@wairon/cli 5.1.1-dev.71 → 5.1.1-dev.73

package/dist/index.js

@@ -2497,7 +2497,7 @@ var require_dist = __commonJS({
       scaffoldPack: () => scaffoldPack2
     });
     module2.exports = __toCommonJS2(src_exports2);
-    var path28 = __toESM2(require("path"));
+    var path29 = __toESM2(require("path"));
     var import_js_yaml3 = require("js-yaml");
     var import_js_yaml = require("js-yaml");
     var import_crypto = require("crypto");
@@ -3061,7 +3061,7 @@ var require_dist = __commonJS({
       return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
     }
     var fs18 = __toESM2(require("fs"));
-    var path29 = __toESM2(require("path"));
+    var path30 = __toESM2(require("path"));
     var import_fflate = require_node();
     var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".hg", ".svn"]);
     function listEntries(archive) {
@@ -3099,8 +3099,8 @@ var require_dist = __commonJS({
     }
     function writeTree(destDir, files) {
       for (const file of files) {
-        const absolute = path29.join(destDir, file.path);
-        fs18.mkdirSync(path29.dirname(absolute), { recursive: true });
+        const absolute = path30.join(destDir, file.path);
+        fs18.mkdirSync(path30.dirname(absolute), { recursive: true });
         fs18.writeFileSync(absolute, file.contents);
       }
     }
@@ -3113,10 +3113,10 @@ var require_dist = __commonJS({
       for (const entry of fs18.readdirSync(current2, { withFileTypes: true })) {
         if (entry.isDirectory()) {
           if (SKIP_DIRS.has(entry.name)) continue;
-          walkPackDir(root, path29.join(current2, entry.name), out);
+          walkPackDir(root, path30.join(current2, entry.name), out);
         } else if (entry.isFile()) {
-          const absolute = path29.join(current2, entry.name);
-          const relative22 = path29.relative(root, absolute).split(path29.sep).join("/");
+          const absolute = path30.join(current2, entry.name);
+          const relative22 = path30.relative(root, absolute).split(path30.sep).join("/");
           out.push({ path: relative22, contents: fs18.readFileSync(absolute) });
         }
       }
@@ -3167,7 +3167,7 @@ var require_dist = __commonJS({
     function scaffoldPack(request) {
       const files = render(request);
       writeTree(request.targetDir, files);
-      return files.map((file) => path28.join(request.targetDir, file.path));
+      return files.map((file) => path29.join(request.targetDir, file.path));
     }
     function buildPack(sourceDir) {
       const files = readPackDir(sourceDir);
@@ -3224,7 +3224,7 @@ var require_dist = __commonJS({
       }
       const manifest = parseManifest(decode(envelope.contents));
       verifyIntegrity2(manifest, files);
-      const directory = path28.resolve(destDir);
+      const directory = path29.resolve(destDir);
       writeTree(directory, files);
       const result = {
         directory,
@@ -3302,7 +3302,7 @@ var require_dist = __commonJS({
       }
       const manifest = parseTreeManifest(decode(envelope.contents));
       verifyTreeIntegrity(manifest, files);
-      const directory = path28.resolve(destDir);
+      const directory = path29.resolve(destDir);
       writeTree(directory, files);
       const result = {
         destDir: directory,
@@ -3317,7 +3317,7 @@ var require_dist = __commonJS({
       return normalized === "." ? ".wai/" : `${normalized}/.wai/`;
     }
     function normalizeRootPath(relativePath) {
-      const posix2 = relativePath.split(path28.sep).join("/").replace(/^\.\//, "").replace(/\/+$/, "");
+      const posix2 = relativePath.split(path29.sep).join("/").replace(/^\.\//, "").replace(/\/+$/, "");
       return posix2 === "" || posix2 === "." ? "." : posix2;
     }
     function slugify(projectName) {
@@ -3511,13 +3511,17 @@ __export(src_exports, {
   ambiguityMessage: () => ambiguityMessage,
   approvalRecord: () => approvalRecord,
   approvalVerdict: () => approvalVerdict,
+  assertContainedProjectPath: () => assertContainedProjectPath,
   assertProjectInitialized: () => assertProjectInitialized,
   backendCommand: () => backendCommand,
+  backfillChainedSubprojectConfigs: () => backfillChainedSubprojectConfigs,
   buildCanvasDataModel: () => buildCanvasDataModel,
   buildProjectGraph: () => buildProjectGraph,
   buildRuleContext: () => buildRuleContext,
   callSitesOf: () => callSitesOf,
   captureApprovedSpecs: () => captureApprovedSpecs,
+  checkDeclarativePack: () => checkDeclarativePack,
+  clearLoaderIssues: () => clearLoaderIssues,
   cognitiveScore: () => cognitiveScore,
   complexityLevel: () => complexityLevel,
   composeAgentBrief: () => composeAgentBrief,
@@ -3532,6 +3536,7 @@ __export(src_exports, {
   createEmptyTopologyConfig: () => createEmptyTopologyConfig,
   createProjectConfig: () => createProjectConfig,
   currentChildPins: () => currentChildPins,
+  currentRootBinding: () => currentRootBinding,
   declaredPackNames: () => declaredPackNames,
   declaredProfileIds: () => declaredProfileIds,
   declaresGlobalPacks: () => declaresGlobalPacks,
@@ -3539,16 +3544,12 @@ __export(src_exports, {
   defaultNarrativeDetail: () => defaultNarrativeDetail,
   defaultPackSelections: () => defaultPackSelections,
   defaultTargetConfig: () => defaultTargetConfig,
-  deleteComponentSpec: () => deleteComponentSpec,
-  deleteImplementationSpec: () => deleteImplementationSpec,
-  deleteInterfaceSpec: () => deleteInterfaceSpec,
   deleteSpec: () => deleteSpec,
-  deleteSubsystemSpec: () => deleteSubsystemSpec,
-  deleteTypeSpec: () => deleteTypeSpec,
   deregisterPackRef: () => deregisterPackRef,
   deriveExecutionProfile: () => deriveExecutionProfile,
   derivedDocPaths: () => derivedDocPaths,
   detectDomainCandidates: () => detectDomainCandidates,
+  diagnoseProjectPacks: () => diagnoseProjectPacks,
   diagramSetIndex: () => diagramSetIndex,
   diffAgainstApproval: () => diffAgainstApproval,
   diffSize: () => diffSize,
@@ -3564,6 +3565,9 @@ __export(src_exports, {
   factsFor: () => factsFor,
   fieldTypeRefs: () => fieldTypeRefs,
   fieldTypesOf: () => fieldTypesOf,
+  findChainingParent: () => findChainingParent,
+  findChainingSubprojectsMissingConfig: () => findChainingSubprojectsMissingConfig,
+  findLegacySpecFiles: () => findLegacySpecFiles,
   findProjectRoot: () => findProjectRoot,
   findSystemRoot: () => findSystemRoot,
   fromProjectRoot: () => fromProjectRoot,
@@ -3573,6 +3577,7 @@ __export(src_exports, {
   generateDiagramSet: () => generateDiagramSet,
   generateSequenceDiagram: () => generateSequenceDiagram,
   getExporter: () => getExporter,
+  getLoaderIssues: () => getLoaderIssues,
   getProjectRoot: () => getProjectRoot,
   getProjectRootOverride: () => getProjectRootOverride,
   getRequestParentReach: () => getRequestParentReach,
@@ -3580,6 +3585,7 @@ __export(src_exports, {
   getStatusReport: () => getStatusReport,
   globalGuideFilePath: () => globalGuideFilePath,
   globalPacksDir: () => globalPacksDir,
+  globalPacksEnabled: () => globalPacksEnabled,
   globalTemplatesDir: () => globalTemplatesDir,
   hasContext: () => hasContext,
   hasFunctionBody: () => hasFunctionBody,
@@ -3610,8 +3616,9 @@ __export(src_exports, {
   loadImplementationSpecs: () => loadImplementationSpecs,
   loadInterfaceSpec: () => loadInterfaceSpec,
   loadInterfaceSpecs: () => loadInterfaceSpecs,
-  loadProjectConfig: () => loadProjectConfig4,
+  loadProjectConfig: () => loadProjectConfig2,
   loadProjectExtensions: () => loadProjectExtensions,
+  loadProjectVariants: () => loadProjectVariants,
   loadRegistry: () => loadRegistry,
   loadSpec: () => loadSpec,
   loadSpecGraph: () => loadSpecGraph,
@@ -3635,12 +3642,16 @@ __export(src_exports, {
   moveSubsystemProject: () => moveSubsystemProject,
   movedChildren: () => movedChildren,
   narrativeStepForeignFields: () => narrativeStepForeignFields,
+  packDirEntry: () => packDirEntry,
+  packEntryLabel: () => packEntryLabel,
+  packEntryRef: () => packEntryRef,
   packStoreDir: () => packStoreDir,
   parseDeclaredCall: () => parseDeclaredCall,
   parseYaml: () => parseYaml,
   passesIntentFloor: () => passesIntentFloor,
   pathExists: () => pathExists,
   pathKey: () => pathKey,
+  pinInstalledPacksAsSelections: () => pinInstalledPacksAsSelections,
   projectConfigExists: () => projectConfigExists,
   provisionProject: () => provisionProject,
   qualifiedTypeId: () => qualifiedTypeId,
@@ -3668,18 +3679,14 @@ __export(src_exports, {
   resolveImport: () => resolveImport,
   resolveInstalledPack: () => resolveInstalledPack,
   resolveSubprojectForNamespace: () => resolveSubprojectForNamespace,
+  resolveVariantGuidance: () => resolveVariantGuidance,
   retireSpecialists: () => retireSpecialists,
   runWithProjectBinding: () => runWithProjectBinding,
   runWithProjectRoot: () => runWithProjectRoot,
   sameContract: () => sameContract,
-  saveComponentSpec: () => saveComponentSpec,
-  saveImplementationSpec: () => saveImplementationSpec,
-  saveInterfaceSpec: () => saveInterfaceSpec,
   saveSpec: () => saveSpec,
-  saveSubsystemSpec: () => saveSubsystemSpec,
-  saveSystemSpec: () => saveSystemSpec,
   saveTopologyConfig: () => saveTopologyConfig,
-  saveTypeSpec: () => saveTypeSpec,
+  scanAllSpecs: () => scanAllSpecs,
   serializeYaml: () => serializeYaml,
   setExecutionTier: () => setExecutionTier,
   setLogLevel: () => setLogLevel,
@@ -3712,7 +3719,7 @@ module.exports = __toCommonJS(src_exports);
 
 // src/config/project-config.ts
 var fs2 = __toESM(require("fs"));
-var path2 = __toESM(require("path"));
+var path3 = __toESM(require("path"));
 var import_zod4 = require("zod");
 
 // src/utils/fs.ts
@@ -3765,6 +3772,9 @@ function listFilesRecursive(dirPath, ext) {
 }
 var projectRootOverride = null;
 var requestRootStore = new import_node_async_hooks.AsyncLocalStorage();
+function currentRootBinding() {
+  return requestRootStore.getStore();
+}
 function runWithProjectRoot(dir, fn) {
   return requestRootStore.run({ ...requestRootStore.getStore(), root: path.resolve(dir) }, fn);
 }
@@ -3909,6 +3919,7 @@ var BundleNotFoundError = class extends WaironError {
 };
 
 // src/models/project.ts
+var path2 = __toESM(require("path"));
 var import_zod3 = require("zod");
 
 // src/models/agent.ts
@@ -4496,16 +4507,28 @@ function activeTargetTypes(config) {
   const targets = config.targets;
   return targets.filter((t) => typeof t === "string" || t.enabled !== false).map((t) => typeof t === "string" ? t : t.type);
 }
+var PACK_EXT_RE = /\.(ya?ml|cjs|js)$/i;
+function declaredPackNames(config) {
+  const selection = config.profileSelection;
+  return [.../* @__PURE__ */ new Set([
+    ...(config.extensions?.packs ?? []).map((entry) => typeof entry === "string" ? path2.basename(entry).replace(PACK_EXT_RE, "") : entry.name),
+    ...selection?.requiredPackNames ?? [],
+    ...selection?.defaultPackNames ?? []
+  ])];
+}
+function declaredProfileIds(config) {
+  return [...new Set(config.profileSelection?.profileIds ?? [])];
+}
 
 // src/config/project-config.ts
 function waiDirAt(root) {
-  const wai = path2.join(root, ".wai");
-  const legacy = path2.join(root, ".wairon");
+  const wai = path3.join(root, ".wai");
+  const legacy = path3.join(root, ".wairon");
   return !fs2.existsSync(wai) && fs2.existsSync(legacy) ? legacy : wai;
 }
 function projectConfigFsAdapterAt(rootDir) {
-  const root = path2.resolve(rootDir);
-  const file = () => path2.join(waiDirAt(root), "project.yaml");
+  const root = path3.resolve(rootDir);
+  const file = () => path3.join(waiDirAt(root), "project.yaml");
   return {
     readDocument() {
       return readYamlFile(file());
@@ -4714,15 +4737,15 @@ function indexOver(store, root) {
     specsDir() {
       try {
         const declared = store.readField("paths.specsDir");
-        if (declared) return path2.resolve(root, declared);
+        if (declared) return path3.resolve(root, declared);
       } catch {
       }
-      return path2.join(waiDirAt(root), "specs");
+      return path3.join(waiDirAt(root), "specs");
     }
   };
 }
 function projectConfigRepositoryOver(adapter, rootDir) {
-  const root = path2.resolve(rootDir);
+  const root = path3.resolve(rootDir);
   const store = storeOver(adapter, root);
   const index = indexOver(store, root);
   const registry = registryOver(store, root);
@@ -4819,36 +4842,24 @@ var projectConfigRepository = {
     bound().pinGlobalPacksAsSelections(selections);
   }
 };
-var PACK_EXT_RE = /\.(ya?ml|cjs|js)$/i;
-function declaredPackNames(config) {
-  const selection = config.profileSelection;
-  return [.../* @__PURE__ */ new Set([
-    ...(config.extensions?.packs ?? []).map((entry) => typeof entry === "string" ? path2.basename(entry).replace(PACK_EXT_RE, "") : entry.name),
-    ...selection?.requiredPackNames ?? [],
-    ...selection?.defaultPackNames ?? []
-  ])];
-}
-function declaredProfileIds(config) {
-  return [...new Set(config.profileSelection?.profileIds ?? [])];
-}
 
 // src/core/domain_projector.ts
 var path16 = __toESM(require("path"));
 
 // src/core/specs.ts
-var fs12 = __toESM(require("fs"));
+var fs11 = __toESM(require("fs"));
 var path15 = __toESM(require("path"));
 
 // src/config/paths.ts
 var fs3 = __toESM(require("fs"));
-var path3 = __toESM(require("path"));
+var path4 = __toESM(require("path"));
 function aiPathsAt(rootDir) {
-  const resolvedRoot = path3.resolve(rootDir);
+  const resolvedRoot = path4.resolve(rootDir);
   const aiDirAt2 = (...segments) => {
-    const waiPath = path3.join(resolvedRoot, ".wai");
-    const waironPath = path3.join(resolvedRoot, ".wairon");
+    const waiPath = path4.join(resolvedRoot, ".wai");
+    const waironPath = path4.join(resolvedRoot, ".wairon");
     const base = !fs3.existsSync(waiPath) && fs3.existsSync(waironPath) ? waironPath : waiPath;
-    return path3.join(base, ...segments);
+    return path4.join(base, ...segments);
   };
   const specsDir = () => projectConfigRepositoryAt(resolvedRoot).specsDir();
   return {
@@ -4865,12 +4876,12 @@ function aiPathsAt(rootDir) {
     contextDomainsMd: () => aiDirAt2("context", "domains.md"),
     contextWaironGuideMd: () => aiDirAt2("context", "wairon-guide.md"),
     specsDir,
-    specsSystem: () => path3.join(specsDir(), ".index.yaml"),
-    specsSubsystemsDir: () => path3.join(specsDir(), "subsystems"),
-    specsComponentsDir: () => path3.join(specsDir(), "components"),
-    specsInterfacesDir: () => path3.join(specsDir(), "interfaces"),
-    specsImplementationsDir: () => path3.join(specsDir(), "implementations"),
-    specsTypesDir: () => path3.join(specsDir(), "types")
+    specsSystem: () => path4.join(specsDir(), ".index.yaml"),
+    specsSubsystemsDir: () => path4.join(specsDir(), "subsystems"),
+    specsComponentsDir: () => path4.join(specsDir(), "components"),
+    specsInterfacesDir: () => path4.join(specsDir(), "interfaces"),
+    specsImplementationsDir: () => path4.join(specsDir(), "implementations"),
+    specsTypesDir: () => path4.join(specsDir(), "types")
   };
 }
 var AI_PATHS = {
@@ -4951,7 +4962,7 @@ function stateIdEquals(a, b) {
 
 // src/core/lockfile.ts
 var fs4 = __toESM(require("fs"));
-var path4 = __toESM(require("path"));
+var path5 = __toESM(require("path"));
 function lockPath() {
   return aiDir("lock.json");
 }
@@ -4983,7 +4994,7 @@ function normalizeRecord(raw) {
 }
 function writeLockRecord(record) {
   const p = lockPath();
-  fs4.mkdirSync(path4.dirname(p), { recursive: true });
+  fs4.mkdirSync(path5.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs4.writeFileSync(tmp, JSON.stringify(withSortedMaps(record), null, 2) + "\n");
   fs4.renameSync(tmp, p);
@@ -5006,7 +5017,7 @@ function withSortedMaps(record) {
 
