@orkestrel/scaffold 0.0.63 → 0.0.65

package/dist/src/core/index.cjs

@@ -4,8 +4,8 @@ let _orkestrel_template = require("@orkestrel/template");
 let _orkestrel_emitter = require("@orkestrel/emitter");
 var package_default = {
 	name: "@orkestrel/scaffold",
-	version: "0.0.63",
-	description: "Scaffold workspaces with five commands: new, audit, repair, catalog, and overwrite.",
+	version: "0.0.65",
+	description: "Scaffold workspaces with commands: new, audit, repair, catalog, and overwrite.",
 	keywords: [
 		"audit",
 		"catalog",
@@ -74,7 +74,7 @@ var package_default = {
 		"test:src:bin": "vitest run --config vite.config.ts --no-cache --reporter=dot --project src:bin",
 		"test:policy": "vitest run --config vite.config.ts --no-cache --reporter=dot --project policy",
 		"test:config": "vitest run --config vite.config.ts --no-cache --reporter=dot --project config",
-		"test:guides": "vitest run --config vite.config.ts --no-cache --reporter=dot --project guides",
+		"test:guides": "node --experimental-strip-types tests/guides.test.ts",
 		"test:distribution": "vitest run --config vite.config.ts --no-cache --reporter=dot --project distribution",
 		"test:probe": "vitest run --config vite.config.ts --no-cache --reporter=verbose --project probe",
 		"test:bench": "vitest bench --config vite.config.ts --no-cache --project probe",
@@ -90,30 +90,29 @@ var package_default = {
 		"prepublishOnly": "npm run format:check && npm run lint:check && npm run check && npm run build && npm test && npm run test:distribution -- --mode release"
 	},
 	dependencies: {
-		"@orkestrel/console": "^0.0.12",
-		"@orkestrel/contract": "^0.0.16",
-		"@orkestrel/emitter": "^0.0.9",
-		"@orkestrel/markdown": "^0.0.13",
-		"@orkestrel/process": "^0.0.10",
-		"@orkestrel/template": "^0.0.6"
+		"@orkestrel/console": "^0.0.13",
+		"@orkestrel/contract": "^0.0.17",
+		"@orkestrel/emitter": "^0.0.10",
+		"@orkestrel/markdown": "^0.0.14",
+		"@orkestrel/process": "^0.0.11",
+		"@orkestrel/template": "^0.0.7"
 	},
 	devDependencies: {
 		"@microsoft/api-extractor": "^7.59.0",
-		"@orkestrel/guide": "^0.0.17",
-		"@orkestrel/html": "^0.0.8",
-		"@orkestrel/probe": "^0.0.12",
-		"@orkestrel/test": "^0.0.13",
-		"@types/node": "^26.4.0",
+		"@orkestrel/guide": "^0.0.18",
+		"@orkestrel/html": "^0.0.9",
+		"@orkestrel/probe": "^0.0.13",
+		"@orkestrel/test": "^0.0.14",
+		"@types/node": "^26.5.0",
 		"@vitest/browser-playwright": "^4.1.11",
-		"oxfmt": "^0.65.0",
-		"oxlint": "^1.80.0",
-		"playwright": "^1.62.1",
+		"oxfmt": "^0.67.0",
+		"oxlint": "^1.82.0",
+		"playwright": "^1.63.0",
 		"typescript": "^6.0.3",
 		"vite": "^8.2.2",
-		"vite-plugin-dts": "^5.0.3",
 		"vitest": "^4.1.11"
 	},
-	engines: { "node": ">=22.12.0" }
+	engines: { "node": ">=22.18.0" }
 };
 //#endregion
 //#region src/core/constants.ts
@@ -213,10 +212,11 @@ var BIN_ENTRY_PATH = "src/bin/main.ts";
 * @remarks
 * These are the files the fleet shares verbatim, and each target holds a copy
 * of the paths it selects: the licence, the harness permission file, the
-* session-start hooks, the shared policy register, the shared policy proof,
-* the shared policy plugin, the shared configuration leaf and its proof, the
-* byte-identical root dotfiles, and the guide mirrors a generated workspace
-* starts from. A directory entry vendors everything beneath it.
+* session-start hooks, the shared policy
+* register, the shared policy proof, the shared policy plugin, the shared
+* configuration leaf and its proof, the byte-identical root dotfiles, and the
+* guide mirrors a generated workspace starts from. A directory entry vendors
+* everything beneath it.
 *
 * A plan carries the subset its target selects, which is why the list is a
 * candidate set rather than a plan: a workspace never mirrors its own guide.
@@ -225,16 +225,13 @@ var BIN_ENTRY_PATH = "src/bin/main.ts";
 * its rules, its skills, its agent roles, its bench configuration, and its MCP
 * registrations from {@link CANON_PATHS} inside the installed package, so no
 * file scaffold leaves in a target names a path the target does not hold.
-* `nameToHostArtifacts` appends {@link CATALOG_AGENT_PATH} to what this list
+* `blueprintToHostArtifacts` appends {@link CATALOG_AGENT_PATH} to what this list
 * selects, which is what keeps the list itself disjoint from the canon.
 */
 var HOST_PATHS = Object.freeze([
 	"LICENSE",
 	".claude/settings.json",
-	"scripts/deps.sh",
-	"scripts/cursor.sh",
-	"scripts/codex.sh",
-	"scripts/ollama.sh",
+	"scripts",
 	"tests/setupPolicy.ts",
 	"tests/policy.test.ts",
 	"tests/config.test.ts",
@@ -273,7 +270,7 @@ var HOST_PATHS = Object.freeze([
 *
 * The plan claims paths inside the canon deliberately, and each has a reason.
 * `blueprintToDocumentArtifacts` claims `AGENTS.md` and `CLAUDE.md` as this
-* package's own template pointers. `nameToHostArtifacts` claims
+* package's own template pointers. `blueprintToHostArtifacts` claims
 * {@link CATALOG_AGENT_PATH}, because the catalog verb refuses a target that
 * lacks the file and repair restores its absence.
 *
@@ -347,19 +344,19 @@ var ORCHESTRATION_PATH_PREFIXES = Object.freeze([
 	"scripts/"
 ]);
 /**
-* Lists the exact root filenames that wire an agent bench rather than the toolchain, frozen.
+* Lists the exact root paths that wire an agent bench or own an orchestration directory, frozen.
 *
 * @remarks
-* `.mcp.json` registers MCP servers for the harness. It sits among the root
-* dotfiles but governs agents, so it groups with the harness bridges.
+* `.mcp.json` registers MCP servers for the harness. `scripts` is the owned
+* directory whose members wire the development environment.
 */
-var ORCHESTRATION_PATH_NAMES = Object.freeze([".mcp.json"]);
+var ORCHESTRATION_PATH_NAMES = Object.freeze([".mcp.json", "scripts"]);
 /**
 * Names the agent file whose marker-bounded package table the catalog verb alone owns.
 *
 * @remarks
 * A plan claims it at a canon path, because the catalog verb refuses a target
-* that lacks the file. `nameToHostArtifacts` appends it to the vendored
+* that lacks the file. `blueprintToHostArtifacts` appends it to the vendored
 * selection, and it reaches a release through the `.claude/agents` directory in
 * {@link CANON_PATHS} rather than through {@link HOST_PATHS}, which is what
 * keeps the two lists disjoint.
@@ -387,11 +384,11 @@ var CATALOG_OPENING_MARKER = "<!-- orkestrel:catalog -->";
 * refused rather than rewritten.
 */
 var CATALOG_CLOSING_MARKER = "<!-- /orkestrel:catalog -->";
-/** Names the provisioner skeleton a workspace with declared service vendors is given once. */
+/** Names the inventory skeleton a workspace with declared service vendors is given once. */
 var SERVICE_SCRIPT_PATH = "scripts/service.sh";
 /** Names the shared Vitest global-setup module whose presence makes a workspace `global`. */
 var GLOBAL_SETUP_PATH = "tests/setupGlobal.ts";
-/** Names the guide-parity proof whose presence selects the planned `guides` project. */
+/** Names the package-owned guide-parity entry used by `test:guides` and to select the `guides` project. */
 var GUIDES_TEST_PATH = "tests/guides.test.ts";
 /** Names the generated packed-package proof every publishing workspace is planned at. */
 var DISTRIBUTION_TEST_PATH = "tests/distribution.test.ts";
@@ -530,11 +527,29 @@ var MAX_MANIFEST_BYTES = 1048576;
 /** Caps the bytes retained across one whole plan or audit. */
 var MAX_TOTAL_ARTIFACT_BYTES = 104857600;
 /** Names the oldest Node version the generated toolchain supports. */
-var MINIMUM_NODE_VERSION = "22.12.0";
+var MINIMUM_NODE_VERSION = "22.18.0";
+/** Names the oldest npm version the generated toolchain supports. */
+var MINIMUM_NPM_VERSION = "11.6.0";
 /** Names the version a workspace starts at. */
 var DEFAULT_VERSION = "0.0.1";
 /** Names the `engines.node` range a workspace starts with. */
 var DEFAULT_ENGINES = `>=${MINIMUM_NODE_VERSION}`;
+/**
+* Holds the `devEngines` record every generated manifest carries.
+*
+* @remarks
+* Every generated manifest names npm at the {@link MINIMUM_NPM_VERSION} floor with the `onFail`
+* key set to the `error` value, and no blueprint field varies that record. An npm at 10.9.0 or
+* later reads the `devEngines` record. Such an npm earlier than the floor refuses an install in a
+* generated workspace rather than resolving its dependency graph.
+* The neighbouring `DEFAULT_ENGINES` constant is the Node range, and a blueprint's `engines`
+* field does replace that one.
+*/
+var WORKSPACE_DEV_ENGINES = Object.freeze({ packageManager: Object.freeze({
+	name: "npm",
+	version: `>=${MINIMUM_NPM_VERSION}`,
+	onFail: "error"
+}) });
 /** Holds the tooling versions scaffold and every generated workspace share. */
 var BASE_DEV_DEPENDENCIES = Object.freeze({
 	"@orkestrel/guide": package_default.devDependencies["@orkestrel/guide"],
@@ -549,13 +564,13 @@ var BASE_DEV_DEPENDENCIES = Object.freeze({
 	vitest: package_default.devDependencies.vitest
 });
 /**
-* Lists the development dependencies that emit declarations for published source or an
-* executable.
+* Lists the development dependencies that roll declarations up for published source.
+*
+* @remarks
+* The toolchain runs the compiler it already installs as a command, emitting one declaration per
+* module, and the extractor rolls that emit into the single file each published face ships.
 */
-var DECLARATION_DEV_DEPENDENCIES = Object.freeze({
-	"@microsoft/api-extractor": package_default.devDependencies["@microsoft/api-extractor"],
-	"vite-plugin-dts": package_default.devDependencies["vite-plugin-dts"]
-});
+var DECLARATION_DEV_DEPENDENCIES = Object.freeze({ "@microsoft/api-extractor": package_default.devDependencies["@microsoft/api-extractor"] });
 /** Lists the development dependencies a published browser `src` environment adds. */
 var SOURCE_BROWSER_DEV_DEPENDENCIES = Object.freeze({
 	"@vitest/browser-playwright": package_default.devDependencies["@vitest/browser-playwright"],
@@ -896,9 +911,10 @@ export function appBrowser(): UserConfig {
 		setupFiles: ['./tests/setup.ts'],
 		environment: 'node',
 		browser: { enabled: false },
-		// A config test validates every target wrapper and runs the real linter twice with
-		// 15-second child caps, so this budget clears both caps and reports their diagnostics.
-		testTimeout: 45_000,
+		// A config test validates every target wrapper, spawns the real linter twice under
+		// 15-second child caps, and rolls one face up through the compiler and the extractor it
+		// spawns, so this budget clears the capped pair with room for a contended host.
+		testTimeout: 60_000,
 	},
 })
 `,
@@ -938,9 +954,9 @@ export const conformance = (): UserConfig => ({
 	},
 })
 `,
-		service: `// The live external services this package drives. It starts nothing itself:
-// \`scripts/service.sh\` provisions, \`tests/setupService.ts\` proves readiness, and
-// the project stays out of \`npm test\` because a real service answers it.
+		service: `// The caller prepares the live external services before this project.
+// \`tests/setupService.ts\` verifies readiness, and the project stays out of \`npm test\`
+// because a real service answers it.
 export const service = (): UserConfig => ({
 	resolve,
 	test: {
@@ -1124,8 +1140,7 @@ export const probe = (): UserConfig => ({
 	vites: Object.freeze({
 		src: Object.freeze({
 			core: `import { defineConfig, mergeConfig } from 'vite'
-import dts from 'vite-plugin-dts'
-import { environmentBoundary, outputBoundary } from '../helpers.js'
+import { declarationRollup, environmentBoundary, outputBoundary } from '../helpers.js'
 import { peers, srcCore, resolveWorkspacePath } from '../../vite.config.ts'
 
