@orkestrel/scaffold 0.0.85 → 0.0.86

package/dist/host/agents/skills/orkestrel-publish/SKILL.md

@@ -20,12 +20,12 @@ description: Run an Orkestrel release from layer order to registry confirmation.
 
 ## Scripts
 
-| Script               | Does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `scripts/compare.ts` | `[--package NAME] [--version V] [--tarball PATH] [--dist dist] [--json]`, run from the package root after its build: fetches the published tarball and lists the material differences from the rebuilt `dist/` (sourcemaps excluded, whitespace-only differences ignored). Exit 0 when nothing differs, 3 when something does, 2 when the tarball cannot be read, 64 on usage (no package name, no `dist/`, or `--tarball` with no path).                                                                                                                                                                                                                                                                                                                                             |
-| `scripts/pins.ts`    | `--version PRIOR [--range PRIOR_RANGE ...] [--paths src,tests] [--json]`, run from the package root: lists every line under the paths carrying the prior version literal or a prior range literal, once per line, sweeping a one-comparator range such as `^8.3.0` for its bare version in any form. Exit 0 with no hits, 3 with hits, 64 on usage (no literal, or a flag with no value).                                                                                                                                                                                                                                                                                                                                                                                             |
-| `scripts/wave.ts`    | `--visit [--target DIR] [--offline] [--from STEP] [--to STEP] [--prior VERSION] [--dry-run] [--json] [--out FILE]` runs one repository's visit in the order [wave.md](references/wave.md) § Visit a repository fixes (pin, commit, overwrite, verify, install, pins, format, gates, compare), stops at the first failing step, and prints each step's exit, the bump ruling (the rebuilt dist against the published tarball, and the final runtime dependency set against the published manifest), and a row for `.orkestrel/release.md`; `--prior` names the version a pre-ruled bump replaced so the self-pin sweep finds it; `--plan` prints the packages by layer from the catalog table. Exit 0 when every step passed, 1 when one failed, 2 when a reading failed, 64 on usage. |
-| `scripts/window.ts`  | `--whoami [--wait SECONDS]` reads or polls `npm whoami`; `--login` prints the operator's login command and polls `whoami` until it answers; `--publish DIR... --otp CODE` uploads back to back with `npm publish --ignore-scripts --otp`, journals each upload under `tmp/units/`, stops at the first refusal naming where to resume, and confirms each accepted version against the registry; `--confirm NAME@VERSION...` re-reads the registry until it serves the version. Exit 0 on success, 3 when not.                                                                                                                                                                                                                                                                          |
+| Script               | Does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `scripts/compare.ts` | `[--package NAME] [--version V] [--tarball PATH] [--dist dist] [--json]`, run from the package root after its build: fetches the published tarball and lists the material differences from the rebuilt `dist/` (sourcemaps excluded, whitespace-only differences ignored). Exit 0 when nothing differs, 3 when something does, 2 when the tarball cannot be read, 64 on usage (no package name, no `dist/`, or `--tarball` with no path).                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `scripts/pins.ts`    | `--version PRIOR [--range PRIOR_RANGE ...] [--paths src,tests] [--json]`, run from the package root: lists every line under the paths carrying the prior version literal or a prior range literal, once per line, sweeping a one-comparator range such as `^8.3.0` for its bare version in any form. Exit 0 with no hits, 3 with hits, 64 on usage (no literal, or a flag with no value).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `scripts/wave.ts`    | `--visit [--target DIR] [--offline] [--from STEP] [--to STEP] [--prior VERSION] [--dry-run] [--json] [--out FILE]` runs one repository's visit in the order [wave.md](references/wave.md) § Visit a repository fixes (pin, commit, overwrite, verify, install, pins, format, gates, compare), stops at the first failing step, and prints each step's exit (a failed step names the `code: message` refusal or the `note` a JSON verb writes on stdout, else the last stderr lines), the bump ruling (the rebuilt dist against the published tarball, and the final runtime dependency set against the published manifest), and a row for `.orkestrel/release.md`; `--prior` names the version a pre-ruled bump replaced so the self-pin sweep finds it; `--plan` prints the packages by layer from the catalog table. Exit 0 when every step passed, 1 when one failed, 2 when a reading failed, 64 on usage. |
+| `scripts/window.ts`  | `--whoami [--wait SECONDS]` reads or polls `npm whoami`; `--login` prints the operator's login command and polls `whoami` until it answers; `--publish DIR... --otp CODE` uploads back to back with `npm publish --ignore-scripts --otp`, journals each upload under `tmp/units/`, stops at the first refusal naming where to resume, and confirms each accepted version against the registry; `--confirm NAME@VERSION...` re-reads the registry until it serves the version. Exit 0 on success, 3 when not.                                                                                                                                                                                                                                                                                                                                                                                                   |
 