 // src/core/spec-files.ts
 var fs5 = __toESM(require("fs"));
-var path5 = __toESM(require("path"));
+var path6 = __toESM(require("path"));
 var SPEC_FILE_EXTENSION = ".yaml";
 function readSpecFile(filePath) {
   return readYamlFile(filePath);
@@ -5020,7 +5031,7 @@ function listSpecFiles(specsDir) {
 function removeSpecFile(filePath, specsRoot) {
   if (!fs5.existsSync(filePath)) return false;
   fs5.unlinkSync(filePath);
-  pruneEmptyDirs(path5.dirname(filePath), path5.resolve(specsRoot));
+  pruneEmptyDirs(path6.dirname(filePath), path6.resolve(specsRoot));
   return true;
 }
 function pruneEmptyDirs(dir, specsRoot) {
@@ -5028,7 +5039,7 @@ function pruneEmptyDirs(dir, specsRoot) {
   while (at !== specsRoot && at.startsWith(specsRoot)) {
     if (!fs5.existsSync(at) || fs5.readdirSync(at).length > 0) return;
     fs5.rmdirSync(at);
-    at = path5.dirname(at);
+    at = path6.dirname(at);
   }
 }
 
@@ -5206,7 +5217,13 @@ var PublicInterfaceSchema = import_zod8.z.object({
   /** The L2 component that realizes this public interface (the subsystem's published surface). */
   component: SpecIdSchema.optional(),
   /** Optional L3 interface on that component backing this entry. */
-  interface: SpecIdSchema.optional()
+  interface: SpecIdSchema.optional(),
+  /**
+   * The subsystems this surface is published to. Absent, anyone may depend on
+   * it; present, only these subsystems may — when every entry publishing the
+   * component names consumers, the union of those lists is the whole set.
+   */
+  consumers: import_zod8.z.array(SpecIdSchema).optional()
 });
 var TrustedLinkSchema = import_zod8.z.object({
   /** The peer subsystem id this link sanctions tight coupling with. */
@@ -6580,7 +6597,7 @@ function jumpFieldsOf(s) {
 }
 
 // src/models/code-model.ts
-var path6 = __toESM(require("path"));
+var path7 = __toESM(require("path"));
 function pathKey(sourcePath) {
   return sourcePath.replace(/\\/g, "/").replace(/^\.\//, "");
 }
@@ -6615,7 +6632,7 @@ function hasFunctionBody(facts, symbol) {
 }
 function resolveImport(fromFile, specifier, knownPaths) {
   if (!specifier.startsWith(".")) return void 0;
-  const joined = pathKey(path6.posix.normalize(path6.posix.join(path6.posix.dirname(fromFile), specifier)));
+  const joined = pathKey(path7.posix.normalize(path7.posix.join(path7.posix.dirname(fromFile), specifier)));
   const candidates = [
     joined,
     joined.replace(/\.js$/, ".ts"),
@@ -6711,7 +6728,7 @@ function resolveNarrativeLabels(methodName, steps) {
 
 // src/core/canvas.ts
 var fs6 = __toESM(require("fs"));
-var path7 = __toESM(require("path"));
+var path8 = __toESM(require("path"));
 
 // src/core/canvas-layout.ts
 function computeLayout(model, collapsed) {
@@ -7370,9 +7387,9 @@ function embedJson(value) {
 }
 function loadCytoscapeLib() {
   const candidates = [
-    path7.resolve(__dirname, "..", "templates", "canvas", "cytoscape.min.js"),
+    path8.resolve(__dirname, "..", "templates", "canvas", "cytoscape.min.js"),
     // src/core & dist/cli
-    path7.resolve(__dirname, "templates", "canvas", "cytoscape.min.js")
+    path8.resolve(__dirname, "templates", "canvas", "cytoscape.min.js")
     // dist (library entry)
   ];
   for (const p of candidates) {
@@ -11544,10 +11561,47 @@ var MODEL = __MODEL_JSON__;
 </html>
 `;
 
+// src/core/surfaces.ts
+var fs7 = __toESM(require("fs"));
+var path9 = __toESM(require("path"));
+
+// src/core/openapi.ts
+var yaml2 = __toESM(require("js-yaml"));
+
+// src/core/surfaces.ts
+var SURFACES_DIRNAME = "surfaces";
+function surfacesDir(rootDir) {
+  return path9.join(rootDir, ".wai", SURFACES_DIRNAME);
+}
+function listSnapshots(rootDir = getProjectRoot()) {
+  const dir = surfacesDir(rootDir);
+  if (!fs7.existsSync(dir)) return [];
+  const out = [];
+  for (const file of fs7.readdirSync(dir)) {
+    if (!file.endsWith(".yaml") && !file.endsWith(".yml")) continue;
+    try {
+      out.push(SurfaceSnapshotSchema.parse(readYamlFile(path9.join(dir, file))));
+    } catch {
+    }
+  }
+  return out;
+}
+function listMountSnapshots(mounts) {
+  const bound2 = path9.resolve(getProjectRoot());
+  const out = [];
+  for (const namespace of mounts) {
+    const dir = resolveSubprojectForNamespace(namespace);
+    if (!dir || path9.resolve(dir) === bound2) continue;
+    const snapshots = listSnapshots(dir);
+    if (snapshots.length > 0) out.push({ namespace, snapshots });
+  }
+  return out;
+}
+
 // src/core/extensions.ts
-var fs8 = __toESM(require("fs"));
+var fs9 = __toESM(require("fs"));
 var os2 = __toESM(require("os"));
-var path10 = __toESM(require("path"));
+var path12 = __toESM(require("path"));
 var import_module = require("module");
 var import_zod9 = require("zod");
 
@@ -11575,12 +11629,12 @@ function isNewerVersion(current2, candidate) {
 
 // src/core/packstore.ts
 var crypto2 = __toESM(require("crypto"));
-var fs7 = __toESM(require("fs"));
-var path9 = __toESM(require("path"));
+var fs8 = __toESM(require("fs"));
+var path11 = __toESM(require("path"));
 
 // src/config/defaults.ts
 var os = __toESM(require("os"));
-var path8 = __toESM(require("path"));
+var path10 = __toESM(require("path"));
 var DEFAULT_TARGET_DIRS = {
   claude: ".claude/agents",
   gemini: ".gemini/agents",
@@ -11596,7 +11650,7 @@ function defaultTargetConfig(type) {
     enabled: true
   };
 }
-var WAIRON_VERSION = "5.1.1-dev.71";
+var WAIRON_VERSION = "5.1.1-dev.73";
 var GITHUB_REPO = "SYW-Apps/Waffle-AIron";
 var ARCHITECT_AGENT_ID = "agent-architect";
 var ARCHITECT_TEMPLATE_ID = "architect";
@@ -11607,7 +11661,7 @@ function globalTemplatesDir(projectOverride) {
   if (projectOverride) {
     return projectOverride;
   }
-  return path8.join(os.homedir(), ".wairon", "templates");
+  return path10.join(os.homedir(), ".wairon", "templates");
 }
 var BACKEND_COMMANDS = {
   claude: "claude",
@@ -11643,7 +11697,7 @@ function packStoreDir() {
 function packFiles(dir, prefix = "") {
   let entries;
   try {
-    entries = fs7.readdirSync(dir, { withFileTypes: true });
+    entries = fs8.readdirSync(dir, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -11651,25 +11705,25 @@ function packFiles(dir, prefix = "") {
   for (const e of entries) {
     if (DIGEST_EXCLUDED.has(e.name)) continue;
     const rel2 = prefix ? `${prefix}/${e.name}` : e.name;
-    if (e.isDirectory()) out.push(...packFiles(path9.join(dir, e.name), rel2));
+    if (e.isDirectory()) out.push(...packFiles(path11.join(dir, e.name), rel2));
     else if (e.isFile()) out.push(rel2);
   }
   return out.sort();
 }
 function computePackDigest(packDir) {
   const hash = crypto2.createHash("sha256");
-  const abs = path9.resolve(packDir);
+  const abs = path11.resolve(packDir);
   let isFile = false;
   try {
-    isFile = fs7.statSync(abs).isFile();
+    isFile = fs8.statSync(abs).isFile();
   } catch {
   }
-  const entries = isFile ? [[path9.basename(abs), abs]] : packFiles(abs).map((rel2) => [rel2, path9.join(abs, rel2)]);
+  const entries = isFile ? [[path11.basename(abs), abs]] : packFiles(abs).map((rel2) => [rel2, path11.join(abs, rel2)]);
   for (const [rel2, full] of entries) {
     hash.update(rel2);
     hash.update("\0");
     try {
-      hash.update(fs7.readFileSync(full));
+      hash.update(fs8.readFileSync(full));
     } catch {
     }
     hash.update("\0");
@@ -11678,7 +11732,7 @@ function computePackDigest(packDir) {
 }
 function readInstallRecord(packPath) {
   try {
-    const raw = readYamlFile(path9.join(packPath, INSTALL_RECORD));
+    const raw = readYamlFile(path11.join(packPath, INSTALL_RECORD));
     return raw && typeof raw === "object" ? raw : {};
   } catch {
     return {};
@@ -11709,14 +11763,14 @@ function installedFrom(location, name, version) {
 function versionedEntries(nameDir, fallbackName) {
   let versions;
   try {
-    versions = fs7.readdirSync(nameDir, { withFileTypes: true });
+    versions = fs8.readdirSync(nameDir, { withFileTypes: true });
   } catch {
     return [];
   }
   const out = [];
   for (const v of versions) {
     if (!v.isDirectory()) continue;
-    const versionDir = path9.join(nameDir, v.name);
+    const versionDir = path11.join(nameDir, v.name);
     const entryFile = packDirEntry(versionDir);
     if (!entryFile) continue;
     out.push(installedFrom(versionDir, declaredName(entryFile) ?? fallbackName, v.name));
@@ -11724,7 +11778,7 @@ function versionedEntries(nameDir, fallbackName) {
   return out;
 }
 function storeEntryPacks(store, entry) {
-  const full = path9.join(store, entry.name);
+  const full = path11.join(store, entry.name);
   if (entry.isFile()) {
     if (!PACK_FILE_RE.test(entry.name)) return [];
     const name = declaredName(full) ?? entry.name.replace(PACK_FILE_RE, "");
@@ -11739,7 +11793,7 @@ function listInstalledPacks() {
   const store = packStoreDir();
   let entries;
   try {
-    entries = fs7.readdirSync(store, { withFileTypes: true });
+    entries = fs8.readdirSync(store, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -11756,17 +11810,17 @@ function resolveInstalledPack(name, version) {
   return candidates[0];
 }
 function installPackFromDirectory(sourceDir, origin) {
-  const abs = path9.resolve(sourceDir);
+  const abs = path11.resolve(sourceDir);
   const entryFile = packDirEntry(abs);
   if (!entryFile) {
     throw new Error(`"${sourceDir}" is not a pack directory (no pack.yaml | pack.cjs | index.cjs | \u2026).`);
   }
-  const manifest = readManifest(entryFile, path9.dirname(entryFile));
+  const manifest = readManifest(entryFile, path11.dirname(entryFile));
   const version = manifest.version && manifest.version.length > 0 ? manifest.version : UNVERSIONED;
-  const dest = path9.join(packStoreDir(), manifest.name, version);
-  fs7.rmSync(dest, { recursive: true, force: true });
-  fs7.mkdirSync(path9.dirname(dest), { recursive: true });
-  fs7.cpSync(abs, dest, { recursive: true });
+  const dest = path11.join(packStoreDir(), manifest.name, version);
+  fs8.rmSync(dest, { recursive: true, force: true });
+  fs8.mkdirSync(path11.dirname(dest), { recursive: true });
+  fs8.cpSync(abs, dest, { recursive: true });
   const digest2 = computePackDigest(dest);
   const record = {
     origin,
@@ -11774,7 +11828,7 @@ function installPackFromDirectory(sourceDir, origin) {
     waironVersion: WAIRON_VERSION,
     installedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  writeYamlFile(path9.join(dest, INSTALL_RECORD), record);
+  writeYamlFile(path11.join(dest, INSTALL_RECORD), record);
   return {
     name: manifest.name,
     version,
@@ -11789,11 +11843,11 @@ function uninstallPack(name, version) {
   const targets = listInstalledPacks().filter((p) => p.name === name && (!version || p.version === version));
   if (targets.length === 0) return false;
   for (const target of targets) {
-    fs7.rmSync(target.path, { recursive: true, force: true });
-    const parent = path9.dirname(target.path);
-    if (path9.resolve(parent) === path9.resolve(packStoreDir())) continue;
+    fs8.rmSync(target.path, { recursive: true, force: true });
+    const parent = path11.dirname(target.path);
+    if (path11.resolve(parent) === path11.resolve(packStoreDir())) continue;
     try {
-      if (fs7.readdirSync(parent).length === 0) fs7.rmdirSync(parent);
+      if (fs8.readdirSync(parent).length === 0) fs8.rmdirSync(parent);
     } catch {
     }
   }
@@ -11944,6 +11998,10 @@ function skillExtendErrors(skills) {
   return skills.filter((s) => s.extends !== void 0 && !EXTENDABLE_BUILTIN_SKILLS.includes(s.extends)).map((s) => `Extension pack "${s.pack}" declares a skill extending "${s.extends}", which is not a builtin skill (extendable: ${EXTENDABLE_BUILTIN_SKILLS.join(", ")}).`);
 }
 var GLOBAL_PACKS_DEFAULT = false;
+function checkDeclarativePack(manifest) {
+  const result = DeclarativePackSchema.safeParse(manifest);
+  return result.success ? null : result.error.issues[0]?.message ?? "shape mismatch";
+}
 function globalPacksEnabled(config) {
   return config.extensions?.useGlobalPacks ?? GLOBAL_PACKS_DEFAULT;
 }
@@ -11951,27 +12009,27 @@ function emptyExtensions() {
   return { packNames: [], packs: [], rules: [], profiles: {}, languages: {}, skills: [], patterns: [], guarantees: [], assertions: [], instructions: [], errors: [], selectionFailures: [] };
 }
 function globalPacksDir() {
-  return process.env.WAIRON_PACKS_DIR ?? path10.join(os2.homedir(), ".wairon", "packs");
+  return process.env.WAIRON_PACKS_DIR ?? path12.join(os2.homedir(), ".wairon", "packs");
 }
 var PACK_DIR_ENTRIES = ["pack.yaml", "pack.yml", "pack.cjs", "pack.js", "index.cjs", "index.js"];
 function packDirEntry(dir) {
   for (const name of PACK_DIR_ENTRIES) {
-    const p = path10.join(dir, name);
-    if (fs8.existsSync(p)) return p;
+    const p = path12.join(dir, name);
+    if (fs9.existsSync(p)) return p;
   }
   return null;
 }
 function latestVersionDir(nameDir) {
   let versions;
   try {
-    versions = fs8.readdirSync(nameDir, { withFileTypes: true });
+    versions = fs9.readdirSync(nameDir, { withFileTypes: true });
   } catch {
     return null;
   }
   let best = null;
   for (const v of versions) {
     if (!v.isDirectory()) continue;
-    const dir = path10.join(nameDir, v.name);
+    const dir = path12.join(nameDir, v.name);
     if (!packDirEntry(dir)) continue;
     if (!best || isNewerVersion(best.version, v.name)) best = { version: v.name, dir };
   }
@@ -11980,13 +12038,13 @@ function latestVersionDir(nameDir) {
 function discoverPacks(dir) {
   let entries;
   try {
-    entries = fs8.readdirSync(dir, { withFileTypes: true });
+    entries = fs9.readdirSync(dir, { withFileTypes: true });
   } catch {
     return [];
   }
   const refs = [];
   for (const e of entries.sort((a, b) => compareOrdinal(a.name, b.name))) {
-    const full = path10.join(dir, e.name);
+    const full = path12.join(dir, e.name);
     if (e.isDirectory()) {
       if (packDirEntry(full)) refs.push(full);
       else {
@@ -12016,7 +12074,7 @@ function mergePack(out, pack, ref, scope, packDir) {
       foreignBuiltins: [.../* @__PURE__ */ new Set([...existing.foreignBuiltins, ...def.foreignBuiltins])]
     } : def;
   }
-  for (const s of pack.skills) out.skills.push({ ...s, pack: pack.name, packVersion: pack.version, sourcePath: path10.resolve(packDir, s.source) });
+  for (const s of pack.skills) out.skills.push({ ...s, pack: pack.name, packVersion: pack.version, sourcePath: path12.resolve(packDir, s.source) });
   for (const p of pack.patterns) out.patterns.push({ ...p, pack: pack.name });
   out.guarantees = [.../* @__PURE__ */ new Set([...out.guarantees, ...pack.guarantees])];
   for (const a of pack.assertions) out.assertions.push({ ...a, pack: pack.name, fullCode: assertionFullCode(pack.name, a.code) });
@@ -12024,10 +12082,10 @@ function mergePack(out, pack, ref, scope, packDir) {
 }
 var isYamlPath = (p) => /\.ya?ml$/i.test(p);
 function resolvePackRef(ref, projectRoot) {
-  const pathLike = ref.startsWith(".") || path10.isAbsolute(ref) || isYamlPath(ref);
+  const pathLike = ref.startsWith(".") || path12.isAbsolute(ref) || isYamlPath(ref);
   if (!pathLike) return ref;
-  const resolved = path10.resolve(projectRoot, ref);
-  if (fs8.existsSync(resolved) && fs8.statSync(resolved).isDirectory()) {
+  const resolved = path12.resolve(projectRoot, ref);
+  if (fs9.existsSync(resolved) && fs9.statSync(resolved).isDirectory()) {
     const entry = packDirEntry(resolved);
     if (!entry) throw new Error(`directory pack has no entry file (${PACK_DIR_ENTRIES.join(" | ")})`);
     return entry;
@@ -12040,7 +12098,7 @@ function readManifest(target, projectRoot) {
     if (raw == null) throw new Error("file not found or empty");
     return { ...DeclarativePackSchema.parse(raw), rules: [] };
   }
-  const req = (0, import_module.createRequire)(path10.join(projectRoot, "package.json"));
+  const req = (0, import_module.createRequire)(path12.join(projectRoot, "package.json"));
   const modRaw = req(target);
   const mod = modRaw?.default ?? modRaw;
   const parsed = DeclarativePackSchema.parse({
@@ -12068,7 +12126,7 @@ function loadExtensionPacks(refs, projectRoot) {
     try {
       const target = resolvePackRef(ref, projectRoot);
       const manifest = readManifest(target, projectRoot);
-      mergePack(out, manifest, ref, scope, path10.dirname(target));
+      mergePack(out, manifest, ref, scope, path12.dirname(target));
       for (const r of manifest.rules) out.rules.push(r);
     } catch (e) {
       out.errors.push(`Extension pack "${ref}" failed to load: ${e instanceof Error ? e.message : String(e)}`);
@@ -12114,7 +12172,7 @@ function defaultPackSelections() {
       const entry = packDirEntry(pack.path) ?? pack.path;
       let manifest;
       try {
-        manifest = readManifest(entry, path10.dirname(entry));
+        manifest = readManifest(entry, path12.dirname(entry));
       } catch {
         continue;
       }
@@ -12130,6 +12188,66 @@ function defaultPackSelections() {
     return [];
   }
 }
+function diagnoseProjectPacks() {
+  const empty = { globalsUndeclared: false, notApplied: [], unresolved: [], globalsApplied: [] };
+  try {
+    const config = projectConfigRepository.load();
+    if (!config) return empty;
+    const globalsUndeclared = !projectConfigRepository.declaresGlobalPacks();
+    const projectRoot = getProjectRoot();
+    const entries = config.extensions?.packs ?? [];
+    const unresolved = [];
+    const selectedNames = /* @__PURE__ */ new Set();
+    for (const entry of entries) {
+      if (typeof entry === "string") continue;
+      selectedNames.add(entry.name);
+      const resolution = resolveSelection(entry, projectRoot);
+      if (resolution.failure) {
+        unresolved.push({ label: packEntryLabel(entry), message: `[${resolution.failure.code}] ${resolution.failure.message}` });
+      }
+    }
+    const installed = listInstalledPacks();
+    const globalsOn = globalPacksEnabled(config);
+    const globalsApplied = [];
+    if (globalsOn) {
+      for (const ref of discoverPacks(globalPacksDir())) {
+        const match = installed.find((p) => path12.resolve(p.path) === path12.resolve(ref));
+        if (match) globalsApplied.push({ name: match.name, version: match.version });
+      }
+    }
+    const applying = /* @__PURE__ */ new Set([...selectedNames, ...globalsApplied.map((p) => p.name)]);
+    const notApplied = installed.filter((p) => !applying.has(p.name)).map((p) => ({ name: p.name, version: p.version, origin: p.origin }));
+    return { globalsUndeclared, notApplied, unresolved, globalsApplied };
+  } catch {
+    return empty;
+  }
+}
+function pinInstalledPacksAsSelections() {
+  const diagnosis = diagnoseProjectPacks();
+  if (!diagnosis.globalsUndeclared || diagnosis.notApplied.length === 0) return [];
+  const added = [];
+  const selections = [];
+  for (const pack of diagnosis.notApplied) {
+    selections.push({
+      name: pack.name,
+      version: pack.version,
+      // Carry the origin so the selection can be obtained elsewhere; a local
+      // path is not fetchable, so it is deliberately not recorded as a source.
+      ...pack.origin && /^[a-z][a-z0-9+.-]*:\/\//i.test(pack.origin) ? { source: pack.origin } : {}
+    });
+    added.push(`${pack.name}@${pack.version}`);
+  }
+  projectConfigRepository.pinGlobalPacksAsSelections(selections);
+  return added;
+}
+function packEntryLabel(entry) {
+  if (typeof entry === "string") return entry;
+  return entry.version ? `${entry.name}@${entry.version}` : entry.name;
+}
+function packEntryRef(entry, projectRoot) {
+  if (typeof entry === "string") return entry;
+  return resolveSelection(entry, projectRoot).ref ?? null;
+}
 function resolveSelection(selection, projectRoot) {
   const wanted = selection.version ? `${selection.name}@${selection.version}` : selection.name;
   const fail = (code, message) => ({ failure: { code, severity: "error", name: selection.name, message } });
@@ -12171,7 +12289,7 @@ function verifyIntegrity(selection, packDir, where) {
   };
 }
 function detectBundleStoreDrift(selection, bundleDir) {
-  const bundledVersion = path10.basename(bundleDir);
+  const bundledVersion = path12.basename(bundleDir);
   const installed = resolveInstalledPack(selection.name, bundledVersion);
   if (!installed) return void 0;
   const bundleDigest = computePackDigest(bundleDir);
@@ -12185,22 +12303,22 @@ function detectBundleStoreDrift(selection, bundleDir) {
   };
 }
 function findBundledPack(projectRoot, selection) {
-  const base = path10.join(projectRoot, ".wai", "packs", selection.name);
+  const base = path12.join(projectRoot, ".wai", "packs", selection.name);
   if (selection.version) {
-    const pinned = path10.join(base, selection.version);
+    const pinned = path12.join(base, selection.version);
     return packDirEntry(pinned) ? pinned : null;
   }
   if (packDirEntry(base)) return base;
   let versions;
   try {
-    versions = fs8.readdirSync(base, { withFileTypes: true });
+    versions = fs9.readdirSync(base, { withFileTypes: true });
   } catch {
     return null;
   }
   let best = null;
   for (const v of versions) {
     if (!v.isDirectory()) continue;
-    const dir = path10.join(base, v.name);
+    const dir = path12.join(base, v.name);
     if (!packDirEntry(dir)) continue;
     if (!best || isNewerVersion(best.version, v.name)) best = { version: v.name, dir };
   }
@@ -12243,21 +12361,21 @@ function buildCodeIndex(model) {
   const declarations = /* @__PURE__ */ new Map();
   const anchors = /* @__PURE__ */ new Map();
   const findingAnchors = /* @__PURE__ */ new Map();
-  const namesAt = (cache, path28, make) => {
-    const cached = cache.get(path28);
+  const namesAt = (cache, path29, make) => {
+    const cached = cache.get(path29);
     if (cached) return cached;
-    const f = facts.get(path28);
+    const f = facts.get(path29);
     if (!f) return NO_NAMES;
     const built = make(f);
-    cache.set(path28, built);
+    cache.set(path29, built);
     return built;
   };
   const republished = /* @__PURE__ */ new Map();
-  const republishedFrom = (path28) => {
-    const cached = republished.get(path28);
+  const republishedFrom = (path29) => {
+    const cached = republished.get(path29);
     if (cached) return cached;
-    const out = /* @__PURE__ */ new Set([path28]);
-    const queue = [path28];
+    const out = /* @__PURE__ */ new Set([path29]);
+    const queue = [path29];
     while (queue.length) {
       const from = queue.pop();
       const f = facts.get(from);
@@ -12270,7 +12388,7 @@ function buildCodeIndex(model) {
         }
       }
     }
-    republished.set(path28, out);
+    republished.set(path29, out);
     return out;
   };
   const NO_ORIGIN = /* @__PURE__ */ new Set();
@@ -12279,9 +12397,9 @@ function buildCodeIndex(model) {
     return to ? republishedFrom(to) : NO_ORIGIN;
   };
   const scopeOf = (site, from) => {
-    const path28 = pathKey(site.from ?? from);
-    const f = facts.get(path28);
-    return f?.status === "analyzed" && f.analysisGrade === "exact" ? { path: path28, facts: f } : void 0;
+    const path29 = pathKey(site.from ?? from);
+    const f = facts.get(path29);
+    return f?.status === "analyzed" && f.analysisGrade === "exact" ? { path: path29, facts: f } : void 0;
   };
   const originOf2 = (site, from) => {
     const resolved = scopeOf(site, from);
@@ -12320,14 +12438,14 @@ function buildCodeIndex(model) {
     if (site.via) for (const typeName of localTypesOf(f, site.via)) widenThroughType(typeName);
     return out;
   };
-  const declarationsAt = (path28) => namesAt(declarations, pathKey(path28), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames]));
+  const declarationsAt = (path29) => namesAt(declarations, pathKey(path29), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames]));
   return {
     paths,
     exactPaths,
-    factsAt: (path28) => facts.get(pathKey(path28)),
+    factsAt: (path29) => facts.get(pathKey(path29)),
     declarationsAt,
-    anchorsAt: (path28) => namesAt(anchors, pathKey(path28), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames, ...f.anchoredNames])),
-    findingAnchorsAt: (path28) => namesAt(findingAnchors, pathKey(path28), (f) => new Set(f.anchoredNames)),
+    anchorsAt: (path29) => namesAt(anchors, pathKey(path29), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames, ...f.anchoredNames])),
+    findingAnchorsAt: (path29) => namesAt(findingAnchors, pathKey(path29), (f) => new Set(f.anchoredNames)),
     originOf: originOf2,
     possibleOriginsOf
   };
@@ -12365,10 +12483,10 @@ function buildRealizationIndex(ctx) {
   return {
     paths,
     implementationsOf: (compId) => implsByComponent.get(compId) ?? NONE_IMPL,
-    implementationsAt: (path28) => implsByPath.get(pathKey(path28)) ?? NONE_IMPL,
+    implementationsAt: (path29) => implsByPath.get(pathKey(path29)) ?? NONE_IMPL,
     filesOf: (compId) => filesByComponent.get(compId) ?? NONE_PATH,
     filesIn: (subsystemId) => filesBySubsystem.get(subsystemId) ?? NONE_PATH,
-    componentsAt: (path28) => componentsByPath.get(pathKey(path28)) ?? NONE_COMP
+    componentsAt: (path29) => componentsByPath.get(pathKey(path29)) ?? NONE_COMP
   };
 }
 function buildImportGraph(index, universe) {
@@ -12380,22 +12498,22 @@ function buildImportGraph(index, universe) {
       if (to && to !== from) into.add(to);
     }
   };
-  const importsOf = (path28) => {
-    const cached = imports.get(path28);
+  const importsOf = (path29) => {
+    const cached = imports.get(path29);
     if (cached) return cached;
-    const facts = index.factsAt(path28);
+    const facts = index.factsAt(path29);
     const out = /* @__PURE__ */ new Set();
-    if (facts?.status === "analyzed") resolveAll(path28, facts.imports, out);
-    imports.set(path28, out);
+    if (facts?.status === "analyzed") resolveAll(path29, facts.imports, out);
+    imports.set(path29, out);
     return out;
   };
-  const tracesOf = (path28) => {
-    const cached = traces.get(path28);
+  const tracesOf = (path29) => {
+    const cached = traces.get(path29);
     if (cached) return cached;
-    const facts = index.factsAt(path28);
-    const out = new Set(importsOf(path28));
-    if (facts?.status === "analyzed") resolveAll(path28, facts.reexports, out);
-    traces.set(path28, out);
+    const facts = index.factsAt(path29);
+    const out = new Set(importsOf(path29));
+    if (facts?.status === "analyzed") resolveAll(path29, facts.reexports, out);
+    traces.set(path29, out);
     return out;
   };
   return {
@@ -12779,6 +12897,32 @@ var publicSurfaceBindingRule = {
   }
 };
 
