onsystem 0.5.0 → 0.7.0

package/dist/cli.js

@@ -1,109 +1,31 @@
 #!/usr/bin/env node
-import { $ as plural, C as updateBaseline, F as CONFIG_FILES, H as RULE_IDS, I as ConfigError, J as detectProject, K as rulesFor, L as DEFAULT_DOCS, R as DEFAULT_SEVERITY, S as readBaseline, V as LEGACY_CONFIG_FILES, _ as VERSION, at as toPosix, b as applyBaseline, c as silentLogger, g as NAME, h as formatDiagnostics, i as componentFiles, it as relativePath, l as stderrLogger, m as uncheckedNotice, nt as isInside, o as loadDesignSystem, rt as matchesGlob, s as tokenFiles, tt as unique, v as BASELINE_FILE, w as writeBaseline, x as countBaseline, y as LEGACY_BASELINE_FILE } from "./design-system-CnEv5sIL.js";
-import { t as serveStdio } from "./stdio-DjfkiDMV.js";
-import { r as loadTarget } from "./workspace-DzWQ4L8R.js";
+import { C as pruneBaseline, Ct as relativePath, D as updateBaseline, E as unrecordedRules, H as CONFIG_FILES, J as LEGACY_CONFIG_FILES, N as toDesignMd, O as writeBaseline, P as toDtcg, S as countBaseline, St as matchesGlob, T as rulesRun, U as ConfigError, W as DEFAULT_DOCS, Y as RULE_IDS, _ as NAME, b as LEGACY_BASELINE_FILE, bt as unique, c as silentLogger, ct as PACKAGE_FIELD, dt as detectProject, g as formatDiagnostics, h as escapeData, i as componentFiles, l as stderrLogger, m as uncheckedNotice, o as loadDesignSystem, ot as libraryTitle, pt as isDesignSystemName, s as tokenFiles, st as notReadYet, tt as rulesFor, ut as declaredConfig, v as VERSION, vt as plural, w as readBaseline, wt as toPosix, x as applyBaseline, xt as isInside, y as BASELINE_FILE } from "./design-system-C4bhqLLw.js";
+import { a as notReadNotices, i as missingDependencies, o as explainProject, s as librariesLeftOut, t as serveStdio } from "./stdio-BojAQ6JP.js";
+import { r as loadTarget } from "./workspace-Z0tZf_Dv.js";
 import fs from "node:fs";
 import path from "node:path";
 import { escapePath, glob } from "tinyglobby";
-import fs$1 from "node:fs/promises";
+import fsp from "node:fs/promises";
 import { spawnSync } from "node:child_process";
 import readline from "node:readline/promises";
 import { parseArgs } from "node:util";
-//#region src/explain.ts
-/**
-* What `inspect --explain` says about one project: every candidate zero config looked
-* at and why each was taken or not, the config it resolved to, tokens whose value did
-* not resolve, and components without props, with the likely reason.
-*/
-function explainProject(ds, cwd, indent = "") {
-	const { config, model } = ds;
-	const lines = [];
-	const out = (line = "") => lines.push(line ? `${indent}${line}` : "");
-	out("How the design system was found");
-	if (config.configured) out(`  components come from ${config.configFile ? display(cwd, config.configFile) : "--components"}, so zero config did not look`);
-	else {
-		const steps = [];
-		detectProject(config.root, config.tsconfig, steps);
-		for (const step of steps) out(`  ${(step.accepted ? "found" : "no").padEnd(6)} ${step.candidate}: ${step.reason}`);
-		if (!config.detected) out(`  So the defaults apply: ${config.components.join(", ")}${model.stats.files.components ? "" : ", which match nothing"}.`);
-	}
-	out();
-	out("Resolved config");
-	const field = (name, value) => out(`  ${name.padEnd(12)} ${value}`);
-	field("root", config.root);
-	field("config", config.configFile ? display(cwd, config.configFile) : "(none)");
-	field("components", listOf$1(config.components) || "(none)");
-	field("exclude", listOf$1(config.exclude));
-	field("tokens", listOf$1(config.tokens.map((t) => `${t.path}${t.prefix ? ` (prefix ${t.prefix})` : ""}`)));
-	field("docs", listOf$1(config.docs));
-	field("tsconfig", config.tsconfig ?? (fs.existsSync(path.join(config.root, "tsconfig.json")) ? "tsconfig.json" : "(none)"));
-	field("importPath", importPaths(ds));
-	if (config.tailwindConfig) field("tailwind", display(config.root, config.tailwindConfig));
-	if (config.designSystems) field("primary", config.designSystems.map((d, i) => `${i ? "then " : ""}${d.source} (${d.imports} imports)`).join("; "));
-	const changed = RULE_IDS.filter((id) => config.rules[id].severity !== DEFAULT_SEVERITY[id]);
-	field("rules", `${RULE_IDS.map((id) => `${id} ${config.rules[id].severity}`).join(", ")}${changed.length ? ` (changed: ${changed.join(", ")})` : ""}`);
-	if (config.overrides?.length) for (const override of config.overrides) field("override", `${override.files.join(", ")}: ${Object.entries(override.rules).map(([id, rule]) => `${id} ${rule.severity}`).join(", ")}`);
-	if (config.base) field("relative to", `${config.base} (a config at the workspace root)`);
-	out();
-	out("Tokens");
-	const found = ds.tokens;
-	const files = model.stats.files.tokens;
-	out(`  ${found.length} tokens from ${files} ${files === 1 ? "file" : "files"}${files ? "" : `: no file matches ${config.tokens.map((t) => t.path).join(", ")}`}`);
-	const defined = new Set(found.map((t) => t.cssVar).filter((v) => Boolean(v)));
-	const missing = (value) => [...value.matchAll(/var\(\s*(--[\w-]+)/g)].map((m) => m[1] ?? "").filter((v) => !defined.has(v));
-	const unresolved = found.filter((t) => missing(t.value).length);
-	if (unresolved.length) out(`  ${unresolved.length} unresolved, reading a custom property no token file defines: ${unresolved.slice(0, 8).map((t) => `${t.cssVar ?? t.name}: ${t.value}`).join(", ")}${unresolved.length > 8 ? `, and ${unresolved.length - 8} more` : ""}`);
-	else if (found.length) out("  every value resolves");
-	for (const warning of model.warnings.filter((w) => /alias|token/i.test(w))) out(`  ${warning}`);
-	out();
-	out("Props");
-	const empty = ds.roots().filter((c) => c.openProps && !c.props.length && !c.inherits.length);
-	const open = ds.components.filter((c) => c.openProps);
-	if (!open.length) out(`  every component's props resolved (${ds.components.length} components)`);
-	else {
-		const installed = nodeModulesFor(config.root);
-		const names = (list) => `${list.slice(0, 6).map((c) => c.name).join(", ")}${list.length > 6 ? ` and ${list.length - 6} more` : ""}`;
-		if (empty.length) out(`  ${empty.length} ${empty.length === 1 ? "component has" : "components have"} 0 props: ${names(empty)}.`);
-		out(`  ${open.length} ${open.length === 1 ? "component has" : "components have"} props that did not fully resolve${empty.length === open.length ? "" : `: ${names(open)}`}, so no-unknown-prop skips ${open.length === 1 ? "it" : "them"}.`);
-		out(installed ? `  Dependencies are installed (${display(cwd, installed)}): a package without types, a type error, or a props type that depends on a type argument leaves them open.` : `  The dependencies are not installed: no node_modules in ${config.root} or a folder above it. Their props come from the packages they wrap (Radix, React Aria), so install them (npm install, pnpm install) and run again.`);
