onsystem 0.9.1 → 0.10.1

package/dist/{design-system-DZm2aP1z.js → design-system-CPH4C7-1.js}

@@ -7,7 +7,7 @@ import ts from "typescript";
 import os from "node:os";
 import postcss from "postcss";
 import { clampChroma, colorsNamed, converter, differenceEuclidean, formatHex, parse, wcagContrast } from "culori";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import fsp from "node:fs/promises";
 import { LineCounter, isMap, isScalar, parseDocument, stringify } from "yaml";
 import { stemmer } from "stemmer";
@@ -122,6 +122,74 @@ function isProjectFile(file) {
 	return !/[\\/]node_modules[\\/]/.test(file);
 }
 //#endregion
+//#region src/util/strings.ts
+/** `alert-dialog` / `alert_dialog` / `alertDialog` → `AlertDialog`. */
+function pascalCase(input) {
+	return input.replace(/\.[^.]+$/, "").split(/[^a-zA-Z0-9]+|(?<=[a-z0-9])(?=[A-Z])/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1).toLowerCase()).join("");
+}
+/** `AlertDialog` → `["Alert", "Dialog"]`, `isHTMLSafe` → `["is", "HTML", "Safe"]`. */
+function splitWords(input) {
+	return input.split(/[^a-zA-Z0-9]+|(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/).filter(Boolean);
+}
+function isPascalCase(name) {
+	return /^[A-Z][A-Za-z0-9]*$/.test(name);
+}
+/** Optimal string alignment distance (Levenshtein plus adjacent transpositions). */
+function editDistance(a, b) {
+	if (a === b) return 0;
+	if (!a.length) return b.length;
+	if (!b.length) return a.length;
+	const rows = a.length + 1;
+	const cols = b.length + 1;
+	const d = new Array(rows * cols).fill(0);
+	const at = (i, j) => d[i * cols + j] ?? 0;
+	for (let i = 0; i < rows; i++) d[i * cols] = i;
+	for (let j = 0; j < cols; j++) d[j] = j;
+	for (let i = 1; i < rows; i++) for (let j = 1; j < cols; j++) {
+		const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+		let v = Math.min(at(i - 1, j) + 1, at(i, j - 1) + 1, at(i - 1, j - 1) + cost);
+		if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) v = Math.min(v, at(i - 2, j - 2) + 1);
+		d[i * cols + j] = v;
+	}
+	return at(a.length, b.length);
+}
+/**
+* The candidate closest to `input` by case-insensitive edit distance, if it is
+* close enough to be a plausible typo (at most a third of the length, min 1).
+*/
+function closest(input, candidates, maxRatio = 1 / 3) {
+	const needle = input.toLowerCase();
+	const limit = Math.max(1, Math.floor(needle.length * maxRatio));
+	let best;
+	let bestScore = Infinity;
+	for (const candidate of candidates) {
+		const gap = Math.abs(candidate.length - needle.length);
+		if (gap > limit || gap >= bestScore) continue;
+		const score = editDistance(needle, candidate.toLowerCase());
+		if (score < bestScore) {
+			best = candidate;
+			bestScore = score;
+		}
+	}
+	return bestScore <= limit ? best : void 0;
+}
+function truncate(text, max) {
+	return text.length <= max ? text : `${text.slice(0, max - 1).trimEnd()}…`;
+}
+/**
+* `text` as a JSON string, with U+0085, U+2028 and U+2029 escaped too, so it stays on one line
+* (JSON escapes the other line breaks).
+*/
+function json(text) {
+	return JSON.stringify(text).replace(/[\u0085\u2028\u2029]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+function plural$1(count, word, pluralWord = `${word}s`) {
+	return `${count} ${count === 1 ? word : pluralWord}`;
+}
+function unique(items) {
+	return [...new Set(items)];
+}
+//#endregion
 //#region src/util/paths.ts
 function toPosix(p) {
 	return p.split(path.sep).join("/");
@@ -271,6 +339,14 @@ function splitTopLevel$2(text) {
 function escapeRegExp(text) {
 	return text.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
 }
+/**
+* A file, folder or import path, as written when it holds only the characters of a path (letters,
+* digits and `_ @ $ . + ~ / \ : ( ) [ ] { } # % , = ! -`, as in `app/(site)/[id]/page.tsx`);
+* otherwise, as for a path that holds a space or a line break (git allows one), JSON-quoted.
+*/
+function pathOf(file) {
+	return /^[\p{L}\p{N}_@$.+~/\\:()[\]{}#%,=!-]+$/u.test(file) ? file : json(file);
+}
 //#endregion
 //#region src/package-source.ts
 /**
@@ -567,67 +643,6 @@ function importedStylesheets(files, resolve) {
 	return out;
 }
 //#endregion
-//#region src/util/strings.ts
-/** `alert-dialog` / `alert_dialog` / `alertDialog` → `AlertDialog`. */
-function pascalCase(input) {
-	return input.replace(/\.[^.]+$/, "").split(/[^a-zA-Z0-9]+|(?<=[a-z0-9])(?=[A-Z])/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1).toLowerCase()).join("");
-}
-/** `AlertDialog` → `["Alert", "Dialog"]`, `isHTMLSafe` → `["is", "HTML", "Safe"]`. */
-function splitWords(input) {
-	return input.split(/[^a-zA-Z0-9]+|(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/).filter(Boolean);
-}
-function isPascalCase(name) {
-	return /^[A-Z][A-Za-z0-9]*$/.test(name);
-}
-/** Optimal string alignment distance (Levenshtein plus adjacent transpositions). */
-function editDistance(a, b) {
-	if (a === b) return 0;
-	if (!a.length) return b.length;
-	if (!b.length) return a.length;
-	const rows = a.length + 1;
-	const cols = b.length + 1;
-	const d = new Array(rows * cols).fill(0);
-	const at = (i, j) => d[i * cols + j] ?? 0;
-	for (let i = 0; i < rows; i++) d[i * cols] = i;
-	for (let j = 0; j < cols; j++) d[j] = j;
-	for (let i = 1; i < rows; i++) for (let j = 1; j < cols; j++) {
-		const cost = a[i - 1] === b[j - 1] ? 0 : 1;
-		let v = Math.min(at(i - 1, j) + 1, at(i, j - 1) + 1, at(i - 1, j - 1) + cost);
-		if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) v = Math.min(v, at(i - 2, j - 2) + 1);
-		d[i * cols + j] = v;
-	}
-	return at(a.length, b.length);
-}
-/**
-* The candidate closest to `input` by case-insensitive edit distance, if it is
-* close enough to be a plausible typo (at most a third of the length, min 1).