+// src/core/rules/integrity/public-surface-consumers.ts
+var publicSurfaceConsumersRule = {
+  name: "public-surface-consumers",
+  description: "Every subsystem a published surface names as its consumer must exist in the tree. A consumers list restricts who may depend on the surface, so an id that names nothing locks the surface against a caller nobody can be \u2014 and a typo there silently locks out the caller that was meant, which the boundary rule would then report against the wrong party.",
+  codes: [
+    { code: "PUBLIC_INTERFACE_UNKNOWN_CONSUMER", defaultSeverity: "error", summary: "A published surface names as its consumer a subsystem the tree does not have" }
+  ],
+  check(ctx) {
+    const known = new Set(ctx.subsystems.map((s) => s.id));
+    for (const sub of ctx.subsystems) {
+      for (const pi of sub.publicInterfaces) {
+        for (const consumer of pi.consumers ?? []) {
+          if (known.has(consumer)) continue;
+          ctx.addIssue(
+            "error",
+            "PUBLIC_INTERFACE_UNKNOWN_CONSUMER",
+            `Subsystem "${sub.id}" publishes "${pi.component ?? `${pi.type} ${pi.details}`}" to consumer "${consumer}", which names no subsystem of this tree. Name an existing subsystem, or drop the id \u2014 a consumers list admits only the subsystems it names.`,
+            sub.id,
+            isDraftSubsystem(sub)
+          );
+        }
+      }
+    }
+  }
+};
+
 // src/core/rules/integrity/public-surface-declared-type.ts
 var pubTypeMatches = (piType, ct, portalType) => {
   switch (piType) {
@@ -13706,11 +13850,11 @@ var unconditionalCallCyclesRule = {
       const memberEdges = keys.flatMap((k) => (adjacency.get(k) ?? []).filter((e) => inScc.has(e.toKey)));
       if (memberEdges.length === 0) continue;
       const anchor = [...memberEdges].sort((a, b) => byCodeUnit(a.fromKey, b.fromKey) || byCodeUnit(a.impl.id, b.impl.id) || a.stepNumber - b.stepNumber)[0];
-      const path28 = [...keys].sort(byCodeUnit).join(" \u2192 ");
+      const path29 = [...keys].sort(byCodeUnit).join(" \u2192 ");
       ctx.addIssue(
         "warning",
         "UNCONDITIONAL_CALL_CYCLE",
-        `Call cycle with no guard: ${path28} \u2014 every call edge in this cycle is unavoidable on all paths of its narrative (e.g. step ${anchor.stepNumber} of "${anchor.methodName}" in "${anchor.impl.id}" always calls ${anchor.toLabel}). This recurses without a base case, by construction. Guard at least one edge with a branch/return before the call, or lint.allow with the termination argument.`,
+        `Call cycle with no guard: ${path29} \u2014 every call edge in this cycle is unavoidable on all paths of its narrative (e.g. step ${anchor.stepNumber} of "${anchor.methodName}" in "${anchor.impl.id}" always calls ${anchor.toLabel}). This recurses without a base case, by construction. Guard at least one edge with a branch/return before the call, or lint.allow with the termination argument.`,
         anchor.impl.id,
         memberEdges.some((e) => ctx.isImplementationDraft(e.impl))
       );
@@ -14148,14 +14292,15 @@ var authSourceWiringRule = {
 // src/core/rules/doctrine/subsystem-boundary-dependencies.ts
 var subsystemBoundaryDepsRule = {
   name: "subsystem-boundary-dependencies",
-  description: "Judges every dependsOn edge that leaves its own subsystem, and every one that resolves nowhere. Across subsystems the shape is client Adapter \u2192 published remote Portal, OR a direct in-process edge licensed by a trustedLink declared on the SOURCE subsystem (the published-Portal target requirement applies either way). A reference that names nothing in this tree is resolved against the stored surface snapshots: a hit is a DECLARED remote portal and the same Adapter requirement applies to it, snapshots of several providers that disagree make the reference ambiguous, and a reference authored to leave this root that no snapshot covers warns instead of erroring. Boundary rules are never relaxed by a pack profile.",
+  description: "Judges every dependsOn edge that leaves its own subsystem, and every one that resolves nowhere. Across subsystems the shape is client Adapter \u2192 published remote Portal, OR a direct in-process edge licensed by a trustedLink declared on the SOURCE subsystem (the published-Portal target requirement applies either way). A published surface may also name the subsystems it serves (a publicInterfaces entry's consumers): a component every one of whose entries names consumers may be depended on only from those subsystems, which is how a provider keeps a surface \u2014 the raw spec writes \u2014 away from a door that must not reach it. A reference that names nothing in this tree is resolved against the stored surface snapshots: a hit is a DECLARED remote portal and the same Adapter requirement applies to it, snapshots of several providers that disagree make the reference ambiguous, and a reference authored to leave this root that no snapshot covers warns instead of erroring. Boundary rules are never relaxed by a pack profile.",
   codes: [
     { code: "INVALID_DEPENDENCY_REFERENCE", defaultSeverity: "error", summary: "dependsOn names a non-existent component" },
     { code: "CROSS_TREE_REF_UNRESOLVED", defaultSeverity: "warning", summary: "Cross-tree dependsOn (super::/:: form) with no surface snapshot covering it" },
     { code: "SURFACE_REF_AMBIGUOUS", defaultSeverity: "error", summary: "Cross-tree dependsOn matched by surface snapshots of several providers with different contracts" },
     { code: "CROSS_SUBSYSTEM_NON_ADAPTER", defaultSeverity: "error", summary: "Non-Adapter component crossing a subsystem boundary" },
     { code: "CROSS_SUBSYSTEM_PRIVATE_ACCESS", defaultSeverity: "error", summary: "Cross-subsystem dependency on an unpublished component" },
-    { code: "CROSS_SUBSYSTEM_TARGET_NON_PORTAL", defaultSeverity: "error", summary: "Cross-subsystem hop entering through a non-Portal" }
+    { code: "CROSS_SUBSYSTEM_TARGET_NON_PORTAL", defaultSeverity: "error", summary: "Cross-subsystem hop entering through a non-Portal" },
+    { code: "CROSS_SUBSYSTEM_UNLISTED_CONSUMER", defaultSeverity: "error", summary: "Cross-subsystem dependency on a surface published only to other subsystems" }
   ],
   check(ctx) {
     for (const edge of ctx.dependencyEdges().all) {
@@ -14238,9 +14383,24 @@ var subsystemBoundaryDepsRule = {
           edge.draftContext
         );
       }
+      const publishedTo = restrictedConsumers(ctx, depComp.subsystem, depComp.id);
+      if (publishedTo && !publishedTo.includes(comp.subsystem)) {
+        ctx.addIssue(
+          "error",
+          "CROSS_SUBSYSTEM_UNLISTED_CONSUMER",
+          `Boundary violation: "${comp.id}" (subsystem "${comp.subsystem}") depends on "${depComp.id}", which subsystem "${depComp.subsystem}" publishes only to ${publishedTo.map((s) => `"${s}"`).join(", ")}. Depend on a surface published to "${comp.subsystem}" instead, or \u2014 when "${comp.subsystem}" really is a caller the provider meant to serve \u2014 add it to the entry's consumers.`,
+          comp.id,
+          edge.draftContext
+        );
+      }
     }
   }
 };
+function restrictedConsumers(ctx, subsystemId, componentId) {
+  const entries = (ctx.subsystems.find((s) => s.id === subsystemId)?.publicInterfaces ?? []).filter((pi) => pi.component === componentId);
+  if (entries.length === 0 || entries.some((pi) => pi.consumers === void 0)) return null;
+  return [...new Set(entries.flatMap((pi) => pi.consumers ?? []))];
+}
 