 export default defineConfig(
@@ -1134,17 +1149,9 @@ export default defineConfig(
 		plugins: [
 			outputBoundary('dist/src/core'),
 			environmentBoundary('src/core'),
-			dts({
-				tsconfigPath: resolveWorkspacePath('configs/src/tsconfig.core.json'),
-				bundleTypes: {
-					extractorConfig: {
-						compiler: {
-							overrideTsconfig: {
-								compilerOptions: { types: ['node'] },
-							},
-						},
-					},
-				},
+			declarationRollup({
+				project: resolveWorkspacePath('configs/src/tsconfig.core.json'),
+				types: ['node'],
 			}),
 		],
 		build: {
@@ -1165,49 +1172,34 @@ export default defineConfig(
 )
 `,
 			browser: `import { defineConfig, mergeConfig } from 'vite'
-import dts from 'vite-plugin-dts'
+import { declarationRollup, rewriteCoreSpecifier } from '../helpers.js'
 import { srcBrowser, resolveWorkspacePath } from '../../vite.config.ts'
 
-// vite-plugin-dts rolls this face into one declaration, and the roll-up reaches
-// src/core through a relative source path the tarball does not carry. The path
-// keeps each source module's own depth, so a module in a browser subfolder emits
-// one that leaves dist/src entirely. The following rewrite externalizes core
-// through the package's own published root export, on the final roll-up only.
+// The roll-up reaches src/core through a specifier the tarball does not carry, so the rewrite
+// externalizes core through the package's own published root export, on the final roll-up alone.
 export default defineConfig(
 	mergeConfig(srcBrowser(), {
 		plugins: [
-			dts({
-				tsconfigPath: resolveWorkspacePath('configs/src/tsconfig.browser.json'),
-				bundleTypes: true,
-				beforeWriteFile: (path, content) => ({
-					content: /[\\\\/]dist[\\\\/]src[\\\\/]browser[\\\\/]index\\.d\\.ts$/.test(path)
-{{replacement}}
-						: content,
-				}),
+			declarationRollup({
+				project: resolveWorkspacePath('configs/src/tsconfig.browser.json'),
+				rewrite: rewriteCoreSpecifier,
 			}),
 		],
 	}),
 )
 `,
 			server: `import { defineConfig, mergeConfig } from 'vite'
-import dts from 'vite-plugin-dts'
+import { declarationRollup, rewriteCoreSpecifier } from '../helpers.js'
 import { srcServer, resolveWorkspacePath } from '../../vite.config.ts'
 