-	}
-	return lines;
-}
-/** The first few, then how many more: a package's exports can name hundreds of files. */
-function listOf$1(items, max = 8) {
-	const shown = items.slice(0, max).join(", ");
-	return items.length > max ? `${shown}, and ${items.length - max} more` : shown;
-}
-/** How components are suggested to be imported. */
-function importPaths(ds) {
-	if (ds.config.importPath) return `${ds.config.importPath} (from the config)`;
-	const counts = /* @__PURE__ */ new Map();
-	for (const c of ds.roots()) counts.set(c.importPath, (counts.get(c.importPath) ?? 0) + 1);
-	const top = [...counts].sort((a, b) => b[1] - a[1]).slice(0, 3);
-	const from = ds.config.imports?.length ? "package exports" : "tsconfig paths or relative paths";
-	return top.length ? `inferred from ${from}: ${top.map(([p, n]) => `${p} (${n})`).join(", ")}${counts.size > 3 ? `, and ${counts.size - 3} more` : ""}` : `inferred from ${from}`;
-}
-/** The nearest node_modules at or above `dir`, if any. */
-function nodeModulesFor(dir) {
-	for (let current = path.resolve(dir);; current = path.dirname(current)) {
-		const candidate = path.join(current, "node_modules");
-		if (fs.existsSync(candidate)) return candidate;
-		if (current === path.dirname(current)) return void 0;
-	}
-}
-function display(cwd, file) {
-	const rel = relativePath(cwd, file);
-	return rel && !rel.startsWith("..") ? rel : file;
-}
-//#endregion
 //#region src/init.ts
 const SCHEMA = "https://unpkg.com/onsystem/schema.json";
 /** More detected globs than this are files, not folders: zero config keeps them. */
 const MAX_GLOBS = 6;
+/** What a design-system package's apps are told about it, next to its config. */
+const GUIDE_FILE = "ONSYSTEM.md";
 /**
 * Writes `onsystem.config.json` in the root from what zero config finds there, or from
 * the answers to up to three questions when it finds nothing, then checks the project
 * once without failing and offers to record what it found as the baseline.
+*
+* In a design-system package (one zero config reads through its own `exports`, or named like
+* one, as apps look for it), it also declares the config in package.json
+* (`"onsystem": "./onsystem.config.json"`, and in `files` when the package lists them), so
+* every app that depends on the package reads it, and writes ONSYSTEM.md, which tells those
+* apps' teams how to add the agent tools and the CI check. In an app that takes on such a
+* package's config, it writes no config of its own unless --force says to.
 */
 async function init(configOptions, options, io, runCheck) {
 	const { config, workspace } = await loadTarget({
@@ -111,16 +33,24 @@ async function init(configOptions, options, io, runCheck) {
 		config: void 0
 	});
 	const root = config.root;
-	const existing = [...CONFIG_FILES, ...LEGACY_CONFIG_FILES].map((name) => path.join(root, name)).find((file) => fs.existsSync(file));
+	const declared = declaredConfig(root);
+	const existing = [...CONFIG_FILES, ...LEGACY_CONFIG_FILES].map((name) => path.join(root, name)).find((file) => fs.existsSync(file)) ?? (declared && "file" in declared ? declared.file : void 0);
+	const manifest = readManifest(root);
+	const name = typeof manifest?.json.name === "string" ? manifest.json.name : void 0;
+	const designSystem = !workspace && !config.designSystemPackage && name !== void 0 && (config.detected?.startsWith("package.json exports of") === true || isDesignSystemName(name));
 	if (existing && !options.force) {
-		io.stderr(`init: ${relativePath(io.cwd, existing) || existing} already exists. Run \`${NAME} inspect --explain\` to see what it resolves to, or pass --force to write a new onsystem.config.json.`);
+		const share = designSystem && !declared && existing.endsWith(".json") ? ` To share it with the apps that depend on ${name}, add "${PACKAGE_FIELD}": "./${path.basename(existing)}" to package.json, and to "files" when it lists them (https://onsystem.vercel.app/docs/design-system-packages).` : "";
+		io.stderr(`init: ${relativePath(io.cwd, existing) || existing} already exists. Run \`${NAME} inspect --explain\` to see what it resolves to, or pass --force to write a new onsystem.config.json.${share}`);
 		return 2;
 	}
 	const ask = options.yes ? void 0 : io.prompt;
 	const file = { $schema: SCHEMA };
 	const notes = [];
 	const relative = (abs) => relativePath(root, abs);
-	if (configOptions.components?.length) {
+	const inherited = options.force ? void 0 : config.designSystemPackage;
+	const replaced = options.force ? config.designSystemPackage : void 0;
+	if (inherited) notes.push(`This project takes on the config ${inherited.name} declares in its package.json (${relativePath(io.cwd, inherited.config) || inherited.config}), so it needs none of its own; nothing was written. Pass --force to write one, which is read instead.`);
+	else if (configOptions.components?.length) {
 		file.components = configOptions.components;
 		if (configOptions.tokens?.length) file.tokens = configOptions.tokens;
 		if (configOptions.docs?.length) file.docs = configOptions.docs;
@@ -133,11 +63,24 @@ async function init(configOptions, options, io, runCheck) {
 		else if (config.components.length > MAX_GLOBS) notes.push(`"components" is left to zero config: it found ${config.components.length} files through the package's exports, which it keeps following as the package changes.`);
 		else {
 			file.components = config.components;
-			if ([...specifiers][0]) file.importPath = [...specifiers][0];
+			const [specifier] = specifiers;
+			if (specifier && !specifier.includes("*")) file.importPath = specifier;
 			const docs = config.docs.filter((d) => !DEFAULT_DOCS.includes(d));
 			if (docs.length) file.docs = [...DEFAULT_DOCS, ...docs];
 		}
 		if (tokens.length) file.tokens = tokens;
+	} else if ((await componentFiles(config)).length) {
+		const declared = replaced && config.configured;
+		const matching = [];
+		for (const glob of config.components) if ((await componentFiles({
+			...config,
+			components: [glob]
+		})).length) matching.push(glob);
+		notes.push(declared ? `Found the design system through the config ${replaced.name} declares: ${matching.join(", ")}.` : `Found the design system in the default folders: ${matching.join(", ")}.`);
+		file.components = matching;
+		if (declared && config.importPath) file.importPath = config.importPath;
+		const tokens = (await tokenFiles(config)).map(relative);
+		if (tokens.length) file.tokens = tokens;