-*/
-function closest(input, candidates, maxRatio = 1 / 3) {
-	const needle = input.toLowerCase();
-	const limit = Math.max(1, Math.floor(needle.length * maxRatio));
-	let best;
-	let bestScore = Infinity;
-	for (const candidate of candidates) {
-		const gap = Math.abs(candidate.length - needle.length);
-		if (gap > limit || gap >= bestScore) continue;
-		const score = editDistance(needle, candidate.toLowerCase());
-		if (score < bestScore) {
-			best = candidate;
-			bestScore = score;
-		}
-	}
-	return bestScore <= limit ? best : void 0;
-}
-function truncate(text, max) {
-	return text.length <= max ? text : `${text.slice(0, max - 1).trimEnd()}…`;
-}
-function plural$1(count, word, pluralWord = `${word}s`) {
-	return `${count} ${count === 1 ? word : pluralWord}`;
-}
-function unique(items) {
-	return [...new Set(items)];
-}
-//#endregion
 //#region src/detect.ts
 const ignore = () => void 0;
 const COMPONENT_FILE = /\.[jt]sx$/;
@@ -1588,11 +1603,11 @@ const PACKAGE_FIELD = "onsystem";
 function declaredConfig(dir, pkg = readJson$1(path.join(dir, "package.json"))) {
 	const value = pkg?.[PACKAGE_FIELD];
 	if (value === void 0) return void 0;
-	const field = `"${PACKAGE_FIELD}" in ${path.join(dir, "package.json")}`;
+	const field = `"${PACKAGE_FIELD}" in ${pathOf(path.join(dir, "package.json"))}`;
 	if (typeof value !== "string" || !value.endsWith(".json")) return { problem: `${field} is ${JSON.stringify(value)}: it names a JSON config file in the package, such as "./onsystem.config.json".` };
 	const file = path.resolve(dir, value);
-	if (!isInside(dir, file) || file === path.resolve(dir)) return { problem: `${field} names ${value}, which is outside the package.` };
-	if (!isFile(file)) return { problem: `${field} names ${value}, which does not exist.` };
+	if (!isInside(dir, file) || file === path.resolve(dir)) return { problem: `${field} names ${JSON.stringify(value)}, which is outside the package.` };
+	if (!isFile(file)) return { problem: `${field} names ${JSON.stringify(value)}, which does not exist.` };
 	return { file };
 }
 /**
@@ -3530,7 +3545,7 @@ function unknownKeys(what, known) {
 		if (issue.code !== "unrecognized_keys") return void 0;
 		return issue.keys.map((key) => {
 			const guess = closest(key, known, .5);
-			return `Unknown ${what} "${key}". ${guess ? `Did you mean "${guess}"?` : `Expected one of: ${known.join(", ")}.`}`;
+			return `Unknown ${what} ${JSON.stringify(key)}. ${guess ? `Did you mean "${guess}"?` : `Expected one of: ${known.join(", ")}.`}`;
 		}).join("\n");
 	};
 }
@@ -3544,7 +3559,7 @@ const ruleSettingSchema = z.union([
 	if (typeof issue.input !== "string") return void 0;
 	const input = issue.input;
 	const guess = SEVERITIES.find((s) => input && (s.startsWith(input) || input.startsWith(s)));
-	return `Invalid severity "${input}": use "off", "warn" or "error"${guess ? ` (did you mean "${guess}"?)` : ""}.`;
+	return `Invalid severity ${JSON.stringify(input)}: use "off", "warn" or "error"${guess ? ` (did you mean "${guess}"?)` : ""}.`;
 } });
 const globsSchema = z.union([z.string(), z.array(z.string())]);
 const rulesSchema = z.partialRecord(z.enum(RULE_IDS), ruleSettingSchema, { error: unknownKeys("rule", RULE_IDS) });
@@ -3562,18 +3577,19 @@ const librariesSchema = z.union([z.literal(false), z.array(z.enum(LIBRARY_IDS))]
 	const unknown = Array.isArray(issue.input) ? issue.input.find((id) => !LIBRARY_IDS.includes(id)) : void 0;
 	if (typeof unknown === "string") {
 		const guess = closest(unknown, LIBRARY_IDS, .5);
-		return `Unknown library "${unknown}". ${guess ? `Did you mean "${guess}"?` : `Expected one of: ${LIBRARY_IDS.join(", ")}.`}`;
+		return `Unknown library ${JSON.stringify(unknown)}. ${guess ? `Did you mean "${guess}"?` : `Expected one of: ${LIBRARY_IDS.join(", ")}.`}`;
 	}
 	return `"libraries" is false, to read no library, or a list of the ones to read: ${JSON.stringify(LIBRARY_IDS)}.`;
 } });
 const configShape = {
 	$schema: z.string().optional(),
+	extends: z.boolean({ error: (issue) => `"extends" is true or false, not ${JSON.stringify(issue.input)}: the design-system package is found from the dependencies, the one whose package.json declares its config ("onsystem"). Leave "extends" out to build on it, or set it to false to read this config alone.` }).optional().describe("Whether this config builds on the one a design-system package declares (\"onsystem\" in the package.json of a dependency, found from the dependencies): its rules apply over the package's, and, unless it sets components of its own, what it leaves out comes from the package's (components with their importPath, docs, elements, tokens and libraries). Default: true. false reads this config alone."),
 	components: globsSchema.optional().describe("Globs for component source files, relative to the root."),
 	exclude: z.array(z.string()).optional().describe("Globs for files to leave out, relative to the root: `check` in folders and globs, the ESLint plugin, the Claude Code hook and check_ui leave them out, and finding components skips them. A folder (`app/legacy`) covers everything in it. Adds to the defaults (node_modules, .d.ts files, tests and stories); a pattern that starts with `!` takes out the default it names, such as `!**/*.d.ts`."),
 	tokens: z.union([tokenSourceSchema, z.array(tokenSourceSchema)]).optional().describe("Token files: W3C DTCG JSON (*.json), CSS custom properties (*.css) or a DESIGN.md's front matter (*.md)."),
 	docs: globsSchema.optional().describe("Globs for per-component Markdown/MDX docs."),
 	tsconfig: z.string().optional().describe("tsconfig used to resolve types and path aliases."),
-	importPath: z.string().optional().describe("Package name components are imported from, e.g. \"@acme/ui\", or a pattern for packages imported by path: \"@acme/ui/{path}\" is @acme/ui/primitives/button for primitives/button.tsx in the package. Default: inferred from package exports and tsconfig paths."),
+	importPath: z.string().optional().describe("Package name components are imported from, e.g. \"@acme/ui\", or a pattern for packages imported by path: \"@acme/ui/{path}\" is @acme/ui/primitives/button for primitives/button.tsx in the package. An installed dependency it names exactly, whose component sources the project does not read, is read from its type declarations (.d.ts). Default: inferred from package exports and tsconfig paths."),
 	elements: z.record(z.string(), z.string()).optional().describe("Extra native element → component mappings, e.g. { \"a\": \"Link\" }."),
 	libraries: librariesSchema.optional().describe(`Published component libraries to read from their type declarations when the project depends on them. Omitted: every one onsystem reads (${LIBRARY_IDS.join(", ")}). false: none. A list: only those, e.g. ["mui"].`),
 	includeDesignSystem: z.boolean().optional().describe("check: lint the design system's own component files too. Off by default: they implement the scale and primitives the rules enforce."),
@@ -3653,9 +3669,11 @@ async function loadConfigWith(options, context = {}) {
 	let packages = context.packages?.root === searchDir ? context.packages : void 0;
 	const finder = (dir) => packages?.root === dir ? packages : packages = new PackageFinder(dir);
 	let lookup = context.lookup;
+	/**
+	* The project's own config: a config file in the folder searched, `--config`, or a workspace
+	* root's that a project in it takes on.