-// vite-plugin-dts rolls this face into one declaration, and the roll-up reaches
-// src/core through a relative source path the tarball does not carry. The
-// following rewrite externalizes core through the package's own published root
-// export, on the final roll-up only.
+// The roll-up reaches src/core through a specifier the tarball does not carry, so the rewrite
+// externalizes core through the package's own published root export, on the final roll-up alone.
 export default defineConfig(
 	mergeConfig(srcServer(), {
 		plugins: [
-			dts({
-				tsconfigPath: resolveWorkspacePath('configs/src/tsconfig.server.json'),
-				bundleTypes: true,
-				beforeWriteFile: (path, content) => ({
-					content: /[\\\\/]dist[\\\\/]src[\\\\/]server[\\\\/]index\\.d\\.ts$/.test(path)
-{{replacement}}
-						: content,
-				}),
+			declarationRollup({
+				project: resolveWorkspacePath('configs/src/tsconfig.server.json'),
+				rewrite: rewriteCoreSpecifier,
 			}),
 		],
 	}),
@@ -1644,14 +1636,20 @@ import {
 	statSync,
 	writeFileSync,
 } from 'node:fs'
-{{transport}}import { tmpdir } from 'node:os'
+{{transport}}import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
 import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
-{{launcher}}import ts from 'typescript'
-import { afterAll, describe, expect, it } from 'vitest'
+{{launcher}}import { afterAll, describe, expect, it } from 'vitest'
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
 const NPM = process.platform === 'win32' ? 'npm.cmd' : 'npm'
+// The compiler this workspace installs, run as a command rather than called in
+// process: the command and its plain-text diagnostics are the same across the
+// compiler majors this toolchain supports, and its in-process API is not. It is
+// resolved from the workspace under proof, so a consumer of the packed artifact is
+// checked by the same compiler that workspace's own \`check\` script runs.
+const TSC = createRequire(join(ROOT, 'package.json')).resolve('typescript/bin/tsc')
 // Windows needs a shell to launch a \`.cmd\`: Node refuses one directly since the
 // batch-argument hardening, and \`spawnSync\` returns \`EINVAL\` with a null status
 // rather than an exit code a caller can read. Every following argument is a literal or
@@ -1668,6 +1666,12 @@ const RELEASE = import.meta.env.MODE === 'release'
 // Node and the miss is silent.
 const BROWSER_OUTPUT = './dist/src/browser/'
 const ABSENT_SUBPATH = '/no-subpath-is-published-under-this-name'
+// A compiler diagnostic that says where it is: the path relative to the directory
+// the compiler ran in, the 1-based line and column, the code, and the message. The
+// diagnostics are the verdict rather than the exit code, which differs between the
+// compiler majors this toolchain supports, so a reported line matching nothing here
+// came from something other than a check of a consumer module.
+const DIAGNOSTIC_PATTERN = /^(.+?)\\(\\d+,\\d+\\): error TS\\d+: /u
 const PING = ['ping', '--fetch-retries=0', '--fetch-timeout=5000', '--loglevel=silent']
 const ESM_DRIVER = 'drive.mjs'
 const CJS_DRIVER = 'drive.cjs'
@@ -1713,8 +1717,8 @@ const DECLARATION_CONDITIONS = Object.freeze({
 
 interface Resolution {
 	readonly label: string
-	readonly resolution: ts.ModuleResolutionKind
-	readonly module: ts.ModuleKind
+	readonly resolution: string
+	readonly module: string
 	readonly conditions: Readonly<Record<Format, readonly string[]>>
 }
 
@@ -1722,51 +1726,61 @@ interface TargetResolution {
 	readonly target: string
 }
 
-// Each compile driver carries the conditions TypeScript applies for its resolution
-// and importing format. A \`require\`-only subpath therefore stays in each CommonJS
-// probe that can resolve it.
+// Each compile driver carries the compiler options its scratch project sets and
+// the conditions TypeScript applies for that resolution and importing format. A
+// \`require\`-only subpath therefore stays in each CommonJS probe that can resolve it.
+// The option values are the spellings the project file takes, so nothing here needs
+// the compiler's own API to name them.
 const RESOLUTIONS: readonly Resolution[] = [
 	{
 		label: 'node16',
-		resolution: ts.ModuleResolutionKind.Node16,
-		module: ts.ModuleKind.Node16,
+		resolution: 'node16',
+		module: 'node16',
 		conditions: DECLARATION_CONDITIONS,
 	},
 	{
 		label: 'nodenext',
-		resolution: ts.ModuleResolutionKind.NodeNext,
-		module: ts.ModuleKind.NodeNext,
+		resolution: 'nodenext',
+		module: 'nodenext',
 		conditions: DECLARATION_CONDITIONS,
 	},
 	{
 		label: 'bundler',
-		resolution: ts.ModuleResolutionKind.Bundler,
-		module: ts.ModuleKind.ESNext,
+		resolution: 'bundler',
+		module: 'esnext',
 		conditions: BUNDLER_CONDITIONS,
 	},
 ]
 
+// The driver a bundled consumer reads declarations under. A browser application
+// compiles through a bundler, so the browser drive answers under this one alone,
+// and naming it here is what keeps that selection tied to the driver it selects.
+const BROWSER_DRIVER = RESOLUTIONS.find((candidate) => candidate.label === 'bundler')
+if (BROWSER_DRIVER === undefined) throw new Error("RESOLUTIONS carries no 'bundler' row")
+
 const FORMATS: ReadonlyArray<readonly [extension: string, format: Format]> = [
 	['ts', 'module'],
 	['cts', 'commonjs'],
 ]
 
 // One published subpath, resolved to what this proof can drive: the specifier a
-// consumer writes, the declarations its consumer formats name, whether its target
-// is a browser bundle, and whether it answers \`import\` and \`require\` at all.
+// consumer writes, whether the declarations its consumer formats resolve at all,
+// whether the exports map answers the browser condition with a target of its own,
+// whether it answers \`import\` and \`require\` at all, and whether the target that
+// \`require\` answers with is one that a CommonJS consumer loads.
 interface Entry {
 	readonly subpath: string
 	readonly specifier: string
 	readonly mapping: unknown
 	readonly declaration: {
-		readonly module: string | undefined
-		readonly commonjs: string | undefined
-		readonly browser: string | undefined
+		readonly importable: boolean
+		readonly requirable: boolean
+		readonly browsable: boolean
 	}
-	readonly browser: boolean
-	readonly module: boolean
-	readonly commonjs: boolean
-	readonly required: boolean
+	readonly browsable: boolean
+	readonly importable: boolean
+	readonly requirable: boolean
+	readonly loadable: boolean
 }
 
 // The installed tree every claim is read from. Every subpath the exports map names
@@ -2019,7 +2033,14 @@ function isDeclaration(target: string): boolean {
 // against. Each field uses the conditions of the TypeScript consumer paired with
 // that runtime. A JavaScript target resolves through TypeScript's adjacent
 // declaration substitution rather than standing in for the declaration itself.
-function readDeclaration(entry: unknown, installed: string): Entry['declaration'] {
+function readDeclaration(
+	entry: unknown,
+	installed: string,
+): {
+	readonly module: string | undefined
+	readonly commonjs: string | undefined
+	readonly browser: string | undefined
+} {
 	return {
 		module: resolveDeclaration(entry, DECLARATION_CONDITIONS.module, installed),
 		commonjs: resolveDeclaration(entry, DECLARATION_CONDITIONS.commonjs, installed),
@@ -2032,72 +2053,137 @@ function selectEntries(entries: readonly Entry[], conditions: readonly string[])
 	return entries.filter(
 		(entry) =>
 			resolveTarget(entry.mapping, conditions) !== undefined &&
-			(!conditions.includes('require') || entry.commonjs),
+			(!conditions.includes('require') || entry.loadable),
+	)
+}
+
+// The compile drivers whose conditions reach one entry under one importing format.
+// A driver that resolves no target for that entry compiles nothing, so a consumer
+// written under it would report a resolution failure this package never made.
+function selectDrivers(entry: Entry, format: Format): readonly Resolution[] {
+	return RESOLUTIONS.filter(
+		(driver) => selectEntries([entry], driver.conditions[format]).length > 0,
 	)
 }
 