 	} else {
 		if (!ask) {
 			io.stderr(`init: zero config found no design system in ${root}. Pass --components (and --tokens) to say where it is, or run init in a terminal to answer a few questions. \`${NAME} inspect --explain\` shows what it looked at.`);
@@ -167,10 +110,27 @@ async function init(configOptions, options, io, runCheck) {
 		const importPath = (await ask("How do apps import them? A package name such as @acme/ui, or leave it empty for tsconfig paths: ")).trim();
 		if (importPath) file.importPath = importPath;
 	}
-	const out = path.join(root, "onsystem.config.json");
-	fs.writeFileSync(out, `${JSON.stringify(file, null, 2)}\n`);
+	const written = [];
+	if (!inherited) {
+		const out = path.join(root, CONFIG_FILE);
+		fs.writeFileSync(out, `${JSON.stringify(file, null, 2)}\n`);
+		written.push(CONFIG_FILE);
+	}
+	if (replaced) {
+		const own = (await loadTarget({
+			...configOptions,
+			config: void 0
+		})).config;
+		notes.push(await replacedNote(replaced, config, own, io.cwd));
+	}
+	let registry;
+	if (designSystem && manifest && name) {
+		written.push(...declarePackage(root, manifest, name, options.force, notes));
+		registry = await unshipped(config, manifest.json);
+		if (registry) notes.push(...registry.notes);
+	}
 	for (const note of notes) io.stdout(note);
-	io.stdout(`Wrote ${relativePath(io.cwd, out) || out}.`);
+	if (written.length) io.stdout(`Wrote ${written.map((f) => relativePath(io.cwd, path.join(root, f)) || f).join(", ")}.`);
 	const checkIo = {
 		...io,
 		cwd: root
@@ -202,9 +162,11 @@ async function init(configOptions, options, io, runCheck) {
 	io.stdout(total ? `Dry run of \`${NAME} check .\`: ${count$1(errors, "error")} and ${count$1(warnings, "warning")} in ${flagged} of ${count$1(results.length, "file")}. By rule: ${[...byRule].sort((a, b) => b[1] - a[1]).map(([rule, n]) => `${rule} ${n.toLocaleString("en-US")}`).join(", ")}.` : `Dry run of \`${NAME} check .\`: no problems in ${count$1(results.length, "file")}.`);
 	for (const line of dry.stderr.split("\n").filter(Boolean)) io.stdout(line);
 	const hasBaseline = [BASELINE_FILE, LEGACY_BASELINE_FILE].some((name) => fs.existsSync(path.join(root, name)));
+	let baselineWritten = false;
 	if (total && !hasBaseline) {
-		const answer = options.yes ? "y" : ask ? (await ask(`Record these ${total.toLocaleString("en-US")} findings in ${BASELINE_FILE}, so check fails only on new ones? [Y/n] `)).trim().toLowerCase() : "n";
-		if (answer === "" || answer.startsWith("y")) {
+		const answer = options.yes ? "y" : ask ? (await ask(`Record these ${total.toLocaleString("en-US")} findings in ${BASELINE_FILE}, so check fails only on new ones? [Y/n] `)).trim().toLowerCase() : void 0;
+		if (answer === void 0) io.stdout(`No terminal to ask in, so the baseline question was skipped and no baseline was written; \`${NAME} check . --update-baseline\` records one.`);
+		else if (answer === "" || answer.startsWith("y")) {
 			const recorded = await runCheck([
 				"check",
 				".",
@@ -212,14 +174,201 @@ async function init(configOptions, options, io, runCheck) {
 				...options.cache ? [] : ["--no-cache"]
 			], checkIo);
 			if (recorded.stdout) io.stdout(recorded.stdout);
+			baselineWritten = fs.existsSync(path.join(root, BASELINE_FILE));
 		} else io.stdout(`No baseline written; \`${NAME} check . --update-baseline\` records one later.`);
 	}
-	io.stdout(`Next: commit onsystem.config.json${total && !hasBaseline ? ` and ${BASELINE_FILE}` : ""}, and run \`npx ${NAME} check . --format github --require-design-system\` in CI.`);
+	const commit = [...written, ...baselineWritten ? [BASELINE_FILE] : []];
+	const files = commit.length > 1 ? `${commit.slice(0, -1).join(", ")} and ${commit.at(-1) ?? ""}` : commit[0];
+	io.stdout(designSystem && name ? registry ? `Next: commit ${files}. A workspace app that depends on ${name} now finds it with no config of its own: run \`npx ${NAME} inspect\` in one to see it, and give its team ${GUIDE_FILE}. An app that installs ${name} from a registry ${registry.next}.` : `Next: commit ${files}. An app that depends on ${name} now finds it with no config of its own: run \`npx ${NAME} inspect\` in one to see it, and give its team ${GUIDE_FILE}.` : `Next: ${files ? `commit ${files}, and ` : ""}run \`npx ${NAME} check . --format github --require-design-system\` in CI.`);
 	return 0;
 }
+const CONFIG_FILE = "onsystem.config.json";
+function readManifest(root) {
+	const file = path.join(root, "package.json");
+	try {
+		const text = fs.readFileSync(file, "utf8");
+		const json = JSON.parse(text);
+		if (!json || typeof json !== "object" || Array.isArray(json)) return void 0;
+		return {
+			file,
+			json,
+			indent: /^([ \t]+)"/m.exec(text)?.[1] ?? "  ",
+			newline: text.endsWith("\n")
+		};
+	} catch {
+		return;
+	}
+}
+/**
+* Declares the config in the package's package.json, `"onsystem": "./onsystem.config.json"`,
+* and adds it to `files` when the package lists the files it publishes, so apps that install it
+* get it too. Writes ONSYSTEM.md for the apps' teams unless one exists. Returns what it wrote.
+*/
+function declarePackage(root, manifest, name, force, notes) {
+	const written = [];
+	const { json } = manifest;
+	const value = `./${CONFIG_FILE}`;
+	let changed = false;
+	if (json["onsystem"] !== value) {
+		json[PACKAGE_FIELD] = value;
+		changed = true;
+	}
+	const files = Array.isArray(json.files) ? json.files : void 0;
+	if (files && !ships(files, CONFIG_FILE)) {
+		files.push(CONFIG_FILE);
+		changed = true;
+	}
+	if (changed) {
+		fs.writeFileSync(manifest.file, `${JSON.stringify(json, null, manifest.indent)}${manifest.newline ? "\n" : ""}`);
+		written.push("package.json");
+	}
+	notes.push(`This is a design-system package: package.json declares its config ("${PACKAGE_FIELD}": "${value}"${files ? ", also added to \"files\"" : ""}), which every app that depends on ${name} reads when it has no config of its own.`);
+	const guide = path.join(root, GUIDE_FILE);
+	if (force || !fs.existsSync(guide)) {
+		fs.writeFileSync(guide, consumerGuide(name));
+		written.push(GUIDE_FILE);
+	} else notes.push(`${GUIDE_FILE} already exists; it was left as it is (--force replaces it).`);
+	return written;
+}
+/**
+* What apps that install the package from a registry will not find: the component and token
+* files its `files` list leaves out of the published package, and those outside the package
+* (`../tailwind-config/theme.css`), which an installed package's config cannot reach. Undefined
+* for a private package, or when they find every file. Without a `files` list, npm publishes
+* everything in the package.
