@orkestrel/scaffold 0.0.44 → 0.0.45

package/dist/src/core/index.d.cts

@@ -16,7 +16,7 @@ export declare const APP_DEV_DEPENDENCIES: Readonly<Record<string, string>>;
  * @remarks
  * An application environment declares no exports, so it carries a runtime
  * entry instead of a subpath and formats. Core carries none because it is
- * shared logic the other two import rather than a host that runs.
+ * shared logic the other environments import rather than a host that runs.
  */
 export declare const APP_MATRIX: Readonly<Record<Environment, AppDefinition>>;
 
@@ -159,7 +159,7 @@ export declare function artifactsToQuestions(artifacts: readonly Artifact[]): re
  * destination has no bytes to record, and every other verdict records the bytes
  * it was given, which is the precondition the mutation that follows is held to.
  * Ownership is copied rather than inferred from drift because aligned findings
- * span all three ownership tiers.
+ * span every ownership tier.
  *
  * `foreign` is not answerable here, because it describes a path no artifact was
  * planned for.
@@ -231,7 +231,7 @@ export declare const BIN_ENTRY_PATH = "src/bin/main.ts";
  *
  * @remarks
  * `src` selects published library environments and `app` selects private
- * runtime environments. The two axes are independent, so library-only,
+ * runtime environments. The axes are independent, so library-only,
  * application-only, and mixed workspaces are all first class. `dependencies`
  * are runtime `@orkestrel/*` packages. A peer in the `@orkestrel` scope is a
  * fleet pin; every other peer is a floor. `extras` are package-specific
@@ -313,7 +313,7 @@ export declare function blueprintToConfigArtifacts(blueprint: Blueprint): readon
  * not installed by the workspace that declares it and developing against one
  * requires it present. A runtime dependency is the opposite case and is removed:
  * it is already installed, so a second declaration would state one fact twice
- * and the two ranges would be free to disagree.
+ * and the ranges would be free to disagree.
  *
  * A workspace never declares itself, so its own package name is removed. That
  * matters for a workspace named after a package the baseline already carries:
@@ -351,7 +351,7 @@ export declare function blueprintToGuideArtifacts(blueprint: Blueprint): readonl
  * Derive the host-specific machinery a generated root Vite configuration carries.
  *
  * @param blueprint - The workspace specification.
- * @returns The four pipelines the generated configuration selects.
+ * @returns The pipelines the generated configuration selects.
  *
  * @remarks
  * The sole derivation of that set: every renderer reads it rather than
@@ -396,7 +396,7 @@ export declare function blueprintToMachinery(blueprint: Blueprint): ViteMachiner
  * artifact serialized directly.
  *
  * The artifact carrying this text is claimed by birth. A workspace owns its own
- * manifest once it exists: its description, its keywords, and any script it
+ * manifest after it exists: its description, its keywords, and any script it
  * added are the consumer's, so a repair that replaced the file would take them.
  * The one part scaffold keeps current afterwards is the declared `@orkestrel/*`
  * range set, and that is a region with its own writer rather than a claim over
@@ -437,14 +437,14 @@ export declare function blueprintToOrchestrationArtifacts(blueprint: Blueprint):
  * Only the laws a blueprint answers alone are here. The structural record and
  * its bounds are already settled by `isBlueprint`, which refuses a value that is
  * not a blueprint at all; what remains is the syntax of a name, a version, a
- * range, and an engines floor, the combinations the two environment axes admit,
- * and the overlaps between the three declared package lists. The laws that need
+ * range, and an engines floor, the combinations the environment axes admit,
+ * and the overlaps between the declared package lists. The laws that need
  * a drafted plan belong to {@link artifactsToQuestions} and
  * {@link overridesToQuestions}.
  *
  * A question blocks when it describes a workspace this package cannot generate.
- * Three do not, because each describes a workspace it can describe honestly and
- * should not create: a published axis of several environments without core,
+ * These do not, because each describes a workspace it can describe honestly but
+ * will not create: a published axis of several environments without core,
  * whose manifest names a core build the workspace never runs; a showcase flag
  * whose required browser axis is absent, which emits nothing; and an
  * integration flag over fewer than two environments, whose seed does emit and
@@ -555,7 +555,7 @@ export declare function blueprintToScripts(blueprint: Blueprint): Readonly<Recor
  *
  * @remarks
  * The barrels and every runtime entry intentionally hold nothing. A generated
- * sample entity is too easy to mistake for package implementation, so the
+ * sample entity would read as package implementation, so the
  * scaffold establishes only the selected environment boundaries. An application
  * entry is empty for the same reason the bin entry is, and because the vendored
  * lint config refuses an unassigned import outside a stylesheet, so the entry
@@ -683,8 +683,8 @@ export declare type CatalogEntry = {
  *
  * The order matters because these packages are `0.0.x`, where a caret pins one
  * exact release. Publishing a dependent before its dependency leaves the
- * dependent pinned to the older release, and two ranges that disagree install
- * two copies of one package that the compiler reads as two distinct types.
+ * dependent pinned to the older release, and ranges that disagree install
+ * duplicate copies of one package that the compiler reads as distinct types.
  *
  * A cycle cannot be published in rounds, so its members are omitted rather than
  * placed in an order that would be wrong. An absent name is the report: compare
@@ -793,7 +793,7 @@ export declare interface CompileFailure {
  * `INVALID`. Structure raises; the laws a well-formed blueprint can still break
  * are the gate's, and they answer with questions.
  *
- * Two consequences of that order are worth stating, because they are the ones a
+ * The consequences of that order are worth stating, because they are the ones a
  * JavaScript caller meets first. A property backed by an accessor is refused
  * rather than read, which is what closes the race a guard cannot close from
  * inside; the accessor never runs. And an optional field present with the value
@@ -845,21 +845,21 @@ export declare class Compiler implements CompilerInterface {
           * carries no plan, then `compile` with the whole outcome either way, so an
           * observer reads every compile from one event and the refusals from the other.
           *
-          * A plan says the blueprint can be built. It does not say the blueprint should
-          * be created, and the questions beside it are what this compiler could not
-          * settle. A caller creating a fresh workspace answers them first and writes
-          * nothing while any remains, which is the rule the `new` verb applies; a caller
-          * describing or repairing an existing target carries them through instead.
-          * Nothing downstream repeats that check, because only the caller knows which of
-          * the two it is.
+          * A plan says the blueprint can be built. It does not decide whether to create
+          * it, and the questions beside it are what this compiler could not settle. A
+          * caller creating a fresh workspace answers them first and writes nothing while
+          * any remains, which is the rule the `new` verb applies; a caller describing or
+          * repairing an existing target carries them through instead.
+          * Nothing downstream repeats that check, because only the caller knows which
+          * case it is.
           *
           * @example
           * ```ts
-          * import { createBlueprint, createCompiler } from '@orkestrel/scaffold'
+          * import { Compiler, createBlueprint } from '@orkestrel/scaffold'
           *
           * const blueprint = createBlueprint('router', { src: ['core'] })
           *
-          * createCompiler().compile(blueprint, ['manifest']).plan?.artifacts.length // 1
+          * new Compiler().compile(blueprint, ['manifest']).plan?.artifacts.length // 1
           * ```
           */
       compile(blueprint: Blueprint, groups?: readonly Group[]): Scaffolding;
@@ -885,12 +885,12 @@ export declare class Compiler implements CompilerInterface {
            *
            * @example
            * ```ts
-           * import { createBlueprint, createCompiler } from '@orkestrel/scaffold'
+           * import { Compiler, createBlueprint } from '@orkestrel/scaffold'
            *
            * const blueprint = createBlueprint('router', { src: ['core'] })
            *
-           * createCompiler().audit(blueprint, {}, ['manifest']).findings[0]?.drift // 'aligned'
-           * createCompiler().audit(blueprint, {}, ['configs']).findings[0]?.drift // 'missing'
+           * new Compiler().audit(blueprint, {}, ['manifest']).findings[0]?.drift // 'aligned'
+           * new Compiler().audit(blueprint, {}, ['configs']).findings[0]?.drift // 'missing'
            * ```
            */
        audit(blueprint: Blueprint, current: Snapshot, groups?: readonly Group[]): Audit;
@@ -901,9 +901,9 @@ export declare class Compiler implements CompilerInterface {
         *
         * @example
         * ```ts
-        * import { createCompiler } from '@orkestrel/scaffold'
+        * import { Compiler } from '@orkestrel/scaffold'
         *
-        * const compiler = createCompiler()
+        * const compiler = new Compiler()
         * compiler.destroy()
         * compiler.emitter.destroyed // true
         * ```
@@ -967,7 +967,7 @@ export declare class Compiler implements CompilerInterface {
           readonly error?: EmitterErrorHandler;
       }
 
-      /** The three compile phases, in the order they run. */
+      /** The compile phases, in the order they run. */
       export declare type CompileStage = 'draft' | 'gate' | 'pin';
 