+	*/
 	let configFile;
-	/** The design-system package whose config this project takes on, having none of its own. */
-	let declared;
 	if (options.config) configFile = path.resolve(cwd, options.config);
 	else {
 		const find = (names) => names.map((name) => path.join(searchDir, name)).find((file) => fs.existsSync(file));
@@ -3663,120 +3681,134 @@ async function loadConfigWith(options, context = {}) {
 		const legacy = find(LEGACY_CONFIG_FILES);
 		if (legacy) deprecations.push(legacyConfigNotice(legacy, configFile));
 		configFile ??= legacy ?? ownDeclaredConfig(searchDir);
-		if (!configFile) {
-			lookup ??= findDesignSystemPackage(searchDir, finder(searchDir));
-			if (lookup?.problems.length) throw declarationError(lookup, searchDir);
-			declared = lookup?.found;
-			configFile = declared?.config;
-		}
-	}
-	for (const { name, problem } of lookup?.skipped ?? []) warnings.push(`${name}'s onsystem config was skipped: ${problem} ${name} is installed in node_modules, so this project is read as if it declared none.`);
-	let raw = {};
-	if (configFile) {
-		if (!fs.existsSync(configFile)) throw new ConfigError(`Config file not found: ${configFile}`);
-		if (options.jsonConfigOnly && !configFile.endsWith(".json")) throw new ConfigError(`${configFile} was not run: the server runs a JavaScript or TypeScript config only in a project it was started in (its working directory, --root or the client's roots), not in one found from the path a tool call names. Start the server in the project, or use onsystem.config.json.`);
-		raw = await readConfigFile(configFile);
-	}
-	const parsed = configSchema.safeParse(raw);
-	if (!parsed.success) throw new ConfigError(`Invalid config in ${configFile ?? "(defaults)"}:\n${z.prettifyError(parsed.error)}`);
-	const config = parsed.data;
+	}
+	const config = configFile ? await readConfig(configFile, options) : {};
 	const root = options.root ? path.resolve(cwd, options.root) : options.config && configFile ? path.dirname(configFile) : searchDir;
 	if (!isDirectory(root)) throw new ConfigError(`Project root not found: ${root}`);
-	const base = declared ? declared.dir : options.base ? path.resolve(cwd, options.base) : root;
-	const inherited = base !== root;
-	const fromBase = (p) => inherited ? toPosix(path.relative(root, path.resolve(base, slashGlob(p)))) || "." : p;
+	let declared;
+	if (config.extends !== false) {
+		lookup ??= findDesignSystemPackage(root, finder(root));
+		if (!lookup?.problems.length) declared = lookup?.found;
+		else if (!configFile) throw declarationError(lookup, root);
+		else warnings.push(`${problemLines(lookup.problems)}\nSo ${configFile} is read alone, without the config a design-system package declares. Fix the "${PACKAGE_FIELD}" field in that package, or set "extends": false in ${path.basename(configFile)}.`);
+	}
+	for (const { name, problem } of lookup?.skipped ?? []) {
+		const quoted = json(name);
+		warnings.push(`The onsystem config of ${quoted} was skipped: ${problem} ${quoted} is installed in node_modules, so this project is read as if it declared none.`);
+	}
+	const pkg = declared ? await readConfig(declared.config, options) : void 0;
+	const base = options.base ? path.resolve(cwd, options.base) : root;
+	const rebase = (from) => (p) => from === root ? p : toPosix(path.relative(root, path.resolve(from, slashGlob(p)))) || ".";
+	const fromBase = rebase(base);
+	const fromPackage = rebase(declared?.dir ?? root);
 	const toProject = toPosix(path.relative(base, root));
 	const excludeFromBase = (e) => {
-		if (!inherited || e.startsWith("**/")) return e;
-		if (declared) return fromBase(e);
+		if (base === root || e.startsWith("**/")) return e;
 		if (e === toProject) return "**";
 		return e.startsWith(`${toProject}/`) ? e.slice(toProject.length + 1) : void 0;
 	};
+	const excludeFromPackage = (e) => e.startsWith("**/") ? e : fromPackage(e);
 	const outside = [];
 	const within = (field) => (p) => {
 		if (!declared || staysIn(declared.dir, declared.boundary, slashGlob(p))) return true;
-		outside.push(`${field} ${p}`);
+		outside.push(`${field} ${json(p)}`);
 		return false;
 	};
-	const configComponents = config.components === void 0 ? void 0 : toArray(config.components).filter(within("components"));
-	const configTokens = config.tokens === void 0 ? void 0 : toArray(config.tokens).filter((t) => within("tokens")(typeof t === "string" ? t : t.path));
-	const configDocs = config.docs === void 0 ? void 0 : toArray(config.docs).filter(within("docs"));
-	if (declared && outside.length) warnings.push(`${declared.name}'s onsystem config names paths outside ${declared.installed ? "the package" : "the workspace"}, which were ignored: ${outside.join(", ")}.`);
+	const pathOf = (t) => typeof t === "string" ? t : t.path;
+	const tokensFrom = (move) => (t) => typeof t === "string" ? { path: move(t) } : {
+		...t,
+		path: move(t.path)
+	};
+	const packageComponents = pkg?.components === void 0 ? void 0 : toArray(pkg.components).filter(within("components")).map(fromPackage);
+	const packageTokens = pkg?.tokens === void 0 ? void 0 : toArray(pkg.tokens).filter((t) => within("tokens")(pathOf(t))).map(tokensFrom(fromPackage));
+	const packageDocs = pkg?.docs === void 0 ? void 0 : toArray(pkg.docs).filter(within("docs")).map(fromPackage);
+	if (declared && outside.length) warnings.push(`The onsystem config of ${json(declared.name)} names paths outside ${declared.installed ? "the package" : "the workspace"}, which were ignored: ${outside.join(", ")}.`);
+	const inherits = pkg !== void 0 && config.components === void 0;
+	const configComponents = config.components === void 0 ? packageComponents : toArray(config.components).map(fromBase);
+	const configTokens = config.tokens === void 0 ? inherits ? packageTokens : void 0 : toArray(config.tokens).map(tokensFrom(fromBase));
+	const configDocs = config.docs === void 0 ? inherits ? packageDocs : void 0 : toArray(config.docs).map(fromBase);
+	const importPath = config.importPath ?? (inherits ? pkg.importPath : void 0);
+	const librariesSetting = config.libraries ?? (inherits ? pkg.libraries : void 0);
 	const rules = {};
 	for (const id of RULE_IDS) {
-		const setting = config.rules?.[id];
+		const setting = config.rules?.[id] ?? pkg?.rules?.[id];
 		rules[id] = setting === void 0 ? {
 			severity: DEFAULT_SEVERITY[id],
 			options: {}
 		} : resolveRule(setting);
 	}
-	const overrides = (declared ? [] : config.overrides ?? []).map((override) => ({
+	const overrides = (config.overrides ?? []).map((override) => ({
 		files: toArray(override.files).map(slashGlob),
 		rules: Object.fromEntries(Object.entries(override.rules).map(([id, setting]) => [id, resolveRule(setting)]))
 	}));
-	const tsconfig = config.tsconfig === void 0 || declared ? void 0 : fromBase(config.tsconfig.replaceAll("\\", "/"));
