI,IAAI,OAAO,KAAA;CACzC,QAAQ;EACN;CACF;AACF;;;;;;;;;;;;AAaA,SAAgB,qBACd,MAAc,QAAQ,IAAI,GAC1B,OAAuD,CAAC,GACxC;CAChB,MAAM,MAAM,KAAK,OAAO,QAAQ;CAEhC,IAAI,iBAAiB,KAAK,QAAQ,GAAG,OAAO,KAAK;CAEjD,MAAM,QAAQ,IAAI;CAClB,IAAI,iBAAiB,KAAK,GAAG,OAAO;CAEpC,MAAM,OAAO,gBAAgB,IAAI,qBAAqB;CACtD,IAAI,MAAM,OAAO;CAEjB,IAAI,UAAU;CACd,SAAS;EACP,KAAK,MAAM,CAAC,MAAM,OAAO,cACvB,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,GAAG,OAAO;EAE9C,MAAM,YAAY,kBAAkB,OAAO;EAC3C,IAAI,WAAW,OAAO;EAEtB,IAAI,WAAW,KAAK,SAAS,MAAM,CAAC,GAAG;EACvC,MAAM,SAAS,QAAQ,OAAO;EAC9B,IAAI,WAAW,SAAS;EACxB,UAAU;CACZ;CAEA,OAAO;AACT;;;;;;;;;;;;;AAcA,SAAgB,aAAa,KAAa,SAAiC,CAAC,GAAW;CACrF,IAAI,CAAC,IAAI,WAAW,WAAW,KAAK,QAAQ,WAAW,OAAO;CAC9D,IAAI,IAAI,SAAS,KAAK,CAAC,GAAG,OAAO;CACjC,MAAM,QAAQ,OAAO;CAGrB,IAAI,OAAO,WAAW,IAAI,GAAG,OAAO,GAAG,IAAI,GAAG,MAAM,MAAM,CAAC,EAAE;CAC7D,OAAO,GAAG,IAAI;AAChB;;AAGA,SAAgB,eACd,IACA,UACA,OAAyE,CAAC,GACtD;CACpB,MAAM,OAAO,OAAO,QAAQ,YAAY;CACxC,MAAM,UAAU,KAAK,MAAM,CAAC,OAAO,QAAQ,eAAe,IAAI,IAAI,CAAC;CACnE,MAAM,QAAQ,SAAS,KAAK,MAC1B,KAAK,QAAQ,EAAE,WAAW,WAAW,KAAK,MAAM,aAC5C,GAAG,EAAE,GAAG,KAAK,QACb,aAAa,GAAG,KAAK,UAAU,CAAC,CAAC,CACvC;CACA,OAAO,CAAC,IAAI;EAAC;EAAM,GAAG;EAAS,GAAG;CAAK,CAAC;AAC1C;;AAGA,SAAgB,YACd,IACA,UACA,OAA0B,CAAC,GACnB;CACR,MAAM,CAAC,KAAK,QAAQ,eAAe,IAAI,UAAU,IAAI;CACrD,OAAO,GAAG,IAAI,GAAG,KAAK,KAAK,GAAG;AAChC"}

package/dist/{drift-qTzJ75Ds.mjs → drift-B02BbFN_.mjs}

@@ -2,25 +2,28 @@ import { t as readFileSafe } from "./fs-m7ZvuBBm.mjs";
 import { c as findComponent, n as readLock, o as fetchRegistry, r as sha256 } from "./lock-CW8UuEPJ.mjs";
 import { t as checkPeerVersions } from "./peer-versions-Cep8Brn3.mjs";
 //#region src/commands/drift.ts
-/**
-* `cascivo doctor --drift` — compares installed components against the
-* registry. Two drift classes:
-*
-*  1. Local-edit drift: an installed file's content no longer matches what
-*     was copied at install time (hand edits, or deleted after install).
-*  2. Peer-version drift: the currently-registered component source needs a
-*     newer `@cascivo/*` peer package (per `peerVersions`) than what's
-*     actually installed in node_modules — the dashboard-feedback failure
-*     mode (DataTable referencing an i18n builtin key an older published
-*     @cascivo/i18n build doesn't have).