       /**
@@ -1043,15 +1043,15 @@ export declare class Compiler implements CompilerInterface {
           }>;
           factories: Readonly<{
               src: Readonly<{
-                  core: "export const srcCore = (options?: UserConfig): UserConfig =>\n\tmergeConfig(\n\t\t{\n\t\t\tresolve,\n\t\t\tpublicDir: false,\n\t\t\tbuild: {\n\t\t\t\temptyOutDir: true,\n\t\t\t\tsourcemap: true,\n\t\t\t\tminify: false,\n\t\t\t},\n\t\t\ttest: {\n\t\t\t\tname: { label: 'src:core', color: 'magenta' },\n\t\t\t\tinclude: ['tests/src/core/**/*.test.ts'],\n\t\t\t\tsetupFiles: ['./tests/setup.ts'],\n\t\t\t\tenvironment: 'node',\n\t\t\t\tbrowser: { enabled: false },\n\t\t\t},\n\t\t},\n\t\toptions ?? {},\n\t)\n";
-                  browser: "export const srcBrowser = (options?: UserConfig): UserConfig =>\n\tmergeConfig(\n\t\t{\n\t\t\tresolve,\n\t\t\tpublicDir: false,\n\t\t\tplugins: [outputBoundary('dist/src/browser'), environmentBoundary('src/browser')],\n\t\t\tbuild: {\n\t\t\t\temptyOutDir: true,\n\t\t\t\tsourcemap: true,\n\t\t\t\tminify: false,\n\t\t\t\tlib: {\n\t\t\t\t\tentry: resolveWorkspacePath('src/browser/index.ts'),\n\t\t\t\t\tformats: ['es'],\n\t\t\t\t\tfileName: () => 'index.js',\n\t\t\t\t},\n\t\t\t\toutDir: 'dist/src/browser',\n\t\t\t\trolldownOptions: {\n\t\t\t\t\t{{external}}\n{{output}}\n\t\t\t\t},\n\t\t\t},\n\t\t\ttest: {\n\t\t\t\tname: { label: 'src:browser', color: 'yellow' },\n\t\t\t\tinclude: ['tests/src/browser/**/*.test.ts'],\n{{exclude}}\t\t\t\tsetupFiles: ['./tests/setup.ts', './tests/setupBrowser.ts'],\n{{global}}\n\t\t\t\tbrowser: {\n\t\t\t\t\tenabled: true,\n\t\t\t\t\tprovider: playwright(browserOptions),\n\t\t\t\t\tinstances: [{ browser: 'chromium', headless: true }],\n\t\t\t\t},\n\t\t\t\tfileParallelism: false,\n\t\t\t},\n\t\t},\n\t\toptions ?? {},\n\t)\n";
-                  server: "export const srcServer = (options?: UserConfig): UserConfig =>\n\tmergeConfig(\n\t\t{\n\t\t\tresolve,\n\t\t\tpublicDir: false,\n\t\t\tplugins: [outputBoundary('dist/src/server'), environmentBoundary('src/server')],\n\t\t\tbuild: {\n\t\t\t\temptyOutDir: true,\n\t\t\t\tsourcemap: true,\n\t\t\t\tminify: false,\n\t\t\t\tlib: {\n\t\t\t\t\tentry: resolveWorkspacePath('src/server/index.ts'),\n\t\t\t\t\tformats: ['es', 'cjs'],\n\t\t\t\t\tfileName: (format: string) => (format === 'es' ? 'index.js' : 'index.cjs'),\n\t\t\t\t},\n\t\t\t\toutDir: 'dist/src/server',\n\t\t\t\ttarget: 'node22',\n\t\t\t\trolldownOptions: {\n\t\t\t\t\tplatform: 'node',\n\t\t\t\t\t{{external}}\n{{output}}\n\t\t\t\t},\n\t\t\t},\n\t\t\ttest: {\n\t\t\t\tname: { label: 'src:server', color: 'red' },\n\t\t\t\tinclude: ['tests/src/server/**/*.test.ts'],\n{{exclude}}\t\t\t\tsetupFiles: ['./tests/setup.ts', './tests/setupServer.ts'],\n\t\t\t\tenvironment: 'node',\n\t\t\t\tbrowser: { enabled: false },\n\t\t\t},\n\t\t},\n\t\toptions ?? {},\n\t)\n";
-                  bin: "export const srcBin = (options?: UserConfig): UserConfig =>\n\tmergeConfig(\n\t\t{\n\t\t\tresolve,\n\t\t\tpublicDir: false,\n\t\t\tplugins: [outputBoundary('dist/bin')],\n\t\t\tbuild: {\n\t\t\t\temptyOutDir: true,\n\t\t\t\tsourcemap: true,\n\t\t\t\tminify: false,\n\t\t\t\tlib: {\n\t\t\t\t\tentry: resolveWorkspacePath('src/bin/main.ts'),\n\t\t\t\t\tformats: ['es'],\n\t\t\t\t\tfileName: () => 'main.js',\n\t\t\t\t},\n\t\t\t\toutDir: 'dist/bin',\n\t\t\t\ttarget: 'node22',\n\t\t\t\trolldownOptions: {\n\t\t\t\t\texternal: (id: string) =>\n\t\t\t\t\t\tid.startsWith('node:') ||\n\t\t\t\t\t\tid.startsWith('@orkestrel/') ||\n\t\t\t\t\t\tid.startsWith('@src/') ||\n\t\t\t\t\t\tpeers.some((peer) => id === peer || id.startsWith(peer + '/')),\n\t\t\t\t},\n\t\t\t},\n\t\t\ttest: {\n\t\t\t\tname: { label: 'src:bin', color: 'yellow' },\n\t\t\t\tinclude: ['tests/src/bin/**/*.test.ts'],\n\t\t\t\tsetupFiles: ['./tests/setup.ts', './tests/setupServer.ts'],\n\t\t\t\tenvironment: 'node',\n\t\t\t\tbrowser: { enabled: false },\n\t\t\t\t// A bin test drives the real executable over a real temporary repository, so it\n\t\t\t\t// spends seconds in process startup and filesystem work rather than milliseconds.\n\t\t\t\t// Vitest's five-second default clears one alone and times out under a full suite.\n\t\t\t\ttestTimeout: 15_000,\n\t\t\t},\n\t\t},\n\t\toptions ?? {},\n\t)\n";
+                  core: "export const srcCore = (options?: UserConfig): UserConfig =>\n\tmergeConfig(\n\t\t{\n\t\t\tresolve,\n\t\t\tpublicDir: false,\n\t\t\tbuild: {\n\t\t\t\temptyOutDir: true,\n\t\t\t\tsourcemap: true,\n\t\t\t\tminify: false,\n\t\t\t\trolldownOptions: { onLog: enforceBuildLog },\n\t\t\t},\n\t\t\ttest: {\n\t\t\t\tname: { label: 'src:core', color: 'magenta' },\n\t\t\t\tinclude: ['tests/src/core/**/*.test.ts'],\n\t\t\t\tsetupFiles: ['./tests/setup.ts'],\n\t\t\t\tenvironment: 'node',\n\t\t\t\tbrowser: { enabled: false },\n\t\t\t},\n\t\t},\n\t\toptions ?? {},\n\t)\n";
+                  browser: "export const srcBrowser = (options?: UserConfig): UserConfig =>\n\tmergeConfig(\n\t\t{\n\t\t\tresolve,\n\t\t\tpublicDir: false,\n\t\t\tplugins: [outputBoundary('dist/src/browser'), environmentBoundary('src/browser')],\n\t\t\tbuild: {\n\t\t\t\temptyOutDir: true,\n\t\t\t\tsourcemap: true,\n\t\t\t\tminify: false,\n\t\t\t\tlib: {\n\t\t\t\t\tentry: resolveWorkspacePath('src/browser/index.ts'),\n\t\t\t\t\tformats: ['es'],\n\t\t\t\t\tfileName: () => 'index.js',\n\t\t\t\t},\n\t\t\t\toutDir: 'dist/src/browser',\n\t\t\t\trolldownOptions: {\n\t\t\t\t\tonLog: enforceBuildLog,\n\t\t\t\t\t{{external}}\n{{output}}\n\t\t\t\t},\n\t\t\t},\n\t\t\ttest: {\n\t\t\t\tname: { label: 'src:browser', color: 'yellow' },\n\t\t\t\tinclude: ['tests/src/browser/**/*.test.ts'],\n{{exclude}}\t\t\t\tsetupFiles: ['./tests/setup.ts', './tests/setupBrowser.ts'],\n{{global}}\n\t\t\t\tbrowser: {\n\t\t\t\t\tenabled: true,\n\t\t\t\t\tprovider: playwright(browserOptions),\n\t\t\t\t\tinstances: [{ browser: 'chromium', headless: true }],\n\t\t\t\t},\n\t\t\t\tfileParallelism: false,\n\t\t\t},\n\t\t},\n\t\toptions ?? {},\n\t)\n";
+                  server: "export const srcServer = (options?: UserConfig): UserConfig =>\n\tmergeConfig(\n\t\t{\n\t\t\tresolve,\n\t\t\tpublicDir: false,\n\t\t\tplugins: [outputBoundary('dist/src/server'), environmentBoundary('src/server')],\n\t\t\tbuild: {\n\t\t\t\temptyOutDir: true,\n\t\t\t\tsourcemap: true,\n\t\t\t\tminify: false,\n\t\t\t\tlib: {\n\t\t\t\t\tentry: resolveWorkspacePath('src/server/index.ts'),\n\t\t\t\t\tformats: ['es', 'cjs'],\n\t\t\t\t\tfileName: (format: string) => (format === 'es' ? 'index.js' : 'index.cjs'),\n\t\t\t\t},\n\t\t\t\toutDir: 'dist/src/server',\n\t\t\t\ttarget: 'node22',\n\t\t\t\trolldownOptions: {\n\t\t\t\t\tonLog: enforceBuildLog,\n\t\t\t\t\tplatform: 'node',\n\t\t\t\t\t{{external}}\n{{output}}\n\t\t\t\t},\n\t\t\t},\n\t\t\ttest: {\n\t\t\t\tname: { label: 'src:server', color: 'red' },\n\t\t\t\tinclude: ['tests/src/server/**/*.test.ts'],\n{{exclude}}\t\t\t\tsetupFiles: ['./tests/setup.ts', './tests/setupServer.ts'],\n\t\t\t\tenvironment: 'node',\n\t\t\t\tbrowser: { enabled: false },\n\t\t\t},\n\t\t},\n\t\toptions ?? {},\n\t)\n";
+                  bin: "export const srcBin = (options?: UserConfig): UserConfig =>\n\tmergeConfig(\n\t\t{\n\t\t\tresolve,\n\t\t\tpublicDir: false,\n\t\t\tplugins: [outputBoundary('dist/bin')],\n\t\t\tbuild: {\n\t\t\t\temptyOutDir: true,\n\t\t\t\tsourcemap: true,\n\t\t\t\tminify: false,\n\t\t\t\tlib: {\n\t\t\t\t\tentry: resolveWorkspacePath('src/bin/main.ts'),\n\t\t\t\t\tformats: ['es'],\n\t\t\t\t\tfileName: () => 'main.js',\n\t\t\t\t},\n\t\t\t\toutDir: 'dist/bin',\n\t\t\t\ttarget: 'node22',\n\t\t\t\trolldownOptions: {\n\t\t\t\t\tonLog: enforceBuildLog,\n\t\t\t\t\texternal: (id: string) =>\n\t\t\t\t\t\tid.startsWith('node:') ||\n\t\t\t\t\t\tid.startsWith('@orkestrel/') ||\n\t\t\t\t\t\tid.startsWith('@src/') ||\n\t\t\t\t\t\tpeers.some((peer) => id === peer || id.startsWith(peer + '/')),\n\t\t\t\t},\n\t\t\t},\n\t\t\ttest: {\n\t\t\t\tname: { label: 'src:bin', color: 'yellow' },\n\t\t\t\tinclude: ['tests/src/bin/**/*.test.ts'],\n\t\t\t\tsetupFiles: ['./tests/setup.ts', './tests/setupServer.ts'],\n\t\t\t\tenvironment: 'node',\n\t\t\t\tbrowser: { enabled: false },\n\t\t\t\t// A bin test drives the real executable over a real temporary repository, so it\n\t\t\t\t// spends seconds in process startup and filesystem work rather than milliseconds.\n\t\t\t\t// Vitest's five-second default clears one alone and times out under a full suite.\n\t\t\t\ttestTimeout: 15_000,\n\t\t\t},\n\t\t},\n\t\toptions ?? {},\n\t)\n";
               }>;
               app: Readonly<{
                   core: "export const appCore = (options?: UserConfig): UserConfig =>\n\tmergeConfig(\n\t\t{\n\t\t\tresolve,\n\t\t\tpublicDir: false,\n\t\t\tplugins: [environmentBoundary('app/core')],\n\t\t\ttest: {\n\t\t\t\tname: { label: 'app:core', color: 'cyan' },\n\t\t\t\tinclude: ['tests/app/core/**/*.test.ts'],\n\t\t\t\tsetupFiles: ['./tests/setup.ts'],\n\t\t\t\tenvironment: 'node',\n\t\t\t\tbrowser: { enabled: false },\n\t\t\t},\n\t\t},\n\t\toptions ?? {},\n\t)\n";
-                  browser: "function applicationBrowser(showcase: boolean): UserConfig {\n\tconst output = showcase ? 'dist/showcase' : 'dist/app/browser'\n{{showcasePlugins}}\treturn {\n\t\tresolve,\n{{plugins}}\t\troot: resolveWorkspacePath('app/browser'),\n\t\tpublicDir: false,\n\t\tbuild: {\n{{showcaseBuild}}\t\t\temptyOutDir: true,\n\t\t\toutDir: resolveWorkspacePath(output),\n\t\t\trolldownOptions: { input: resolveWorkspacePath('app/browser/index.html') },\n\t\t},\n\t\ttest: {\n\t\t\tname: { label: 'app:browser', color: 'blue' },\n\t\t\troot: resolveWorkspacePath('.'),\n\t\t\tdir: resolveWorkspacePath('.'),\n\t\t\tinclude: ['tests/app/browser/**/*.test.ts'],\n\t\t\tsetupFiles: ['./tests/setup.ts', './tests/setupBrowser.ts'],\n\t\t\tbrowser: {\n\t\t\t\tenabled: true,\n\t\t\t\tprovider: playwright(browserOptions),\n\t\t\t\tinstances: [{ browser: 'chromium', headless: true }],\n\t\t\t},\n\t\t\tfileParallelism: false,\n\t\t},\n\t}\n}\n\nexport function appBrowser(): UserConfig {\n\treturn applicationBrowser(false)\n}\n{{showcaseFactory}}";
-                  server: "export const appServer = (options?: UserConfig): UserConfig =>\n\tmergeConfig(\n\t\t{\n\t\t\tresolve,\n\t\t\tpublicDir: false,\n\t\t\tplugins: [outputBoundary('dist/app/server'), environmentBoundary('app/server')],\n\t\t\tbuild: {\n\t\t\t\temptyOutDir: true,\n\t\t\t\tlib: {\n\t\t\t\t\tentry: resolveWorkspacePath('app/server/main.ts'),\n\t\t\t\t\tformats: ['cjs'],\n\t\t\t\t\tfileName: () => 'main.cjs',\n\t\t\t\t},\n\t\t\t\toutDir: resolveWorkspacePath('dist/app/server'),\n\t\t\t\ttarget: 'node22',\n\t\t\t\trolldownOptions: { external: (id: string) => id.startsWith('node:') },\n\t\t\t},\n\t\t\ttest: {\n\t\t\t\tname: { label: 'app:server', color: 'green' },\n\t\t\t\tinclude: ['tests/app/server/**/*.test.ts'],\n\t\t\t\tsetupFiles: ['./tests/setup.ts', './tests/setupServer.ts'],\n\t\t\t\tenvironment: 'node',\n\t\t\t\tbrowser: { enabled: false },\n\t\t\t},\n\t\t},\n\t\toptions ?? {},\n\t)\n";
+                  browser: "function applicationBrowser(showcase: boolean): UserConfig {\n\tconst output = showcase ? 'dist/showcase' : 'dist/app/browser'\n{{showcasePlugins}}\treturn {\n\t\tresolve,\n{{plugins}}\t\troot: resolveWorkspacePath('app/browser'),\n\t\tpublicDir: false,\n\t\tbuild: {\n{{showcaseBuild}}\t\t\temptyOutDir: true,\n\t\t\toutDir: resolveWorkspacePath(output),\n\t\t\trolldownOptions: {\n\t\t\t\tonLog: enforceBuildLog,\n\t\t\t\tinput: resolveWorkspacePath('app/browser/index.html'),\n\t\t\t},\n\t\t},\n\t\ttest: {\n\t\t\tname: { label: 'app:browser', color: 'blue' },\n\t\t\troot: resolveWorkspacePath('.'),\n\t\t\tdir: resolveWorkspacePath('.'),\n\t\t\tinclude: ['tests/app/browser/**/*.test.ts'],\n\t\t\tsetupFiles: ['./tests/setup.ts', './tests/setupBrowser.ts'],\n\t\t\tbrowser: {\n\t\t\t\tenabled: true,\n\t\t\t\tprovider: playwright(browserOptions),\n\t\t\t\tinstances: [{ browser: 'chromium', headless: true }],\n\t\t\t},\n\t\t\tfileParallelism: false,\n\t\t},\n\t}\n}\n\nexport function appBrowser(): UserConfig {\n\treturn applicationBrowser(false)\n}\n{{showcaseFactory}}";
+                  server: "export const appServer = (options?: UserConfig): UserConfig =>\n\tmergeConfig(\n\t\t{\n\t\t\tresolve,\n\t\t\tpublicDir: false,\n\t\t\tplugins: [outputBoundary('dist/app/server'), environmentBoundary('app/server')],\n\t\t\tbuild: {\n\t\t\t\temptyOutDir: true,\n\t\t\t\tlib: {\n\t\t\t\t\tentry: resolveWorkspacePath('app/server/main.ts'),\n\t\t\t\t\tformats: ['cjs'],\n\t\t\t\t\tfileName: () => 'main.cjs',\n\t\t\t\t},\n\t\t\t\toutDir: resolveWorkspacePath('dist/app/server'),\n\t\t\t\ttarget: 'node22',\n\t\t\t\trolldownOptions: {\n\t\t\t\t\tonLog: enforceBuildLog,\n\t\t\t\t\texternal: (id: string) => id.startsWith('node:'),\n\t\t\t\t},\n\t\t\t},\n\t\t\ttest: {\n\t\t\t\tname: { label: 'app:server', color: 'green' },\n\t\t\t\tinclude: ['tests/app/server/**/*.test.ts'],\n\t\t\t\tsetupFiles: ['./tests/setup.ts', './tests/setupServer.ts'],\n\t\t\t\tenvironment: 'node',\n\t\t\t\tbrowser: { enabled: false },\n\t\t\t},\n\t\t},\n\t\toptions ?? {},\n\t)\n";
               }>;
               policy: "export const policy = (options?: UserConfig): UserConfig =>\n\tmergeConfig(\n\t\t{\n\t\t\tresolve,\n\t\t\ttest: {\n\t\t\t\tname: { label: 'policy', color: 'white' },\n\t\t\t\tinclude: ['tests/policy.test.ts'],\n\t\t\t\tsetupFiles: ['./tests/setup.ts'],\n\t\t\t\tenvironment: 'node',\n\t\t\t\tbrowser: { enabled: false },\n\t\t\t},\n\t\t},\n\t\toptions ?? {},\n\t)\n";
               config: "export const config = (options?: UserConfig): UserConfig =>\n\tmergeConfig(\n\t\t{\n\t\t\tresolve,\n\t\t\ttest: {\n\t\t\t\tname: { label: 'config', color: 'yellow' },\n\t\t\t\tinclude: ['tests/config.test.ts'],\n\t\t\t\tsetupFiles: ['./tests/setup.ts'],\n\t\t\t\tenvironment: 'node',\n\t\t\t\tbrowser: { enabled: false },\n\t\t\t\t// A config test validates every target wrapper and runs the real linter twice with\n\t\t\t\t// 15-second child caps, so this budget clears both caps and reports their diagnostics.\n\t\t\t\ttestTimeout: 45_000,\n\t\t\t},\n\t\t},\n\t\toptions ?? {},\n\t)\n";
@@ -1082,14 +1082,14 @@ export declare class Compiler implements CompilerInterface {
                   browser: "import { defineConfig } from 'vite'\nimport dts from 'vite-plugin-dts'\nimport { srcBrowser, resolveWorkspacePath } from '../../vite.config.ts'\n\n// vite-plugin-dts rolls this face into one declaration, and the roll-up reaches\n// src/core through a relative source path the tarball does not carry. The path\n// keeps each source module's own depth, so a module in a browser subfolder emits\n// one that leaves dist/src entirely. The rewrite below externalizes core through\n// the package's own published root export, on the final roll-up only.\nexport default defineConfig(\n\tsrcBrowser({\n\t\tplugins: [\n\t\t\tdts({\n\t\t\t\ttsconfigPath: resolveWorkspacePath('configs/src/tsconfig.browser.json'),\n\t\t\t\tbundleTypes: true,\n\t\t\t\tbeforeWriteFile: (path, content) => ({\n\t\t\t\t\tcontent: /[\\\\/]dist[\\\\/]src[\\\\/]browser[\\\\/]index\\.d\\.ts$/.test(path)\n{{replacement}}\n\t\t\t\t\t\t: content,\n\t\t\t\t}),\n\t\t\t}),\n\t\t],\n\t}),\n)\n";
                   server: "import { defineConfig } from 'vite'\nimport dts from 'vite-plugin-dts'\nimport { srcServer, resolveWorkspacePath } from '../../vite.config.ts'\n\n// vite-plugin-dts rolls this face into one declaration, and the roll-up reaches\n// src/core through a relative source path the tarball does not carry. The rewrite\n// below externalizes core through the package's own published root export, on the\n// final roll-up only.\nexport default defineConfig(\n\tsrcServer({\n\t\tplugins: [\n\t\t\tdts({\n\t\t\t\ttsconfigPath: resolveWorkspacePath('configs/src/tsconfig.server.json'),\n\t\t\t\tbundleTypes: true,\n\t\t\t\tbeforeWriteFile: (path, content) => ({\n\t\t\t\t\tcontent: /[\\\\/]dist[\\\\/]src[\\\\/]server[\\\\/]index\\.d\\.ts$/.test(path)\n{{replacement}}\n\t\t\t\t\t\t: content,\n\t\t\t\t}),\n\t\t\t}),\n\t\t],\n\t}),\n)\n";
               }>;
-              bin: "import { defineConfig } from 'vite'\nimport { srcBin } from '../../vite.config.ts'\n\n// The `scaffold` executable build — a single ESM lib file, no declarations (an\n// executable ships no types), with the `#!/usr/bin/env node` shebang re-emitted via\n// `output.banner` (rolldown strips shebangs from source during bundling), and\n// `output.paths` rewriting the externalized `@src/*` specifiers to the built sibling\n// src environments (relative to `dist/bin/`), so the emitted bin resolves at runtime.\nexport default defineConfig(\n\tsrcBin({\n\t\tbuild: {\n\t\t\trolldownOptions: {\n\t\t\t\toutput: {\n\t\t\t\t\tbanner: '#!/usr/bin/env node',\n{{paths}}\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\t}),\n)\n";
+              bin: "import { defineConfig } from 'vite'\nimport { srcBin } from '../../vite.config.ts'\n\n// The `scaffold` executable build — a single ESM lib file, no declarations (an\n// executable ships no types), with the `#!/usr/bin/env node` shebang re-emitted through\n// `output.banner` (rolldown strips shebangs from source during bundling), and\n// `output.paths` rewriting the externalized `@src/*` specifiers to the built sibling\n// src environments (relative to `dist/bin/`), so the emitted bin resolves at runtime.\nexport default defineConfig(\n\tsrcBin({\n\t\tbuild: {\n\t\t\trolldownOptions: {\n\t\t\t\toutput: {\n\t\t\t\t\tbanner: '#!/usr/bin/env node',\n{{paths}}\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\t}),\n)\n";
               app: Readonly<{
                   browser: "import { defineConfig } from 'vite'\nimport { appBrowser } from '../../vite.config.ts'\n\nexport default defineConfig(appBrowser())\n";
                   server: "import { defineConfig } from 'vite'\nimport { appServer } from '../../vite.config.ts'\n\nexport default defineConfig(appServer())\n";
                   showcase: "import { defineConfig } from 'vite'\nimport { appShowcase } from '../../vite.config.ts'\n\nexport default defineConfig(appShowcase())\n";
               }>;
           }>;
-          browsers: "// A generated browser workspace resolves its own Chromium here rather than in\n// `configs/helpers.ts`, because that leaf is vendored byte-identical to every\n// workspace and most of them declare no `playwright` to import.\n\nimport type { PlaywrightProviderOptions } from '@vitest/browser-playwright'\nimport { chromium } from 'playwright'\nimport { accessSync, constants as FS_CONSTANTS, globSync, readdirSync, statSync } from 'node:fs'\nimport { basename, dirname, join, resolve as resolvePath } from 'node:path'\n\n/**\n * Chromium executable layouts inside a `chromium-<revision>` browsers-directory entry, per\n * platform.\n *\n * @remarks\n * The current Playwright build ships Chrome for Testing on macOS. The trailing `Chromium.app`\n * layouts are what earlier builds shipped, so the list spans Playwright versions instead of\n * pinning to the installed one.\n */\nexport const CHROMIUM_LAYOUTS = Object.freeze([\n\t'chrome-linux/chrome',\n\t'chrome-linux64/chrome',\n\t'chrome-win/chrome.exe',\n\t'chrome-win64/chrome.exe',\n\t'chrome-mac-x64/Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing',\n\t'chrome-mac-arm64/Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing',\n\t'chrome-mac/Chromium.app/Contents/MacOS/Chromium',\n\t'chrome-mac-arm64/Chromium.app/Contents/MacOS/Chromium',\n])\n\n/** The `chromium-<revision>` entry name Playwright installs one managed build into. */\nexport const CHROMIUM_ENTRY_PATTERN = /^chromium-\\d+$/\n\n/** The revision number carried by any path containing a `chromium-<revision>` segment. */\nexport const CHROMIUM_REVISION_PATTERN = /chromium-(\\d+)/\n\n/** The directory a managed Linux container installs its bundled Playwright browsers into. */\nexport const BUNDLED_BROWSERS_ROOT = '/opt/pw-browsers'\n\n/**\n * Bundled Chromium layouts under the managed-container browsers root, as glob patterns.\n *\n * @remarks\n * The revision directory and its inner layout both drift across Playwright builds, and the\n * container also carries a top-level `chromium` alias, so every known shape is globbed.\n */\nexport const BUNDLED_CHROMIUM_LAYOUTS = Object.freeze([\n\t'chromium',\n\t'chromium-*/chrome-linux64/chrome',\n\t'chromium-*/chrome-linux/chrome',\n])\n\n/** Stable Playwright Chromium channels and their standard executable layouts. */\nexport const SYSTEM_BROWSER_CHANNELS = Object.freeze([\n\tObject.freeze({\n\t\tchannel: 'chrome',\n\t\tlayouts: Object.freeze({\n\t\t\tlinux: '/opt/google/chrome/chrome',\n\t\t\tdarwin: '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',\n\t\t\twin32: Object.freeze(['Google', 'Chrome', 'Application', 'chrome.exe']),\n\t\t}),\n\t}),\n\tObject.freeze({\n\t\tchannel: 'msedge',\n\t\tlayouts: Object.freeze({\n\t\t\tlinux: '/opt/microsoft/msedge/msedge',\n\t\t\tdarwin: '/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge',\n\t\t\twin32: Object.freeze(['Microsoft', 'Edge', 'Application', 'msedge.exe']),\n\t\t}),\n\t}),\n])\n\n/**\n * Determine whether a path identifies an executable regular file.\n *\n * @param path - The filesystem path to inspect.\n * @returns Whether the path is a regular file with execute access.\n *\n * @example\n * ```ts\n * isBrowserExecutable('/opt/google/chrome/chrome')\n * ```\n */\nexport function isBrowserExecutable(path: string): boolean {\n\ttry {\n\t\tif (!statSync(path).isFile()) return false\n\t\taccessSync(path, FS_CONSTANTS.X_OK)\n\t\treturn true\n\t} catch {\n\t\treturn false\n\t}\n}\n\n/**\n * Order two Chromium paths so the highest revision sorts first.\n *\n * @param left - The first path or directory entry to compare.\n * @param right - The second path or directory entry to compare.\n * @returns A negative number when `left` sorts first, positive when `right` does.\n *\n * @remarks\n * Revisions are numbers, so `chromium-1200` outranks `chromium-999` despite sorting below it\n * lexically. A path carrying no revision falls back to descending name order.\n *\n * @example\n * ```ts\n * ['chromium-999', 'chromium-1200'].sort(compareRevisions)\n * ```\n */\nexport function compareRevisions(left: string, right: string): number {\n\tconst leftRevision = CHROMIUM_REVISION_PATTERN.exec(left)?.[1]\n\tconst rightRevision = CHROMIUM_REVISION_PATTERN.exec(right)?.[1]\n\tif (leftRevision === undefined || rightRevision === undefined) return right.localeCompare(left)\n\treturn Number(rightRevision) - Number(leftRevision)\n}\n\n/**\n * Read the executable path of Playwright's pinned Chromium revision.\n *\n * @returns The pinned executable path, or `undefined` when this platform has none.\n *\n * @remarks\n * Playwright throws rather than returning a path when the current platform carries no initialized\n * executable, and an unguarded call would fail configuration evaluation for every project.\n *\n * @example\n * ```ts\n * resolvePinnedBrowser()\n * ```\n */\nexport function resolvePinnedBrowser(): string | undefined {\n\ttry {\n\t\tconst pinned = chromium.executablePath()\n\t\treturn pinned.length === 0 ? undefined : pinned\n\t} catch {\n\t\treturn undefined\n\t}\n}\n\n/**\n * Resolve a launchable Playwright-managed Chromium executable: the pinned revision when installed,\n * otherwise a `chromium` / `chromium.exe` alias or any other `chromium-*` revision under the same\n * Playwright browsers directory. A pinned-revision miss is not Chromium absence — managed\n * containers ship one usable build, often behind a revision-agnostic alias, for many Playwright\n * versions.\n *\n * @param pinned - The executable path for Playwright's pinned Chromium revision.\n * @returns The managed executable path, or `undefined` when none is executable.\n *\n * @example\n * ```ts\n * resolveManagedBrowser('/root/.cache/ms-playwright/chromium-1234/chrome-linux64/chrome')\n * ```\n */\nexport function resolveManagedBrowser(pinned: string): string | undefined {\n\tif (isBrowserExecutable(pinned)) return pinned\n\tlet revisionRoot = dirname(pinned)\n\tfor (;;) {\n\t\tif (CHROMIUM_ENTRY_PATTERN.test(basename(revisionRoot))) break\n\t\tconst parent = dirname(revisionRoot)\n\t\tif (parent === revisionRoot) return undefined\n\t\trevisionRoot = parent\n\t}\n\tconst browsersRoot = dirname(revisionRoot)\n\tfor (const alias of ['chromium', 'chromium.exe']) {\n\t\tconst candidate = resolvePath(browsersRoot, alias)\n\t\tif (isBrowserExecutable(candidate)) return candidate\n\t}\n\tlet entries: readonly string[]\n\ttry {\n\t\tentries = readdirSync(browsersRoot)\n\t} catch {\n\t\treturn undefined\n\t}\n\tconst revisions = entries\n\t\t.filter((entry) => CHROMIUM_ENTRY_PATTERN.test(entry))\n\t\t.sort(compareRevisions)\n\tfor (const revision of revisions) {\n\t\tfor (const layout of CHROMIUM_LAYOUTS) {\n\t\t\tconst candidate = resolvePath(browsersRoot, revision, layout)\n\t\t\tif (isBrowserExecutable(candidate)) return candidate\n\t\t}\n\t}\n\treturn undefined\n}\n\n/**\n * Resolve the Chromium a managed Linux container bundles outside the Playwright cache.\n *\n * @param platform - The Node platform the container runs on.\n * @param root - The bundled browsers directory to search.\n * @returns The highest matching executable path, or `undefined` when none is executable.\n *\n * @example\n * ```ts\n * resolveBundledBrowser('linux', BUNDLED_BROWSERS_ROOT)\n * ```\n */\nexport function resolveBundledBrowser(platform: NodeJS.Platform, root: string): string | undefined {\n\tif (platform !== 'linux') return undefined\n\tfor (const layout of BUNDLED_CHROMIUM_LAYOUTS) {\n\t\tlet matches: readonly string[]\n\t\ttry {\n\t\t\tmatches = globSync(layout, { cwd: root })\n\t\t} catch {\n\t\t\treturn undefined\n\t\t}\n\t\tfor (const match of [...matches].sort(compareRevisions)) {\n\t\t\tconst candidate = resolvePath(root, match)\n\t\t\tif (isBrowserExecutable(candidate)) return candidate\n\t\t}\n\t}\n\treturn undefined\n}\n\n/**\n * Resolve the first installed stable system Chromium channel.\n *\n * @param platform - The Node platform whose standard layouts should be probed.\n * @param environment - The process environment supplying Windows installation roots.\n * @returns `chrome`, then `msedge`, or `undefined` when neither is executable.\n *\n * @example\n * ```ts\n * resolveSystemBrowser(process.platform, process.env)\n * ```\n */\nexport function resolveSystemBrowser(\n\tplatform: NodeJS.Platform,\n\tenvironment: NodeJS.ProcessEnv,\n): string | undefined {\n\tif (platform !== 'linux' && platform !== 'darwin' && platform !== 'win32') return undefined\n\tconst roots = new Set<string>()\n\tif (platform === 'win32') {\n\t\tfor (const root of [\n\t\t\tenvironment.LOCALAPPDATA,\n\t\t\tenvironment.PROGRAMFILES,\n\t\t\tenvironment['PROGRAMFILES(X86)'],\n\t\t]) {\n\t\t\tif (root !== undefined && root.length > 0) roots.add(root)\n\t\t}\n\t\tconst homeDrive = environment.HOMEDRIVE\n\t\tif (homeDrive !== undefined && homeDrive.length > 0) {\n\t\t\troots.add(join(homeDrive, 'Program Files'))\n\t\t\troots.add(join(homeDrive, 'Program Files (x86)'))\n\t\t}\n\t}\n\tfor (const browser of SYSTEM_BROWSER_CHANNELS) {\n\t\tif (platform === 'win32') {\n\t\t\tfor (const root of roots) {\n\t\t\t\tif (isBrowserExecutable(join(root, ...browser.layouts.win32))) return browser.channel\n\t\t\t}\n\t\t\tcontinue\n\t\t}\n\t\tif (isBrowserExecutable(browser.layouts[platform])) return browser.channel\n\t}\n\treturn undefined\n}\n\n/**\n * Resolve Playwright provider options for whatever browser this host can actually launch.\n *\n * @param pinned - The executable path for Playwright's pinned Chromium revision, when it has one.\n * @param platform - The Node platform whose standard layouts should be probed.\n * @param environment - The process environment supplying operator overrides and Windows roots.\n * @param root - The managed-container bundled browsers directory to search.\n * @returns Provider options naming an executable, a WebSocket endpoint, or a channel.\n *\n * @remarks\n * Precedence, most important first: `PLAYWRIGHT_EXECUTABLE_PATH`, `PLAYWRIGHT_WS_ENDPOINT`,\n * `PLAYWRIGHT_CHANNEL`, the managed Playwright Chromium, the container's bundled Chromium, a\n * verified system channel, then the platform default channel. An operator override outranks\n * discovery and is returned exactly as given: none of those three environment values is checked\n * against the filesystem, because verifying an override would defeat the override. The pinned\n * managed revision outranks anything found on the host because it is deterministic. The installed\n * pinned revision returns empty options so Playwright keeps its own default launch semantics. Only\n * a discovered system channel is verified before it is named. The platform default is unverified\n * as well and exists only as a last resort: Windows takes `msedge`, which ships with the OS and\n * never collides with a foreground Chrome.\n *\n * @example\n * ```ts\n * resolveBrowser(resolvePinnedBrowser(), process.platform, process.env)\n * ```\n */\nexport function resolveBrowser(\n\tpinned: string | undefined,\n\tplatform: NodeJS.Platform,\n\tenvironment: NodeJS.ProcessEnv,\n\troot: string = BUNDLED_BROWSERS_ROOT,\n): PlaywrightProviderOptions {\n\tconst executable = environment.PLAYWRIGHT_EXECUTABLE_PATH\n\tif (executable !== undefined && executable.length > 0) {\n\t\treturn { launchOptions: { executablePath: executable } }\n\t}\n\tconst endpoint = environment.PLAYWRIGHT_WS_ENDPOINT\n\tif (endpoint !== undefined && endpoint.length > 0) {\n\t\treturn { connectOptions: { wsEndpoint: endpoint } }\n\t}\n\tconst requested = environment.PLAYWRIGHT_CHANNEL\n\tif (requested !== undefined && requested.length > 0) {\n\t\treturn { launchOptions: { channel: requested } }\n\t}\n\tconst managed = pinned === undefined ? undefined : resolveManagedBrowser(pinned)\n\tif (managed !== undefined) {\n\t\treturn managed === pinned ? {} : { launchOptions: { executablePath: managed } }\n\t}\n\tconst bundled = resolveBundledBrowser(platform, root)\n\tif (bundled !== undefined) return { launchOptions: { executablePath: bundled } }\n\tconst fallback = platform === 'win32' ? 'msedge' : 'chrome'\n\treturn { launchOptions: { channel: resolveSystemBrowser(platform, environment) ?? fallback } }\n}\n";
+          browsers: "// A generated browser workspace resolves its own Chromium here rather than in\n// `configs/helpers.ts`, because that leaf is vendored byte-identical to every\n// workspace and most of them declare no `playwright` to import.\n\nimport type { PlaywrightProviderOptions } from '@vitest/browser-playwright'\nimport { chromium } from 'playwright'\nimport { accessSync, constants as FS_CONSTANTS, globSync, readdirSync, statSync } from 'node:fs'\nimport { basename, dirname, join, resolve as resolvePath } from 'node:path'\n\n/**\n * Chromium executable layouts inside a `chromium-<revision>` browsers-directory entry, per\n * platform.\n *\n * @remarks\n * The current Playwright build ships Chrome for Testing on macOS. The trailing `Chromium.app`\n * layouts are what earlier builds shipped, so the list spans Playwright versions instead of\n * pinning to the installed one.\n */\nexport const CHROMIUM_LAYOUTS = Object.freeze([\n\t'chrome-linux/chrome',\n\t'chrome-linux64/chrome',\n\t'chrome-win/chrome.exe',\n\t'chrome-win64/chrome.exe',\n\t'chrome-mac-x64/Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing',\n\t'chrome-mac-arm64/Google Chrome for Testing.app/Contents/MacOS/Google Chrome for Testing',\n\t'chrome-mac/Chromium.app/Contents/MacOS/Chromium',\n\t'chrome-mac-arm64/Chromium.app/Contents/MacOS/Chromium',\n])\n\n/** The `chromium-<revision>` entry name Playwright installs one managed build into. */\nexport const CHROMIUM_ENTRY_PATTERN = /^chromium-\\d+$/\n\n/** The revision number carried by any path containing a `chromium-<revision>` segment. */\nexport const CHROMIUM_REVISION_PATTERN = /chromium-(\\d+)/\n\n/** The directory a managed Linux container installs its bundled Playwright browsers into. */\nexport const BUNDLED_BROWSERS_ROOT = '/opt/pw-browsers'\n\n/**\n * Bundled Chromium layouts under the managed-container browsers root, as glob patterns.\n *\n * @remarks\n * The revision directory and its inner layout both drift across Playwright builds, and the\n * container also carries a top-level `chromium` alias, so every known shape is globbed.\n */\nexport const BUNDLED_CHROMIUM_LAYOUTS = Object.freeze([\n\t'chromium',\n\t'chromium-*/chrome-linux64/chrome',\n\t'chromium-*/chrome-linux/chrome',\n])\n\n/** Stable Playwright Chromium channels and their standard executable layouts. */\nexport const SYSTEM_BROWSER_CHANNELS = Object.freeze([\n\tObject.freeze({\n\t\tchannel: 'chrome',\n\t\tlayouts: Object.freeze({\n\t\t\tlinux: '/opt/google/chrome/chrome',\n\t\t\tdarwin: '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',\n\t\t\twin32: Object.freeze(['Google', 'Chrome', 'Application', 'chrome.exe']),\n\t\t}),\n\t}),\n\tObject.freeze({\n\t\tchannel: 'msedge',\n\t\tlayouts: Object.freeze({\n\t\t\tlinux: '/opt/microsoft/msedge/msedge',\n\t\t\tdarwin: '/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge',\n\t\t\twin32: Object.freeze(['Microsoft', 'Edge', 'Application', 'msedge.exe']),\n\t\t}),\n\t}),\n])\n\n/**\n * Determine whether a path identifies an executable regular file.\n *\n * @param path - The filesystem path to inspect.\n * @returns Whether the path is a regular file with execute access.\n *\n * @example\n * ```ts\n * isBrowserExecutable('/opt/google/chrome/chrome')\n * ```\n */\nexport function isBrowserExecutable(path: string): boolean {\n\ttry {\n\t\tif (!statSync(path).isFile()) return false\n\t\taccessSync(path, FS_CONSTANTS.X_OK)\n\t\treturn true\n\t} catch {\n\t\treturn false\n\t}\n}\n\n/**\n * Order two Chromium paths so the highest revision sorts first.\n *\n * @param left - The first path or directory entry to compare.\n * @param right - The second path or directory entry to compare.\n * @returns A negative number when `left` sorts first, positive when `right` does.\n *\n * @remarks\n * Revisions are numbers, so `chromium-1200` outranks `chromium-999` despite sorting below it\n * lexically. A path carrying no revision falls back to descending name order.\n *\n * @example\n * ```ts\n * ['chromium-999', 'chromium-1200'].sort(compareRevisions)\n * ```\n */\nexport function compareRevisions(left: string, right: string): number {\n\tconst leftRevision = CHROMIUM_REVISION_PATTERN.exec(left)?.[1]\n\tconst rightRevision = CHROMIUM_REVISION_PATTERN.exec(right)?.[1]\n\tif (leftRevision === undefined || rightRevision === undefined) return right.localeCompare(left)\n\treturn Number(rightRevision) - Number(leftRevision)\n}\n\n/**\n * Read the executable path of Playwright's pinned Chromium revision.\n *\n * @returns The pinned executable path, or `undefined` when this platform has none.\n *\n * @remarks\n * Playwright throws rather than returning a path when the current platform carries no initialized\n * executable, and an unguarded call would fail configuration evaluation for every project.\n *\n * @example\n * ```ts\n * resolvePinnedBrowser()\n * ```\n */\nexport function resolvePinnedBrowser(): string | undefined {\n\ttry {\n\t\tconst pinned = chromium.executablePath()\n\t\treturn pinned.length === 0 ? undefined : pinned\n\t} catch {\n\t\treturn undefined\n\t}\n}\n\n/**\n * Resolve a launchable Playwright-managed Chromium executable: the pinned revision when installed,\n * otherwise a `chromium` / `chromium.exe` alias or any other `chromium-*` revision under the same\n * Playwright browsers directory. A pinned-revision miss is not Chromium absence — managed\n * containers ship one usable build, often behind a revision-agnostic alias, for many Playwright\n * versions.\n *\n * @param pinned - The executable path for Playwright's pinned Chromium revision.\n * @returns The managed executable path, or `undefined` when none is executable.\n *\n * @example\n * ```ts\n * resolveManagedBrowser('/root/.cache/ms-playwright/chromium-1234/chrome-linux64/chrome')\n * ```\n */\nexport function resolveManagedBrowser(pinned: string): string | undefined {\n\tif (isBrowserExecutable(pinned)) return pinned\n\tlet revisionRoot = dirname(pinned)\n\tfor (;;) {\n\t\tif (CHROMIUM_ENTRY_PATTERN.test(basename(revisionRoot))) break\n\t\tconst parent = dirname(revisionRoot)\n\t\tif (parent === revisionRoot) return undefined\n\t\trevisionRoot = parent\n\t}\n\tconst browsersRoot = dirname(revisionRoot)\n\tfor (const alias of ['chromium', 'chromium.exe']) {\n\t\tconst candidate = resolvePath(browsersRoot, alias)\n\t\tif (isBrowserExecutable(candidate)) return candidate\n\t}\n\tlet entries: readonly string[]\n\ttry {\n\t\tentries = readdirSync(browsersRoot)\n\t} catch {\n\t\treturn undefined\n\t}\n\tconst revisions = entries\n\t\t.filter((entry) => CHROMIUM_ENTRY_PATTERN.test(entry))\n\t\t.sort(compareRevisions)\n\tfor (const revision of revisions) {\n\t\tfor (const layout of CHROMIUM_LAYOUTS) {\n\t\t\tconst candidate = resolvePath(browsersRoot, revision, layout)\n\t\t\tif (isBrowserExecutable(candidate)) return candidate\n\t\t}\n\t}\n\treturn undefined\n}\n\n/**\n * Resolve the Chromium a managed Linux container bundles outside the Playwright cache.\n *\n * @param platform - The Node platform the container runs on.\n * @param root - The bundled browsers directory to search.\n * @returns The highest matching executable path, or `undefined` when none is executable.\n *\n * @example\n * ```ts\n * resolveBundledBrowser('linux', BUNDLED_BROWSERS_ROOT)\n * ```\n */\nexport function resolveBundledBrowser(platform: NodeJS.Platform, root: string): string | undefined {\n\tif (platform !== 'linux') return undefined\n\tfor (const layout of BUNDLED_CHROMIUM_LAYOUTS) {\n\t\tlet matches: readonly string[]\n\t\ttry {\n\t\t\tmatches = globSync(layout, { cwd: root })\n\t\t} catch {\n\t\t\treturn undefined\n\t\t}\n\t\tfor (const match of [...matches].sort(compareRevisions)) {\n\t\t\tconst candidate = resolvePath(root, match)\n\t\t\tif (isBrowserExecutable(candidate)) return candidate\n\t\t}\n\t}\n\treturn undefined\n}\n\n/**\n * Resolve the first installed stable system Chromium channel.\n *\n * @param platform - The Node platform whose standard layouts this call probes.\n * @param environment - The process environment supplying Windows installation roots.\n * @returns `chrome`, then `msedge`, or `undefined` when neither is executable.\n *\n * @example\n * ```ts\n * resolveSystemBrowser(process.platform, process.env)\n * ```\n */\nexport function resolveSystemBrowser(\n\tplatform: NodeJS.Platform,\n\tenvironment: NodeJS.ProcessEnv,\n): string | undefined {\n\tif (platform !== 'linux' && platform !== 'darwin' && platform !== 'win32') return undefined\n\tconst roots = new Set<string>()\n\tif (platform === 'win32') {\n\t\tfor (const root of [\n\t\t\tenvironment.LOCALAPPDATA,\n\t\t\tenvironment.PROGRAMFILES,\n\t\t\tenvironment['PROGRAMFILES(X86)'],\n\t\t]) {\n\t\t\tif (root !== undefined && root.length > 0) roots.add(root)\n\t\t}\n\t\tconst homeDrive = environment.HOMEDRIVE\n\t\tif (homeDrive !== undefined && homeDrive.length > 0) {\n\t\t\troots.add(join(homeDrive, 'Program Files'))\n\t\t\troots.add(join(homeDrive, 'Program Files (x86)'))\n\t\t}\n\t}\n\tfor (const browser of SYSTEM_BROWSER_CHANNELS) {\n\t\tif (platform === 'win32') {\n\t\t\tfor (const root of roots) {\n\t\t\t\tif (isBrowserExecutable(join(root, ...browser.layouts.win32))) return browser.channel\n\t\t\t}\n\t\t\tcontinue\n\t\t}\n\t\tif (isBrowserExecutable(browser.layouts[platform])) return browser.channel\n\t}\n\treturn undefined\n}\n\n/**\n * Resolve Playwright provider options for whatever browser this host can actually launch.\n *\n * @param pinned - The executable path for Playwright's pinned Chromium revision, when it has one.\n * @param platform - The Node platform whose standard layouts this call probes.\n * @param environment - The process environment supplying operator overrides and Windows roots.\n * @param root - The managed-container bundled browsers directory to search.\n * @returns Provider options naming an executable, a WebSocket endpoint, or a channel.\n *\n * @remarks\n * Precedence, most important first: `PLAYWRIGHT_EXECUTABLE_PATH`, `PLAYWRIGHT_WS_ENDPOINT`,\n * `PLAYWRIGHT_CHANNEL`, the managed Playwright Chromium, the container's bundled Chromium, a\n * verified system channel, then the platform default channel. An operator override outranks\n * discovery and is returned exactly as given: none of those environment values is checked\n * against the filesystem, because verifying an override would defeat the override. The pinned\n * managed revision outranks anything found on the host because it is deterministic. The installed\n * pinned revision returns empty options so Playwright keeps its own default launch semantics. Only\n * a discovered system channel is verified before it is named. The platform default is unverified\n * as well and exists only as a last resort: Windows takes `msedge`, which ships with the OS and\n * never collides with a foreground Chrome.\n *\n * @example\n * ```ts\n * resolveBrowser(resolvePinnedBrowser(), process.platform, process.env)\n * ```\n */\nexport function resolveBrowser(\n\tpinned: string | undefined,\n\tplatform: NodeJS.Platform,\n\tenvironment: NodeJS.ProcessEnv,\n\troot: string = BUNDLED_BROWSERS_ROOT,\n): PlaywrightProviderOptions {\n\tconst executable = environment.PLAYWRIGHT_EXECUTABLE_PATH\n\tif (executable !== undefined && executable.length > 0) {\n\t\treturn { launchOptions: { executablePath: executable } }\n\t}\n\tconst endpoint = environment.PLAYWRIGHT_WS_ENDPOINT\n\tif (endpoint !== undefined && endpoint.length > 0) {\n\t\treturn { connectOptions: { wsEndpoint: endpoint } }\n\t}\n\tconst requested = environment.PLAYWRIGHT_CHANNEL\n\tif (requested !== undefined && requested.length > 0) {\n\t\treturn { launchOptions: { channel: requested } }\n\t}\n\tconst managed = pinned === undefined ? undefined : resolveManagedBrowser(pinned)\n\tif (managed !== undefined) {\n\t\treturn managed === pinned ? {} : { launchOptions: { executablePath: managed } }\n\t}\n\tconst bundled = resolveBundledBrowser(platform, root)\n\tif (bundled !== undefined) return { launchOptions: { executablePath: bundled } }\n\tconst fallback = platform === 'win32' ? 'msedge' : 'chrome'\n\treturn { launchOptions: { channel: resolveSystemBrowser(platform, environment) ?? fallback } }\n}\n";
       }>;
 