 The user's current instruction wins. `references/release.md` owns the credential
 and authorization law; nothing here weakens it.

package/dist/host/agents/skills/orkestrel-publish/references/wave.md

@@ -35,8 +35,9 @@ by hand only to repair it, then resume with `--from <step>`.
      again. Keep a local MCP server registration outside the repository rather than at `.mcp.json`.
 4. Force-verify every `@orkestrel` range against a registry sweep taken after the previous layer
    published.
-5. Run the full install. The overwrite re-declares the toolchain ranges, so the lockfile the first
-   install regenerated no longer matches the manifest.
+5. Run the full install. The overwrite re-declares the toolchain ranges and declares each planned
+   dependency the manifest lacks, so the lockfile the first install regenerated no longer matches the
+   manifest.
 6. Sweep the self-pins, per § Sweep the self-pins: the re-pin moves the snapshot class.
 7. Run the mutating `format` script to converge generated writes.
 8. Run the quality gates.

package/dist/host/agents/skills/orkestrel-publish/scripts/wave.ts

@@ -14,11 +14,12 @@
 // fatal), format, gates (format:check, lint:check, check, build, test), and compare (the rebuilt
 // dist against the published tarball, and the final runtime dependency set against the published
 // manifest `npm view NAME --json` serves; both readings are reported, not fatal). The summary
-// carries each step's exit and duration, the bump ruling, and a Markdown row for
-// `.orkestrel/release.md`. --dry-run prints the commands and runs nothing, so its ruling is
-// unanswered. --plan reads the marker-bounded catalog table in `.claude/agents/orkestrel.md` and
-// prints the packages by layer. Exit 0 when every step passed, 1 when a step failed, 2 when a
-// reading failed, 64 on usage.
+// carries each step's exit and duration, a failed step's refusal (the `code: message` envelope or
+// the `note` a JSON verb prints on stdout, else the last stderr lines), the bump ruling, and a
+// Markdown row for `.orkestrel/release.md`. --dry-run prints the commands and runs nothing, so its
+// ruling is unanswered. --plan reads the marker-bounded catalog table in
+// `.claude/agents/orkestrel.md` and prints the packages by layer. Exit 0 when every step passed, 1
+// when a step failed, 2 when a reading failed, 64 on usage.
 import type { SpawnSyncReturns } from 'node:child_process'
 import { spawnSync } from 'node:child_process'
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'node:fs'
@@ -158,8 +159,20 @@ function describeCommand(file: string, args: readonly string[]): string {
 	return [file === process.execPath ? 'node' : file, ...args].join(' ')
 }
 