-*/
 async function runDoctorDrift(config, cwd = process.cwd()) {
 	const lock = await readLock(cwd);
 	if (!lock || Object.keys(lock.items).length === 0) {
 		console.log("No installed components found in cascivo.lock.");
-		return;
+		return {
+			ran: false,
+			reason: "no components installed (cascivo.lock is empty or missing)",
+			issues: 0
+		};
+	}
+	let registry;
+	try {
+		registry = await fetchRegistry(config.registry);
+	} catch (error) {
+		const reason = `could not reach the registry (${error instanceof Error ? error.message : String(error)})`;
+		console.log(`Drift check skipped: ${reason}`);
+		return {
+			ran: false,
+			reason,
+			issues: 0
+		};
 	}
-	const registry = await fetchRegistry(config.registry);
 	let driftCount = 0;
 	for (const [name, entry] of Object.entries(lock.items)) {
 		const current = findComponent(registry, name);
@@ -50,8 +53,12 @@ async function runDoctorDrift(config, cwd = process.cwd()) {
 		console.log(`\n${driftCount} drift issue(s) found.`);
 		process.exitCode = 1;
 	} else console.log("No drift detected — installed components match the registry.");
+	return {
+		ran: true,
+		issues: driftCount
+	};
 }
 //#endregion
 export { runDoctorDrift };
 
-//# sourceMappingURL=drift-qTzJ75Ds.mjs.map
+//# sourceMappingURL=drift-B02BbFN_.mjs.map

package/dist/drift-B02BbFN_.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"drift-B02BbFN_.mjs","names":[],"sources":["../src/commands/drift.ts"],"sourcesContent":["import type { CascadeConfig } from '../utils/config.js'\nimport { readFileSafe } from '../utils/fs.js'\nimport { readLock, sha256 } from '../utils/lock.js'\nimport { checkPeerVersions } from '../utils/peer-versions.js'\nimport { fetchRegistry, findComponent } from '../utils/registry.js'\n\n/**\n * `cascivo doctor --drift` — compares installed components against the\n * registry. Two drift classes:\n *\n *  1. Local-edit drift: an installed file's content no longer matches what\n *     was copied at install time (hand edits, or deleted after install).\n *  2. Peer-version drift: the currently-registered component source needs a\n *     newer `@cascivo/*` peer package (per `peerVersions`) than what's\n *     actually installed in node_modules — the dashboard-feedback failure\n *     mode (DataTable referencing an i18n builtin key an older published\n *     @cascivo/i18n build doesn't have).\n */\n/**\n * What a drift run actually managed to do.\n *\n * `runDoctorDrift` used to return void, so the default `cascivo doctor` could not run it and\n * still say something honest. That is how \"No violations found.\" got printed by a run that\n * had never looked: the two were disjoint branches, and `--drift` reported five real issues\n * on the same project.\n */\nexport interface DriftOutcome {\n  /** False when the check could not run at all (no lockfile, offline, unreachable registry). */\n  ran: boolean\n  /** Why it could not run — printed instead of an unqualified \"clean\". */\n  reason?: string\n  issues: number\n}\n\nexport async function runDoctorDrift(\n  config: CascadeConfig,\n  cwd: string = process.cwd(),\n): Promise<DriftOutcome> {\n  const lock = await readLock(cwd)\n  if (!lock || Object.keys(lock.items).length === 0) {\n    console.log('No installed components found in cascivo.lock.')\n    return {\n      ran: false,\n      reason: 'no components installed (cascivo.lock is empty or missing)',\n      issues: 0,\n    }\n  }\n\n  let registry: Awaited<ReturnType<typeof fetchRegistry>>\n  try {\n    registry = await fetchRegistry(config.registry)\n  } catch (error) {\n    const reason = `could not reach the registry (${error instanceof Error ? error.message : String(error)})`\n    console.log(`Drift check skipped: ${reason}`)\n    return { ran: false, reason, issues: 0 }\n  }\n  let driftCount = 0\n\n  for (const [name, entry] of Object.entries(lock.items)) {\n    const current = findComponent(registry, name)\n    if (!current) continue\n\n    for (const [path, lockedHash] of Object.entries(entry.files)) {\n      const content = await readFileSafe(path)\n      if (content === null) {\n        console.log(`${name}: ${path} is missing (installed, then deleted)`)\n        driftCount++\n        continue\n      }\n      if (sha256(content) !