-// Require-loadable entries that declare CommonJS support but a typed CommonJS
-// consumer cannot compile against. A default branch resolving under the require
-// condition set makes no CommonJS claim.
+// Requirable entries that declare CommonJS support but a typed CommonJS consumer
+// cannot compile against. A default branch resolving under the require condition
+// set makes no CommonJS claim.
 function selectUntypable(entries: readonly Entry[], installed: string): readonly Entry[] {
 	return entries.filter(
 		(entry) =>
-			entry.required &&
+			entry.requirable &&
 			isRecord(entry.mapping) &&
 			Object.hasOwn(entry.mapping, 'require') &&
 			!declaresCommonJS(entry.mapping, installed),
 	)
 }
 
-// The value exports a declaration publishes, read through the compiler's checker
-// over the module symbol rather than off the declaration text. An alias resolves to
-// what it names, so a re-export counts as the thing it re-exports, and a type-only
-// symbol is dropped because no runtime publishes one.
-function readDeclaredExports(declaration: string): readonly string[] {
-	const program = ts.createProgram([declaration], {
-		module: ts.ModuleKind.ESNext,
-		moduleResolution: ts.ModuleResolutionKind.Bundler,
-		noEmit: true,
-		skipLibCheck: true,
-		target: ts.ScriptTarget.ESNext,
-	})
-	const source = program.getSourceFile(declaration)
-	if (source === undefined) throw new Error(\`The declaration \${declaration} was not read\`)
-	const checker = program.getTypeChecker()
-	const symbol = checker.getSymbolAtLocation(source)
-	if (symbol === undefined) throw new Error(\`\${declaration} declares no module symbol\`)
-	const values: string[] = []
-	for (const exported of checker.getExportsOfModule(symbol)) {
-		const direct = (exported.flags & ts.SymbolFlags.Alias) === 0
-		const resolved = direct ? exported : checker.getAliasedSymbol(exported)
-		if ((resolved.flags & ts.SymbolFlags.Value) !== 0) values.push(exported.getName())
+// One surface comparison, written as the consumer module that proves it: the
+// installed entry that consumer imports, the file extension fixing its importing
+// format, the names a real runtime published off it, and the driver whose scratch
+// project compiles it.
+interface Surface {
+	readonly entry: Entry
+	readonly extension: string
+	readonly published: readonly string[]
+	readonly driver: Resolution
+}
+
+// A scratch project over named consumer modules, written beside them so their own
+// resolution reaches the installed package. Nothing is emitted and no ambient types
+// are pulled in, so what the check reads is the installed declarations alone.
+function writeProject(
+	stage: Stage,
+	name: string,
+	driver: Resolution,
+	files: readonly string[],
+): string {
+	const path = join(stage.consumer, \`tsconfig.\${name}.json\`)
+	const project = {
+		compilerOptions: {
+			module: driver.module,
+			moduleResolution: driver.resolution,
+			noEmit: true,
+			skipLibCheck: true,
+			strict: true,
+			target: 'esnext',
+			types: [],
+		},
+		files: [...files],
 	}
-	return [...values].sort()
+	writeFile(path, \`\${JSON.stringify(project, undefined, '\\t')}\\n\`)
+	return path
 }
 
-// The diagnostics a consumer compiling against the installed declarations reports,
-// flattened to their messages so a failure names what the consumer could not do.
-function compileConsumer(
-	entry: string,
-	resolution: ts.ModuleResolutionKind,
-	module: ts.ModuleKind,
-): readonly string[] {
-	const program = ts.createProgram([entry], {
-		module,
-		moduleResolution: resolution,
-		noEmit: true,
-		skipLibCheck: true,
-		strict: true,
-		target: ts.ScriptTarget.ESNext,
-	})
-	return ts
-		.getPreEmitDiagnostics(program)
-		.map((diagnostic) => ts.flattenDiagnosticMessageText(diagnostic.messageText, ' '))
+// The diagnostics the compiler this workspace installs reports for one scratch
+// project. The compiler runs as a command, so nothing here reaches an API that
+// moves between its majors, and the located lines it prints are the verdict rather
+// than the exit code, which moves between them. A line carrying no location, a line
+// naming the scratch project rather than a consumer module, and anything at all on
+// the error stream are faults of this proof rather than of the package under proof,
+// so each is raised where it happens instead of counted against the package.
+function checkProject(stage: Stage, project: string): readonly string[] {
+	const result = runNode([TSC, '--noEmit', '--pretty', 'false', '-p', project], stage.consumer)
+	const refused = \`\${result.stderr ?? ''}\`.trim()
+	if (refused.length > 0) {
+		throw new Error(\`The consumer compiler wrote \${refused} to its error stream\`)
+	}
+	const reported: string[] = []
+	for (const line of \`\${result.stdout ?? ''}\`.split(/\\r\\n|\\n/u)) {
+		if (line.trim().length === 0) continue
+		const last = reported.at(-1)
+		// An elaborated diagnostic prints its detail on indented lines under its own
+		// first line, so each of those joins the diagnostic it elaborates.
+		if (/^\\s/u.test(line) && last !== undefined) {
+			reported[reported.length - 1] = \`\${last} \${line.trim()}\`
+			continue
+		}
+		const located = DIAGNOSTIC_PATTERN.exec(line)?.[1]
+		if (located === undefined) {
+			throw new Error(\`The consumer compiler reported \${line}, which names no location\`)
+		}
+		if (resolve(stage.consumer, located) === project) {
+			throw new Error(\`The scratch project is itself at fault: \${line}\`)
+		}
+		reported.push(line)
+	}
+	if (reported.length === 0 && result.status !== 0) {
+		throw new Error(\`The consumer compiler refused the project: \${readOutput(result)}\`)
+	}
+	return reported
+}
+
+// One installed entry's published names checked against its own declarations by
+// the compiler this workspace installs, in the direction each divergence surfaces
+// under. The runtime's key list is written into the consumer as a literal, so the
+// published side comes from a real process and the declared side from the
+// declarations that process's package ships, and the two can disagree. A name the
+// declarations carry and the runtime does not lands on \`declared\`. A name the
+// runtime carries and the declarations do not, and a name the declarations publish
+// as a type alone, land on \`surfaced\`: a variable widens into the type
+// \`declared\` annotates, and only \`surfaced\` reads the literal's own keys back.
+// Each names the member it is about, so the failure says which export moved.
+function checkSurface(stage: Stage, surface: Surface): readonly string[] {
+	const slug = surface.entry.subpath.replaceAll(/[^\\w]+/gu, '-')
+	const name = \`surface.\${surface.driver.label}\${slug}.\${surface.extension}\`
+	const module = \`\${name}\`
+	const keys = surface.published.map((key) => \`\${JSON.stringify(key)}: true\`).join(', ')
+	writeFile(
+		join(stage.consumer, module),
+		\`import * as entry from \${JSON.stringify(surface.entry.specifier)}
+const published = {\${keys.length === 0 ? '' : \` \${keys} \`}} as const
+const declared: Record<keyof typeof entry, true> = published
+const surfaced: Record<keyof typeof published, true> = declared
+\`,
+	)
+	const project = writeProject(stage, name, surface.driver, [\`./\${module}\`])
+	return checkProject(stage, project).map((line) => \`\${surface.driver.label}: \${line}\`)
 }
 