+// A JSON verb writes its refusal envelope or its partial-run note on stdout, so the stderr tail
+// alone reads empty for exactly the failures the operator needs named.
 function describeFailure(result: SpawnSyncReturns<string>): string | undefined {
 	if (result.status === 0) return undefined
+	const value = readJsonObject(result.stdout)
+	const error = value?.error
+	if (typeof error === 'object' && error !== null && !Array.isArray(error)) {
+		const envelope = Object.fromEntries(Object.entries(error))
+		const code = readString(envelope, 'code')
+		const message = readString(envelope, 'message')
+		if (code !== undefined && message !== undefined) return `${code}: ${message}`
+	}
+	const note = readString(value, 'note')
+	if (note !== undefined) return note
 	return result.stderr
 		.trim()
 		.split(/\r\n|\n/)
@@ -341,11 +354,11 @@ function runOverwrite(
 		runner.target,
 	)
 	if (runner.offline && written !== undefined && written.status === 1) {
-		const note = readString(readJsonObject(written.stdout) ?? {}, 'note')
+		const note = readString(readJsonObject(written.stdout), 'note')
 		if (note !== undefined && note.includes(OFFLINE_REFUSAL)) {
 			replaceLastStep(runner, 0, 'offline overwrite skipped the catalog step by design')
 		} else {
-			replaceLastStep(runner, 1, note ?? describeFailure(written))
+			replaceLastStep(runner, 1, describeFailure(written))
 		}
 	}
 	if (!failed(runner)) {

package/dist/host/claude/agents/orkestrel.md

@@ -78,7 +78,7 @@ so network-controlled descriptions never enter agent instruction context.
 | `@orkestrel/reason`     | `0.0.12` | L2    | `@orkestrel/emitter` `^0.0.11`, `@orkestrel/contract` `^0.0.18`                                                                                                                                                                                                                                                             |                                                                |
 | `@orkestrel/relation`   | `0.0.14` | L3    | `@orkestrel/emitter` `^0.0.11`, `@orkestrel/contract` `^0.0.18`, `@orkestrel/database` `^0.0.16`                                                                                                                                                                                                                            |                                                                |
 | `@orkestrel/router`     | `0.0.16` | L2    | `@orkestrel/abort` `^0.0.12`, `@orkestrel/emitter` `^0.0.11`, `@orkestrel/contract` `^0.0.18`                                                                                                                                                                                                                               |                                                                |
-| `@orkestrel/scaffold`   | `0.0.84` | L3    | `@orkestrel/console` `^0.0.15`, `@orkestrel/emitter` `^0.0.11`, `@orkestrel/process` `^0.0.14`, `@orkestrel/contract` `^0.0.19`, `@orkestrel/markdown` `^0.0.17`, `@orkestrel/template` `^0.0.9`                                                                                                                            |                                                                |
+| `@orkestrel/scaffold`   | `0.0.85` | L3    | `@orkestrel/console` `^0.0.15`, `@orkestrel/emitter` `^0.0.11`, `@orkestrel/process` `^0.0.14`, `@orkestrel/contract` `^0.0.19`, `@orkestrel/markdown` `^0.0.17`, `@orkestrel/template` `^0.0.9`                                                                                                                            |                                                                |
 | `@orkestrel/sea`        | `0.0.18` | L3    | `@orkestrel/emitter` `^0.0.11`, `@orkestrel/process` `^0.0.14`, `@orkestrel/contract` `^0.0.18`                                                                                                                                                                                                                             |                                                                |
 | `@orkestrel/server`     | `0.0.22` | L3    | `@orkestrel/abort` `^0.0.12`, `@orkestrel/codec` `^0.0.5`, `@orkestrel/router` `^0.0.16`, `@orkestrel/emitter` `^0.0.11`, `@orkestrel/timeout` `^0.0.12`, `@orkestrel/contract` `^0.0.19`                                                                                                                                   |                                                                |
 | `@orkestrel/sqlite`     | `0.0.13` | L1    | `@orkestrel/contract` `^0.0.18`                                                                                                                                                                                                                                                                                             |                                                                |