== lockedHash) {\n        console.log(`${name}: ${path} has local edits (differs from the version installed)`)\n        driftCount++\n      }\n    }\n\n    if (current.peerVersions) {\n      const violations = await checkPeerVersions(cwd, current.peerVersions)\n      for (const v of violations) {\n        const installedDesc = v.installed ? `${v.installed} is installed` : 'it is not installed'\n        console.log(`${name}: needs ${v.pkg} ${v.required}, but ${installedDesc}.`)\n        driftCount++\n      }\n    }\n  }\n\n  if (driftCount > 0) {\n    console.log(`\\n${driftCount} drift issue(s) found.`)\n    process.exitCode = 1\n  } else {\n    console.log('No drift detected — installed components match the registry.')\n  }\n  return { ran: true, issues: driftCount }\n}\n"],"mappings":";;;;AAkCA,eAAsB,eACpB,QACA,MAAc,QAAQ,IAAI,GACH;CACvB,MAAM,OAAO,MAAM,SAAS,GAAG;CAC/B,IAAI,CAAC,QAAQ,OAAO,KAAK,KAAK,KAAK,CAAC,CAAC,WAAW,GAAG;EACjD,QAAQ,IAAI,gDAAgD;EAC5D,OAAO;GACL,KAAK;GACL,QAAQ;GACR,QAAQ;EACV;CACF;CAEA,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,cAAc,OAAO,QAAQ;CAChD,SAAS,OAAO;EACd,MAAM,SAAS,iCAAiC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE;EACvG,QAAQ,IAAI,wBAAwB,QAAQ;EAC5C,OAAO;GAAE,KAAK;GAAO;GAAQ,QAAQ;EAAE;CACzC;CACA,IAAI,aAAa;CAEjB,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,KAAK,GAAG;EACtD,MAAM,UAAU,cAAc,UAAU,IAAI;EAC5C,IAAI,CAAC,SAAS;EAEd,KAAK,MAAM,CAAC,MAAM,eAAe,OAAO,QAAQ,MAAM,KAAK,GAAG;GAC5D,MAAM,UAAU,MAAM,aAAa,IAAI;GACvC,IAAI,YAAY,MAAM;IACpB,QAAQ,IAAI,GAAG,KAAK,IAAI,KAAK,sCAAsC;IACnE;IACA;GACF;GACA,IAAI,OAAO,OAAO,MAAM,YAAY;IAClC,QAAQ,IAAI,GAAG,KAAK,IAAI,KAAK,sDAAsD;IACnF;GACF;EACF;EAEA,IAAI,QAAQ,cAAc;GACxB,MAAM,aAAa,MAAM,kBAAkB,KAAK,QAAQ,YAAY;GACpE,KAAK,MAAM,KAAK,YAAY;IAC1B,MAAM,gBAAgB,EAAE,YAAY,GAAG,EAAE,UAAU,iBAAiB;IACpE,QAAQ,IAAI,GAAG,KAAK,UAAU,EAAE,IAAI,GAAG,EAAE,SAAS,QAAQ,cAAc,EAAE;IAC1E;GACF;EACF;CACF;CAEA,IAAI,aAAa,GAAG;EAClB,QAAQ,IAAI,KAAK,WAAW,uBAAuB;EACnD,QAAQ,WAAW;CACrB,OACE,QAAQ,IAAI,8DAA8D;CAE5E,OAAO;EAAE,KAAK;EAAM,QAAQ;CAAW;AACzC"}

package/dist/generated/audit-contract.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.16.0",
+  "version": "0.16.1",
   "tokens": [
     { "name": "--cascivo-gray-0", "resolvedDefault": "oklch(1 0 0)" },
     { "name": "--cascivo-gray-50", "resolvedDefault": "oklch(0.985 0.002 264)" },
@@ -92,6 +92,14 @@
     { "name": "--cascivo-text-2xl", "resolvedDefault": "1.5rem" },
     { "name": "--cascivo-text-3xl", "resolvedDefault": "1.875rem" },
     { "name": "--cascivo-text-4xl", "resolvedDefault": "2.25rem" },
+    { "name": "--cascivo-font-size-xs", "resolvedDefault": "0.75rem" },
+    { "name": "--cascivo-font-size-sm", "resolvedDefault": "0.875rem" },
+    { "name": "--cascivo-font-size-base", "resolvedDefault": "1rem" },
+    { "name": "--cascivo-font-size-lg", "resolvedDefault": "1.125rem" },
+    { "name": "--cascivo-font-size-xl", "resolvedDefault": "1.25rem" },
+    { "name": "--cascivo-font-size-2xl", "resolvedDefault": "1.5rem" },
+    { "name": "--cascivo-font-size-3xl", "resolvedDefault": "1.875rem" },
+    { "name": "--cascivo-font-size-4xl", "resolvedDefault": "2.25rem" },
     { "name": "--cascivo-font-normal", "resolvedDefault": "400" },
     { "name": "--cascivo-font-medium", "resolvedDefault": "500" },
     { "name": "--cascivo-font-semibold", "resolvedDefault": "600" },
@@ -1117,6 +1125,16 @@
         { "name": "className", "type": "string", "required": false }
       ]
     },
+    {
+      "name": "InfiniteScroll",
+      "props": [
+        { "name": "onLoadMore", "type": "() => Promise<unknown> | unknown", "required": true },
+        { "name": "disabled", "type": "boolean", "required": false },
+        { "name": "rootMargin", "type": "string", "required": false },
+        { "name": "labels", "type": "{ loadMore?: string; loading?: string }", "required": false },
+        { "name": "className", "type": "string", "required": false }
+      ]
+    },
     {
       "name": "InlineLoading",
       "props": [
@@ -1180,6 +1198,18 @@
         { "name": "labels", "type": "{ required?: string }", "required": false }
       ]
     },
+    {
+      "name": "LargeTitleHeader",
+      "props": [
+        { "name": "title", "type": "string", "required": true },
+        { "name": "children", "type": "React.ReactNode", "required": true },
+        { "name": "leading", "type": "React.ReactNode", "required": false },
