@orkestrel/scaffold 0.0.28 → 0.0.29

package/dist/host/AGENTS.md

@@ -157,3 +157,15 @@ This governs prose everywhere: chat replies, instruction files, guides, TSDoc, c
 - Keep all substance, nuance, and precision. Cut only what makes text hard to read.
 - Present a tradeoff as option, cost, and recommendation — not as a balanced meditation.
 - Write requirements so they are specific and testable. Replace evaluative words such as "user friendly" or "hardened further" with the concrete condition that closes them.
+
+#### Instruction files
+
+`AGENTS.md`, `.claude/rules/*`, `.agents/*`, `.claude/agents/*`, and every skill are executed, not
+read. An agent loads them mid-task and acts on them. Write them for that reader.
+
+- Write every line as a directive: what to do, what to check, or what to refuse. Delete a line that does none of the three.
+- Name the observable trigger and the required action. "When X, do Y" is actionable; "X matters" is not.
+- State the finding as the rule. Never record how it was found, which session found it, what was tried first, or what a probe proved. That history belongs in the commit message.
+- Cut any clause written to persuade, reassure, or explain the rule to a person. An agent needs the rule and its trigger, not agreement with it.
+- Give a rule one home. Restating it elsewhere creates two copies that drift, and an agent reading the stale one is following this file.
+- Keep an example only when it disambiguates the rule. Delete an example that merely illustrates it.

package/dist/host/agents/orchestration.md

@@ -91,6 +91,12 @@ Record the substitution.
 - Never assign Grok to either lane in Claude Code or Codex. If the remaining native engine is also
   unavailable there, the pass cannot run: stop and report rather than substituting Grok.
 - Grok takes both lanes only in Cursor, and only when Opus 5 and Sol are both unavailable.
+- Treat a lane that returns no verdicts as a lane that did not run. A bench lane reporting that its
+  driver executed and its engine was never reached is a dark bench, not a result. Record the bench
+  dark from that report, re-run the lane on the substitute engine from the table above, and name in
+  the routing ledger which lane ran on which engine. Never accept a round with one lane empty.
+- Re-read bench liveness at dispatch, not at session start. A bench that probed live can be dark when
+  the lane launches.
 
 ## Tedious work goes to Grok
 
@@ -617,17 +623,25 @@ flag is what stops the gate chain running a second time inside the five minutes.
 
 ### Reaching the approval
 
-- **Log in first** when the session is new or a day has passed. `npm login` and `npm publish` reach
-  the same browser approval, and a publish that has to run the login flow spends the window on it.
-- `npm login` backgrounded with stdin at EOF falls through to a legacy `Username:` prompt and exits
-  **zero** without authenticating. Confirm with `npm whoami` rather than an exit code.
-- npm offers its browser approval only when it sees a TTY. Without one it fails `EOTP` and there is
-  no way to answer it. Run the login, and the first publish of a layer, under
-  `script -qfc '<command>' <log>` with stdin read from a fifo a long `sleep` holds open.
-- npm prints `Press ENTER to open in the browser` and does not begin polling until that is
-  acknowledged. Send a newline into the fifo. The browser it tries to open does not exist in a
-  headless container, which is harmless.
-- Surface the approval URL to the user the moment it appears in the log, and say that approving it
+- Run `npm login` before any publish. `npm publish` does not open the browser flow: unauthenticated
+  it returns `E404` on `PUT`, which reads as a missing package rather than a missing credential.
+- Pass `--browser=false` to `npm login` and to every `npm publish`. Without it npm prints
+  `Press ENTER to open in the browser...` and blocks. Never answer that prompt with a newline: the
+  web flow consumes the newline on a later read, drops to a legacy `Username:` prompt, and exits
+  **zero** without authenticating. With the flag npm prints the URL and polls, and stdin stays
+  untouched.
+- Hold stdin open and write nothing to it. Use a fifo held open by a long `sleep`. EOF drops npm to
+  the same legacy prompt a stray newline does.
+- Run the login and every publish under `script -qfc '<command>' <log>`. npm offers the approval only
+  when it sees a TTY; without one it fails `EOTP` with no way to answer.
+- Expect two approvals. `npmjs.com/login/cli/<id>` authenticates the session; `npmjs.com/auth/cli/<id>`
+  authorizes the publish and opens the five-minute window. Tell the user both are coming, or the
+  second link reads as the first having failed.
+- Confirm authentication with `npm whoami`, never with an exit code. The legacy fallthrough exits
+  zero.
+- Re-probe `whoami` immediately before opening the window. A stored credential expires mid-session,
+  so a session-start answer does not hold.
+- Surface each approval URL the moment it appears in the log. Say that approving the publish one
   opens a five-minute window covering the rest of the layer.
 