 // src/core/rules/doctrine/stereotype-terms.ts
 var NEVER_INLINE_STATE = " Never resolve this by merging the store's state into the consuming component \u2014 state hidden inside a logic block is invisible to the spec and unrecoverable.";
@@ -15361,8 +15521,8 @@ var lifecycleRule = {
 };
 
 // src/core/rules/wiring/portal-mounts.ts
-function liesUnder(path28, prefix) {
-  return path28 === prefix || path28.startsWith(prefix + "/");
+function liesUnder(path29, prefix) {
+  return path29 === prefix || path29.startsWith(prefix + "/");
 }
 var portalMountsRule = {
   name: "portal-mounts",
@@ -16530,11 +16690,11 @@ var hiddenStateRule = {
         byPath.set(key, list);
       }
     }
-    for (const path28 of code.exactPaths) {
-      const facts = code.factsAt(path28);
+    for (const path29 of code.exactPaths) {
+      const facts = code.factsAt(path29);
       const bindings = facts.topLevelMutableBindings ?? [];
       if (bindings.length === 0) continue;
-      const mapped = byPath.get(path28) ?? [];
+      const mapped = byPath.get(path29) ?? [];
       if (mapped.length === 0) continue;
       if (!mapped.every((m) => isStatelessLogic(m.component))) continue;
       const anchor = [...mapped].sort((a, b) => a.impl.id.localeCompare(b.impl.id))[0];
@@ -16600,7 +16760,7 @@ var dependencyConformanceRule = {
       }
       return false;
     };
-    const draftAt = (path28) => realization.implementationsAt(path28).some((impl) => ctx.isImplementationDraft(impl));
+    const draftAt = (path29) => realization.implementationsAt(path29).some((impl) => ctx.isImplementationDraft(impl));
     for (const fromPath of mappedPaths) {
       const fromComponents = realization.componentsAt(fromPath);
       for (const toPath of graph.importsOf(fromPath)) {
@@ -16656,6 +16816,60 @@ var dependencyConformanceRule = {
   }
 };
 
+// src/core/rules/conformance/portal-imports.ts
+var portalImportsRule = {
+  name: "portal-imports",
+  description: "A runtime import that crosses a subsystem boundary must land on a file that realizes one of the target subsystem's PUBLISHED components \u2014 its portal file. dependency-conformance asks whether the hop is declared; this asks where it lands. An import that reaches past the portal into a concrete module can use anything that module exports, published or not, so the portal stops being the boundary and names no contract ever promised leak across it \u2014 which is how a surface grows that nobody designed. In-process it is cosmetic at runtime; it is not cosmetic for the contract. Only exact-grade component-mapped files participate; type-only imports are exempt; chained subprojects validate standalone.",
+  codes: [
+    {
+      code: "IMPORT_BYPASSES_PORTAL",
+      defaultSeverity: "warning",
+      summary: "A runtime import crosses into another subsystem through a file that realizes none of its published components",
+      carryable: true
+    }
+  ],
+  check(ctx) {
+    const code = ctx.codeIndex();
+    const realization = ctx.realizationIndex();
+    const mappedPaths = new Set(realization.paths.filter((p) => code.exactPaths.has(p)));
+    const graph = ctx.importGraph(mappedPaths);
+    const portalFiles = /* @__PURE__ */ new Map();
+    const portalFilesOf = (subsystemId) => {
+      let files = portalFiles.get(subsystemId);
+      if (!files) {
+        files = /* @__PURE__ */ new Set();
+        for (const compId of ctx.publicSet.get(subsystemId) ?? []) {
+          for (const f of realization.filesOf(compId)) if (mappedPaths.has(f)) files.add(f);
+        }
+        portalFiles.set(subsystemId, files);
+      }
+      return files;
+    };
+    const draftAt = (path29) => realization.implementationsAt(path29).some((impl) => ctx.isImplementationDraft(impl));
+    for (const fromPath of mappedPaths) {
+      const fromSubsystems = new Set(realization.componentsAt(fromPath).map((c) => c.subsystem));
+      for (const toPath of graph.importsOf(fromPath)) {
+        const crossed = [...new Set(realization.componentsAt(toPath).map((c) => c.subsystem))].filter((s) => !fromSubsystems.has(s));
+        const bypassed = crossed.filter((s) => !portalFilesOf(s).has(toPath));
+        if (bypassed.length === 0) continue;
+        for (const subsystemId of bypassed) {
+          const portals = [...portalFilesOf(subsystemId)];
+          ctx.addIssue(
+            "warning",
+            "IMPORT_BYPASSES_PORTAL",
+            `"${fromPath}" imports "${toPath}", crossing into subsystem "${subsystemId}" somewhere other than its portal file (${portals.length > 0 ? portals.join(", ") : "none realized at exact grade"}). Import the name from the portal file instead; when no portal of "${subsystemId}" publishes it, it is a surface the provider never promised \u2014 publish it on the contract of the portal whose capability it is, or stop depending on it.`,
+            realization.implementationsAt(fromPath)[0]?.id,
+            draftAt(fromPath) || draftAt(toPath),
+            void 0,
+            // One import edge, one indivisible fact: the EDGE is the site.
+            { at: `${fromPath} -> ${toPath}` }
+          );
+        }
+      }
+    }
+  }
+};
+
 // src/core/rules/conformance/integration-sim-declaration.ts
 var integrationSimDeclarationRule = {
   name: "integration-sim-declaration",
@@ -17167,8 +17381,8 @@ var paramConformanceRule = {
 };
 
 // src/core/rules/conformance/route-coverage.ts
-function liesUnder2(path28, prefix) {
-  return path28 === prefix || path28.startsWith(prefix + "/");
+function liesUnder2(path29, prefix) {
+  return path29 === prefix || path29.startsWith(prefix + "/");
 }
 function normalizeSegment(segment) {
   return /^\{.+\}$/.test(segment) || segment.startsWith(":") ? "*" : segment;
@@ -18733,10 +18947,11 @@ var SDD_RULES = [
   assertionForbiddenEdgesRule,
   assertionRequiredFieldsRule,
   assertionEndpointShapesRule,
-  // The published surface in three questions: what backs the entry, whether
-  // that component's stereotype can realize the type it declares, and whether
-  // the contract it binds is that component's own.
+  // The published surface in four questions: what backs the entry, who it is
+  // published to, whether that component's stereotype can realize the type it
+  // declares, and whether the contract it binds is that component's own.
   publicSurfaceBindingRule,
+  publicSurfaceConsumersRule,
   publicSurfaceDeclaredTypeRule,
   publicSurfaceBoundContractRule,
   cyclesRule,
@@ -18789,6 +19004,8 @@ var SDD_RULES = [
   // The fields-vs-Store criterion: mutable module state in logic-only files.
   hiddenStateRule,
   dependencyConformanceRule,
+  // Where a declared crossing LANDS: on the target subsystem's portal file.
+  portalImportsRule,
   // Integration wiring proof rides after the code↔spec family: it consumes
   // the same code model and speaks about the same sourcePath modules. Four
   // questions about one harness, in the order a reader meets them: is one
@@ -18865,8 +19082,8 @@ function knownIssueCodes() {
 }
 
 // src/core/source-analysis.ts
-var fs9 = __toESM(require("fs"));
-var path11 = __toESM(require("path"));
+var fs10 = __toESM(require("fs"));
+var path13 = __toESM(require("path"));
 var import_module2 = require("module");
 function emptyCodeModel() {
   return { files: [], projectRoot: "", rootFiles: [] };
@@ -19091,7 +19308,7 @@ function resolveTypeScript(projectRoot) {
     return cached.ts;
   }
   let ts = null;
-  const bases = [path11.join(projectRoot, "package.json"), __filename];
+  const bases = [path13.join(projectRoot, "package.json"), __filename];
   for (const base of bases) {
     try {
       const req = (0, import_module2.createRequire)(base);
@@ -19487,7 +19704,7 @@ function walkExact(ts, sourceText, fileName) {
 }
 function resolveRelativeModule(fromFile, specifier) {
   if (!specifier.startsWith(".")) return null;
-  const base = path11.resolve(path11.dirname(fromFile), specifier);
+  const base = path13.resolve(path13.dirname(fromFile), specifier);
   const candidates = [
     base,
     base.replace(/\.js$/, ".ts"),
@@ -19495,12 +19712,12 @@ function resolveRelativeModule(fromFile, specifier) {
     `${base}.ts`,
     `${base}.tsx`,
     `${base}.js`,
-    path11.join(base, "index.ts"),
-    path11.join(base, "index.js")
+    path13.join(base, "index.ts"),
+    path13.join(base, "index.js")
   ];
   for (const c of candidates) {
     try {
-      if (fs9.statSync(c).isFile()) return c;
+      if (fs10.statSync(c).isFile()) return c;
     } catch {
     }
   }
@@ -19508,11 +19725,11 @@ function resolveRelativeModule(fromFile, specifier) {
 }
 function reexportTarget(ts, filePath, specifier, projectRoot, visited, exactCache) {
   const target = resolveRelativeModule(filePath, specifier);
-  if (!target || path11.relative(projectRoot, target).startsWith("..")) return null;
+  if (!target || path13.relative(projectRoot, target).startsWith("..")) return null;
   let targetFacts = exactCache.get(target);
   if (targetFacts === void 0) {
     try {
-      targetFacts = walkExact(ts, fs9.readFileSync(target, "utf8"), target);
+      targetFacts = walkExact(ts, fs10.readFileSync(target, "utf8"), target);
     } catch {
       targetFacts = null;
     }
@@ -19530,7 +19747,7 @@ function carryBody(facts, target, targetPath, local, exported, projectRoot) {
   if (score !== void 0) facts.complexity.set(exported, Math.max(facts.complexity.get(exported) ?? 0, score));
   const targetCalls = target.calls.get(local);
   if (!targetCalls) return;
-  const carriedFrom = pathKey(path11.relative(projectRoot, targetPath));
+  const carriedFrom = pathKey(path13.relative(projectRoot, targetPath));
   const sites = facts.calls.get(exported) ?? /* @__PURE__ */ new Map();
   for (const [key, site] of targetCalls) sites.set(carriedFrom + "|" + key, { ...site, from: site.from ?? carriedFrom });
   facts.calls.set(exported, sites);
@@ -19560,24 +19777,24 @@ function walkDeclaredRoots(roots, exclude, projectRoot) {
   const excluded = exclude.map(pathKey);
   const isExcluded = (key) => excluded.some((e) => key === e || key.startsWith(`${e}/`));
   const record = (absolute) => {
-    const key = pathKey(path11.relative(projectRoot, absolute));
+    const key = pathKey(path13.relative(projectRoot, absolute));
     if (seen.has(key) || isExcluded(key)) return;
-    if (!EXTENSION_LANGUAGE[path11.extname(key).toLowerCase()]) return;
+    if (!EXTENSION_LANGUAGE[path13.extname(key).toLowerCase()]) return;
     seen.add(key);
     found.push(key);
   };
   const descend = (dir) => {
     let entries;
     try {
-      entries = fs9.readdirSync(dir, { withFileTypes: true });
+      entries = fs10.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries.slice().sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0)) {
-      const child = path11.join(dir, entry.name);
+      const child = path13.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === "node_modules" || entry.name.startsWith(".")) continue;
-        if (isExcluded(pathKey(path11.relative(projectRoot, child)))) continue;
+        if (isExcluded(pathKey(path13.relative(projectRoot, child)))) continue;
         descend(child);
       } else if (entry.isFile()) {
         record(child);
@@ -19586,13 +19803,13 @@ function walkDeclaredRoots(roots, exclude, projectRoot) {
   };
   for (const root of roots) {
     const key = pathKey(root);
-    if (path11.isAbsolute(key) || path11.normalize(key).split(path11.sep)[0] === "..") continue;
-    const absolute = path11.resolve(projectRoot, key);
-    if (path11.relative(projectRoot, absolute).startsWith("..")) continue;
+    if (path13.isAbsolute(key) || path13.normalize(key).split(path13.sep)[0] === "..") continue;
+    const absolute = path13.resolve(projectRoot, key);
+    if (path13.relative(projectRoot, absolute).startsWith("..")) continue;
     if (isExcluded(key)) continue;
     let stat;
     try {
-      stat = fs9.statSync(absolute);
+      stat = fs10.statSync(absolute);
     } catch {
       continue;
     }
@@ -19618,23 +19835,23 @@ function buildCodeModel(implementations, types, projectRoot, sourceRoots = [], e
     if (seen.has(sourcePath)) continue;
     seen.add(sourcePath);
     const empty = { declaredNames: [], anchoredNames: [], exportedNames: [], imports: [], reexports: [] };
-    if (path11.isAbsolute(sourcePath) || path11.normalize(sourcePath).split(path11.sep)[0] === "..") {
+    if (path13.isAbsolute(sourcePath) || path13.normalize(sourcePath).split(path13.sep)[0] === "..") {
       files.push({ path: sourcePath, status: "escaped", ...empty });
       continue;
     }
-    const absolute = path11.resolve(projectRoot, sourcePath);
-    if (path11.relative(projectRoot, absolute).startsWith("..")) {
+    const absolute = path13.resolve(projectRoot, sourcePath);
+    if (path13.relative(projectRoot, absolute).startsWith("..")) {
       files.push({ path: sourcePath, status: "escaped", ...empty });
       continue;
     }
     let buffer;
     try {
-      const stat = fs9.statSync(absolute);
+      const stat = fs10.statSync(absolute);
       if (!stat.isFile()) {
         files.push({ path: sourcePath, status: "missing", ...empty });
         continue;
       }
-      buffer = fs9.readFileSync(absolute);
+      buffer = fs10.readFileSync(absolute);
     } catch {
       files.push({ path: sourcePath, status: "missing", ...empty });
       continue;
@@ -19644,7 +19861,7 @@ function buildCodeModel(implementations, types, projectRoot, sourceRoots = [], e
       continue;
     }
     const text = buffer.toString("utf8");
-    const language = EXTENSION_LANGUAGE[path11.extname(sourcePath).toLowerCase()];
+    const language = EXTENSION_LANGUAGE[path13.extname(sourcePath).toLowerCase()];
     let analyzed;
     if (language === "typescript" || language === "javascript") {
       const ts = resolveTypeScript(projectRoot);
@@ -19715,6 +19932,7 @@ var DEPTH_GATED_CODES = {
   CONFORMANCE_DEGRADED: "implementations",
   UNDECLARED_DEPENDENCY: "implementations",
   UNREALIZED_DEPENDENCY: "implementations",
+  IMPORT_BYPASSES_PORTAL: "implementations",
   MISSING_INTEGRATION_SIM: "implementations",
   // L5 expectations: narratives and everything whose fuel is narrative edges
   // (the reachability walk and the hydration round-trip would drown a
@@ -19749,6 +19967,7 @@ var COMPLETENESS_RULES = /* @__PURE__ */ new Set([
   "CONFORMANCE_ANALYSIS_SKIPPED",
   "UNDECLARED_DEPENDENCY",
   "UNREALIZED_DEPENDENCY",
+  "IMPORT_BYPASSES_PORTAL",
   // Detail sufficiency reads the realized code like the conformance family
   // does — a draft tree is allowed to disagree with its code.
   "UNNARRATED_COMPLEXITY",
@@ -20180,244 +20399,49 @@ function buildRuleContext(opts) {
   return ctx;
 }
 
