@orkestrel/scaffold 0.0.60 → 0.0.61

package/dist/bin/main.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { align, renderTable, strip, stripControls, width } from "@orkestrel/console";
-import { attempt, isRecord, isString, parseJSON } from "@orkestrel/contract";
+import { attempt, isError, isRecord, isString, parseJSON } from "@orkestrel/contract";
+import { BIN_ENTRY_PATH, CATALOG_AGENT_PATH, CONFORMANCE_TEST_PATH, Compiler, DEPENDENCY_NAME_PATTERN, ENVIRONMENTS, GLOBAL_SETUP_PATH, GROUPS, GUIDES_TEST_PATH, HOST_PATHS, INTEGRATION_TEST_PATH, MAX_MANIFEST_BYTES, SERVICE_SETUP_PATH, SHOWCASE_CONFIG_PATH, ScaffoldError, blueprintToDevDependencies, blueprintToRootVite, blueprintToScripts, blueprintToTestArtifacts, blueprintToWritableScripts, compareVersions, createBlueprint, extractRangeMajor, extractVersion, isFloorPath, isScaffoldError, manifestToDependencies, manifestToName, nameToGuide, replaceManifestScripts, replacePlanRanges } from "../src/core/index.js";
+import { Materializer, Upstream, filesToHost, isExactCaseFile, isPhysicalDirectory, isWorktree, listFiles, readFileText, readHostFloor, readSnapshot, resolveContainedPath } from "../src/server/index.js";
 import { createMarkdown, flattenText, isTableNode } from "@orkestrel/markdown";
 import { executeSync } from "@orkestrel/process/server";
-import { BIN_ENTRY_PATH, CATALOG_AGENT_PATH, CONFORMANCE_TEST_PATH, Compiler, DEPENDENCY_NAME_PATTERN, ENVIRONMENTS, GLOBAL_SETUP_PATH, GROUPS, GUIDES_TEST_PATH, HOST_PATHS, INTEGRATION_TEST_PATH, MAX_MANIFEST_BYTES, SERVICE_SETUP_PATH, SHOWCASE_CONFIG_PATH, ScaffoldError, blueprintToDevDependencies, blueprintToRootVite, blueprintToScripts, blueprintToTestArtifacts, blueprintToWritableScripts, compareVersions, createBlueprint, extractRangeMajor, extractVersion, isCanonPath, isDeferredPath, isScaffoldError, manifestToDependencies, manifestToName, nameToGuide, replaceManifestScripts, replacePlanRanges } from "../src/core/index.js";
-import { Materializer, Upstream, filesToHost, isExactCaseFile, isPhysicalDirectory, isWorktree, listFiles, readFileText, readHostFloor, readSnapshot, resolveContainedPath } from "../src/server/index.js";
 import { parseArgs } from "node:util";
 //#region src/bin/constants.ts
 /**
-* The name the executable installs as.
+* Names the command the executable installs as.
 *
 * @remarks
 * `package.json`'s `bin` field is the authority for what the command is called;
@@ -17,7 +17,7 @@ import { parseArgs } from "node:util";
 */
 var EXECUTABLE_NAME = "scaffold";
 /**
-* The {@link Verb} values in usage order, frozen.
+* Lists the {@link Verb} values in usage order, frozen.
 *
 * @remarks
 * The order the type declares them in, which is also the order usage lists them:
@@ -32,7 +32,7 @@ var VERBS = Object.freeze([
 	"overwrite"
 ]);
 /**
-* What each exit code means, frozen.
+* Describes what each exit code means, frozen.
 *
 * @remarks
 * Keyed by the code constants rather than by literals, so the usage block
@@ -44,7 +44,7 @@ var EXIT_SUMMARY = Object.freeze({
 	[2]: "usage error"
 });
 /**
-* The machine-readable code a malformed command line reports.
+* Names the machine-readable code a malformed command line reports.
 *
 * @remarks
 * The executable contributes its own codes to the failure envelope, which is why
@@ -53,12 +53,12 @@ var EXIT_SUMMARY = Object.freeze({
 * operation could.
 */
 var USAGE_CODE = "USAGE";
-/** The machine-readable code a failure carrying no code of its own reports. */
+/** Names the machine-readable code a failure carrying no code of its own reports. */
 var FAILED_CODE = "FAILED";
-/** What the failure envelope says when the raised value carried no message. */
+/** Holds what the failure envelope says when the raised value carried no message. */
 var FAILED_MESSAGE = "The command failed for an unrecognized reason";
 /**
-* The positional argument `new` alone takes, as usage writes it.
+* Names the positional argument `new` alone takes, as usage writes it.
 *
 * @remarks
 * The workspace name is the only positional argument any verb takes, so it is
@@ -66,7 +66,7 @@ var FAILED_MESSAGE = "The command failed for an unrecognized reason";
 */
 var NAME_ARGUMENT = "<name>";
 /**
-* Every option the executable accepts, as `node:util` parses them, frozen.
+* Declares every option the executable accepts, as `node:util` parses them, frozen.
 *
 * @remarks
 * One table for every verb rather than one per verb, because the verb an option
@@ -95,7 +95,7 @@ var COMMAND_OPTIONS = Object.freeze({
 	json: Object.freeze({ type: "boolean" })
 });
 /**
-* What each option does, keyed by the token usage prints, frozen.
+* Describes what each option does, keyed by the token usage prints, frozen.
 *
 * @remarks
 * The key order is the glossary order. A key is the whole displayed token,
@@ -118,7 +118,7 @@ var OPTION_SUMMARY = Object.freeze({
 	ORKESTREL_SCAFFOLD_REPOSITORY: "the repository base mapped to upstream.repository.base"
 });
 /**
-* The options each verb takes, in usage order, frozen.
+* Lists the options each verb takes, in usage order, frozen.
 *
 * @remarks
 * The executable's half of the frozen command union: every option a branch
@@ -167,7 +167,7 @@ var VERB_OPTIONS = Object.freeze({
 	])
 });
 /**
-* What each verb does, in one line, frozen.
+* Describes what each verb does, in one line, frozen.
 *
 * @remarks
 * Each line names what the verb writes, because authority is the verb's: a
@@ -183,7 +183,7 @@ var VERB_SUMMARY = Object.freeze({
 //#endregion
 //#region src/bin/errors.ts
 /**
-* The error raised when a command line is not a command.
+* Represents the error raised when a command line is not a command.
 *
 * @remarks
 * Distinct from `ScaffoldError` because they answer different questions and
@@ -210,7 +210,7 @@ var VERB_SUMMARY = Object.freeze({
 var UsageError = class extends Error {
 	code;
 	/**
-	* Construct a usage error.
+	* Constructs a usage error.
 	*
 	* @param message - What was wrong with the command line, in one sentence.
 	*/
@@ -221,10 +221,10 @@ var UsageError = class extends Error {
 	}
 };
 /**
-* Narrow a caught value to a {@link UsageError}.
+* Narrows a caught value to a {@link UsageError}.
 *
 * @param value - The caught value to narrow.
-* @returns `true` when `value` is a {@link UsageError}.
+* @returns True if `value` is a {@link UsageError}; false otherwise.
 *
 * @example
 * ```ts
@@ -240,7 +240,7 @@ function isUsageError(value) {
 //#endregion
 //#region src/bin/helpers.ts
 /**
-* Read the option name out of the token usage displays it as.
