milestone 23 s1: stylex build integration, tokens and shared styles

licenses/inventory.zon

@@ -39,6 +39,21 @@
 // stay listed in licenses/dependency-identity.txt so that a future build which
 // does pull them in trips the guard.
 //
+// Four more joined that list with the StyleX build integration: css-mediaquery,
+// invariant, and loose-envify with js-tokens under it. They are @stylexjs/
+// stylex's own dependencies, they serve its compiler and not its runtime, and a
+// sourcemap build of a component calling stylex.props shows none of them in any
+// `sources` list.
+//
+// StyleX itself is inventoried below although nothing imports it yet, so no
+// chunk carries it today. The licence is carried now because the same sourcemap
+// build settles what the page conversion will land, and it is not the obvious
+// answer: only @stylexjs/stylex appears as a bundled package, and styleq
+// arrives inside it. The published lib/es/stylex.mjs vendors styleq's source
+// instead of importing it, so styleq's bytes ship while styleq never appears in
+// a `sources` list — no guard would raise it, which is why it is written down
+// here.
+//
 // Of the remaining devDependencies, none puts a byte in web/dist: @vitejs/
 // plugin-react and typescript only transform our own sources (react-refresh is
 // dev-server only, and tslib is optional and unused), @tailwindcss/vite
@@ -94,6 +109,18 @@
         .note = "Bundled into the admin UI JavaScript. Grouped because all five carry the identical MIT text and copyright line.",
         .file = "tanstack-mit.txt",
     },
+    .{
+        .component = "StyleX",
+        .version = "@stylexjs/stylex 0.19.0",
+        .note = "The style runtime for the admin UI. Its published dist vendors styleq's source, so the styleq entry below covers bytes that arrive inside this package. The npm tarball ships no licence file of its own; this text is the LICENSE of facebook/stylex at tag 0.19.0, which is byte-identical to the one on main.",
+        .file = "stylex-mit.txt",
+    },
+    .{
+        .component = "styleq",
+        .version = "styleq 0.2.1",
+        .note = "The class-name merger StyleX calls at runtime. Never a bundled package in its own right: @stylexjs/stylex vendors its source into lib/es/stylex.mjs, so it reaches web/dist without appearing in any sourcemap `sources` list. Separate entry from StyleX: same MIT text, different copyright line.",
+        .file = "styleq-mit.txt",
+    },
     .{
         .component = "TanStack Store",
         .version = "@tanstack/store 0.9.3, @tanstack/react-store 0.9.3",