+        { "name": "actions", "type": "React.ReactNode", "required": false },
+        { "name": "level", "type": "1 | 2 | 3", "required": false },
+        { "name": "collapseDistance", "type": "number", "required": false },
+        { "name": "className", "type": "string", "required": false }
+      ]
+    },
     {
       "name": "Link",
       "props": [
@@ -1531,6 +1561,20 @@
         { "name": "format", "type": "Intl.RelativeTimeFormatOptions", "required": false }
       ]
     },
+    {
+      "name": "ReorderList",
+      "props": [
+        { "name": "value", "type": "ReorderItem[]", "required": true },
+        { "name": "onValueChange", "type": "(value: ReorderItem[]) => void", "required": true },
+        { "name": "disabled", "type": "boolean", "required": false },
+        {
+          "name": "labels",
+          "type": "{ handle?: string; grabbed?: string; moved?: string; dropped?: string; cancelled?: string }",
+          "required": false
+        },
+        { "name": "className", "type": "string", "required": false }
+      ]
+    },
     {
       "name": "Resizable",
       "props": [
@@ -1984,10 +2028,38 @@
         { "name": "avatarProps", "type": "AvatarProps", "required": false }
       ]
     },
+    {
+      "name": "VirtualList",
+      "props": [
+        { "name": "items", "type": "Item[]", "required": true },
+        { "name": "itemHeight", "type": "number", "required": true },
+        { "name": "height", "type": "number", "required": true },
+        {
+          "name": "renderItem",
+          "type": "(item: Item, index: number) => React.ReactNode",
+          "required": true
+        },
+        { "name": "overscan", "type": "number", "required": false },
+        { "name": "ariaLabel", "type": "string", "required": false },
+        { "name": "className", "type": "string", "required": false }
+      ]
+    },
     {
       "name": "VisuallyHidden",
       "props": [{ "name": "children", "type": "ReactNode", "required": true }]
     },
+    {
+      "name": "WheelPicker",
+      "props": [
+        { "name": "options", "type": "WheelPickerOption[]", "required": true },
+        { "name": "value", "type": "string", "required": true },
+        { "name": "onValueChange", "type": "(value: string) => void", "required": true },
+        { "name": "visibleCount", "type": "number", "required": false },
+        { "name": "itemHeight", "type": "number", "required": false },
+        { "name": "ariaLabel", "type": "string", "required": false },
+        { "name": "className", "type": "string", "required": false }
+      ]
+    },
     {
       "name": "AppFrame",
       "props": [

package/dist/index.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as detectPackageManager, c as isPackageManager, l as loadConfig, n as DEFAULT_CONFIG$1, o as installCommand, r as THEMES, s as installHint, t as CASCIVO_HOST, u as __exportAll } from "./config-C6GdrbvF.mjs";
+import { a as detectPackageManager, c as isPackageManager, l as loadConfig, n as DEFAULT_CONFIG$1, o as installCommand, r as THEMES, s as installHint, t as CASCIVO_HOST, u as __exportAll } from "./config-D7ddWN_9.mjs";
 import { n as resolveOutputPath, r as writeFileSafe, t as readFileSafe } from "./fs-m7ZvuBBm.mjs";
 import { r as fetchTextRetry, t as fetchJson } from "./http-CJZ5W0Fa.mjs";
 import { a as writeLock, c as findComponent, i as updateLockEntry, n as readLock, o as fetchRegistry, r as sha256, s as fileName, t as createLock } from "./lock-CW8UuEPJ.mjs";
@@ -24,7 +24,11 @@ import { createInterface } from "node:readline/promises";
 function installPackages(packages, cwd = process.cwd(), opts = {}) {
 	if (packages.length === 0) return true;
 	const pm = opts.pm ?? detectPackageManager(cwd);
-	const [cmd, args] = installCommand(pm, packages, { dev: opts.dev ?? false });
+	const [cmd, args] = installCommand(pm, packages, {
+		dev: opts.dev ?? false,
+		...opts.floors ? { floors: opts.floors } : {},
+		...opts.pin ? { pin: opts.pin } : {}
+	});
 	console.log(`Installing ${packages.join(", ")} with ${cmd}…`);
 	if (spawnSync(cmd, args, {
 		cwd,
@@ -351,6 +355,17 @@ async function add(names, config, opts = {}) {
 	}
 	const { resolved, missing } = resolveBareClosure(registry, bareSpecs);
 	for (const name of missing) console.error(`Component "${name}" not found in registry. Run "cascivo list".`);