+	const tsconfig = config.tsconfig === void 0 ? void 0 : fromBase(config.tsconfig.replaceAll("\\", "/"));
 	if (tsconfig !== void 0 && !fs.existsSync(path.resolve(root, tsconfig))) throw new ConfigError(`tsconfig not found: ${path.resolve(root, tsconfig)} (from "tsconfig" in ${configFile ?? "the config"})`);
-	const componentsSet = Boolean(options.components?.length) || config.components !== void 0;
+	const componentsSet = Boolean(options.components?.length) || configComponents !== void 0;
 	const detection = componentsSet ? void 0 : detectProject(root, tsconfig, void 0, declared, finder(root));
 	const explicitTokens = options.tokens?.length ? {
 		paths: options.tokens,
 		from: "--tokens"
-	} : config.tokens !== void 0 && !declared ? {
-		paths: toArray(config.tokens).map((t) => fromBase(typeof t === "string" ? t : t.path)),
+	} : config.tokens !== void 0 ? {
+		paths: toArray(config.tokens).map((t) => fromBase(pathOf(t))),
 		from: `"tokens" in ${configFile ?? "the config"}`
 	} : void 0;
 	for (const file of explicitTokens?.paths ?? []) {
 		const absolute = path.resolve(root, slashGlob(file));
 		if (!/[*?[\]{}()!]/.test(file) && !fs.existsSync(absolute)) throw new ConfigError(`Token file not found: ${absolute} (from ${explicitTokens?.from})`);
 	}
-	const components = (options.components?.length ? options.components : configComponents !== void 0 ? configComponents.map(fromBase) : detection ? [...detection.withDefaults ? DEFAULT_COMPONENTS : [], ...detection.components] : DEFAULT_COMPONENTS).map(slashGlob);
-	const libraries = detectLibraries(root, config.libraries, {
-		importPath: config.importPath,
+	const components = (options.components?.length ? options.components : configComponents ?? (detection ? [...detection.withDefaults ? DEFAULT_COMPONENTS : [], ...detection.components] : DEFAULT_COMPONENTS)).map(slashGlob);
+	const libraries = detectLibraries(root, librariesSetting, {
+		importPath,
 		components
 	});
-	const tokenSources = options.tokens?.length ? options.tokens.map((p) => ({ path: p })) : configTokens !== void 0 ? configTokens.map((t) => typeof t === "string" ? { path: fromBase(t) } : {
-		...t,
-		path: fromBase(t.path)
-	}) : [...(detection?.tokens.length ? [...detection.tokens, ...DEFAULT_TOKENS.filter((t) => t.endsWith(".json"))] : DEFAULT_TOKENS).map((p) => ({ path: p })), ...FALLBACK_TOKENS.map((p) => ({
+	const tokenSources = options.tokens?.length ? options.tokens.map((p) => ({ path: p })) : configTokens ?? [...(detection?.tokens.length ? [...detection.tokens, ...DEFAULT_TOKENS.filter((t) => t.endsWith(".json"))] : DEFAULT_TOKENS).map((p) => ({ path: p })), ...FALLBACK_TOKENS.map((p) => ({
 		path: p,
 		fallback: true
 	}))];
 	const tidy = (e) => slashGlob(e).replace(/^(?:\.\/)+/, "").replace(/(.)\/+$/, "$1");
-	const listed = config.exclude ?? [];
-	const dropped = new Set(listed.filter((e) => e.startsWith("!")).map((e) => tidy(e.slice(1))));
-	for (const pattern of dropped) {
-		if (DEFAULT_EXCLUDE.includes(pattern)) continue;
-		warnings.push(`"!${pattern}" in "exclude" takes out none of the defaults, which are ${DEFAULT_EXCLUDE.map((d) => `"${d}"`).join(", ")}: a pattern that starts with "!" names one of them.`);
-	}
-	const exclude = [.../* @__PURE__ */ new Set([...DEFAULT_EXCLUDE.filter((d) => !dropped.has(d)), ...listed.filter((e) => !e.startsWith("!")).map(tidy)])].map(excludeFromBase).filter((e) => e !== void 0);
+	const excludeOf = (listed, move) => {
+		const dropped = new Set(listed.filter((e) => e.startsWith("!")).map((e) => tidy(e.slice(1))));
+		for (const pattern of dropped) {
+			if (DEFAULT_EXCLUDE.includes(pattern)) continue;
+			warnings.push(`"!${pattern}" in "exclude" takes out none of the defaults, which are ${DEFAULT_EXCLUDE.map((d) => `"${d}"`).join(", ")}: a pattern that starts with "!" names one of them.`);
+		}
+		return [.../* @__PURE__ */ new Set([...DEFAULT_EXCLUDE.filter((d) => !dropped.has(d)), ...listed.filter((e) => !e.startsWith("!")).map(tidy)])].map(move).filter((e) => e !== void 0);
+	};
+	const exclude = excludeOf(config.exclude ?? [], excludeFromBase);
+	const packageExclude = pkg?.exclude ? excludeOf(pkg.exclude, excludeFromPackage) : void 0;
 	return {
 		root,
-		configFile,
+		configFile: configFile ?? declared?.config,
 		components,
-		exclude: declared && config.exclude ? [.../* @__PURE__ */ new Set([...DEFAULT_EXCLUDE, ...exclude])] : exclude,
-		...declared && config.exclude ? { designSystemExclude: exclude } : {},
+		exclude: packageExclude ? [.../* @__PURE__ */ new Set([...exclude, ...packageExclude.filter((e) => !DEFAULT_EXCLUDE.includes(e))])] : exclude,
+		...packageExclude && inherits ? { designSystemExclude: packageExclude } : {},
 		tokens: tokenSources.map((t) => ({
 			...t,
 			path: slashGlob(t.path)
 		})),
 		...!options.tokens?.length && configTokens === void 0 ? { tokensDetected: true } : {},
-		docs: (options.docs?.length ? options.docs : configDocs === void 0 ? [.../* @__PURE__ */ new Set([...DEFAULT_DOCS, ...detection?.docs ?? []])] : configDocs.map(fromBase)).map(slashGlob),
+		docs: (options.docs?.length ? options.docs : configDocs ?? [.../* @__PURE__ */ new Set([...DEFAULT_DOCS, ...detection?.docs ?? []])]).map(slashGlob),
 		tsconfig,
-		importPath: config.importPath,
-		imports: detection?.imports ?? (declared && componentsSet ? packageImports(root, declared.dir) : []),
+		importPath,
+		imports: detection?.imports ?? (declared && inherits && componentsSet ? packageImports(root, declared.dir) : []),
 		detected: detection?.source,
 		...detection?.designSystems ? { designSystems: detection.designSystems } : {},
 		tailwindConfig: findTailwindConfig(root),
 		libraries: libraries.read,
-		libraryIds: config.libraries,
+		libraryIds: librariesSetting,
 		librariesOff: libraries.off,
 		librariesUnread: libraries.unread,
-		elements: config.elements ?? {},
-		includeDesignSystem: options.includeDesignSystem ?? (declared ? void 0 : config.includeDesignSystem) ?? false,
+		elements: {
+			...inherits ? pkg.elements : {},
+			...config.elements
+		},
+		includeDesignSystem: options.includeDesignSystem ?? config.includeDesignSystem ?? false,
 		rules,
 		overrides,
-		...inherited && !declared ? { base } : {},
+		...base !== root ? { base } : {},
 		...declared ? { designSystemPackage: declared } : {},
+		...inherits ? { inherits: true } : {},
+		...config.extends === false ? { extendsOff: true } : {},
 		configured: componentsSet,
 		...deprecations.length ? { deprecations } : {},
 		...warnings.length ? { warnings } : {}
@@ -3785,7 +3817,7 @@ async function loadConfigWith(options, context = {}) {
 /**
 * Whether `dir` has a config of its own: a config file under its current or old name, or one its
 * package.json names in its `onsystem` field. Without one, a project takes on its design-system
-* package's config, else the workspace root's.
