@orkestrel/scaffold 0.0.80 → 0.0.82

package/dist/host/configs/policy.ts

@@ -20,6 +20,7 @@ export interface PolicyExpression extends PolicyNode {
 	readonly callee?: PolicyExpression
 	readonly argument?: PolicyExpression | null
 	readonly arguments?: readonly PolicyExpression[]
+	readonly elements?: ReadonlyArray<PolicyExpression | null>
 	readonly body?: PolicyExpression | readonly PolicyExpression[]
 	readonly quasis?: readonly PolicyExpression[]
 	readonly expressions?: readonly PolicyExpression[]
@@ -514,39 +515,65 @@ export function isPolicyDeclaredFunction(node: PolicyExpression): boolean {
 	return node.type === 'FunctionDeclaration' || node.type === 'TSDeclareFunction'
 }
 
-/** Reports whether a policy function is anonymous. */
-export function isPolicyAnonymous(node: PolicyExpression): boolean {
-	return node.type === 'ArrowFunctionExpression' || node.id === null
-}
-
-/** Returns the outermost parenthesized expression holding a policy function. */
+/** Returns a policy function's position through parentheses, object values, and array elements. */
 export function functionToPolicyPosition(node: PolicyExpression): PolicyExpression {
 	let position = node
-	while (position.parent?.type === 'ParenthesizedExpression') {
-		position = position.parent
+	while (position.parent !== undefined && position.parent !== null) {
+		const parent = position.parent
+		if (parent.type === 'ParenthesizedExpression') {
+			position = parent
+			continue
+		}
+		if (
+			parent.type === 'Property' &&
+			parent.kind === 'init' &&
+			parent.method === false &&
+			parent.computed !== true &&
+			parent.value === position &&
+			parent.parent?.type === 'ObjectExpression'
+		) {
+			position = parent.parent
+			continue
+		}
+		if (parent.type === 'ArrayExpression' && parent.elements?.includes(position) === true) {
+			position = parent
+			continue
+		}
+		break
 	}
 	return position
 }
 
-/** Reports whether a policy function is an anonymous callback passed directly as an argument. */
+/** Reports whether a literal position is admitted as an argument, return, or arrow body. */
+export function isPolicyPosition(position: PolicyExpression): boolean {
+	const parent = position.parent
+	return (
+		((parent?.type === 'CallExpression' || parent?.type === 'NewExpression') &&
+			parent.arguments?.includes(position) === true) ||
+		(parent?.type === 'ReturnStatement' && parent.argument === position) ||
+		(parent?.type === 'ArrowFunctionExpression' && parent.body === position)
+	)
+}
+
+/** Reports whether a function expression is passed as an argument through its literal position. */
 export function isPolicyCallback(node: PolicyExpression): boolean {
-	if (!isPolicyAnonymous(node)) return false
+	if (node.type !== 'ArrowFunctionExpression' && node.type !== 'FunctionExpression') return false
 	const position = functionToPolicyPosition(node)
 	const parent = position.parent
 	return (
 		(parent?.type === 'CallExpression' || parent?.type === 'NewExpression') &&
-		parent.arguments?.includes(position) === true
+		isPolicyPosition(position)
 	)
 }
 
-/** Reports whether a policy function is an anonymous function returned directly as a result. */
+/** Reports whether a function expression is returned as a result through its literal position. */
 export function isPolicyResult(node: PolicyExpression): boolean {
-	if (!isPolicyAnonymous(node)) return false
+	if (node.type !== 'ArrowFunctionExpression' && node.type !== 'FunctionExpression') return false
 	const position = functionToPolicyPosition(node)
 	const parent = position.parent
 	return (
-		(parent?.type === 'ReturnStatement' && parent.argument === position) ||
-		(parent?.type === 'ArrowFunctionExpression' && parent.body === position)
+		(parent?.type === 'ReturnStatement' || parent?.type === 'ArrowFunctionExpression') &&
+		isPolicyPosition(position)
 	)
 }
 