       /** The official-tooling drift proof whose presence makes a workspace `conformance`. */
@@ -1143,17 +1143,17 @@ export declare class Compiler implements CompilerInterface {
            * workspace actually declares.
            *
            * This is the construction door, and {@link parseBlueprint} is the coercing one.
-           * They differ in all three of their parts: this fills the defaults and takes a
+           * They differ in every part: this fills the defaults and takes a
            * partial specification, where the parser fills nothing and takes an untrusted
            * value; and this refuses by throwing, where the parser refuses by answering
            * `undefined`. What they share is the law — both accept exactly what
            * `isBlueprint` accepts.
            *
            * That law is structural only. Whether the name is a name, the version a
-           * version, and the two environment axes a combination this package can generate
+           * version, and the environment axes a combination this package can generate
            * are the gate's laws, and the gate answers them with {@link Question}s carrying
-           * their accepted candidates. Deciding them here as well would state one law in
-           * two places and let the two answers disagree, so a blueprint the gate will
+           * their accepted candidates. Deciding them here as well would restate that law
+           * and let the answers disagree, so a blueprint the gate will
            * refuse is still constructible.
            *
            * @example
@@ -1166,1704 +1166,1685 @@ export declare class Compiler implements CompilerInterface {
            */
        export declare function createBlueprint(name: string, input?: Partial<Omit<Blueprint, 'name'>>): Blueprint;
 
-       /**
-        * Construct a {@link Compiler}.
-        *
-        * @param options - The initial listeners and the listener-error handler.
-        * @returns The compiler, typed as the contract consumers program against.
-        * @throws {@link ScaffoldError} coded `INVALID` when `options` is present but is
-            * not an option bag the compiler accepts.
-            *
-            * @example
-            * ```ts
-            * import { createCompiler } from '@orkestrel/scaffold'
-            *
-            * const compiler = createCompiler({ on: { block: (questions) => report(questions) } })
-            * compiler.destroy()
-            * ```
-            */
-        export declare function createCompiler(options?: CompilerOptions): CompilerInterface;
-
-        /** The development dependencies that emit declarations for published source or an executable. */
-        export declare const DECLARATION_DEV_DEPENDENCIES: Readonly<Record<string, string>>;
+       /** The development dependencies that emit declarations for published source or an executable. */
+       export declare const DECLARATION_DEV_DEPENDENCIES: Readonly<Record<string, string>>;
 
-        /** The `engines.node` range a workspace starts with. */
-        export declare const DEFAULT_ENGINES = ">=22.12.0";
+       /** The `engines.node` range a workspace starts with. */
+       export declare const DEFAULT_ENGINES = ">=22.12.0";
 
-        /** The version a workspace starts at. */
-        export declare const DEFAULT_VERSION = "0.0.1";
-
-        /**
-         * Measure one declared package list against the name and range syntax it accepts.
-         *
-         * @param dependencies - The declared list.
-         * @param field - The blueprint field the list came from, reported on each question.
-         * @param name - The package-name syntax the field accepts.
-         * @param range - The range syntax the field accepts.
-         * @returns One blocking question per rejected name, repeated name, and rejected
-         * range, in list order.
-         *
-         * @remarks
-         * The declared lists and peer partitions differ only in the two syntaxes they
-         * accept, so the rules live here once and each caller supplies its own patterns.
-         * A runtime dependency name reaches a path through its guide mirror and is
-         * fixed to the `@orkestrel` scope. A foreign peer or development extra reaches
-         * no path and admits any valid npm name.
-         *
-         * Both patterns must be stateless. A global or sticky pattern carries a
-         * `lastIndex` between calls, so it would answer differently for the same input
-         * depending on what was tested before it.
-         *
-         * @example
-         * ```ts
-         * import { DEPENDENCY_NAME_PATTERN, ORKESTREL_RANGE_PATTERN } from '@orkestrel/scaffold'
-         * import { dependenciesToQuestions } from '@orkestrel/scaffold'
-         *
-         * dependenciesToQuestions(
-         * 	[{ name: '@orkestrel/router', range: '0.0.8' }],
-         * 	'dependencies',
-         * 	DEPENDENCY_NAME_PATTERN,
-         * 	ORKESTREL_RANGE_PATTERN,
-         * ).length // 1 — the range is not caret-pinned
-         * ```
-         */
-        export declare function dependenciesToQuestions(dependencies: readonly Dependency[], field: string, name: RegExp, range: RegExp): readonly Question[];
+       /** The version a workspace starts at. */
+       export declare const DEFAULT_VERSION = "0.0.1";
 
-        /**
-         * One runtime `@orkestrel/*` dependency of a generated workspace.
-         *
-         * @remarks
-         * `optional` is meaningful only on a blueprint's `peers`, where it emits a
-         * `peerDependenciesMeta` entry beside the peer.
-         */
-        export declare interface Dependency {
-            readonly name: string;
-            readonly range: string;
-            readonly optional?: boolean;
-        }
-
-        /**
-         * The runtime dependency name syntax: the `@orkestrel` scope and a bare name.
-         *
-         * @remarks
-         * A dependency name reaches a path, because a workspace's guide mirror is
-         * derived from it. Fixing the scope and forbidding everything but the bare name
-         * after it is what stops a hand-built name from escaping the directory the
-         * mirror belongs in.
-         */
-        export declare const DEPENDENCY_NAME_PATTERN: RegExp;
+       /**
+        * Measure one declared package list against the name and range syntax it accepts.
+        *
+        * @param dependencies - The declared list.
+        * @param field - The blueprint field the list came from, reported on each question.
+        * @param name - The package-name syntax the field accepts.
+        * @param range - The range syntax the field accepts.
+        * @returns One blocking question per rejected name, repeated name, and rejected
+        * range, in list order.
+        *
+        * @remarks
+        * The declared lists and peer partitions differ only in the syntaxes they
+        * accept, so the rules live here once and each caller supplies its own patterns.
+        * A runtime dependency name reaches a path through its guide mirror and is
+        * fixed to the `@orkestrel` scope. A foreign peer or development extra reaches
+        * no path and admits any valid npm name.
+        *
+        * Both patterns must be stateless. A global or sticky pattern carries a
+        * `lastIndex` between calls, so it would answer differently for the same input
+        * depending on what was tested before it.
+        *
+        * @example
+        * ```ts
+        * import { DEPENDENCY_NAME_PATTERN, ORKESTREL_RANGE_PATTERN } from '@orkestrel/scaffold'
+        * import { dependenciesToQuestions } from '@orkestrel/scaffold'
+        *
+        * dependenciesToQuestions(
+        * 	[{ name: '@orkestrel/router', range: '0.0.8' }],
+        * 	'dependencies',
+        * 	DEPENDENCY_NAME_PATTERN,
+        * 	ORKESTREL_RANGE_PATTERN,
+        * ).length // 1 — the range is not caret-pinned
+        * ```
+        */
+       export declare function dependenciesToQuestions(dependencies: readonly Dependency[], field: string, name: RegExp, range: RegExp): readonly Question[];
 
-        /** The packed-package proof whose presence makes a workspace `distribution`. */
-        export declare const DISTRIBUTION_TEST_PATH = "tests/distribution.test.ts";
+       /**
+        * One runtime `@orkestrel/*` dependency of a generated workspace.
+        *
+        * @remarks
+        * `optional` is meaningful only on a blueprint's `peers`, where it emits a
+        * `peerDependenciesMeta` entry beside the peer.
+        */
+       export declare interface Dependency {
+           readonly name: string;
+           readonly range: string;
+           readonly optional?: boolean;
+       }
 
-        /**
-         * How one target path compares to the artifact planned for it.
-         *
-         * @remarks
-         * `foreign` is a path the plan does not own at all. It is also the set
-         * `overwrite` deletes from, narrowed by the paths no verb may remove and by
-         * what git tracks.
-         */
-        export declare type Drift = 'aligned' | 'stale' | 'missing' | 'foreign';
+       /**
+        * The runtime dependency name syntax: the `@orkestrel` scope and a bare name.
+        *
+        * @remarks
+        * A dependency name reaches a path, because a workspace's guide mirror is
+        * derived from it. Fixing the scope and forbidding everything but the bare name
+        * after it is what stops a hand-built name from escaping the directory the
+        * mirror belongs in.
+        */
+       export declare const DEPENDENCY_NAME_PATTERN: RegExp;
 
-        /** The minimum-Node engine syntax a blueprint declares. */
-        export declare const ENGINES_PATTERN: RegExp;
+       /** The packed-package proof whose presence makes a workspace `distribution`. */
+       export declare const DISTRIBUTION_TEST_PATH = "tests/distribution.test.ts";
 
-        /** One environment a generated workspace selects on its `src` or `app` axis. */
-        export declare type Environment = 'core' | 'browser' | 'server';
+       /**
+        * How one target path compares to the artifact planned for it.
+        *
+        * @remarks
+        * `foreign` is a path the plan does not own at all. It is also the set
+        * `overwrite` deletes from, narrowed by the paths no verb may remove and by
+        * what git tracks.
+        */
+       export declare type Drift = 'aligned' | 'stale' | 'missing' | 'foreign';
 
-        /**
-         * The three `Environment` values, frozen.
-         *
-         * @remarks
-         * A blueprint's `src` and `app` axes are caller-supplied, so the gate measures
-         * each selection against this list and reports it as the accepted candidates
-         * when it rejects one. It is also the key order the per-environment matrices
-         * are read in.
-         */
-        export declare const ENVIRONMENTS: readonly Environment[];
+       /** The minimum-Node engine syntax a blueprint declares. */
+       export declare const ENGINES_PATTERN: RegExp;
 
-        /**
-         * The vendored paths a target receives with its executable bit set, frozen.
-         *
-         * @remarks
-         * Declared rather than read from the staging host's filesystem, because that
-         * reading is not portable: Windows carries no executable bit, so a host staged
-         * there reports every file non-executable and every target receives hooks it
-         * cannot run. Declaring the set here makes one checkout stage one manifest on
-         * every host.
-         *
-         * Every entry is also a {@link HOST_PATHS} member or sits beneath one. A file
-         * that must run when a target invokes it belongs here the moment it is vendored.
-         */
-        export declare const EXECUTABLE_PATHS: readonly string[];
+       /** One environment a generated workspace selects on its `src` or `app` axis. */
+       export declare type Environment = 'core' | 'browser' | 'server';
 
-        /** The registry-only semver subset accepted for a development extra's range. */
-        export declare const EXTRA_RANGE_PATTERN: RegExp;
+       /**
+        * The `Environment` values, frozen.
+        *
+        * @remarks
+        * A blueprint's `src` and `app` axes are caller-supplied, so the gate measures
+        * each selection against this list and reports it as the accepted candidates
+        * when it rejects one. It is also the key order the per-environment matrices
+        * are read in.
+        */
+       export declare const ENVIRONMENTS: readonly Environment[];
 
-        /**
-         * Extract the three numeric components of an exact version.
-         *
-         * @param version - The candidate version text.
-         * @returns The major, minor, and patch numbers, or `undefined` when the text is
-         * not the exact three-component syntax.
-         *
-         * @remarks
-         * Deliberately narrow: a prerelease or build suffix is not extracted, because
-         * this package compares released versions and refusing to read one is honest
-         * where guessing its precedence would not be.
-         *
-         * @example
-         * ```ts
-         * import { extractVersion } from '@orkestrel/scaffold'
-         *
-         * extractVersion('0.0.23') // [0, 0, 23]
-         * extractVersion('1.2.3-beta.1') // undefined
-         * ```
-         */
-        export declare function extractVersion(version: string): readonly [major: number, minor: number, patch: number] | undefined;
+       /**
+        * The vendored paths a target receives with its executable bit set, frozen.
+        *
+        * @remarks
+        * Declared rather than read from the staging host's filesystem, because that
+        * reading is not portable: Windows carries no executable bit, so a host staged
+        * there reports every file non-executable and every target receives hooks it
+        * cannot run. Declaring the set here makes one checkout stage one manifest on
+        * every host.
+        *
+        * Every entry is also a {@link HOST_PATHS} member or sits beneath one. A file
+        * that must run when a target invokes it belongs here the moment it is vendored.
+        */
+       export declare const EXECUTABLE_PATHS: readonly string[];
 