+	const announced = /* @__PURE__ */ new Set();
+	for (const { entry, requested } of resolved) {
+		if (!requested || !entry.install || announced.has(entry.install)) continue;
+		announced.add(entry.install);
+		console.log(`\n"${entry.name}" ships in the ${entry.install} npm package — no source is copied into your project. Updates come from your package manager, not \`cascivo update\`.`);
+	}
+	for (const { entry, requested } of resolved) {
+		if (!requested || !entry.deprecated) continue;
+		const { replacement, since, note } = entry.deprecated;
+		console.warn(`\n⚠ "${entry.name}" is deprecated since ${since}. Use "${replacement}" instead:\n    cascivo add ${replacement}\n` + (note ? `  ${note}\n` : "") + `  Adding "${entry.name}" anyway — it still works.\n`);
+	}
 	const peerFloors = {};
 	for (const { entry } of resolved) for (const [pkg, floor] of Object.entries(entry.peerVersions ?? {})) peerFloors[pkg] = floor;
 	const npmPackages = /* @__PURE__ */ new Set();
@@ -499,11 +514,11 @@ function resolvePackageManagerFlag(args) {
 * and GETTING-STARTED.md tells adopters to pin exactly. Regenerate with `pnpm regen`.
 */
 const CASCIVO_VERSIONS = {
-	"@cascivo/react": "0.16.0",
-	"@cascivo/themes": "0.4.10",
-	"@cascivo/charts": "0.16.0",
-	"@cascivo/icons": "0.3.7",
-	"@cascivo/eslint-config": "0.2.1"
+	"@cascivo/react": "0.16.1",
+	"@cascivo/themes": "0.4.11",
+	"@cascivo/charts": "0.16.1",
+	"@cascivo/icons": "0.3.8",
+	"@cascivo/eslint-config": "0.2.2"
 };
 /** `@cascivo/core`'s declared `@preact/signals-react` peer range. */
 const SIGNALS_PEER = ">=3.0.0";
@@ -667,7 +682,7 @@ function indexHtml(opts) {
     <title>${opts.name}</title>
     <style>
       @layer vendor, cascivo.reset, cascivo.base, cascivo.tokens, cascivo.component,
-        cascivo.theme, cascivo.blocks, cascivo.example, cascivo.override;
+        cascivo.platform, cascivo.theme, cascivo.blocks, cascivo.example, cascivo.override;
       /* cascivo.example is this app's own slot — above the component/blocks layers so your
          styles win, below cascivo.override which stays free for one-off hotfixes. The
          generated AGENTS.md tells the agent to write there, and this statement is what makes
@@ -816,7 +831,9 @@ import cascivo from '@cascivo/eslint-config'
 
 export default [
   js.configs.recommended,
-  reactHooks.configs['recommended-latest'],
+  // NOTE the \`.flat\` — the plugin exports both \`configs['recommended-latest']\` (the legacy
+  // eslintrc shape, which applies NOTHING here and reports no error) and this one.
+  reactHooks.configs.flat['recommended-latest'],
   // Spread LAST — flat config is last-wins. This turns off \`react-hooks/immutability\`,
   // which reports cascivo's signal writes (\`signal.value = next\`) as errors.
   // See https://cascivo.com/docs/using-with-strict-eslint.md
@@ -880,7 +897,7 @@ This app's declared layer order (in \`index.html\`):
 
 \`\`\`css
 @layer vendor, cascivo.reset, cascivo.base, cascivo.tokens, cascivo.component,
-  cascivo.theme, cascivo.blocks, cascivo.example, cascivo.override;
+  cascivo.platform, cascivo.theme, cascivo.blocks, cascivo.example, cascivo.override;
 \`\`\`
 
 ### Worked example — nesting, not new layers
@@ -1011,7 +1028,7 @@ async function create(args, cwd = process.cwd()) {
 		const templateSpec = flagValue(args, "template");
 		if (templateSpec) {
 			const { add } = await Promise.resolve().then(() => add_exports);
-			const { loadConfig } = await import("./config-C6GdrbvF.mjs").then((n) => n.i);
+			const { loadConfig } = await import("./config-D7ddWN_9.mjs").then((n) => n.i);
 			console.log(`\nInstalling template "${templateSpec}"…`);
 			await add([templateSpec], await loadConfig(), {
 				cwd: targetDir,
@@ -1030,6 +1047,7 @@ async function create(args, cwd = process.cwd()) {
 //#region src/commands/doctor.ts
 var doctor_exports = /* @__PURE__ */ __exportAll({
 	checkDuplicateCore: () => checkDuplicateCore,
+	checkFormatterIgnore: () => checkFormatterIgnore,
 	checkProjectDependencies: () => checkProjectDependencies,
 	checkSignalsCompat: () => checkSignalsCompat,
 	checkSsrConfig: () => checkSsrConfig,
@@ -1250,6 +1268,38 @@ const VITE_CONFIG_FILES = [
 * cliff the 2026-07-20 report hit (blocker #1). A text match, not a gate. Returns
 * null when there's no Vite SSR framework or the config already handles it.