 ### Spending the window

package/dist/host/claude/rules/workspace.md

@@ -60,9 +60,13 @@ Define aliases in `tsconfig.json` first. `vite.config.ts` derives from `compiler
 - `*/types.ts`: public API contracts.
 - `configs/src/` and `configs/app/`: thin per-target wrappers, including optional
   `configs/src/*bin*` files. Shared logic remains in root configs.
-- `configs/helpers.ts`: the one permitted leaf under `configs/`. It imports nothing from the
-  workspace, which is what keeps it a leaf. Each `configs/src/*.config.ts` imports the root config
-  rather than the leaf, so shared build logic stays in one place.
+- `configs/helpers.ts` and `configs/browsers.ts`: the only permitted leaves under `configs/`. Each
+  imports nothing from the workspace, which is what keeps it a leaf. Each `configs/src/*.config.ts`
+  imports the root config rather than a leaf, so shared build logic stays in one place.
+- Keep `configs/helpers.ts` free of any dependency a core-only workspace does not declare. It is
+  vendored byte-identical to every workspace, so an import there must resolve in all of them.
+  `configs/browsers.ts` exists for that reason: it imports `playwright` and
+  `@vitest/browser-playwright`, and only a workspace with a browser environment is given it.
 
 Environment rules:
 

package/dist/host/guides/scaffold.md

@@ -191,6 +191,7 @@ Exported from `@orkestrel/scaffold`, and reachable from
 | `matchesOrchestrationPath`  | function | Test whether a path instructs or wires an agent rather than the toolchain.    |
 | `matchesRange`              | function | Test whether a declared range already admits a published version.             |
 | `nameToGuide`               | function | Derive the guide mirror path a package name answers for.                      |
+| `nameToRewrite`             | function | Derive the declaration rewrite a published face roll-up applies.              |
 | `planToSummary`             | function | Project a plan into its tally by artifact origin.                             |
 | `selectGroups`              | function | Select the groups a compile covers, in plan order.                            |
 | `selectHostPaths`           | function | Select the host paths a named workspace vendors.                              |
@@ -826,6 +827,17 @@ except the manifest.
 - One template artifact per configuration file the selection needs: the root `tsconfig.json` and
   `vite.config.ts`, plus a Vite config and a scoped TypeScript config per selected environment, and
   two more when `bin` is set.
+- One template artifact, `configs/browsers.ts`, for a workspace selecting `browser` on either axis.
+  It resolves the Chromium the Playwright provider launches, and the root `vite.config.ts` calls it
+  once into `browserOptions` and passes that to every `playwright()` provider it configures. The
+  precedence is `PLAYWRIGHT_EXECUTABLE_PATH`, `PLAYWRIGHT_WS_ENDPOINT`, `PLAYWRIGHT_CHANNEL`, the
+  managed Playwright Chromium, the container's bundled Chromium, a verified system channel, then the
+  platform default. An installed pinned revision returns empty options, so Playwright keeps its own
+  launch defaults. A pinned revision that is not installed falls through to a `chromium` alias or a
+  sibling `chromium-*` revision under the same browsers directory, because a managed container ships
+  one usable build for many Playwright versions. It is its own file rather than a block in the
+  vendored `configs/helpers.ts`, which every workspace receives byte-identical while only a browser
+  selection declares the `playwright` this module imports.
 - One template artifact per source and test file the selection needs: an `index.ts` barrel per
   selected environment, `main.ts` and `index.html` for an application browser, `tests/setup.ts`
   plus the host setup modules the selection reaches, and one entry test per axis project.

