onsystem 0.10.0 → 0.10.1

package/dist/{design-system-D53Jxybo.js → design-system-CPH4C7-1.js}

@@ -7,7 +7,7 @@ import ts from "typescript";
 import os from "node:os";
 import postcss from "postcss";
 import { clampChroma, colorsNamed, converter, differenceEuclidean, formatHex, parse, wcagContrast } from "culori";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import fsp from "node:fs/promises";
 import { LineCounter, isMap, isScalar, parseDocument, stringify } from "yaml";
 import { stemmer } from "stemmer";
@@ -122,6 +122,74 @@ function isProjectFile(file) {
 	return !/[\\/]node_modules[\\/]/.test(file);
 }
 //#endregion
+//#region src/util/strings.ts
+/** `alert-dialog` / `alert_dialog` / `alertDialog` → `AlertDialog`. */
+function pascalCase(input) {
+	return input.replace(/\.[^.]+$/, "").split(/[^a-zA-Z0-9]+|(?<=[a-z0-9])(?=[A-Z])/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1).toLowerCase()).join("");
+}
+/** `AlertDialog` → `["Alert", "Dialog"]`, `isHTMLSafe` → `["is", "HTML", "Safe"]`. */
+function splitWords(input) {
+	return input.split(/[^a-zA-Z0-9]+|(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/).filter(Boolean);
+}
+function isPascalCase(name) {
+	return /^[A-Z][A-Za-z0-9]*$/.test(name);
+}
+/** Optimal string alignment distance (Levenshtein plus adjacent transpositions). */
+function editDistance(a, b) {
+	if (a === b) return 0;
+	if (!a.length) return b.length;
+	if (!b.length) return a.length;
+	const rows = a.length + 1;
+	const cols = b.length + 1;
+	const d = new Array(rows * cols).fill(0);
+	const at = (i, j) => d[i * cols + j] ?? 0;
+	for (let i = 0; i < rows; i++) d[i * cols] = i;
+	for (let j = 0; j < cols; j++) d[j] = j;
+	for (let i = 1; i < rows; i++) for (let j = 1; j < cols; j++) {
+		const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+		let v = Math.min(at(i - 1, j) + 1, at(i, j - 1) + 1, at(i - 1, j - 1) + cost);
+		if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) v = Math.min(v, at(i - 2, j - 2) + 1);
+		d[i * cols + j] = v;
+	}
+	return at(a.length, b.length);
+}
+/**
+* The candidate closest to `input` by case-insensitive edit distance, if it is
+* close enough to be a plausible typo (at most a third of the length, min 1).
+*/
+function closest(input, candidates, maxRatio = 1 / 3) {
+	const needle = input.toLowerCase();
+	const limit = Math.max(1, Math.floor(needle.length * maxRatio));
+	let best;
+	let bestScore = Infinity;
+	for (const candidate of candidates) {
+		const gap = Math.abs(candidate.length - needle.length);
+		if (gap > limit || gap >= bestScore) continue;
+		const score = editDistance(needle, candidate.toLowerCase());
+		if (score < bestScore) {
+			best = candidate;
+			bestScore = score;
+		}
+	}
+	return bestScore <= limit ? best : void 0;
+}
+function truncate(text, max) {
+	return text.length <= max ? text : `${text.slice(0, max - 1).trimEnd()}…`;
+}
+/**
+* `text` as a JSON string, with U+0085, U+2028 and U+2029 escaped too, so it stays on one line
+* (JSON escapes the other line breaks).
+*/
+function json(text) {
+	return JSON.stringify(text).replace(/[\u0085\u2028\u2029]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function plural$1(count, word, pluralWord = `${word}s`) {
+	return `${count} ${count === 1 ? word : pluralWord}`;
+}
+function unique(items) {
+	return [...new Set(items)];
+}
+//#endregion
 //#region src/util/paths.ts
 function toPosix(p) {
 	return p.split(path.sep).join("/");
@@ -271,6 +339,14 @@ function splitTopLevel$2(text) {
 function escapeRegExp(text) {
 	return text.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
 }
+/**
+* A file, folder or import path, as written when it holds only the characters of a path (letters,
+* digits and `_ @ $ . + ~ / \ : ( ) [ ] { } # % , = ! -`, as in `app/(site)/[id]/page.tsx`);
+* otherwise, as for a path that holds a space or a line break (git allows one), JSON-quoted.