@@ -581,42 +608,6 @@ export function hasPolicyFunctionAncestor(node: PolicyExpression): boolean {
 	return method
 }
 
-/** Reports whether an arrow is the policy plugin's sanctioned visitor-table delegation. */
-export function isPolicyVisitor(node: PolicyExpression): boolean {
-	const body = expressionToPolicyBody(node)
-	if (
-		node.type !== 'ArrowFunctionExpression' ||
-		node.expression !== true ||
-		body?.type !== 'CallExpression' ||
-		body.callee?.type !== 'Identifier' ||
-		typeof body.callee.name !== 'string' ||
-		!body.callee.name.startsWith('report')
-	) {
-		return false
-	}
-	const property = node.parent
-	const object = property?.parent
-	const returned = object?.parent
-	const block = returned?.parent
-	const create = block?.parent
-	const definition = create?.parent
-	return (
-		property?.type === 'Property' &&
-		property.method === false &&
-		property.value === node &&
-		object?.type === 'ObjectExpression' &&
-		returned?.type === 'ReturnStatement' &&
-		returned.argument === object &&
-		block?.type === 'BlockStatement' &&
-		create?.type === 'FunctionExpression' &&
-		definition?.type === 'Property' &&
-		definition.method === true &&
-		definition.value === create &&
-		definition.key?.type === 'Identifier' &&
-		definition.key.name === 'create'
-	)
-}
-
 /**
  * Returns the module-scope statement that owns a policy function, or `undefined` when none does.
  *
@@ -849,15 +840,17 @@ export function reportComments(context: PolicyContext): void {
 
 /** Reports function syntax nested inside another function body. */
 export function reportNested(context: PolicyContext, node: PolicyExpression): void {
-	if (
-		!hasPolicyFunctionAncestor(node) ||
-		isPolicyMethod(node) ||
-		isPolicyCallback(node) ||
-		isPolicyResult(node) ||
-		isPolicyVisitor(node)
-	) {
+	if (!hasPolicyFunctionAncestor(node) || isPolicyCallback(node) || isPolicyResult(node)) {
 		return
 	}
+	if (isPolicyMethod(node)) {
+		if (node.parent?.type === 'MethodDefinition') return
+		const object = node.parent?.parent
+		if (object?.type === 'ObjectExpression') {
+			const position = functionToPolicyPosition(object)
+			if (isPolicyPosition(position)) return
+		}
+	}
 	context.report({ node, messageId: 'nested' })
 }
 
@@ -969,7 +962,16 @@ export function reportFunction(context: PolicyContext, node: PolicyExpression):
 		return
 	}
 	if (region.type !== 'VariableDeclaration') return
-	if (isPolicyCallback(node) || isPolicyResult(node)) return
+	let position = node
+	while (position.parent?.type === 'ParenthesizedExpression') position = position.parent
+	// Module placement admits direct callbacks; a literal member still belongs in a function file.
+	if (
+		(node.type === 'ArrowFunctionExpression' || node.id === null) &&
+		functionToPolicyPosition(node) === position &&
+		(isPolicyCallback(node) || isPolicyResult(node))
+	) {
+		return
+	}
 	context.report({ node, messageId: 'function' })
 }
 
@@ -1059,11 +1061,12 @@ export const NESTED_RULE: PolicyRuleInterface = {
 	meta: {
 		type: 'problem',
 		docs: {
-			description: 'Disallow function declarations and assignments inside another function body.',
+			description:
+				'Disallow nested functions except callbacks passed as arguments or returned as results, directly or as members of object or array literals in those positions.',
 		},
 		messages: {
 			nested:
-				'Extract the function to module scope or make instance-bound work a method; only direct anonymous callbacks and returned anonymous functions may stay in a function body.',
+				'Extract the function to module scope or make instance-bound work a method; only a callback passed as an argument or returned as the result, directly or as a member of an object or array literal in that position, may stay in a function body.',
 		},
 	},
 	create(context) {