package/dist/src/core/index.cjs

@@ -290,7 +290,7 @@ var DEFAULT_ENGINES = `>=${MINIMUM_NODE_VERSION}`;
 var BASE_DEV_DEPENDENCIES = Object.freeze({
 	"@microsoft/api-extractor": "^7.58.12",
 	"@orkestrel/guide": "^0.0.10",
-	"@orkestrel/scaffold": "^0.0.28",
+	"@orkestrel/scaffold": "^0.0.29",
 	"@types/node": "^26.2.0",
 	oxfmt: "^0.62.0",
 	oxlint: "^1.77.0",
@@ -386,11 +386,11 @@ var CONFIG_TEMPLATES = Object.freeze({
 		vite: `import type { {{viteTypes}} } from 'vite'
 {{imports}}import { defineConfig, mergeConfig } from 'vitest/config'
 import tsconfig from './tsconfig.json' with { type: 'json' }
-{{helpers}}import { lstatSync, readdirSync, realpathSync } from 'node:fs'
+{{helpers}}{{browsers}}import { lstatSync, readdirSync, realpathSync } from 'node:fs'
 import { basename, join, parse, relative, resolve as resolvePath, sep } from 'node:path'
 import { fileURLToPath, URL } from 'node:url'
 
-export function resolveWorkspacePath(relativePath: string): string {
+{{options}}export function resolveWorkspacePath(relativePath: string): string {
 	return fileURLToPath(new URL(relativePath, import.meta.url))
 }
 
@@ -484,7 +484,7 @@ const resolve = {
 {{exclude}}				setupFiles: ['./tests/setup.ts', './tests/setupBrowser.ts'],
 				browser: {
 					enabled: true,
-					provider: playwright(),
+					provider: playwright(browserOptions),
 					instances: [{ browser: 'chromium', headless: true }],
 				},
 				fileParallelism: false,
@@ -595,7 +595,7 @@ const resolve = {
 			setupFiles: ['./tests/setup.ts', './tests/setupBrowser.ts'],
 			browser: {
 				enabled: true,
-				provider: playwright(),
+				provider: playwright(browserOptions),
 				instances: [{ browser: 'chromium', headless: true }],
 			},
 			fileParallelism: false,
@@ -920,12 +920,22 @@ export default defineConfig(
 import dts from 'vite-plugin-dts'
 import { srcBrowser, resolveWorkspacePath } from '../../vite.config.ts'
 