+* package's config, and, from a workspace root, the root's over it.
 */
 function hasOwnConfig(dir) {
 	if ([...CONFIG_FILES, ...LEGACY_CONFIG_FILES].some((name) => fs.existsSync(path.join(dir, name)))) return true;
@@ -3797,9 +3829,17 @@ function ownDeclaredConfig(dir) {
 	if (declared && "problem" in declared) throw new ConfigError(declared.problem);
 	return declared?.file;
 }
+/**
+* Each declaration that cannot be read, on a line of its own. The package's name is the
+* repository's text (any string can name a dependency in package.json), so it is JSON-quoted:
+* a line break or a sentence in it stays inside the quotes, on that line.
+*/
+function problemLines(problems) {
+	return problems.map((p) => `${json(p.name)}: ${p.problem}`).join("\n");
+}
 /** The error for workspace packages whose declaration cannot be read: their team can fix them. */
 function declarationError(lookup, dir) {
-	return new ConfigError(`${lookup.problems.map((p) => `${p.name}: ${p.problem}`).join("\n")}\nFix the "${PACKAGE_FIELD}" field in that package, or give ${dir} a config of its own (onsystem.config.json), which is read instead.`);
+	return new ConfigError(`${problemLines(lookup.problems)}\nFix the "${PACKAGE_FIELD}" field in that package, or give ${dir} a config of its own (onsystem.config.json), which is read instead.`);
 }
 /**
 * Whether a path or glob in a dependency's config, relative to its folder `dir`, stays in
@@ -3863,6 +3903,14 @@ function nodeRunsTypeScript(version = process.versions.node) {
 	const [major = 0, minor = 0] = version.replace(/^v/, "").split(".").map(Number);
 	return major > 23 || major === 23 && minor >= 6 || major === 22 && minor >= 18;
 }
+/** A config file, read and validated: a JSON one only with `jsonConfigOnly`. */
+async function readConfig(file, options) {
+	if (!fs.existsSync(file)) throw new ConfigError(`Config file not found: ${file}`);
+	if (options.jsonConfigOnly && !file.endsWith(".json")) throw new ConfigError(`${file} was not run: the server runs a JavaScript or TypeScript config only in a project it was started in (its working directory, --root or the client's roots), not in one found from the path a tool call names. Start the server in the project, or use onsystem.config.json.`);
+	const parsed = configSchema.safeParse(await readConfigFile(file));
+	if (!parsed.success) throw new ConfigError(`Invalid config in ${file}:\n${z.prettifyError(parsed.error)}`);
+	return parsed.data;
+}
 async function readConfigFile(file) {
 	if (/\.[cm]?ts$/.test(file) && !nodeRunsTypeScript()) throw new ConfigError(`${file} is TypeScript, which Node.js runs from 22.18; this is ${process.version}. Use onsystem.config.json or .mjs, or Node.js 22.18 or later.`);
 	if (file.endsWith(".json")) try {
@@ -4913,6 +4961,8 @@ function dedent(code) {
 }
 //#endregion
 //#region src/libraries/declarations.ts
+/** A component's name: a capitalised identifier (`Button`, `ButtonBase`, `Unstable_Grid2`). */
+const COMPONENT_NAME = /^[A-Z][\w$]*$/;
 /** Packages contributing more props than this are summarised, as in source extraction. */
 const MAX_LISTED_INHERITED = 40;
 /**
@@ -4984,9 +5034,9 @@ function extractLibrary(options) {
 			const declaration = symbol.valueDeclaration ?? symbol.declarations?.[0];
 			const isDefault = exported.getName() === "default";
 			const name = isDefault && subpath && declaration ? ts.getNameOfDeclaration(declaration)?.getText() ?? "default" : exported.getName();
-			if (isDefault && !/^[A-Z]/.test(name)) continue;
+			if (isDefault && !COMPONENT_NAME.test(name)) continue;
 			exportNames.add(name);
-			if (!/^[A-Z]/.test(name)) continue;
+			if (!COMPONENT_NAME.test(name)) continue;
 			const known = bySymbol.get(symbol);
 			if (known) {
 				if (known.name !== name && !known.aliases.includes(name)) known.aliases.push(name);
@@ -8179,7 +8229,8 @@ function table(tokens, keys) {
 		use(token),
 		...described ? [token.description ?? ""] : []
 	]);
-	const line = (cells) => `| ${cells.map((c) => c.replace(/\|/g, "\\|")).join(" | ")} |`;
+	const oneLine = (text) => text.split(/\r\n?|\n/).map((part) => part.trim()).filter(Boolean).join(" ");
+	const line = (cells) => `| ${cells.map((c) => oneLine(c).replace(/\|/g, "\\|")).join(" | ")} |`;
 	return [
 		line(header),
 		line(header.map(() => "---")),
@@ -10411,7 +10462,7 @@ function maskReferencedGradientIds(elements) {
 	for (const element of elements) if (element.tag === "mask") refsFrom(element.node);
 	return ids;
 }
-const noHardcodedColor = {
+const noHardcodedColor = shortQuotes({
 	id: "no-hardcoded-color",
 	description: "Colors must come from design tokens: no hex/rgb/oklch literals, arbitrary Tailwind colors or default-palette classes.",
 	run(context) {
@@ -10622,7 +10673,31 @@ const noHardcodedColor = {
 		}
 		reportChartTokens(context, allow);
 	}
-};
+});
+/** The longest code a message quotes. */
+const QUOTED_CODE = 120;
+/**
+* The rule, with each `code` span in its messages cut to QUOTED_CODE characters. A message quotes
+* the class, its fix and the value whole, so one class with 33,000 `hover:` variants made a
+* message of 400,000 characters for the agent to read.