package/dist/host/dotfiles/oxlintrc.json

@@ -132,16 +132,20 @@
 					"error",
 					{
 						"patterns": [
+							{
+								"regex": "^(?:@(?:src|app)/vue(?:[/?#]|$)|@orkestrel/[^/]+/vue(?:[/?#]|$)|(?:\\.\\./)+(?:vue|src/vue|app/vue)(?:[/?#]|$))",
+								"message": "src/core must not depend on Vue extension modules"
+							},
 							{
 								"regex": "^(?:/|[A-Za-z]:[\\\\/])",
 								"message": "imports must not use machine-specific absolute paths"
 							},
 							{
-								"regex": "^(?!node:)[A-Za-z][A-Za-z0-9+.-]*:",
+								"regex": "^(?:[A-Za-mo-z][A-Za-z0-9+.-]*|n(?:[A-Za-np-z0-9+.-][A-Za-z0-9+.-]*)?|no(?:[A-Za-ce-z0-9+.-][A-Za-z0-9+.-]*)?|nod(?:[A-Za-df-z0-9+.-][A-Za-z0-9+.-]*)?|node[A-Za-z0-9+.-]+):",
 								"message": "imports must not use non-Node URL schemes"
 							},
 							{
-								"regex": "(?:^|/)(?!\\.{1,2}(?:/|$))[^/]+/\\.{1,2}(?:/|$)",
+								"regex": "(?:^|/)(?:[^/.][^/]*|\\.[^/.][^/]*|\\.\\.[^/]+)/\\.{1,2}(?:/|$)",
 								"message": "internal import paths must not contain noncanonical dot segments"
 							},
 							{
@@ -180,16 +184,20 @@
 					"error",
 					{
 						"patterns": [
+							{
+								"regex": "^(?:(?:vue|vite)(?:[/?#]|$)|@(?:vue|vitejs)/|@(?:src|app)/vue(?:[/?#]|$)|@orkestrel/[^/]+/vue(?:[/?#]|$)|(?:\\.\\./)+(?:vue|src/vue|app/vue)(?:[/?#]|$))",
+								"message": "src/browser must not depend on Vue extension modules"
+							},
 							{
 								"regex": "^(?:/|[A-Za-z]:[\\\\/])",
 								"message": "imports must not use machine-specific absolute paths"
 							},
 							{
-								"regex": "^(?!node:)[A-Za-z][A-Za-z0-9+.-]*:",
+								"regex": "^(?:[A-Za-mo-z][A-Za-z0-9+.-]*|n(?:[A-Za-np-z0-9+.-][A-Za-z0-9+.-]*)?|no(?:[A-Za-ce-z0-9+.-][A-Za-z0-9+.-]*)?|nod(?:[A-Za-df-z0-9+.-][A-Za-z0-9+.-]*)?|node[A-Za-z0-9+.-]+):",
 								"message": "imports must not use non-Node URL schemes"
 							},
 							{
-								"regex": "(?:^|/)(?!\\.{1,2}(?:/|$))[^/]+/\\.{1,2}(?:/|$)",
+								"regex": "(?:^|/)(?:[^/.][^/]*|\\.[^/.][^/]*|\\.\\.[^/]+)/\\.{1,2}(?:/|$)",
 								"message": "internal import paths must not contain noncanonical dot segments"
 							},
 							{
@@ -217,6 +225,54 @@
 				]
 			}
 		},
+		{
+			"files": ["src/vue/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx,vue}"],
+			"rules": {
+				"no-restricted-imports": [
+					"error",
+					{
+						"patterns": [
+							{
+								"regex": "^(?:@src/(?:|[^/?#cbv][^/?#]*|c|c[^/?#o][^/?#]*|co|co[^/?#r][^/?#]*|cor|cor[^/?#e][^/?#]*|core[^/?#][^/?#]*|b|b[^/?#r][^/?#]*|br|br[^/?#o][^/?#]*|bro|bro[^/?#w][^/?#]*|brow|brow[^/?#s][^/?#]*|brows|brows[^/?#e][^/?#]*|browse|browse[^/?#r][^/?#]*|browser[^/?#][^/?#]*|v|v[^/?#u][^/?#]*|vu|vu[^/?#e][^/?#]*|vue[^/?#][^/?#]*)(?:[/?#]|$)|(?:\\.\\./)+(?:src/)?(?:[^/.scbv][^/.]*|s|s[^/.r][^/.]*|sr|sr[^/.c][^/.]*|src[^/.][^/.]*|c|c[^/.o][^/.]*|co|co[^/.r][^/.]*|cor|cor[^/.e][^/.]*|core[^/.][^/.]*|b|b[^/.r][^/.]*|br|br[^/.o][^/.]*|bro|bro[^/.w][^/.]*|brow|brow[^/.s][^/.]*|brows|brows[^/.e][^/.]*|browse|browse[^/.r][^/.]*|browser[^/.][^/.]*|v|v[^/.u][^/.]*|vu|vu[^/.e][^/.]*|vue[^/.][^/.]*)(?:/|$))",