+*/
+function pathOf(file) {
+	return /^[\p{L}\p{N}_@$.+~/\\:()[\]{}#%,=!-]+$/u.test(file) ? file : json(file);
+}
 //#endregion
 //#region src/package-source.ts
 /**
@@ -567,67 +643,6 @@ function importedStylesheets(files, resolve) {
 	return out;
 }
 //#endregion
-//#region src/util/strings.ts
-/** `alert-dialog` / `alert_dialog` / `alertDialog` → `AlertDialog`. */
-function pascalCase(input) {
-	return input.replace(/\.[^.]+$/, "").split(/[^a-zA-Z0-9]+|(?<=[a-z0-9])(?=[A-Z])/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1).toLowerCase()).join("");
-}
-/** `AlertDialog` → `["Alert", "Dialog"]`, `isHTMLSafe` → `["is", "HTML", "Safe"]`. */
-function splitWords(input) {
-	return input.split(/[^a-zA-Z0-9]+|(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/).filter(Boolean);
-}
-function isPascalCase(name) {
-	return /^[A-Z][A-Za-z0-9]*$/.test(name);
-}
-/** Optimal string alignment distance (Levenshtein plus adjacent transpositions). */
-function editDistance(a, b) {
-	if (a === b) return 0;
-	if (!a.length) return b.length;
-	if (!b.length) return a.length;
-	const rows = a.length + 1;
-	const cols = b.length + 1;
-	const d = new Array(rows * cols).fill(0);
-	const at = (i, j) => d[i * cols + j] ?? 0;
-	for (let i = 0; i < rows; i++) d[i * cols] = i;
-	for (let j = 0; j < cols; j++) d[j] = j;
-	for (let i = 1; i < rows; i++) for (let j = 1; j < cols; j++) {
-		const cost = a[i - 1] === b[j - 1] ? 0 : 1;
-		let v = Math.min(at(i - 1, j) + 1, at(i, j - 1) + 1, at(i - 1, j - 1) + cost);
-		if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) v = Math.min(v, at(i - 2, j - 2) + 1);
-		d[i * cols + j] = v;
-	}
-	return at(a.length, b.length);
-}
-/**
-* The candidate closest to `input` by case-insensitive edit distance, if it is
-* close enough to be a plausible typo (at most a third of the length, min 1).
-*/
-function closest(input, candidates, maxRatio = 1 / 3) {
-	const needle = input.toLowerCase();
-	const limit = Math.max(1, Math.floor(needle.length * maxRatio));
-	let best;
-	let bestScore = Infinity;
-	for (const candidate of candidates) {
-		const gap = Math.abs(candidate.length - needle.length);
-		if (gap > limit || gap >= bestScore) continue;
-		const score = editDistance(needle, candidate.toLowerCase());
-		if (score < bestScore) {
-			best = candidate;
-			bestScore = score;
-		}
-	}
-	return bestScore <= limit ? best : void 0;
-}
-function truncate(text, max) {
-	return text.length <= max ? text : `${text.slice(0, max - 1).trimEnd()}…`;
-}
-function plural$1(count, word, pluralWord = `${word}s`) {
-	return `${count} ${count === 1 ? word : pluralWord}`;
-}
-function unique(items) {
-	return [...new Set(items)];
-}
-//#endregion
 //#region src/detect.ts
 const ignore = () => void 0;
 const COMPONENT_FILE = /\.[jt]sx$/;
@@ -1588,11 +1603,11 @@ const PACKAGE_FIELD = "onsystem";
 function declaredConfig(dir, pkg = readJson$1(path.join(dir, "package.json"))) {
 	const value = pkg?.[PACKAGE_FIELD];
 	if (value === void 0) return void 0;
-	const field = `"${PACKAGE_FIELD}" in ${path.join(dir, "package.json")}`;
+	const field = `"${PACKAGE_FIELD}" in ${pathOf(path.join(dir, "package.json"))}`;
 	if (typeof value !== "string" || !value.endsWith(".json")) return { problem: `${field} is ${JSON.stringify(value)}: it names a JSON config file in the package, such as "./onsystem.config.json".` };
 	const file = path.resolve(dir, value);
-	if (!isInside(dir, file) || file === path.resolve(dir)) return { problem: `${field} names ${value}, which is outside the package.` };
-	if (!isFile(file)) return { problem: `${field} names ${value}, which does not exist.` };
+	if (!isInside(dir, file) || file === path.resolve(dir)) return { problem: `${field} names ${JSON.stringify(value)}, which is outside the package.` };
+	if (!isFile(file)) return { problem: `${field} names ${JSON.stringify(value)}, which does not exist.` };
 	return { file };
 }
 /**
@@ -3530,7 +3545,7 @@ function unknownKeys(what, known) {
 		if (issue.code !== "unrecognized_keys") return void 0;
 		return issue.keys.map((key) => {
 			const guess = closest(key, known, .5);
-			return `Unknown ${what} "${key}". ${guess ? `Did you mean "${guess}"?` : `Expected one of: ${known.join(", ")}.`}`;
+			return `Unknown ${what} ${JSON.stringify(key)}. ${guess ? `Did you mean "${guess}"?` : `Expected one of: ${known.join(", ")}.`}`;
 		}).join("\n");
 	};
 }
@@ -3544,7 +3559,7 @@ const ruleSettingSchema = z.union([
 	if (typeof issue.input !== "string") return void 0;
 	const input = issue.input;
 	const guess = SEVERITIES.find((s) => input && (s.startsWith(input) || input.startsWith(s)));