+// vite-plugin-dts rolls this face into one declaration, and the roll-up reaches
+// src/core through a relative source path the tarball does not carry. The path
+// keeps each source module's own depth, so a module in a browser subfolder emits
+// one that leaves dist/src entirely. The rewrite below externalizes core through
+// the package's own published root export, on the final roll-up only.
 export default defineConfig(
 	srcBrowser({
 		plugins: [
 			dts({
 				tsconfigPath: resolveWorkspacePath('configs/src/tsconfig.browser.json'),
 				bundleTypes: true,
+				beforeWriteFile: (path, content) => ({
+					content: /[\\\\/]dist[\\\\/]src[\\\\/]browser[\\\\/]index\\.d\\.ts$/.test(path)
+{{replacement}}
+						: content,
+				}),
 			}),
 		],
 	}),
@@ -994,7 +1004,319 @@ import { appShowcase } from '../../vite.config.ts'
 export default defineConfig(appShowcase())
 `
 		})
-	})
+	}),
+	browsers: `// A generated browser workspace resolves its own Chromium here rather than in
+// \`configs/helpers.ts\`, because that leaf is vendored byte-identical to every
+// workspace and most of them declare no \`playwright\` to import.
+
+import type { PlaywrightProviderOptions } from '@vitest/browser-playwright'
+import { chromium } from 'playwright'
+import { accessSync, constants as FS_CONSTANTS, globSync, readdirSync, statSync } from 'node:fs'
+import { basename, dirname, join, resolve as resolvePath } from 'node:path'
+
+/**
+ * Chromium executable layouts inside a \`chromium-<revision>\` browsers-directory entry, per
+ * platform.
+ *
+ * @remarks
+ * The current Playwright build ships Chrome for Testing on macOS. The trailing \`Chromium.app\`
+ * layouts are what earlier builds shipped, so the list spans Playwright versions instead of
+ * pinning to the installed one.
+ */
+export const CHROMIUM_LAYOUTS = Object.freeze([
+	'chrome-linux/chrome',
+	'chrome-linux64/chrome',
+	'chrome-win/chrome.exe',
+	'chrome-win64/chrome.exe',
+	'chrome-mac-x64/Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing',
+	'chrome-mac-arm64/Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing',
+	'chrome-mac/Chromium.app/Contents/MacOS/Chromium',
+	'chrome-mac-arm64/Chromium.app/Contents/MacOS/Chromium',
+])
+
+/** The \`chromium-<revision>\` entry name Playwright installs one managed build into. */
+export const CHROMIUM_ENTRY_PATTERN = /^chromium-\\d+$/
+
+/** The revision number carried by any path containing a \`chromium-<revision>\` segment. */
+export const CHROMIUM_REVISION_PATTERN = /chromium-(\\d+)/
+
+/** The directory a managed Linux container installs its bundled Playwright browsers into. */
+export const BUNDLED_BROWSERS_ROOT = '/opt/pw-browsers'
+
+/**
+ * Bundled Chromium layouts under the managed-container browsers root, as glob patterns.
+ *
+ * @remarks
+ * The revision directory and its inner layout both drift across Playwright builds, and the
+ * container also carries a top-level \`chromium\` alias, so every known shape is globbed.
+ */
+export const BUNDLED_CHROMIUM_LAYOUTS = Object.freeze([
+	'chromium',
+	'chromium-*/chrome-linux64/chrome',
+	'chromium-*/chrome-linux/chrome',
+])
+
+/** Stable Playwright Chromium channels and their standard executable layouts. */
+export const SYSTEM_BROWSER_CHANNELS = Object.freeze([
+	Object.freeze({
+		channel: 'chrome',
+		layouts: Object.freeze({
+			linux: '/opt/google/chrome/chrome',
+			darwin: '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
+			win32: Object.freeze(['Google', 'Chrome', 'Application', 'chrome.exe']),
+		}),
+	}),
+	Object.freeze({
+		channel: 'msedge',
+		layouts: Object.freeze({
+			linux: '/opt/microsoft/msedge/msedge',