 */
+/**
+* Warn when the vendored components dir is not excluded from the project's formatter.
+*
+* Owning the code means your formatter rewrites it, and `cascivo update` then reports drift
+* on files you never edited. `cascivo init` writes the exclusion for you, but a project that
+* adopted cascivo before that existed — or that added Prettier afterwards — never got it.
+*/
+function checkFormatterIgnore(cwd, outputDir) {
+	const pairs = [{
+		configs: [
+			".prettierrc",
+			".prettierrc.json",
+			".prettierrc.js",
+			"prettier.config.js"
+		],
+		ignore: ".prettierignore"
+	}, {
+		configs: [".oxfmtrc", ".oxfmtrc.json"],
+		ignore: ".oxfmtignore"
+	}];
+	const dir = outputDir.replace(/\/+$/, "");
+	for (const { configs, ignore } of pairs) {
+		if (!configs.some((f) => existsSync(join(cwd, f)))) continue;
+		let content = "";
+		try {
+			content = readFileSync(join(cwd, ignore), "utf8");
+		} catch {}
+		if (content.split("\n").some((l) => l.trim().replace(/\/+$/, "") === dir)) continue;
+		return `"${dir}/" is not excluded from your formatter. Running it will rewrite code you own, and \`cascivo update\` will then report drift on files you never edited. Add "${dir}/" to ${ignore}.`;
+	}
+	return null;
+}
 function checkSsrConfig(cwd) {
 	let deps = {};
 	try {
@@ -1478,9 +1528,7 @@ async function generate(args, config) {
 	}
 	const { readFileSync } = await import("node:fs");
 	const configJson = readFileSync(inputArg, "utf-8");
-	const viewConfig = JSON.parse(configJson);
-	await fetchRegistry(config.registry);
-	const tsx = generateTsx(viewConfig, /* @__PURE__ */ new Map(), componentsDirArg ?? config.outputDir ?? "./src/components/ui");
+	const tsx = generateTsx(JSON.parse(configJson), /* @__PURE__ */ new Map(), componentsDirArg ?? config.outputDir ?? "./src/components/ui");
 	const outPath = outArg ?? join(dirname(inputArg), `${basename(inputArg, ".json")}.tsx`);
 	writeFileSync(outPath, tsx, "utf-8");
 	console.log(`Generated ${outPath}`);
@@ -1570,6 +1618,85 @@ function hintEslintIfPresent(cwd) {
 	console.log("\nESLint: copied cascivo source may trip a strict host config on stylistic rules.");
 	console.log("  Scope them off your components dir — see docs/USING-WITH-STRICT-ESLINT.md");
 }
+/**
+* Write dependency entries into `package.json` so a failed install still leaves a
+* DECLARATIVE-complete project, one `install` away from working.
+*
+* The reported failure: one unrelated bad version range elsewhere in the adopter's
+* `package.json` made `pnpm add` exit non-zero. cascivo had already written
+* `cascivo.config.ts`, so the project claimed to be cascivo-configured with none of the
+* runtime present, and the printed advice ("install them yourself") was the same command
+* that had just failed. Recording the dependencies is the difference between "recoverable
+* with one command" and "figure out what was supposed to be here".
+*
+* Never overwrites an entry that already exists — the app's own pin wins.
+*/
+function recordDependencies(cwd, packages, opts) {
+	const pkgPath = join(cwd, "package.json");
+	if (!existsSync(pkgPath)) return [];
+	let pkg;
+	try {
+		pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+	} catch {
+		return [];
+	}
+	const field = opts.dev ? "devDependencies" : "dependencies";
+	const deps = pkg[field] ??= {};
+	const added = [];
+	for (const name of packages) {
+		if (deps[name] !== void 0) continue;
+		deps[name] = "latest";
+		added.push(name);
+	}
+	if (added.length === 0) return [];
+	writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`, "utf8");
+	return added;
+}
+/** Formatter ignore files, in the order a project is likely to use them. */
+const FORMATTER_IGNORES = [{
+	config: [
+		".prettierrc",
+		".prettierrc.json",
+		".prettierrc.js",
+		"prettier.config.js"
+	],
+	ignore: ".prettierignore"
+}, {
+	config: [".oxfmtrc", ".oxfmtrc.json"],
+	ignore: ".oxfmtignore"
+}];
+/**
+* Exclude the vendored components dir from the project's formatter.