+								"message": "Vue faces must not depend on sibling sheet faces"
+							},
+							{
+								"regex": "^(?:/|[A-Za-z]:[\\\\/])",
+								"message": "imports must not use machine-specific absolute paths"
+							},
+							{
+								"regex": "^(?:[A-Za-mo-z][A-Za-z0-9+.-]*|n(?:[A-Za-np-z0-9+.-][A-Za-z0-9+.-]*)?|no(?:[A-Za-ce-z0-9+.-][A-Za-z0-9+.-]*)?|nod(?:[A-Za-df-z0-9+.-][A-Za-z0-9+.-]*)?|node[A-Za-z0-9+.-]+):",
+								"message": "imports must not use non-Node URL schemes"
+							},
+							{
+								"regex": "(?:^|/)(?:[^/.][^/]*|\\.[^/.][^/]*|\\.\\.[^/]+)/\\.{1,2}(?:/|$)",
+								"message": "internal import paths must not contain noncanonical dot segments"
+							},
+							{
+								"regex": "^(?:(?:\\./)+\\.\\.(?:/|$)|(?:\\.\\./)+(?:\\./)+)|//",
+								"message": "relative import paths must not contain normalized traversal segments"
+							},
+							{
+								"regex": "\\\\",
+								"message": "import paths must use portable forward slashes"
+							},
+							{
+								"regex": "^typescript(?:[/?#]|$)",
+								"message": "the in-process compiler API is not a surface the fleet uses"
+							},
+							{
+								"regex": "^(?:@app(?:[/?#]|$)|(?:\\.\\./)+app(?:[/?#]|$))",
+								"message": "src environments must not depend on private app modules"
+							},
+							{
+								"regex": "^(?:node:|(?:_(?:http_(?:agent|client|common|incoming|outgoing|server)|stream_(?:duplex|passthrough|readable|transform|wrap|writable)|tls_(?:common|wrap))|assert(?:/strict)?|async_hooks|buffer|child_process|cluster|console|constants|crypto|dgram|diagnostics_channel|dns(?:/promises)?|domain|events|fs(?:/promises)?|http|http2|https|inspector(?:/promises)?|module|net|os|path(?:/(?:posix|win32))?|perf_hooks|process|punycode|querystring|readline(?:/promises)?|repl|sqlite|stream(?:/(?:consumers|promises|web))?|string_decoder|sys|timers(?:/promises)?|tls|trace_events|tty|url|util(?:/types)?|v8|vm|wasi|worker_threads|zlib)(?:[/?#]|$)|@src/server(?:[/?#]|$)|@orkestrel/[^/]+/server(?:[/?#]|$)|(?:\\.\\./)+(?:server|src/server|app/server)(?:[/?#]|$))",
+								"message": "src/vue must not depend on Node or server-only modules"
+							}
+						]
+					}
+				]
+			}
+		},
 		{
 			"files": ["src/server/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx,vue}"],
 			"rules": {
@@ -224,16 +280,20 @@
 					"error",
 					{
 						"patterns": [
+							{
+								"regex": "^(?:@(?:src|app)/vue(?:[/?#]|$)|@orkestrel/[^/]+/vue(?:[/?#]|$)|(?:\\.\\./)+(?:vue|src/vue|app/vue)(?:[/?#]|$))",
+								"message": "src/server must not depend on Vue extension modules"
+							},
 							{
 								"regex": "^(?:/|[A-Za-z]:[\\\\/])",