-        /**
-         * One drift verdict against a target path.
-         *
-         * @remarks
-         * `observed` carries the destination's exact bytes and is the precondition the
-         * mutation is held to: a write that replaces stale bytes and a deletion that
-         * removes a foreign file each fail when the destination no longer matches what
-         * the finding recorded. Both therefore require it, and the requirement is in
-         * the type rather than in prose, because a deletion that cannot bind to what
-         * the audit showed is the one thing the destructive verb must never do. A
-         * missing destination has no bytes to record. An aligned one may have gone
-         * uncompared, which is what a birth-owned path always does, so it records
-         * bytes only where they were actually read. Every planned finding carries its
-         * artifact's {@link Ownership}, so a consumer reads what scaffold claims at the
-         * path from the finding itself. A foreign finding has no planned artifact and
-         * therefore no ownership.
-         *
-         * Which combinations of `ownership`, `drift`, and `observed` a real audit
-         * produces is {@link inferDrift}'s law, not this type's. A birth-owned path is
-         * never compared and is always aligned, a presence-owned path compares existence
-         * only, and bytes are recorded only where they were read. This shape therefore
-         * admits a combination that law never produces — a birth-owned path reported
-         * stale is the plainest one — and it admits it deliberately: restating the
-         * comparison's case analysis here would be a second copy of it, able to disagree
-         * with the one that decides. What closes the gap is the writer: `repair` and
-         * `remove` re-derive every verdict themselves and refuse a caller's audit that
-         * does not match, so a verdict the comparison could not have reached is refused
-         * rather than acted on.
-         */
-        export declare type Finding = {
-            readonly path: string;
-            readonly group: Group;
-            readonly ownership: Ownership;
-            readonly drift: 'stale';
-            readonly observed: string;
-        } | {
-            readonly path: string;
-            readonly group: Group;
-            readonly ownership?: never;
-            readonly drift: 'foreign';
-            readonly observed: string;
-        } | {
-            readonly path: string;
-            readonly group: Group;
-            readonly ownership: Ownership;
-            readonly drift: 'missing';
-            readonly observed?: never;
-        } | {
-            readonly path: string;
-            readonly group: Group;
-            readonly ownership: Ownership;
-            readonly drift: 'aligned';
-            readonly observed?: string;
-        };
-
-        /**
-         * The exact three-component floor accepted for a foreign peer's range.
-         *
-         * @remarks
-         * This is independent from {@link ENGINES_PATTERN}. An engine floors the Node
-         * runtime a workspace supports, while a peer floors a tool the consumer
-         * supplies. Either obligation may change without changing the other.
-         */
-        export declare const FLOOR_RANGE_PATTERN: RegExp;
+       /** The registry-only semver subset accepted for a development extra's range. */
+       export declare const EXTRA_RANGE_PATTERN: RegExp;
 
-        /**
-         * The package name syntax for a dependency this package does not publish.
-         *
-         * @remarks
-         * A foreign package is one this package does not publish, so its name reaches
-         * no path. It may carry any scope or no scope at all. Each name segment begins
-         * with an alphanumeric character after an optional leading `@`, and the name
-         * carries at most one `/`. No segment can therefore be `..`, and no backslash
-         * is admitted, so the shape cannot express a traversal.
-         */
-        export declare const FOREIGN_NAME_PATTERN: RegExp;
+       /**
+        * Extract the major, minor, and patch components of an exact version.
+        *
+        * @param version - The candidate version text.
+        * @returns The major, minor, and patch numbers, or `undefined` when the text is
+        * not the exact `major.minor.patch` syntax.
+        *
+        * @remarks
+        * Deliberately narrow: a prerelease or build suffix is not extracted, because
+        * this package compares released versions and refusing to read one is honest
+        * where guessing its precedence would not be.
+        *
+        * @example
+        * ```ts
+        * import { extractVersion } from '@orkestrel/scaffold'
+        *
+        * extractVersion('0.0.23') // [0, 0, 23]
+        * extractVersion('1.2.3-beta.1') // undefined
+        * ```
+        */
+       export declare function extractVersion(version: string): readonly [major: number, minor: number, patch: number] | undefined;
 
-        /** The shared Vitest global-setup module whose presence makes a workspace `global`. */
-        export declare const GLOBAL_SETUP_PATH = "tests/setupGlobal.ts";
+       /**
+        * One drift verdict against a target path.
+        *
+        * @remarks
+        * `observed` carries the destination's exact bytes and is the precondition the
+        * mutation is held to: a write that replaces stale bytes and a deletion that
+        * removes a foreign file each fail when the destination no longer matches what
+        * the finding recorded. Both therefore require it, and the requirement is in
+        * the type rather than in prose, because a deletion that cannot bind to what
+        * the audit showed is the one thing the destructive verb must never do. A
+        * missing destination has no bytes to record. An aligned one may have gone
+        * uncompared, which is what a birth-owned path always does, so it records
+        * bytes only where they were actually read. Every planned finding carries its
+        * artifact's {@link Ownership}, so a consumer reads what scaffold claims at the
+        * path from the finding itself. A foreign finding has no planned artifact and
+        * therefore no ownership.
+        *
+        * Which combinations of `ownership`, `drift`, and `observed` a real audit
+        * produces is {@link inferDrift}'s law, not this type's. A birth-owned path is
+        * never compared and is always aligned, a presence-owned path compares existence
+        * only, and bytes are recorded only where they were read. This shape therefore
+        * admits a combination that law never produces — a birth-owned path reported
+        * stale is the plainest one — and it admits it deliberately: restating the
+        * comparison's case analysis here would be a second copy of it, able to disagree
+        * with the one that decides. What closes the gap is the writer: `repair` and
+        * `remove` re-derive every verdict themselves and refuse a caller's audit that
+        * does not match, so a verdict the comparison could not have reached is refused
+        * rather than acted on.
+        */
+       export declare type Finding = {
+           readonly path: string;
+           readonly group: Group;
+           readonly ownership: Ownership;
+           readonly drift: 'stale';
+           readonly observed: string;
+       } | {
+           readonly path: string;
+           readonly group: Group;
+           readonly ownership?: never;
+           readonly drift: 'foreign';
+           readonly observed: string;
+       } | {
+           readonly path: string;
+           readonly group: Group;
+           readonly ownership: Ownership;
+           readonly drift: 'missing';
+           readonly observed?: never;
+       } | {
+           readonly path: string;
+           readonly group: Group;
+           readonly ownership: Ownership;
+           readonly drift: 'aligned';
+           readonly observed?: string;
+       };
 
-        /** The artifact group a plan selects over. */
-        export declare type Group = 'manifest' | 'configs' | 'source' | 'tests' | 'guides' | 'docs' | 'orchestration';
+       /**
+        * The exact `major.minor.patch` floor accepted for a foreign peer's range.
+        *
+        * @remarks
+        * This is independent from {@link ENGINES_PATTERN}. An engine floors the Node
+        * runtime a workspace supports, while a peer floors a tool the consumer
+        * supplies. Either obligation may change without changing the other.
+        */
+       export declare const FLOOR_RANGE_PATTERN: RegExp;
 
-        /**
-         * The seven `Group` values in plan order, frozen.
-         *
-         * @remarks
-         * A compile that names no groups covers every one of them, so this list is the
-         * default selection as well as the accepted candidates for a rejected one. The
-         * order is the order a plan lists its artifacts in.
-         */
-        export declare const GROUPS: readonly Group[];
+       /**
+        * The package name syntax for a dependency this package does not publish.
+        *
+        * @remarks
+        * A foreign package is one this package does not publish, so its name reaches
+        * no path. It may carry any scope or no scope at all. Each name segment begins
+        * with an alphanumeric character after an optional leading `@`, and the name
+        * carries at most one `/`. No segment can therefore be `..`, and no backslash
+        * is admitted, so the shape cannot express a traversal.
+        */
+       export declare const FOREIGN_NAME_PATTERN: RegExp;
 
-        /** The guide-parity proof whose presence selects the planned `guides` project. */
-        export declare const GUIDES_TEST_PATH = "tests/guides.test.ts";
+       /** The shared Vitest global-setup module whose presence makes a workspace `global`. */
+       export declare const GLOBAL_SETUP_PATH = "tests/setupGlobal.ts";
 
-        /** Exact lowercase hexadecimal bytes: two digits per byte, and empty content is valid. */
-        export declare const HEX_PATTERN: RegExp;
+       /** The artifact group a plan selects over. */
+       export declare type Group = 'manifest' | 'configs' | 'source' | 'tests' | 'guides' | 'docs' | 'orchestration';
 
-        /**
-         * The paths byte-copied from the vendored data root, frozen.
-         *
-         * @remarks
-         * These are the files the fleet shares verbatim: the root instruction
-         * documents, the licence, the canonical orchestration contract every harness
-         * bridge points at, the four harness directories, the session hook scripts,
-         * the shared policy register, the byte-identical root dotfiles, and the two
-         * guide mirrors a generated workspace starts from. A directory entry vendors
-         * everything beneath it.
-         *
-         * A plan carries the subset its target selects, which is why the list is a
-         * candidate set rather than a plan: a workspace never mirrors its own guide.
-         */
-        export declare const HOST_PATHS: readonly string[];
+       /**
+        * The `Group` values in plan order, frozen.
+        *
+        * @remarks
+        * A compile that names no groups covers every one of them, so this list is the
+        * default selection as well as the accepted candidates for a rejected one. The
+        * order is the order a plan lists its artifacts in.
+        */
+       export declare const GROUPS: readonly Group[];
 
-        /**
-         * A file byte-copied from the vendored data root, planned before its bytes are read.
-         *
-         * @remarks
-         * `source` falls back to `path` when absent. The pure core face cannot read the
-         * vendored root, so a plan it compiles alone claims only that these files
-         * exist. That is why the ownership here is narrowed away from `content`: a
-         * claim over bytes nobody has read is a claim that cannot be checked. Reading
-         * the vendored root turns the ones scaffold owns the bytes of into
-         * {@link HydratedArtifact}. Workspace-owned paths and paths whose bytes belong
-         * to another verb stay plain host artifacts, because this writer claims only
-         * their presence.
-         */
-        export declare interface HostArtifact extends ArtifactBase {
-            readonly origin: 'host';
-            readonly ownership: 'presence' | 'birth';
-            readonly source?: string;
-            readonly hex?: never;
-            readonly content?: never;
-        }
-
-        /**
-         * A vendored file whose exact bytes have been read, so its content can be compared.
-         *
-         * @remarks
-         * `hex` is the canonical lowercase byte pairs of the vendored source. It is
-         * required, which is what makes content ownership honest: every artifact
-         * claiming a byte comparison carries the bytes that comparison needs. Hydration
-         * leaves a guide-mirror pointer and the catalog agent as plain host artifacts,
-         * because another verb owns those bytes.
-         */
-        export declare interface HydratedArtifact extends ArtifactBase {
-            readonly origin: 'host';
-            readonly ownership: 'content';
-            readonly source?: string;
-            readonly hex: string;
-            readonly content?: never;
-        }
-
-        /**
-         * Infer how one target path compares to the artifact planned for it.
-         *
-         * @param artifact - The planned artifact.
-         * @param observed - The destination's exact bytes as hexadecimal; absent when
-         * the destination holds no file.
-         * @returns `aligned`, `stale`, or `missing`.
-         *
-         * @remarks
-         * Ownership decides the comparison and nothing else does. A `birth`-owned
-         * artifact is never compared and is always aligned, so a file the workspace has
-         * outgrown is never reported as drift. A `presence`-owned artifact compares
-         * existence only. A `content`-owned artifact compares bytes, and it always
-         * carries the bytes to compare, so the comparison can always be made.
-         *
-         * `foreign` is not answerable here: it describes a path the plan does not own,
-         * so no artifact exists to pass in.
-         *
-         * @example
-         * ```ts
-         * import type { Artifact } from '@orkestrel/scaffold'
-         * import { inferDrift } from '@orkestrel/scaffold'
-         *
-         * const artifact: Artifact = {
-         * 	path: 'README.md',
-         * 	group: 'docs',
-         * 	ownership: 'content',
-         * 	origin: 'computed',
-         * 	content: 'hi\n',
-         * }
-         *
-         * inferDrift(artifact, '68690a') // 'aligned'
-         * inferDrift(artifact, '6279650a') // 'stale'
-         * inferDrift(artifact) // 'missing'
-         * ```
-         */
-        export declare function inferDrift(artifact: Artifact, observed?: string): Exclude<Drift, 'foreign'>;
+       /** The guide-parity proof whose presence selects the planned `guides` project. */
+       export declare const GUIDES_TEST_PATH = "tests/guides.test.ts";
 
-        /**
-         * Infer the {@link Group} a path belongs to.
-         *
-         * @param path - The target-relative path to classify.
-         * @returns The group that owns the path.
-         *
-         * @remarks
-         * A path is grouped by what it governs rather than by where it sits. The two
-         * manifest files are named exactly; anything
-         * {@link matchesOrchestrationPath} accepts is orchestration; `src` and `app`
-         * are source; `tests`, `guides`, and `docs` carry their own names; the licence
-         * and a root Markdown document are docs; and everything else is configuration.
-         * A vendored path and a foreign path found in a target are classified here
-         * alike, so the plan and the audit never disagree about what a path is.
-         *
-         * @example
-         * ```ts
-         * import { inferGroup } from '@orkestrel/scaffold'
-         *
-         * inferGroup('src/core/index.ts') // 'source'
-         * inferGroup('AGENTS.md') // 'docs'
-         * inferGroup('.editorconfig') // 'configs'
-         * ```
-         */
-        export declare function inferGroup(path: string): Group;
+       /** Exact lowercase hexadecimal bytes: two digits per byte, and empty content is valid. */
+       export declare const HEX_PATTERN: RegExp;
 
-        /** The cross-environment composition proof whose presence makes a workspace `integration`. */
-        export declare const INTEGRATION_TEST_PATH = "tests/integration.test.ts";
+       /**
+        * The paths byte-copied from the vendored data root, frozen.
+        *
+        * @remarks
+        * These are the files the fleet shares verbatim: the root instruction
+        * documents, the licence, the canonical orchestration contract every harness
+        * bridge points at, the harness directories, the session hook scripts,
+        * the shared policy register, the byte-identical root dotfiles, and the
+        * guide mirrors a generated workspace starts from. A directory entry vendors
+        * everything beneath it.
+        *
+        * A plan carries the subset its target selects, which is why the list is a
+        * candidate set rather than a plan: a workspace never mirrors its own guide.
+        */
+       export declare const HOST_PATHS: readonly string[];
 
-        /** Visible characters a target-relative path and a Markdown path cell both forbid. */
-        export declare const INVALID_PATH_CHARACTER_PATTERN: RegExp;
+       /**
+        * A file byte-copied from the vendored data root, planned before its bytes are read.
+        *
+        * @remarks
+        * `source` falls back to `path` when absent. The pure core face cannot read the
+        * vendored root, so a plan it compiles alone claims only that these files
+        * exist. That is why the ownership here is narrowed away from `content`: a
+        * claim over bytes nobody has read is a claim that cannot be checked. Reading
+        * the vendored root turns the ones scaffold owns the bytes of into
+        * {@link HydratedArtifact}. Workspace-owned paths and paths whose bytes belong
+        * to another verb stay plain host artifacts, because this writer claims only
+        * their presence.
+        */
+       export declare interface HostArtifact extends ArtifactBase {
+           readonly origin: 'host';
+           readonly ownership: 'presence' | 'birth';
+           readonly source?: string;
+           readonly hex?: never;
+           readonly content?: never;
+       }
 
-        /**
-         * Narrow a value to an {@link Artifact}.
-         *
-         * @remarks
-         * One branch per way content is produced, discriminated by `origin` and
-         * narrowed by `ownership`. Each branch declares only the keys its branch has,
-         * so a host artifact carrying `content`, a hydrated artifact carrying anything
-         * but `content` ownership, and a template artifact carrying `hex` are all
-         * refused rather than admitted to the wrong branch.
-         *
-         * @example
-         * ```ts
-         * import { isArtifact } from '@orkestrel/scaffold'
-         *
-         * isArtifact({ path: 'AGENTS.md', group: 'docs', ownership: 'presence', origin: 'host' }) // true
-         * ```
-         */
-        export declare const isArtifact: Guard<Artifact>;
+       /**
+        * A vendored file whose exact bytes have been read, so its content can be compared.
+        *
+        * @remarks
+        * `hex` is the canonical lowercase byte pairs of the vendored source. It is
+        * required, which is what makes content ownership honest: every artifact
+        * claiming a byte comparison carries the bytes that comparison needs. Hydration
+        * leaves a guide-mirror pointer and the catalog agent as plain host artifacts,
+        * because another verb owns those bytes.
+        */
+       export declare interface HydratedArtifact extends ArtifactBase {
+           readonly origin: 'host';
+           readonly ownership: 'content';
+           readonly source?: string;
+           readonly hex: string;
+           readonly content?: never;
+       }
 
-        /**
-         * Narrow a value to an {@link Audit}.
-         *
-         * @remarks
-         * An audit reaches the writer and the destructive verb, so it is guarded as
-         * strictly as the plan beside it. Findings use the sum of the two producer
-         * bounds: one per planned artifact, then one per unplanned snapshot path.
-         */
-        export declare const isAudit: Guard<Audit>;
+       /**
+        * Infer how one target path compares to the artifact planned for it.
+        *
+        * @param artifact - The planned artifact.
+        * @param observed - The destination's exact bytes as hexadecimal; absent when
+        * the destination holds no file.
+        * @returns `aligned`, `stale`, or `missing`.
+        *
+        * @remarks
+        * Ownership decides the comparison and nothing else does. A `birth`-owned
+        * artifact is never compared and is always aligned, so a file the workspace has
+        * outgrown is never reported as drift. A `presence`-owned artifact compares
+        * existence only. A `content`-owned artifact compares bytes, and it always
+        * carries the bytes to compare, so the comparison can always be made.
+        *
+        * `foreign` is not answerable here: it describes a path the plan does not own,
+        * so no artifact exists to pass in.
+        *
+        * @example
+        * ```ts
+        * import type { Artifact } from '@orkestrel/scaffold'
+        * import { inferDrift } from '@orkestrel/scaffold'
+        *
+        * const artifact: Artifact = {
+        * 	path: 'README.md',
+        * 	group: 'docs',
+        * 	ownership: 'content',
+        * 	origin: 'computed',
+        * 	content: 'hi\n',
+        * }
+        *
+        * inferDrift(artifact, '68690a') // 'aligned'
+        * inferDrift(artifact, '6279650a') // 'stale'
+        * inferDrift(artifact) // 'missing'
+        * ```
+        */
+       export declare function inferDrift(artifact: Artifact, observed?: string): Exclude<Drift, 'foreign'>;
 
-        /**
-         * Narrow a value to a {@link Blueprint}.
-         *
-         * @remarks
-         * The whole closed record, its literal axes, and the count and length bounds
-         * this package admits. The syntactic laws over a name, a version, a range, and
-         * an engines floor stay with the gate, which reports each one as a
-         * {@link Question} instead of refusing the value outright.
-         *
-         * @example
-         * ```ts
-         * import { isBlueprint } from '@orkestrel/scaffold'
-         *
-         * isBlueprint({ name: 'router', src: ['core'] }) // false — not the whole record
-         * ```
-         */
-        export declare const isBlueprint: Guard<Blueprint>;
+       /**
+        * Infer the {@link Group} a path belongs to.
+        *
+        * @param path - The target-relative path to classify.
+        * @returns The group that owns the path.
+        *
+        * @remarks
+        * A path is grouped by what it governs rather than by where it sits. The
+        * manifest files are named exactly; anything
+        * {@link matchesOrchestrationPath} accepts is orchestration; `src` and `app`
+        * are source; `tests`, `guides`, and `docs` carry their own names; the licence
+        * and a root Markdown document are docs; and everything else is configuration.
+        * A vendored path and a foreign path found in a target are classified here
+        * alike, so the plan and the audit never disagree about what a path is.
+        *
+        * @example
+        * ```ts
+        * import { inferGroup } from '@orkestrel/scaffold'
+        *
+        * inferGroup('src/core/index.ts') // 'source'
+        * inferGroup('AGENTS.md') // 'docs'
+        * inferGroup('.editorconfig') // 'configs'
+        * ```
+        */
+       export declare function inferGroup(path: string): Group;
 
-        /**
-         * Narrow a value to a {@link CatalogEntry}.
-         *
-         * @remarks
-         * A row that found no version carries the cause instead, and neither branch may
-         * carry the other's field.
-         */
-        export declare const isCatalogEntry: Guard<CatalogEntry>;
+       /** The cross-environment composition proof whose presence makes a workspace `integration`. */
+       export declare const INTEGRATION_TEST_PATH = "tests/integration.test.ts";
 
-        /**
-         * Narrow a value to an array within the limit one public collection accepts.
-         *
-         * @param value - The candidate collection.
-         * @returns `true` for an array of no more than `MAX_COLLECTION_ITEMS` items.
-         *
-         * @remarks
-         * Compose this ahead of an element guard so the item count is settled before
-         * anything walks the items. A hostile `length` accessor answers `false` here
-         * rather than escaping as a thrown error.
-         *
-         * @example
-         * ```ts
-         * import { isCollection } from '@orkestrel/scaffold'
-         *
-         * isCollection(['manifest']) // true
-         * isCollection('manifest') // false
-         * ```
-         */
-        export declare function isCollection(value: unknown): value is readonly unknown[];
+       /** Visible characters a target-relative path and a Markdown path cell both forbid. */
+       export declare const INVALID_PATH_CHARACTER_PATTERN: RegExp;
 
-        /**
-         * Narrow a value to the compiler's initial listener record.
-         *
-         * @remarks
-         * Every event is optional and every declared value is a function. A key outside
-         * the compiler's event map is refused, so a listener wired to a misspelled
-         * event fails at construction instead of never firing.
-         */
-        export declare const isCompilerHooks: Guard<EmitterHooks<CompilerEventMap>>;
+       /**
+        * Narrow a value to an {@link Artifact}.
+        *
+        * @remarks
+        * One branch per way content is produced, discriminated by `origin` and
+        * narrowed by `ownership`. Each branch declares only the keys its branch has,
+        * so a host artifact carrying `content`, a hydrated artifact carrying anything
+        * but `content` ownership, and a template artifact carrying `hex` are all
+        * refused rather than admitted to the wrong branch.
+        *
+        * @example
+        * ```ts
+        * import { isArtifact } from '@orkestrel/scaffold'
+        *
+        * isArtifact({ path: 'AGENTS.md', group: 'docs', ownership: 'presence', origin: 'host' }) // true
+        * ```
+        */
+       export declare const isArtifact: Guard<Artifact>;
 
-        /**
-         * Narrow a value to {@link CompilerOptions}.
-         *
-         * @example
-         * ```ts
-         * import { isCompilerOptions } from '@orkestrel/scaffold'
-         *
-         * isCompilerOptions({}) // true
-         * isCompilerOptions({ retries: 2 }) // false
-         * ```
-         */
-        export declare const isCompilerOptions: Guard<CompilerOptions>;
+       /**
+        * Narrow a value to an {@link Audit}.
+        *
+        * @remarks
+        * An audit reaches the writer and the destructive verb, so it is guarded as
+        * strictly as the plan beside it. Findings use the sum of the producer
+        * bounds: one per planned artifact, then one per unplanned snapshot path.
+        */
+       export declare const isAudit: Guard<Audit>;
 