+* Reads the option name out of the token usage displays it as.
 *
 * @param option - The displayed token, such as `--from <path>`.
 * @returns The bare name `node:util` parses the option under.
@@ -263,7 +263,7 @@ function optionToName(option) {
 	return token.startsWith("--") ? token.slice(2) : token;
 }
 /**
-* Project process environment endpoints into upstream reader options.
+* Projects process environment endpoints into upstream reader options.
 *
 * @param environment - The process environment to read.
 * @returns The configured endpoint groups, or `undefined` when neither endpoint
@@ -279,7 +279,7 @@ function environmentToUpstream(environment) {
 	};
 }
 /**
-* Render one verb's synopsis.
+* Renders one verb's synopsis.
 *
 * @param verb - The verb to describe.
 * @returns The command line this verb accepts, with every option bracketed.
@@ -300,7 +300,7 @@ function verbToSyntax(verb) {
 	return `${EXECUTABLE_NAME} ${verb}${verb === "new" ? ` ${NAME_ARGUMENT}` : ""} ${VERB_OPTIONS[verb].map((option) => `[${option}]`).join(" ")}`;
 }
 /**
-* Render the whole command reference.
+* Renders the whole command reference.
 *
 * @returns One line per output call: the synopsis, every verb, the option glossary, and the exit codes.
 *
@@ -327,7 +327,7 @@ function renderUsage() {
 	];
 }
 /**
-* Read one command out of the arguments following the executable's own name.
+* Reads one command out of the arguments following the executable's own name.
 *
 * @param argv - The arguments the executable was given.
 * @returns The command the arguments denote.
@@ -364,7 +364,7 @@ function argvToCommand(argv) {
 	}));
 	if (!parsed.success) {
 		const cause = parsed.error;
-		throw new UsageError(cause instanceof Error ? cause.message : `Could not read the arguments to '${verb}'.`);
+		throw new UsageError(isError(cause) ? cause.message : `Could not read the arguments to '${verb}'.`);
 	}
 	const { positionals, values } = parsed.value;
 	const accepted = VERB_OPTIONS[verb].map((option) => optionToName(option));
@@ -436,7 +436,7 @@ function argvToCommand(argv) {
 	}
 }
 /**
-* Read the exit code an audit reports.
+* Reads the exit code an audit reports.
 *
 * @param audit - The comparison of a plan against a target.
 * @returns `EXIT_CLEAN` when the target matched the plan, `EXIT_DRIFT` otherwise.
@@ -463,7 +463,7 @@ function auditToExit(audit) {
 	return blocked || drifted ? 1 : 0;
 }
 /**
-* Read the runtime and development rows a writing verb may raise.
+* Reads the runtime and development rows a writing verb may raise.
 *
 * @param manifest - The target manifest text.
 * @param blueprint - The workspace shape that supplies the planned tool set.
@@ -502,7 +502,7 @@ function manifestToWritableDependencies(manifest, blueprint) {
 	};
 }
 /**
-* Keep only dependencies published by the Orkestrel fleet.
+* Keeps only dependencies published by the Orkestrel fleet.
 *
 * @param dependencies - The declared dependencies to inspect.
 * @returns The fleet declarations in their original order.
@@ -511,7 +511,7 @@ function dependenciesToFleet(dependencies) {
 	return dependencies.filter((dependency) => dependency.name.startsWith("@orkestrel/"));
 }
 /**
-* Project declared concrete ranges to their distributed release floors.
+* Projects declared concrete ranges to their distributed release floors.
 *
 * @param dependencies - The declarations whose floor versions to read.
 * @returns One found floor per declaration, or `undefined` when any range names
@@ -531,7 +531,7 @@ function dependenciesToFloors(dependencies) {
 	return releases;
 }
 /**
-* Read the exit code registry release evidence earns.
+* Reads the exit code registry release evidence earns.
 *
 * @param releases - The release verdicts to measure.
 * @returns `EXIT_DRIFT` for a failed lookup or an exact fleet mismatch; `EXIT_CLEAN` otherwise.
@@ -540,7 +540,7 @@ function releasesToExit(releases) {
 	return releases.some((release) => release.lookup !== "found" || release.name.startsWith("@orkestrel/") && release.range !== `^${release.latest}`) ? 1 : 0;
 }
 /**
-* Project foreign floor and supported-major drift into audit questions.
+* Projects foreign floor and supported-major drift into audit questions.
 *
 * @param releases - The release verdicts to measure.
 * @param served - Alternate release verdicts used to detect a newer served major.
@@ -570,7 +570,7 @@ function releasesToQuestions(releases, served = releases) {
 	return questions;
 }
 /**
-* Project an audit into the human summary of its outcome.
+* Projects an audit into the human summary of its outcome.
 *
 * @param audit - The comparison to summarize.
 * @returns The refusal, or the planned-path outcome, its grounds, and any foreign-path count.
@@ -607,7 +607,7 @@ function auditToSummary(audit) {
 	return foreign === 0 ? summary : `${summary} The plan does not own ${String(foreign)} further path${foreign === 1 ? "" : "s"} beneath its groups.`;
 }
 /**
-* Project a raised value into the machine-readable failure envelope.
+* Projects a raised value into the machine-readable failure envelope.
 *
 * @param error - The value a command raised.
 * @returns The envelope naming the coded reason and what went wrong.
@@ -633,13 +633,556 @@ function errorToEnvelope(error) {
 	} };
 	return { error: {
 		code: FAILED_CODE,
-		message: error instanceof Error ? error.message : FAILED_MESSAGE
+		message: isError(error) ? error.message : FAILED_MESSAGE
 	} };
 }
+/**
+* Writes one report line to the process output stream.
+*
+* @param line - The already-sanitized line to write.
+*
+* @remarks
+* The destination a terminal caller means for the report. It is the executable's
+* default `output` handler and the only place this package names
+* `process.stdout`, so a caller driving the executable from inside another
+* process replaces the whole write path by supplying its own handler.
+*
+* @example
+* ```ts
+* import { writeOutput } from './helpers.js'
+*
+* writeOutput('0 written, 0 unchanged, 0 removed in ./target.')
+* ```
+*/
+function writeOutput(line) {
+	process.stdout.write(`${line}\n`);
+}
+/**
+* Writes one diagnostic line to the process error stream.
+*
+* @param line - The already-sanitized line to write.
+*
+* @remarks
+* The destination a terminal caller means for everything that must stay off the
+* report, so a piped machine-readable value is never polluted by a warning. It
+* is the executable's default `diagnostic` handler and the only place this
+* package names `process.stderr`.
+*
+* @example
+* ```ts
+* import { writeDiagnostic } from './helpers.js'
+*
+* writeDiagnostic('FAILED: the target is not a git repository.')
+* ```
+*/
+function writeDiagnostic(line) {
+	process.stderr.write(`${line}\n`);
+}
+/**
+* Strips one line of everything a terminal would act on rather than print.
+*
+* @param line - The line to sanitize.
+* @returns The line with ANSI escapes and control characters removed and every
+* break folded to a space.
+*
+* @remarks
+* The single write path's cleaner, and the only place hostile bytes are answered
+* for. A refusal quotes the argument that caused it, so an escape sequence, a
+* bell, or a forged second line arrives here inside otherwise ordinary prose.
