Vendoring

There is nothing to install and nothing to fetch at build time. A consumer takes bytes and proves them against a lock.

How to consume it

Vendor the files; the lock does the rest

There is no package to install and nothing to fetch at build time. A consumer copies the files it needs, copies brand.lock verbatim, and declares what it took in brand.uses — the one file in the set that differs per repository.

# take the current layer
npm run brand:sync -- --from ../../333.eco/brand.333.eco

# in CI — no network, no credentials, no sibling checkout
npm run check:brand

Concatenation order

It is not arbitrary. Custom-property substitution is lazy, so a value declared early may reference one a later file sets — which is how --accent, set per site, reaches the derived family.

tokens.css
  + theme-3block.css   or   theme-2state.css
  + motion.css
  + metta.css          opt-in — only where a session descends
  + reduce-global.css  (opt-in)
  + brand.css          (per site)
  + site.css           (per site)

Never @import a sibling of these files. The partial-based sites inject their stylesheets as raw text and concatenate them; a relative @import resolves against src/, where partials/ is unreachable, and ships a dead render-blocking at-rule that quietly destroys the one-request-renders-complete property.

Two theme files, on purpose

theme-3block.css is a dark-default cascade for sites that stamp both classes and must resolve the unstamped case themselves. theme-2state.css is a light-default stamp for a site whose resolver already handles three states and writes only .dark. Neither is the inferior variant of the other, and converting a site between them is a regression, not a tidy-up.