+*/
+function shortQuotes(rule) {
+	const cut = (span, code) => code.length > QUOTED_CODE ? `\`${truncate(code, QUOTED_CODE)}\`` : span;
+	return {
+		...rule,
+		run(context) {
+			rule.run({
+				...context,
+				report(report) {
+					context.report({
+						...report,
+						message: report.message.replace(/`([^`]+)`/g, cut)
+					});
+				}
+			});
+		}
+	};
+}
 /** Packages that draw charts: Recharts, Chart.js, Nivo, visx, Victory, Tremor, MUI X Charts, D3. */
 const CHART_LIBRARY = /chart|^@nivo\/|^@visx\/|^victory|^@tremor\/|^d3(?:-|$)/i;
 /** Roles of an element that is a drawing: a chart drawn by hand is an image. */
@@ -11211,25 +11286,69 @@ function setsColor(utility, prefix) {
 */
 function keepStatesApart(list) {
 	const after = (listed) => listed.report?.fix?.[0]?.text ?? listed.value;
+	const order = new Map(list.map((listed, i) => [listed, i]));
+	const parsed = /* @__PURE__ */ new Map();
+	const parse = (text) => {
+		let utility = parsed.get(text);
+		if (!utility) {
+			utility = parseUtility(text);
+			parsed.set(text, utility);
+		}
+		return utility;
+	};
+	const byText = /* @__PURE__ */ new Map();
+	const byUtility = /* @__PURE__ */ new Map();
+	const utilityKey = (text) => `${parse(text).base}\0${parse(text).modifier}`;
+	const place = (listed) => {
+		const text = after(listed);
+		const same = byText.get(text) ?? [];
+		byText.set(text, same);
+		const index = order.get(listed) ?? 0;
+		same.splice(same.findLastIndex((other) => (order.get(other) ?? 0) < index) + 1, 0, listed);
+		const texts = byUtility.get(utilityKey(text)) ?? /* @__PURE__ */ new Set();
+		byUtility.set(utilityKey(text), texts.add(text));
+	};
+	const unplace = (listed) => {
+		const text = after(listed);
+		const same = byText.get(text) ?? [];
+		same.splice(same.indexOf(listed), 1);
+		if (!same.length) byUtility.get(utilityKey(text))?.delete(text);
+	};
+	for (const listed of list) place(listed);
 	for (const pass of ["state", "base"]) for (const listed of list) {
 		const { report } = listed;
 		if (!report?.fix?.[0]) continue;
-		for (const other of list) {
-			if (other === listed || oneColor(listed.color, other.color)) continue;
-			const [stateListed, baseListed] = pass === "state" ? [listed, other] : [other, listed];
-			const state = parseUtility(after(stateListed));
-			const base = parseUtility(after(baseListed));
+		const text = after(listed);
+		let found;
+		for (const otherText of byUtility.get(utilityKey(text)) ?? []) {
+			if (otherText === text) continue;
+			const [state, base] = pass === "state" ? [parse(text), parse(otherText)] : [parse(otherText), parse(text)];
 			const conditions = conditionsBetween(state, base);
-			if (!conditions || hasDarkBase(list, stateListed, baseListed, state, base, after)) continue;
-			const had = pass === "base" ? `\`${other.value}\` is in the class list too` : after(other) === other.value ? `The class list already has \`${other.value}\`` : `\`${other.value}\` becomes \`${after(other)}\` too`;
-			const apart = state.modifier ? "such as with another opacity modifier" : `such as with \`${withBase({
-				...state,
-				modifier: "/90"
-			}, state.base)}\``;
-			report.message += ` ${had}, so with this fix \`${conditions}\` would change nothing: it is not applied automatically. Keep the two apart, ${apart}.`;
-			report.fix = void 0;
-			break;
+			if (!conditions) continue;
+			for (const other of byText.get(otherText) ?? []) {
+				if (found && (order.get(other) ?? 0) > (order.get(found.other) ?? 0)) break;
+				if (oneColor(listed.color, other.color)) continue;
+				const [stateListed, baseListed] = pass === "state" ? [listed, other] : [other, listed];
+				if (hasDarkBase(list, stateListed, baseListed, state, base, after)) continue;
+				found = {
+					other,
+					state,
+					conditions
+				};
+				break;
+			}
 		}
+		if (!found) continue;
+		const { other, state, conditions } = found;
+		const had = pass === "base" ? `\`${other.value}\` is in the class list too` : after(other) === other.value ? `The class list already has \`${other.value}\`` : `\`${other.value}\` becomes \`${after(other)}\` too`;
+		const apart = state.modifier ? "such as with another opacity modifier" : `such as with \`${withBase({
+			...state,
+			modifier: "/90"
+		}, state.base)}\``;
+		report.message += ` ${had}, so with this fix \`${conditions}\` would change nothing: it is not applied automatically. Keep the two apart, ${apart}.`;
+		unplace(listed);
+		report.fix = void 0;
+		place(listed);
 	}
 }
 /**
@@ -11409,7 +11528,8 @@ function scopes(context, element, classes) {
 		if (name && !/^Sidebar(?:Provider|Inset)$/.test(name)) tags.push(name);
 	}
 	const { tokens, components } = context.target;
-	const found = scopesIn(tokens.scopedFamilies, context.file, classes, ...tags);
+	const found = scopesIn(tokens.scopedFamilies, context.file, ...tags);
+	if (classes) for (const family of classScopes(context, classes)) found.add(family);
 	const files = /* @__PURE__ */ new Set([context.file]);
 	for (const tag of tags) {
 		const file = components.get(tag)?.source.file;
@@ -11421,6 +11541,25 @@ function scopes(context, element, classes) {
 	}
 	return found;
 }
+/** The scoped families each class string of a check names, by its text. */
+const classScopeCache = /* @__PURE__ */ new WeakMap();
+/**
+* The scoped families a class string names, read once per string and check: each color in it
+* asks, and reading the whole string again for each made a list of thousands quadratic.