+* ANSI escapes go first because they are what repaints a terminal, control
+* characters next, and what remains is folded onto one line because a handler
+* takes one line and a caller writing a record per call must get one record.
+* A lone carriage return is folded as a break too, because a terminal repaints
+* the line already printed on one. The fold is a replacement rather than a line
+* split, so no bare `\r` is read as a line terminator here.
+*
+* @example
+* ```ts
+* import { sanitizeLine } from './helpers.js'
+*
+* sanitizeLine('first\nsecond') // 'first second'
+* ```
+*/
+function sanitizeLine(line) {
+	return stripControls(strip(line)).replace(/\r\n|\r|\n/gu, " ");
+}
+/**
+* Projects an incomplete version resolution into the refusal it earns.
+*
+* @param versions - The resolution to measure.
+* @returns The refusal to throw, or `undefined` when the resolution is complete.
+*
+* @remarks
+* Read before a caller opens a write, so a run that could not name every floor
+* refuses instead of writing a partial pin set.
+*
+* @example
+* ```ts
+* import { versionsToRefusal } from './helpers.js'
+*
+* versionsToRefusal({ releases: [], pins: { runtime: [], development: [] }, forced: false, complete: true })
+* // undefined
+* ```
+*/
+function versionsToRefusal(versions) {
+	if (versions.complete) return void 0;
+	const names = versions.releases.filter((release) => release.lookup !== "found").map((release) => release.name);
+	return new ScaffoldError("FETCH", names.length === 0 ? "A declared dependency names no concrete floor." : `The registry named no release for ${names.join(", ")}.`, { names: names.length });
+}
+/**
+* Projects an incomplete catalog fetch into the refusal it earns.
+*
+* @param entries - The catalog rows the fetch produced.
+* @param mirrors - The guide mirrors the fetch produced.
+* @returns The refusal to throw, or `undefined` when every row answered.
+*
+* @remarks
+* A catalog transaction starts only after every packument answered. A mirror the
+* host could not serve — a failed read or an absent guide, which is what a
+* published package with a private repository answers with — is skipped and
+* reported rather than refusing every other write, because one unreachable
+* package never costs the caller the rest of the fetch.
+*
+* @example
+* ```ts
+* import { fetchToRefusal } from './helpers.js'
+*
+* fetchToRefusal([], []) // undefined
+* ```
+*/
+function fetchToRefusal(entries, mirrors) {
+	const failed = [...entries.filter((entry) => entry.lookup !== "found").map((entry) => entry.name), ...mirrors.filter((mirror) => mirror.lookup !== "found" && mirror.lookup !== "failed" && mirror.lookup !== "missing").map((mirror) => mirror.name)];
+	if (failed.length === 0) return void 0;
+	return new ScaffoldError("FETCH", `Upstream produced no complete catalog answer for ${failed.join(", ")}.`, { names: failed.length });
+}
+/**
+* Projects the catalog packuments already read into declared release evidence.
+*
+* @param declared - The declared dependencies to answer for, in declaration order.
+* @param entries - The catalog rows the fetch produced.
+* @returns One release verdict per declaration, in input order.
+*
+* @remarks
+* The catalog verb already holds every fleet packument, so a declared range is
+* measured against what that read returned rather than against a second request.
+*
+* @example
+* ```ts
+* import { entriesToReleases } from './helpers.js'
+*
+* entriesToReleases([{ name: '@orkestrel/emitter', range: '^0.0.5' }], [])
+* // [{ name: '@orkestrel/emitter', range: '^0.0.5', lookup: 'missing', note: '…' }]
+* ```
+*/
+function entriesToReleases(declared, entries) {
+	return declared.map((dependency) => {
+		const entry = entries.find((candidate) => candidate.name === dependency.name);
+		if (entry?.lookup === "found") return {
+			...dependency,
+			lookup: "found",
+			latest: entry.version
+		};
+		return {
+			...dependency,
+			lookup: entry?.lookup ?? "missing",
+			note: entry?.note ?? "the organization catalog does not list the declared package"
+		};
+	});
+}
+/**
+* Projects release evidence into the complete pin set a write may apply.
+*
+* @param releases - The release verdicts, one per declared dependency, in the
+* order the declarations were looked up.
+* @param declared - The runtime and development declarations the verdicts answer for.
+* @returns The runtime and development pins, each at the caret of its release.
+* @throws `ScaffoldError('FETCH', …)` when a verdict named no release, when a
+* verdict has no matching declaration, or when the two sets differ in length.
+*
+* @remarks
+* All or nothing: a caller never writes a partial pin set, because a manifest
+* carrying some raised ranges and some stale ones is harder to recover from than
+* one that was not written at all.
+*
+* @example
+* ```ts
+* import { releasesToPins } from './helpers.js'
+*
+* releasesToPins(
+* 	[{ name: '@orkestrel/emitter', range: '^0.0.5', lookup: 'found', latest: '0.0.6' }],
+* 	{ runtime: [{ name: '@orkestrel/emitter', range: '^0.0.5' }], development: [] },
+* ) // { runtime: [{ name: '@orkestrel/emitter', range: '^0.0.6' }], development: [] }
+* ```
+*/
+function releasesToPins(releases, declared) {
+	const refused = releases.filter((release) => release.lookup !== "found");
+	if (refused.length > 0) throw new ScaffoldError("FETCH", `The registry named no release for ${refused.map((release) => release.name).join(", ")}.`, { names: refused.length });
+	const dependencies = [...declared.runtime, ...declared.development];
+	const pins = [];
+	for (let index = 0; index < releases.length; index += 1) {
+		const release = releases[index];
+		const dependency = dependencies[index];
+		if (release === void 0 || dependency === void 0) throw new ScaffoldError("FETCH", "The release answer has no matching declaration.");
+		if (release.lookup !== "found") throw new ScaffoldError("FETCH", `The registry named no release for ${release.name}.`);
+		pins.push({
+			name: dependency.name,
+			range: `^${release.latest}`
+		});
+	}
+	if (pins.length !== dependencies.length) throw new ScaffoldError("FETCH", "The release answer does not match the declaration set.");
+	return {
+		runtime: pins.slice(0, declared.runtime.length),
+		development: pins.slice(declared.runtime.length)
+	};
+}
+/**
+* Reads the literal Vitest projects and npm run scripts one shell command invokes.
+*
+* @param script - The manifest script text to read.
+* @returns The invoked projects and scripts, or `undefined` when the command
+* cannot be read literally.
+*
+* @remarks
+* Quotes group a token but do not hide the option, while shell expansions make
+* its value unresolved and therefore refuse the write that asked the question.
+* An unterminated quote, a trailing escape, and an unresolved `--project` value
+* all answer `undefined` rather than a partial reading.