-	return `Invalid severity "${input}": use "off", "warn" or "error"${guess ? ` (did you mean "${guess}"?)` : ""}.`;
+	return `Invalid severity ${JSON.stringify(input)}: use "off", "warn" or "error"${guess ? ` (did you mean "${guess}"?)` : ""}.`;
 } });
 const globsSchema = z.union([z.string(), z.array(z.string())]);
 const rulesSchema = z.partialRecord(z.enum(RULE_IDS), ruleSettingSchema, { error: unknownKeys("rule", RULE_IDS) });
@@ -3562,7 +3577,7 @@ const librariesSchema = z.union([z.literal(false), z.array(z.enum(LIBRARY_IDS))]
 	const unknown = Array.isArray(issue.input) ? issue.input.find((id) => !LIBRARY_IDS.includes(id)) : void 0;
 	if (typeof unknown === "string") {
 		const guess = closest(unknown, LIBRARY_IDS, .5);
-		return `Unknown library "${unknown}". ${guess ? `Did you mean "${guess}"?` : `Expected one of: ${LIBRARY_IDS.join(", ")}.`}`;
+		return `Unknown library ${JSON.stringify(unknown)}. ${guess ? `Did you mean "${guess}"?` : `Expected one of: ${LIBRARY_IDS.join(", ")}.`}`;
 	}
 	return `"libraries" is false, to read no library, or a list of the ones to read: ${JSON.stringify(LIBRARY_IDS)}.`;
 } });
@@ -3675,9 +3690,12 @@ async function loadConfigWith(options, context = {}) {
 		lookup ??= findDesignSystemPackage(root, finder(root));
 		if (!lookup?.problems.length) declared = lookup?.found;
 		else if (!configFile) throw declarationError(lookup, root);
-		else warnings.push(`${lookup.problems.map((p) => `${p.name}: ${p.problem}`).join("\n")}\nSo ${configFile} is read alone, without the config a design-system package declares. Fix the "${PACKAGE_FIELD}" field in that package, or set "extends": false in ${path.basename(configFile)}.`);
+		else warnings.push(`${problemLines(lookup.problems)}\nSo ${configFile} is read alone, without the config a design-system package declares. Fix the "${PACKAGE_FIELD}" field in that package, or set "extends": false in ${path.basename(configFile)}.`);
+	}
+	for (const { name, problem } of lookup?.skipped ?? []) {
+		const quoted = json(name);
+		warnings.push(`The onsystem config of ${quoted} was skipped: ${problem} ${quoted} is installed in node_modules, so this project is read as if it declared none.`);
 	}
-	for (const { name, problem } of lookup?.skipped ?? []) warnings.push(`${name}'s onsystem config was skipped: ${problem} ${name} is installed in node_modules, so this project is read as if it declared none.`);
 	const pkg = declared ? await readConfig(declared.config, options) : void 0;
 	const base = options.base ? path.resolve(cwd, options.base) : root;
 	const rebase = (from) => (p) => from === root ? p : toPosix(path.relative(root, path.resolve(from, slashGlob(p)))) || ".";
@@ -3693,7 +3711,7 @@ async function loadConfigWith(options, context = {}) {
 	const outside = [];
 	const within = (field) => (p) => {
 		if (!declared || staysIn(declared.dir, declared.boundary, slashGlob(p))) return true;
-		outside.push(`${field} ${p}`);
+		outside.push(`${field} ${json(p)}`);
 		return false;
 	};
 	const pathOf = (t) => typeof t === "string" ? t : t.path;
@@ -3704,7 +3722,7 @@ async function loadConfigWith(options, context = {}) {
 	const packageComponents = pkg?.components === void 0 ? void 0 : toArray(pkg.components).filter(within("components")).map(fromPackage);
 	const packageTokens = pkg?.tokens === void 0 ? void 0 : toArray(pkg.tokens).filter((t) => within("tokens")(pathOf(t))).map(tokensFrom(fromPackage));
 	const packageDocs = pkg?.docs === void 0 ? void 0 : toArray(pkg.docs).filter(within("docs")).map(fromPackage);
-	if (declared && outside.length) warnings.push(`${declared.name}'s onsystem config names paths outside ${declared.installed ? "the package" : "the workspace"}, which were ignored: ${outside.join(", ")}.`);
+	if (declared && outside.length) warnings.push(`The onsystem config of ${json(declared.name)} names paths outside ${declared.installed ? "the package" : "the workspace"}, which were ignored: ${outside.join(", ")}.`);
 	const inherits = pkg !== void 0 && config.components === void 0;
 	const configComponents = config.components === void 0 ? packageComponents : toArray(config.components).map(fromBase);
 	const configTokens = config.tokens === void 0 ? inherits ? packageTokens : void 0 : toArray(config.tokens).map(tokensFrom(fromBase));
@@ -3811,9 +3829,17 @@ function ownDeclaredConfig(dir) {
 	if (declared && "problem" in declared) throw new ConfigError(declared.problem);
 	return declared?.file;
 }
+/**
+* Each declaration that cannot be read, on a line of its own. The package's name is the
+* repository's text (any string can name a dependency in package.json), so it is JSON-quoted:
+* a line break or a sentence in it stays inside the quotes, on that line.