-        /**
-         * Narrow a value to text this package will accept as one artifact's content.
-         *
-         * @remarks
-         * The bound is a code-unit ceiling rather than a byte count, because a string
-         * of more code units than {@link MAX_ARTIFACT_BYTES} cannot encode within that
-         * budget under any encoding this package writes. The exact UTF-8 measurement
-         * belongs to the compiler and the writer, which are the two places the bytes
-         * are actually produced.
-         */
-        export declare const isContent: Guard<string>;
+       /**
+        * Narrow a value to a {@link Blueprint}.
+        *
+        * @remarks
+        * The whole closed record, its literal axes, and the count and length bounds
+        * this package admits. The syntactic laws over a name, a version, a range, and
+        * an engines floor stay with the gate, which reports each one as a
+        * {@link Question} instead of refusing the value outright.
+        *
+        * @example
+        * ```ts
+        * import { isBlueprint } from '@orkestrel/scaffold'
+        *
+        * isBlueprint({ name: 'router', src: ['core'] }) // false — not the whole record
+        * ```
+        */
+       export declare const isBlueprint: Guard<Blueprint>;
 
-        /**
-         * Narrow a value to a {@link Dependency}.
-         *
-         * @remarks
-         * Structural and bounded: which names and ranges a blueprint may declare is a
-         * gate law, reported as a {@link Question} carrying its accepted candidates, so
-         * refusing it here would replace an answerable question with a bare `false`.
-         *
-         * @example
-         * ```ts
-         * import { isDependency } from '@orkestrel/scaffold'
-         *
-         * isDependency({ name: '@orkestrel/emitter', range: '^0.0.5' }) // true
-         * isDependency({ name: '@orkestrel/emitter' }) // false
-         * ```
-         */
-        export declare const isDependency: Guard<Dependency>;
+       /**
+        * Narrow a value to a {@link CatalogEntry}.
+        *
+        * @remarks
+        * A row that found no version carries the cause instead, and neither branch may
+        * carry the other's field.
+        */
+       export declare const isCatalogEntry: Guard<CatalogEntry>;
 
-        /**
-         * Narrow a value to the scoped package name a runtime dependency carries.
-         *
-         * @remarks
-         * A dependency name reaches a path, because a workspace's guide mirror is
-         * derived from it. Fixing the scope and admitting nothing but a bare name after
-         * it is what keeps that derivation inside the directory the mirror belongs in.
-         * A blueprint's development extras are deliberately wider and are measured by
-         * the gate instead, which is why {@link isDependency} does not apply this.
-         *
-         * @example
-         * ```ts
-         * import { isDependencyName } from '@orkestrel/scaffold'
-         *
-         * isDependencyName('@orkestrel/router') // true
-         * isDependencyName('@orkestrel/../etc') // false
-         * ```
-         */
-        export declare const isDependencyName: Guard<string>;
+       /**
+        * Narrow a value to an array within the limit one public collection accepts.
+        *
+        * @param value - The candidate collection.
+        * @returns `true` for an array of no more than `MAX_COLLECTION_ITEMS` items.
+        *
+        * @remarks
+        * Compose this ahead of an element guard so the item count is settled before
+        * anything walks the items. A hostile `length` accessor answers `false` here
+        * rather than escaping as a thrown error.
+        *
+        * @example
+        * ```ts
+        * import { isCollection } from '@orkestrel/scaffold'
+        *
+        * isCollection(['manifest']) // true
+        * isCollection('manifest') // false
+        * ```
+        */
+       export declare function isCollection(value: unknown): value is readonly unknown[];
 
-        /**
-         * Narrow a value to one {@link Environment} a workspace may select.
-         *
-         * @example
-         * ```ts
-         * import { isEnvironment } from '@orkestrel/scaffold'
-         *
-         * isEnvironment('browser') // true
-         * isEnvironment('worker') // false
-         * ```
-         */
-        export declare const isEnvironment: Guard<Environment>;
+       /**
+        * Narrow a value to the compiler's initial listener record.
+        *
+        * @remarks
+        * Every event is optional and every declared value is a function. A key outside
+        * the compiler's event map is refused, so a listener wired to a misspelled
+        * event fails at construction instead of never firing.
+        */
+       export declare const isCompilerHooks: Guard<EmitterHooks<CompilerEventMap>>;
 
-        /**
-         * Narrow a value to a {@link Finding}.
-         *
-         * @remarks
-         * `observed` is required exactly where the mutation it precedes is held to it,
-         * absent where the destination had no bytes to record, and optional where the
-         * comparison may not have been made. Planned findings require `ownership`;
-         * foreign findings forbid it because no artifact was planned for their path.
-         *
-         * That is the whole claim. This guard proves the shape a reader may destructure
-         * and nothing about whether the verdict is one an audit could have reached: the
-         * correlation between `ownership`, `drift`, and `observed` belongs to
-         * {@link inferDrift}, and it is re-derived at the verb that acts on the finding.
-         */
-        export declare const isFinding: Guard<Finding>;
+       /**
+        * Narrow a value to {@link CompilerOptions}.
+        *
+        * @example
+        * ```ts
+        * import { isCompilerOptions } from '@orkestrel/scaffold'
+        *
+        * isCompilerOptions({}) // true
+        * isCompilerOptions({ retries: 2 }) // false
+        * ```
+        */
+       export declare const isCompilerOptions: Guard<CompilerOptions>;
 
-        /**
-         * Narrow a value to one {@link Group} a plan selects over.
-         *
-         * @example
-         * ```ts
-         * import { isGroup } from '@orkestrel/scaffold'
-         *
-         * isGroup('manifest') // true
-         * isGroup('readme') // false
-         * ```
-         */
-        export declare const isGroup: Guard<Group>;
+       /**
+        * Narrow a value to text this package will accept as one artifact's content.
+        *
+        * @remarks
+        * The bound is a code-unit ceiling rather than a byte count, because a string
+        * of more code units than {@link MAX_ARTIFACT_BYTES} cannot encode within that
+        * budget under any encoding this package writes. The exact UTF-8 measurement
+        * belongs to the compiler and the writer, which are the places the bytes
+        * are actually produced.
+        */
+       export declare const isContent: Guard<string>;
 
-        /** Narrow a value to a bounded group selection. */
-        export declare const isGroups: Guard<readonly Group[]>;
+       /**
+        * Narrow a value to a {@link Dependency}.
+        *
+        * @remarks
+        * Structural and bounded: which names and ranges a blueprint may declare is a
+        * gate law, reported as a {@link Question} carrying its accepted candidates, so
+        * refusing it here would replace an answerable question with a bare `false`.
+        *
+        * @example
+        * ```ts
+        * import { isDependency } from '@orkestrel/scaffold'
+        *
+        * isDependency({ name: '@orkestrel/emitter', range: '^0.0.5' }) // true
+        * isDependency({ name: '@orkestrel/emitter' }) // false
+        * ```
+        */
+       export declare const isDependency: Guard<Dependency>;
 
-        /**
-         * Narrow a value to exact lowercase hexadecimal bytes within one artifact's limit.
-         *
-         * @remarks
-         * Two digits per byte, so an odd length is refused and empty content is valid.
-         * The bound is exact rather than approximate: the encoding is ASCII, so the
-         * string's length is twice the byte count it stands for.
-         *
-         * @example
-         * ```ts
-         * import { isHex } from '@orkestrel/scaffold'
-         *
-         * isHex('68690a') // true
-         * isHex('68690A') // false
-         * ```
-         */
-        export declare const isHex: Guard<string>;
+       /**
+        * Narrow a value to the scoped package name a runtime dependency carries.
+        *
+        * @remarks
+        * A dependency name reaches a path, because a workspace's guide mirror is
+        * derived from it. Fixing the scope and admitting nothing but a bare name after
+        * it is what keeps that derivation inside the directory the mirror belongs in.
+        * A blueprint's development extras are deliberately wider and are measured by
+        * the gate instead, which is why {@link isDependency} does not apply this.
+        *
+        * @example
+        * ```ts
+        * import { isDependencyName } from '@orkestrel/scaffold'
+        *
+        * isDependencyName('@orkestrel/router') // true
+        * isDependencyName('@orkestrel/../etc') // false
+        * ```
+        */
+       export declare const isDependencyName: Guard<string>;
 
-        /**
-         * Narrow a value to a {@link Mirror}.
-         *
-         * @remarks
-         * `content` is the fetched guide text and `observed` is the local mirror's
-         * exact bytes, so the two carry different laws: one is content this package
-         * writes, the other is the precondition that write is held to.
-         */
-        export declare const isMirror: Guard<Mirror>;
+       /**
+        * Narrow a value to one {@link Environment} a workspace may select.
+        *
+        * @example
+        * ```ts
+        * import { isEnvironment } from '@orkestrel/scaffold'
+        *
+        * isEnvironment('browser') // true
+        * isEnvironment('worker') // false
+        * ```
+        */
+       export declare const isEnvironment: Guard<Environment>;
 
-        /**
-         * Narrow a value to an {@link Override}.
-         *
-         * @remarks
-         * Whether the path names a planned artifact is a gate law; whether it names a
-         * destination at all is this guard's.
-         *
-         * @example
-         * ```ts
-         * import { isOverride } from '@orkestrel/scaffold'
-         *
-         * isOverride({ path: 'README.md', content: '# Title\n' }) // true
-         * ```
-         */
-        export declare const isOverride: Guard<Override>;
+       /**
+        * Narrow a value to a {@link Finding}.
+        *
+        * @remarks
+        * `observed` is required exactly where the mutation it precedes is held to it,
+        * absent where the destination had no bytes to record, and optional where the
+        * comparison may not have been made. Planned findings require `ownership`;
+        * foreign findings forbid it because no artifact was planned for their path.
+        *
+        * That is the whole claim. This guard proves the shape a reader may destructure
+        * and nothing about whether the verdict is one an audit could have reached: the
+        * correlation between `ownership`, `drift`, and `observed` belongs to
+        * {@link inferDrift}, and it is re-derived at the verb that acts on the finding.
+        */
+       export declare const isFinding: Guard<Finding>;
 
-        /**
-         * Narrow a value to a logical target-relative path.
-         *
-         * @param value - The candidate path.
-         * @returns `true` for a bounded relative path with no traversal, empty segment,
-         * control character, or reserved syntax character.
-         *
-         * @remarks
-         * Every path this package reads or writes passes here, so one law covers a
-         * planned artifact, an override target, an audit finding, a guide mirror, and a
-         * snapshot key. Rejecting `..`, a leading `/`, and a backslash at the guard is
-         * what stops a caller-supplied path from naming a destination outside the
-         * target. Host-location validation is a separate server boundary: this guard
-         * does not reject a device spelling, a trailing dot or space, or a segment that
-         * exceeds a host filesystem's byte ceiling.
-         *
-         * @example
-         * ```ts
-         * import { isPath } from '@orkestrel/scaffold'
-         *
-         * isPath('configs/src/tsconfig.core.json') // true
-         * isPath('../secrets') // false
-         * ```
-         */
-        export declare function isPath(value: unknown): value is string;
+       /**
+        * Narrow a value to one {@link Group} a plan selects over.
+        *
+        * @example
+        * ```ts
+        * import { isGroup } from '@orkestrel/scaffold'
+        *
+        * isGroup('manifest') // true
+        * isGroup('readme') // false
+        * ```
+        */
+       export declare const isGroup: Guard<Group>;
 
-        /**
-         * Narrow a value to a {@link Plan}.
-         *
-         * @remarks
-         * A plan reaches the writer, and the writer has no question channel, so this
-         * carries the whole law of the value: every artifact path, every claimed byte,
-         * and the blueprint it was compiled from.
-         */
-        export declare const isPlan: Guard<Plan>;
+       /** Narrow a value to a bounded group selection. */
+       export declare const isGroups: Guard<readonly Group[]>;
 
-        /**
-         * Narrow a value to a {@link Question}.
-         *
-         * @example
-         * ```ts
-         * import { isQuestion } from '@orkestrel/scaffold'
-         *
-         * isQuestion({ field: 'src', message: 'Unknown environment', blocking: true }) // true
-         * ```
-         */
-        export declare const isQuestion: Guard<Question>;
+       /**
+        * Narrow a value to exact lowercase hexadecimal bytes within one artifact's limit.
+        *
+        * @remarks
+        * Two digits per byte, so an odd length is refused and empty content is valid.
+        * The bound is exact rather than approximate: the encoding is ASCII, so the
+        * string's length is twice the byte count it stands for.
+        *
+        * @example
+        * ```ts
+        * import { isHex } from '@orkestrel/scaffold'
+        *
+        * isHex('68690a') // true
+        * isHex('68690A') // false
+        * ```
+        */
+       export declare const isHex: Guard<string>;
 
-        /**
-         * Narrow a caught value to a {@link ScaffoldError}.
-         *
-         * @param value - The caught value to narrow.
-         * @returns `true` when `value` is a {@link ScaffoldError}.
-         *
-         * @example
-         * ```ts
-         * import { isScaffoldError } from '@orkestrel/scaffold'
-         *
-         * isScaffoldError(new Error('plain')) // false
-         * isScaffoldError(undefined) // false
-         * ```
-         */
-        export declare function isScaffoldError(value: unknown): value is ScaffoldError;
+       /**
+        * Narrow a value to a {@link Mirror}.
+        *
+        * @remarks
+        * `content` is the fetched guide text and `observed` is the local mirror's
+        * exact bytes, so they carry different laws: one is content this package
+        * writes, the other is the precondition that write is held to.
+        */
+       export declare const isMirror: Guard<Mirror>;
 
-        /**
-         * Narrow a value to a {@link Snapshot}.
-         *
-         * @param value - The candidate target snapshot.
-         * @returns `true` for a bounded plain record whose every key is a path and
-         * whose every value is exact lowercase hexadecimal bytes.
-         *
-         * @remarks
-         * Read through the shared total key lens, so a hostile `ownKeys` trap and a
-         * throwing accessor both answer `false` rather than escaping. There is no
-         * dictionary combinator upstream to compose this from: the key law and the
-         * value law are both this package's own.
-         *
-         * @example
-         * ```ts
-         * import { isSnapshot } from '@orkestrel/scaffold'
-         *
-         * isSnapshot({ 'AGENTS.md': '68690a' }) // true
-         * isSnapshot({ 'AGENTS.md': 'hi' }) // false
-         * ```
-         */
-        export declare function isSnapshot(value: unknown): value is Snapshot;
+       /**
+        * Narrow a value to an {@link Override}.
+        *
+        * @remarks
+        * Whether the path names a planned artifact is a gate law; whether it names a
+        * destination at all is this guard's.
+        *
+        * @example
+        * ```ts
+        * import { isOverride } from '@orkestrel/scaffold'
+        *
+        * isOverride({ path: 'README.md', content: '# Title\n' }) // true
+        * ```
+        */
+       export declare const isOverride: Guard<Override>;
 
-        /**
-         * Whether an upstream lookup produced an answer.
-         *
-         * @remarks
-         * `found` carries the answer. `missing` is an upstream `404`, which is a
-         * definite answer that the package is not published there. `failed` is a
-         * transport fault, which is no answer at all and may succeed on a later run.
-         * Holding these apart from how a local copy compares is what lets a verdict
-         * omit the value it never received instead of inventing an empty one.
-         */
-        export declare type Lookup = 'found' | 'missing' | 'failed';
+       /**
+        * Narrow a value to a logical target-relative path.
+        *
+        * @param value - The candidate path.
+        * @returns `true` for a bounded relative path with no traversal, empty segment,
+        * control character, or reserved syntax character.
+        *
+        * @remarks
+        * Every path this package reads or writes passes here, so one law covers a
+        * planned artifact, an override target, an audit finding, a guide mirror, and a
+        * snapshot key. Rejecting `..`, a leading `/`, and a backslash at the guard is
+        * what stops a caller-supplied path from naming a destination outside the
+        * target. Host-location validation is a separate server boundary: this guard
+        * does not reject a device spelling, a trailing dot or space, or a segment that
+        * exceeds a host filesystem's byte ceiling.
+        *
+        * @example
+        * ```ts
+        * import { isPath } from '@orkestrel/scaffold'
+        *
+        * isPath('configs/src/tsconfig.core.json') // true
+        * isPath('../secrets') // false
+        * ```
+        */
+       export declare function isPath(value: unknown): value is string;
 
-        /**
-         * Project a package manifest's text to the `@orkestrel/*` packages it declares.
-         *
-         * @param manifest - The `package.json` text.
-         * @returns One dependency per declared `@orkestrel` package, in section order,
-         * with the first declaration of a repeated name winning.
-         *
-         * @remarks
-         * Runtime, development, and peer sections are read in that order, because a
-         * package the fleet publishes is upstream of this workspace wherever it is
-         * declared. Every other name is skipped rather than refused: a workspace's
-         * unrelated dependencies are not this package's to report on.
-         *
-         * Never throws, and every row it returns satisfies `isDependency` while the
-         * list satisfies `isCollection`, so the result crosses the compiler's own
-         * boundary without a second cleaning.
-         *
-         * @example
-         * ```ts
-         * import { manifestToDependencies } from '@orkestrel/scaffold'
-         *
-         * manifestToDependencies('{"dependencies":{"@orkestrel/emitter":"^0.0.5","vite":"~8.2.0"}}')
-         * // [{ name: '@orkestrel/emitter', range: '^0.0.5' }]
-         * ```
-         */
-        export declare function manifestToDependencies(manifest: string): readonly Dependency[];
+       /**
+        * Narrow a value to a {@link Plan}.
+        *
+        * @remarks
+        * A plan reaches the writer, and the writer has no question channel, so this
+        * carries the whole law of the value: every artifact path, every claimed byte,
+        * and the blueprint it was compiled from.
+        */
+       export declare const isPlan: Guard<Plan>;
 
-        /**
-         * Project a package manifest's text to its own name.
-         *
-         * @param manifest - The `package.json` text.
-         * @returns The declared name, or `undefined` when the text is oversized,
-         * malformed, not an object, or carries no bounded string name.
-         *
-         * @remarks
-         * Never throws: a manifest is a file a target owns, so unreadable is an answer
-         * rather than a fault. The name is bounded by the registry's own package-name
-         * ceiling, because it reaches a path through {@link nameToGuide}.
-         *
-         * @example
-         * ```ts
-         * import { manifestToName } from '@orkestrel/scaffold'
-         *
-         * manifestToName('{"name":"@orkestrel/router"}') // '@orkestrel/router'
-         * manifestToName('{') // undefined
-         * ```
-         */
-        export declare function manifestToName(manifest: string): string | undefined;
+       /**
+        * Narrow a value to a {@link Question}.
+        *
+        * @example
+        * ```ts
+        * import { isQuestion } from '@orkestrel/scaffold'
+        *
+        * isQuestion({ field: 'src', message: 'Unknown environment', blocking: true }) // true
+        * ```
+        */
+       export declare const isQuestion: Guard<Question>;
 
-        /**
-         * Test whether {@link inferDrift} could have produced a finding for an ownership.
-         *
-         * @param ownership - What scaffold claims at the planned path.
-         * @param finding - The audit verdict to test.
-         * @returns Whether the ownership and verdict are reachable through {@link inferDrift}.
-         *
-         * @remarks
-         * This predicate keeps the comparison law beside the reachability law it
-         * restates. A mutation uses it so a refusal can distinguish an impossible
-         * verdict from a target that genuinely moved after its audit.
-         */
-        export declare function matchesDriftReachability(ownership: Ownership, finding: Finding): boolean;
+       /**
+        * Narrow a caught value to a {@link ScaffoldError}.
+        *
+        * @param value - The caught value to narrow.
+        * @returns `true` when `value` is a {@link ScaffoldError}.
+        *
+        * @example
+        * ```ts
+        * import { isScaffoldError } from '@orkestrel/scaffold'
+        *
+        * isScaffoldError(new Error('plain')) // false
+        * isScaffoldError(undefined) // false
+        * ```
+        */
+       export declare function isScaffoldError(value: unknown): value is ScaffoldError;
 
-        /**
-         * Test whether a declared engines floor is at or above the supported minimum.
-         *
-         * @param engines - The declared `engines.node` range.
-         * @returns `true` when the range is the accepted syntax and its floor is at or
-         * above `MINIMUM_NODE_VERSION`.
-         *
-         * @remarks
-         * The declaration states a floor, so the comparison is against the oldest Node
-         * the generated toolchain supports rather than against a published version. The
-         * `>=` prefix is read here, so no caller repeats the offset.
-         *
-         * @example
-         * ```ts
-         * import { matchesEngines } from '@orkestrel/scaffold'
-         *
-         * matchesEngines('>=22.12.0') // true
-         * matchesEngines('>=20.0.0') // false
-         * matchesEngines('22.12.0') // false
-         * ```
-         */
-        export declare function matchesEngines(engines: string): boolean;
+       /**
+        * Narrow a value to a {@link Snapshot}.
+        *
+        * @param value - The candidate target snapshot.
+        * @returns `true` for a bounded plain record whose every key is a path and
+        * whose every value is exact lowercase hexadecimal bytes.
+        *
+        * @remarks
+        * Read through the shared total key lens, so a hostile `ownKeys` trap and a
+        * throwing accessor both answer `false` rather than escaping. There is no
+        * dictionary combinator upstream to compose this from: the key law and the
+        * value law are both this package's own.
+        *
+        * @example
+        * ```ts
+        * import { isSnapshot } from '@orkestrel/scaffold'
+        *
+        * isSnapshot({ 'AGENTS.md': '68690a' }) // true
+        * isSnapshot({ 'AGENTS.md': 'hi' }) // false
+        * ```
+        */
+       export declare function isSnapshot(value: unknown): value is Snapshot;
 
-        /**
-         * Test whether a path instructs or wires an agent rather than the toolchain.
-         *
-         * @param path - The target-relative path to test.
-         * @returns `true` when the path is beneath a harness directory or is one of the
-         * exact root filenames that wires an agent bench.
-         *
-         * @remarks
-         * The one home of the orchestration membership rule. A vendored path and a
-         * foreign path found in a target are both classified through here, so a new
-         * harness directory is admitted once in `ORCHESTRATION_PATH_PREFIXES` and every
-         * caller follows.
-         *
-         * @example
-         * ```ts
-         * import { matchesOrchestrationPath } from '@orkestrel/scaffold'
-         *
-         * matchesOrchestrationPath('.claude/rules/names.md') // true
-         * matchesOrchestrationPath('.mcp.json') // true
-         * matchesOrchestrationPath('.oxlintrc.json') // false
-         * ```
-         */
-        export declare function matchesOrchestrationPath(path: string): boolean;
+       /**
+        * Whether an upstream lookup produced an answer.
+        *
+        * @remarks
+        * `found` carries the answer. `missing` is an upstream `404`, which is a
+        * definite answer that the package is not published there. `failed` is a
+        * transport fault, which is no answer at all and may succeed on a later run.
+        * Holding these apart from how a local copy compares is what lets a verdict
+        * omit the value it never received instead of inventing an empty one.
+        */
+       export declare type Lookup = 'found' | 'missing' | 'failed';
 