+*/
+function classScopes(context, classes) {
+	let cache = classScopeCache.get(context.analysis);
+	if (!cache) {
+		cache = /* @__PURE__ */ new Map();
+		classScopeCache.set(context.analysis, cache);
+	}
+	let found = cache.get(classes);
+	if (!found) {
+		found = scopesIn(context.target.tokens.scopedFamilies, classes);
+		cache.set(classes, found);
+	}
+	return found;
+}
 /** The variant prop of the element's component that already sets `prefix-*` classes, if any. */
 function variantProp(context, element, prefix) {
 	const resolution = context.resolve(element);
@@ -11443,7 +11582,7 @@ function numberValue(init) {
 	if (ts.isPrefixUnaryExpression(init) && ts.isNumericLiteral(init.operand) && (init.operator === ts.SyntaxKind.MinusToken || init.operator === ts.SyntaxKind.PlusToken)) return `${init.operator === ts.SyntaxKind.MinusToken ? "-" : ""}${init.operand.text}`;
 }
 function lengthRule(id, description, spec) {
-	return {
+	return shortQuotes({
 		id,
 		description,
 		run(context) {
@@ -11515,7 +11654,7 @@ function lengthRule(id, description, spec) {
 				}
 			}
 		}
-	};
+	});
 }
 /**
 * A value on the scale whose token code cannot name, with neither a Tailwind class nor a
@@ -11998,7 +12137,7 @@ function isObject(value) {
 var name = "onsystem";
 //#endregion
 //#region src/version.ts
-const VERSION = "0.9.1";
+const VERSION = "0.10.1";
 const NAME = name;
 //#endregion
 //#region src/lint/sarif.ts
@@ -12221,7 +12360,7 @@ function checkSource(code, target, options) {
 	try {
 		return checkParsed(code, target, options, file);
 	} catch (error) {
-		if (!isStackOverflow(error)) throw error;
+		if (!isStackOverflow$1(error)) throw error;
 		return {
 			file,
 			diagnostics: [{
@@ -12239,7 +12378,7 @@ function checkSource(code, target, options) {
 		};
 	}
 }
-function isStackOverflow(error) {
+function isStackOverflow$1(error) {
 	return error instanceof RangeError && /call stack/i.test(error.message);
 }
 function checkParsed(code, target, options, file) {
@@ -12363,7 +12502,7 @@ function uncheckedNotice(results) {
 	const list = [...names];
 	const shown = list.slice(0, 4).map((n) => `<${n}>`);
 	const more = list.length > shown.length ? ` and ${list.length - shown.length} more` : "";
-	const from = [...modules].slice(0, 3).map((m) => `"${m}"`);
+	const from = [...modules].slice(0, 3).map((m) => JSON.stringify(m));
 	const moreModules = modules.size > from.length ? ` and ${modules.size - from.length} more` : "";
 	const where = results.length > 1 ? ` (in ${files} ${files === 1 ? "file" : "files"})` : "";
 	return `${shown.join(", ")}${more} ${list.length === 1 ? "comes" : "come"} from ${from.join(", ")}${moreModules}, which the design-system model does not include, so ${list.length === 1 ? "it was" : "they were"} not checked${where}. Extraction looks incomplete: \`inspect\` lists what was found; add the missing files to "components" in the config.`;
@@ -13080,6 +13219,38 @@ function repositoryOf(dir) {
 		if (current === path.dirname(current)) return void 0;
 	}
 }
+/**
+* `extractComponents`, without the component files nested too deeply for TypeScript's recursive
+* parser (thousands of levels), each named in a warning: one such file would otherwise fail the
+* whole design system with a RangeError that names no file.
+*/
+function extractReadable(options) {
+	try {
+		return extractComponents(options);
+	} catch (error) {
+		if (!isStackOverflow(error)) throw error;
+		const tooDeep = new Set(options.files.filter(overflowsParser));
+		if (!tooDeep.size) throw error;
+		const extracted = extractComponents({
+			...options,
+			files: options.files.filter((file) => !tooDeep.has(file))
+		});
+		for (const file of tooDeep) extracted.warnings.push(`${relativePath(options.root, file)}: nested too deeply to read (thousands of levels); skipped.`);
+		return extracted;
+	}
+}
+/** Whether parsing `file` on its own runs out of stack. */
+function overflowsParser(file) {
+	try {
+		ts.createSourceFile(file, fs.readFileSync(file, "utf8"), ts.ScriptTarget.Latest);
+		return false;
+	} catch (error) {
+		return isStackOverflow(error);
+	}
+}
+function isStackOverflow(error) {
+	return error instanceof RangeError && /call stack/i.test(error.message);
+}
 /** What `inspect` and the server's log say about files that lead outside the project. */
 function outsideWarning(root, files) {
 	const shown = files.map((file) => relativePath(root, file)).sort();
@@ -13227,11 +13398,54 @@ async function cacheKey(config, files, dependencies, stats = new FileStats(confi
 		stats: await stats.of(all)
 	})).digest("hex");
 }
+/**
+* Where the model is cached: the project's `node_modules/.cache`, else (`temp`) a folder of the
+* user's own in the system temp folder, `onsystem-<uid>`.
+*/
 function cacheFile(root) {
 	const nodeModules = path.join(root, "node_modules");
-	if (fs.existsSync(nodeModules)) return path.join(nodeModules, ".cache", "onsystem", "model.json");
+	if (fs.existsSync(nodeModules)) return {
+		file: path.join(nodeModules, ".cache", "onsystem", "model.json"),
+		temp: false
+	};
 	const id = createHash("sha256").update(root).digest("hex").slice(0, 16);
-	return path.join(os.tmpdir(), "onsystem", `${id}.json`);
+	const user = process.getuid ? `-${process.getuid()}` : "";
+	return {
+		file: path.join(os.tmpdir(), `onsystem${user}`, `${id}.json`),
+		temp: true
+	};
+}
+/**
+* Why the cache folder in the system temp folder cannot be trusted, or undefined when it can: it
+* must be a folder, not a link, that the user owns and no one else can write to. On a multi-user
+* host the temp folder is shared, and a model planted in it would reach the agent. With `create`,
+* it is created (or closed) for the user first. Windows gives each user a temp folder of their own.
+*/
+async function untrustedCacheFolder(folder, create) {
+	if (!process.getuid) return void 0;
+	if (create) await fsp.mkdir(folder, {
+		recursive: true,
+		mode: 448
+	});
+	const stat = await fsp.lstat(folder);
+	if (!stat.isDirectory()) return `${folder} is not a folder`;
+	if (stat.uid !== process.getuid()) return `${folder} belongs to another user`;
+	if (!create && stat.mode & 18) return `other users can write to ${folder}`;
+	if (create && stat.mode & 63) await fsp.chmod(folder, 448);
+}
+/**
+* Writes `text` beside `file`, then renames it into place: a run reading it never sees half. With
+* `own`, only the user can read it (the temp folder's cache); without, it has the default mode, so
+* a cache in `node_modules` built by one user (a Docker build as root) is still read by another.
+*/
+async function writeWhole(file, text, own) {
+	const partial = `${file}.${process.pid}-${randomUUID()}.tmp`;
+	try {
+		await fsp.writeFile(partial, text, own ? { mode: 384 } : {});
+		await fsp.rename(partial, file);
+	} finally {
+		await fsp.rm(partial, { force: true });
+	}
 }
 /**
 * Fingerprint of the files a config tracks (paths, sizes, mtimes), plus the
@@ -13245,10 +13459,10 @@ async function buildModel(config, options = {}) {
 	const started = performance.now();
 	const files = await resolveFiles(config);
 	const useCache = options.cache !== false;
-	const cachePath = cacheFile(config.root);
+	const { file: cachePath, temp } = cacheFile(config.root);
 	let cached;
 	if (useCache && !options.oldProgram) try {
-		cached = JSON.parse(await fsp.readFile(cachePath, "utf8"));
+		if (!(temp && await untrustedCacheFolder(path.dirname(cachePath), false))) cached = JSON.parse(await fsp.readFile(cachePath, "utf8"));
 	} catch {}
 	const known = Array.isArray(cached?.dependencies) ? cached.dependencies : options.oldProgram ? projectFiles(options.oldProgram) : [];
 	const stats = new FileStats(config.root);
@@ -13262,7 +13476,7 @@ async function buildModel(config, options = {}) {
 			dependencies: cached.dependencies
 		};
 	}
-	const extracted = extractComponents({
+	const extracted = extractReadable({
 		root: config.root,
 		files: files.components,
 		tsconfig: config.tsconfig,
@@ -13324,12 +13538,16 @@ async function buildModel(config, options = {}) {
 	]);
 	const key = await cacheKey(config, files, dependencies, stats);
 	if (useCache) try {
-		await fsp.mkdir(path.dirname(cachePath), { recursive: true });
-		await fsp.writeFile(cachePath, JSON.stringify({
+		const folder = path.dirname(cachePath);
+		let untrusted;
+		if (temp) untrusted = await untrustedCacheFolder(folder, true);
+		else await fsp.mkdir(folder, { recursive: true });
+		if (untrusted) logger.warn(`not caching the model: ${untrusted}. Install the project's dependencies, so the cache goes in node_modules, or set TMPDIR to a folder of your own.`);
+		else await writeWhole(cachePath, JSON.stringify({
 			key,
 			dependencies,
 			model
-		}));
+		}), temp);
 	} catch (error) {
 		logger.warn(`could not write cache ${cachePath}: ${error.message}`);
 	}
@@ -13406,15 +13624,16 @@ var DesignSystemHost = class {
 		this.watchConfigFiles();
 	}
 	/**
-	* Watches the config file, the tsconfig and the tsconfigs it extends through
-	* their directories: editors save by renaming a new file over the old one,
-	* which ends a watch on the file. Called again after each build, so a new
-	* `extends` target is picked up.