+*/
+function problemLines(problems) {
+	return problems.map((p) => `${json(p.name)}: ${p.problem}`).join("\n");
+}
 /** The error for workspace packages whose declaration cannot be read: their team can fix them. */
 function declarationError(lookup, dir) {
-	return new ConfigError(`${lookup.problems.map((p) => `${p.name}: ${p.problem}`).join("\n")}\nFix the "${PACKAGE_FIELD}" field in that package, or give ${dir} a config of its own (onsystem.config.json), which is read instead.`);
+	return new ConfigError(`${problemLines(lookup.problems)}\nFix the "${PACKAGE_FIELD}" field in that package, or give ${dir} a config of its own (onsystem.config.json), which is read instead.`);
 }
 /**
 * Whether a path or glob in a dependency's config, relative to its folder `dir`, stays in
@@ -4935,6 +4961,8 @@ function dedent(code) {
 }
 //#endregion
 //#region src/libraries/declarations.ts
+/** A component's name: a capitalised identifier (`Button`, `ButtonBase`, `Unstable_Grid2`). */
+const COMPONENT_NAME = /^[A-Z][\w$]*$/;
 /** Packages contributing more props than this are summarised, as in source extraction. */
 const MAX_LISTED_INHERITED = 40;
 /**
@@ -5006,9 +5034,9 @@ function extractLibrary(options) {
 			const declaration = symbol.valueDeclaration ?? symbol.declarations?.[0];
 			const isDefault = exported.getName() === "default";
 			const name = isDefault && subpath && declaration ? ts.getNameOfDeclaration(declaration)?.getText() ?? "default" : exported.getName();
-			if (isDefault && !/^[A-Z]/.test(name)) continue;
+			if (isDefault && !COMPONENT_NAME.test(name)) continue;
 			exportNames.add(name);
-			if (!/^[A-Z]/.test(name)) continue;
+			if (!COMPONENT_NAME.test(name)) continue;
 			const known = bySymbol.get(symbol);
 			if (known) {
 				if (known.name !== name && !known.aliases.includes(name)) known.aliases.push(name);
@@ -10434,7 +10462,7 @@ function maskReferencedGradientIds(elements) {
 	for (const element of elements) if (element.tag === "mask") refsFrom(element.node);
 	return ids;
 }
-const noHardcodedColor = {
+const noHardcodedColor = shortQuotes({
 	id: "no-hardcoded-color",
 	description: "Colors must come from design tokens: no hex/rgb/oklch literals, arbitrary Tailwind colors or default-palette classes.",
 	run(context) {
@@ -10645,7 +10673,31 @@ const noHardcodedColor = {
 		}
 		reportChartTokens(context, allow);
 	}
-};
+});
+/** The longest code a message quotes. */
+const QUOTED_CODE = 120;
+/**
+* The rule, with each `code` span in its messages cut to QUOTED_CODE characters. A message quotes
+* the class, its fix and the value whole, so one class with 33,000 `hover:` variants made a
+* message of 400,000 characters for the agent to read.
+*/
+function shortQuotes(rule) {
+	const cut = (span, code) => code.length > QUOTED_CODE ? `\`${truncate(code, QUOTED_CODE)}\`` : span;
+	return {
+		...rule,
+		run(context) {
+			rule.run({
+				...context,
+				report(report) {
+					context.report({
+						...report,
+						message: report.message.replace(/`([^`]+)`/g, cut)
+					});
+				}
+			});
+		}
+	};
+}
 /** Packages that draw charts: Recharts, Chart.js, Nivo, visx, Victory, Tremor, MUI X Charts, D3. */
 const CHART_LIBRARY = /chart|^@nivo\/|^@visx\/|^victory|^@tremor\/|^d3(?:-|$)/i;
 /** Roles of an element that is a drawing: a chart drawn by hand is an image. */
@@ -11234,25 +11286,69 @@ function setsColor(utility, prefix) {
 */
 function keepStatesApart(list) {
 	const after = (listed) => listed.report?.fix?.[0]?.text ?? listed.value;
+	const order = new Map(list.map((listed, i) => [listed, i]));
+	const parsed = /* @__PURE__ */ new Map();
+	const parse = (text) => {
+		let utility = parsed.get(text);
+		if (!utility) {
+			utility = parseUtility(text);
+			parsed.set(text, utility);
+		}
+		return utility;
+	};
+	const byText = /* @__PURE__ */ new Map();
+	const byUtility = /* @__PURE__ */ new Map();
+	const utilityKey = (text) => `${parse(text).base}\0${parse(text).modifier}`;
+	const place = (listed) => {
+		const text = after(listed);
+		const same = byText.get(text) ?? [];
+		byText.set(text, same);