+*
+* @example
+* ```ts
+* import { scriptToInvocations } from './helpers.js'
+*
+* scriptToInvocations('vitest run --project src:core')
+* // { projects: ['src:core'], scripts: [] }
+* ```
+*/
+function scriptToInvocations(script) {
+	const tokens = [];
+	let value = "";
+	let resolved = true;
+	let started = false;
+	let quote;
+	for (let index = 0; index < script.length; index += 1) {
+		const character = script[index];
+		if (character === void 0) return void 0;
+		if (quote === void 0) {
+			if (/\s/.test(character)) {
+				if (started) tokens.push({
+					value,
+					resolved
+				});
+				value = "";
+				resolved = true;
+				started = false;
+				continue;
+			}
+			if (";&|()".includes(character)) {
+				if (started) tokens.push({
+					value,
+					resolved
+				});
+				const paired = script[index + 1] === character && (character === "&" || character === "|");
+				tokens.push({
+					value: paired ? `${character}${character}` : character,
+					resolved: true
+				});
+				value = "";
+				resolved = true;
+				started = false;
+				if (paired) index += 1;
+				continue;
+			}
+			if (character === "\"" || character === "'") {
+				quote = character;
+				started = true;
+				continue;
+			}
+			if (character === "\\") {
+				const escaped = script[index + 1];
+				if (escaped === void 0) return void 0;
+				value += escaped;
+				started = true;
+				index += 1;
+				continue;
+			}
+			if (character === "$" || character === "`" || character === "%") resolved = false;
+			value += character;
+			started = true;
+			continue;
+		}
+		if (character === quote) {
+			quote = void 0;
+			continue;
+		}
+		if (character === "\\" && quote === "\"") {
+			const escaped = script[index + 1];
+			if (escaped === void 0) return void 0;
+			value += escaped;
+			index += 1;
+			continue;
+		}
+		if (quote === "\"" && (character === "$" || character === "`" || character === "%")) resolved = false;
+		value += character;
+		started = true;
+	}
+	if (quote !== void 0) return void 0;
+	if (started) tokens.push({
+		value,
+		resolved
+	});
+	const projects = [];
+	const scripts = [];
+	for (let index = 0; index < tokens.length; index += 1) {
+		const token = tokens[index];
+		if (token === void 0) return void 0;
+		if (token.value === "npm" && tokens[index + 1]?.value === "run") {
+			const name = tokens[index + 2];
+			if (name === void 0 || !name.resolved || name.value.length === 0 || [
+				"&&",
+				"||",
+				";",
+				"|",
+				"&",
+				"(",
+				")"
+			].includes(name.value)) return void 0;
+			scripts.push(name.value);
+			index += 2;
+			continue;
+		}
+		if (token.value === "--project") {
+			const project = tokens[index + 1];
+			if (project === void 0 || !project.resolved || project.value.length === 0 || [
+				"&&",
+				"||",
+				";",
+				"|",
+				"&",
+				"(",
+				")"
+			].includes(project.value)) return void 0;
+			projects.push(project.value);
+			index += 1;
+			continue;
+		}
+		if (token.value.startsWith("--project=")) {
+			const project = token.value.slice(10);
+			if (!token.resolved || project.length === 0) return void 0;
+			projects.push(project);
+			continue;
+		}
+		if (!token.resolved && token.value.includes("--project")) return void 0;
+	}
+	return {
+		projects,
+		scripts
+	};
+}
+/**
+* Reads the environments one axis of a target physically ships.
+*
+* @param target - The target directory to read.
+* @param axis - The axis directory, `src` or `app`.
+* @returns The environments that axis holds as directories, in declared order.
+*
+* @remarks
+* Read as directories rather than declared, because a directory is the fact and
+* a declaration would be a second copy of it free to disagree.
+*
+* @example
+* ```ts
+* import { targetToEnvironments } from './helpers.js'
+*
+* targetToEnvironments('./packages/router', 'src') // ['core', 'server']
+* ```
+*/
+function targetToEnvironments(target, axis) {
+	return ENVIRONMENTS.filter((environment) => {
+		const full = resolveContainedPath(target, `${axis}/${environment}`);
+		return full !== void 0 && isPhysicalDirectory(full);
+	});
+}
+/**
+* Reads the packages a target's catalog table listed before this run.
+*
+* @param target - The target directory holding the catalog agent file.
+* @returns The package names the table's first column carries, in table order,
+* and no names when the file is absent.
+*
+* @remarks
+* Read through the declared markdown parser rather than by pattern, so a row is
+* a row because the document says so.
+*
+* @example
+* ```ts
+* import { catalogToNames } from './helpers.js'
+*
+* catalogToNames('./packages/router') // ['@orkestrel/contract', '@orkestrel/emitter']
+* ```
+*/
+function catalogToNames(target) {
+	const text = readFileText(target, CATALOG_AGENT_PATH);
+	if (text === void 0) return [];
+	const names = [];
+	for (const table of createMarkdown(text).filter(isTableNode)) for (const row of table.rows) {
+		const [cell] = row;
+		if (cell === void 0) continue;
+		const name = cell.map(flattenText).join("").trim();
+		if (DEPENDENCY_NAME_PATTERN.test(name)) names.push(name);
+	}
+	return names;
+}
+/**
+* Reads one git query as its NUL-separated records.
+*
+* @param target - The repository the query runs in.
+* @param args - The git arguments, without the program name.
+* @returns The non-empty records git wrote, in git's own order.
+* @throws `ScaffoldError('TARGET', …)` when the query fails, which is what a
+* directory that is not a git repository answers with.
+*
+* @remarks
+* Git is asked rather than reimplemented, because the tracked set and the dirty
+* set are git's own answers and nothing else can give them. `executeSync`
+* resolves the bare `git` name against `PATH` and `PATHEXT` on Windows, never
+* through a shell, so the query runs without an extension of its own. A failed
+* run resolves instead of throwing there, so git's own refusal is buffered into
+* the result rather than written onto a stream nobody chose.
+*
+* @example
+* ```ts
+* import { readGitRecords } from './helpers.js'
+*
+* readGitRecords('./packages/router', ['ls-files', '-z']) // ['package.json', 'src/core/index.ts']
+* ```
+*/
+function readGitRecords(target, args) {
+	const result = executeSync({
+		file: "git",
+		arguments: [...args]
+	}, {
+		workspace: target,
+		limit: MAX_MANIFEST_BYTES,
+		strict: false
+	});
+	if (result.failed) throw new ScaffoldError("TARGET", `The target at ${target} is not a git repository.`, { target });
+	return result.stdout.split("\0").filter((record) => record.length > 0);
+}
+/**
+* Reads the environments a comma-separated selection names.
+*
+* @param selection - The selection text, or `undefined` for no selection.
+* @param axis - The axis the option configures, quoted in a refusal.
+* @returns The named environments in declared order, and none for no selection.
+* @throws `UsageError` when the selection names something that is not an environment.
+*
+* @example
+* ```ts
+* import { selectionToEnvironments } from './helpers.js'
+*
+* selectionToEnvironments('server,core', 'src') // ['core', 'server']
+* ```
+*/
+function selectionToEnvironments(selection, axis) {
+	if (selection === void 0) return [];
+	const requested = selection.split(",");
+	const refused = requested.filter((name) => !ENVIRONMENTS.some((environment) => environment === name));
+	if (refused.length > 0) throw new UsageError(`'--${axis}' does not take ${refused.join(", ")}. It takes ${ENVIRONMENTS.join(", ")}.`);
+	return ENVIRONMENTS.filter((environment) => requested.includes(environment));
+}
+/**
+* Reads the artifact groups a comma-separated selection names.
+*
+* @param selection - The selection text, or `undefined` for no selection.
+* @returns The named groups in plan order, and `undefined` for no selection,
+* which covers every group.