-        /**
-         * Test whether one emitted line fits the vendored formatter width.
-         *
-         * @param line - One emitted line, leading tabs included.
-         * @returns `true` when the expanded line fits.
-         *
-         * @remarks
-         * A generator writes source the formatter then reads back, so a line packed
-         * past the vendored width is rewrapped on the next `format` run and the emitted
-         * bytes stop matching the plan the audit compares against. The generator
-         * therefore measures a candidate line and chooses the shape the formatter would
-         * have chosen. Tabs are expanded first because the formatter counts them as
-         * `TAB_WIDTH` columns rather than as one character.
-         *
-         * @example
-         * ```ts
-         * import { matchesPrintWidth } from '@orkestrel/scaffold'
-         *
-         * matchesPrintWidth('\t\tprojects: [core],') // true
-         * ```
-         */
-        export declare function matchesPrintWidth(line: string): boolean;
+       /**
+        * Project a package manifest's text to the `@orkestrel/*` packages it declares.
+        *
+        * @param manifest - The `package.json` text.
+        * @returns One dependency per declared `@orkestrel` package, in section order,
+        * with the first declaration of a repeated name winning.
+        *
+        * @remarks
+        * Runtime, development, and peer sections are read in that order, because a
+        * package the fleet publishes is upstream of this workspace wherever it is
+        * declared. Every other name is skipped rather than refused: a workspace's
+        * unrelated dependencies are not this package's to report on.
+        *
+        * Never throws, and every row it returns satisfies `isDependency` while the
+        * list satisfies `isCollection`, so the result crosses the compiler's own
+        * boundary without a second cleaning.
+        *
+        * @example
+        * ```ts
+        * import { manifestToDependencies } from '@orkestrel/scaffold'
+        *
+        * manifestToDependencies('{"dependencies":{"@orkestrel/emitter":"^0.0.5","vite":"~8.2.0"}}')
+        * // [{ name: '@orkestrel/emitter', range: '^0.0.5' }]
+        * ```
+        */
+       export declare function manifestToDependencies(manifest: string): readonly Dependency[];
 
-        /**
-         * Test whether a declared range already admits a published version.
-         *
-         * @param range - The declared dependency range.
-         * @param latest - The version the registry reported as latest.
-         * @returns `true` when the range admits that version.
-         *
-         * @remarks
-         * The one place this comparison is made. A `Release` records the declared range
-         * and the reported version and stores no verdict beside them, because a stored
-         * verdict could only disagree with the two fields it sits next to.
-         *
-         * Readability is decided first, and it is `EXTRA_RANGE_PATTERN`: an optional
-         * caret or tilde over three numeric components and an optional prerelease
-         * suffix. That pattern already covers every `ORKESTREL_RANGE_PATTERN` range and
-         * every `VERSION_PATTERN` version, so the subset is stated once rather than
-         * assembled here. Text outside it is never admitted, including text handed in on
-         * both sides, so an unreadable declaration surfaces as work instead of matching
-         * itself.
-         *
-         * The accepted subset is the one that pattern admits: an exact pin, a tilde
-         * range, and a caret range. An exact pin is satisfied by that version alone. A
-         * tilde range holds the minor and admits a later patch. A caret range holds the
-         * leading nonzero component, which is why `^0.0.5` is an exact pin and `^0.5.3`
-         * admits `0.5.4` but not `0.6.0`.
-         *
-         * Identity is the door a prerelease passes through, and the only one: this
-         * package does not order prerelease precedence, so `1.2.3-beta.1` is satisfied
-         * by that exact string and by nothing else. The version side needs no separate
-         * readability test, because identity already proves it equals a readable
-         * declaration and every other branch reads it through {@link extractVersion}.
-         *
-         * @example
-         * ```ts
-         * import { matchesRange } from '@orkestrel/scaffold'
-         *
-         * matchesRange('^0.0.5', '0.0.5') // true
-         * matchesRange('^0.0.5', '0.0.7') // false
-         * matchesRange('~8.2.0', '8.2.4') // true
-         * matchesRange('^7.58.12', '7.60.0') // true
-         * matchesRange('not-a-range', 'not-a-range') // false
-         * ```
-         */
-        export declare function matchesRange(range: string, latest: string): boolean;
+       /**
+        * Project a package manifest's text to its own name.
+        *
+        * @param manifest - The `package.json` text.
+        * @returns The declared name, or `undefined` when the text is oversized,
+        * malformed, not an object, or carries no bounded string name.
+        *
+        * @remarks
+        * Never throws: a manifest is a file a target owns, so unreadable is an answer
+        * rather than a fault. The name is bounded by the registry's own package-name
+        * ceiling, because it reaches a path through {@link nameToGuide}.
+        *
+        * @example
+        * ```ts
+        * import { manifestToName } from '@orkestrel/scaffold'
+        *
+        * manifestToName('{"name":"@orkestrel/router"}') // '@orkestrel/router'
+        * manifestToName('{') // undefined
+        * ```
+        */
+       export declare function manifestToName(manifest: string): string | undefined;
 
-        /** Maximum bytes accepted for one artifact. */
-        export declare const MAX_ARTIFACT_BYTES = 5242880;
+       /**
+        * Test whether {@link inferDrift} could have produced a finding for an ownership.
+        *
+        * @param ownership - What scaffold claims at the planned path.
+        * @param finding - The audit verdict to test.
+        * @returns Whether the ownership and verdict are reachable through {@link inferDrift}.
+        *
+        * @remarks
+        * This predicate keeps the comparison law beside the reachability law it
+        * restates. A mutation uses it so a refusal can distinguish an impossible
+        * verdict from a target that genuinely moved after its audit.
+        */
+       export declare function matchesDriftReachability(ownership: Ownership, finding: Finding): boolean;
 
-        /** Maximum length of the hexadecimal string carrying one artifact's bytes. */
-        export declare const MAX_ARTIFACT_HEX_LENGTH: number;
+       /**
+        * Test whether a declared engines floor is at or above the supported minimum.
+        *
+        * @param engines - The declared `engines.node` range.
+        * @returns `true` when the range is the accepted syntax and its floor is at or
+        * above `MINIMUM_NODE_VERSION`.
+        *
+        * @remarks
+        * The declaration states a floor, so the comparison is against the oldest Node
+        * the generated toolchain supports rather than against a published version. The
+        * `>=` prefix is read here, so no caller repeats the offset.
+        *
+        * @example
+        * ```ts
+        * import { matchesEngines } from '@orkestrel/scaffold'
+        *
+        * matchesEngines('>=22.12.0') // true
+        * matchesEngines('>=20.0.0') // false
+        * matchesEngines('22.12.0') // false
+        * ```
+        */
+       export declare function matchesEngines(engines: string): boolean;
 
-        /** Maximum findings one audit can produce from a bounded plan and snapshot. */
-        export declare const MAX_AUDIT_FINDINGS: number;
+       /**
+        * Test whether a path instructs or wires an agent rather than the toolchain.
+        *
+        * @param path - The target-relative path to test.
+        * @returns `true` when the path is beneath a harness directory or is one of the
+        * exact root filenames that wires an agent bench.
+        *
+        * @remarks
+        * The one home of the orchestration membership rule. A vendored path and a
+        * foreign path found in a target are both classified through here, so a new
+        * harness directory is admitted once in `ORCHESTRATION_PATH_PREFIXES` and every
+        * caller follows.
+        *
+        * @example
+        * ```ts
+        * import { matchesOrchestrationPath } from '@orkestrel/scaffold'
+        *
+        * matchesOrchestrationPath('.claude/rules/names.md') // true
+        * matchesOrchestrationPath('.mcp.json') // true
+        * matchesOrchestrationPath('.oxlintrc.json') // false
+        * ```
+        */
+       export declare function matchesOrchestrationPath(path: string): boolean;
 
-        /** Maximum items accepted in one public collection. */
-        export declare const MAX_COLLECTION_ITEMS = 1000;
+       /**
+        * Test whether one emitted line fits the vendored formatter width.
+        *
+        * @param line - One emitted line, leading tabs included.
+        * @returns `true` when the expanded line fits.
+        *
+        * @remarks
+        * A generator writes source the formatter then reads back, so a line packed
+        * past the vendored width is rewrapped on the next `format` run and the emitted
+        * bytes stop matching the plan the audit compares against. The generator
+        * therefore measures a candidate line and chooses the shape the formatter would
+        * have chosen. Tabs are expanded first because the formatter counts them as
+        * `TAB_WIDTH` columns rather than as one character.
+        *
+        * @example
+        * ```ts
+        * import { matchesPrintWidth } from '@orkestrel/scaffold'
+        *
+        * matchesPrintWidth('\t\tprojects: [core],') // true
+        * ```
+        */
+       export declare function matchesPrintWidth(line: string): boolean;
 
-        /** Maximum dependency package name length, scope included, as the registry caps it. */
-        export declare const MAX_DEPENDENCY_NAME_LENGTH = 214;
+       /**
+        * Test whether a declared range already admits a published version.
+        *
+        * @param range - The declared dependency range.
+        * @param latest - The version the registry reported as latest.
+        * @returns `true` when the range admits that version.
+        *
+        * @remarks
+        * The one place this comparison is made. A `Release` records the declared range
+        * and the reported version and stores no verdict beside them, because a stored
+        * verdict could only disagree with the fields it sits next to.
+        *
+        * Readability is decided first, and it is `EXTRA_RANGE_PATTERN`: an optional
+        * caret or tilde over `major.minor.patch` and an optional prerelease
+        * suffix. That pattern already covers every `ORKESTREL_RANGE_PATTERN` range and
+        * every `VERSION_PATTERN` version, so the subset is stated once rather than
+        * assembled here. Text outside it is never admitted, including text handed in on
+        * both sides, so an unreadable declaration surfaces as work instead of matching
+        * itself.
+        *
+        * The accepted subset is the one that pattern admits: an exact pin, a tilde
+        * range, and a caret range. An exact pin is satisfied by that version alone. A
+        * tilde range holds the minor and admits a later patch. A caret range holds the
+        * leading nonzero component, which is why `^0.0.5` is an exact pin and `^0.5.3`
+        * admits `0.5.4` but not `0.6.0`.
+        *
+        * Identity is the door a prerelease passes through, and the only one: this
+        * package does not order prerelease precedence, so `1.2.3-beta.1` is satisfied
+        * by that exact string and by nothing else. The version side needs no separate
+        * readability test, because identity already proves it equals a readable
+        * declaration and every other branch reads it through {@link extractVersion}.
+        *
+        * @example
+        * ```ts
+        * import { matchesRange } from '@orkestrel/scaffold'
+        *
+        * matchesRange('^0.0.5', '0.0.5') // true
+        * matchesRange('^0.0.5', '0.0.7') // false
+        * matchesRange('~8.2.0', '8.2.4') // true
+        * matchesRange('^7.58.12', '7.60.0') // true
+        * matchesRange('not-a-range', 'not-a-range') // false
+        * ```
+        */
+       export declare function matchesRange(range: string, latest: string): boolean;
 
-        /** Maximum bytes accepted for one package or vendored-host manifest. */
-        export declare const MAX_MANIFEST_BYTES = 1048576;
+       /** Maximum bytes accepted for one artifact. */
+       export declare const MAX_ARTIFACT_BYTES = 5242880;
 
-        /**
-         * Maximum bare workspace name length.
-         *
-         * @remarks
-         * The registry caps a whole package name at 214 characters and the generated
-         * scope `@orkestrel/` spends 11 of them.
-         */
-        export declare const MAX_NAME_LENGTH = 203;
+       /** Maximum length of the hexadecimal string carrying one artifact's bytes. */
+       export declare const MAX_ARTIFACT_HEX_LENGTH: number;
 
-        /** Maximum length of one path, matching the longest a supported filesystem accepts. */
-        export declare const MAX_PATH_LENGTH = 32767;
+       /** Maximum findings one audit can produce from a bounded plan and snapshot. */
+       export declare const MAX_AUDIT_FINDINGS: number;
 
-        /** Maximum length of one declared package range. */
-        export declare const MAX_RANGE_LENGTH = 2048;
+       /** Maximum items accepted in one public collection. */
+       export declare const MAX_COLLECTION_ITEMS = 1000;
 
-        /** Maximum bytes retained across one whole plan or audit. */
-        export declare const MAX_TOTAL_ARTIFACT_BYTES = 104857600;
+       /** Maximum dependency package name length, scope included, as the registry caps it. */
+       export declare const MAX_DEPENDENCY_NAME_LENGTH = 214;
 
-        /** The oldest Node version the generated toolchain supports. */
-        export declare const MINIMUM_NODE_VERSION = "22.12.0";
+       /** Maximum bytes accepted for one package or vendored-host manifest. */
+       export declare const MAX_MANIFEST_BYTES = 1048576;
 
-        /**
-         * One dependency guide fetched from upstream, beside the local mirror it answers for.
-         *
-         * @remarks
-         * A found lookup carries the fetched bytes; one that produced no answer carries
-         * the cause and no bytes. Either way `observed` is the local mirror's exact
-         * bytes as they stood when the fetch was made, and is absent when the mirror
-         * was not there; it is the precondition the write is held to, exactly as
-         * {@link Finding.observed} is. Whether the mirror is behind is not recorded,
-         * because it is `content` against `observed` and a stored answer could only
-         * disagree with them. These bytes belong to the catalog verb, which is why a
-         * guide mirror is presence-owned: repair restores one that is absent and never
-         * replaces one that is present.
-         */
-        export declare type Mirror = {
-            readonly name: string;
-            readonly path: string;
-            readonly lookup: 'found';
-            readonly content: string;
-            readonly observed?: string;
-            readonly note?: never;
-        } | {
-            readonly name: string;
-            readonly path: string;
-            readonly lookup: 'missing' | 'failed';
-            readonly note: string;
-            readonly observed?: string;
-            readonly content?: never;
-        };
-
-        /** The bare workspace name syntax: lowercase alphanumeric with hyphens, letter first. */
-        export declare const NAME_PATTERN: RegExp;
-
-        /**
-         * Derive the guide mirror path a package name answers for.
-         *
-         * @param name - A bare or `@orkestrel`-scoped package name.
-         * @returns The mirror path, `guides/<bare name>.md`.
-         *
-         * @remarks
-         * The single shape of a mirror path, read by the fetch that fills one and by
-         * the plan that leaves the target's own guide out of its host set. Only the
-         * segment after the final `/` is used, so the scope never reaches the path.
-         * Whether the derived path is safe to write is `isPath`'s answer and the gate's,
-         * which is why `DEPENDENCY_NAME_PATTERN` closes the name to a bare scoped one
-         * before it ever arrives here.
-         *
-         * @example
-         * ```ts
-         * import { nameToGuide } from '@orkestrel/scaffold'
-         *
-         * nameToGuide('@orkestrel/router') // 'guides/router.md'
-         * nameToGuide('scaffold') // 'guides/scaffold.md'
-         * ```
-         */
-        export declare function nameToGuide(name: string): string;
+       /**
+        * Maximum bare workspace name length.
+        *
+        * @remarks
+        * The registry caps a whole package name at 214 characters and the generated
+        * scope `@orkestrel/` spends 11 of them.
+        */
+       export declare const MAX_NAME_LENGTH = 203;
 
-        /**
-         * Compile the vendored host artifacts a named workspace plans.
-         *
-         * @param name - The target workspace's own bare package name.
-         * @returns One artifact per vendored path, in `HOST_PATHS` order.
-         *
-         * @remarks
-         * Every artifact is claimed by presence, which is the strongest claim a pure
-         * compile can make: core cannot read the vendored data root, so it cannot carry
-         * the bytes a content claim would have to be checked against. Reading that root
-         * is what promotes the ones scaffold owns the bytes of.
-         *
-         * `source` is left absent because it falls back to `path`, and every vendored
-         * path is stored under the name it is written to. The group comes from
-         * {@link inferGroup}, so a vendored path and a foreign path found in a target
-         * are classified by one rule and a plan never disagrees with the audit beside
-         * it.
-         *
-         * @example
-         * ```ts
-         * import { nameToHostArtifacts } from '@orkestrel/scaffold'
-         *
-         * nameToHostArtifacts('router').some((artifact) => artifact.path === 'AGENTS.md') // true
-         * nameToHostArtifacts('router').some((artifact) => artifact.path === 'guides/router.md') // false
-         * ```
-         */
-        export declare function nameToHostArtifacts(name: string): readonly Artifact[];
+       /** Maximum length of one path, matching the longest a supported filesystem accepts. */
+       export declare const MAX_PATH_LENGTH = 32767;
 
-        /**
-         * Derive the declaration rewrite a published face's `beforeWriteFile` applies.
-         *
-         * @param name - The workspace's own bare package name.
-         * @returns The ternary consequent an emitted `vite.{browser,server}.config.ts`
-         * fills its `{{replacement}}` span with, indented for that span.
-         *
-         * @remarks
-         * `vite-plugin-dts` rolls a face into one declaration and keeps each source
-         * module's own relative depth, so a nested module emits a path that escapes
-         * `dist/src` and a flat one resolves only by luck. Both faces rewrite the same
-         * relative core path to the package's published root export, so the branch is
-         * derived once here. The extension alternation is what the two permitted import
-         * spellings produce: an `@src/core` alias resolves to the core source module and
-         * prints `.ts`, while a relative import prints the `.js` specifier it was
-         * written with. The formatter keeps the call on one line only while the line it
-         * prints measures inside the vendored width, and the workspace name is what
-         * varies, so the shape is chosen by measuring the candidate: a tab prints as the
-         * vendored two columns, and the gate admits a name long enough to push the
-         * joined call past 100.
-         *
-         * @example
-         * ```ts
-         * import { nameToRewrite } from '@orkestrel/scaffold'
-         *
-         * nameToRewrite('router').includes("'@orkestrel/router'") // true
-         * ```
-         */
-        export declare function nameToRewrite(name: string): string;
+       /** Maximum length of one declared package range. */
+       export declare const MAX_RANGE_LENGTH = 2048;
 
-        /**
-         * The exact root filenames that wire an agent bench rather than the toolchain, frozen.
-         *
-         * @remarks
-         * `.mcp.json` registers MCP servers for the harness. It sits among the root
-         * dotfiles but governs agents, so it groups with the harness bridges.
-         */
-        export declare const ORCHESTRATION_PATH_NAMES: readonly string[];
+       /** Maximum bytes retained across one whole plan or audit. */
+       export declare const MAX_TOTAL_ARTIFACT_BYTES = 104857600;
 
-        /**
-         * The path prefixes whose contents instruct or wire an agent, frozen.
-         *
-         * @remarks
-         * A path is grouped by what it governs rather than by where it sits: anything
-         * beneath one of these prefixes is `orchestration`, and everything else that is
-         * not source, tests, guides, docs, or a manifest is `configs`. A vendored path
-         * and a foreign path found in a target are classified against the same list, so
-         * a new harness directory is admitted once.
-         */
-        export declare const ORCHESTRATION_PATH_PREFIXES: readonly string[];
+       /** The oldest Node version the generated toolchain supports. */
+       export declare const MINIMUM_NODE_VERSION = "22.12.0";
 
-        /**
-         * How an artifact's content is produced.
-         *
-         * @remarks
-         * `host` is byte-copied from this package's vendored data root. `template` is
-         * filled from a frozen template definition. `computed` is derived by this
-         * package's own combination logic. Origin says nothing about what scaffold
-         * claims at the path; {@link Ownership} says that.
-         */
-        export declare type Origin = 'host' | 'template' | 'computed';
+       /**
+        * One dependency guide fetched from upstream, beside the local mirror it answers for.
+        *
+        * @remarks
+        * A found lookup carries the fetched bytes; one that produced no answer carries
+        * the cause and no bytes. Either way `observed` is the local mirror's exact
+        * bytes as they stood when the fetch was made, and is absent when the mirror
+        * was not there; it is the precondition the write is held to, exactly as
+        * {@link Finding.observed} is. Whether the mirror is behind is not recorded,
+        * because it is `content` against `observed` and a stored answer could only
+        * disagree with them. These bytes belong to the catalog verb, which is why a
+        * guide mirror is presence-owned: repair restores one that is absent and never
+        * replaces one that is present.
+        */
+       export declare type Mirror = {
+           readonly name: string;
+           readonly path: string;
+           readonly lookup: 'found';
+           readonly content: string;
+           readonly observed?: string;
+           readonly note?: never;
+       } | {
+           readonly name: string;
+           readonly path: string;
+           readonly lookup: 'missing' | 'failed';
+           readonly note: string;
+           readonly observed?: string;
+           readonly content?: never;
+       };
+
+       /** The bare workspace name syntax: lowercase alphanumeric with hyphens, letter first. */
+       export declare const NAME_PATTERN: RegExp;
 
-        /**
-         * The exact caret-pinned pre-1.0 range accepted for an `@orkestrel/*` runtime dependency.
-         *
-         * @remarks
-         * Pre-1.0 means any `0.x`, not `0.0.x`. The narrower form would refuse the first
-         * fleet package to reach `0.1.0`, and `catalog` pins to whatever the registry
-         * publishes, so a single minor release would block every later run against a
-         * workspace that had already been pinned to it.
-         */
-        export declare const ORKESTREL_RANGE_PATTERN: RegExp;
+       /**
+        * Derive the guide mirror path a package name answers for.
+        *
+        * @param name - A bare or `@orkestrel`-scoped package name.
+        * @returns The mirror path, `guides/<bare name>.md`.
+        *
+        * @remarks
+        * The single shape of a mirror path, read by the fetch that fills one and by
+        * the plan that leaves the target's own guide out of its host set. Only the
+        * segment after the final `/` is used, so the scope never reaches the path.
+        * Whether the derived path is safe to write is `isPath`'s answer and the gate's,
+        * which is why `DEPENDENCY_NAME_PATTERN` closes the name to a bare scoped one
+        * before it ever arrives here.
+        *
+        * @example
+        * ```ts
+        * import { nameToGuide } from '@orkestrel/scaffold'
+        *
+        * nameToGuide('@orkestrel/router') // 'guides/router.md'
+        * nameToGuide('scaffold') // 'guides/scaffold.md'
+        * ```
+        */
+       export declare function nameToGuide(name: string): string;
 
-        /**
-         * One artifact override.
-         *
-         * @remarks
-         * `content` replaces the rendered artifact at `path` and never partially
-         * merges it. Legality is measured against every artifact the blueprint drafts,
-         * before a compile narrows the returned groups. An override that matches none
-         * of those artifacts, that targets a host-origin artifact, or that targets the
-         * manifest is a blocking question rather than a silent no-op.
-         */
-        export declare interface Override {
-            readonly path: string;
-            readonly content: string;
-        }
+       /**
+        * Compile the vendored host artifacts a named workspace plans.
+        *
+        * @param name - The target workspace's own bare package name.
+        * @returns One artifact per vendored path, in `HOST_PATHS` order.
+        *
+        * @remarks
+        * Every artifact is claimed by presence, which is the strongest claim a pure
+        * compile can make: core cannot read the vendored data root, so it cannot carry
+        * the bytes a content claim would have to be checked against. Reading that root
+        * is what promotes the ones scaffold owns the bytes of.
+        *
+        * `source` is left absent because it falls back to `path`, and every vendored
+        * path is stored under the name it is written to. The group comes from
+        * {@link inferGroup}, so a vendored path and a foreign path found in a target
+        * are classified by one rule and a plan never disagrees with the audit beside
+        * it.
+        *
+        * @example
+        * ```ts
+        * import { nameToHostArtifacts } from '@orkestrel/scaffold'
+        *
+        * nameToHostArtifacts('router').some((artifact) => artifact.path === 'AGENTS.md') // true
+        * nameToHostArtifacts('router').some((artifact) => artifact.path === 'guides/router.md') // false
+        * ```
+        */
+       export declare function nameToHostArtifacts(name: string): readonly Artifact[];
 
