Refactor token-utils loops; mark TODO items done

Replace forEach callbacks with for..of loops in scripts/token-utils.ts to make control flow explicit (use continue instead of callback return) and simplify deepMerge by iterating Object.entries and avoiding redundant lookups. Update TODO.md to mark Tailwind preset composition and CSS variable integration checks as completed and add notes pointing to the example/integration-fixture and check:integration validation.

Author: bradpotts

TODO.md

@@ -86,13 +86,16 @@ design synchronization, and safe retirement paths.
   - Validate that the package works the way downstream packages actually
   consume it, not just that the token shape is correct in isolation.
 
-- [ ] Validate Tailwind preset composition against a downstream config
+- [x] Validate Tailwind preset composition against a downstream config
   - Confirm the preset composes correctly with a consumer Tailwind config that
   has its own theme extensions. Catch namespace collisions and merge conflicts.
+  - Delivered via `example/integration-fixture/` validated by `check:integration`.
 
-- [ ] Validate CSS variable output in a real integration context
+- [x] Validate CSS variable output in a real integration context
   - Confirm variables do not collide with or shadow downstream CSS when the
   package is used alongside `spectre-ui`.
+  - Delivered via `example/integration-fixture/layer.css` and `check:integration`
+  namespace-collision checks.
 
 - [x] Document any integration constraints as explicit contract rules
   - Add integration-level requirements to `TOKEN_CONTRACT.md` so they are part

scripts/token-utils.ts

@@ -30,20 +30,19 @@ function assertNoDuplicateTokenPaths(files: string[]): void {
   const owners = new Map<string, string>();
   const duplicates: string[] = [];
 
-  files.forEach((file) => {
+  for (const file of files) {
     const fullPath = join(TOKENS_DIR, file);
     const content = JSON.parse(readFileSync(fullPath, 'utf8')) as Record<string, unknown>;
 
-    collectLeafPaths(content).forEach((tokenPath) => {
+    for (const tokenPath of collectLeafPaths(content)) {
       const existingOwner = owners.get(tokenPath);
       if (existingOwner && existingOwner !== file) {
         duplicates.push(`${tokenPath} (${existingOwner}, ${file})`);
-        return;
+        continue;
       }
-
       owners.set(tokenPath, file);
-    });
-  });
+    }
+  }
 
   if (duplicates.length > 0) {
     throw new Error(
@@ -57,19 +56,16 @@ function assertNoDuplicateTokenPaths(files: string[]): void {
 }
 
 function deepMerge(target: Record<string, unknown>, source: Record<string, unknown>): Record<string, unknown> {
-  Object.keys(source).forEach(key => {
+  for (const [key, sourceValue] of Object.entries(source)) {
     const targetValue = target[key];
-    const sourceValue = source[key];
-
     if (Array.isArray(targetValue) && Array.isArray(sourceValue)) {
       target[key] = sourceValue;
     } else if (isObject(targetValue) && isObject(sourceValue)) {
       target[key] = deepMerge({ ...targetValue }, sourceValue);
     } else {
       target[key] = sourceValue;
     }
-  });
-
+  }
   return target;
 }