+* @throws `UsageError` when the selection names something that is not a group.
+*
+* @example
+* ```ts
+* import { selectionToGroups } from './helpers.js'
+*
+* selectionToGroups('tests,manifest') // ['manifest', 'tests']
+* ```
+*/
+function selectionToGroups(selection) {
+	if (selection === void 0) return void 0;
+	const requested = selection.split(",");
+	const refused = requested.filter((name) => !GROUPS.some((group) => group === name));
+	if (refused.length > 0) throw new UsageError(`'--groups' does not take ${refused.join(", ")}. It takes ${GROUPS.join(", ")}.`);
+	return GROUPS.filter((group) => requested.includes(group));
+}
+/**
+* Reads the fleet packages a comma-separated selection names.
+*
+* @param selection - The selection text, or `undefined` for no selection.
+* @returns The named packages in selection order, and none for no selection.
+* @throws `UsageError` when a name is not a published `@orkestrel` package name.
+*
+* @example
+* ```ts
+* import { selectionToPackages } from './helpers.js'
+*
+* selectionToPackages('@orkestrel/emitter') // ['@orkestrel/emitter']
+* ```
+*/
+function selectionToPackages(selection) {
+	if (selection === void 0) return [];
+	const requested = selection.split(",");
+	const refused = requested.filter((name) => !DEPENDENCY_NAME_PATTERN.test(name));
+	if (refused.length > 0) throw new UsageError(`'--deps' does not take ${refused.join(", ")}. Every name is a published @orkestrel package.`);
+	return requested;
+}
+/**
+* Merges the results of two mutations of one target into one result.
+*
+* @param first - The earlier result, which fixes the reported target.
+* @param second - The later result.
+* @returns One result carrying both path lists, first's paths ahead of second's.
+*
+* @remarks
+* Written and skipped never overlap across the calls a verb makes, because each
+* call answers for its own paths.
+*
+* @example
+* ```ts
+* import { mergeResults } from './helpers.js'
+*
+* mergeResults(
+* 	{ target: './t', written: ['a'], skipped: [], removed: [] },
+* 	{ target: './t', written: ['b'], skipped: [], removed: [] },
+* ) // { target: './t', written: ['a', 'b'], skipped: [], removed: [] }
+* ```
+*/
+function mergeResults(first, second) {
+	return {
+		target: first.target,
+		written: [...first.written, ...second.written],
+		skipped: [...first.skipped, ...second.skipped],
+		removed: [...first.removed, ...second.removed]
+	};
+}
+/**
+* Projects one mutation result into the line that states what it did.
+*
+* @param result - The result to state.
+* @returns One line naming the written, unchanged, and removed tallies and the target.
+*
+* @example
+* ```ts
+* import { resultToTally } from './helpers.js'
+*
+* resultToTally({ target: './t', written: ['a'], skipped: [], removed: [] })
+* // '1 written, 0 unchanged, 0 removed in ./t.'
+* ```
+*/
+function resultToTally(result) {
+	return `${String(result.written.length)} written, ${String(result.skipped.length)} unchanged, ${String(result.removed.length)} removed in ${result.target}.`;
+}
 //#endregion
 //#region src/bin/CLI.ts
 /**
-* The executable: one command line in, one exit code out.
+* Represents the executable: one command line in, one exit code out.
 *
 * @remarks
 * Every destination this class writes to is a handler it was given, and the run
@@ -672,25 +1215,23 @@ function errorToEnvelope(error) {
 * code // 0
 * ```
 */
-var CLI = class CLI {
-	static #stdout = (line) => void process.stdout.write(`${line}\n`);
-	static #stderr = (line) => void process.stderr.write(`${line}\n`);
+var CLI = class {
 	#output;
 	#diagnostic;
 	#upstream;
 	/**
-	* Construct the executable over the destinations it writes to.
+	* Constructs the executable over the destinations it writes to.
 	*
 	* @param options - The report and diagnostic handlers and the upstream
 	* endpoints; the process streams and the published endpoints when absent.
 	*/
 	constructor(options) {
-		this.#output = options?.output ?? CLI.#stdout;
-		this.#diagnostic = options?.diagnostic ?? CLI.#stderr;
+		this.#output = options?.output ?? writeOutput;
+		this.#diagnostic = options?.diagnostic ?? writeDiagnostic;
 		this.#upstream = options?.upstream;
 	}
 	/**
-	* Run one command line to completion and report through the configured output.
+	* Runs one command line to completion and reports through the configured output.
 	*
 	* @param argv - The arguments following the executable's own name.
 	* @returns The exit code: `0` clean, `1` drift or failure, `2` a usage error.
@@ -734,11 +1275,11 @@ var CLI = class CLI {
 	async #create(command) {
 		const target = command.target ?? command.name;
 		const blueprint = createBlueprint(command.name, {
-			src: this.#environments(command.src, "src"),
-			app: this.#environments(command.app, "app"),
+			src: selectionToEnvironments(command.src, "src"),
+			app: selectionToEnvironments(command.app, "app"),
 			bin: command.bin === true,
 			setup: false,
-			dependencies: this.#packages(command.dependencies).map((name) => ({
+			dependencies: selectionToPackages(command.dependencies).map((name) => ({
 				name,
 				range: "^0.0.0"
 			}))
@@ -751,7 +1292,8 @@ var CLI = class CLI {
 			runtime: dependenciesToFleet(declarations.runtime),
 			development: dependenciesToFleet(declarations.development)
 		}, command.offline === true);
-		this.#assertVersions(versions);
+		const refusal = versionsToRefusal(versions);
+		if (refusal !== void 0) throw refusal;
 		const resolved = replacePlanRanges(plan, versions.pins);
 		if (resolved === void 0) throw new ScaffoldError("BLOCKED", "The compiled plan ranges could not be replaced.");
 		const host = await this.#host(command.from, void 0, command.offline === true);
@@ -767,7 +1309,7 @@ var CLI = class CLI {
 			if (command.json === true) this.#report(outcome);
 			else {
 				this.#say(`Scaffolded ${blueprint.name} into ${result.target}.`);
-				this.#say(this.#tally(result));
+				this.#say(resultToTally(result));
 			}
 			if (versions.forced || host.forced) this.#reportBaselines(outcome.provenance);
 			return 0;
@@ -779,7 +1321,7 @@ var CLI = class CLI {
 		const target = command.target ?? ".";
 		const manifest = this.#manifest(target);
 		const blueprint = this.#derive(target);
-		const groups = this.#groups(command.groups);
+		const groups = selectionToGroups(command.groups);
 		const declared = manifestToWritableDependencies(manifest, blueprint);
 		const versions = await this.#versions(declared, command.offline === true);
 		const questions = [...this.#targetQuestions(target, blueprint, groups), ...releasesToQuestions(versions.releases)];
@@ -812,7 +1354,7 @@ var CLI = class CLI {
 	}
 	async #restore(command) {
 		const target = command.target ?? ".";
-		const groups = this.#groups(command.groups);
+		const groups = selectionToGroups(command.groups);
 		const blueprint = this.#derive(target);
 		this.#assertTarget(target, blueprint, groups);