package/dist/host/guides/scaffold.md

@@ -306,6 +306,7 @@ Exported from `@orkestrel/scaffold`, and reachable from
 | `blueprintToTestArtifacts`          | function | Compiles every artifact in the `tests` group that is not vendored from the host.                         |
 | `blueprintToWritableScripts`        | function | Projects a blueprint into the manifest scripts a region write may replace.                               |
 | `dependenciesToQuestions`           | function | Measures one declared package list against the name and range syntax it accepts.                         |
+| `insertManifestDependencies`        | function | Inserts dependencies a package manifest does not declare into the section each one names.                |
 | `overridesToQuestions`              | function | Measures a blueprint's overrides against the artifacts drafted for it.                                   |
 | `pathToCondition`                   | function | Builds one `exports` condition block for a built environment.                                            |
 | `planToFindings`                    | function | Compares a plan against a target's current content.                                                      |
@@ -539,7 +540,7 @@ option grants a write.
 | `audit`     | Nothing                                                                                    |
 | `repair`    | Each planned path the target is missing or has let drift, and the range and script regions |
 | `catalog`   | The package table, the guide mirrors, and the range region                                 |
-| `overwrite` | Everything `repair` and `catalog` write, plus deletions                                    |
+| `overwrite` | Everything `repair` and `catalog` write, deletions, and missing planned dependencies       |
 
 ### Baselines
 
@@ -589,7 +590,7 @@ scaffold <verb> [options]
   scaffold catalog [--all] [--from <path>] [--target <path>] [--json]
       regenerate the package table and refresh the guide mirrors
   scaffold overwrite [--groups <list>] [--dirty] [--offline] [--from <path>] [--target <path>] [--json]
-      do everything repair and catalog do, then delete what the plan does not own and re-declare the dependency ranges
+      do everything repair and catalog do, then delete what the plan does not own, re-declare the dependency ranges, and declare each planned dependency the manifest lacks
 
 options
   --src <list>                   the published library environments to build: core, browser, server
@@ -802,9 +803,20 @@ live in either section, and how current a declared range is belongs to the regis
 Dependency floors describes rather than to this question. A present section that is not an object
 produces a question instead of a crash. This question belongs to `configs` and `tests`. `audit`
 reports it only when its selection includes either group, without changing its exit semantics.
-`repair` and `overwrite` refuse before writing a selected `configs` or `tests` group. A selection
-that excludes those groups proceeds, and no verb adds the declaration for you: `package.json` is
-birth-owned, and the range and script regions are the only parts of it a verb rewrites.
+`repair` refuses before writing a selected `configs` or `tests` group, and a selection that
+excludes those groups proceeds: `package.json` is birth-owned, and `repair` rewrites only its range
+and script regions. `overwrite` declares each missing package instead, in the `devDependencies` map
+the plan assigns it, at its planned range, before the first declared key that sorts after it. A
+manifest with no `devDependencies` map gets one: `overwrite` creates it as one top-level key after
+`dependencies`, or last in the manifest object when `dependencies` is absent too, in the indentation
+of the manifest's first key. The declaration lands with the repair, before the catalog step, so a
+partial run keeps it. The JSON result names each declaration in `additions`, and the human report
+prints one `Declared "<name>": "<range>" in devDependencies. Run npm install to install it.` line
+per declaration, because the lockfile does not carry the package until the next install. A
+`devDependencies` value that is not an object, or an entry in that map whose value is not a version
+string, leaves `overwrite` no map to declare in. `overwrite` refuses that manifest before any write,
+whatever `--groups` selects, and names the section or each malformed entry. A malformed section
+refuses `repair` as well.
 
 `audit` reports a further non-blocking question, on the `setup` field.
 
@@ -844,6 +856,17 @@ write: a writing verb reports it in the terminal audit it prints, because refusi
 gap no write can close would block every write. Run across a fleet, the question is the list of
 packages carrying a filled, exporting setup module that no proof covers.
 