+		const index = order.get(listed) ?? 0;
+		same.splice(same.findLastIndex((other) => (order.get(other) ?? 0) < index) + 1, 0, listed);
+		const texts = byUtility.get(utilityKey(text)) ?? /* @__PURE__ */ new Set();
+		byUtility.set(utilityKey(text), texts.add(text));
+	};
+	const unplace = (listed) => {
+		const text = after(listed);
+		const same = byText.get(text) ?? [];
+		same.splice(same.indexOf(listed), 1);
+		if (!same.length) byUtility.get(utilityKey(text))?.delete(text);
+	};
+	for (const listed of list) place(listed);
 	for (const pass of ["state", "base"]) for (const listed of list) {
 		const { report } = listed;
 		if (!report?.fix?.[0]) continue;
-		for (const other of list) {
-			if (other === listed || oneColor(listed.color, other.color)) continue;
-			const [stateListed, baseListed] = pass === "state" ? [listed, other] : [other, listed];
-			const state = parseUtility(after(stateListed));
-			const base = parseUtility(after(baseListed));
+		const text = after(listed);
+		let found;
+		for (const otherText of byUtility.get(utilityKey(text)) ?? []) {
+			if (otherText === text) continue;
+			const [state, base] = pass === "state" ? [parse(text), parse(otherText)] : [parse(otherText), parse(text)];
 			const conditions = conditionsBetween(state, base);
-			if (!conditions || hasDarkBase(list, stateListed, baseListed, state, base, after)) continue;
-			const had = pass === "base" ? `\`${other.value}\` is in the class list too` : after(other) === other.value ? `The class list already has \`${other.value}\`` : `\`${other.value}\` becomes \`${after(other)}\` too`;
-			const apart = state.modifier ? "such as with another opacity modifier" : `such as with \`${withBase({
-				...state,
-				modifier: "/90"
-			}, state.base)}\``;
-			report.message += ` ${had}, so with this fix \`${conditions}\` would change nothing: it is not applied automatically. Keep the two apart, ${apart}.`;
-			report.fix = void 0;
-			break;
+			if (!conditions) continue;
+			for (const other of byText.get(otherText) ?? []) {
+				if (found && (order.get(other) ?? 0) > (order.get(found.other) ?? 0)) break;
+				if (oneColor(listed.color, other.color)) continue;
+				const [stateListed, baseListed] = pass === "state" ? [listed, other] : [other, listed];
+				if (hasDarkBase(list, stateListed, baseListed, state, base, after)) continue;
+				found = {
+					other,
+					state,
+					conditions
+				};
+				break;
+			}
 		}
+		if (!found) continue;
+		const { other, state, conditions } = found;
+		const had = pass === "base" ? `\`${other.value}\` is in the class list too` : after(other) === other.value ? `The class list already has \`${other.value}\`` : `\`${other.value}\` becomes \`${after(other)}\` too`;
+		const apart = state.modifier ? "such as with another opacity modifier" : `such as with \`${withBase({
+			...state,
+			modifier: "/90"
+		}, state.base)}\``;
+		report.message += ` ${had}, so with this fix \`${conditions}\` would change nothing: it is not applied automatically. Keep the two apart, ${apart}.`;
+		unplace(listed);
+		report.fix = void 0;
+		place(listed);
 	}
 }
 /**
@@ -11432,7 +11528,8 @@ function scopes(context, element, classes) {
 		if (name && !/^Sidebar(?:Provider|Inset)$/.test(name)) tags.push(name);
 	}
 	const { tokens, components } = context.target;
-	const found = scopesIn(tokens.scopedFamilies, context.file, classes, ...tags);
+	const found = scopesIn(tokens.scopedFamilies, context.file, ...tags);
+	if (classes) for (const family of classScopes(context, classes)) found.add(family);
 	const files = /* @__PURE__ */ new Set([context.file]);
 	for (const tag of tags) {
 		const file = components.get(tag)?.source.file;
@@ -11444,6 +11541,25 @@ function scopes(context, element, classes) {
 	}
 	return found;
 }
+/** The scoped families each class string of a check names, by its text. */
+const classScopeCache = /* @__PURE__ */ new WeakMap();
+/**
+* The scoped families a class string names, read once per string and check: each color in it
+* asks, and reading the whole string again for each made a list of thousands quadratic.