 // One consumer module importing every installed entry, written where its own
 // resolution finds the installed package.
-function writeConsumerProbe(stage: Stage, path: string, specifiers: readonly string[]): string {
+function writeConsumerProbe(stage: Stage, path: string, specifiers: readonly string[]): void {
 	const names: string[] = []
 	const bindings: string[] = []
 	for (const [index, specifier] of specifiers.entries()) {
@@ -2105,9 +2191,8 @@ function writeConsumerProbe(stage: Stage, path: string, specifiers: readonly str
 		names.push(binding)
 		bindings.push(\`import * as \${binding} from \${JSON.stringify(specifier)}\`)
 	}
-	const target = join(stage.consumer, path)
-	writeFile(target, \`\${bindings.join('\\n')}\\nexport const surface = [\${names.join(', ')}]\\n\`)
-	return target
+	const source = \`\${bindings.join('\\n')}\\nexport const surface = [\${names.join(', ')}]\\n\`
+	writeFile(join(stage.consumer, path), source)
 }
 
 // The runtime key set a real process reads off one installed entry under one
@@ -2177,27 +2262,26 @@ function buildStage(): Stage {
 			else excluded.push(subpath)
 			continue
 		}
-		const imported = resolveTarget(entry, RUNTIME_CONDITIONS.module)
-		const requiredTarget = resolveTarget(entry, RUNTIME_CONDITIONS.commonjs)
+		const importTarget = resolveTarget(entry, RUNTIME_CONDITIONS.module)
+		const requireTarget = resolveTarget(entry, RUNTIME_CONDITIONS.commonjs)
 		const browserTarget = resolveTarget(entry, RUNTIME_CONDITIONS.browser)
-		const browser = resolvesBrowser(entry)
-		const required = requiredTarget !== undefined && !(browser && requiredTarget === browserTarget)
-		const commonjs = required && resolvesCommonJS(entry, installed)
+		const browsable = resolvesBrowser(entry)
+		const shadowed = browsable && requireTarget === browserTarget
+		const requirable = requireTarget !== undefined && !shadowed
+		const loadable = requirable && resolvesCommonJS(entry, installed)
 		entries.push({
 			subpath,
 			specifier: subpath === '.' ? name : \`\${name}\${subpath.slice(1)}\`,
 			mapping: entry,
 			declaration: {
-				module: declaration.module === undefined ? undefined : join(installed, declaration.module),
-				commonjs:
-					declaration.commonjs === undefined ? undefined : join(installed, declaration.commonjs),
-				browser:
-					declaration.browser === undefined ? undefined : join(installed, declaration.browser),
+				importable: declaration.module !== undefined,
+				requirable: declaration.commonjs !== undefined,
+				browsable: declaration.browser !== undefined,
 			},
-			browser,
-			module: imported !== undefined && !(browser && imported === browserTarget),
-			commonjs,
-			required,
+			browsable,
+			importable: importTarget !== undefined && !(browsable && importTarget === browserTarget),
+			requirable,
+			loadable,
 		})
 	}
 	return { consumer, installed, archives, entries, subpaths, undeclared, excluded, targets }
@@ -2348,7 +2432,7 @@ describe('installed package consumer', () => {
 		// loads it. Each later drive retires itself for that entry, so this assertion names
 		// the subpath rather than counting it as driven.
 		const unreachable = stage.entries.filter(
-			(entry) => !entry.module && !entry.required && !entry.browser,
+			(entry) => !entry.importable && !entry.requirable && !entry.browsable,
 		)
 		expect(unreachable.map((entry) => entry.subpath)).toStrictEqual([])
 		const untypable = selectUntypable(stage.entries, stage.installed)
@@ -2377,16 +2461,18 @@ describe('installed package consumer', () => {
 			for (const [extension, format] of FORMATS) {
 				const written = selectEntries(stage.entries, driver.conditions[format])
 				if (written.length === 0) continue
+				const label = \`\${driver.label}.\${extension}\`
+				const probe = \`probe.\${label}\`
 				const specifiers = written.map((entry) => entry.specifier)
-				const probe = writeConsumerProbe(stage, \`probe.\${driver.label}.\${extension}\`, specifiers)
-				for (const message of compileConsumer(probe, driver.resolution, driver.module)) {
-					reported.push(\`\${driver.label}.\${extension}: \${message}\`)
-				}
-				const absent = [\`\${name}\${ABSENT_SUBPATH}\`]
-				const control = writeConsumerProbe(stage, \`control.\${driver.label}.\${extension}\`, absent)
-				if (compileConsumer(control, driver.resolution, driver.module).length === 0) {
-					silent.push(\`\${driver.label}.\${extension}\`)
+				writeConsumerProbe(stage, probe, specifiers)
+				const project = writeProject(stage, probe, driver, [\`./\${probe}\`])
+				for (const message of checkProject(stage, project)) {
+					reported.push(\`\${label}: \${message}\`)
 				}
+				const control = \`control.\${label}\`
+				writeConsumerProbe(stage, control, [\`\${name}\${ABSENT_SUBPATH}\`])
+				const refused = writeProject(stage, control, driver, [\`./\${control}\`])
+				if (checkProject(stage, refused).length === 0) silent.push(label)
 			}
 		}
 		expect(reported).toStrictEqual([])
@@ -2396,27 +2482,44 @@ describe('installed package consumer', () => {
 
 for (const entry of STAGE?.entries ?? []) {
 	describe(\`installed entry \${entry.subpath}\`, () => {
-		it.runIf(entry.module)(
+		it.runIf(entry.importable)(
 			'publishes what it declares to a Node import, and no more',
 			(context) => {
-				const declaration = entry.declaration.module
-				if (declaration === undefined) {
+				const stage = requireStage(context)
+				// The exports-map walk resolved a declaration a typed importer reads, so an
+				// entry reaching this drive without one is reported for that rather than for
+				// what a consumer of a missing declaration goes on to say.
+				if (!entry.declaration.importable) {
 					throw new Error(\`\${entry.subpath} publishes no import declaration\`)
 				}
-				const published = driveRuntime(requireStage(context), entry.specifier, ESM_DRIVER)
-				expect(published).toStrictEqual(readDeclaredExports(declaration))
+				const published = driveRuntime(stage, entry.specifier, ESM_DRIVER)
+				const drivers = selectDrivers(entry, 'module')
+				expect(drivers).not.toStrictEqual([])
+				const reported = drivers.flatMap((driver) =>
+					checkSurface(stage, { entry, extension: 'ts', published, driver }),
+				)
+				expect(reported).toStrictEqual([])
 			},
 		)
 