 								"message": "imports must not use machine-specific absolute paths"
 							},
 							{
-								"regex": "^(?!node:)[A-Za-z][A-Za-z0-9+.-]*:",
+								"regex": "^(?:[A-Za-mo-z][A-Za-z0-9+.-]*|n(?:[A-Za-np-z0-9+.-][A-Za-z0-9+.-]*)?|no(?:[A-Za-ce-z0-9+.-][A-Za-z0-9+.-]*)?|nod(?:[A-Za-df-z0-9+.-][A-Za-z0-9+.-]*)?|node[A-Za-z0-9+.-]+):",
 								"message": "imports must not use non-Node URL schemes"
 							},
 							{
-								"regex": "(?:^|/)(?!\\.{1,2}(?:/|$))[^/]+/\\.{1,2}(?:/|$)",
+								"regex": "(?:^|/)(?:[^/.][^/]*|\\.[^/.][^/]*|\\.\\.[^/]+)/\\.{1,2}(?:/|$)",
 								"message": "internal import paths must not contain noncanonical dot segments"
 							},
 							{
@@ -272,16 +332,20 @@
 					"error",
 					{
 						"patterns": [
+							{
+								"regex": "^(?:@(?:src|app)/vue(?:[/?#]|$)|@orkestrel/[^/]+/vue(?:[/?#]|$)|(?:\\.\\./)+(?:vue|src/vue|app/vue)(?:[/?#]|$))",
+								"message": "app/core must not depend on Vue extension modules"
+							},
 							{
 								"regex": "^(?:/|[A-Za-z]:[\\\\/])",
 								"message": "imports must not use machine-specific absolute paths"
 							},
 							{
-								"regex": "^(?!node:)[A-Za-z][A-Za-z0-9+.-]*:",
+								"regex": "^(?:[A-Za-mo-z][A-Za-z0-9+.-]*|n(?:[A-Za-np-z0-9+.-][A-Za-z0-9+.-]*)?|no(?:[A-Za-ce-z0-9+.-][A-Za-z0-9+.-]*)?|nod(?:[A-Za-df-z0-9+.-][A-Za-z0-9+.-]*)?|node[A-Za-z0-9+.-]+):",
 								"message": "imports must not use non-Node URL schemes"
 							},
 							{
-								"regex": "(?:^|/)(?!\\.{1,2}(?:/|$))[^/]+/\\.{1,2}(?:/|$)",
+								"regex": "(?:^|/)(?:[^/.][^/]*|\\.[^/.][^/]*|\\.\\.[^/]+)/\\.{1,2}(?:/|$)",
 								"message": "internal import paths must not contain noncanonical dot segments"
 							},
 							{
@@ -316,16 +380,20 @@
 					"error",
 					{
 						"patterns": [
+							{
+								"regex": "^(?:(?:vue|vite)(?:[/?#]|$)|@(?:vue|vitejs)/|@(?:src|app)/vue(?:[/?#]|$)|@orkestrel/[^/]+/vue(?:[/?#]|$)|(?:\\.\\./)+(?:vue|src/vue|app/vue)(?:[/?#]|$))",
+								"message": "app/browser must not depend on Vue extension modules"
+							},
 							{
 								"regex": "^(?:/|[A-Za-z]:[\\\\/])",
 								"message": "imports must not use machine-specific absolute paths"
 							},
 							{
-								"regex": "^(?!node:)[A-Za-z][A-Za-z0-9+.-]*:",
+								"regex": "^(?:[A-Za-mo-z][A-Za-z0-9+.-]*|n(?:[A-Za-np-z0-9+.-][A-Za-z0-9+.-]*)?|no(?:[A-Za-ce-z0-9+.-][A-Za-z0-9+.-]*)?|nod(?:[A-Za-df-z0-9+.-][A-Za-z0-9+.-]*)?|node[A-Za-z0-9+.-]+):",
 								"message": "imports must not use non-Node URL schemes"
 							},
 							{
-								"regex": "(?:^|/)(?!\\.{1,2}(?:/|$))[^/]+/\\.{1,2}(?:/|$)",
+								"regex": "(?:^|/)(?:[^/.][^/]*|\\.[^/.][^/]*|\\.\\.[^/]+)/\\.{1,2}(?:/|$)",
 								"message": "internal import paths must not contain noncanonical dot segments"
 							},
 							{
@@ -349,6 +417,50 @@
 				]
 			}
 		},
+		{
+			"files": ["app/vue/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx,vue}"],