-        /**
-         * Measure a blueprint's overrides against the artifacts drafted for it.
-         *
-         * @param overrides - The blueprint's overrides.
-         * @param artifacts - The drafted artifacts, before overrides are applied.
-         * @returns One blocking question per override the draft cannot accept.
-         *
-         * @remarks
-         * An override that matches no planned artifact is a caller expecting a file that
-         * does not exist, and applying nothing would leave that expectation
-         * unanswered. An override on a host-origin artifact asks this package to
-         * rewrite a file it byte-copies from the vendored data root, which it never
-         * does. An override on the manifest asks it to rewrite the one artifact the
-         * blueprint's own fields decide, so the fields would no longer describe the
-         * workspace they generated. Each is refused rather than dropped.
-         *
-         * @example
-         * ```ts
-         * import { blueprintToConfigArtifacts, createBlueprint, overridesToQuestions } from '@orkestrel/scaffold'
-         *
-         * const artifacts = blueprintToConfigArtifacts(createBlueprint('router', { src: ['core'] }))
-         *
-         * overridesToQuestions([{ path: 'package.json', content: '{}\n' }], artifacts).length // 1
-         * ```
-         */
-        export declare function overridesToQuestions(overrides: readonly Override[], artifacts: readonly Artifact[]): readonly Question[];
+       /**
+        * Derive the declaration rewrite a published face's `beforeWriteFile` applies.
+        *
+        * @param name - The workspace's own bare package name.
+        * @returns The ternary consequent an emitted `vite.{browser,server}.config.ts`
+        * fills its `{{replacement}}` span with, indented for that span.
+        *
+        * @remarks
+        * `vite-plugin-dts` rolls a face into one declaration and keeps each source
+        * module's own relative depth, so a nested module emits a path that escapes
+        * `dist/src` and a flat one resolves only by luck. Both faces rewrite the same
+        * relative core path to the package's published root export, so the branch is
+        * derived once here. The extension alternation is what the permitted import
+        * spellings produce: an `@src/core` alias resolves to the core source module and
+        * prints `.ts`, while a relative import prints the `.js` specifier it was
+        * written with. The formatter keeps the call on one line only while the line it
+        * prints measures inside the vendored width, and the workspace name is what
+        * varies, so the shape is chosen by measuring the candidate: a tab prints as the
+        * vendored two columns, and the gate admits a name long enough to push the
+        * joined call past 100.
+        *
+        * @example
+        * ```ts
+        * import { nameToRewrite } from '@orkestrel/scaffold'
+        *
+        * nameToRewrite('router').includes("'@orkestrel/router'") // true
+        * ```
+        */
+       export declare function nameToRewrite(name: string): string;
 
-        /**
-         * What scaffold claims at an artifact's path.
-         *
-         * @remarks
-         * `content` claims the bytes: audit compares them, and a write restores a
-         * missing file and replaces a stale one. `presence` claims only that the file
-         * exists: audit compares existence, and a write restores an absent file and
-         * never touches present bytes. `birth` claims only the file's creation: audit
-         * never compares it and always reports it aligned, and a write creates it only
-         * while it is absent.
-         */
-        export declare type Ownership = 'content' | 'presence' | 'birth';
+       /**
+        * The exact root filenames that wire an agent bench rather than the toolchain, frozen.
+        *
+        * @remarks
+        * `.mcp.json` registers MCP servers for the harness. It sits among the root
+        * dotfiles but governs agents, so it groups with the harness bridges.
+        */
+       export declare const ORCHESTRATION_PATH_NAMES: readonly string[];
 
-        /**
-         * Coerce an untrusted value to a {@link Blueprint}.
-         *
-         * @param value - The value to parse.
-         * @returns The blueprint, or `undefined` when the value is not one.
-         *
-         * @remarks
-         * Derived from {@link isBlueprint}, which is what makes the pair sound in both
-         * directions: a guard-valid value is returned unchanged, and every value this
-         * returns satisfies that guard. The reference is returned rather than copied,
-         * so a caller that means to own the value clones it.
-         *
-         * @example
-         * ```ts
-         * import { parseBlueprint } from '@orkestrel/scaffold'
-         *
-         * parseBlueprint({ name: 'router' }) // undefined
-         * ```
-         */
-        export declare function parseBlueprint(value: unknown): Blueprint | undefined;
+       /**
+        * The path prefixes whose contents instruct or wire an agent, frozen.
+        *
+        * @remarks
+        * A path is grouped by what it governs rather than by where it sits: anything
+        * beneath one of these prefixes is `orchestration`, and everything else that is
+        * not source, tests, guides, docs, or a manifest is `configs`. A vendored path
+        * and a foreign path found in a target are classified against the same list, so
+        * a new harness directory is admitted once.
+        */
+       export declare const ORCHESTRATION_PATH_PREFIXES: readonly string[];
 
-        /**
-         * Coerce an untrusted value to {@link CompilerOptions}.
-         *
-         * @param value - The value to parse.
-         * @returns The options, or `undefined` when the value is not an option bag.
-         *
-         * @remarks
-         * Derived from {@link isCompilerOptions}. Absence is not an option bag, so
-         * `undefined` in returns `undefined` out and a constructor reads that as the
-         * defaults rather than as a refusal.
-         *
-         * @example
-         * ```ts
-         * import { parseCompilerOptions } from '@orkestrel/scaffold'
-         *
-         * parseCompilerOptions({ on: { compile: () => {} } }) // the same record
-         * parseCompilerOptions({ on: { compiled: () => {} } }) // undefined
-         * ```
-         */
-        export declare function parseCompilerOptions(value: unknown): CompilerOptions | undefined;
+       /**
+        * How an artifact's content is produced.
+        *
+        * @remarks
+        * `host` is byte-copied from this package's vendored data root. `template` is
+        * filled from a frozen template definition. `computed` is derived by this
+        * package's own combination logic. Origin says nothing about what scaffold
+        * claims at the path; {@link Ownership} says that.
+        */
+       export declare type Origin = 'host' | 'template' | 'computed';
 
-        /**
-         * Coerce an untrusted value to a group selection.
-         *
-         * @param value - The value to parse.
-         * @returns The selection, or `undefined` when the value is not one.
-         *
-         * @remarks
-         * Derived from {@link isGroups}. Order and repetition are preserved: which
-         * groups a plan finally covers, and in which order, is the compiler's to decide
-         * from `GROUPS`, not this boundary's.
-         *
-         * @example
-         * ```ts
-         * import { parseGroups } from '@orkestrel/scaffold'
-         *
-         * parseGroups(['manifest', 'configs']) // ['manifest', 'configs']
-         * parseGroups(['readme']) // undefined
-         * ```
-         */
-        export declare function parseGroups(value: unknown): readonly Group[] | undefined;
+       /**
+        * The exact caret-pinned pre-1.0 range accepted for an `@orkestrel/*` runtime dependency.
+        *
+        * @remarks
+        * Pre-1.0 means any `0.x`, not `0.0.x`. The narrower form would refuse the first
+        * fleet package to reach `0.1.0`, and `catalog` pins to whatever the registry
+        * publishes, so a single minor release would block every later run against a
+        * workspace that had already been pinned to it.
+        */
+       export declare const ORKESTREL_RANGE_PATTERN: RegExp;
 
-        /**
-         * Coerce an untrusted value to a {@link Snapshot}.
-         *
-         * @param value - The value to parse.
-         * @returns The snapshot, or `undefined` when the value is not one.
-         *
-         * @remarks
-         * Derived from {@link isSnapshot}.
-         *
-         * @example
-         * ```ts
-         * import { parseSnapshot } from '@orkestrel/scaffold'
-         *
-         * parseSnapshot({ 'AGENTS.md': '68690a' }) // { 'AGENTS.md': '68690a' }
-         * parseSnapshot({ 'AGENTS.md': null }) // undefined
-         * ```
-         */
-        export declare function parseSnapshot(value: unknown): Snapshot | undefined;
+       /**
+        * One artifact override.
+        *
+        * @remarks
+        * `content` replaces the rendered artifact at `path` and never partially
+        * merges it. Legality is measured against every artifact the blueprint drafts,
+        * before a compile narrows the returned groups. An override that matches none
+        * of those artifacts, that targets a host-origin artifact, or that targets the
+        * manifest is a blocking question rather than a silent no-op.
+        */
+       export declare interface Override {
+           readonly path: string;
+           readonly content: string;
+       }
 
-        /**
-         * Build one `exports` condition block for a built environment.
-         *
-         * @param path - The extensionless `dist` path both conditions point at.
-         * @param formats - The module formats that environment builds.
-         * @returns The condition block: an `import` condition always, and a `require`
-         * condition only where a CommonJS build exists.
-         *
-         * @remarks
-         * The formats decide the shape, so no caller repeats the rule. An environment
-         * that builds ES only publishes an `import` condition alone rather than a
-         * `default` one, because a `default` condition answers `require` too and would
-         * hand a CommonJS consumer a module its loader cannot read.
-         *
-         * @example
-         * ```ts
-         * import { pathToCondition } from '@orkestrel/scaffold'
-         *
-         * pathToCondition('./dist/src/browser/index', ['es'])
-         * // { import: { types: './dist/src/browser/index.d.ts', default: './dist/src/browser/index.js' } }
-         * ```
-         */
-        export declare function pathToCondition(path: string, formats: readonly BuildFormat[]): Readonly<Record<string, unknown>>;
+       /**
+        * Measure a blueprint's overrides against the artifacts drafted for it.
+        *
+        * @param overrides - The blueprint's overrides.
+        * @param artifacts - The drafted artifacts, before overrides are applied.
+        * @returns One blocking question per override the draft cannot accept.
+        *
+        * @remarks
+        * An override that matches no planned artifact is a caller expecting a file that
+        * does not exist, and applying nothing would leave that expectation
+        * unanswered. An override on a host-origin artifact asks this package to
+        * rewrite a file it byte-copies from the vendored data root, which it never
+        * does. An override on the manifest asks it to rewrite the one artifact the
+        * blueprint's own fields decide, so the fields would no longer describe the
+        * workspace they generated. Each is refused rather than dropped.
+        *
+        * @example
+        * ```ts
+        * import { blueprintToConfigArtifacts, createBlueprint, overridesToQuestions } from '@orkestrel/scaffold'
+        *
+        * const artifacts = blueprintToConfigArtifacts(createBlueprint('router', { src: ['core'] }))
+        *
+        * overridesToQuestions([{ path: 'package.json', content: '{}\n' }], artifacts).length // 1
+        * ```
+        */
+       export declare function overridesToQuestions(overrides: readonly Override[], artifacts: readonly Artifact[]): readonly Question[];
 
-        /**
-         * The compiled, ordered artifact list and the selection it covers.
-         *
-         * @remarks
-         * `hash` is the plan's content identity and is absent until the pin stage
-         * fills it.
-         */
-        export declare interface Plan {
-            readonly blueprint: Blueprint;
-            readonly groups: readonly Group[];
-            readonly artifacts: readonly Artifact[];
-            readonly hash?: string;
-        }
-
-        /** The tally of one plan by artifact origin. */
-        export declare interface PlanSummary {
-            readonly name: string;
-            readonly src: readonly Environment[];
-            readonly app: readonly Environment[];
-            readonly groups: readonly Group[];
-            readonly host: number;
-            readonly template: number;
-            readonly computed: number;
-        }
-
-        /**
-         * Compare a plan against a target's current content.
-         *
-         * @param plan - The compiled plan.
-         * @param current - The target's exact bytes, keyed by artifact-relative path.
-         * @returns One finding per planned artifact in plan order, then one `foreign`
-         * finding per unplanned path in snapshot order.
-         *
-         * @remarks
-         * The sweep is bounded by the plan's own selection: a path the plan does not own
-         * is reported as foreign only when its group is one the plan covers, so a
-         * compile narrowed to a few groups never reports the rest of the workspace as
-         * unowned. Within a covered group the report is deliberately wide, because
-         * `foreign` is the set the destructive verb draws from and the narrowing that
-         * set needs — the paths no verb may remove, and what git tracks — belongs to
-         * that verb rather than to the comparison.
-         *
-         * @example
-         * ```ts
-         * import { createBlueprint, createCompiler, planToFindings } from '@orkestrel/scaffold'
-         *
-         * const { plan } = createCompiler().compile(createBlueprint('router', { src: ['core'] }))
-         *
-         * plan === undefined ? [] : planToFindings(plan, { 'AGENTS.md': '68690a' })
-         * ```
-         */
-        export declare function planToFindings(plan: Plan, current: Snapshot): readonly Finding[];
+       /**
+        * What scaffold claims at an artifact's path.
+        *
+        * @remarks
+        * `content` claims the bytes: audit compares them, and a write restores a
+        * missing file and replaces a stale one. `presence` claims only that the file
+        * exists: audit compares existence, and a write restores an absent file and
+        * never touches present bytes. `birth` claims only the file's creation: audit
+        * never compares it and always reports it aligned, and a write creates it only
+        * while it is absent.
+        */
+       export declare type Ownership = 'content' | 'presence' | 'birth';
 
-        /**
-         * Compute a plan's content identity.
-         *
-         * @param plan - The plan to identify.
-         * @returns Sixteen lowercase hexadecimal digits, or `undefined` when the plan
-         * carries a value JSON cannot encode.
-         *
-         * @remarks
-         * The identity covers the blueprint the plan was compiled from, the groups it
-         * covers, and its ordered artifacts. It deliberately excludes `hash` itself,
-         * which is what lets a pinned plan be re-identified and compared without
-         * stripping a field first.
-         *
-         * The projection is canonical, so two plans that differ only in key order
-         * answer the same digits. Nothing here reads a clock or randomness, and the
-         * refusal is total: a value that cannot be read answers `undefined` rather than
-         * escaping as a thrown error, and a caller decides what an unidentifiable plan
-         * means.
-         *
-         * @example
-         * ```ts
-         * import { createBlueprint, createCompiler, planToHash } from '@orkestrel/scaffold'
-         *
-         * const { plan } = createCompiler().compile(createBlueprint('router', { src: ['core'] }))
-         *
-         * plan === undefined ? undefined : planToHash(plan)?.length // 16
-         * ```
-         */
-        export declare function planToHash(plan: Plan): string | undefined;
+       /**
+        * Coerce an untrusted value to a {@link Blueprint}.
+        *
+        * @param value - The value to parse.
+        * @returns The blueprint, or `undefined` when the value is not one.
+        *
+        * @remarks
+        * Derived from {@link isBlueprint}, which is what makes the pair sound in both
+        * directions: a guard-valid value is returned unchanged, and every value this
+        * returns satisfies that guard. The reference is returned rather than copied,
+        * so a caller that means to own the value clones it.
+        *
+        * @example
+        * ```ts
+        * import { parseBlueprint } from '@orkestrel/scaffold'
+        *
+        * parseBlueprint({ name: 'router' }) // undefined
+        * ```
+        */
+       export declare function parseBlueprint(value: unknown): Blueprint | undefined;
 
-        /**
-         * Project a plan into its tally by artifact origin.
-         *
-         * @param plan - The plan to summarize.
-         * @returns The workspace's name, both environment axes, the covered groups, and
-         * one count per origin.
-         *
-         * @remarks
-         * Lossy on purpose: the summary is what a report prints, and it holds nothing a
-         * caller could mistake for the plan itself. The counts are derived on each call
-         * rather than stored on the plan, so they cannot disagree with the artifacts
-         * beside them.
-         *
-         * @example
-         * ```ts
-         * import { planToSummary } from '@orkestrel/scaffold'
-         *
-         * planToSummary(plan).computed // the number of computed artifacts
-         * ```
-         */
-        export declare function planToSummary(plan: Plan): PlanSummary;
+       /**
+        * Coerce an untrusted value to {@link CompilerOptions}.
+        *
+        * @param value - The value to parse.
+        * @returns The options, or `undefined` when the value is not an option bag.
+        *
+        * @remarks
+        * Derived from {@link isCompilerOptions}. Absence is not an option bag, so
+        * `undefined` in returns `undefined` out and a constructor reads that as the
+        * defaults rather than as a refusal.
+        *
+        * @example
+        * ```ts
+        * import { parseCompilerOptions } from '@orkestrel/scaffold'
+        *
+        * parseCompilerOptions({ on: { compile: () => {} } }) // the same record
+        * parseCompilerOptions({ on: { compiled: () => {} } }) // undefined
+        * ```
+        */
+       export declare function parseCompilerOptions(value: unknown): CompilerOptions | undefined;
 
-        /** Columns one emitted line may occupy, matching `printWidth` in `.oxfmtrc.json`. */
-        export declare const PRINT_WIDTH = 100;
+       /**
+        * Coerce an untrusted value to a group selection.
+        *
+        * @param value - The value to parse.
+        * @returns The selection, or `undefined` when the value is not one.
+        *
+        * @remarks
+        * Derived from {@link isGroups}. Order and repetition are preserved: which
+        * groups a plan finally covers, and in which order, is the compiler's to decide
+        * from `GROUPS`, not this boundary's.
+        *
+        * @example
+        * ```ts
+        * import { parseGroups } from '@orkestrel/scaffold'
+        *
+        * parseGroups(['manifest', 'configs']) // ['manifest', 'configs']
+        * parseGroups(['readme']) // undefined
+        * ```
+        */
+       export declare function parseGroups(value: unknown): readonly Group[] | undefined;
 
-        /**
-         * One validation issue raised against a blueprint or a plan.
-         *
-         * @remarks
-         * A blocking question fails the gate closed. A non-blocking question is an
-         * advisory that rides a complete result. `candidates` names the accepted
-         * values when the issue is a rejected choice.
-         */
-        export declare interface Question {
-            readonly field: string;
-            readonly message: string;
-            readonly blocking: boolean;
-            readonly candidates?: readonly string[];
-        }
-
-        /**
-         * One declared dependency range measured against the registry's latest release.
-         *
-         * @remarks
-         * A found lookup carries the version upstream reported; one that produced no
-         * answer carries the cause and no version. Whether the declared range already
-         * admits that version is not recorded, because it is a deterministic function
-         * of `range` and `latest`: a stored answer could only disagree with the two
-         * fields beside it. One centralized helper decides it, and every caller reads
-         * the same decision.
-         */
-        export declare type Release = {
-            readonly name: string;
-            readonly range: string;
-            readonly lookup: 'found';
-            readonly latest: string;
-            readonly note?: never;
-        } | {
-            readonly name: string;
-            readonly range: string;
-            readonly lookup: 'missing' | 'failed';
-            readonly note: string;
-            readonly latest?: never;
-        };
-
-        /**
-         * The one error this package throws, carrying the coded reason it was raised.
-         *
-         * @remarks
-         * Each code names one cause: `INVALID` for off-contract input, `DESTROYED` for
-         * any call made after teardown, `TARGET` for a destination that is not what the
-         * caller's observation said it was, `WRITE` for a mutation that could not be
-         * completed, `FETCH` for an upstream read that produced no answer the caller can
-         * be given, and `BLOCKED` for a refused blueprint.
-         *
-         * `BLOCKED` covers both refusals a blueprint can meet, because they are one fact
-         * — this blueprint will not be built — and the questions say which. The compiler
-         * answers its refusal rather than throwing it: the gate fails closed, returns the
-         * questions that closed it, and records `BLOCKED` on its stage, so a caller reads
-         * that refusal from the value it asked for. A verb that creates a workspace
-         * throws it, because it chose the shape and has nothing to hand back. A blocking
-         * question closed the gate; a non-blocking one is a shape this package can
-         * describe and declines to create.
-         *
-         * `context` carries whatever the raising site can say about the failure. It is
-         * `unknown` because nothing narrows it usefully at the catch site; read it for
-         * a report, never branch on it.
-         *
-         * @example
-         * ```ts
-         * import { ScaffoldError, isScaffoldError } from '@orkestrel/scaffold'
-         *
-         * try {
-         * 	throw new ScaffoldError('INVALID', 'Blueprint is not an exact record')
-         * } catch (error) {
-         * 	if (isScaffoldError(error)) error.code // 'INVALID'
-         * }
-         * ```
-         */
-        export declare class ScaffoldError extends Error {
-            readonly code: ScaffoldErrorCode;
-            readonly context?: unknown;
-            /**
-             * Construct a coded scaffold error.
-             *
-             * @param code - The coded reason the error is raised.
-             * @param message - What went wrong, in one sentence.
-             * @param context - Whatever the raising site can say about the failure.
-             */
-            constructor(code: ScaffoldErrorCode, message: string, context?: unknown);
-        }
-
-        /** The coded reasons a scaffold error is raised. */
-        export declare type ScaffoldErrorCode = 'INVALID' | 'BLOCKED' | 'DESTROYED' | 'TARGET' | 'WRITE' | 'FETCH';
-
-        /**
-         * The replayable outcome of one compile.
-         *
-         * @remarks
-         * `plan` is present exactly when the compile completed, so it is also the
-         * completeness test, and it carries the blueprint it was compiled from. A
-         * gated compile returns the questions that closed the gate and the stage
-         * records up to it, and no plan; the caller still holds the blueprint it
-         * passed in, so repeating it here would be one fact stored twice and free to
-         * disagree with itself.
-         */
-        export declare interface Scaffolding {
-            readonly plan?: Plan;
-            readonly questions: readonly Question[];
-            readonly stages: readonly CompileRecord[];
-            readonly blueprint?: never;
-        }
-
-        /**
-         * Select the groups a compile covers, in plan order.
-         *
-         * @param groups - The requested selection; every group when absent.
-         * @returns The requested groups in `GROUPS` order, without repeats.
-         *
-         * @remarks
-         * A caller's selection is data, so it arrives in whatever order and with
-         * whatever repeats the caller wrote. Plan order is this package's, so the
-         * selection is read as membership and the order comes from `GROUPS`. An empty
-         * selection covers nothing, which is a caller asking for an empty plan rather
-         * than a caller asking for everything.
-         *
-         * @example
-         * ```ts
-         * import { selectGroups } from '@orkestrel/scaffold'
-         *
-         * selectGroups(['tests', 'manifest', 'tests']) // ['manifest', 'tests']
-         * selectGroups() // every group, in plan order
-         * ```
-         */
-        export declare function selectGroups(groups?: readonly Group[]): readonly Group[];
+       /**
+        * Coerce an untrusted value to a {@link Snapshot}.
+        *
+        * @param value - The value to parse.
+        * @returns The snapshot, or `undefined` when the value is not one.
+        *
+        * @remarks
+        * Derived from {@link isSnapshot}.
+        *
+        * @example
+        * ```ts
+        * import { parseSnapshot } from '@orkestrel/scaffold'
+        *
+        * parseSnapshot({ 'AGENTS.md': '68690a' }) // { 'AGENTS.md': '68690a' }
+        * parseSnapshot({ 'AGENTS.md': null }) // undefined
+        * ```
+        */
+       export declare function parseSnapshot(value: unknown): Snapshot | undefined;
 
-        /**
-         * Select the host paths a named workspace vendors.
-         *
-         * @param paths - The candidate host paths, in their declared order.
-         * @param name - The target workspace's own bare package name.
-         * @returns Every candidate except the workspace's own guide, in input order.
-         *
-         * @remarks
-         * `HOST_PATHS` is a candidate set rather than a plan, because a workspace never
-         * mirrors its own guide: that file is the workspace's own product, and vendoring
-         * it would have the target overwrite its guide with the copy it published.
-         *
-         * @example
-         * ```ts
-         * import { HOST_PATHS, selectHostPaths } from '@orkestrel/scaffold'
-         *
-         * selectHostPaths(HOST_PATHS, 'scaffold').includes('guides/scaffold.md') // false
-         * ```
-         */
-        export declare function selectHostPaths(paths: readonly string[], name: string): readonly string[];
+       /**
+        * Build one `exports` condition block for a built environment.
+        *
+        * @param path - The extensionless `dist` path both conditions point at.
+        * @param formats - The module formats that environment builds.
+        * @returns The condition block: an `import` condition always, and a `require`
+        * condition only where a CommonJS build exists.
+        *
+        * @remarks
+        * The formats decide the shape, so no caller repeats the rule. An environment
+        * that builds ES only publishes an `import` condition alone rather than a
+        * `default` one, because a `default` condition answers `require` too and would
+        * hand a CommonJS consumer a module its loader cannot read.
+        *
+        * @example
+        * ```ts
+        * import { pathToCondition } from '@orkestrel/scaffold'
+        *
+        * pathToCondition('./dist/src/browser/index', ['es'])
+        * // { import: { types: './dist/src/browser/index.d.ts', default: './dist/src/browser/index.js' } }
+        * ```
+        */
+       export declare function pathToCondition(path: string, formats: readonly BuildFormat[]): Readonly<Record<string, unknown>>;
 