+*/
+async function unshipped(config, json) {
+	if (json.private === true) return void 0;
+	const name = typeof json.name === "string" ? json.name : "the package";
+	const files = Array.isArray(json.files) ? json.files : void 0;
+	const relative = (abs) => abs.map((f) => relativePath(config.root, f));
+	const components = relative(await componentFiles(config));
+	const tokens = relative(await tokenFiles(config));
+	const outside = (f) => f.startsWith("../");
+	const left = (list) => files ? list.filter((f) => !outside(f) && !ships(files, f)) : [];
+	const missing = {
+		components: left(components),
+		tokens: left(tokens)
+	};
+	const away = {
+		components: components.filter(outside),
+		tokens: tokens.filter(outside)
+	};
+	const noComponents = components.length > 0 && missing.components.length + away.components.length === components.length;
+	const lost = (lists, one) => {
+		const c = lists.components.length;
+		const t = lists.tokens.length;
+		const kinds = andList([...c ? [count$1(c, "component file")] : [], ...t ? [count$1(t, "token file")] : []]);
+		const what = andList([...c ? ["components"] : [], ...t ? ["tokens"] : []], "or");
+		const checks = c && noComponents ? `: they get no component, prop, variant or native-element checks, and \`${NAME} check --require-design-system\` fails in them` : "";
+		return `(${kinds}). Those apps do not know the ${what} in ${one ? "it" : "them"}${checks}.`;
+	};
+	const notes = [];
+	const top = (f) => f.includes("/") ? `${f.slice(0, f.indexOf("/"))}/` : f;
+	const folders = [...new Set([...missing.components, ...missing.tokens].map(top))];
+	if (folders.length) {
+		const one = folders.length === 1;
+		notes.push(`Apps that install ${name} from a registry get only what "files" in package.json publishes, which leaves out ${andList(folders)} ${lost(missing, one)} Add ${one ? "it" : "them"} to "files" for them; workspace apps read the sources either way.`);
+	}
+	const beyond = [...away.components, ...away.tokens];
+	if (beyond.length) {
+		const one = beyond.length === 1;
+		notes.push(`Apps that install ${name} from a registry read only the files in it, so they skip ${andList(beyond)}, outside the package ${lost(away, one)} Workspace apps read ${one ? "it" : "them"}. To give installed apps what ${one ? "it holds" : "they hold"}, keep a copy in the package, publish it, and name the copy in the config instead.`);
+	}
+	if (!notes.length) return void 0;
+	return {
+		notes,
+		next: noComponents && missing.components.length ? `gets no component checks until "files" publishes ${andList([...new Set(missing.components.map(top))])}` : `does not read ${andList([...folders, ...beyond])}`
+	};
+}
+/**
+* Said when --force writes a config in an app that took on a design-system package's: the new
+* one is read instead, and what it does not take from the package. `taken` is the config the
+* app took on, `own` the one it reads now.
+*/
+async function replacedNote(pkg, taken, own, cwd) {
+	const lacks = async (list) => {
+		const kept = new Set((await list(own)).map((f) => path.resolve(f)));
+		return (await list(taken)).some((f) => !kept.has(path.resolve(f)));
+	};
+	const components = await lacks(componentFiles);
+	const importPath = taken.importPath !== void 0 && own.importPath === void 0;
+	const tokens = await lacks(tokenFiles);
+	const declared = relativePath(cwd, pkg.config) || pkg.config;
+	const replaced = `This project took on the config ${pkg.name} declares (${declared}); with --force it has one of its own, which is read instead, so ${pkg.name}'s rules and later changes to its config no longer reach it.`;
+	if (!components && !importPath && !tokens) return replaced;
+	const effects = andList([
+		...components ? [`does not know ${pkg.name}'s components`] : [],
+		...importPath && !components ? [`does not match imports from ${pkg.name} to its components`] : [],
+		...tokens ? [`does not read ${pkg.name}'s tokens`] : []
+	]);
+	const fields = [
+		...components ? ["\"components\""] : [],
+		...importPath || components && taken.importPath !== void 0 ? ["\"importPath\""] : [],
+		...tokens ? ["\"tokens\""] : []
+	];
+	return `${replaced} It ${effects}: ${(!components || taken.configured === true) && (!tokens || taken.tokensDetected !== true) ? `copy ${andList(fields)} from ${declared} into ${CONFIG_FILE}, or ` : ""}delete ${CONFIG_FILE} to take on ${pkg.name}'s config again.`;
+}
+/** Whether npm's `files` list publishes `file`, a path relative to the package. */
+function ships(files, file) {
+	return files.some((entry) => {
+		if (typeof entry !== "string") return false;
+		const pattern = entry.replace(/^\.?\//, "").replace(/\/+$/, "");
+		if (!pattern || pattern.startsWith("!")) return false;
+		return file === pattern || file.startsWith(`${pattern}/`) || matchesGlob(file, pattern) || matchesGlob(file, `${pattern}/**`);
+	});
+}
+/** ONSYSTEM.md: how an app that uses the package gets the design system to its agents and CI. */
+function consumerGuide(name) {
+	return `${[
+		`# onsystem in apps that use ${name}`,
+		"",
+		`${name} declares its [onsystem](https://onsystem.vercel.app) config in its package.json: \`"${PACKAGE_FIELD}": "./${CONFIG_FILE}"\`. An app that depends on ${name}, as a workspace package or installed from npm, reads that config when it has none of its own, and its UI is checked against ${name}'s components, props, variants and tokens. To see what an app finds, run this in its folder:`,
+		"",
+		"```sh",
+		`npx -y ${NAME} inspect`,
+		"```",
+		"",
+		`An app with an ${CONFIG_FILE} of its own reads that instead.`,
+		"",
+		"## Coding agents",
+		"",
+		"Claude Code: the plugin checks every UI file the agent writes and hands the errors back to fix, and adds the MCP server and a skill.",
+		"",
+		"```text",
+		"/plugin marketplace add dgesteves/onsystem",
+		"/plugin install onsystem@dgesteves",
+		"```",
+		"",
+		`Other agents: \`npx skills add dgesteves/onsystem\` adds the skill, and \`npx -y ${NAME}\` started in the app is the MCP server. [Set up your agent](https://onsystem.vercel.app/docs/clients) has the config for each client.`,
+		"",
+		"## CI",
+		"",
+		"In the app, record the findings it already has once, and commit the baseline, so pull requests fail only on new ones:",
+		"",
+		"```sh",
+		`npm install --save-dev ${NAME}`,
+		`npx ${NAME} check . --update-baseline`,
+		"```",
+		"",
+		"```yaml",
+		`- run: npx ${NAME} check . --format github --require-design-system`,
+		"```",
+		"",
+		"[CI and baselines](https://onsystem.vercel.app/docs/ci) has the GitHub Action and the rest.",
+		"",
+		"## Changing the config",