+			darwin: '/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge',
+			win32: Object.freeze(['Microsoft', 'Edge', 'Application', 'msedge.exe']),
+		}),
+	}),
+])
+
+/**
+ * Determine whether a path identifies an executable regular file.
+ *
+ * @param path - The filesystem path to inspect.
+ * @returns Whether the path is a regular file with execute access.
+ *
+ * @example
+ * \`\`\`ts
+ * isBrowserExecutable('/opt/google/chrome/chrome')
+ * \`\`\`
+ */
+export function isBrowserExecutable(path: string): boolean {
+	try {
+		if (!statSync(path).isFile()) return false
+		accessSync(path, FS_CONSTANTS.X_OK)
+		return true
+	} catch {
+		return false
+	}
+}
+
+/**
+ * Order two Chromium paths so the highest revision sorts first.
+ *
+ * @param left - The first path or directory entry to compare.
+ * @param right - The second path or directory entry to compare.
+ * @returns A negative number when \`left\` sorts first, positive when \`right\` does.
+ *
+ * @remarks
+ * Revisions are numbers, so \`chromium-1200\` outranks \`chromium-999\` despite sorting below it
+ * lexically. A path carrying no revision falls back to descending name order.
+ *
+ * @example
+ * \`\`\`ts
+ * ['chromium-999', 'chromium-1200'].sort(compareRevisions)
+ * \`\`\`
+ */
+export function compareRevisions(left: string, right: string): number {
+	const leftRevision = CHROMIUM_REVISION_PATTERN.exec(left)?.[1]
+	const rightRevision = CHROMIUM_REVISION_PATTERN.exec(right)?.[1]
+	if (leftRevision === undefined || rightRevision === undefined) return right.localeCompare(left)
+	return Number(rightRevision) - Number(leftRevision)
+}
+
+/**
+ * Read the executable path of Playwright's pinned Chromium revision.
+ *
+ * @returns The pinned executable path, or \`undefined\` when this platform has none.
+ *
+ * @remarks
+ * Playwright throws rather than returning a path when the current platform carries no initialized
+ * executable, and an unguarded call would fail configuration evaluation for every project.
+ *
+ * @example
+ * \`\`\`ts
+ * resolvePinnedBrowser()
+ * \`\`\`
+ */
+export function resolvePinnedBrowser(): string | undefined {
+	try {
+		const pinned = chromium.executablePath()
+		return pinned.length === 0 ? undefined : pinned
+	} catch {
+		return undefined
+	}
+}
+
+/**
+ * Resolve a launchable Playwright-managed Chromium executable: the pinned revision when installed,
+ * otherwise a \`chromium\` / \`chromium.exe\` alias or any other \`chromium-*\` revision under the same
+ * Playwright browsers directory. A pinned-revision miss is not Chromium absence — managed
+ * containers ship one usable build, often behind a revision-agnostic alias, for many Playwright
+ * versions.
+ *
+ * @param pinned - The executable path for Playwright's pinned Chromium revision.
+ * @returns The managed executable path, or \`undefined\` when none is executable.
+ *
+ * @example
+ * \`\`\`ts
+ * resolveManagedBrowser('/root/.cache/ms-playwright/chromium-1234/chrome-linux64/chrome')
+ * \`\`\`
+ */
+export function resolveManagedBrowser(pinned: string): string | undefined {
+	if (isBrowserExecutable(pinned)) return pinned
+	let revisionRoot = dirname(pinned)
+	for (;;) {
+		if (CHROMIUM_ENTRY_PATTERN.test(basename(revisionRoot))) break
+		const parent = dirname(revisionRoot)
+		if (parent === revisionRoot) return undefined
+		revisionRoot = parent
+	}
+	const browsersRoot = dirname(revisionRoot)
+	for (const alias of ['chromium', 'chromium.exe']) {
+		const candidate = resolvePath(browsersRoot, alias)
+		if (isBrowserExecutable(candidate)) return candidate
+	}
+	let entries: readonly string[]