+*/
+function classScopes(context, classes) {
+	let cache = classScopeCache.get(context.analysis);
+	if (!cache) {
+		cache = /* @__PURE__ */ new Map();
+		classScopeCache.set(context.analysis, cache);
+	}
+	let found = cache.get(classes);
+	if (!found) {
+		found = scopesIn(context.target.tokens.scopedFamilies, classes);
+		cache.set(classes, found);
+	}
+	return found;
+}
 /** The variant prop of the element's component that already sets `prefix-*` classes, if any. */
 function variantProp(context, element, prefix) {
 	const resolution = context.resolve(element);
@@ -11466,7 +11582,7 @@ function numberValue(init) {
 	if (ts.isPrefixUnaryExpression(init) && ts.isNumericLiteral(init.operand) && (init.operator === ts.SyntaxKind.MinusToken || init.operator === ts.SyntaxKind.PlusToken)) return `${init.operator === ts.SyntaxKind.MinusToken ? "-" : ""}${init.operand.text}`;
 }
 function lengthRule(id, description, spec) {
-	return {
+	return shortQuotes({
 		id,
 		description,
 		run(context) {
@@ -11538,7 +11654,7 @@ function lengthRule(id, description, spec) {
 				}
 			}
 		}
-	};
+	});
 }
 /**
 * A value on the scale whose token code cannot name, with neither a Tailwind class nor a
@@ -12021,7 +12137,7 @@ function isObject(value) {
 var name = "onsystem";
 //#endregion
 //#region src/version.ts
-const VERSION = "0.10.0";
+const VERSION = "0.10.1";
 const NAME = name;
 //#endregion
 //#region src/lint/sarif.ts
@@ -12244,7 +12360,7 @@ function checkSource(code, target, options) {
 	try {
 		return checkParsed(code, target, options, file);
 	} catch (error) {
-		if (!isStackOverflow(error)) throw error;
+		if (!isStackOverflow$1(error)) throw error;
 		return {
 			file,
 			diagnostics: [{
@@ -12262,7 +12378,7 @@ function checkSource(code, target, options) {
 		};
 	}
 }
-function isStackOverflow(error) {
+function isStackOverflow$1(error) {
 	return error instanceof RangeError && /call stack/i.test(error.message);
 }
 function checkParsed(code, target, options, file) {
@@ -12386,7 +12502,7 @@ function uncheckedNotice(results) {
 	const list = [...names];
 	const shown = list.slice(0, 4).map((n) => `<${n}>`);
 	const more = list.length > shown.length ? ` and ${list.length - shown.length} more` : "";
-	const from = [...modules].slice(0, 3).map((m) => `"${m}"`);
+	const from = [...modules].slice(0, 3).map((m) => JSON.stringify(m));
 	const moreModules = modules.size > from.length ? ` and ${modules.size - from.length} more` : "";
 	const where = results.length > 1 ? ` (in ${files} ${files === 1 ? "file" : "files"})` : "";
 	return `${shown.join(", ")}${more} ${list.length === 1 ? "comes" : "come"} from ${from.join(", ")}${moreModules}, which the design-system model does not include, so ${list.length === 1 ? "it was" : "they were"} not checked${where}. Extraction looks incomplete: \`inspect\` lists what was found; add the missing files to "components" in the config.`;
@@ -13103,6 +13219,38 @@ function repositoryOf(dir) {
 		if (current === path.dirname(current)) return void 0;
 	}
 }
+/**
+* `extractComponents`, without the component files nested too deeply for TypeScript's recursive
+* parser (thousands of levels), each named in a warning: one such file would otherwise fail the
+* whole design system with a RangeError that names no file.
+*/
+function extractReadable(options) {
+	try {
+		return extractComponents(options);
+	} catch (error) {
+		if (!isStackOverflow(error)) throw error;
+		const tooDeep = new Set(options.files.filter(overflowsParser));
+		if (!tooDeep.size) throw error;
+		const extracted = extractComponents({
+			...options,
+			files: options.files.filter((file) => !tooDeep.has(file))
+		});
+		for (const file of tooDeep) extracted.warnings.push(`${relativePath(options.root, file)}: nested too deeply to read (thousands of levels); skipped.`);
+		return extracted;
+	}
+}
+/** Whether parsing `file` on its own runs out of stack. */
+function overflowsParser(file) {
+	try {
+		ts.createSourceFile(file, fs.readFileSync(file, "utf8"), ts.ScriptTarget.Latest);
+		return false;
+	} catch (error) {
+		return isStackOverflow(error);
+	}
+}
+function isStackOverflow(error) {
+	return error instanceof RangeError && /call stack/i.test(error.message);
+}
 /** What `inspect` and the server's log say about files that lead outside the project. */
 function outsideWarning(root, files) {
 	const shown = files.map((file) => relativePath(root, file)).sort();
@@ -13250,11 +13398,54 @@ async function cacheKey(config, files, dependencies, stats = new FileStats(confi
 		stats: await stats.of(all)
 	})).digest("hex");
 }
+/**
+* Where the model is cached: the project's `node_modules/.cache`, else (`temp`) a folder of the
+* user's own in the system temp folder, `onsystem-<uid>`.
+*/
 function cacheFile(root) {
 	const nodeModules = path.join(root, "node_modules");
-	if (fs.existsSync(nodeModules)) return path.join(nodeModules, ".cache", "onsystem", "model.json");
+	if (fs.existsSync(nodeModules)) return {
+		file: path.join(nodeModules, ".cache", "onsystem", "model.json"),
+		temp: false
+	};
 	const id = createHash("sha256").update(root).digest("hex").slice(0, 16);
-	return path.join(os.tmpdir(), "onsystem", `${id}.json`);
+	const user = process.getuid ? `-${process.getuid()}` : "";
+	return {
+		file: path.join(os.tmpdir(), `onsystem${user}`, `${id}.json`),
+		temp: true
+	};
+}
+/**
+* Why the cache folder in the system temp folder cannot be trusted, or undefined when it can: it
+* must be a folder, not a link, that the user owns and no one else can write to. On a multi-user
+* host the temp folder is shared, and a model planted in it would reach the agent. With `create`,
+* it is created (or closed) for the user first. Windows gives each user a temp folder of their own.