+`audit` reports a non-blocking question on the `tests` field for each planned sheet test the target
+holds that imports by a root-relative specifier. A sheet test is birth-owned, so a target born
+before the template imported the built sheet by a relative path keeps the
+`'/dist/src/<name>/index.css?raw'` import, and the content-owned `.oxlintrc.json` refuses it under
+`--deny-warnings` through `import/no-absolute-path`. The message names the file and each
+root-relative specifier beside the relative one to write: one `../` per directory between the file
+and the workspace root, so `tests/src/styles/index.test.ts` writes
+`'../../../dist/src/styles/index.css?raw'`. Scaffold never rewrites the file. The question belongs to
+the `tests` group, and `repair` and `overwrite` report it in their terminal audit without
+refusing a write.
+
 `audit` reads the instruction canon as findings rather than as a question. Each `CANON_PATHS` member
 the target holds enters the comparison, by file where the member is a directory, and a path the plan
 does not claim there reports `foreign`. Ownership and drift states that population, and Vendored data
@@ -886,12 +909,14 @@ standard error, so a piped value is never polluted.
 | `audit`     | `Audit` — `findings` and `questions` — plus `releases` and `provenance`; findings carry `ownership`                                                           |
 | `repair`    | `MaterializeResult` plus `audit`, the terminal audit taken after the write, `releases`, and `provenance`                                                      |
 | `catalog`   | `MaterializeResult` plus `mirrors`, `provenance`, optional `membership` with `entries`, `dropped`, and `releases`, and an explanatory `note` on a partial run |
-| `overwrite` | The `catalog` value plus `audit` and top-level `releases` from its version read; `note` explains a partial run                                                |
+| `overwrite` | The `catalog` value plus `audit`, top-level `releases` from its version read, and `additions`; `note` explains a partial run                                  |
 
 The `membership` entity is present only when the catalog read completes. Its `entries` holds the
 package table, `dropped` names packages the preceding table carried that the registry no longer
 lists, and `releases` measures declared fleet ranges against the catalog read. The `overwrite`
-result also retains top-level `releases` from its separate version read, including foreign tools.
+result also retains top-level `releases` from its separate version read, including foreign tools,
+and `additions`, the `DependencyPinSet` of planned dependencies it declared, empty when the
+manifest lacked none.
 An absent `membership` identifies an incomplete catalog read; `note` explains the cause.
 
 The following JSON excerpt shows the membership evidence in a completed catalog result:

package/dist/host/manifest.json

@@ -352,7 +352,7 @@
 			"storage": "agents/skills/orkestrel-publish/SKILL.md",
 			"destination": ".agents/skills/orkestrel-publish/SKILL.md",
 			"executable": false,
-			"digest": "b79e81c49a5b89f8418fc751eaf6d02c68c5dd9f26a4a0678f9025b1915ebda2"
+			"digest": "f4bcc24e910bbd40de268ba6a9d4ba57b3e5f9ce69075dea395479a45ec0f9d4"
 		},
 		{
 			"storage": "agents/skills/orkestrel-publish/agents/openai.yaml",
@@ -370,7 +370,7 @@
 			"storage": "agents/skills/orkestrel-publish/references/wave.md",
 			"destination": ".agents/skills/orkestrel-publish/references/wave.md",
 			"executable": false,
-			"digest": "e519a148a47dbf3271bf3f8a57428a4182afedf9230b56774a97ba5449208325"
+			"digest": "2d5479e0d3ed0529015f5f1f21345fb389f8119333b6c5530d2320be432fe1e1"
 		},
 		{
 			"storage": "agents/skills/orkestrel-publish/references/window.md",
@@ -394,7 +394,7 @@
 			"storage": "agents/skills/orkestrel-publish/scripts/wave.ts",
 			"destination": ".agents/skills/orkestrel-publish/scripts/wave.ts",
 			"executable": false,
-			"digest": "53a85584203346325df82b2b2b20a77a86b64dbbf017afc1fdfc58d782e4f85c"
+			"digest": "e7a492aee9f3c63fcb22e3ab6a90f7a1a292a408d1824d75e3de26ea07a3f3e9"
 		},
 		{
 			"storage": "agents/skills/orkestrel-publish/scripts/window.ts",
@@ -496,7 +496,7 @@
 			"storage": "claude/agents/orkestrel.md",
 			"destination": ".claude/agents/orkestrel.md",
 			"executable": false,
-			"digest": "9a093f83f23cc1f0d1fe1ba139e97afa0d1a38ab45522cc3e150fffc796c3ae3"
+			"digest": "6b3af62e323ff6725680f6a13c3505904154e1d2c0afcb8ba7151a00ff5875c2"
 		},
 		{
 			"storage": "claude/agents/planner.md",
@@ -1042,7 +1042,7 @@
 			"storage": "guides/scaffold.md",
 			"destination": "guides/scaffold.md",
 			"executable": false,
-			"digest": "116e87dd3c9b5c23451bb53a2365f7df8982e6782f60a3466070c8058c099700"
+			"digest": "9d6ea9f86610e3237d6ddbe120aabdec137f022092fc5311ca18e87d4b4e6212"
 		},
 		{
 			"storage": "guides/sea.md",
@@ -2144,5 +2144,5 @@
 			]
 		}
 	],
-	"digest": "f8711433145a8b302c5c8c626c1be5ddbdd2e5a44c1f971fb6fce1ed4f5703b6"
+	"digest": "ccbd92a2462e0a17fb972b7582bf05e6deec0c1f11cf4d2d17e6ebec5cc431bf"
 }