+	try {
+		entries = readdirSync(browsersRoot)
+	} catch {
+		return undefined
+	}
+	const revisions = entries
+		.filter((entry) => CHROMIUM_ENTRY_PATTERN.test(entry))
+		.sort(compareRevisions)
+	for (const revision of revisions) {
+		for (const layout of CHROMIUM_LAYOUTS) {
+			const candidate = resolvePath(browsersRoot, revision, layout)
+			if (isBrowserExecutable(candidate)) return candidate
+		}
+	}
+	return undefined
+}
+
+/**
+ * Resolve the Chromium a managed Linux container bundles outside the Playwright cache.
+ *
+ * @param platform - The Node platform the container runs on.
+ * @param root - The bundled browsers directory to search.
+ * @returns The highest matching executable path, or \`undefined\` when none is executable.
+ *
+ * @example
+ * \`\`\`ts
+ * resolveBundledBrowser('linux', BUNDLED_BROWSERS_ROOT)
+ * \`\`\`
+ */
+export function resolveBundledBrowser(platform: NodeJS.Platform, root: string): string | undefined {
+	if (platform !== 'linux') return undefined
+	for (const layout of BUNDLED_CHROMIUM_LAYOUTS) {
+		let matches: readonly string[]
+		try {
+			matches = globSync(layout, { cwd: root })
+		} catch {
+			return undefined
+		}
+		for (const match of [...matches].sort(compareRevisions)) {
+			const candidate = resolvePath(root, match)
+			if (isBrowserExecutable(candidate)) return candidate
+		}
+	}
+	return undefined
+}
+
+/**
+ * Resolve the first installed stable system Chromium channel.
+ *
+ * @param platform - The Node platform whose standard layouts should be probed.
+ * @param environment - The process environment supplying Windows installation roots.
+ * @returns \`chrome\`, then \`msedge\`, or \`undefined\` when neither is executable.
+ *
+ * @example
+ * \`\`\`ts
+ * resolveSystemBrowser(process.platform, process.env)
+ * \`\`\`
+ */
+export function resolveSystemBrowser(
+	platform: NodeJS.Platform,
+	environment: NodeJS.ProcessEnv,
+): string | undefined {
+	if (platform !== 'linux' && platform !== 'darwin' && platform !== 'win32') return undefined
+	const roots = new Set<string>()
+	if (platform === 'win32') {
+		for (const root of [
+			environment.LOCALAPPDATA,
+			environment.PROGRAMFILES,
+			environment['PROGRAMFILES(X86)'],
+		]) {
+			if (root !== undefined && root.length > 0) roots.add(root)
+		}
+		const homeDrive = environment.HOMEDRIVE
+		if (homeDrive !== undefined && homeDrive.length > 0) {
+			roots.add(join(homeDrive, 'Program Files'))
+			roots.add(join(homeDrive, 'Program Files (x86)'))
+		}
+	}
+	for (const browser of SYSTEM_BROWSER_CHANNELS) {
+		if (platform === 'win32') {
+			for (const root of roots) {
+				if (isBrowserExecutable(join(root, ...browser.layouts.win32))) return browser.channel
+			}
+			continue
+		}
+		if (isBrowserExecutable(browser.layouts[platform])) return browser.channel
+	}
+	return undefined
+}
+
+/**
+ * Resolve Playwright provider options for whatever browser this host can actually launch.
+ *
+ * @param pinned - The executable path for Playwright's pinned Chromium revision, when it has one.
+ * @param platform - The Node platform whose standard layouts should be probed.
+ * @param environment - The process environment supplying operator overrides and Windows roots.
+ * @param root - The managed-container bundled browsers directory to search.
+ * @returns Provider options naming an executable, a WebSocket endpoint, or a channel.
+ *
+ * @remarks
+ * Precedence, most important first: \`PLAYWRIGHT_EXECUTABLE_PATH\`, \`PLAYWRIGHT_WS_ENDPOINT\`,
+ * \`PLAYWRIGHT_CHANNEL\`, the managed Playwright Chromium, the container's bundled Chromium, a
+ * verified system channel, then the platform default channel. An operator override outranks