+		"",
+		`${CONFIG_FILE} in ${name} sets what every app gets: where the components, tokens and docs are, and the rules' severities. Its \`tsconfig\`, \`overrides\` and \`includeDesignSystem\` apply to ${name}'s own files only. [Design-system packages](https://onsystem.vercel.app/docs/design-system-packages) has the details.`
+	].join("\n")}\n`;
+}
 function count$1(n, word) {
 	return `${n.toLocaleString("en-US")} ${n === 1 ? word : `${word}s`}`;
 }
+/** `a`, `a and b`, `a, b and c` (or `or`). */
+function andList(items, conjunction = "and") {
+	return items.length > 1 ? `${items.slice(0, -1).join(", ")} ${conjunction} ${items.at(-1) ?? ""}` : items.join("");
+}
 //#endregion
 //#region src/cli.ts
 const DOCS = "https://onsystem.vercel.app/docs";
@@ -234,6 +383,9 @@ Usage
   onsystem check <paths...>      Lint files, folders or globs with the check_ui rules
                                  (for CI)
   onsystem inspect               Print what was extracted from the project
+  onsystem export --format dtcg|design-md
+                                 Print the tokens it found as a DTCG 2025.10 file or a
+                                 DESIGN.md (--out <file> writes them to a file)
   onsystem init                  Write onsystem.config.json from what was found, run a
                                  dry-run check and offer a baseline
   onsystem help                  Show this help
@@ -252,9 +404,13 @@ Options
   --docs <glob>           Component docs (Markdown/MDX), repeatable
   --no-cache              Ignore the on-disk extraction cache
   --no-watch              serve: do not reload when files change
-  --format <format>       check: pretty | json | github | sarif (default: pretty)
+  --format <format>       check: pretty | json | github | sarif (default: pretty);
+                          export: dtcg | design-md
+  --out <file>            export: write to this file instead of stdout
   --max-warnings <n>      check: exit 1 when there are more than n warnings
   --update-baseline       check: record the current findings as accepted, and exit 0
+  --prune-baseline        check: drop baseline entries that no longer occur, and
+                          accept nothing new
   --baseline <file>       check: baseline file (default: ${BASELINE_FILE} in the root,
                           used whenever it exists)
   --ignore-baseline       check: report every finding, baseline or not
@@ -292,7 +448,8 @@ const defaultIo = {
 	stdout: (text) => process.stdout.write(`${text}\n`),
 	stderr: (text) => process.stderr.write(`${text}\n`),
 	color: process.stdout.isTTY && !process.env.NO_COLOR,
-	prompt: process.stdin.isTTY && process.stdout.isTTY ? askInTerminal : void 0
+	prompt: process.stdin.isTTY && process.stdout.isTTY ? askInTerminal : void 0,
+	stdinIsTTY: process.stdin.isTTY
 };
 /** One question on the terminal, answered with a line. */
 async function askInTerminal(question) {
@@ -337,16 +494,18 @@ async function main(argv, io = defaultIo) {
 					type: "boolean",
 					default: true
 				},
-				format: {
-					type: "string",
-					default: "pretty"
-				},
+				format: { type: "string" },
+				out: { type: "string" },
 				"max-warnings": { type: "string" },
 				baseline: { type: "string" },
 				"update-baseline": {
 					type: "boolean",
 					default: false
 				},
+				"prune-baseline": {
+					type: "boolean",
+					default: false
+				},
 				"ignore-baseline": {
 					type: "boolean",
 					default: false
@@ -422,15 +581,18 @@ async function main(argv, io = defaultIo) {
 	try {
 		switch (command) {
 			case "serve":
+				if (io.stdinIsTTY) io.stderr(`${NAME} is an MCP server: it is waiting for an agent on stdin. Add it to your agent (${DOCS}/clients), or run \`npx -y ${NAME} inspect\` or \`npx -y ${NAME} check .\` here. Ctrl+C quits.`);
 				await serveStdio({
 					...configOptions,
 					cache: values.cache,
 					watch: values.watch,
-					logger: stderrLogger
+					logger: stderrLogger,
+					...io.transport ? { transport: io.transport } : {}
 				});
 				return 0;
 			case "check": return await check(rest, configOptions, values, io);
 			case "inspect": return await inspect(configOptions, values, io);
+			case "export": return await exportTokens(configOptions, values, io);
 			case "init": return await init(configOptions, {
 				yes: values.yes,
 				force: values.force,
@@ -466,18 +628,22 @@ async function check(patterns, configOptions, values, io) {
 		io.stderr("check: pass --quiet-without-design-system or --require-design-system, not both");
 		return 2;
 	}
+	for (const other of ["update-baseline", "ignore-baseline"]) if (values["prune-baseline"] && values[other]) {
+		io.stderr(`check: pass --prune-baseline or --${other}, not both`);
+		return 2;
+	}
 	if (!patterns.length) {
 		io.stderr(`check: pass files, folders or globs, e.g. ${NAME} check .`);
 		return 2;
 	}
-	const format = values.format;
+	const format = values.format ?? "pretty";
 	if (![
 		"pretty",
 		"json",
 		"github",
 		"sarif"
 	].includes(format)) {
-		io.stderr(`check: unknown --format "${values.format}" (pretty, json, github, sarif)`);
+		io.stderr(`check: unknown --format "${format}" (pretty, json, github, sarif)`);
 		return 2;
 	}
 	const maxWarnings = values["max-warnings"] === void 0 ? void 0 : Number(values["max-warnings"]);
@@ -487,6 +653,7 @@ async function check(patterns, configOptions, values, io) {
 	}
 	const target = await loadTarget(configOptions);
 	warnDeprecated(target.config.deprecations, format, io);
+	warnDeprecated(configWarnings(target), format, io);
 	const selection = target.workspace ? await selectInWorkspace(target.workspace, patterns, values, format, io) : await selectInProject(target.config, patterns, values, format, io);
 	if (typeof selection === "number") return selection;
 	const { files, notes } = selection;
@@ -498,6 +665,7 @@ async function check(patterns, configOptions, values, io) {
 		return 0;
 	}
 	const update = values["update-baseline"];
+	const prune = values["prune-baseline"];
 	const baselineFile = values.baseline ? path.resolve(io.cwd, values.baseline) : defaultBaseline(selection.root, values["ignore-baseline"] ? void 0 : (text) => {
 		warnDeprecated([text], format, io);
 	});
@@ -506,6 +674,10 @@ async function check(patterns, configOptions, values, io) {
 		io.stderr(`check: baseline not found: ${displayPath(io.cwd, baselineFile)}`);
 		return 2;
 	}
+	if (prune && !baseline) {
+		io.stderr(`check --prune-baseline: no baseline to prune at ${displayPath(io.cwd, baselineFile)}. Pass --baseline <file> to prune another one, or record the current findings with \`${checkCommand(patterns, configOptions, values, "--update-baseline")}\`.`);