+	* Watches the config file, the config a design-system package declares, which a project with
+	* a config of its own reads under that one, the tsconfig and the tsconfigs it extends through
+	* their directories: editors save by renaming a new file over the old one, which ends a watch
+	* on the file. Called again after each build, so a new `extends` target is picked up.
 	*/
 	watchConfigFiles() {
 		const { root, configFile, tsconfig, designSystemPackage } = this.config;
 		const files = [
 			configFile,
+			designSystemPackage?.config,
 			designSystemPackage && path.join(designSystemPackage.dir, "package.json"),
 			...DETECTION_FILES.map((f) => path.join(root, f)),
 			...tsconfig ? [path.resolve(root, tsconfig)] : PROJECT_CONFIG_FILES.map((f) => path.join(root, f)),
@@ -13472,7 +13691,7 @@ var DesignSystemHost = class {
 		const { root, configFile, designSystemPackage, warnings } = this.config;
 		const load = this.options.loadConfig ?? (() => loadConfig({
 			root,
-			config: designSystemPackage ? void 0 : configFile
+			config: configFile === designSystemPackage?.config ? void 0 : configFile
 		}));
 		try {
 			this.config = await load();
@@ -13511,4 +13730,4 @@ var DesignSystemHost = class {
 	}
 };
 //#endregion
-export { LEGACY_CONFIG_FILES as $, unrecordedRules as A, relativePath as At, statusKinds as B, countBaseline as C, closest as Ct, pruneBaseline as D, SCRIPT_FILE$2 as Dt, onLines as E, unique as Et, loadTokens as F, parseDoc as G, parseDesignMd as H, mergeTokens as I, ConfigError as J, extractComponents as K, toDesignMd as L, writeBaseline as M, defaultProjectConfig as Mt, RULES as N, readProjectConfig as Nt, readBaseline as O, isInside as Ot, TokenIndex as P, DEFAULT_TEST_FOLDERS as Q, toDtcg as R, applyBaseline as S, workspacePatterns as St, goneFiles as T, truncate as Tt, parseCssTokens as U, parseDtcgTokens as V, attachDocs as W, DEFAULT_SEVERITY as X, DEFAULT_DOCS as Y, DEFAULT_TEST_EXCLUDE as Z, formatDiagnostics as _, detectProject as _t, fingerprint as a, loadConfig as at, BASELINE_FILE as b, isWorkspaceRoot as bt, silentLogger as c, formatPx as ct, descriptionOf as d, LIBRARY_IDS as dt, RULE_IDS as et, searchComponents as f, libraryTitle as ft, escapeData as g, declaredConfig as gt, uncheckedNotice as h, PackageFinder as ht, componentFiles as i, hasOwnConfig as it, updateBaseline as j, toPosix as jt, rulesRun as k, matchesGlob as kt, stderrLogger as l, findVariantDefinitions as lt, checkSource as m, PACKAGE_FIELD as mt, DesignSystemHost as n, defineConfig as nt, loadDesignSystem as o, loadConfigWith as ot, applyFixes as p, notReadYet as pt, CONFIG_FILES as q, buildModel as r, excludedBy as rt, tokenFiles as s, rulesFor as st, DesignSystem as t, configJsonSchema as tt, buildSearchIndex as u, LIBRARIES as ut, NAME as v, findDesignSystemPackage as vt, findMoves as w, plural$1 as wt, LEGACY_BASELINE_FILE as x, workspacePackageDirs as xt, VERSION as y, isDesignSystemName as yt, TOKEN_CATEGORIES as z };
+export { DEFAULT_TOKENS as $, unrecordedRules as A, toPosix as At, statusKinds as B, countBaseline as C, workspacePackageDirs as Ct, pruneBaseline as D, matchesGlob as Dt, onLines as E, isInside as Et, loadTokens as F, unique as Ft, parseDoc as G, parseDesignMd as H, mergeTokens as I, defaultProjectConfig as It, ConfigError as J, extractComponents as K, toDesignMd as L, readProjectConfig as Lt, writeBaseline as M, json as Mt, RULES as N, plural$1 as Nt, readBaseline as O, pathOf as Ot, TokenIndex as P, truncate as Pt, DEFAULT_TEST_FOLDERS as Q, toDtcg as R, applyBaseline as S, isWorkspaceRoot as St, goneFiles as T, SCRIPT_FILE$2 as Tt, parseCssTokens as U, parseDtcgTokens as V, attachDocs as W, DEFAULT_SEVERITY as X, DEFAULT_DOCS as Y, DEFAULT_TEST_EXCLUDE as Z, formatDiagnostics as _, PackageFinder as _t, fingerprint as a, excludedBy as at, BASELINE_FILE as b, findDesignSystemPackage as bt, silentLogger as c, loadConfigWith as ct, descriptionOf as d, findVariantDefinitions as dt, FALLBACK_TOKENS as et, searchComponents as f, LIBRARIES as ft, escapeData as g, PACKAGE_FIELD as gt, uncheckedNotice as h, notReadYet as ht, componentFiles as i, defineConfig as it, updateBaseline as j, closest as jt, rulesRun as k, relativePath as kt, stderrLogger as l, rulesFor as lt, checkSource as m, libraryTitle as mt, DesignSystemHost as n, RULE_IDS as nt, loadDesignSystem as o, hasOwnConfig as ot, applyFixes as p, LIBRARY_IDS as pt, CONFIG_FILES as q, buildModel as r, configJsonSchema as rt, tokenFiles as s, loadConfig as st, DesignSystem as t, LEGACY_CONFIG_FILES as tt, buildSearchIndex as u, formatPx as ut, NAME as v, declaredConfig as vt, findMoves as w, workspacePatterns as wt, LEGACY_BASELINE_FILE as x, isDesignSystemName as xt, VERSION as y, detectProject as yt, TOKEN_CATEGORIES as z };