-		it.runIf(entry.required)(
+		it.runIf(entry.requirable)(
 			'publishes what it declares to a Node require, and no more',
 			(context) => {
-				const declaration = entry.declaration.commonjs
-				if (declaration === undefined) {
+				const stage = requireStage(context)
+				if (!entry.declaration.requirable) {
 					throw new Error(\`\${entry.subpath} publishes no require declaration\`)
 				}
-				const published = driveRuntime(requireStage(context), entry.specifier, CJS_DRIVER)
-				expect(published).toStrictEqual(readDeclaredExports(declaration))
+				const published = driveRuntime(stage, entry.specifier, CJS_DRIVER)
+				// A subpath whose \`require\` resolves to a module that no typed CommonJS
+				// consumer can compile against carries no declared side to compare here, and
+				// whether it may publish one at all is the untypable set's question rather
+				// than this drive's. The preceding runtime drive ran either way.
+				const drivers = selectDrivers(entry, 'commonjs')
+				expect(drivers).not.toStrictEqual([])
+				const reported = drivers.flatMap((driver) =>
+					checkSurface(stage, { entry, extension: 'cts', published, driver }),
+				)
+				expect(reported).toStrictEqual([])
 			},
 		)
 {{drive}}	})
@@ -2529,12 +2632,11 @@ async function readBrowserExports(browser: Browser, bundle: string): Promise<rea
 }
 `,
 			drive: `
-		it.runIf(entry.browser)(
+		it.runIf(entry.browsable)(
 			'publishes what it declares to a real browser, and no more [requires a browser]',
 			async (context) => {
 				const stage = requireStage(context)
-				const declaration = entry.declaration.browser
-				if (declaration === undefined) {
+				if (!entry.declaration.browsable) {
 					throw new Error(\`\${entry.subpath} publishes no browser declaration\`)
 				}
 				const options = resolveBrowser(resolvePinnedBrowser(), process.platform, process.env)
@@ -2545,9 +2647,16 @@ async function readBrowserExports(browser: Browser, bundle: string): Promise<rea
 				})
 				try {
 					const bundle = await bundleEntry(stage, entry)
-					expect(await readBrowserExports(browser, bundle)).toStrictEqual(
-						readDeclaredExports(declaration),
-					)
+					const published = await readBrowserExports(browser, bundle)
+					// A browser consumer reads the installed declarations through a bundler, so
+					// that is the one driver this face answers under.
+					const reported = checkSurface(stage, {
+						entry,
+						extension: 'ts',
+						published,
+						driver: BROWSER_DRIVER,
+					})
+					expect(reported).toStrictEqual([])
 				} finally {
 					await browser.close()
 				}
@@ -2570,7 +2679,7 @@ async function readBrowserExports(browser: Browser, bundle: string): Promise<rea
 	// file and runs the \`repair\` verb, which writes the variant carrying that branch.
 	it('publishes no browser face this proof cannot drive [requires the registry]', (context) => {
 		const stage = requireStage(context)
-		const faces = stage.entries.filter((entry) => entry.browser)
+		const faces = stage.entries.filter((entry) => entry.browsable)
 		expect(faces.map((entry) => entry.subpath)).toStrictEqual([])
 	})
 `
@@ -2685,12 +2794,12 @@ printf '%s\\n' \\
 *
 * @example
 * ```ts
-* import { ScaffoldError, isScaffoldError } from '@orkestrel/scaffold'
+* import { isScaffoldError, ScaffoldError } from '@orkestrel/scaffold'
 *
 * try {
-* 	throw new ScaffoldError('INVALID', 'Blueprint is not an exact record')
+* 	throw new ScaffoldError('TARGET', 'The target carries no readable manifest.')
 * } catch (error) {
-* 	if (isScaffoldError(error)) error.code // 'INVALID'
+* 	if (isScaffoldError(error)) error.code // 'TARGET'
 * }
 * ```
 */
@@ -3135,7 +3244,8 @@ var isCatalogEntry = (0, _orkestrel_contract.unionOf)((0, _orkestrel_contract.re
 	name: isDependencyName,
 	lookup: (0, _orkestrel_contract.literalOf)("found"),
 	version: _orkestrel_contract.isString,
-	dependencies: (0, _orkestrel_contract.andOf)(isCollection, (0, _orkestrel_contract.arrayOf)(isDependency))
+	dependencies: (0, _orkestrel_contract.andOf)(isCollection, (0, _orkestrel_contract.arrayOf)(isDependency)),
+	peers: (0, _orkestrel_contract.andOf)(isCollection, (0, _orkestrel_contract.arrayOf)(isDependency))
 }), (0, _orkestrel_contract.recordOf)({
 	name: isDependencyName,
 	lookup: (0, _orkestrel_contract.literalOf)("missing", "unmatched", "failed"),
@@ -3521,7 +3631,7 @@ function isCanonPath(path) {
 	return CANON_PATHS.some((canon) => path === canon || path.startsWith(`${canon}/`));
 }
 /**
-* Checks whether a target's present bytes at a path are owned by another surface.
+* Checks whether another surface owns a target's present bytes at a path.
 *
 * @param path - The target-relative path to test.
 * @returns True if the path is a {@link WORKSPACE_OWNED_PATHS} member or a
@@ -3698,46 +3808,6 @@ function matchesPrintWidth(line) {
 	return line.replaceAll("	", " ".repeat(2)).length <= 100;
 }
 /**
-* Derives the declaration rewrite a published face's `beforeWriteFile` applies.
-*
-* @param name - The workspace's own bare package name.
-* @returns The ternary consequent an emitted `vite.{browser,server}.config.ts`
-* fills its `{{replacement}}` span with, indented for that span.
-*
-* @remarks
-* `vite-plugin-dts` rolls a face into one declaration and keeps each source
-* module's own relative depth, so a nested module emits a path that escapes
-* `dist/src` and a flat one resolves only by luck. Both faces rewrite the same
-* relative core path to the package's published root export, so the branch is
-* derived once here. The extension alternation is what the permitted import
-* spellings produce: an `@src/core` alias resolves to the core source module and
-* prints `.ts`, while a relative import prints the `.js` specifier it was
-* written with. The formatter keeps the call on one line only while the line it
-* prints measures inside the vendored width, and the workspace name is what
-* varies, so the shape is chosen by measuring the candidate: a tab prints as the
-* vendored two columns, and the gate admits a name long enough to push the
-* joined call past 100.
-*
-* @example
-* ```ts
-* import { nameToRewrite } from '@orkestrel/scaffold'
-*
-* nameToRewrite('router').includes("'@orkestrel/router'") // true
-* ```
-*/
-function nameToRewrite(name) {
-	const specifier = serializeTypeScriptString(`@orkestrel/${name}`);
-	const pattern = "/(?:\\.\\.\\/)+core\\/index\\.[jt]s/g";
-	const joined = `\t\t\t\t\t\t? content.replaceAll(${pattern}, ${specifier})`;
-	if (matchesPrintWidth(joined)) return joined;
-	return [
-		"						? content.replaceAll(",
-		`\t\t\t\t\t\t\t\t${pattern},`,
-		`\t\t\t\t\t\t\t\t${specifier},`,
-		"							)"
-	].join("\n");
-}
-/**
 * Selects the single published environment a package root points at.
 *
 * @param src - The declared published environments.
@@ -3993,9 +4063,11 @@ function matchesDriftReachability(ownership, finding) {
 * @remarks
 * A layer is a deterministic function of the catalog's own edges, so it is
 * computed here rather than stored on a row that could disagree with them.
-* Only RUNTIME edges between catalogued packages count: a development
+* Only RUNTIME and PEER edges between catalogued packages count: a development
 * dependency reaches no consumer, so it constrains nothing about publish order,
-* and an edge leaving the fleet is a package this catalog does not publish.