+		return 2;
+	}
 	const disabledFor = (file) => {
 		const ds = selection.designSystemOf(file);
 		return new Set(Object.entries(rulesFor(ds.config, relativePath(ds.root, file))).filter(([, rule]) => rule.severity === "off").map(([id]) => id));
@@ -515,18 +687,22 @@ async function check(patterns, configOptions, values, io) {
 	const baselineKey = (file) => relativePath(realRoot, fs.realpathSync.native(file)).normalize("NFC");
 	const results = [];
 	const checked = /* @__PURE__ */ new Map();
+	const ran = /* @__PURE__ */ new Set();
 	let baselined = 0;
 	let fixed = 0;
 	for (const file of files) {
-		const code = await fs$1.readFile(file, "utf8");
+		const code = await fsp.readFile(file, "utf8");
 		const ds = selection.designSystemOf(file);
 		let result = ds.check(code, relativePath(ds.root, file));
 		const key = baselineKey(file);
 		const disabled = disabledFor(file);
 		disabledByKey.set(key, disabled);
-		if (update) checked.set(key, result.diagnostics);
+		if (update || prune) checked.set(key, result.diagnostics);
+		if (update) {
+			for (const rule of RULE_IDS) if (!disabled.has(rule) && canRun(ds, rule)) ran.add(rule);
+		}
 		if (baseline && !update) {
-			const match = applyBaseline(baseline, key, result, disabled);
+			const match = applyBaseline(baseline.entries, key, result, disabled);
 			result = {
 				...match.result,
 				baselined: match.baselined
@@ -543,22 +719,51 @@ async function check(patterns, configOptions, values, io) {
 	if (elsewhere) notes.push(`${plural(elsewhere, "image or email file")} not checked`);
 	const unchecked = uncheckedNotice(results);
 	if (update) {
-		const next = updateBaseline(baseline, checked, realRoot, (key) => disabledByKey.get(key) ?? /* @__PURE__ */ new Set());
-		writeBaseline(baselineFile, next);
+		const next = updateBaseline(baseline?.entries, checked, realRoot, (key) => disabledByKey.get(key) ?? /* @__PURE__ */ new Set());
+		const wholeRoot = patterns.some((pattern) => {
+			const dir = path.resolve(io.cwd, pattern);
+			return Boolean(fs.statSync(dir, { throwIfNoEntry: false })?.isDirectory() && isInside(realPath(dir), realRoot));
+		});
+		writeBaseline(baselineFile, next, {
+			onsystem: VERSION,
+			rules: rulesRun(baseline, next, checked, ran, wholeRoot)
+		});
 		const counts = countBaseline(next);
-		io.stdout(`Baseline: ${count(counts.findings, "finding")} in ${count(counts.files, "file")} → ${displayPath(io.cwd, baselineFile)}`);
+		const summary = `Baseline: ${count(counts.findings, "finding")} in ${count(counts.files, "file")} → ${displayPath(io.cwd, baselineFile)}`;
+		if (format === "pretty") io.stdout(summary);
+		else io.stderr(summary);
 		for (const text of selection.notices) io.stderr(text);
 		if (unchecked) io.stderr(unchecked);
 		return 0;
 	}
+	const command = (flag) => checkCommand(patterns, configOptions, values, flag);
+	const baselineNotes = [];
+	if (baseline) {
+		const fresh = results.flatMap((r) => r.diagnostics);
+		const unrecorded = unrecordedRules(baseline, fresh);
+		if (unrecorded.size) baselineNotes.push(unrecordedNote(unrecorded, fresh.length, baseline.onsystem, command("--update-baseline")));
+	}
+	if (prune && baseline) {
+		const next = pruneBaseline(baseline.entries, checked, realRoot, (key) => disabledByKey.get(key) ?? /* @__PURE__ */ new Set());
+		const left = countBaseline(next);
+		const dropped = countBaseline(baseline.entries).findings - left.findings;
+		if (dropped) writeBaseline(baselineFile, next, {
+			onsystem: baseline.onsystem,
+			rules: baseline.rules
+		});
+		baselineNotes.push(`Baseline: ${dropped ? `dropped ${count(dropped, "finding")} that no longer ${dropped === 1 ? "occurs" : "occur"}` : "nothing to drop"}; ${count(left.findings, "finding")} in ${count(left.files, "file")} → ${displayPath(io.cwd, baselineFile)}`);
+	}
 	const output = formatDiagnostics(format === "json" ? results : results.filter((r) => !r.skipped), format, {
 		color: io.color,
 		uri: format === "sarif" || format === "github" ? repositoryPath(io.cwd, io.env ?? process.env) : void 0,
 		baselined: baseline ? baselined : void 0,
 		notes,
-		fixedHint: fixed ? `${count(fixed, "baseline finding")} no longer ${fixed === 1 ? "occurs" : "occur"}: run \`check ${patterns.map(shellQuote).join(" ")} --update-baseline\` to drop ${fixed === 1 ? "it" : "them"}.` : void 0
+		fixedHint: fixed && !prune ? `${count(fixed, "baseline finding")} no longer ${fixed === 1 ? "occurs" : "occur"}: run \`${command("--prune-baseline")}\` to drop ${fixed === 1 ? "it" : "them"}.` : void 0
 	});
 	if (output) io.stdout(output);
+	for (const text of baselineNotes) if (format === "pretty") io.stdout(text);
+	else if (format === "github") io.stdout(`::notice title=${NAME} baseline::${escapeData(text)}`);
+	else io.stderr(text);
 	for (const text of [...selection.notices, unchecked]) {
 		if (!text) continue;
 		if (format === "pretty") io.stdout(text);
@@ -650,7 +855,7 @@ async function selectInProject(config, patterns, values, format, io) {
 		excluded: leftOut.filter((file) => !TEST_FILE.test(file)).length,
 		gitignored: ignored.size
 	};
-	let files = unique([...named, ...kept.filter((file) => !ignored.has(file))]).sort();
+	let files = oncePerFile([...named, ...kept.filter((file) => !ignored.has(file))]).sort();
 	if (!files.length && !all.length) {
 		io.stderr(`check: no files match ${patterns.join(" ")}`);
 		return 2;
@@ -660,8 +865,9 @@ async function selectInProject(config, patterns, values, format, io) {
 		return 0;
 	}
 	const notice = ds.notice();
-	if (notice && values["require-design-system"]) {
+	if (notice && values["require-design-system"] && !ds.hasDesignSystem()) {
 		io.stderr(`check --require-design-system: ${notice}`);
+		for (const text of notReadNotices([{ ds }])) io.stderr(text);
 		return 2;
 	}
 	let skipped = 0;
@@ -676,7 +882,7 @@ async function selectInProject(config, patterns, values, format, io) {
 		designSystemOf: () => ds,
 		root: ds.root,
 		notes: scopeNotes(skipped, left),
-		notices: notice ? [notice] : [],
+		notices: [...notice ? [notice] : [], ...notReadNotices([{ ds }])],
 		skipped,
 		testsLeftOut: left.tests
 	};
@@ -726,7 +932,7 @@ async function selectInWorkspace(workspace, patterns, values, format, io) {
 		excluded: leftOut.filter((file) => !TEST_FILE.test(file)).length,
 		gitignored: ignored.size
 	};
-	let files = unique([...named, ...kept.filter((file) => !ignored.has(file))]).sort();
+	let files = oncePerFile([...named, ...kept.filter((file) => !ignored.has(file))]).sort();