+ * discovery and is returned exactly as given: none of those three environment values is checked
+ * against the filesystem, because verifying an override would defeat the override. The pinned
+ * managed revision outranks anything found on the host because it is deterministic. The installed
+ * pinned revision returns empty options so Playwright keeps its own default launch semantics. Only
+ * a discovered system channel is verified before it is named. The platform default is unverified
+ * as well and exists only as a last resort: Windows takes \`msedge\`, which ships with the OS and
+ * never collides with a foreground Chrome.
+ *
+ * @example
+ * \`\`\`ts
+ * resolveBrowser(resolvePinnedBrowser(), process.platform, process.env)
+ * \`\`\`
+ */
+export function resolveBrowser(
+	pinned: string | undefined,
+	platform: NodeJS.Platform,
+	environment: NodeJS.ProcessEnv,
+	root: string = BUNDLED_BROWSERS_ROOT,
+): PlaywrightProviderOptions {
+	const executable = environment.PLAYWRIGHT_EXECUTABLE_PATH
+	if (executable !== undefined && executable.length > 0) {
+		return { launchOptions: { executablePath: executable } }
+	}
+	const endpoint = environment.PLAYWRIGHT_WS_ENDPOINT
+	if (endpoint !== undefined && endpoint.length > 0) {
+		return { connectOptions: { wsEndpoint: endpoint } }
+	}
+	const requested = environment.PLAYWRIGHT_CHANNEL
+	if (requested !== undefined && requested.length > 0) {
+		return { launchOptions: { channel: requested } }
+	}
+	const managed = pinned === undefined ? undefined : resolveManagedBrowser(pinned)
+	if (managed !== undefined) {
+		return managed === pinned ? {} : { launchOptions: { executablePath: managed } }
+	}
+	const bundled = resolveBundledBrowser(platform, root)
+	if (bundled !== undefined) return { launchOptions: { executablePath: bundled } }
+	const fallback = platform === 'win32' ? 'msedge' : 'chrome'
+	return { launchOptions: { channel: resolveSystemBrowser(platform, environment) ?? fallback } }
+}
+`
 });
 /**
 * Formatter-stable template text for source, test, document, guide, and service artifacts.
@@ -2075,6 +2397,46 @@ function nameToGuide(name) {
 	return `guides/${name.slice(name.lastIndexOf("/") + 1)}.md`;
 }
 /**
+* Derive the declaration rewrite a published face's `beforeWriteFile` applies.
+*
+* @param name - The workspace's own bare package name.
+* @returns The ternary consequent an emitted `vite.{browser,server}.config.ts`
+* fills its `{{replacement}}` span with, indented for that span.
+*
+* @remarks
+* `vite-plugin-dts` rolls a face into one declaration and keeps each source
+* module's own relative depth, so a nested module emits a path that escapes
+* `dist/src` and a flat one resolves only by luck. Both faces rewrite the same
+* relative core path to the package's published root export, so the branch is
+* derived once here. The extension alternation is what the two permitted import
+* spellings produce: an `@src/core` alias resolves to the core source module and
+* prints `.ts`, while a relative import prints the `.js` specifier it was
+* written with. The formatter keeps the call on one line only while the line it
+* prints measures inside the vendored width, and the workspace name is what
+* varies, so the shape is chosen by measuring the candidate: a tab prints as the
+* vendored two columns, and the gate admits a name long enough to push the
+* joined call past 100.
+*
+* @example
+* ```ts
+* import { nameToRewrite } from '@orkestrel/scaffold'
+*
+* nameToRewrite('router').includes("'@orkestrel/router'") // true
+* ```
+*/
+function nameToRewrite(name) {
