fix(ui): harden built CSS checks

Author: librowski

packages/ui/built-css-pitfalls.md

@@ -57,7 +57,7 @@ legitimate pattern rather than a mis-scoped default. Every other check applies e
 
 **How to spot it** - Search declarations for the legacy `--ax-` prefix and for `--wb-` properties outside `--wb-ds-`, `--wb-sdk-`, or `--wb-public-`. Unprefixed component-local and third-party properties remain valid. Source Stylelint separately verifies that variable uses resolve and applies the fallback contract from `wb/no-system-token-fallbacks`.
 
-**Automated?** - Yes. `Unsanctioned variable namespace` checks declaration property names without a catalogue of individual variables.
+**Automated?** - Yes. `Unsanctioned variable namespace` checks declaration property names without a catalogue of individual variables. It does not inspect custom property names inside `var()` values. This narrowing is safe today because Stylelint's `csstools/value-no-unknown-custom-properties` rule rejects unknown names in source files, and the build does not generate new `var()` references. If a build transform starts rewriting `var()` values, the narrowing is no longer safe and the value check must be restored.
 
 ## Built CSS import
 

packages/ui/scripts/check-built-css.ts

@@ -1,4 +1,4 @@
-import { existsSync, globSync, readFileSync, statSync } from 'node:fs';
+import { globSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import path from 'node:path';
 
 import postcss, { AtRule, type ChildNode, type Declaration, type Node } from 'postcss';
@@ -34,6 +34,19 @@ function add(file: string, node: Node | undefined, message: string): void {
   problems.push(`${file}:${node?.source?.start?.line ?? 1} ${message}. See ${pitfalls}.`);
 }
 
+function existsWithExactCase(root: string, relativeTarget: string): boolean {
+  let current = root;
+  return relativeTarget.split(path.sep).every((segment) => {
+    try {
+      if (!readdirSync(current).includes(segment)) return false;
+    } catch {
+      return false;
+    }
+    current = path.join(current, segment);
+    return true;
+  });
+}
+
 function isPublicDefault(declaration: Declaration): boolean {
   const rule = declaration.parent;
   if (
@@ -107,7 +120,7 @@ for (const { path: directory, ownsLayerContract } of directories) {
         const relativeTarget = path.relative(directory, target);
         const outside =
           relativeTarget === '..' || relativeTarget.startsWith(`..${path.sep}`) || path.isAbsolute(relativeTarget);
-        if (outside || !existsSync(target) || !statSync(target).isFile())
+        if (outside || !existsWithExactCase(directory, relativeTarget) || !statSync(target).isFile())
           add(file, declaration, 'Missing built URL target');
       }
     });