+*/
+async function untrustedCacheFolder(folder, create) {
+	if (!process.getuid) return void 0;
+	if (create) await fsp.mkdir(folder, {
+		recursive: true,
+		mode: 448
+	});
+	const stat = await fsp.lstat(folder);
+	if (!stat.isDirectory()) return `${folder} is not a folder`;
+	if (stat.uid !== process.getuid()) return `${folder} belongs to another user`;
+	if (!create && stat.mode & 18) return `other users can write to ${folder}`;
+	if (create && stat.mode & 63) await fsp.chmod(folder, 448);
+}
+/**
+* Writes `text` beside `file`, then renames it into place: a run reading it never sees half. With
+* `own`, only the user can read it (the temp folder's cache); without, it has the default mode, so
+* a cache in `node_modules` built by one user (a Docker build as root) is still read by another.
+*/
+async function writeWhole(file, text, own) {
+	const partial = `${file}.${process.pid}-${randomUUID()}.tmp`;
+	try {
+		await fsp.writeFile(partial, text, own ? { mode: 384 } : {});
+		await fsp.rename(partial, file);
+	} finally {
+		await fsp.rm(partial, { force: true });
+	}
 }
 /**
 * Fingerprint of the files a config tracks (paths, sizes, mtimes), plus the
@@ -13268,10 +13459,10 @@ async function buildModel(config, options = {}) {
 	const started = performance.now();
 	const files = await resolveFiles(config);
 	const useCache = options.cache !== false;
-	const cachePath = cacheFile(config.root);
+	const { file: cachePath, temp } = cacheFile(config.root);
 	let cached;
 	if (useCache && !options.oldProgram) try {
-		cached = JSON.parse(await fsp.readFile(cachePath, "utf8"));
+		if (!(temp && await untrustedCacheFolder(path.dirname(cachePath), false))) cached = JSON.parse(await fsp.readFile(cachePath, "utf8"));
 	} catch {}
 	const known = Array.isArray(cached?.dependencies) ? cached.dependencies : options.oldProgram ? projectFiles(options.oldProgram) : [];
 	const stats = new FileStats(config.root);
@@ -13285,7 +13476,7 @@ async function buildModel(config, options = {}) {
 			dependencies: cached.dependencies
 		};
 	}
-	const extracted = extractComponents({
+	const extracted = extractReadable({
 		root: config.root,
 		files: files.components,
 		tsconfig: config.tsconfig,
@@ -13347,12 +13538,16 @@ async function buildModel(config, options = {}) {
 	]);
 	const key = await cacheKey(config, files, dependencies, stats);
 	if (useCache) try {
-		await fsp.mkdir(path.dirname(cachePath), { recursive: true });
-		await fsp.writeFile(cachePath, JSON.stringify({
+		const folder = path.dirname(cachePath);
+		let untrusted;
+		if (temp) untrusted = await untrustedCacheFolder(folder, true);
+		else await fsp.mkdir(folder, { recursive: true });
+		if (untrusted) logger.warn(`not caching the model: ${untrusted}. Install the project's dependencies, so the cache goes in node_modules, or set TMPDIR to a folder of your own.`);
+		else await writeWhole(cachePath, JSON.stringify({
 			key,
 			dependencies,
 			model
-		}));
+		}), temp);
 	} catch (error) {
 		logger.warn(`could not write cache ${cachePath}: ${error.message}`);
 	}
@@ -13535,4 +13730,4 @@ var DesignSystemHost = class {
 	}
 };
 //#endregion
-export { DEFAULT_TOKENS as $, unrecordedRules as A, isInside as At, statusKinds as B, countBaseline as C, workspacePackageDirs as Ct, pruneBaseline as D, truncate as Dt, onLines as E, plural$1 as Et, loadTokens as F, readProjectConfig as Ft, parseDoc as G, parseDesignMd as H, mergeTokens as I, ConfigError as J, extractComponents as K, toDesignMd as L, writeBaseline as M, relativePath as Mt, RULES as N, toPosix as Nt, readBaseline as O, unique as Ot, TokenIndex as P, defaultProjectConfig as Pt, DEFAULT_TEST_FOLDERS as Q, toDtcg as R, applyBaseline as S, isWorkspaceRoot as St, goneFiles as T, closest as Tt, parseCssTokens as U, parseDtcgTokens as V, attachDocs as W, DEFAULT_SEVERITY as X, DEFAULT_DOCS as Y, DEFAULT_TEST_EXCLUDE as Z, formatDiagnostics as _, PackageFinder as _t, fingerprint as a, excludedBy as at, BASELINE_FILE as b, findDesignSystemPackage as bt, silentLogger as c, loadConfigWith as ct, descriptionOf as d, findVariantDefinitions as dt, FALLBACK_TOKENS as et, searchComponents as f, LIBRARIES as ft, escapeData