package/dist/src/core/index.cjs

@@ -4,7 +4,7 @@ let _orkestrel_template = require("@orkestrel/template");
 let _orkestrel_emitter = require("@orkestrel/emitter");
 var package_default = {
 	name: "@orkestrel/scaffold",
-	version: "0.0.85",
+	version: "0.0.86",
 	description: "Scaffold workspaces with commands: new, audit, repair, catalog, and overwrite.",
 	keywords: [
 		"audit",
@@ -7361,6 +7361,185 @@ function replaceManifestRanges(manifest, pins) {
 	return declaredRuntime && declaredDevelopment ? compiled : void 0;
 }
 /**
+* Inserts dependencies a package manifest does not declare into the section each one names.
+*
+* @param manifest - The manifest text to compile.
+* @param additions - The runtime and development names and ranges to declare.
+* @returns The manifest declaring every addition, or `undefined` when the text is not a
+* manifest, an addition's section is not an object or holds a value that is not a range, a name
+* is repeated, or `dependencies` or `devDependencies` already declares a name.
+*
+* @remarks
+* Runtime additions enter `dependencies` and development additions enter `devDependencies`. The
+* compiler inserts text instead of serializing the manifest, so every declared byte survives.
+* Each addition lands before the first declared key that sorts after it, or after the last
+* declared key when none does, so a section kept in key order stays in key order. An addition
+* copies the indentation of the section's first entry; an empty section takes its entries one
+* level inside the indentation of its opening line. An absent section is created as one
+* top-level key holding its additions: `devDependencies` after `dependencies`, `dependencies`
+* before `devDependencies`, and either one last in the manifest object when its sibling is
+* absent. The created key copies the indentation of the manifest's first key, and its entries sit
+* one level further in. A name either writable section already declares is the caller's mistake
+* rather than an addition, so the compiler refuses it instead of declaring a package twice.
+*
+* @example
+* ```ts
+* import { insertManifestDependencies } from '@orkestrel/scaffold'
+*
+* insertManifestDependencies('{\n\t"devDependencies": {\n\t\t"vite": "^8.3.2"\n\t}\n}\n', {
+*   runtime: [],
+*   development: [{ name: 'typescript', range: '^6.0.3' }],
+* })
+* // '{\n\t"devDependencies": {\n\t\t"typescript": "^6.0.3",\n\t\t"vite": "^8.3.2"\n\t}\n}\n'
+* ```
+*/
+function insertManifestDependencies(manifest, additions) {
+	const requested = [...additions.runtime, ...additions.development];
+	if (requested.length === 0) return manifest;
+	const parsed = (0, _orkestrel_contract.parseJSON)(manifest);
+	if (!(0, _orkestrel_contract.isRecord)(parsed)) return void 0;
+	const declared = /* @__PURE__ */ new Set();
+	for (const section of ["dependencies", "devDependencies"]) {
+		const entries = parsed[section];
+		if ((0, _orkestrel_contract.isRecord)(entries)) for (const name of Object.keys(entries)) declared.add(name);
+	}
+	const names = new Set(requested.map(({ name }) => name));
+	if (names.size !== requested.length || [...names].some((name) => declared.has(name))) return;
+	let compiled = manifest;
+	const sections = [{
+		name: "dependencies",
+		dependencies: additions.runtime
+	}, {
+		name: "devDependencies",
+		dependencies: additions.development
+	}];
+	for (const section of sections) {
+		if (section.dependencies.length === 0) continue;
+		const entries = parsed[section.name];
+		if (entries !== void 0 && (!(0, _orkestrel_contract.isRecord)(entries) || !Object.values(entries).every(_orkestrel_contract.isString))) return;
+		const ordered = [...section.dependencies].sort((left, right) => (0, _orkestrel_contract.compareValues)(left.name, right.name));
+		const lines = ordered.map(({ name, range }) => `${JSON.stringify(name)}: ${JSON.stringify(range)}`);
+		const sibling = section.name === "dependencies" ? "devDependencies" : "dependencies";
+		const located = /* @__PURE__ */ new Map();
+		let current;
+		let head = -1;
+		let root = -1;
+		let depth = 0;
+		let cursor = 0;
+		while (cursor < compiled.length && root < 0) {
+			const character = compiled.charAt(cursor);
+			if (character === "\"") {
+				const start = cursor;
+				let quote = cursor + 1;
+				while (quote < compiled.length && compiled.charAt(quote) !== "\"") quote += compiled.charAt(quote) === "\\" ? 2 : 1;
+				if (quote >= compiled.length) return void 0;
+				let colon = quote + 1;
+				while (/\s/u.test(compiled.charAt(colon))) colon += 1;
+				cursor = quote + 1;
+				if (depth !== 1 || compiled.charAt(colon) !== ":") continue;