-// src/core/variants.ts
-var fs10 = __toESM(require("fs"));
-var os3 = __toESM(require("os"));
-var path12 = __toESM(require("path"));
-var import_zod10 = require("zod");
-var VariantDefSchema = import_zod10.z.object({
-  /** Variant id referenced by a component's `variant` (e.g. "publisher", "org/external-config-adapter"). */
-  id: import_zod10.z.string().min(1),
-  /** The core stereotype this variant specializes — authoritative for generic semantics (Adapter, Orchestrator, …). */
-  base: import_zod10.z.string().min(1),
-  /** How to implement a component of this variant — the recipe the implementer follows and reuses across same-variant components. */
-  guidance: import_zod10.z.string().min(1),
-  /** Optional: this variant only applies for the given target language (else it applies everywhere). */
-  target: import_zod10.z.string().optional(),
-  /** Optional: this variant only applies under the given architectural profile. */
-  profile: import_zod10.z.string().optional()
-});
-function globalVariantsDir() {
-  return process.env.WAIRON_VARIANTS_DIR ?? path12.join(os3.homedir(), ".wairon", "variants");
-}
-function builtinVariantsDir() {
-  const candidates = [
-    path12.resolve(__dirname, "..", "templates", "variants"),
-    // src/core & dist/cli
-    path12.resolve(__dirname, "templates", "variants")
-    // dist (library entry)
-  ];
-  return candidates.find((dir) => fs10.existsSync(dir)) ?? candidates[0];
-}
-function projectVariantsDir() {
-  return path12.join(getProjectRoot(), ".wai", "variants");
-}
-function variantFiles(dir) {
-  let entries;
+// src/core/validation.ts
+var path14 = __toESM(require("path"));
+function projectPackSelections() {
   try {
-    entries = fs10.readdirSync(dir, { withFileTypes: true });
+    return (loadProjectConfig()?.extensions?.packs ?? []).filter((e) => typeof e !== "string");
   } catch {
     return [];
   }
-  return entries.filter((e) => e.isFile() && /\.ya?ml$/i.test(e.name)).sort((a, b) => a.name.localeCompare(b.name)).map((e) => path12.join(dir, e.name));
-}
-function parseVariants(raw) {
-  if (raw == null) return [];
-  return (Array.isArray(raw) ? raw : [raw]).map((item) => VariantDefSchema.parse(item));
 }
-function reportSkippedFile(file, err) {
-  console.error(`[variants] skipped "${file}": ${err instanceof Error ? err.message : String(err)}`);
+var RESOLUTION_FAILURE_CODES = /* @__PURE__ */ new Set([
+  "UNDEFINED_TYPE_REFERENCE",
+  "INVALID_DEPENDENCY_REFERENCE",
+  "INVALID_TARGET_COMPONENT_REFERENCE",
+  "INVALID_SUBSYSTEM_REFERENCE",
+  "INVALID_TRUSTED_LINK",
+  "CROSS_TREE_REF_UNRESOLVED"
+]);
+var SEVERITY_RANK = { off: 0, warning: 1, error: 2 };
+function issueKey(issue2) {
+  return `${issue2.code}|${issue2.specId ?? ""}`;
 }
-function readVariantsDir(dir) {
-  const out = [];
-  for (const file of variantFiles(dir)) {
-    try {
-      out.push(...parseVariants(readYamlFile(file)));
-    } catch (err) {
-      reportSkippedFile(file, err);
-    }
+function worstByKey(issues) {
+  const worst = /* @__PURE__ */ new Map();
+  for (const issue2 of issues) {
+    const key = issueKey(issue2);
+    const seen = worst.get(key);
+    if (!seen || SEVERITY_RANK[issue2.severity] > SEVERITY_RANK[seen]) worst.set(key, issue2.severity);
   }
-  return out;
+  return worst;
 }
-function mergeById(...layers) {
-  const byId = /* @__PURE__ */ new Map();
-  for (const layer of layers) {
-    for (const v of layer) byId.set(v.id, v);
+function stricterSeverities(parent, child) {
+  const fromParent = parent?.sddRuleSeverity ?? {};
+  const fromChild = child?.sddRuleSeverity ?? {};
+  const codes = /* @__PURE__ */ new Set([...Object.keys(fromParent), ...Object.keys(fromChild)]);
+  if (codes.size === 0) return parent ?? child;
+  const defaults = new Map(knownIssueCodes().map((rc) => [rc.code, rc.defaultSeverity]));
+  const merged = {};
+  for (const code of codes) {
+    const p = fromParent[code] ?? defaults.get(code);
+    const c = fromChild[code] ?? defaults.get(code);
+    merged[code] = p === void 0 || c === void 0 ? p ?? c : SEVERITY_RANK[p] >= SEVERITY_RANK[c] ? p : c;
   }
-  return [...byId.values()];
-}
-function resolveVariantGuidance(component, allComponents, variantsById) {
-  if (!component.variant) return null;
-  const def = variantsById.get(component.variant);
-  if (!def) return null;
-  return {
-    variant: component.variant,
-    base: def.base,
-    guidance: def.guidance,
-    siblings: allComponents.filter((o) => o.variant === component.variant && o.id !== component.id).map((o) => o.id),
-    ...def.target ? { target: def.target } : {},
-    ...def.profile ? { profile: def.profile } : {}
-  };
-}
-function composeVariantGuidance(comps, allComponents, variantsById) {
-  const resolved = comps.map((c) => ({ id: c.id, guidance: resolveVariantGuidance(c, allComponents, variantsById) })).filter((r) => r.guidance !== null);
-  if (resolved.length === 0) return "";
-  const lines = [
-    "## Component variants \u2014 reuse the shared approach",
-    "",
-    "One or more of your components declare a variant \u2014 a base-anchored kind with implementation guidance. Implement every component of the same variant alike, reusing one shared approach instead of reinventing it per instance:",
-    ""
-  ];
-  for (const { id, guidance } of resolved) {
-    let line = `- **${id}** \u2014 variant \`${guidance.variant}\` (a kind of ${guidance.base}): ${guidance.guidance}`;
-    if (guidance.siblings.length > 0) {
-      line += ` Same-variant components elsewhere: ${guidance.siblings.join(", ")} \u2014 implement them consistently, reusing the same logic/concept.`;
-    }
-    lines.push(line);
-  }
-  return lines.join("\n");
-}
-function loadProjectVariants() {
-  try {
-    return mergeById(
-      readVariantsDir(builtinVariantsDir()),
-      readVariantsDir(globalVariantsDir()),
-      readVariantsDir(projectVariantsDir())
-    );
-  } catch {
-    return [];
-  }
-}
-function listProjectVariants() {
-  return mergeById(readVariantsDir(projectVariantsDir()));
-}
-function rebaseProjectVariants(fromBase, toBase) {
-  const rebased = [];
-  for (const file of variantFiles(projectVariantsDir())) {
-    const content = readFileOrNull(file);
-    if (content === null) continue;
-    let raw;
-    let variants;
-    try {
-      raw = parseYaml(content, file);
-      variants = parseVariants(raw);
-    } catch (err) {
-      reportSkippedFile(file, err);
-      continue;
-    }
-    const matching = variants.filter((v) => v.base === fromBase);
-    if (matching.length === 0) continue;
-    writeFile(file, rebasedText(content, fromBase, toBase, withRebasedEntries(raw, fromBase, toBase)));
-    for (const v of matching) {
-      if (!rebased.includes(v.id)) rebased.push(v.id);
-    }
-  }
-  return rebased;
-}
-function withRebasedEntries(raw, fromBase, toBase) {
-  const rebase = (entry) => entry.base === fromBase ? { ...entry, base: toBase } : entry;
-  return Array.isArray(raw) ? raw.map(rebase) : rebase(raw);
-}
-function rebasedText(content, fromBase, toBase, rebasedContent) {
-  const escaped = fromBase.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const baseLine = new RegExp(`^([ \\t]*(?:-[ \\t]+)?base:[ \\t]*)(["']?)${escaped}\\2(?=[ \\t]*(?:#.*)?$)`, "gm");
-  const edited = content.replace(baseLine, (_line, key, quote) => `${key}${quote}${toBase}${quote}`);
-  try {
-    if (JSON.stringify(parseYaml(edited)) === JSON.stringify(rebasedContent)) return edited;
-  } catch {
-  }
-  return serializeYaml(rebasedContent);
-}
-
-// src/core/surfaces.ts
-var fs11 = __toESM(require("fs"));
-var path13 = __toESM(require("path"));
-
-// src/core/openapi.ts
-var yaml2 = __toESM(require("js-yaml"));
-
-// src/core/surfaces.ts
-var SURFACES_DIRNAME = "surfaces";
-function surfacesDir(rootDir) {
-  return path13.join(rootDir, ".wai", SURFACES_DIRNAME);
-}
-function listSnapshots(rootDir = getProjectRoot()) {
-  const dir = surfacesDir(rootDir);
-  if (!fs11.existsSync(dir)) return [];
-  const out = [];
-  for (const file of fs11.readdirSync(dir)) {
-    if (!file.endsWith(".yaml") && !file.endsWith(".yml")) continue;
-    try {
-      out.push(SurfaceSnapshotSchema.parse(readYamlFile(path13.join(dir, file))));
-    } catch {
-    }
-  }
-  return out;
-}
-function loadSurfaceSnapshots() {
-  return listSnapshots();
-}
-function listMountSnapshots(mounts) {
-  const bound2 = path13.resolve(getProjectRoot());
-  const out = [];
-  for (const namespace of mounts) {
-    const dir = resolveSubprojectForNamespace(namespace);
-    if (!dir || path13.resolve(dir) === bound2) continue;
-    const snapshots = listSnapshots(dir);
-    if (snapshots.length > 0) out.push({ namespace, snapshots });
-  }
-  return out;
-}
-function loadMountSurfaceSnapshots(mounts) {
-  return listMountSnapshots(mounts);
-}
-
-// src/core/validation.ts
-var path14 = __toESM(require("path"));
-function loadProjectConfig2() {
-  return loadProjectConfig();
-}
-function projectPackSelections() {
-  try {
-    return (loadProjectConfig2()?.extensions?.packs ?? []).filter((e) => typeof e !== "string");
-  } catch {
-    return [];
-  }
-}
-var RESOLUTION_FAILURE_CODES = /* @__PURE__ */ new Set([
-  "UNDEFINED_TYPE_REFERENCE",
-  "INVALID_DEPENDENCY_REFERENCE",
-  "INVALID_TARGET_COMPONENT_REFERENCE",
-  "INVALID_SUBSYSTEM_REFERENCE",
-  "INVALID_TRUSTED_LINK",
-  "CROSS_TREE_REF_UNRESOLVED"
-]);
-var SEVERITY_RANK = { off: 0, warning: 1, error: 2 };
-function issueKey(issue2) {
-  return `${issue2.code}|${issue2.specId ?? ""}`;
-}
-function worstByKey(issues) {
-  const worst = /* @__PURE__ */ new Map();
-  for (const issue2 of issues) {
-    const key = issueKey(issue2);
-    const seen = worst.get(key);
-    if (!seen || SEVERITY_RANK[issue2.severity] > SEVERITY_RANK[seen]) worst.set(key, issue2.severity);
-  }
-  return worst;
-}
-function stricterSeverities(parent, child) {
-  const fromParent = parent?.sddRuleSeverity ?? {};
-  const fromChild = child?.sddRuleSeverity ?? {};
-  const codes = /* @__PURE__ */ new Set([...Object.keys(fromParent), ...Object.keys(fromChild)]);
-  if (codes.size === 0) return parent ?? child;
-  const defaults = new Map(knownIssueCodes().map((rc) => [rc.code, rc.defaultSeverity]));
-  const merged = {};
-  for (const code of codes) {
-    const p = fromParent[code] ?? defaults.get(code);
-    const c = fromChild[code] ?? defaults.get(code);
-    merged[code] = p === void 0 || c === void 0 ? p ?? c : SEVERITY_RANK[p] >= SEVERITY_RANK[c] ? p : c;
-  }
-  return { ...parent ?? child, sddRuleSeverity: merged };
+  return { ...parent ?? child, sddRuleSeverity: merged };
 }
 function issue(severity, code, message, agentId, specId) {
   return { severity, code, message, agentId, specId };
@@ -20449,7 +20473,7 @@ function validateSddTree(rulesOrOptions, projectType = "backend") {
   const interfaces = loadInterfaceSpecs();
   const implementations = loadImplementationSpecs();
   const types = loadTypeSpecs();
-  const surfaceSnapshots = loadSurfaceSnapshots();
+  const surfaceSnapshots = listSnapshots();
   const conformance = rules?.conformance;
   const codeModel = buildCodeModel(
     implementations,
@@ -20496,7 +20520,7 @@ function validateSddTree(rulesOrOptions, projectType = "backend") {
     for (const err of extensions.errors) {
       issues.push(issue("error", "EXTENSION_LOAD_ERROR", err));
     }
-    const mountSurfaceSnapshots = loadMountSurfaceSnapshots(
+    const mountSurfaceSnapshots = listMountSnapshots(
       subsystems.filter((s) => s.projectPath).map((s) => s.id)
     );
     const roundTripIssues = dryRunSerializeSpecs(isSpecInScope);
@@ -20584,10 +20608,9 @@ function resolveThroughParent(boundRoot, treatAllAsComplete, childRules) {
   if (chain.length === 0) return null;
   const scope = chain.join("::");
   const inner = runWithProjectRoot(top, () => {
-    invalidateSpecCache();
     let governing = { rules: stricterSeverities(void 0, childRules) };
     try {
-      const config = loadProjectConfig2();
+      const config = loadProjectConfig();
       if (config) governing = { rules: stricterSeverities(config.rules, childRules), projectType: config.projectType };
     } catch {
     }
@@ -21287,7 +21310,7 @@ function canonicalPath(target) {
   const rest = [];
   for (; ; ) {
     try {
-      fs12.lstatSync(existing);
+      fs11.lstatSync(existing);
       break;
     } catch {
       const up = path15.dirname(existing);
@@ -21297,7 +21320,7 @@ function canonicalPath(target) {
     }
   }
   try {
-    return path15.join(fs12.realpathSync.native(existing), ...rest);
+    return path15.join(fs11.realpathSync.native(existing), ...rest);
   } catch {
     return null;
   }
@@ -21389,7 +21412,7 @@ function inspectChainedRoots(rootDir = getProjectRoot()) {
       let reason;
       if (projectPathEscapesRoot(projectDir, projectPath, childDir)) reason = "escapes";
       else if (ancestors.has(chainDirKey(childDir))) reason = "cyclic";
-      else if (!fs12.existsSync(childDir)) reason = "missing";
+      else if (!fs11.existsSync(childDir)) reason = "missing";
       else if (depth >= 32) reason = "too-deep";
       if (reason) {
         const mount = prefix ? qualifyDeclaredId(localId, prefix, true) : localId;
@@ -21441,7 +21464,10 @@ function stripNamespaceFromSubsystem(spec, prefix) {
     publicInterfaces: spec.publicInterfaces.map((pi) => ({
       ...pi,
       component: pi.component ? relMember(pi.component) : void 0,
-      interface: pi.interface ? relMember(pi.interface) : void 0
+      interface: pi.interface ? relMember(pi.interface) : void 0,
+      // consumers name SUBSYSTEMS — peers of this one, so they are relative to
+      // the namespace the subsystem itself is declared in, never its members'.
+      ...pi.consumers ? { consumers: pi.consumers.map((c) => c.includes("::") ? relativizeId(c, prefix) : c) } : {}
     })),
     lifecycle: spec.lifecycle?.map((le) => ({
       ...le,
@@ -21527,9 +21553,9 @@ function findOwner(id, components) {
 }
 function moveComponentFolder(fromDir, toDir) {
   if (path15.normalize(fromDir) === path15.normalize(toDir)) return false;
-  if (!fs12.existsSync(fromDir) || fs12.existsSync(toDir)) return false;
+  if (!fs11.existsSync(fromDir) || fs11.existsSync(toDir)) return false;
   ensureDir(path15.dirname(toDir));
-  fs12.renameSync(fromDir, toDir);
+  fs11.renameSync(fromDir, toDir);
   return true;
 }
 function formatZodIssues(error) {
@@ -21546,13 +21572,13 @@ var SIGNATURE_TTL_MS = 2e3;
 function computeSpecTreeSignature(dirs) {
   const parts = [];
   for (const dir of dirs) {
-    if (!fs12.existsSync(dir)) {
+    if (!fs11.existsSync(dir)) {
       parts.push(`${dir}:missing`);
       continue;
     }
     for (const f of listSpecFiles(dir)) {
       try {
-        const st = fs12.statSync(f);
+        const st = fs11.statSync(f);
         parts.push(`${f}:${st.mtimeMs}:${st.size}`);
       } catch {
         parts.push(`${f}:gone`);
@@ -21824,13 +21850,13 @@ function ineffectiveDeltaPaths(delta, merged, stored) {
   const isPlain = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
   const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
   const at = (prefix, key) => prefix ? `${prefix}.${key}` : key;
-  const say = (path28, why) => {
-    out.push(`${path28} \u2014 ${why}`);
+  const say = (path29, why) => {
+    out.push(`${path29} \u2014 ${why}`);
   };
-  const walkValue = (d, m, s, path28, field) => {
+  const walkValue = (d, m, s, path29, field) => {
     if (Array.isArray(d)) {
       if (!Array.isArray(m)) {
-        say(path28, "the level does not have this field, so the write dropped it");
+        say(path29, "the level does not have this field, so the write dropped it");
         return;
       }
       if (field === "narrative" && d.some(carriesEditMarker)) return;
@@ -21838,32 +21864,32 @@ function ineffectiveDeltaPaths(delta, merged, stored) {
         if (carriesEditMarker(element)) continue;
         const key = reportIdentityOf(field, element);
         if (key === null) {
-          if (!same(m, d)) say(path28, "the level does not keep this value, so the write dropped it");
-          else if (same(s, d)) say(path28, "the stored spec already held this value");
+          if (!same(m, d)) say(path29, "the level does not keep this value, so the write dropped it");
+          else if (same(s, d)) say(path29, "the stored spec already held this value");
           return;
         }
         const mMatch = m.find((i) => reportIdentityOf(field, i) === key);
         const sMatch = Array.isArray(s) ? s.find((i) => reportIdentityOf(field, i) === key) : void 0;
         if (mMatch === void 0) {
-          say(at(path28, key), "the write did not store this element");
+          say(at(path29, key), "the write did not store this element");
           continue;
         }
-        walk2(element, mMatch, sMatch, at(path28, key), field);
+        walk2(element, mMatch, sMatch, at(path29, key), field);
       }
       return;
     }
     if (isPlain(d)) {
       if (!isPlain(m)) {
-        say(path28, "the level does not have this field, so the write dropped it");
+        say(path29, "the level does not have this field, so the write dropped it");
         return;
       }
-      walk2(d, m, s, path28, field);
+      walk2(d, m, s, path29, field);
       return;
     }
-    if (!same(m, d)) say(path28, "the write did not store it \u2014 the level's schema does not keep this value");
-    else if (same(s, d)) say(path28, "the stored spec already held this value");
+    if (!same(m, d)) say(path29, "the write did not store it \u2014 the level's schema does not keep this value");
+    else if (same(s, d)) say(path29, "the stored spec already held this value");
   };
-  function walk2(d, m, s, path28, container) {
+  function walk2(d, m, s, path29, container) {
     for (const [key, value] of Object.entries(d)) {
       if (DELTA_VERBS.has(key) || JUMP_LABEL_TWINS.has(key)) continue;
       if (key === "label" && LABEL_TWIN_CONTAINERS.has(container)) continue;
@@ -21873,13 +21899,13 @@ function ineffectiveDeltaPaths(delta, merged, stored) {
           if (typeof name !== "string") continue;
           const had = isPlain(s) && s[name] !== void 0;
           const still = isPlain(m) && m[name] !== void 0;
-          if (!had) say(at(path28, name), "unset named a field the stored spec did not have");
-          else if (still) say(at(path28, name), "unset did not remove it");
+          if (!had) say(at(path29, name), "unset named a field the stored spec did not have");
+          else if (still) say(at(path29, name), "unset did not remove it");
         }
         continue;
       }
       if (value === void 0 || value === null) continue;
-      const here = at(path28, key);
+      const here = at(path29, key);
       const mValue = isPlain(m) ? m[key] : void 0;
       const sValue = isPlain(s) ? s[key] : void 0;
       if (mValue === void 0) {
@@ -21905,6 +21931,15 @@ var SpecWorkspace = class {
     this.rootDir = path15.resolve(rootDir);
     this.paths = aiPathsAt(this.rootDir);
   }
+  /**
+   * The next scan re-verifies the tree's file signature whatever the TTL says.
+   * Called when the bound project root switches to this workspace: a caller that
+   * just bound a root reads it as it is NOW, even if another process changed it
+   * a moment after this workspace last looked.
+   */
+  expireFreshness() {
+    this.lastSignatureCheckMs = 0;
+  }
   invalidate() {
     this.cachedIndex = null;
     this.cachedRecursive = null;
@@ -22049,7 +22084,10 @@ var SpecWorkspace = class {
         publicInterfaces: sub.publicInterfaces.map((p) => ({
           ...p,
           component: p.component ? qualifyId(p.component, componentPrefix, this.rootSubsystems) : void 0,
-          interface: p.interface ? qualifyId(p.interface, componentPrefix, this.rootSubsystems) : void 0
+          interface: p.interface ? qualifyId(p.interface, componentPrefix, this.rootSubsystems) : void 0,
+          // Each consumer is a subsystem reference: qualified into the namespace
+          // this subsystem is declared in, like a component's `subsystem` field.
+          ...p.consumers ? { consumers: p.consumers.map((c) => qualifySubsystemRef(c, namespacePrefix, this.rootSubsystems)) } : {}
         })),
         lifecycle: sub.lifecycle?.map((le) => ({
           ...le,
@@ -22155,7 +22193,7 @@ var SpecWorkspace = class {
           });
           continue;
         }
-        if (!fs12.existsSync(childDir)) {
+        if (!fs11.existsSync(childDir)) {
           this.loaderIssues.push({
             severity: "error",
             code: "SUBPROJECT_NOT_FOUND",
@@ -23159,8 +23197,8 @@ var SpecWorkspace = class {
       }
     }
     for (const file of files) {
-      if (fs12.existsSync(file)) {
-        snapshot.set(file, fs12.readFileSync(file, "utf8"));
+      if (fs11.existsSync(file)) {
+        snapshot.set(file, fs11.readFileSync(file, "utf8"));
       }
     }
     return snapshot;
@@ -23663,7 +23701,8 @@ var SpecWorkspace = class {
             out.publicInterfaces = out.publicInterfaces.map((pi) => ({
               ...pi,
               ...typeof pi?.component === "string" ? { component: qm(pi.component) } : {},
-              ...typeof pi?.interface === "string" ? { interface: qm(pi.interface) } : {}
+              ...typeof pi?.interface === "string" ? { interface: qm(pi.interface) } : {},
+              ...Array.isArray(pi?.consumers) ? { consumers: pi.consumers.map((c) => typeof c === "string" ? qualifySubsystemRef(c, prefix, this.rootSubsystems) : c) } : {}
             }));
           }
           if (Array.isArray(out.lifecycle)) {
@@ -24228,8 +24267,15 @@ function workspaceFor(rootDir) {
   }
   return ws;
 }
+var lastServedBinding = null;
 function current() {
-  return workspaceFor(getProjectRoot());
+  const ws = workspaceFor(getProjectRoot());
+  const binding = currentRootBinding() ?? ws.rootDir;
+  if (binding !== lastServedBinding) {
+    lastServedBinding = binding;
+    ws.expireFreshness();
+  }
+  return ws;
 }
 function invalidateSpecCache() {
   for (const ws of workspaces.values()) ws.invalidate();
@@ -24274,9 +24320,6 @@ function loadSubsystemSpec(id) {
 function saveSubsystemSpec(spec) {
   current().saveSubsystemSpec(spec);
 }
-function deleteSubsystemSpec(id) {
-  return current().deleteSubsystemSpec(id);
-}
 function loadComponentSpecs() {
   return current().loadComponentSpecs();
 }
@@ -24286,9 +24329,6 @@ function loadComponentSpec(id) {
 function saveComponentSpec(spec, opts) {
   return current().saveComponentSpec(spec, opts);
 }
-function deleteComponentSpec(id) {
-  return current().deleteComponentSpec(id);
-}
 function loadInterfaceSpecs() {
   return current().loadInterfaceSpecs();
 }
@@ -24298,9 +24338,6 @@ function loadInterfaceSpec(id) {
 function saveInterfaceSpec(spec, opts) {
   return current().saveInterfaceSpec(spec, opts);
 }
-function deleteInterfaceSpec(id) {
-  return current().deleteInterfaceSpec(id);
-}
 function loadImplementationSpecs() {
   return current().loadImplementationSpecs();
 }
@@ -24310,18 +24347,12 @@ function loadImplementationSpec(id) {
 function saveImplementationSpec(spec, opts) {
   return current().saveImplementationSpec(spec, opts);
 }
-function deleteImplementationSpec(id) {
-  return current().deleteImplementationSpec(id);
-}
 function loadTypeSpecs() {
   return current().loadTypeSpecs();
 }
 function loadTypeSpec(id) {
   return current().loadTypeSpec(id);
 }
-function saveTypeSpec(spec) {
-  return current().saveTypeSpec(spec);
-}
 function dryRunSerializeSpecs(include) {
   return current().dryRunSerializeSpecs(include);
 }
@@ -24341,7 +24372,7 @@ function consumedSurfaceInputsAt(rootDir) {
   const dir = path15.join(rootDir, ".wai", "surfaces");
   if (!pathExists(dir)) return [];
   const keys = [];
-  for (const file of fs12.readdirSync(dir)) {
+  for (const file of fs11.readdirSync(dir)) {
     if (!file.endsWith(".yaml") && !file.endsWith(".yml")) continue;
     try {
       keys.push(snapshotInputKey(SurfaceSnapshotSchema.parse(readYamlFile(path15.join(dir, file)))));
@@ -24397,15 +24428,15 @@ function computeStateIdAt(root) {
     return `${s.algorithm}:${s.digest}`;
   });
 }
-function deleteTypeSpec(id) {
-  return current().deleteTypeSpec(id);
-}
 function specPathsInScope(scopeSubsystem) {
   return current().specPathsInScope(scopeSubsystem);
 }
 function snapshotSpecFiles() {
   return current().snapshotSpecFiles();
 }
+function findLegacySpecFiles() {
+  return current().findLegacySpecFiles();
+}
 function loadSpec(kind, id) {
   const workspace = current();
   return workspace.load(kind, id);
@@ -24512,7 +24543,7 @@ function unregisterDomain(id) {
 }
 