 	if (!files.length && !all.length) {
 		io.stderr(`check: no files match ${patterns.join(" ")}`);
 		return 2;
@@ -747,7 +953,7 @@ async function selectInWorkspace(workspace, patterns, values, format, io) {
 	}
 	if (values["require-design-system"]) {
 		let complete = false;
-		for (const p of workspace.projects) if (!(await load(p)).notice()) {
+		for (const p of workspace.projects) if ((await load(p)).hasDesignSystem()) {
 			complete = true;
 			break;
 		}
@@ -778,6 +984,14 @@ async function selectInWorkspace(workspace, patterns, values, format, io) {
 		gaps.set(notice, gap);
 	}
 	const notices = [...gaps.values()].map(({ ds, dirs }) => ds.notice(listOf(dirs)) ?? "");
+	const checkedProjects = unique(files.map(project)).flatMap((p) => {
+		const ds = loaded.get(p.root);
+		return ds ? [{
+			ds,
+			dir: p.dir
+		}] : [];
+	});
+	notices.push(...notReadNotices(checkedProjects));
 	const used = unique(files.map((file) => project(file).root)).length;
 	return {
 		files,
@@ -799,6 +1013,7 @@ async function inspect(configOptions, values, io) {
 	const target = await loadTarget(configOptions);
 	const { config } = target;
 	warnDeprecated(config.deprecations, "pretty", io);
+	warnDeprecated(configWarnings(target), "pretty", io);
 	if (target.workspace) return inspectWorkspace(target.workspace, values, io);
 	const ds = await loadDesignSystem(config, {
 		cache: values.cache,
@@ -811,12 +1026,13 @@ async function inspect(configOptions, values, io) {
 	}
 	const lines = [
 		`root     ${model.root}`,
-		`config   ${config.configFile ? displayPath(io.cwd, config.configFile) : "(defaults)"}`,
+		`config   ${config.configFile ? `${displayPath(io.cwd, config.configFile)}${declaredBy(config)}` : "(defaults)"}`,
 		...config.detected ? [`detected ${config.detected}`] : [],
+		...describeLibraries(config, model, io.cwd).map((line) => `library  ${line}`),
 		`files    ${plural(model.stats.files.components, "component file")}, ${plural(model.stats.files.tokens, "token file")}, ${plural(model.stats.files.docs, "doc")}`,
 		`time     ${model.stats.durationMs}ms${model.stats.fromCache ? " (cache)" : ""}`,
 		"",
-		`Components (${ds.roots().length} + ${model.components.length - ds.roots().length} parts)`
+		`Components (${ds.roots().length} + ${ds.components.length - ds.roots().length} parts)`
 	];
 	for (const c of ds.roots()) {
 		const variants = c.variants.map((v) => `${v.name}[${v.values.length}]`).join(" ");
@@ -838,8 +1054,72 @@ async function inspect(configOptions, values, io) {
 	}
 	if (values.explain) lines.push("", ...explainProject(ds, io.cwd));
 	io.stdout(lines.join("\n"));
+	const missing = values.explain ? void 0 : missingDependencies([{ ds }]);
+	if (missing) io.stderr(missing);
 	return 0;
 }
+/**
+* `MUI (@mui/material 9.4.0): 149 components from its type declarations`, per library the
+* project depends on, including those the config's `libraries` leaves out.
+*/
+function describeLibraries(config, model, cwd) {
+	const name = (library) => `${libraryTitle(library.package)} (${library.package}${library.version ? ` ${library.version}` : ""})`;
+	return [
+		...(config.libraries ?? []).map((library) => {
+			if (!library.dir) return `${name(library)}: a dependency, but not installed`;
+			const count = model.components.filter((c) => c.library === library.package).length;
+			return `${name(library)}: ${plural(count, "component")} from its type declarations`;
+		}),
+		...(config.librariesOff ?? []).map((library) => `${name(library)}: ${librariesLeftOut(config, cwd)}`),
+		...(config.librariesUnread ?? []).map((library) => `${name(library)}: ${notReadYet()}`)
+	];
+}
+/**
+* `export --format dtcg|design-md`: the project's tokens as a DTCG 2025.10 file or a
+* DESIGN.md, on stdout or in the `--out` file.
+*/
+async function exportTokens(configOptions, values, io) {
+	const format = values.format;
+	if (format !== "dtcg" && format !== "design-md") {
+		io.stderr(`export: pass --format dtcg or --format design-md${format === void 0 ? "" : ` (not "${format}")`}`);
+		return 2;
+	}
+	const target = await loadTarget(configOptions);
+	warnDeprecated(target.config.deprecations, "pretty", io);
+	warnDeprecated(configWarnings(target), "pretty", io);
+	if (target.workspace) {
+		const dirs = target.workspace.projects.map((p) => p.dir);
+		io.stderr(`export: ${target.workspace.root} is a monorepo root, and each project has its own tokens. Pass --root with one of them${dirs.length ? ` (${listOf(dirs)})` : ""}.`);
+		return 2;
+	}
+	const ds = await loadDesignSystem(target.config, {
+		cache: values.cache,
+		logger: silentLogger
+	});
+	if (!ds.tokens.length) {
+		io.stderr(`export: no design tokens found in ${ds.root}. \`${NAME} inspect --explain\` shows where it looked.`);
+		return 2;
+	}
+	const result = format === "dtcg" ? toDtcg(ds.tokens) : toDesignMd(ds.tokens, { name: projectName(ds.root) });
+	for (const warning of result.warnings) io.stderr(`export: ${warning}`);
+	if (values.out === void 0) {
+		io.stdout(result.text.trimEnd());
+		return 0;
+	}
+	const file = path.resolve(io.cwd, values.out);
+	await fsp.mkdir(path.dirname(file), { recursive: true });
+	await fsp.writeFile(file, result.text);
+	io.stdout(`Wrote ${plural(result.count, "token")} to ${displayPath(io.cwd, file)} (${format === "dtcg" ? "DTCG 2025.10" : "DESIGN.md"})`);
+	return 0;
+}
+/** The package name in the root's package.json, else the folder's name. */
+function projectName(root) {
+	try {
+		const pkg = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
+		if (typeof pkg.name === "string" && pkg.name) return pkg.name;
+	} catch {}
+	return path.basename(root);
+}
 function tokenCounts(model) {
 	const counts = /* @__PURE__ */ new Map();
 	for (const t of model.tokens) counts.set(t.category, (counts.get(t.category) ?? 0) + 1);
@@ -880,14 +1160,19 @@ async function inspectWorkspace(workspace, values, io) {
 		const { model } = ds;
 		const roots = ds.roots();
 		const tokens = [...tokenCounts(model)].map(([category, n]) => `${category} ${n}`);
-		const own = project.config.configFile && project.config.configFile !== workspace.configFile ? displayPath(workspace.root, project.config.configFile) : void 0;
-		lines.push("", `${project.dir}${project.name ? ` (${project.name})` : ""}`, ...own ? [`  config     ${own}`] : [], ...project.config.detected ? [`  detected   ${project.config.detected}`] : [], `  files      ${plural(model.stats.files.components, "component file")}, ${plural(model.stats.files.tokens, "token file")}, ${plural(model.stats.files.docs, "doc")}`, `  components ${roots.length} + ${model.components.length - roots.length} parts${roots.length ? `: ${listNames(roots.map((c) => c.name))}` : ""}`, `  tokens     ${tokens.length ? tokens.join(", ") : "none"}`, ...model.warnings.length ? [`  warnings   ${model.warnings.length}: ${model.warnings[0] ?? ""}`] : []);