+*
+* Owning the code means your formatter reformats it, and then `cascivo update` reports drift
+* on files you never touched. This ACTS rather than hints: the ESLint equivalent below only
+* prints a pointer, and an adopter ran `prettier --write .` before ever reading it.
+*
+* Idempotent, and never rewrites an existing line.
+*/
+function ensureFormatterIgnore(cwd, outputDir) {
+	const line = `${outputDir.replace(/\/+$/, "")}/`;
+	for (const { config, ignore } of FORMATTER_IGNORES) {
+		if (!(config.some((f) => existsSync(join(cwd, f))) || hasPrettierKeyInPackageJson(cwd, ignore))) continue;
+		const path = join(cwd, ignore);
+		const current = existsSync(path) ? readFileSync(path, "utf8") : "";
+		if (current.split("\n").some((l) => l.trim() === line)) continue;
+		const banner = "# cascivo: vendored component source — you own it, so do not reformat it\n";
+		writeFileSync(path, current === "" ? banner + line + "\n" : `${current.replace(/\n*$/, "\n")}\n${banner}${line}\n`, "utf8");
+		console.log(`\nAdded "${line}" to ${ignore} (so your formatter does not rewrite copied source).`);
+	}
+}
+/** `prettier` key in package.json counts as a Prettier config — only relevant to .prettierignore. */
+function hasPrettierKeyInPackageJson(cwd, ignore) {
+	if (ignore !== ".prettierignore") return false;
+	const pkgPath = join(cwd, "package.json");
+	if (!existsSync(pkgPath)) return false;
+	try {
+		return "prettier" in JSON.parse(readFileSync(pkgPath, "utf8"));
+	} catch {
+		return false;
+	}
+}
 /** The "here's everything you need" summary, printed once at the end of init. */
 function printDependencySummary() {
 	console.log("\nDependencies");
@@ -1607,13 +1734,36 @@ async function init(args = [], cwd = process.cwd()) {
 			pm,
 			dev: true
 		});
-		if (!runtimeOk || !devOk) process.exitCode = 1;
+		if (!runtimeOk || !devOk) {
+			const recorded = [...runtimeOk ? [] : recordDependencies(cwd, RUNTIME_DEPS, { dev: false }), ...devOk ? [] : recordDependencies(cwd, DEV_DEPS, { dev: true })];
+			console.error("\nInstall failed — cascivo.config.ts was written but the packages are not installed.");
+			if (recorded.length > 0) {
+				console.error(`Wrote ${recorded.length} dependency entries to package.json: ${recorded.join(", ")}`);
+				console.error(`Recover with:\n  ${pm} install`);
+			} else console.error(`Recover with:\n  ${installHint(pm, RUNTIME_DEPS)}\n  ${installHint(pm, DEV_DEPS, { dev: true })}`);
+			process.exitCode = 1;
+		}
 	}
-	console.log("\nImport the theme in your root CSS or entry file:");
-	console.log(`  import '@cascivo/themes/${theme}.css'`);
-	console.log("Then set the theme on your root element:");
+	console.log("\nStylesheets — import these once, in this order, in your entry file:");
+	console.log(`  import '@cascivo/tokens'                 // primitive tokens — every --cascivo-* value`);
+	console.log(`  import '@cascivo/themes/${theme}.css'${" ".repeat(Math.max(1, 16 - theme.length))}// the ${theme} theme's semantic values`);
+	console.log(`  // …then your component CSS (\`cascivo add\` writes .module.css beside each component)`);
+	console.log("\nThen set the theme on your root element:");
 	console.log(`  <html data-theme="${theme}">`);
+	console.log("\nSwitching themes at runtime? Use a bundle instead of the single theme:");
+	console.log("  import '@cascivo/themes/light-dark.css'  // light + dark — the common case");
+	console.log("  import '@cascivo/themes/all.css'         // all twelve themes");
+	console.log("  import { ThemeProvider } from '@cascivo/core'");
+	console.log("\nIn YOUR components, when you read a signal during render:");
+	console.log("  import { useSignals } from '@cascivo/core'");
+	console.log("  function MyComponent() {");
+	console.log("    useSignals()   // ← first statement, or the component never re-renders");
+	console.log("    return <span>{count.value}</span>");
+	console.log("  }");
+	console.log("\nAdding a chart later? Charts ship as an npm package with their own stylesheet:");
+	console.log("  import '@cascivo/charts/styles.css'      // `cascivo add <chart>` reminds you");
 	printDependencySummary();
+	ensureFormatterIgnore(cwd, DEFAULT_CONFIG$1.outputDir);
 	hintEslintIfPresent(cwd);
 	console.log("\nAdd components with: cascivo add <name>");
 }
@@ -1628,12 +1778,22 @@ const TYPE_LABELS = {
 	flow: "Flow (npm: @cascivo/flow)",
 	editor: "Editor (npm: @cascivo/editor)"
 };
+/**
+* Deprecation marker for the listing.