 // src/core/provision.ts
-var fs13 = __toESM(require("fs"));
+var fs12 = __toESM(require("fs"));
 var path17 = __toESM(require("path"));
 function defaultProjectConfig(name, now) {
   return {
@@ -24561,7 +24592,7 @@ function provisionProject(name) {
 function ensureProjectInitialized(fallbackName) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const paths = aiPathsAt(getProjectRoot());
-  const hasSystem = fs13.existsSync(paths.specsSystem());
+  const hasSystem = fs12.existsSync(paths.specsSystem());
   let name = fallbackName;
   if (hasSystem) {
     const existing = loadSystemSpec();
@@ -24580,10 +24611,41 @@ function ensureProjectInitialized(fallbackName) {
   if (wroteConfig || wroteSystem) invalidateSpecCache();
   return { wroteConfig, wroteSystem };
 }
+function walkChainedSubprojects(projectRoot, onChild) {
+  const visited = /* @__PURE__ */ new Set();
+  const walk2 = (dir) => {
+    const resolved = path17.resolve(dir);
+    if (visited.has(resolved)) return;
+    visited.add(resolved);
+    const specsDir = aiPathsAt(dir).specsDir();
+    if (!fs12.existsSync(specsDir)) return;
+    for (const file of listFilesRecursive(specsDir, ".yaml")) {
+      let raw;
+      try {
+        raw = readYamlFile(file);
+      } catch {
+        continue;
+      }
+      if (!(raw && typeof raw === "object" && "parentSystem" in raw)) continue;
+      const pp = raw.projectPath;
+      if (typeof pp !== "string" || pp.trim() === "") continue;
+      let childDir;
+      try {
+        childDir = assertContainedProjectPath(dir, pp);
+      } catch {
+        continue;
+      }
+      const id = raw.id;
+      onChild(childDir, typeof id === "string" ? id : path17.basename(childDir));
+      walk2(childDir);
+    }
+  };
+  walk2(projectRoot);
+}
 function listDirectChainedSubprojects(projectRoot) {
   const out = [];
   const specsDir = aiPathsAt(projectRoot).specsDir();
-  if (!fs13.existsSync(specsDir)) return out;
+  if (!fs12.existsSync(specsDir)) return out;
   for (const file of listFilesRecursive(specsDir, ".yaml")) {
     let raw;
     try {
@@ -24605,6 +24667,28 @@ function listDirectChainedSubprojects(projectRoot) {
   }
   return out;
 }
+function childHasSpecsButNoConfig(childDir) {
+  return fs12.existsSync(aiPathsAt(childDir).specsDir()) && !projectConfigRepositoryAt(childDir).exists();
+}
+function findChainingSubprojectsMissingConfig(projectRoot) {
+  const missing = [];
+  walkChainedSubprojects(projectRoot, (childDir) => {
+    if (childHasSpecsButNoConfig(childDir)) missing.push(childDir);
+  });
+  return missing;
+}
+function backfillChainedSubprojectConfigs(projectRoot) {
+  const backfilled = [];
+  walkChainedSubprojects(projectRoot, (childDir, subsystemId) => {
+    if (childHasSpecsButNoConfig(childDir)) {
+      runWithProjectRoot(childDir, () => {
+        ensureProjectInitialized(subsystemId);
+      });
+      backfilled.push(childDir);
+    }
+  });
+  return backfilled;
+}
 function createChainedSubsystem(subsystem, projectName) {
   if (!subsystem.projectPath || subsystem.projectPath.trim() === "") {
     throw new WaironError("projectPath is required to create a chained subsystem.");
@@ -24633,14 +24717,14 @@ function moveSubsystemProject(subsystemId, newProjectPath) {
   const oldDir = assertContainedProjectPath(root, sub.projectPath);
   const newDir = assertContainedProjectPath(root, nextPath);
   if (oldDir !== newDir) {
-    if (!fs13.existsSync(oldDir)) {
+    if (!fs12.existsSync(oldDir)) {
       throw new WaironError(`Subproject directory not found at its current path: ${oldDir}`);
     }
-    if (fs13.existsSync(newDir)) {
+    if (fs12.existsSync(newDir)) {
       throw new WaironError(`Target directory already exists: ${newDir}`);
     }
     ensureDir(path17.dirname(newDir));
-    fs13.renameSync(oldDir, newDir);
+    fs12.renameSync(oldDir, newDir);
   }
   saveSubsystemSpec({ ...sub, projectPath: nextPath, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
   invalidateSpecCache();
@@ -24664,13 +24748,13 @@ function externalizeSubsystem(subsystemId, projectPath) {
   const parentRoot = getProjectRoot();
   const parentSpecsDir = aiPathsAt(parentRoot).specsDir();
   const fooDir = path17.join(parentSpecsDir, subsystemId);
-  if (!fs13.existsSync(fooDir)) {
+  if (!fs12.existsSync(fooDir)) {
     throw new WaironError(`subsystem specs directory not found: ${fooDir}`);
   }
   const relPath = toPosixPath(projectPath);
   const childDir = assertContainedProjectPath(parentRoot, relPath);
   const childFooDir = path17.join(childDir, ".wai", "specs", subsystemId);
-  if (fs13.existsSync(childFooDir)) {
+  if (fs12.existsSync(childFooDir)) {
     throw new WaironError(`target already contains a "${subsystemId}" subsystem: ${childFooDir}`);
   }
   const renameMap = buildRenameMap(
@@ -24686,7 +24770,7 @@ function externalizeSubsystem(subsystemId, projectPath) {
     saveSystemSpec(bootstrapSystemSpec(childSystemName, now));
   });
   ensureDir(path17.dirname(childFooDir));
-  fs13.renameSync(fooDir, childFooDir);
+  fs12.renameSync(fooDir, childFooDir);
   rebaseImplementationPaths(childFooDir, parentRoot, childDir);
   patchSubsystemIndex(path17.join(childFooDir, ".index.yaml"), (s) => {
     s.parentSystem = childSystemName;
@@ -24722,7 +24806,7 @@ function internalizeSubsystem(subsystemId) {
   const childDir = assertContainedProjectPath(parentRoot, foo.projectPath);
   const childWai = path17.join(childDir, ".wai");
   const childFooDir = path17.join(childDir, ".wai", "specs", subsystemId);
-  if (!fs13.existsSync(childFooDir)) {
+  if (!fs12.existsSync(childFooDir)) {
     throw new WaironError(`external subproject missing subsystem "${subsystemId}": ${childFooDir}`);
   }
   const childOwnSubs = runWithProjectRoot(childDir, () => loadSubsystemSpecs()).filter((s) => !s.id.includes("::"));
@@ -24736,15 +24820,15 @@ function internalizeSubsystem(subsystemId) {
   );
   const parentSystemName = loadSystemSpec()?.name ?? foo.parentSystem;
   const fooDir = path17.join(parentSpecsDir, subsystemId);
-  fs13.rmSync(fooDir, { recursive: true, force: true });
+  fs12.rmSync(fooDir, { recursive: true, force: true });
   ensureDir(path17.dirname(fooDir));
-  fs13.renameSync(childFooDir, fooDir);
+  fs12.renameSync(childFooDir, fooDir);
   rebaseImplementationPaths(fooDir, childDir, parentRoot);
   patchSubsystemIndex(path17.join(fooDir, ".index.yaml"), (s) => {
     s.parentSystem = parentSystemName;
     delete s.projectPath;
   });
-  fs13.rmSync(childWai, { recursive: true, force: true });
+  fs12.rmSync(childWai, { recursive: true, force: true });
   rewriteRefsInDir(parentSpecsDir, renameMap, fooDir);
   rebaseMovedRefs(fooDir, subsystemId, "outOf");
   invalidateSpecCache();
@@ -24839,7 +24923,7 @@ function rebaseImplementationPaths(specsDir, fromRoot, toRoot) {
   }
 }
 function patchSubsystemIndex(indexPath, mutate) {
-  if (!fs13.existsSync(indexPath)) return;
+  if (!fs12.existsSync(indexPath)) return;
   const raw = readYamlFile(indexPath);
   mutate(raw);
   raw.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -24901,7 +24985,7 @@ function moveRenamedSpecs(componentId, newId, component, movingInterface, moving
   if (movedImplementation) {
     const oldFile = getImplementationPath(movedImplementation.id);
     if (path17.resolve(getImplementationPath(implementationId, movedImplementation.contract)) === path17.resolve(oldFile)) {
-      fs13.unlinkSync(oldFile);
+      fs12.unlinkSync(oldFile);
     }
     saveImplementationSpec({ ...movedImplementation, id: implementationId });
   }
@@ -24911,17 +24995,17 @@ function moveRenamedSpecs(componentId, newId, component, movingInterface, moving
   invalidateSpecCache();
 }
 function removeSpecFile2(file, id) {
-  if (!fs13.existsSync(file)) return;
+  if (!fs12.existsSync(file)) return;
   try {
     if (readYamlFile(file)?.id !== id) return;
   } catch {
     return;
   }
-  fs13.unlinkSync(file);
+  fs12.unlinkSync(file);
   const specsRoot = path17.resolve(aiPathsAt(getProjectRoot()).specsDir());
   for (let dir = path17.dirname(path17.resolve(file)); dir !== specsRoot && isWithinDir(specsRoot, dir); dir = path17.dirname(dir)) {
-    if (fs13.readdirSync(dir).length > 0) break;
-    fs13.rmdirSync(dir);
+    if (fs12.readdirSync(dir).length > 0) break;
+    fs12.rmdirSync(dir);
   }
 }
 var METHOD_NAME = /^[a-z][a-zA-Z0-9]*$/;
@@ -25032,7 +25116,7 @@ function identifierPattern(methodName) {
 }
 