+* and an edge leaving the fleet is a package this catalog does not publish. A
+* peer edge counts like a runtime edge, because a caret peer range at `0.0.x`
+* names one exact release the dependent cannot publish ahead of.
 *
 * The order matters because these packages are `0.0.x`, where a caret pins one
 * exact release. Publishing a dependent before its dependency leaves the
@@ -4006,11 +4078,12 @@ function matchesDriftReachability(ownership, finding) {
 * placed in an order that would be wrong. An absent name is the report: compare
 * the returned names against the catalog to find one.
 *
-* @example
+* @example Fleet catalog
 * ```ts
 * import { catalogToLayers } from '@orkestrel/scaffold'
 *
-* catalogToLayers(entries)[0] // the names that depend on nothing in the fleet
+* const layers = catalogToLayers(entries)
+* layers[0] // the names that depend on nothing else in the fleet
 * ```
 */
 function catalogToLayers(entries) {
@@ -4018,7 +4091,7 @@ function catalogToLayers(entries) {
 	const pending = /* @__PURE__ */ new Map();
 	for (const entry of entries) {
 		if (entry.lookup !== "found") continue;
-		const edges = entry.dependencies.map((dependency) => dependency.name);
+		const edges = [...entry.dependencies, ...entry.peers].map((dependency) => dependency.name);
 		pending.set(entry.name, new Set(edges.filter((name) => published.has(name))));
 	}
 	const layers = [];
@@ -4232,9 +4305,9 @@ function matchesRange(range, latest) {
 * ```ts
 * import { matchesEngines } from '@orkestrel/scaffold'
 *
-* matchesEngines('>=22.12.0') // true
+* matchesEngines('>=22.18.0') // true
 * matchesEngines('>=20.0.0') // false
-* matchesEngines('22.12.0') // false
+* matchesEngines('22.18.0') // false
 * ```
 */
 function matchesEngines(engines) {
@@ -4595,7 +4668,7 @@ function blueprintToScripts(blueprint) {
 	scripts["test:policy"] = `${vitest} --project policy`;
 	scripts["test:config"] = `${vitest} --project config`;
 	if (blueprint.setup) scripts["test:setup"] = `${vitest} --project setup`;
-	if (blueprint.guides) scripts["test:guides"] = `${vitest} --project guides`;
+	if (blueprint.guides) scripts["test:guides"] = `node --experimental-strip-types ${GUIDES_TEST_PATH}`;
 	if (blueprint.conformance) scripts["test:conformance"] = `${vitest} --project conformance`;
 	scripts["test:probe"] = "vitest run --config vite.config.ts --no-cache --reporter=verbose --project probe";
 	scripts["test:bench"] = "vitest bench --config vite.config.ts --no-cache --project probe";
@@ -4649,13 +4722,16 @@ function blueprintToScripts(blueprint) {
 *
 * @remarks
 * Every direct `test:<project>` script is writable, together with the probe and
-* benchmark workbench scripts. Publishing adds the pack and publication
-* lifecycle scripts. Aggregate test scripts and maintainer-owned gate chains
-* stay outside the region.
+* benchmark workbench scripts. A workspace carrying guides adds `test:guides`,
+* whose package-owned entry runs the guides project and handles explicit parity
+* rewrites. Publishing adds the pack and publication lifecycle scripts.
+* Aggregate test scripts and
+* maintainer-owned gate chains stay outside the region.
 *
 * `accepted` carries each generated predecessor the region can replace. The
-* pack hook accepts the build chain emitted before it delegated to `build`. The
-* publication hook accepts the same gate chain without
+* guides entry accepts the generated command that invoked the guides project
+* through Vitest alone. The pack hook accepts the build chain emitted before it
+* delegated to `build`. The publication hook accepts the same gate chain without
 * {@link RELEASE_PROOF_COMMAND}. The value being written is always writable, so
 * it is not repeated there. Any other value is a script the workspace author
 * customized, and {@link replaceManifestScripts} retains it while writing the
@@ -4674,11 +4750,11 @@ function blueprintToWritableScripts(blueprint) {
 	const scripts = blueprintToScripts(blueprint);
 	const writable = [];
 	for (const [name, command] of Object.entries(scripts)) {
-		if (!name.startsWith("test:") || name === "test:src" || name === "test:app") continue;
+		if (!(name.startsWith("test:") && name !== "test:src" && name !== "test:app")) continue;
 		writable.push({
 			name,
 			command,
-			accepted: []
+			accepted: name === "test:guides" ? ["vitest run --config vite.config.ts --no-cache --reporter=dot --project guides"] : []
 		});
 	}
 	const prepack = scripts.prepack;
@@ -4780,6 +4856,7 @@ function blueprintToManifest(blueprint) {
 		devDependencies: blueprintToDevDependencies(blueprint),
 		...Object.keys(peerDependencies).length > 0 ? { peerDependencies } : {},
 		...Object.keys(peerDependenciesMeta).length > 0 ? { peerDependenciesMeta } : {},
+		devEngines: WORKSPACE_DEV_ENGINES,
 		engines: { node: blueprint.engines }
 	};
 	return `${JSON.stringify(manifest, void 0, "	")}\n`;
@@ -4826,6 +4903,21 @@ function blueprintToMachinery(blueprint) {
 * @param blueprint - The workspace specification.
 * @returns Formatter-stable `tsconfig.json` text.
 *
+* @remarks
+* `paths` carries the workspace's own published specifiers beside the `@src` and
+* `@app` aliases, mapped to source. The published set is what
+* {@link srcToExports} publishes, read the same way here so the two never name
+* different subpaths, and the `app` axis publishes nothing so it maps nothing.
+* A package's own name resolves inside its own checkout through that `exports`
+* map, to the built `dist/` entry, so a module importing it would make the root
+* typecheck depend on a build; mapping the specifier to source is what keeps
+* `npm run check` independent of `npm run build`. The root Vite configuration
+* derives its `alias` record from every `paths` entry, so the same specifiers
+* resolve to source under Vitest, and every subpath is emitted before the bare
+* specifier: an alias record is matched in declaration order and a bare pattern
+* also matches its own subpaths, so the reverse order would resolve
+* `@orkestrel/<name>/server` through the core entry.
+*
 * @example
 * ```ts
 * import { blueprintToRootTsconfig, createBlueprint } from '@orkestrel/scaffold'
@@ -4837,9 +4929,21 @@ function blueprintToMachinery(blueprint) {
 */
 function blueprintToRootTsconfig(blueprint) {
 	const aliases = [];
-	for (const environment of ENVIRONMENTS) if (blueprint.src.includes(environment)) aliases.push(`"@src/${environment}": ["./src/${environment}/index.ts"]`);
-	for (const environment of ENVIRONMENTS) if (blueprint.app.includes(environment)) aliases.push(`"@app/${environment}": ["./app/${environment}/index.ts"]`);
-	const paths = aliases.map((alias, index) => `\t\t\t${alias}${index === aliases.length - 1 ? "" : ","}`).join("\n");
+	for (const environment of ENVIRONMENTS) if (blueprint.src.includes(environment)) aliases.push([`@src/${environment}`, `./src/${environment}/index.ts`]);
+	for (const environment of ENVIRONMENTS) if (blueprint.app.includes(environment)) aliases.push([`@app/${environment}`, `./app/${environment}/index.ts`]);
+	const root = srcToRoot(blueprint.src);
+	if (root === void 0) for (const environment of ENVIRONMENTS) {
+		if (environment === "core" || !blueprint.src.includes(environment)) continue;
+		const subpath = SRC_MATRIX[environment].path.slice(1);