 		const host = await this.#host(command.from, target, command.offline === true);
@@ -827,8 +1369,9 @@ var CLI = class CLI {
 				return 1;
 			}
 			const versions = await this.#versions(manifestToWritableDependencies(this.#manifest(target), blueprint), command.offline === true);
-			this.#assertVersions(versions);
-			const result = this.#merge(host.materializer.repair(plan, audit, target), host.materializer.declare({
+			const refusal = versionsToRefusal(versions);
+			if (refusal !== void 0) throw refusal;
+			const result = mergeResults(host.materializer.repair(plan, audit, target), host.materializer.declare({
 				pins: versions.pins,
 				scripts: blueprintToWritableScripts(blueprint)
 			}, target));
@@ -848,7 +1391,7 @@ var CLI = class CLI {
 			else {
 				this.#present(terminal);
 				this.#reportReplacements(audit, terminal);
-				this.#say(this.#tally(result));
+				this.#say(resultToTally(result));
 			}
 			if (versions.forced || host.forced) this.#reportBaselines(outcome.provenance);
 			if (command.offline !== true && (versions.forced || host.forced)) return 1;
@@ -861,21 +1404,22 @@ var CLI = class CLI {
 		const target = command.target ?? ".";
 		const [host, ...extra] = command.from ?? [];
 		if (extra.length > 0) this.#warn(`Read the data root from ${String(host)}. The other ${String(extra.length)} local root${extra.length === 1 ? "" : "s"} named by --from reach nothing this run does.`);
-		const previous = this.#previous(target);
+		const previous = catalogToNames(target);
 		const fetched = await this.#fetch(target, command.all === true);
 		const declarations = manifestToDependencies(this.#manifest(target));
 		const writable = {
 			runtime: dependenciesToFleet(declarations.runtime),
 			development: dependenciesToFleet(declarations.development)
 		};
-		const releases = this.#catalogReleases([...writable.runtime, ...writable.development], fetched.entries);
-		const pins = this.#pin(releases, writable);
-		this.#assertFetched(fetched.entries, fetched.mirrors);
+		const releases = entriesToReleases([...writable.runtime, ...writable.development], fetched.entries);
+		const pins = releasesToPins(releases, writable);
+		const refusal = fetchToRefusal(fetched.entries, fetched.mirrors);
+		if (refusal !== void 0) throw refusal;
 		const guides = fetched.mirrors.length === 0 ? void 0 : fetched.mirrors.some((mirror) => mirror.lookup !== "found") ? "floor" : "live";
 		const materializer = new Materializer({ host: host ?? readHostFloor() });
 		let result;
 		try {
-			result = this.#merge(this.#publish(materializer, target, fetched.entries, fetched.mirrors), materializer.declare({
+			result = mergeResults(this.#publish(materializer, target, fetched.entries, fetched.mirrors), materializer.declare({
 				pins,
 				scripts: []
 			}, target));
@@ -899,7 +1443,7 @@ var CLI = class CLI {
 	}
 	async #replace(command) {
 		const target = command.target ?? ".";
-		const groups = this.#groups(command.groups);
+		const groups = selectionToGroups(command.groups);
 		const blueprint = this.#derive(target);
 		this.#assertTarget(target, blueprint, groups);
 		const worktree = this.#worktree(target);
@@ -922,18 +1466,16 @@ var CLI = class CLI {
 				pins: manifestToWritableDependencies(this.#manifest(target), blueprint),
 				scripts: blueprintToWritableScripts(blueprint)
 			};
-			const repaired = host.materializer.repair(plan, audit, target);
-			const removed = host.materializer.remove(plan, audit, command.dirty === true ? {
+			const local = mergeResults(host.materializer.repair(plan, audit, target), host.materializer.remove(plan, audit, command.dirty === true ? {
 				tracked: worktree.tracked,
 				dirty: []
-			} : worktree, target);
-			const offline = this.#merge(repaired, removed);
-			const online = command.offline === true ? await this.#offline(host.materializer, target, declared, host.baseline) : await this.#reconcile(host.materializer, target, declared, host.baseline, host.forced);
+			} : worktree, target));
+			const remainder = command.offline === true ? await this.#declare(host.materializer, target, declared, host.baseline) : await this.#reconcile(host.materializer, target, declared, host.baseline, host.forced);
 			const [measured] = this.#survey(host.materializer, blueprint, target, groups);
 			const terminal = this.#appendQuestions(measured, target, blueprint, groups);
 			const outcome = {
-				...online,
-				...this.#merge(offline, online),
+				...remainder,
+				...mergeResults(local, remainder),
 				audit: terminal
 			};
 			if (command.json === true) this.#report(outcome);
@@ -941,17 +1483,18 @@ var CLI = class CLI {
 				this.#present(terminal);
 				this.#reportReplacements(audit, terminal);
 				this.#recount(outcome);
-				if (online.note !== void 0) this.#warn(online.note);
+				if (remainder.note !== void 0) this.#warn(remainder.note);
 			}
-			if (online.note !== void 0) return 1;
+			if (remainder.note !== void 0) return 1;
 			return auditToExit(terminal);
 		} finally {
 			host.materializer.destroy();
 		}
 	}
-	async #offline(materializer, target, declared, host) {
+	async #declare(materializer, target, declared, host) {
 		const versions = await this.#versions(declared.pins, true);
-		this.#assertVersions(versions);
+		const refusal = versionsToRefusal(versions);
+		if (refusal !== void 0) throw refusal;
 		return {
 			...materializer.declare({
 				pins: versions.pins,
@@ -969,7 +1512,7 @@ var CLI = class CLI {
 		};
 	}
 	async #reconcile(materializer, target, declared, host, hostForced) {
-		const previous = this.#previous(target);
+		const previous = catalogToNames(target);
 		let releases = [];
 		let provenance = { ...host === void 0 ? {} : { host } };
 		try {
@@ -979,16 +1522,18 @@ var CLI = class CLI {
 				...versions.baseline === void 0 ? {} : { versions: versions.baseline },
 				...host === void 0 ? {} : { host }
 			};
-			this.#assertVersions(versions);
+			const refused = versionsToRefusal(versions);
+			if (refused !== void 0) throw refused;
 			const fetched = await this.#fetch(target, false);
-			this.#assertFetched(fetched.entries, fetched.mirrors);
+			const incomplete = fetchToRefusal(fetched.entries, fetched.mirrors);
+			if (incomplete !== void 0) throw incomplete;
 			const guides = fetched.mirrors.length === 0 ? void 0 : fetched.mirrors.some((mirror) => mirror.lookup === "failed") ? "floor" : "live";
 			provenance = {
 				...versions.baseline === void 0 ? {} : { versions: versions.baseline },
 				...guides === void 0 ? {} : { guides },
 				...host === void 0 ? {} : { host }
 			};
-			const written = this.#merge(this.#publish(materializer, target, fetched.entries, fetched.mirrors), materializer.declare({
+			const written = mergeResults(this.#publish(materializer, target, fetched.entries, fetched.mirrors), materializer.declare({
 				pins: versions.pins,
 				scripts: declared.scripts
 			}, target));
@@ -1031,7 +1576,7 @@ var CLI = class CLI {
 			baseline: "floor",