-        /**
-         * Serialize one string as a single-quoted TypeScript literal.
-         *
-         * @param value - The string to serialize.
-         * @returns A complete single-quoted literal with line-breaking and delimiter
-         * characters escaped.
-         *
-         * @remarks
-         * Configuration templates insert blueprint-derived strings into TypeScript.
-         * Keeping this one serializer at that boundary prevents a name from becoming
-         * syntax and preserves oxfmt's configured single-quote fixed point.
-         *
-         * @example
-         * ```ts
-         * import { serializeTypeScriptString } from '@orkestrel/scaffold'
-         *
-         * serializeTypeScriptString("it's") // `'it\\'s'`
-         * ```
-         */
-        export declare function serializeTypeScriptString(value: string): string;
+       /**
+        * The compiled, ordered artifact list and the selection it covers.
+        *
+        * @remarks
+        * `hash` is the plan's content identity and is absent until the pin stage
+        * fills it.
+        */
+       export declare interface Plan {
+           readonly blueprint: Blueprint;
+           readonly groups: readonly Group[];
+           readonly artifacts: readonly Artifact[];
+           readonly hash?: string;
+       }
+
+       /** The tally of one plan by artifact origin. */
+       export declare interface PlanSummary {
+           readonly name: string;
+           readonly src: readonly Environment[];
+           readonly app: readonly Environment[];
+           readonly groups: readonly Group[];
+           readonly host: number;
+           readonly template: number;
+           readonly computed: number;
+       }
 
-        /** The provisioner skeleton a workspace with declared service vendors is given once. */
-        export declare const SERVICE_SCRIPT_PATH = "scripts/service.sh";
+       /**
+        * Compare a plan against a target's current content.
+        *
+        * @param plan - The compiled plan.
+        * @param current - The target's exact bytes, keyed by artifact-relative path.
+        * @returns One finding per planned artifact in plan order, then one `foreign`
+        * finding per unplanned path in snapshot order.
+        *
+        * @remarks
+        * The sweep is bounded by the plan's own selection: a path the plan does not own
+        * is reported as foreign only when its group is one the plan covers, so a
+        * compile narrowed to a few groups never reports the rest of the workspace as
+        * unowned. Within a covered group the report is deliberately wide, because
+        * `foreign` is the set the destructive verb draws from and the narrowing that
+        * set needs — the paths no verb may remove, and what git tracks — belongs to
+        * that verb rather than to the comparison.
+        *
+        * @example
+        * ```ts
+        * import { Compiler, createBlueprint, planToFindings } from '@orkestrel/scaffold'
+        *
+        * const { plan } = new Compiler().compile(createBlueprint('router', { src: ['core'] }))
+        *
+        * plan === undefined ? [] : planToFindings(plan, { 'AGENTS.md': '68690a' })
+        * ```
+        */
+       export declare function planToFindings(plan: Plan, current: Snapshot): readonly Finding[];
 
-        /** The live-service readiness module whose presence makes a workspace `service`. */
-        export declare const SERVICE_SETUP_PATH = "tests/setupService.ts";
+       /**
+        * Compute a plan's content identity.
+        *
+        * @param plan - The plan to identify.
+        * @returns Sixteen lowercase hexadecimal digits, or `undefined` when the plan
+        * carries a value JSON cannot encode.
+        *
+        * @remarks
+        * The identity covers the blueprint the plan was compiled from, the groups it
+        * covers, and its ordered artifacts. It deliberately excludes `hash` itself,
+        * which is what lets a pinned plan be re-identified and compared without
+        * stripping a field first.
+        *
+        * The projection is canonical, so two plans that differ only in key order
+        * answer the same digits. Nothing here reads a clock or randomness, and the
+        * refusal is total: a value that cannot be read answers `undefined` rather than
+        * escaping as a thrown error, and a caller decides what an unidentifiable plan
+        * means.
+        *
+        * @example
+        * ```ts
+        * import { Compiler, createBlueprint, planToHash } from '@orkestrel/scaffold'
+        *
+        * const { plan } = new Compiler().compile(createBlueprint('router', { src: ['core'] }))
+        *
+        * plan === undefined ? undefined : planToHash(plan)?.length // 16
+        * ```
+        */
+       export declare function planToHash(plan: Plan): string | undefined;
 
-        /** The include the live-service project covers, which is a directory rather than one proof. */
-        export declare const SERVICE_TEST_INCLUDE = "tests/service/**/*.test.ts";
+       /**
+        * Project a plan into its tally by artifact origin.
+        *
+        * @param plan - The plan to summarize.
+        * @returns The workspace's name, both environment axes, the covered groups, and
+        * one count per origin.
+        *
+        * @remarks
+        * Lossy on purpose: the summary is what a report prints, and it holds nothing a
+        * caller could mistake for the plan itself. The counts are derived on each call
+        * rather than stored on the plan, so they cannot disagree with the artifacts
+        * beside them.
+        *
+        * @example
+        * ```ts
+        * import { planToSummary } from '@orkestrel/scaffold'
+        *
+        * planToSummary(plan).computed // the number of computed artifacts
+        * ```
+        */
+       export declare function planToSummary(plan: Plan): PlanSummary;
 
-        /** The Vite wrapper whose presence makes a workspace `showcase`. */
-        export declare const SHOWCASE_CONFIG_PATH = "configs/app/vite.showcase.config.ts";
+       /** Columns one emitted line may occupy, matching `printWidth` in `.oxfmtrc.json`. */
+       export declare const PRINT_WIDTH = 100;
 
-        /**
-         * The development dependency used only by the optional single-file showcase build.
-         *
-         * @example
-         * ```ts
-         * import { SHOWCASE_DEV_DEPENDENCIES } from '@orkestrel/scaffold'
-         *
-         * SHOWCASE_DEV_DEPENDENCIES['vite-plugin-singlefile'] // '^2.3.3'
-         * ```
-         */
-        export declare const SHOWCASE_DEV_DEPENDENCIES: Readonly<Record<string, string>>;
+       /**
+        * One validation issue raised against a blueprint or a plan.
+        *
+        * @remarks
+        * A blocking question fails the gate closed. A non-blocking question is an
+        * advisory that rides a complete result. `candidates` names the accepted
+        * values when the issue is a rejected choice.
+        */
+       export declare interface Question {
+           readonly field: string;
+           readonly message: string;
+           readonly blocking: boolean;
+           readonly candidates?: readonly string[];
+       }
 
-        /** Exact lowercase hexadecimal target bytes keyed by artifact-relative path. */
-        export declare type Snapshot = Readonly<Record<string, string>>;
+       /**
+        * One declared dependency range measured against the registry's latest release.
+        *
+        * @remarks
+        * A found lookup carries the version upstream reported; one that produced no
+        * answer carries the cause and no version. Whether the declared range already
+        * admits that version is not recorded, because it is a deterministic function
+        * of `range` and `latest`: a stored answer could only disagree with the
+        * fields beside it. One centralized helper decides it, and every caller reads
+        * the same decision.
+        */
+       export declare type Release = {
+           readonly name: string;
+           readonly range: string;
+           readonly lookup: 'found';
+           readonly latest: string;
+           readonly note?: never;
+       } | {
+           readonly name: string;
+           readonly range: string;
+           readonly lookup: 'missing' | 'failed';
+           readonly note: string;
+           readonly latest?: never;
+       };
 
-        /** The development dependencies a published browser `src` environment adds. */
-        export declare const SOURCE_BROWSER_DEV_DEPENDENCIES: Readonly<Record<string, string>>;
+       /**
+        * The one error this package throws, carrying the coded reason it was raised.
+        *
+        * @remarks
+        * Each code names one cause: `INVALID` for off-contract input, `DESTROYED` for
+        * any call made after teardown, `TARGET` for a destination that is not what the
+        * caller's observation said it was, `WRITE` for a mutation that could not be
+        * completed, `FETCH` for an upstream read that produced no answer the caller can
+        * be given, and `BLOCKED` for a refused blueprint.
+        *
+        * `BLOCKED` covers both refusals a blueprint can meet, because they are one fact
+        * — this blueprint will not be built — and the questions say which. The compiler
+        * answers its refusal rather than throwing it: the gate fails closed, returns the
+        * questions that closed it, and records `BLOCKED` on its stage, so a caller reads
+        * that refusal from the value it asked for. A verb that creates a workspace
+        * throws it, because it chose the shape and has nothing to hand back. A blocking
+        * question closed the gate; a non-blocking one is a shape this package can
+        * describe and declines to create.
+        *
+        * `context` carries whatever the raising site can say about the failure. It is
+        * `unknown` because nothing narrows it usefully at the catch site; read it for
+        * a report, never branch on it.
+        *
+        * @example
+        * ```ts
+        * import { ScaffoldError, isScaffoldError } from '@orkestrel/scaffold'
+        *
+        * try {
+        * 	throw new ScaffoldError('INVALID', 'Blueprint is not an exact record')
+        * } catch (error) {
+        * 	if (isScaffoldError(error)) error.code // 'INVALID'
+        * }
+        * ```
+        */
+       export declare class ScaffoldError extends Error {
+           readonly code: ScaffoldErrorCode;
+           readonly context?: unknown;
+           /**
+            * Construct a coded scaffold error.
+            *
+            * @param code - The coded reason the error is raised.
+            * @param message - What went wrong, in one sentence.
+            * @param context - Whatever the raising site can say about the failure.
+            */
+           constructor(code: ScaffoldErrorCode, message: string, context?: unknown);
+       }
 
-        /**
-         * The build and export settings each published `src` environment contributes, frozen.
-         *
-         * @remarks
-         * Per environment: the thin configuration files it adds under `configs/src`,
-         * its Vitest project label, its `exports` subpath, and the module formats it
-         * builds. Core alone occupies the package root, so it is the only environment
-         * whose subpath is `.`; browser ships ES only because no CommonJS consumer
-         * reaches it.
-         */
-        export declare const SRC_MATRIX: Readonly<Record<Environment, SrcDefinition>>;
-
-        /** The build and export settings one published `src` environment contributes. */
-        export declare interface SrcDefinition {
-            readonly configs: readonly string[];
-            readonly project: string;
-            readonly path: string;
-            readonly formats: readonly BuildFormat[];
-        }
-
-        /**
-         * Project a published selection into the manifest's entry fields.
-         *
-         * @param src - The declared published environments.
-         * @returns The `main` and `module` fields, plus `types` when one environment
-         * owns the package root.
-         *
-         * @remarks
-         * `main` follows the root environment's own formats, so an environment that
-         * builds ES only points both fields at the same file rather than promising a
-         * CommonJS build that never runs. A selection with several environments carries
-         * no top-level `types`, because each environment declares its own under its
-         * subpath and a single top-level field could only name one of them.
-         *
-         * @example
-         * ```ts
-         * import { srcToEntry } from '@orkestrel/scaffold'
-         *
-         * srcToEntry(['core']).main // './dist/src/core/index.cjs'
-         * srcToEntry(['browser']).main // './dist/src/browser/index.js'
-         * ```
-         */
-        export declare function srcToEntry(src: readonly Environment[]): {
-            readonly main: string;
-            readonly module: string;
-            readonly types?: string;
-        };
-
-        /**
-         * Project a published selection into the manifest's `exports` map.
-         *
-         * @param src - The declared published environments.
-         * @returns The map, keyed by subpath in `ENVIRONMENTS` order.
-         *
-         * @remarks
-         * One environment owns the package root and every other declared environment
-         * takes the subpath its `SRC_MATRIX` row names, so the map never invents a
-         * subpath. `./package.json` is published alongside, which is what lets a
-         * consumer's tooling read the manifest of a package whose exports are otherwise
-         * closed. A selection publishing nothing answers an empty map rather than a
-         * core-rooted one, because a workspace with no published environment declares
-         * no exports at all.
-         *
-         * @example
-         * ```ts
-         * import { srcToExports } from '@orkestrel/scaffold'
-         *
-         * Object.keys(srcToExports(['core', 'server'])) // ['.', './server', './package.json']
-         * srcToExports([]) // {}
-         * ```
-         */
-        export declare function srcToExports(src: readonly Environment[]): Readonly<Record<string, unknown>>;
+       /** The coded reasons a scaffold error is raised. */
+       export declare type ScaffoldErrorCode = 'INVALID' | 'BLOCKED' | 'DESTROYED' | 'TARGET' | 'WRITE' | 'FETCH';
 
-        /**
-         * Select the single published environment a package root points at.
-         *
-         * @param src - The declared published environments.
-         * @returns That environment, or `undefined` when the selection declares none or
-         * several.
-         *
-         * @remarks
-         * A workspace publishing exactly one environment puts it at the package root,
-         * so its entry fields and its `'.'` export condition both name that
-         * environment's build. A workspace publishing several puts core at the root and
-         * gives every other environment a subpath, so there is no single root to name.
-         * Both callers read the same answer, which is why the branch is decided once
-         * here rather than twice.
-         *
-         * @example
-         * ```ts
-         * import { srcToRoot } from '@orkestrel/scaffold'
-         *
-         * srcToRoot(['browser']) // 'browser'
-         * srcToRoot(['core', 'server']) // undefined
-         * ```
-         */
-        export declare function srcToRoot(src: readonly Environment[]): Environment | undefined;
+       /**
+        * The replayable outcome of one compile.
+        *
+        * @remarks
+        * `plan` is present exactly when the compile completed, so it is also the
+        * completeness test, and `scaffolding.plan.blueprint` carries the blueprint it
+        * was compiled from. A gated compile returns the questions that closed the gate
+        * and the stage records up to it, and no plan; the caller still holds the
+        * blueprint it passed in, so repeating it at this level would be one fact stored
+        * twice and free to disagree with itself.
+        */
+       export declare interface Scaffolding {
+           readonly plan?: Plan;
+           readonly questions: readonly Question[];
+           readonly stages: readonly CompileRecord[];
+       }
 
-        /** Columns one tab occupies when the formatter measures a line, matching `tabWidth`. */
-        export declare const TAB_WIDTH = 2;
+       /**
+        * Select the groups a compile covers, in plan order.
+        *
+        * @param groups - The requested selection; every group when absent.
+        * @returns The requested groups in `GROUPS` order, without repeats.
+        *
+        * @remarks
+        * A caller's selection is data, so it arrives in whatever order and with
+        * whatever repeats the caller wrote. Plan order is this package's, so the
+        * selection is read as membership and the order comes from `GROUPS`. An empty
+        * selection covers nothing, which is a caller asking for an empty plan rather
+        * than a caller asking for everything.
+        *
+        * @example
+        * ```ts
+        * import { selectGroups } from '@orkestrel/scaffold'
+        *
+        * selectGroups(['tests', 'manifest', 'tests']) // ['manifest', 'tests']
+        * selectGroups() // every group, in plan order
+        * ```
+        */
+       export declare function selectGroups(groups?: readonly Group[]): readonly Group[];
 
-        /** The exact three-component version syntax a blueprint declares. */
-        export declare const VERSION_PATTERN: RegExp;
+       /**
+        * Select the host paths a named workspace vendors.
+        *
+        * @param paths - The candidate host paths, in their declared order.
+        * @param name - The target workspace's own bare package name.
+        * @returns Every candidate except the workspace's own guide, in input order.
+        *
+        * @remarks
+        * `HOST_PATHS` is a candidate set rather than a plan, because a workspace never
+        * mirrors its own guide: that file is the workspace's own product, and vendoring
+        * it would have the target overwrite its guide with the copy it published.
+        *
+        * @example
+        * ```ts
+        * import { HOST_PATHS, selectHostPaths } from '@orkestrel/scaffold'
+        *
+        * selectHostPaths(HOST_PATHS, 'scaffold').includes('guides/scaffold.md') // false
+        * ```
+        */
+       export declare function selectHostPaths(paths: readonly string[], name: string): readonly string[];
 
-        /**
-         * Which host-specific pipelines a generated root Vite configuration carries.
-         *
-         * @remarks
-         * Boundary guarantees never vary by blueprint, so they are not selected here:
-         * every generated configuration emits the environment-boundary plugin, its
-         * module-graph audit, and stylesheet rejection. `browser` selects the shared
-         * root CSS analysis and real-browser test machinery. `vue` selects the
-         * single-file-component, HTML, and development-server machinery an application
-         * browser environment needs. `output` selects build-output containment.
-         * `showcase` selects the optional single-file application-browser projection.
-         */
-        export declare interface ViteMachinery {
-            readonly browser: boolean;
-            readonly vue: boolean;
-            readonly output: boolean;
-            readonly showcase: boolean;
-        }
-
-        /**
-         * The vendored paths whose present bytes belong to each workspace, frozen.
-         *
-         * @remarks
-         * These paths are copied into a workspace when absent and are never compared
-         * or replaced while present. A workspace therefore stops receiving later
-         * canonical updates to them. `.gitignore` takes that trade because its correct
-         * rules differ by workspace, so scaffold cannot own its bytes.
-         */
-        export declare const WORKSPACE_OWNED_PATHS: readonly string[];
+       /**
+        * Serialize one string as a single-quoted TypeScript literal.
+        *
+        * @param value - The string to serialize.
+        * @returns A complete single-quoted literal with line-breaking and delimiter
+        * characters escaped.
+        *
+        * @remarks
+        * Configuration templates insert blueprint-derived strings into TypeScript.
+        * Keeping this one serializer at that boundary prevents a name from becoming
+        * syntax and preserves oxfmt's configured single-quote fixed point.
+        *
+        * @example
+        * ```ts
+        * import { serializeTypeScriptString } from '@orkestrel/scaffold'
+        *
+        * serializeTypeScriptString("it's") // `'it\\'s'`
+        * ```
+        */
+       export declare function serializeTypeScriptString(value: string): string;
+
+       /** The provisioner skeleton a workspace with declared service vendors is given once. */
+       export declare const SERVICE_SCRIPT_PATH = "scripts/service.sh";
+
+       /** The live-service readiness module whose presence makes a workspace `service`. */
+       export declare const SERVICE_SETUP_PATH = "tests/setupService.ts";
+
+       /** The include the live-service project covers, which is a directory rather than one proof. */
+       export declare const SERVICE_TEST_INCLUDE = "tests/service/**/*.test.ts";
+
+       /** The Vite wrapper whose presence makes a workspace `showcase`. */
+       export declare const SHOWCASE_CONFIG_PATH = "configs/app/vite.showcase.config.ts";
+
+       /**
+        * The development dependency used only by the optional single-file showcase build.
+        *
+        * @example
+        * ```ts
+        * import { SHOWCASE_DEV_DEPENDENCIES } from '@orkestrel/scaffold'
+        *
+        * SHOWCASE_DEV_DEPENDENCIES['vite-plugin-singlefile'] // '^2.3.3'
+        * ```
+        */
+       export declare const SHOWCASE_DEV_DEPENDENCIES: Readonly<Record<string, string>>;
+
+       /** Exact lowercase hexadecimal target bytes keyed by artifact-relative path. */
+       export declare type Snapshot = Readonly<Record<string, string>>;
+
+       /** The development dependencies a published browser `src` environment adds. */
+       export declare const SOURCE_BROWSER_DEV_DEPENDENCIES: Readonly<Record<string, string>>;
+
+       /**
+        * The build and export settings each published `src` environment contributes, frozen.
+        *
+        * @remarks
+        * Per environment: the thin configuration files it adds under `configs/src`,
+        * its Vitest project label, its `exports` subpath, and the module formats it
+        * builds. Core alone occupies the package root, so it is the only environment
+        * whose subpath is `.`; browser ships ES only because no CommonJS consumer
+        * reaches it.
+        */
+       export declare const SRC_MATRIX: Readonly<Record<Environment, SrcDefinition>>;
+
+       /** The build and export settings one published `src` environment contributes. */
+       export declare interface SrcDefinition {
+           readonly configs: readonly string[];
+           readonly project: string;
+           readonly path: string;
+           readonly formats: readonly BuildFormat[];
+       }
+
+       /**
+        * Project a published selection into the manifest's entry fields.
+        *
+        * @param src - The declared published environments.
+        * @returns The `main` and `module` fields, plus `types` when one environment
+        * owns the package root.
+        *
+        * @remarks
+        * `main` follows the root environment's own formats, so an environment that
+        * builds ES only points both fields at the same file rather than promising a
+        * CommonJS build that never runs. A selection with several environments carries
+        * no top-level `types`, because each environment declares its own under its
+        * subpath and a single top-level field could only name one of them.
+        *
+        * @example
+        * ```ts
+        * import { srcToEntry } from '@orkestrel/scaffold'
+        *
+        * srcToEntry(['core']).main // './dist/src/core/index.cjs'
+        * srcToEntry(['browser']).main // './dist/src/browser/index.js'
+        * ```
+        */
+       export declare function srcToEntry(src: readonly Environment[]): {
+           readonly main: string;
+           readonly module: string;
+           readonly types?: string;
+       };
+
+       /**
+        * Project a published selection into the manifest's `exports` map.
+        *
+        * @param src - The declared published environments.
+        * @returns The map, keyed by subpath in `ENVIRONMENTS` order.
+        *
+        * @remarks
+        * One environment owns the package root and every other declared environment
+        * takes the subpath its `SRC_MATRIX` row names, so the map never invents a
+        * subpath. `./package.json` is published alongside, which is what lets a
+        * consumer's tooling read the manifest of a package whose exports are otherwise
+        * closed. A selection publishing nothing answers an empty map rather than a
+        * core-rooted one, because a workspace with no published environment declares
+        * no exports at all.
+        *
+        * @example
+        * ```ts
+        * import { srcToExports } from '@orkestrel/scaffold'
+        *
+        * Object.keys(srcToExports(['core', 'server'])) // ['.', './server', './package.json']
+        * srcToExports([]) // {}
+        * ```
+        */
+       export declare function srcToExports(src: readonly Environment[]): Readonly<Record<string, unknown>>;
+
+       /**
+        * Select the single published environment a package root points at.
+        *
+        * @param src - The declared published environments.
+        * @returns That environment, or `undefined` when the selection declares none or
+        * several.
+        *
+        * @remarks
+        * A workspace publishing exactly one environment puts it at the package root,
+        * so its entry fields and its `'.'` export condition both name that
+        * environment's build. A workspace publishing several puts core at the root and
+        * gives every other environment a subpath, so there is no single root to name.
+        * Both callers read the same answer, which is why the branch is decided once
+        * here rather than twice.
+        *
+        * @example
+        * ```ts
+        * import { srcToRoot } from '@orkestrel/scaffold'
+        *
+        * srcToRoot(['browser']) // 'browser'
+        * srcToRoot(['core', 'server']) // undefined
+        * ```
+        */
+       export declare function srcToRoot(src: readonly Environment[]): Environment | undefined;
+
+       /** Columns one tab occupies when the formatter measures a line, matching `tabWidth`. */
+       export declare const TAB_WIDTH = 2;
+
+       /** The exact `major.minor.patch` version syntax a blueprint declares. */
+       export declare const VERSION_PATTERN: RegExp;
+
+       /**
+        * Which host-specific pipelines a generated root Vite configuration carries.
+        *
+        * @remarks
+        * Boundary guarantees never vary by blueprint, so they are not selected here:
+        * every generated configuration emits the environment-boundary plugin, its
+        * module-graph audit, and stylesheet rejection. `browser` selects the shared
+        * root CSS analysis and real-browser test machinery. `vue` selects the
+        * single-file-component, HTML, and development-server machinery an application
+        * browser environment needs. `output` selects build-output containment.
+        * `showcase` selects the optional single-file application-browser projection.
+        */
+       export declare interface ViteMachinery {
+           readonly browser: boolean;
+           readonly vue: boolean;
+           readonly output: boolean;
+           readonly showcase: boolean;
+       }
+
+       /**
+        * The vendored paths whose present bytes belong to each workspace, frozen.
+        *
+        * @remarks
+        * These paths are copied into a workspace when absent and are never compared
+        * or replaced while present. A workspace therefore stops receiving later
+        * canonical updates to them. `.gitignore` takes that trade because its correct
+        * rules differ by workspace, so scaffold cannot own its bytes.
+        */
+       export declare const WORKSPACE_OWNED_PATHS: readonly string[];
 
-        export { }
+       export { }