+			"rules": {
+				"no-restricted-imports": [
+					"error",
+					{
+						"patterns": [
+							{
+								"regex": "^(?:@(?:src|app)/(?:|[^/?#cbv][^/?#]*|c|c[^/?#o][^/?#]*|co|co[^/?#r][^/?#]*|cor|cor[^/?#e][^/?#]*|core[^/?#][^/?#]*|b|b[^/?#r][^/?#]*|br|br[^/?#o][^/?#]*|bro|bro[^/?#w][^/?#]*|brow|brow[^/?#s][^/?#]*|brows|brows[^/?#e][^/?#]*|browse|browse[^/?#r][^/?#]*|browser[^/?#][^/?#]*|v|v[^/?#u][^/?#]*|vu|vu[^/?#e][^/?#]*|vue[^/?#][^/?#]*)(?:[/?#]|$)|(?:\\.\\./)+(?:src/|app/)?(?:[^/.sacbv][^/.]*|s|s[^/.r][^/.]*|sr|sr[^/.c][^/.]*|src[^/.][^/.]*|a|a[^/.p][^/.]*|ap|ap[^/.p][^/.]*|app[^/.][^/.]*|c|c[^/.o][^/.]*|co|co[^/.r][^/.]*|cor|cor[^/.e][^/.]*|core[^/.][^/.]*|b|b[^/.r][^/.]*|br|br[^/.o][^/.]*|bro|bro[^/.w][^/.]*|brow|brow[^/.s][^/.]*|brows|brows[^/.e][^/.]*|browse|browse[^/.r][^/.]*|browser[^/.][^/.]*|v|v[^/.u][^/.]*|vu|vu[^/.e][^/.]*|vue[^/.][^/.]*)(?:/|$))",
+								"message": "Vue faces must not depend on sibling sheet faces"
+							},
+							{
+								"regex": "^(?:/|[A-Za-z]:[\\\\/])",
+								"message": "imports must not use machine-specific absolute paths"
+							},
+							{
+								"regex": "^(?:[A-Za-mo-z][A-Za-z0-9+.-]*|n(?:[A-Za-np-z0-9+.-][A-Za-z0-9+.-]*)?|no(?:[A-Za-ce-z0-9+.-][A-Za-z0-9+.-]*)?|nod(?:[A-Za-df-z0-9+.-][A-Za-z0-9+.-]*)?|node[A-Za-z0-9+.-]+):",
+								"message": "imports must not use non-Node URL schemes"
+							},
+							{
+								"regex": "(?:^|/)(?:[^/.][^/]*|\\.[^/.][^/]*|\\.\\.[^/]+)/\\.{1,2}(?:/|$)",
+								"message": "internal import paths must not contain noncanonical dot segments"
+							},
+							{
+								"regex": "^(?:(?:\\./)+\\.\\.(?:/|$)|(?:\\.\\./)+(?:\\./)+)|//",
+								"message": "relative import paths must not contain normalized traversal segments"
+							},
+							{
+								"regex": "\\\\",
+								"message": "import paths must use portable forward slashes"
+							},
+							{
+								"regex": "^typescript(?:[/?#]|$)",
+								"message": "the in-process compiler API is not a surface the fleet uses"
+							},
+							{
+								"regex": "^(?:node:|(?:_(?:http_(?:agent|client|common|incoming|outgoing|server)|stream_(?:duplex|passthrough|readable|transform|wrap|writable)|tls_(?:common|wrap))|assert(?:/strict)?|async_hooks|buffer|child_process|cluster|console|constants|crypto|dgram|diagnostics_channel|dns(?:/promises)?|domain|events|fs(?:/promises)?|http|http2|https|inspector(?:/promises)?|module|net|os|path(?:/(?:posix|win32))?|perf_hooks|process|punycode|querystring|readline(?:/promises)?|repl|sqlite|stream(?:/(?:consumers|promises|web))?|string_decoder|sys|timers(?:/promises)?|tls|trace_events|tty|url|util(?:/types)?|v8|vm|wasi|worker_threads|zlib)(?:[/?#]|$)|@app/server(?:[/?#]|$)|@src/server(?:[/?#]|$)|@orkestrel/[^/]+/server(?:[/?#]|$)|(?:\\.\\./)+(?:server|src/server|app/server)(?:[/?#]|$))",