 			forced: false
 		};
-		const paths = floor.manifest.entries.filter((entry) => !isDeferredPath(entry.destination) && !isCanonPath(entry.destination)).map((entry) => entry.destination);
+		const paths = floor.manifest.entries.filter((entry) => !isFloorPath(entry.destination)).map((entry) => entry.destination);
 		const current = target === void 0 ? floor.bytes : readSnapshot(target, paths);
 		const upstream = new Upstream(this.#upstream);
 		try {
@@ -1119,17 +1664,12 @@ var CLI = class CLI {
 		}
 		return {
 			releases,
-			pins: this.#pin(releases, declared),
+			pins: releasesToPins(releases, declared),
 			baseline: "live",
 			forced: false,
 			complete: true
 		};
 	}
-	#assertVersions(versions) {
-		if (versions.complete) return;
-		const names = versions.releases.filter((release) => release.lookup !== "found").map((release) => release.name);
-		throw new ScaffoldError("FETCH", names.length === 0 ? "A declared dependency names no concrete floor." : `The registry named no release for ${names.join(", ")}.`, { names: names.length });
-	}
 	async #lookup(declared) {
 		if (declared.length === 0) return [];
 		const upstream = new Upstream(this.#upstream);
@@ -1179,48 +1719,7 @@ var CLI = class CLI {
 		}
 	}
 	#publish(materializer, target, entries, mirrors) {
-		return this.#merge(materializer.mirror(mirrors, target), materializer.catalog(entries, target));
-	}
-	#catalogReleases(declared, entries) {
-		return declared.map((dependency) => {
-			const entry = entries.find((candidate) => candidate.name === dependency.name);
-			if (entry?.lookup === "found") return {
-				...dependency,
-				lookup: "found",
-				latest: entry.version
-			};
-			return {
-				...dependency,
-				lookup: entry?.lookup ?? "missing",
-				note: entry?.note ?? "the organization catalog does not list the declared package"
-			};
-		});
-	}
-	#assertFetched(entries, mirrors) {
-		const failed = [...entries.filter((entry) => entry.lookup !== "found").map((entry) => entry.name), ...mirrors.filter((mirror) => mirror.lookup !== "found" && mirror.lookup !== "failed" && mirror.lookup !== "missing").map((mirror) => mirror.name)];
-		if (failed.length === 0) return;
-		throw new ScaffoldError("FETCH", `Upstream produced no complete catalog answer for ${failed.join(", ")}.`, { names: failed.length });
-	}
-	#pin(releases, declared) {
-		const refused = releases.filter((release) => release.lookup !== "found");
-		if (refused.length > 0) throw new ScaffoldError("FETCH", `The registry named no release for ${refused.map((release) => release.name).join(", ")}.`, { names: refused.length });
-		const dependencies = [...declared.runtime, ...declared.development];
-		const pins = [];
-		for (let index = 0; index < releases.length; index += 1) {
-			const release = releases[index];
-			const dependency = dependencies[index];
-			if (release === void 0 || dependency === void 0) throw new ScaffoldError("FETCH", "The release answer has no matching declaration.");
-			if (release.lookup !== "found") throw new ScaffoldError("FETCH", `The registry named no release for ${release.name}.`);
-			pins.push({
-				name: dependency.name,
-				range: `^${release.latest}`
-			});
-		}
-		if (pins.length !== dependencies.length) throw new ScaffoldError("FETCH", "The release answer does not match the declaration set.");
-		return {
-			runtime: pins.slice(0, declared.runtime.length),
-			development: pins.slice(declared.runtime.length)
-		};
+		return mergeResults(materializer.mirror(mirrors, target), materializer.catalog(entries, target));
 	}
 	#compile(blueprint, groups) {
 		const compiler = new Compiler();
@@ -1259,8 +1758,8 @@ var CLI = class CLI {
 		const global = resolveContainedPath(target, GLOBAL_SETUP_PATH);
 		const showcase = resolveContainedPath(target, SHOWCASE_CONFIG_PATH);
 		return createBlueprint(declared.slice(declared.lastIndexOf("/") + 1), {
-			src: this.#probe(target, "src"),
-			app: this.#probe(target, "app"),
+			src: targetToEnvironments(target, "src"),
+			app: targetToEnvironments(target, "app"),
 			dependencies: manifestToDependencies(manifest).runtime,
 			bin: bin !== void 0 && isExactCaseFile(bin),
 			setup: tests !== void 0 && listFiles(tests).some((path) => {
@@ -1276,128 +1775,6 @@ var CLI = class CLI {
 			showcase: showcase !== void 0 && isExactCaseFile(showcase)
 		});
 	}
-	#invocations(script) {
-		const tokens = [];
-		let value = "";
-		let resolved = true;
-		let started = false;
-		let quote;
-		for (let index = 0; index < script.length; index += 1) {
-			const character = script[index];
-			if (character === void 0) return void 0;
-			if (quote === void 0) {
-				if (/\s/.test(character)) {
-					if (started) tokens.push({
-						value,
-						resolved
-					});
-					value = "";
-					resolved = true;
-					started = false;
-					continue;
-				}
-				if (";&|()".includes(character)) {
-					if (started) tokens.push({
-						value,
-						resolved
-					});
-					const paired = script[index + 1] === character && (character === "&" || character === "|");
-					tokens.push({
-						value: paired ? `${character}${character}` : character,
-						resolved: true
-					});
-					value = "";
-					resolved = true;
-					started = false;
-					if (paired) index += 1;
-					continue;
-				}
-				if (character === "\"" || character === "'") {
-					quote = character;
-					started = true;
-					continue;
-				}
-				if (character === "\\") {
-					const escaped = script[index + 1];
-					if (escaped === void 0) return void 0;
-					value += escaped;
-					started = true;
-					index += 1;
-					continue;
-				}
-				if (character === "$" || character === "`" || character === "%") resolved = false;
-				value += character;
-				started = true;
-				continue;
-			}
-			if (character === quote) {
-				quote = void 0;
-				continue;
-			}
-			if (character === "\\" && quote === "\"") {
-				const escaped = script[index + 1];
-				if (escaped === void 0) return void 0;
-				value += escaped;
-				index += 1;
-				continue;
-			}
-			if (quote === "\"" && (character === "$" || character === "`" || character === "%")) resolved = false;
-			value += character;
-			started = true;
-		}
-		if (quote !== void 0) return void 0;
-		if (started) tokens.push({
-			value,
-			resolved
-		});
-		const projects = [];
-		const scripts = [];
-		for (let index = 0; index < tokens.length; index += 1) {
-			const token = tokens[index];
-			if (token === void 0) return void 0;
-			if (token.value === "npm" && tokens[index + 1]?.value === "run") {
-				const name = tokens[index + 2];
-				if (name === void 0 || !name.resolved || name.value.length === 0 || [
-					"&&",
-					"||",
-					";",
-					"|",
-					"&",
-					"(",
-					")"
-				].includes(name.value)) return void 0;
-				scripts.push(name.value);
-				index += 2;
-				continue;
-			}
-			if (token.value === "--project") {
-				const project = tokens[index + 1];