 // src/core/detection.ts
-var fs14 = __toESM(require("fs"));
+var fs13 = __toESM(require("fs"));
 var path18 = __toESM(require("path"));
 var PACKAGE_MARKERS = [
   "package.json",
@@ -25084,7 +25168,7 @@ function deduplicateIds(candidates, existingIds = /* @__PURE__ */ new Set()) {
   });
 }
 function parseGitmodules(filePath) {
-  const content = fs14.readFileSync(filePath, "utf-8");
+  const content = fs13.readFileSync(filePath, "utf-8");
   const entries = [];
   let current2 = {};
   for (const line of content.split("\n")) {
@@ -25107,7 +25191,7 @@ function parseGitmodules(filePath) {
 }
 function detectGitSubmodules(projectRoot) {
   const gitmodulesPath = path18.join(projectRoot, ".gitmodules");
-  if (!fs14.existsSync(gitmodulesPath)) return [];
+  if (!fs13.existsSync(gitmodulesPath)) return [];
   return parseGitmodules(gitmodulesPath).map((entry) => ({
     suggestedId: pathToId(entry.path),
     suggestedName: pathToName(entry.path),
@@ -25125,7 +25209,7 @@ function walkForGit(projectRoot, currentDir, depth, results) {
   if (depth > MAX_SCAN_DEPTH) return;
   let entries;
   try {
-    entries = fs14.readdirSync(currentDir, { withFileTypes: true });
+    entries = fs13.readdirSync(currentDir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -25136,7 +25220,7 @@ function walkForGit(projectRoot, currentDir, depth, results) {
     const relPath = normalizePath(path18.relative(projectRoot, fullPath));
     if (relPath === "" || relPath === ".") continue;
     const gitPath = path18.join(fullPath, ".git");
-    if (fs14.existsSync(gitPath)) {
+    if (fs13.existsSync(gitPath)) {
       results.push({
         suggestedId: pathToId(relPath),
         suggestedName: pathToName(relPath),
@@ -25158,7 +25242,7 @@ function walkForPackages(projectRoot, currentDir, depth, results) {
   if (depth > MAX_SCAN_DEPTH) return;
   let entries;
   try {
-    entries = fs14.readdirSync(currentDir, { withFileTypes: true });
+    entries = fs13.readdirSync(currentDir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -25168,7 +25252,7 @@ function walkForPackages(projectRoot, currentDir, depth, results) {
     const fullPath = path18.join(currentDir, entry.name);
     const relPath = normalizePath(path18.relative(projectRoot, fullPath));
     if (relPath === "" || relPath === ".") continue;
-    const hasMarker = PACKAGE_MARKERS.some((m) => fs14.existsSync(path18.join(fullPath, m)));
+    const hasMarker = PACKAGE_MARKERS.some((m) => fs13.existsSync(path18.join(fullPath, m)));
     if (hasMarker) {
       results.push({
         suggestedId: pathToId(relPath),
@@ -25193,19 +25277,168 @@ function normalizePath(p) {
   return p.replace(/\\/g, "/");
 }
 
+// src/core/variants.ts
+var fs14 = __toESM(require("fs"));
+var os3 = __toESM(require("os"));
+var path19 = __toESM(require("path"));
+var import_zod10 = require("zod");
+var VariantDefSchema = import_zod10.z.object({
+  /** Variant id referenced by a component's `variant` (e.g. "publisher", "org/external-config-adapter"). */
+  id: import_zod10.z.string().min(1),
+  /** The core stereotype this variant specializes — authoritative for generic semantics (Adapter, Orchestrator, …). */
+  base: import_zod10.z.string().min(1),
+  /** How to implement a component of this variant — the recipe the implementer follows and reuses across same-variant components. */
+  guidance: import_zod10.z.string().min(1),
+  /** Optional: this variant only applies for the given target language (else it applies everywhere). */
+  target: import_zod10.z.string().optional(),
+  /** Optional: this variant only applies under the given architectural profile. */
+  profile: import_zod10.z.string().optional()
+});
+function globalVariantsDir() {
+  return process.env.WAIRON_VARIANTS_DIR ?? path19.join(os3.homedir(), ".wairon", "variants");
+}
+function builtinVariantsDir() {
+  const candidates = [
+    path19.resolve(__dirname, "..", "templates", "variants"),
+    // src/core & dist/cli
+    path19.resolve(__dirname, "templates", "variants")
+    // dist (library entry)
+  ];
+  return candidates.find((dir) => fs14.existsSync(dir)) ?? candidates[0];
+}
+function projectVariantsDir() {
+  return path19.join(getProjectRoot(), ".wai", "variants");
+}
+function variantFiles(dir) {
+  let entries;
+  try {
+    entries = fs14.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries.filter((e) => e.isFile() && /\.ya?ml$/i.test(e.name)).sort((a, b) => a.name.localeCompare(b.name)).map((e) => path19.join(dir, e.name));
+}
+function parseVariants(raw) {
+  if (raw == null) return [];
+  return (Array.isArray(raw) ? raw : [raw]).map((item) => VariantDefSchema.parse(item));
+}
+function reportSkippedFile(file, err) {
+  console.error(`[variants] skipped "${file}": ${err instanceof Error ? err.message : String(err)}`);
+}
+function readVariantsDir(dir) {
+  const out = [];
+  for (const file of variantFiles(dir)) {
+    try {
+      out.push(...parseVariants(readYamlFile(file)));
+    } catch (err) {
+      reportSkippedFile(file, err);
+    }
+  }
+  return out;
+}
+function mergeById(...layers) {
+  const byId = /* @__PURE__ */ new Map();
+  for (const layer of layers) {
+    for (const v of layer) byId.set(v.id, v);
+  }
+  return [...byId.values()];
+}
+function resolveVariantGuidance(component, allComponents, variantsById) {
+  if (!component.variant) return null;
+  const def = variantsById.get(component.variant);
+  if (!def) return null;
+  return {
+    variant: component.variant,
+    base: def.base,
+    guidance: def.guidance,
+    siblings: allComponents.filter((o) => o.variant === component.variant && o.id !== component.id).map((o) => o.id),
+    ...def.target ? { target: def.target } : {},
+    ...def.profile ? { profile: def.profile } : {}
+  };
+}
+function composeVariantGuidance(comps, allComponents, variantsById) {
+  const resolved = comps.map((c) => ({ id: c.id, guidance: resolveVariantGuidance(c, allComponents, variantsById) })).filter((r) => r.guidance !== null);
+  if (resolved.length === 0) return "";
+  const lines = [
+    "## Component variants \u2014 reuse the shared approach",
+    "",
+    "One or more of your components declare a variant \u2014 a base-anchored kind with implementation guidance. Implement every component of the same variant alike, reusing one shared approach instead of reinventing it per instance:",
+    ""
+  ];
+  for (const { id, guidance } of resolved) {
+    let line = `- **${id}** \u2014 variant \`${guidance.variant}\` (a kind of ${guidance.base}): ${guidance.guidance}`;
+    if (guidance.siblings.length > 0) {
+      line += ` Same-variant components elsewhere: ${guidance.siblings.join(", ")} \u2014 implement them consistently, reusing the same logic/concept.`;
+    }
+    lines.push(line);
+  }
+  return lines.join("\n");
+}
+function loadProjectVariants() {
+  try {
+    return mergeById(
+      readVariantsDir(builtinVariantsDir()),
+      readVariantsDir(globalVariantsDir()),
+      readVariantsDir(projectVariantsDir())
+    );
+  } catch {
+    return [];
+  }
+}
+function listProjectVariants() {
+  return mergeById(readVariantsDir(projectVariantsDir()));
+}
+function rebaseProjectVariants(fromBase, toBase) {
+  const rebased = [];
+  for (const file of variantFiles(projectVariantsDir())) {
+    const content = readFileOrNull(file);
+    if (content === null) continue;
+    let raw;
+    let variants;
+    try {
+      raw = parseYaml(content, file);
+      variants = parseVariants(raw);
+    } catch (err) {
+      reportSkippedFile(file, err);
+      continue;
+    }
+    const matching = variants.filter((v) => v.base === fromBase);
+    if (matching.length === 0) continue;
+    writeFile(file, rebasedText(content, fromBase, toBase, withRebasedEntries(raw, fromBase, toBase)));
+    for (const v of matching) {
+      if (!rebased.includes(v.id)) rebased.push(v.id);
+    }
+  }
+  return rebased;
+}
+function withRebasedEntries(raw, fromBase, toBase) {
+  const rebase = (entry) => entry.base === fromBase ? { ...entry, base: toBase } : entry;
+  return Array.isArray(raw) ? raw.map(rebase) : rebase(raw);
+}
+function rebasedText(content, fromBase, toBase, rebasedContent) {
+  const escaped = fromBase.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const baseLine = new RegExp(`^([ \\t]*(?:-[ \\t]+)?base:[ \\t]*)(["']?)${escaped}\\2(?=[ \\t]*(?:#.*)?$)`, "gm");
+  const edited = content.replace(baseLine, (_line, key, quote) => `${key}${quote}${toBase}${quote}`);
+  try {
+    if (JSON.stringify(parseYaml(edited)) === JSON.stringify(rebasedContent)) return edited;
+  } catch {
+  }
+  return serializeYaml(rebasedContent);
+}
+
 // src/core/agent_resolver.ts
-var path20 = __toESM(require("path"));
+var path21 = __toESM(require("path"));
 var fs15 = __toESM(require("fs"));
 
 // src/core/templates.ts
-var path19 = __toESM(require("path"));
+var path20 = __toESM(require("path"));
 function builtinTemplatesDir() {
-  return path19.resolve(__dirname, "..", "templates");
+  return path20.resolve(__dirname, "..", "templates");
 }
 function loadTemplate(id, globalOverride) {
   const dirs = templateSearchDirs(globalOverride);
   for (const dir of dirs) {
-    const filePath = path19.join(dir, `${id}.yaml`);
+    const filePath = path20.join(dir, `${id}.yaml`);
     if (pathExists(filePath)) {
       const raw = readYamlFile(filePath);
       return { ...TemplateSchema.parse(raw), templateName: id };
@@ -25214,7 +25447,7 @@ function loadTemplate(id, globalOverride) {
   throw new TemplateNotFoundError(id);
 }
 function loadAgentOverride(agentId) {
-  const filePath = path19.join(AI_PATHS.root(), "agents", `${agentId}.md`);
+  const filePath = path20.join(AI_PATHS.root(), "agents", `${agentId}.md`);
   return readFileOrNull(filePath);
 }
 function templateSearchDirs(globalOverride) {
@@ -25366,7 +25599,7 @@ function resolveBudget(profile, config, agentId) {
 var projectFilesCache = /* @__PURE__ */ new Map();
 function listFilesRecursiveSafe(dirPath, ext) {
   if (!fs15.existsSync(dirPath)) return [];
-  const nameLower = path20.basename(dirPath).toLowerCase();
+  const nameLower = path21.basename(dirPath).toLowerCase();
   const IGNORED_DIRS = /* @__PURE__ */ new Set([
     "node_modules",
     "target",
@@ -25384,7 +25617,7 @@ function listFilesRecursiveSafe(dirPath, ext) {
   const entries = fs15.readdirSync(dirPath, { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
-    const fullPath = path20.join(dirPath, entry.name);
+    const fullPath = path21.join(dirPath, entry.name);
     if (entry.isDirectory()) {
       files.push(...listFilesRecursiveSafe(fullPath, ext));
     } else if (entry.isFile() && entry.name.endsWith(ext)) {
@@ -25397,8 +25630,8 @@ function getProjectFiles(projectDir) {
   let files = projectFilesCache.get(projectDir);
   if (!files) {
     files = [];
-    const srcDir = path20.join(projectDir, "src");
-    const legacySrcDir = path20.join(projectDir, "legacy-src");
+    const srcDir = path21.join(projectDir, "src");
+    const legacySrcDir = path21.join(projectDir, "legacy-src");
     let searchDir = projectDir;
     if (pathExists(srcDir)) {
       searchDir = srcDir;
@@ -25413,7 +25646,7 @@ function getProjectFiles(projectDir) {
       files.push(...listFilesRecursiveSafe(searchDir, ext));
     }
     const rootDir = getProjectRoot();
-    files = files.map((f) => path20.relative(rootDir, f).replace(/\\/g, "/"));
+    files = files.map((f) => path21.relative(rootDir, f).replace(/\\/g, "/"));
     projectFilesCache.set(projectDir, files);
   }
   return files;
@@ -25438,8 +25671,8 @@ function inferSourcePathForComponent(comp, subsystems) {
     let bestFile = null;
     let bestScore = -1;
     for (const f of files) {
-      const ext = path20.extname(f);
-      const base = path20.basename(f, ext).toLowerCase();
+      const ext = path21.extname(f);
+      const base = path21.basename(f, ext).toLowerCase();
       if (candidates.has(base)) {
         let score = 0;
         const normalizedPath = f.toLowerCase();
@@ -25536,7 +25769,7 @@ function resolveAgentTopology() {
   });
   for (const sub of subsystems) {
     if (sub.projectPath) {
-      const mountSpecPath = path20.relative(getProjectRoot(), getSubsystemPath(sub.id)).replace(/\\/g, "/");
+      const mountSpecPath = path21.relative(getProjectRoot(), getSubsystemPath(sub.id)).replace(/\\/g, "/");
       agents.push({
         id: `${sub.id}-owner`,
         name: `${sub.name} (chained subproject)`,
@@ -25558,9 +25791,9 @@ function resolveAgentTopology() {
     }
     const subComponents = components.filter((c) => c.subsystem === sub.id);
     const ownedPaths = [];
-    ownedPaths.push(path20.relative(getProjectRoot(), getSubsystemPath(sub.id)).replace(/\\/g, "/"));
+    ownedPaths.push(path21.relative(getProjectRoot(), getSubsystemPath(sub.id)).replace(/\\/g, "/"));
     for (const c of subComponents) {
-      ownedPaths.push(path20.relative(getProjectRoot(), getComponentPath(c.id, sub.id)).replace(/\\/g, "/"));
+      ownedPaths.push(path21.relative(getProjectRoot(), getComponentPath(c.id, sub.id)).replace(/\\/g, "/"));
     }
     if (!config.rules.generateComponentImplementers) {
       for (const comp of subComponents) {
@@ -25636,10 +25869,10 @@ function resolveAgentTopology() {
       }
       const dependencies = comp.dependsOn.map((depId) => `${depId}-implementer`);
       const readPaths = [
-        path20.relative(getProjectRoot(), AI_PATHS.specsSystem()).replace(/\\/g, "/"),
-        path20.relative(getProjectRoot(), getComponentPath(comp.id, comp.subsystem)).replace(/\\/g, "/"),
-        ...compInterfaces.map((i) => path20.relative(getProjectRoot(), getInterfacePath(i.id, comp.id)).replace(/\\/g, "/")),
-        ...compImpls.map((impl) => path20.relative(getProjectRoot(), getImplementationPath(impl.id, impl.contract)).replace(/\\/g, "/"))
+        path21.relative(getProjectRoot(), AI_PATHS.specsSystem()).replace(/\\/g, "/"),
+        path21.relative(getProjectRoot(), getComponentPath(comp.id, comp.subsystem)).replace(/\\/g, "/"),
+        ...compInterfaces.map((i) => path21.relative(getProjectRoot(), getInterfacePath(i.id, comp.id)).replace(/\\/g, "/")),
+        ...compImpls.map((impl) => path21.relative(getProjectRoot(), getImplementationPath(impl.id, impl.contract)).replace(/\\/g, "/"))
       ];
       agents.push({
         id: `${comp.id}-implementer`,
@@ -25745,10 +25978,10 @@ function loadRegistry() {
 }
 
 // src/exporters/generate.ts
-var path24 = __toESM(require("path"));
+var path25 = __toESM(require("path"));
 
 // src/exporters/claude.ts
-var path21 = __toESM(require("path"));
+var path22 = __toESM(require("path"));
 var MODEL_BY_TIER = {
   small: "haiku",
   standard: "sonnet",
@@ -25787,7 +26020,7 @@ var ClaudeExporter = class {
   outputPath(ctx) {
     const { agent, target, projectRoot } = ctx;
     const outputDir = "outputDir" in target ? target.outputDir : ".claude/agents";
-    return path21.resolve(projectRoot, outputDir, `${agent.id.replace(/::/g, "--")}.md`);
+    return path22.resolve(projectRoot, outputDir, `${agent.id.replace(/::/g, "--")}.md`);
   }
   export(ctx) {
     const { agent, renderedInstructions, budget } = ctx;
@@ -25812,7 +26045,7 @@ var ClaudeExporter = class {
 };
 
 // src/exporters/custom.ts
-var path22 = __toESM(require("path"));
+var path23 = __toESM(require("path"));
 var CustomExporter = class {
   constructor() {
     this.targetType = "custom";
@@ -25822,7 +26055,7 @@ var CustomExporter = class {
     if (!("outputDir" in target)) {
       throw new Error("CustomExporter requires target.outputDir");
     }
-    return path22.resolve(projectRoot, target.outputDir, `${agent.id.replace(/::/g, "--")}.md`);
+    return path23.resolve(projectRoot, target.outputDir, `${agent.id.replace(/::/g, "--")}.md`);
   }
   export(ctx) {
     const { agent, target, renderedInstructions } = ctx;
@@ -25845,7 +26078,7 @@ var CustomExporter = class {
 };
 