+								"message": "app/vue must not depend on Node or server-only modules"
+							}
+						]
+					}
+				]
+			}
+		},
 		{
 			"files": ["app/server/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx,vue}"],
 			"rules": {
@@ -356,16 +468,20 @@
 					"error",
 					{
 						"patterns": [
+							{
+								"regex": "^(?:@(?:src|app)/vue(?:[/?#]|$)|@orkestrel/[^/]+/vue(?:[/?#]|$)|(?:\\.\\./)+(?:vue|src/vue|app/vue)(?:[/?#]|$))",
+								"message": "app/server must not depend on Vue extension modules"
+							},
 							{
 								"regex": "^(?:/|[A-Za-z]:[\\\\/])",
 								"message": "imports must not use machine-specific absolute paths"
 							},
 							{
-								"regex": "^(?!node:)[A-Za-z][A-Za-z0-9+.-]*:",
+								"regex": "^(?:[A-Za-mo-z][A-Za-z0-9+.-]*|n(?:[A-Za-np-z0-9+.-][A-Za-z0-9+.-]*)?|no(?:[A-Za-ce-z0-9+.-][A-Za-z0-9+.-]*)?|nod(?:[A-Za-df-z0-9+.-][A-Za-z0-9+.-]*)?|node[A-Za-z0-9+.-]+):",
 								"message": "imports must not use non-Node URL schemes"
 							},
 							{
-								"regex": "(?:^|/)(?!\\.{1,2}(?:/|$))[^/]+/\\.{1,2}(?:/|$)",
+								"regex": "(?:^|/)(?:[^/.][^/]*|\\.[^/.][^/]*|\\.\\.[^/]+)/\\.{1,2}(?:/|$)",
 								"message": "internal import paths must not contain noncanonical dot segments"
 							},
 							{
@@ -405,11 +521,11 @@
 								"message": "imports must not use machine-specific absolute paths"
 							},
 							{
-								"regex": "^(?!node:)[A-Za-z][A-Za-z0-9+.-]*:",
+								"regex": "^(?:[A-Za-mo-z][A-Za-z0-9+.-]*|n(?:[A-Za-np-z0-9+.-][A-Za-z0-9+.-]*)?|no(?:[A-Za-ce-z0-9+.-][A-Za-z0-9+.-]*)?|nod(?:[A-Za-df-z0-9+.-][A-Za-z0-9+.-]*)?|node[A-Za-z0-9+.-]+):",
 								"message": "imports must not use non-Node URL schemes"
 							},
 							{
-								"regex": "(?:^|/)(?!\\.{1,2}(?:/|$))[^/]+/\\.{1,2}(?:/|$)",
+								"regex": "(?:^|/)(?:[^/.][^/]*|\\.[^/.][^/]*|\\.\\.[^/]+)/\\.{1,2}(?:/|$)",
 								"message": "internal import paths must not contain noncanonical dot segments"
 							},
 							{
@@ -433,7 +549,7 @@
 								"message": "src/bin must not depend on private app modules"
 							},
 							{
-								"regex": "^(?:(?:vue|vite)(?:[/?#]|$)|@(?:vue|vitejs)/|@src/browser(?:[/?#]|$)|@orkestrel/[^/]+/browser(?:[/?#]|$)|(?:\\.\\./)+(?:browser|src/browser|app/browser)(?:[/?#]|$))",
+								"regex": "^(?:(?:vue|vite)(?:[/?#]|$)|@(?:vue|vitejs)/|@src/(?:browser|vue)(?:[/?#]|$)|@orkestrel/[^/]+/(?:browser|vue)(?:[/?#]|$)|(?:\\.\\./)+(?:browser|vue|src/(?:browser|vue)|app/browser)(?:[/?#]|$))",
 								"message": "src/bin must not depend on browser-only modules"
 							}
 						]
@@ -446,7 +562,7 @@
 				"tests/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx,vue}",
 				"configs/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx,vue}",
 				"scripts/**/*.{cjs,cts,js,jsx,mjs,mts,ts,tsx,vue}",
-				"*.{cjs,cts,js,mjs,mts,ts}"
+				"./*.{cjs,cts,js,mjs,mts,ts}"
 			],
 			"rules": {
 				"no-restricted-imports": [