as g, PACKAGE_FIELD as gt, uncheckedNotice as h, notReadYet as ht, componentFiles as i, defineConfig as it, updateBaseline as j, matchesGlob as jt, rulesRun as k, SCRIPT_FILE$2 as kt, stderrLogger as l, rulesFor as lt, checkSource as m, libraryTitle as mt, DesignSystemHost as n, RULE_IDS as nt, loadDesignSystem as o, hasOwnConfig as ot, applyFixes as p, LIBRARY_IDS as pt, CONFIG_FILES as q, buildModel as r, configJsonSchema as rt, tokenFiles as s, loadConfig as st, DesignSystem as t, LEGACY_CONFIG_FILES as tt, buildSearchIndex as u, formatPx as ut, NAME as v, declaredConfig as vt, findMoves as w, workspacePatterns as wt, LEGACY_BASELINE_FILE as x, isDesignSystemName as xt, VERSION as y, detectProject as yt, TOKEN_CATEGORIES as z };
+export { DEFAULT_TOKENS as $, unrecordedRules as A, toPosix as At, statusKinds as B, countBaseline as C, workspacePackageDirs as Ct, pruneBaseline as D, matchesGlob as Dt, onLines as E, isInside as Et, loadTokens as F, unique as Ft, parseDoc as G, parseDesignMd as H, mergeTokens as I, defaultProjectConfig as It, ConfigError as J, extractComponents as K, toDesignMd as L, readProjectConfig as Lt, writeBaseline as M, json as Mt, RULES as N, plural$1 as Nt, readBaseline as O, pathOf as Ot, TokenIndex as P, truncate as Pt, DEFAULT_TEST_FOLDERS as Q, toDtcg as R, applyBaseline as S, isWorkspaceRoot as St, goneFiles as T, SCRIPT_FILE$2 as Tt, parseCssTokens as U, parseDtcgTokens as V, attachDocs as W, DEFAULT_SEVERITY as X, DEFAULT_DOCS as Y, DEFAULT_TEST_EXCLUDE as Z, formatDiagnostics as _, PackageFinder as _t, fingerprint as a, excludedBy as at, BASELINE_FILE as b, findDesignSystemPackage as bt, silentLogger as c, loadConfigWith as ct, descriptionOf as d, findVariantDefinitions as dt, FALLBACK_TOKENS as et, searchComponents as f, LIBRARIES as ft, escapeData as g, PACKAGE_FIELD as gt, uncheckedNotice as h, notReadYet as ht, componentFiles as i, defineConfig as it, updateBaseline as j, closest as jt, rulesRun as k, relativePath as kt, stderrLogger as l, rulesFor as lt, checkSource as m, libraryTitle as mt, DesignSystemHost as n, RULE_IDS as nt, loadDesignSystem as o, hasOwnConfig as ot, applyFixes as p, LIBRARY_IDS as pt, CONFIG_FILES as q, buildModel as r, configJsonSchema as rt, tokenFiles as s, loadConfig as st, DesignSystem as t, LEGACY_CONFIG_FILES as tt, buildSearchIndex as u, formatPx as ut, NAME as v, declaredConfig as vt, findMoves as w, workspacePatterns as wt, LEGACY_BASELINE_FILE as x, isDesignSystemName as xt, VERSION as y, detectProject as yt, TOKEN_CATEGORIES as z };

package/dist/eslint-worker.js

@@ -1,5 +1,5 @@
-import { Mt as relativePath, at as excludedBy, i as componentFiles, r as buildModel } from "./design-system-D53Jxybo.js";
-import { r as loadTarget } from "./workspace-DAa_08uB.js";
+import { at as excludedBy, i as componentFiles, kt as relativePath, r as buildModel } from "./design-system-CPH4C7-1.js";
+import { r as loadTarget } from "./workspace-BINqxi7p.js";
 import fs from "node:fs";
 import path from "node:path";
 import { parentPort } from "node:worker_threads";

package/dist/eslint.js

@@ -1,4 +1,4 @@
-import { Mt as relativePath, N as RULES, Q as DEFAULT_TEST_FOLDERS, X as DEFAULT_SEVERITY, Z as DEFAULT_TEST_EXCLUDE, t as DesignSystem, v as NAME, y as VERSION } from "./design-system-D53Jxybo.js";
+import { N as RULES, Q as DEFAULT_TEST_FOLDERS, X as DEFAULT_SEVERITY, Z as DEFAULT_TEST_EXCLUDE, kt as relativePath, t as DesignSystem, v as NAME, y as VERSION } from "./design-system-CPH4C7-1.js";
 import path from "node:path";
 import { MessageChannel, Worker, receiveMessageOnPort } from "node:worker_threads";
 //#region src/eslint/bridge.ts

package/dist/index.d.ts

@@ -826,7 +826,7 @@ interface CreateServerOptions {
   getProjects?: (target?: string) => Promise<ProjectSet | undefined>;
 }
 /** Builds the MCP server: five tools, two resources and one prompt. Transport-agnostic. */
-export declare function createServer({ getDesignSystem, getProjects }: CreateServerOptions): McpServer;
+export declare function createServer(options: CreateServerOptions): McpServer;
 //#endregion
 //#region src/server/stdio.d.ts
 interface ServeOptions extends LoadConfigOptions {