+*
+* Shown at DISCOVERY time on purpose. `overflow-menu` carried a `@deprecated` JSDoc in its
+* source for months, which an adopter only meets after they have already vendored the file —
+* and it pointed at an import path that cannot resolve on either install path.
+*/
+function deprecationSuffix(c) {
+	return c.deprecated ? `  ⚠ deprecated → ${c.deprecated.replacement}` : "";
+}
 /** Render a group of entries as an aligned text table (no section header). */
 function formatGroup(entries) {
 	const rows = entries.map((c) => [
 		c.name,
 		c.category,
-		c.description
+		c.description + deprecationSuffix(c)
 	]);
 	const headers = [
 		"Name",
@@ -2697,12 +2857,12 @@ async function run(args) {
 		case "doctor": {
 			const ci = rest.includes("--ci");
 			if (rest.includes("--drift")) {
-				const { runDoctorDrift } = await import("./drift-qTzJ75Ds.mjs");
+				const { runDoctorDrift } = await import("./drift-B02BbFN_.mjs");
 				await runDoctorDrift(await loadConfig());
 			} else {
 				const cwd = process.cwd();
 				const result = await runDoctor(cwd);
-				const { checkDuplicateCore, checkProjectDependencies, checkSignalsCompat, checkSsrConfig, detectInstallPath } = await Promise.resolve().then(() => doctor_exports);
+				const { checkDuplicateCore, checkFormatterIgnore, checkProjectDependencies, checkSignalsCompat, checkSsrConfig, detectInstallPath } = await Promise.resolve().then(() => doctor_exports);
 				const adopter = detectInstallPath(cwd) !== "unknown";
 				const deps = adopter ? checkProjectDependencies(cwd) : [];
 				const missingRequired = deps.filter((d) => d.required);
@@ -2710,15 +2870,23 @@ async function run(args) {
 				const signalsError = signalsCompat?.severity === "error";
 				const ssrHint = adopter ? checkSsrConfig(cwd) : null;
 				const duplicateCore = adopter ? await checkDuplicateCore(cwd) : null;
-				if (result.passed && deps.length === 0 && signalsCompat === null && ssrHint === null && duplicateCore === null) console.log("No violations found.");
+				const formatterHint = adopter ? checkFormatterIgnore(cwd, (await loadConfig()).outputDir) : null;
+				const { runDoctorDrift } = await import("./drift-B02BbFN_.mjs");
+				const driftOutcome = adopter ? await runDoctorDrift(await loadConfig(), cwd) : {
+					ran: false,
+					reason: "no cascivo install detected",
+					issues: 0
+				};
+				if (result.passed && deps.length === 0 && signalsCompat === null && ssrHint === null && duplicateCore === null && formatterHint === null && driftOutcome.issues === 0) console.log(driftOutcome.ran ? "No violations found." : `No violations found (drift: not checked — ${driftOutcome.reason}).`);
 				else {
 					for (const v of result.violations) console.error(`[${v.rule}] ${v.detail}\n  ${v.file}`);
 					for (const d of missingRequired) console.error(d.kind === "forbidden" ? `[forbidden-dependency] ${d.package} must not be a direct dependency here. Remove it — ${d.hint}` : `[missing-dependency] ${d.package} is not in package.json. Install: ${d.hint}`);
 					if (signalsCompat) (signalsError ? console.error : console.log)(`[${signalsError ? "signals-incompatible" : "signals-outdated"}] ${signalsCompat.detail} Upgrade: ${signalsCompat.hint}`);
 					if (ssrHint) console.log(`[ssr-config] ${ssrHint}`);
+					if (formatterHint) console.log(`[formatter-drift] ${formatterHint}`);
 					if (duplicateCore) console.error(`[duplicate-core] More than one @cascivo/core is installed (root: ${duplicateCore.root ?? "none"}; ${duplicateCore.nested.join("; ")}). ` + duplicateCore.hint);
 					for (const d of deps.filter((x) => !x.required)) console.log(`[optional] ${d.package} is not installed; add it when a component or chart needs it: ${d.hint}`);
-					if (ci && (result.violations.length > 0 || missingRequired.length > 0 || signalsError || duplicateCore !== null)) process.exitCode = 1;
+					if (ci && (result.violations.length > 0 || missingRequired.length > 0 || signalsError || duplicateCore !== null || driftOutcome.issues > 0)) process.exitCode = 1;
 				}
 			}
 			break;