package/dist/host/dotfiles/prettierignore

@@ -5,7 +5,7 @@
 dist/
 
 # Generated single-file application showcase.
-demo/showcase.html
+showcase/
 
 # Campaign records under the orchestration folder are verbatim evidence, not formatted source.
 .orkestrel/

package/dist/host/guides/README.md

@@ -16,15 +16,19 @@ guide mirrors, and the `WriteTransaction` those writes stage through. The `scaff
 ([`src/bin`](../src/bin)) publishes no barrel, so it is documented in prose and sits outside the
 surface bijection.
 
-The [Blueprint reference](scaffold.md#blueprint) describes the journey axis and its adopter-edited
-`configs/app/vite.journey.config.ts` wrapper, the `SetupRuntime` list, and the `setup:browser`
-project. The generated workspace runs journey variants and browser setup proofs through its
-`test` chain.
-
 That bijection is the row's contract, and [`tests/guides.test.ts`](../tests/guides.test.ts)
 enforces it: every symbol the guide documents exists in the core barrel or the server barrel, and
 every symbol either barrel exports is documented.
 
+The [Blueprint reference](scaffold.md#blueprint) describes the structural facts, the
+`SetupRuntime` list, and the `setup:browser` project. The
+[surfaces and extensions reference](scaffold.md#surfaces-and-extensions) describes the browser
+surface with its journey and showcase modes, the styles surface with its themes target, the `vue`
+faces and named-sheet extensions, the creation options, their refusals, and the advisories on a
+declared selection, the marker each fact is read from, the ownership of every path a sheet face
+emits, the page stamp, the external resolution of each published face, the vendored proofs, the
+root setup mirror, and the migration guard. Both sections belong to the `scaffold.md` row.
+
 ## By directory
 
 | Directory    | Guide                        |