+	const specifier = serializeTypeScriptString(`@orkestrel/${name}`);
+	const pattern = "/(?:\\.\\.\\/)+core\\/index\\.[jt]s/g";
+	const joined = `\t\t\t\t\t\t? content.replaceAll(${pattern}, ${specifier})`;
+	if (joined.replaceAll("	", "  ").length <= 100) return joined;
+	return [
+		"						? content.replaceAll(",
+		`\t\t\t\t\t\t\t\t${pattern},`,
+		`\t\t\t\t\t\t\t\t${specifier},`,
+		"							)"
+	].join("\n");
+}
+/**
 * Select the host paths a named workspace vendors.
 *
 * @param paths - The candidate host paths, in their declared order.
@@ -3133,6 +3495,8 @@ ${projects.map((project) => `\t\t\t${project},`).join("\n")}
 		viteTypes: machinery.showcase ? "PluginOption, UserConfig" : "UserConfig",
 		imports: imports.length === 0 ? "" : `${imports.join("\n")}\n`,
 		helpers: boundaries.length === 0 ? "" : `import { ${boundaries.join(", ")} } from './configs/helpers.js'\n`,
+		browsers: machinery.browser ? "import { resolveBrowser, resolvePinnedBrowser } from './configs/browsers.js'\n" : "",
+		options: machinery.browser ? "const browserOptions = resolveBrowser(resolvePinnedBrowser(), process.platform, process.env)\n\n" : "",
 		factories: body,
 		projects: projectRows
 	});
@@ -3166,22 +3530,20 @@ function blueprintToConfigArtifacts(blueprint) {
 		origin: "template",
 		content: blueprintToRootVite(blueprint)
 	}];
+	if (blueprintToMachinery(blueprint).browser) artifacts.push({
+		path: "configs/browsers.ts",
+		group: "configs",
+		ownership: "content",
+		origin: "template",
+		content: CONFIG_TEMPLATES.browsers
+	});
 	for (const environment of blueprint.src) for (const path of SRC_MATRIX[environment].configs) {
 		let content = CONFIG_TEMPLATES.vites.src.core;
 		if (path === "configs/src/tsconfig.core.json") content = CONFIG_TEMPLATES.tsconfigs.src.core;
-		else if (path === "configs/src/vite.browser.config.ts") content = CONFIG_TEMPLATES.vites.src.browser;
+		else if (path === "configs/src/vite.browser.config.ts") content = (0, _orkestrel_template.fillTemplate)(CONFIG_TEMPLATES.vites.src.browser, { replacement: nameToRewrite(blueprint.name) });
 		else if (path === "configs/src/tsconfig.browser.json") content = CONFIG_TEMPLATES.tsconfigs.src.browser;
-		else if (path === "configs/src/vite.server.config.ts") {
-			const packageName = serializeTypeScriptString(`@orkestrel/${blueprint.name}`);
-			const joined = `\t\t\t\t\t\t? content.replaceAll(/(?:\\.\\.\\/)+core\\/index\\.ts/g, ${packageName})`;
-			const replacement = joined.replaceAll("	", "  ").length <= 100 ? joined : [
-				"						? content.replaceAll(",
-				"								/(?:\\.\\.\\/)+core\\/index\\.ts/g,",
-				`\t\t\t\t\t\t\t\t${packageName},`,
-				"							)"
-			].join("\n");
-			content = (0, _orkestrel_template.fillTemplate)(CONFIG_TEMPLATES.vites.src.server, { replacement });
-		} else if (path === "configs/src/tsconfig.server.json") content = CONFIG_TEMPLATES.tsconfigs.src.server;
+		else if (path === "configs/src/vite.server.config.ts") content = (0, _orkestrel_template.fillTemplate)(CONFIG_TEMPLATES.vites.src.server, { replacement: nameToRewrite(blueprint.name) });
+		else if (path === "configs/src/tsconfig.server.json") content = CONFIG_TEMPLATES.tsconfigs.src.server;
 		artifacts.push({
 			path,
 			group: "configs",
@@ -4531,6 +4893,7 @@ exports.matchesOrchestrationPath = matchesOrchestrationPath;
 exports.matchesRange = matchesRange;
 exports.nameToGuide = nameToGuide;
 exports.nameToHostArtifacts = nameToHostArtifacts;
+exports.nameToRewrite = nameToRewrite;
 exports.overridesToQuestions = overridesToQuestions;
 exports.parseBlueprint = parseBlueprint;
 exports.parseCompilerOptions = parseCompilerOptions;