 // src/exporters/gemini.ts
-var path23 = __toESM(require("path"));
+var path24 = __toESM(require("path"));
 var GeminiExporter = class {
   constructor() {
     this.targetType = "gemini";
@@ -25853,7 +26086,7 @@ var GeminiExporter = class {
   outputPath(ctx) {
     const { agent, target, projectRoot } = ctx;
     const outputDir = "outputDir" in target ? target.outputDir : ".gemini/agents";
-    return path23.resolve(projectRoot, outputDir, `${agent.id.replace(/::/g, "--")}.yaml`);
+    return path24.resolve(projectRoot, outputDir, `${agent.id.replace(/::/g, "--")}.yaml`);
   }
   export(ctx) {
     const { agent, renderedInstructions } = ctx;
@@ -25950,7 +26183,7 @@ function resolveExpectedOutputPaths(agents, projectConfig, projectRoot = getProj
       const targetConfig = resolveTargetConfig(agentTarget, projectConfig);
       if (!targetConfig) continue;
       const ctx = { agent, projectRoot, target: targetConfig };
-      expected.add(path24.resolve(getExporter(targetConfig).outputPath(ctx)));
+      expected.add(path25.resolve(getExporter(targetConfig).outputPath(ctx)));
     }
   }
   return expected;
@@ -25965,7 +26198,7 @@ function resolveTargetConfig(agentTarget, projectConfig) {
 
 // src/core/treetransfer.ts
 var fs16 = __toESM(require("fs"));
-var path25 = __toESM(require("path"));
+var path26 = __toESM(require("path"));
 var sdkPortal = __toESM(require_dist());
 var STAGING_PREFIX = ".wai-staging-";
 var BACKUP_DIR = ".wai-backups";
@@ -25991,39 +26224,39 @@ function hasAuthoredSpecs(root) {
   if (!pathExists(specsDir)) {
     return false;
   }
-  const systemIndex = path25.resolve(paths.specsSystem());
+  const systemIndex = path26.resolve(paths.specsSystem());
   for (const file of listFilesRecursive(specsDir, ".yaml")) {
-    if (path25.resolve(file) !== systemIndex) {
+    if (path26.resolve(file) !== systemIndex) {
       return true;
     }
   }
   return false;
 }
 function createStagingDir(destDir) {
-  const root = path25.resolve(destDir);
+  const root = path26.resolve(destDir);
   fs16.mkdirSync(root, { recursive: true });
-  const stagingDir = fs16.mkdtempSync(path25.join(root, STAGING_PREFIX));
+  const stagingDir = fs16.mkdtempSync(path26.join(root, STAGING_PREFIX));
   return stagingDir;
 }
 function commitStagedTree(stagingDir, destDir, roots, backupExisting) {
-  const root = path25.resolve(destDir);
-  const backupDir = path25.join(root, BACKUP_DIR, timestampSlug());
+  const root = path26.resolve(destDir);
+  const backupDir = path26.join(root, BACKUP_DIR, timestampSlug());
   let backedUp = false;
   for (const rootRel of roots) {
     const relative9 = rootRel === "." ? "" : rootRel;
-    const stagedSpecDir = path25.join(stagingDir, relative9, ".wai");
+    const stagedSpecDir = path26.join(stagingDir, relative9, ".wai");
     if (!fs16.existsSync(stagedSpecDir)) continue;
-    const liveSpecDir = liveSpecDirFor(path25.join(root, relative9));
+    const liveSpecDir = liveSpecDirFor(path26.join(root, relative9));
     if (backupExisting && liveSpecDir && fs16.existsSync(liveSpecDir)) {
-      const backupTarget = path25.join(backupDir, relative9, path25.basename(liveSpecDir));
-      fs16.mkdirSync(path25.dirname(backupTarget), { recursive: true });
+      const backupTarget = path26.join(backupDir, relative9, path26.basename(liveSpecDir));
+      fs16.mkdirSync(path26.dirname(backupTarget), { recursive: true });
       fs16.renameSync(liveSpecDir, backupTarget);
       backedUp = true;
     } else if (liveSpecDir && fs16.existsSync(liveSpecDir)) {
       fs16.rmSync(liveSpecDir, { recursive: true, force: true });
     }
-    const target = path25.join(root, relative9, ".wai");
-    fs16.mkdirSync(path25.dirname(target), { recursive: true });
+    const target = path26.join(root, relative9, ".wai");
+    fs16.mkdirSync(path26.dirname(target), { recursive: true });
     if (fs16.existsSync(target)) fs16.rmSync(target, { recursive: true, force: true });
     fs16.renameSync(stagedSpecDir, target);
   }
@@ -26048,7 +26281,7 @@ function exportSpecTree(includeDerived, allowPartial) {
   const skipped = [...inspection.skipped];
   const roots = [{ relativePath: ".", waiDir: aiPathsAt(root).root() }];
   for (const rel2 of inspection.roots) {
-    const waiDir = aiPathsAt(path25.resolve(root, rel2)).root();
+    const waiDir = aiPathsAt(path26.resolve(root, rel2)).root();
     if (pathExists(waiDir)) {
       roots.push({ relativePath: rel2, waiDir });
     } else {
@@ -26079,7 +26312,7 @@ function importSpecTree(archive, options) {
   if (!info.compatible) {
     throw new Error("incompatible .waitree archive (format or minimum wairon version)");
   }
-  const destDir = path25.resolve(options.destDir ?? getProjectRoot());
+  const destDir = path26.resolve(options.destDir ?? getProjectRoot());
   const occupied = hasSpecTree(destDir);
   const authored = hasAuthoredSpecs(destDir);
   if (authored && options.replaceExisting !== true) {
@@ -26110,9 +26343,9 @@ function importSpecTree(archive, options) {
   return result;
 }
 function liveSpecDirFor(rootDir) {
-  const modern = path25.join(rootDir, ".wai");
+  const modern = path26.join(rootDir, ".wai");
   if (fs16.existsSync(modern)) return modern;
-  const legacy = path25.join(rootDir, ".wairon");
+  const legacy = path26.join(rootDir, ".wairon");
   if (fs16.existsSync(legacy)) return legacy;
   return null;
 }
@@ -26254,7 +26487,7 @@ function repairForeignStepFields(apply) {
 
 // src/core/approval.ts
 var crypto3 = __toESM(require("crypto"));
-var path26 = __toESM(require("path"));
+var path27 = __toESM(require("path"));
 
 // src/models/lock.ts
 function describeApprover(who) {
@@ -26271,12 +26504,12 @@ function digest(content) {
   return crypto3.createHash("sha256").update(normalized, "utf8").digest("hex");
 }
 function currentSpecDigests(root = getProjectRoot()) {
-  const mountDirs = loadSubsystemSpecs().filter((s) => s.projectPath && !s.id.includes("::")).map((s) => `${path26.resolve(root, s.projectPath).split(path26.sep).join("/")}/`);
+  const mountDirs = loadSubsystemSpecs().filter((s) => s.projectPath && !s.id.includes("::")).map((s) => `${path27.resolve(root, s.projectPath).split(path27.sep).join("/")}/`);
   const out = {};
   for (const [abs, content] of snapshotSpecFiles()) {
-    const normalized = path26.resolve(abs).split(path26.sep).join("/");
+    const normalized = path27.resolve(abs).split(path27.sep).join("/");
     if (mountDirs.some((dir) => normalized.startsWith(dir))) continue;
-    out[path26.relative(root, abs).split(path26.sep).join("/")] = digest(content);
+    out[path27.relative(root, abs).split(path27.sep).join("/")] = digest(content);
   }
   return out;
 }
@@ -26334,7 +26567,7 @@ function currentChildPins(mounts, root = getProjectRoot()) {
   const pins = {};
   for (const mount of mounts) {
     if (!mount.projectPath || mount.id.includes("::")) continue;
-    const child = readLockRecordAt(path26.resolve(root, mount.projectPath));
+    const child = readLockRecordAt(path27.resolve(root, mount.projectPath));
     if (child) pins[mount.id] = pinOf(child.stateId);
   }
   return pins;
@@ -26436,7 +26669,7 @@ function localApprover() {
 // src/utils/ai-guide.ts
 var fs17 = __toESM(require("fs"));
 var os5 = __toESM(require("os"));
-var path27 = __toESM(require("path"));
+var path28 = __toESM(require("path"));
 
 // src/core/stamp.ts
 function versionStamp() {
@@ -26496,13 +26729,13 @@ This project uses **wairon**. System specs live under \`.wai/specs/\` (L0 System
 * **Variants**: \`gateway\`, a Portal that authenticates, authorizes, validates or rate-limits before it dispatches. Logic is an Orchestrator, and \`dependencyClass: pure | read\` bounds what it may depend on (unset = a workflow). Specialist and Gateway are retired stereotypes.
 * Use \`owns\` for private member containment (exactly one hop) and \`dependsOn\` for collaborators. Never use generic suffixes like "Manager", "Helper", or "Utils".`;
 function globalGuideFilePath(targetType) {
-  if (targetType === "claude") return path27.join(process.env["CLAUDE_CONFIG_DIR"] || path27.join(os5.homedir(), ".claude"), "CLAUDE.md");
-  if (targetType === "gemini") return path27.join(process.env["GEMINI_CONFIG_DIR"] || path27.join(os5.homedir(), ".gemini"), "GEMINI.md");
+  if (targetType === "claude") return path28.join(process.env["CLAUDE_CONFIG_DIR"] || path28.join(os5.homedir(), ".claude"), "CLAUDE.md");
+  if (targetType === "gemini") return path28.join(process.env["GEMINI_CONFIG_DIR"] || path28.join(os5.homedir(), ".gemini"), "GEMINI.md");
   return null;
 }
 function localGuideFilePath(projectRoot, targetType) {
-  if (targetType === "claude") return path27.join(projectRoot, ".claude", "CLAUDE.md");
-  if (targetType === "gemini" || targetType === "agy") return path27.join(projectRoot, ".gemini", "GEMINI.md");
+  if (targetType === "claude") return path28.join(projectRoot, ".claude", "CLAUDE.md");
+  if (targetType === "gemini" || targetType === "agy") return path28.join(projectRoot, ".gemini", "GEMINI.md");
   return null;
 }
 function injectGuide(filePath, scope) {
@@ -26517,7 +26750,7 @@ ${GUIDE_MARKER_END}
   const existing = fs17.existsSync(filePath) ? fs17.readFileSync(filePath, "utf-8") : "";
   const stripped = stripGuideSection(existing);
   const newContent = stripped.trimEnd() + section;
-  fs17.mkdirSync(path27.dirname(filePath), { recursive: true });
+  fs17.mkdirSync(path28.dirname(filePath), { recursive: true });
   fs17.writeFileSync(filePath, newContent, "utf-8");
 }
 function stripGuideSection(content) {
@@ -26528,7 +26761,7 @@ function stripGuideSection(content) {
 }
 function writeRootGuideDelegator(projectRoot, targetType) {
   if (targetType === "claude") {
-    const filePath = path27.join(projectRoot, "CLAUDE.md");
+    const filePath = path28.join(projectRoot, "CLAUDE.md");
     const content = `@.claude/CLAUDE.md
 
 # Wairon SDD Project
@@ -26543,7 +26776,7 @@ the \`wairon\` CLI is the human developer's tool, not yours.
 `;
     fs17.writeFileSync(filePath, content, "utf-8");
   } else if (targetType === "gemini" || targetType === "agy") {
-    const filePath = path27.join(projectRoot, "GEMINI.md");
+    const filePath = path28.join(projectRoot, "GEMINI.md");
     const content = `# Wairon SDD Project
 ${GUIDE_MARKER_START}
 ${versionStamp()}
@@ -26552,7 +26785,7 @@ ${GUIDE_MARKER_END}
 `;
     fs17.writeFileSync(filePath, content, "utf-8");
   } else if (targetType === "cursor") {
-    const filePath = path27.join(projectRoot, ".cursorrules");
+    const filePath = path28.join(projectRoot, ".cursorrules");
     const content = `# Wairon SDD Project
 
 This project uses the Wairon Spec-Driven Development (SDD) framework.
@@ -26561,8 +26794,8 @@ Refer to the rules in [.cursor/rules/](.cursor/rules/) for full instructions.
 `;
     fs17.writeFileSync(filePath, content, "utf-8");
   } else if (targetType === "copilot") {
-    const filePath = path27.join(projectRoot, ".github", "copilot-instructions.md");
-    fs17.mkdirSync(path27.dirname(filePath), { recursive: true });
+    const filePath = path28.join(projectRoot, ".github", "copilot-instructions.md");
+    fs17.mkdirSync(path28.dirname(filePath), { recursive: true });
     const content = `# Wairon SDD Project
 
 This project uses the Wairon Spec-Driven Development (SDD) framework.
@@ -26571,7 +26804,7 @@ Refer to the prompts in [.github/prompts/](.github/prompts/) for instructions.
 `;
     fs17.writeFileSync(filePath, content, "utf-8");
   } else if (targetType === "codex") {
-    const filePath = path27.join(projectRoot, ".codexrules");
+    const filePath = path28.join(projectRoot, ".codexrules");
     const content = `# Wairon SDD Project
 
 Refer to [.codex/agents/](.codex/agents/) for full instructions.
@@ -26947,18 +27180,15 @@ var logger = {
 
 // src/core/skills.ts
 var SKILL_NAMES = ["sdd-architect", "sdd-narrative", "sdd-auditor", "sdd-implement", "sdd-delegate"];
-function loadProjectConfig3() {
-  return loadProjectConfig();
-}
 function activeTargetTypes2() {
-  const config = loadProjectConfig3();
+  const config = loadProjectConfig();
   if (!config) return [];
   return activeTargetTypes(config);
 }
 var RESOURCE_SKILL_IDS = [...SKILL_NAMES].sort();
 
 // src/index.ts
-function loadProjectConfig4() {
+function loadProjectConfig2() {
   const config = loadProjectConfig();
   if (!config) throw new ProjectNotInitializedError();
   return config;
@@ -27091,13 +27321,17 @@ function loadProjectConfig4() {
   ambiguityMessage,
   approvalRecord,
   approvalVerdict,
+  assertContainedProjectPath,
   assertProjectInitialized,
   backendCommand,
+  backfillChainedSubprojectConfigs,
   buildCanvasDataModel,
   buildProjectGraph,
   buildRuleContext,
   callSitesOf,
   captureApprovedSpecs,
+  checkDeclarativePack,
+  clearLoaderIssues,
   cognitiveScore,
   complexityLevel,
   composeAgentBrief,
@@ -27112,6 +27346,7 @@ function loadProjectConfig4() {
   createEmptyTopologyConfig,
   createProjectConfig,
   currentChildPins,
+  currentRootBinding,
   declaredPackNames,
   declaredProfileIds,
   declaresGlobalPacks,
@@ -27119,16 +27354,12 @@ function loadProjectConfig4() {
   defaultNarrativeDetail,
   defaultPackSelections,
   defaultTargetConfig,
-  deleteComponentSpec,
-  deleteImplementationSpec,
-  deleteInterfaceSpec,
   deleteSpec,
-  deleteSubsystemSpec,
-  deleteTypeSpec,
   deregisterPackRef,
   deriveExecutionProfile,
   derivedDocPaths,
   detectDomainCandidates,
+  diagnoseProjectPacks,
   diagramSetIndex,
   diffAgainstApproval,
   diffSize,
@@ -27144,6 +27375,9 @@ function loadProjectConfig4() {
   factsFor,
   fieldTypeRefs,
   fieldTypesOf,
+  findChainingParent,
+  findChainingSubprojectsMissingConfig,
+  findLegacySpecFiles,
   findProjectRoot,
   findSystemRoot,
   fromProjectRoot,
@@ -27153,6 +27387,7 @@ function loadProjectConfig4() {
   generateDiagramSet,
   generateSequenceDiagram,
   getExporter,
+  getLoaderIssues,
   getProjectRoot,
   getProjectRootOverride,
   getRequestParentReach,
@@ -27160,6 +27395,7 @@ function loadProjectConfig4() {
   getStatusReport,
   globalGuideFilePath,
   globalPacksDir,
+  globalPacksEnabled,
   globalTemplatesDir,
   hasContext,
   hasFunctionBody,
@@ -27192,6 +27428,7 @@ function loadProjectConfig4() {
   loadInterfaceSpecs,
   loadProjectConfig,
   loadProjectExtensions,
+  loadProjectVariants,
   loadRegistry,
   loadSpec,
   loadSpecGraph,
@@ -27215,12 +27452,16 @@ function loadProjectConfig4() {
   moveSubsystemProject,
   movedChildren,
   narrativeStepForeignFields,
+  packDirEntry,
+  packEntryLabel,
+  packEntryRef,
   packStoreDir,
   parseDeclaredCall,
   parseYaml,
   passesIntentFloor,
   pathExists,
   pathKey,
+  pinInstalledPacksAsSelections,
   projectConfigExists,
   provisionProject,
   qualifiedTypeId,
@@ -27248,18 +27489,14 @@ function loadProjectConfig4() {
   resolveImport,
   resolveInstalledPack,
   resolveSubprojectForNamespace,
+  resolveVariantGuidance,
   retireSpecialists,
   runWithProjectBinding,
   runWithProjectRoot,
   sameContract,
-  saveComponentSpec,
-  saveImplementationSpec,
-  saveInterfaceSpec,
   saveSpec,
-  saveSubsystemSpec,
-  saveSystemSpec,
   saveTopologyConfig,
-  saveTypeSpec,
+  scanAllSpecs,
   serializeYaml,
   setExecutionTier,
   setLogLevel,