+		aliases.push([`@orkestrel/${blueprint.name}${subpath}`, `./src/${environment}/index.ts`]);
+	}
+	if (blueprint.src.length > 0) aliases.push([`@orkestrel/${blueprint.name}`, `./src/${root ?? "core"}/index.ts`]);
+	const paths = aliases.map(([specifier, target], index) => {
+		const separator = index === aliases.length - 1 ? "" : ",";
+		const line = `\t\t\t"${specifier}": ["${target}"]${separator}`;
+		if (matchesPrintWidth(line)) return line;
+		return `\t\t\t"${specifier}": [\n\t\t\t\t"${target}"\n\t\t\t]${separator}`;
+	}).join("\n");
 	return (0, _orkestrel_template.fillTemplate)(CONFIG_TEMPLATES.root.tsconfig, { paths });
 }
 /**
@@ -5072,9 +5176,9 @@ function blueprintToConfigArtifacts(blueprint) {
 	for (const environment of blueprint.src) for (const path of SRC_MATRIX[environment].configs) {
 		let content = CONFIG_TEMPLATES.vites.src.core;
 		if (path === "configs/src/tsconfig.core.json") content = CONFIG_TEMPLATES.tsconfigs.src.core;
-		else if (path === "configs/src/vite.browser.config.ts") content = (0, _orkestrel_template.fillTemplate)(CONFIG_TEMPLATES.vites.src.browser, { replacement: nameToRewrite(blueprint.name) });
+		else if (path === "configs/src/vite.browser.config.ts") content = CONFIG_TEMPLATES.vites.src.browser;
 		else if (path === "configs/src/tsconfig.browser.json") content = CONFIG_TEMPLATES.tsconfigs.src.browser;
-		else if (path === "configs/src/vite.server.config.ts") content = (0, _orkestrel_template.fillTemplate)(CONFIG_TEMPLATES.vites.src.server, { replacement: nameToRewrite(blueprint.name) });
+		else if (path === "configs/src/vite.server.config.ts") content = CONFIG_TEMPLATES.vites.src.server;
 		else if (path === "configs/src/tsconfig.server.json") content = CONFIG_TEMPLATES.tsconfigs.src.server;
 		artifacts.push({
 			path,
@@ -5517,11 +5621,11 @@ function blueprintToOrchestrationArtifacts(blueprint) {
 	}];
 }
 /**
-* Compiles the vendored host artifacts a named workspace plans.
+* Compiles the vendored host artifacts a workspace plans.
 *
-* @param name - The target workspace's own bare package name.
-* @returns One artifact per vendored path in `HOST_PATHS` order, then the
-* catalog file.
+* @param blueprint - The workspace specification.
+* @returns One artifact per selected vendored path in `HOST_PATHS` order, then
+* the catalog file.
 *
 * @remarks
 * Every artifact is claimed by presence, which is the strongest claim a pure
@@ -5546,15 +5650,16 @@ function blueprintToOrchestrationArtifacts(blueprint) {
 *
 * @example
 * ```ts
-* import { nameToHostArtifacts } from '@orkestrel/scaffold'
+* import { blueprintToHostArtifacts, createBlueprint } from '@orkestrel/scaffold'
+*
+* const blueprint = createBlueprint('router')
 *
-* nameToHostArtifacts('router').some((artifact) => artifact.path === '.claude/settings.json') // true
-* nameToHostArtifacts('router').some((artifact) => artifact.path === '.claude/agents/orkestrel.md') // true
-* nameToHostArtifacts('router').some((artifact) => artifact.path === 'guides/router.md') // false
+* blueprintToHostArtifacts(blueprint).some((artifact) => artifact.path === 'tests/guides.test.ts') // false
+* blueprintToHostArtifacts(blueprint).some((artifact) => artifact.path === 'guides/router.md') // false
 * ```
 */
-function nameToHostArtifacts(name) {
-	return [...selectHostPaths(HOST_PATHS, name), CATALOG_AGENT_PATH].map((path) => ({
+function blueprintToHostArtifacts(blueprint) {
+	return [...selectHostPaths(HOST_PATHS, blueprint.name), CATALOG_AGENT_PATH].map((path) => ({
 		path,
 		group: inferGroup(path),
 		ownership: "presence",
@@ -5597,7 +5702,8 @@ function applyOverrides(artifacts, overrides) {
 	});
 }
 /**
-* Replaces declared dependency ranges in package manifest text.
+* Replaces the runtime and development dependency ranges in package manifest text, and never a
+* peer range.
 *
 * @param manifest - The manifest text to compile.
 * @param pins - The runtime and development names and replacement ranges.
@@ -6483,12 +6589,18 @@ function overridesToQuestions(overrides, artifacts) {
 * and let the answers disagree, so a blueprint the gate will
 * refuse is still constructible.
 *
-* @example
+* @example Blueprint
 * ```ts
 * import { createBlueprint } from '@orkestrel/scaffold'
 *
-* createBlueprint('router', { src: ['core'] }).version // '0.0.1'
-* createBlueprint('Router').name // 'Router' — the gate refuses it, this does not
+* const blueprint = createBlueprint('router', {
+* 	src: ['core', 'server'],
+* 	dependencies: [{ name: '@orkestrel/emitter', range: '^0.0.5' }],
+* 	bin: true,
+* })
+*
+* blueprint.version // '0.0.1'
+* blueprint.engines // '>=22.18.0'
 * ```
 */
 function createBlueprint(name, input) {
@@ -6552,11 +6664,13 @@ function createBlueprint(name, input) {
 *
 * @example
 * ```ts
-* import { createBlueprint, Compiler } from '@orkestrel/scaffold'
+* import { Compiler, createBlueprint } from '@orkestrel/scaffold'
 *
 * const compiler = new Compiler()
 * const scaffolding = compiler.compile(createBlueprint('router', { src: ['core'] }))
-* scaffolding.plan?.hash?.length // 16
+*
+* scaffolding.plan?.artifacts // every planned file, in group order
+* scaffolding.stages // one CompileRecord per stage that ran
 * compiler.destroy()
 * ```
 */
@@ -6788,7 +6902,7 @@ var Compiler = class {
 			...blueprintToGuideArtifacts(blueprint),
 			...blueprintToDocumentArtifacts(blueprint),
 			...blueprintToOrchestrationArtifacts(blueprint),
-			...nameToHostArtifacts(blueprint.name)
+			...blueprintToHostArtifacts(blueprint)
 		];
 	}
 	#gate(blueprint, draft, artifacts) {
@@ -6869,6 +6983,7 @@ exports.MAX_SCRIPT_LENGTH = MAX_SCRIPT_LENGTH;
 exports.MAX_TOTAL_ARTIFACT_BYTES = MAX_TOTAL_ARTIFACT_BYTES;
 exports.MAX_TOTAL_REGISTRY_BYTES = MAX_TOTAL_REGISTRY_BYTES;
 exports.MINIMUM_NODE_VERSION = MINIMUM_NODE_VERSION;
+exports.MINIMUM_NPM_VERSION = MINIMUM_NPM_VERSION;
 exports.NAME_PATTERN = NAME_PATTERN;
 exports.ORCHESTRATION_PATH_NAMES = ORCHESTRATION_PATH_NAMES;
 exports.ORCHESTRATION_PATH_PREFIXES = ORCHESTRATION_PATH_PREFIXES;
@@ -6885,6 +7000,7 @@ exports.SRC_MATRIX = SRC_MATRIX;
 exports.ScaffoldError = ScaffoldError;
 exports.TAB_WIDTH = TAB_WIDTH;
 exports.VERSION_PATTERN = VERSION_PATTERN;
+exports.WORKSPACE_DEV_ENGINES = WORKSPACE_DEV_ENGINES;
 exports.WORKSPACE_OWNED_PATHS = WORKSPACE_OWNED_PATHS;
 exports.applyOverrides = applyOverrides;
 exports.artifactToFinding = artifactToFinding;
@@ -6894,6 +7010,7 @@ exports.blueprintToConfigArtifacts = blueprintToConfigArtifacts;
 exports.blueprintToDevDependencies = blueprintToDevDependencies;
 exports.blueprintToDocumentArtifacts = blueprintToDocumentArtifacts;
 exports.blueprintToGuideArtifacts = blueprintToGuideArtifacts;
+exports.blueprintToHostArtifacts = blueprintToHostArtifacts;
 exports.blueprintToMachinery = blueprintToMachinery;
 exports.blueprintToManifest = blueprintToManifest;
 exports.blueprintToOrchestrationArtifacts = blueprintToOrchestrationArtifacts;
@@ -6952,8 +7069,6 @@ exports.matchesOrchestrationPath = matchesOrchestrationPath;
 exports.matchesPrintWidth = matchesPrintWidth;
 exports.matchesRange = matchesRange;
 exports.nameToGuide = nameToGuide;
-exports.nameToHostArtifacts = nameToHostArtifacts;
-exports.nameToRewrite = nameToRewrite;
 exports.overridesToQuestions = overridesToQuestions;
 exports.parseBlueprint = parseBlueprint;
 exports.parseCompilerOptions = parseCompilerOptions;