+				if (head < 0) head = start;
+				const name = (0, _orkestrel_contract.parseJSON)(compiled.slice(start, quote + 1));
+				if (!(0, _orkestrel_contract.isString)(name) || name !== section.name && name !== sibling) continue;
+				if (located.has(name)) continue;
+				let brace = colon + 1;
+				while (/\s/u.test(compiled.charAt(brace))) brace += 1;
+				if (compiled.charAt(brace) !== "{") {
+					if (name === section.name) return void 0;
+					continue;
+				}
+				current = {
+					name,
+					start,
+					open: brace
+				};
+				depth += 1;
+				cursor = brace + 1;
+				continue;
+			}
+			if (character === "{") depth += 1;
+			else if (character === "}") {
+				depth -= 1;
+				if (depth === 1 && current !== void 0) {
+					located.set(current.name, {
+						...current,
+						close: cursor
+					});
+					current = void 0;
+				}
+				if (depth === 0) root = cursor;
+			}
+			cursor += 1;
+		}
+		const bounds = located.get(section.name);
+		if (bounds === void 0) {
+			if (entries !== void 0 || root < 0) return void 0;
+			const breaking = head < 0 ? -1 : compiled.lastIndexOf("\n", head);
+			const margin = breaking < 0 ? "" : compiled.slice(breaking + 1, head);
+			const gap = breaking < 0 || /\S/u.test(margin) ? "" : `\n${margin}`;
+			const block = `${JSON.stringify(section.name)}: {${lines.map((line) => `${gap === "" ? "" : `${gap}${margin}`}${line}`).join(",")}${gap}}`;
+			const neighbor = located.get(sibling);
+			let tail = root - 1;
+			while (tail > 0 && /\s/u.test(compiled.charAt(tail))) tail -= 1;
+			const [position, insertion] = neighbor === void 0 ? [tail + 1, compiled.charAt(tail) === "{" ? block : `,${gap}${block}`] : section.name === "devDependencies" ? [neighbor.close + 1, `,${gap}${block}`] : [neighbor.start, `${block},${gap}`];
+			compiled = compiled.slice(0, position) + insertion + compiled.slice(position);
+			continue;
+		}
+		const { open, close } = bounds;
+		const declarations = [];
+		let key;
+		let scan = open + 1;
+		while (scan < close) {
+			if (compiled.charAt(scan) !== "\"") {
+				scan += 1;
+				continue;
+			}
+			let quote = scan + 1;
+			while (quote < close && compiled.charAt(quote) !== "\"") quote += compiled.charAt(quote) === "\\" ? 2 : 1;
+			if (quote >= close) return void 0;
+			if (key === void 0) {
+				const name = (0, _orkestrel_contract.parseJSON)(compiled.slice(scan, quote + 1));
+				if (!(0, _orkestrel_contract.isString)(name)) return void 0;
+				key = {
+					name,
+					start: scan
+				};
+			} else {
+				declarations.push({
+					...key,
+					end: quote + 1
+				});
+				key = void 0;
+			}
+			scan = quote + 1;
+		}
+		const first = declarations[0];
+		const last = declarations.at(-1);
+		const edits = /* @__PURE__ */ new Map();
+		if (first === void 0 || last === void 0) {
+			const opening = compiled.lastIndexOf("\n", open);
+			let column = opening + 1;
+			while (column < open && /\s/u.test(compiled.charAt(column))) column += 1;
+			const level = opening < 0 ? "" : compiled.slice(opening + 1, column);
+			const separator = opening < 0 ? "" : `\n${level}${level}`;
+			const ending = opening < 0 ? "" : `\n${level}`;
+			compiled = `${compiled.slice(0, open + 1)}${lines.map((line) => `${separator}${line}`).join(",")}${ending}${compiled.slice(close)}`;
+			continue;
+		}
+		const newline = compiled.lastIndexOf("\n", first.start);
+		const indent = newline < 0 ? "" : compiled.slice(newline + 1, first.start);
+		const separator = newline < 0 || /\S/u.test(indent) ? "" : `\n${indent}`;
+		for (const [index, dependency] of ordered.entries()) {
+			const line = lines[index] ?? "";
+			const anchor = declarations.find((declaration) => (0, _orkestrel_contract.compareValues)(declaration.name, dependency.name) > 0);
+			const position = anchor?.start ?? last.end;
+			const text = anchor === void 0 ? `,${separator}${line}` : `${line},${separator}`;
+			edits.set(position, `${edits.get(position) ?? ""}${text}`);
+		}
+		for (const [position, text] of [...edits].sort(([left], [right]) => right - left)) compiled = compiled.slice(0, position) + text + compiled.slice(position);
+	}
+	return compiled;
+}
+/**
 * Replaces named script values in package manifest text.
 *
 * @param manifest - The manifest text to compile.
@@ -8570,6 +8749,7 @@ exports.extractRangeMajor = extractRangeMajor;
 exports.extractVersion = extractVersion;
 exports.inferDrift = inferDrift;
 exports.inferGroup = inferGroup;
+exports.insertManifestDependencies = insertManifestDependencies;
 exports.isArtifact = isArtifact;
 exports.isAudit = isAudit;
 exports.isBlueprint = isBlueprint;