+		const own = project.config.configFile && project.config.configFile !== workspace.configFile ? `${displayPath(workspace.root, project.config.configFile)}${declaredBy(project.config)}` : void 0;
+		lines.push("", `${project.dir}${project.name ? ` (${project.name})` : ""}`, ...own ? [`  config     ${own}`] : [], ...project.config.detected ? [`  detected   ${project.config.detected}`] : [], ...describeLibraries(project.config, model, io.cwd).map((line) => `  library    ${line}`), `  files      ${plural(model.stats.files.components, "component file")}, ${plural(model.stats.files.tokens, "token file")}, ${plural(model.stats.files.docs, "doc")}`, `  components ${roots.length} + ${ds.components.length - roots.length} parts${roots.length ? `: ${listNames(roots.map((c) => c.name))}` : ""}`, `  tokens     ${tokens.length ? tokens.join(", ") : "none"}`, ...model.warnings.length ? [`  warnings   ${model.warnings.length}: ${model.warnings[0] ?? ""}`] : []);
 	}
 	if (!loaded.length) lines.push("", `No workspace package has a design system that zero config finds. See ${DOCS}/troubleshooting`);
 	if (workspace.others.length) lines.push("", `Without a design system (${workspace.others.length}): ${listNames(workspace.others)}`);
 	lines.push("", `Each file is checked by its project's design system. For one project's components, tokens and warnings: ${NAME} inspect --root <folder>`);
 	if (values.explain) lines.push("", ...explainWorkspace(workspace, loaded, io.cwd));
 	io.stdout(lines.join("\n"));
+	const missing = values.explain ? void 0 : missingDependencies(loaded.map(({ project, ds }) => ({
+		ds,
+		dir: project.dir
+	})));
+	if (missing) io.stderr(missing);
 	return 0;
 }
 /** Why the root is read as a monorepo, then each project's explanation. */
@@ -903,6 +1188,10 @@ function explainWorkspace(workspace, loaded, cwd) {
 	for (const { project, ds } of loaded) lines.push("", `${project.dir}${project.name ? ` (${project.name})` : ""}`, ...explainProject(ds, cwd, "  "));
 	return lines;
 }
+/** ` (declared by @acme/ui)` after a config a design-system package declares; empty otherwise. */
+function declaredBy(config) {
+	return config.designSystemPackage ? ` (declared by ${config.designSystemPackage.name})` : "";
+}
 /** `A, B, C` up to a dozen names, then `and 40 more`. */
 function listNames(names, max = 12) {
 	const shown = names.slice(0, max).join(", ");
@@ -912,6 +1201,10 @@ function listNames(names, max = 12) {
 * Says once what a file's old name means: on stderr, or as a workflow warning with
 * `--format github` so it shows on the run. Never on stdout otherwise, which JSON output owns.
 */
+/** What the configs read have to say: the project's, or every package's at a monorepo root. */
+function configWarnings(target) {
+	return target.workspace ? target.workspace.warnings : target.config.warnings;
+}
 function warnDeprecated(messages, format, io) {
 	for (const text of messages ?? []) if (format === "github") io.stdout(`::warning title=${NAME}::${text}`);
 	else io.stderr(text);
@@ -990,6 +1283,50 @@ function gitIgnored(cwd, files) {
 function count(n, word) {
 	return `${n.toLocaleString("en-US")} ${n === 1 ? word : `${word}s`}`;
 }
+/**
+* `check` as this run was given, with `flag`: the patterns and the options that decide what it
+* finds and which baseline it reads (output options left out).
+*/
+function checkCommand(patterns, configOptions, values, flag) {
+	const args = [...patterns];
+	const option = (name, value) => {
+		if (value !== void 0) args.push(`--${name}`, value);
+	};
+	option("root", configOptions.root);
+	option("config", configOptions.config);
+	for (const name of [
+		"components",
+		"tokens",
+		"docs"
+	]) for (const value of configOptions[name] ?? []) option(name, value);
+	option("baseline", values.baseline);
+	if (configOptions.includeDesignSystem !== void 0) args.push(`--${configOptions.includeDesignSystem ? "" : "no-"}include-design-system`);
+	if (values["include-tests"]) args.push("--include-tests");
+	return `check ${args.map(shellQuote).join(" ")} ${flag}`;
+}
+/**
+* Whether a rule has something to compare against in a design system, as `notice()` says when
+* it has not: no-hardcoded-color needs color tokens, the spacing and radius rules tokens of
+* their kind, and the component rules components. Keep it in step with `DesignSystem.notice()`
+* in src/design-system.ts, or the baseline records a rule as run when it was skipped, or the
+* other way round.
+*/
+function canRun(ds, rule) {
+	switch (rule) {
+		case "no-hardcoded-color": return ds.tokenIndex.has("color");
+		case "no-hardcoded-spacing": return ds.tokenIndex.has("spacing");
+		case "no-hardcoded-radius": return ds.tokenIndex.has("radius");
+		case "icon-button-accessible-name": return true;
+		default: return ds.model.components.length > 0;
+	}
+}
+/** Why findings of rules that did not run when the baseline was recorded are new to it. */
+function unrecordedNote(byRule, total, version, update) {
+	const rules = [...byRule.keys()].sort();
+	const n = [...byRule.values()].reduce((sum, k) => sum + k, 0);
+	const others = total - n;
+	return `${listOf(rules, rules.length)} did not run when the baseline was written${version ? ` (onsystem ${version})` : ""}, so ${rules.length === 1 ? "its" : "their"} ${count(n, "finding")} ${n === 1 ? "is" : "are"} new to the baseline, not necessarily to the code. To accept ${n === 1 ? "it" : "them"}, run \`${update}\`${others ? `, which also accepts the ${count(others, "other new finding")}` : ""}.`;
+}
 /** Quotes a pattern for the hint when the shell would expand or split it. */
 function shellQuote(pattern) {
 	return /^[\w./@-]+$/.test(pattern) ? pattern : `"${pattern.replace(/(["\\$`])/g, "\\$1")}"`;
@@ -1002,6 +1339,19 @@ function realPath(file) {
 		return file;
 	}
 }
+/**
+* One path per file, links resolved: a folder that links back to its parent reaches the same
+* files again. The shortest path stays.
+*/
+function oncePerFile(files) {
+	const kept = /* @__PURE__ */ new Map();
+	for (const file of files) {
+		const real = realPath(file);
+		const previous = kept.get(real);
+		if (previous === void 0 || file.length < previous.length) kept.set(real, file);
+	}
+	return [...kept.values()];
+}
 /** Relative to cwd when the file is below it, absolute otherwise. */
 function displayPath(cwd, file) {
 	const rel = path.relative(cwd, file);