-				if (project === void 0 || !project.resolved || project.value.length === 0 || [
-					"&&",
-					"||",
-					";",
-					"|",
-					"&",
-					"(",
-					")"
-				].includes(project.value)) return void 0;
-				projects.push(project.value);
-				index += 1;
-				continue;
-			}
-			if (token.value.startsWith("--project=")) {
-				const project = token.value.slice(10);
-				if (!token.resolved || project.length === 0) return void 0;
-				projects.push(project);
-				continue;
-			}
-			if (!token.resolved && token.value.includes("--project")) return void 0;
-		}
-		return {
-			projects,
-			scripts
-		};
-	}
 	#projectQuestion(target, blueprint, writing = false) {
 		const text = this.#manifest(target);
 		const manifest = replaceManifestScripts(text, blueprintToWritableScripts(blueprint)) ?? text;
@@ -1410,7 +1787,7 @@ var CLI = class CLI {
 		let unresolved = false;
 		for (const script of Object.values(scripts)) {
 			if (!isString(script) || !script.includes("vitest")) continue;
-			const invoked = this.#invocations(script);
+			const invoked = scriptToInvocations(script);
 			if (invoked === void 0) {
 				unresolved = true;
 				continue;
@@ -1434,7 +1811,7 @@ var CLI = class CLI {
 		const expectedLines = /* @__PURE__ */ new Map();
 		for (const [name, script] of Object.entries(expected)) {
 			if (!name.startsWith("test:")) continue;
-			const invoked = this.#invocations(script);
+			const invoked = scriptToInvocations(script);
 			if (invoked === void 0) continue;
 			for (const project of invoked.projects) {
 				if (project === "probe") continue;
@@ -1452,7 +1829,7 @@ var CLI = class CLI {
 			visited.add(name);
 			const script = scripts[name];
 			if (!isString(script)) continue;
-			const invoked = this.#invocations(script);
+			const invoked = scriptToInvocations(script);
 			if (invoked === void 0) {
 				unresolved = true;
 				continue;
@@ -1594,27 +1971,9 @@ var CLI = class CLI {
 		if (manifest === void 0) throw new ScaffoldError("TARGET", `The target at ${target} carries no readable manifest.`, { target });
 		return manifest;
 	}
-	#probe(target, axis) {
-		return ENVIRONMENTS.filter((environment) => {
-			const full = resolveContainedPath(target, `${axis}/${environment}`);
-			return full !== void 0 && isPhysicalDirectory(full);
-		});
-	}
-	#previous(target) {
-		const text = readFileText(target, CATALOG_AGENT_PATH);
-		if (text === void 0) return [];
-		const names = [];
-		for (const table of createMarkdown(text).filter(isTableNode)) for (const row of table.rows) {
-			const [cell] = row;
-			if (cell === void 0) continue;
-			const name = cell.map(flattenText).join("").trim();
-			if (DEPENDENCY_NAME_PATTERN.test(name)) names.push(name);
-		}
-		return names;
-	}
 	#worktree(target) {
-		const tracked = this.#inventory(target, ["ls-files", "-z"]);
-		const dirty = this.#inventory(target, [
+		const tracked = readGitRecords(target, ["ls-files", "-z"]);
+		const dirty = readGitRecords(target, [
 			"status",
 			"--porcelain=v1",
 			"--untracked-files=all",
@@ -1631,47 +1990,6 @@ var CLI = class CLI {
 		});
 		return state;
 	}
-	#inventory(target, args) {
-		const result = executeSync({
-			file: "git",
-			arguments: [...args]
-		}, {
-			workspace: target,
-			limit: MAX_MANIFEST_BYTES,
-			strict: false
-		});
-		if (result.failed) throw new ScaffoldError("TARGET", `The target at ${target} is not a git repository.`, { target });
-		return result.stdout.split("\0").filter((record) => record.length > 0);
-	}
-	#environments(selection, axis) {
-		if (selection === void 0) return [];
-		const requested = selection.split(",");
-		const refused = requested.filter((name) => !ENVIRONMENTS.some((environment) => environment === name));
-		if (refused.length > 0) throw new UsageError(`'--${axis}' does not take ${refused.join(", ")}. It takes ${ENVIRONMENTS.join(", ")}.`);
-		return ENVIRONMENTS.filter((environment) => requested.includes(environment));
-	}
-	#groups(selection) {
-		if (selection === void 0) return void 0;
-		const requested = selection.split(",");
-		const refused = requested.filter((name) => !GROUPS.some((group) => group === name));
-		if (refused.length > 0) throw new UsageError(`'--groups' does not take ${refused.join(", ")}. It takes ${GROUPS.join(", ")}.`);
-		return GROUPS.filter((group) => requested.includes(group));
-	}
-	#packages(selection) {
-		if (selection === void 0) return [];
-		const requested = selection.split(",");
-		const refused = requested.filter((name) => !DEPENDENCY_NAME_PATTERN.test(name));
-		if (refused.length > 0) throw new UsageError(`'--deps' does not take ${refused.join(", ")}. Every name is a published @orkestrel package.`);
-		return requested;
-	}
-	#merge(first, second) {
-		return {
-			target: first.target,
-			written: [...first.written, ...second.written],
-			skipped: [...first.skipped, ...second.skipped],
-			removed: [...first.removed, ...second.removed]
-		};
-	}
 	#reportBaselines(provenance) {
 		const baselines = [];
 		if (provenance.versions !== void 0) baselines.push(`versions=${provenance.versions}`);
@@ -1714,8 +2032,8 @@ var CLI = class CLI {
 			if (finding.drift !== "stale") continue;
 			const current = terminal.get(finding.path);
 			if (current?.drift !== "aligned" || current.observed === void 0) continue;
-			const previousLines = Buffer.from(finding.observed, "hex").toString("utf8").split(/\r\n|\r|\n/u).length;
-			const delta = Buffer.from(current.observed, "hex").toString("utf8").split(/\r\n|\r|\n/u).length - previousLines;
+			const previousLines = Buffer.from(finding.observed, "hex").toString("utf8").split(/\r\n|\n/u).length;
+			const delta = Buffer.from(current.observed, "hex").toString("utf8").split(/\r\n|\n/u).length - previousLines;
 			if (delta === 0) {
 				this.#say(`${finding.path} replaced (0-line delta).`);
 				continue;
@@ -1725,13 +2043,10 @@ var CLI = class CLI {
 		}
 	}
 	#recount(result) {
-		this.#say(this.#tally(result));
+		this.#say(resultToTally(result));
 		this.#say(`${String(result.entries.length)} published, ${String(result.mirrors.filter((mirror) => mirror.lookup === "found").length)} guide${result.mirrors.length === 1 ? "" : "s"} fetched, ${String(result.dropped.length)} no longer listed.`);
 		for (const mirror of result.mirrors) if (mirror.lookup !== "found") this.#warn(`${mirror.name}: ${mirror.note}`);
 	}
-	#tally(result) {
-		return `${String(result.written.length)} written, ${String(result.skipped.length)} unchanged, ${String(result.removed.length)} removed in ${result.target}.`;
-	}
 	#report(value) {
 		this.#say(JSON.stringify(value));
 	}
@@ -1742,13 +2057,10 @@ var CLI = class CLI {
 		return isUsageError(error) ? 2 : 1;
 	}
 	#say(line) {
-		this.#output(this.#sanitize(line));
+		this.#output(sanitizeLine(line));
 	}
 	#warn(line) {
-		this.#diagnostic(this.#sanitize(line));
-	}
-	#sanitize(line) {
-		return stripControls(strip(line)).split(/\r?\n/).join(" ");
+		this.#diagnostic(sanitizeLine(line));
 	}
 };
 //#endregion