limina 0.0.1

package/cli.js

@@ -0,0 +1,2287 @@
+#!/usr/bin/env node
+import "./chunks/dep-lkQg1P9Q.js";
+import { d as normalizeSlashes, f as normalizeWorkspacePath, h as toRelativePath, i as loadConfig, l as isPathInsideDirectory, m as toPosixPath, n as getActiveCheckerExtensions, p as toAbsolutePath, r as getActiveCheckers, u as normalizeAbsolutePath } from "./chunks/dep-jgc7X0zw.js";
+import { A as collectImporters, B as createFormatHost, C as inferPackageProject$1, D as parseProject$1, E as isWorkspacePackageFile, F as collectGraphProjectRoute, G as isOrdinaryTypecheckConfigPath, H as getDtsCompanionConfigPath, I as collectGraphProjectRouteFromRoot, J as readJsonConfig, K as parseProjectFileNames, L as collectGraphProjectRoutes, M as findPackageForSpecifier, N as getPackageRootSpecifier, O as resolveInternalImport$1, P as collectCheckerEntryProjectRoutes, S as getTypecheckConfigPath, T as isRelativeSpecifier, U as getRawReferencePaths, V as formatReferences, W as isDtsConfigPath, X as resolveReferencePath, Y as resolveProjectConfigPath, _ as createFileOwnerLookup$1, a as runSourceCheck, b as findTargetProject, c as PackageLogger, d as clearCliScreen, f as formatErrorMessage$1, g as collectImportsFromFile$1, h as normalizeGraphRules, i as runCheckerTypecheck, j as collectWorkspacePackages, k as shouldResolveThroughGraph$1, l as PathsLogger, m as getDeniedWorkspaceDepRule, n as createLiminaFlowReporter, o as CliLogger, p as getDeniedRefRule, q as parseProjectFileNamesForExtensions, r as runCheckerBuild, s as GraphLogger, u as ProofLogger, v as findImporterForFile$1, w as isDtsProjectConfig, x as formatArtifactDependencyPolicy, y as findPackageForFile, z as createExtensionPattern } from "./chunks/dep-DoSHsBSP.js";
+import { builtinModules } from "node:module";
+import { cac } from "cac";
+import { createElapsedTimer } from "@docs-islands/logger/helper";
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import ts from "typescript";
+import { spawn, spawnSync } from "node:child_process";
+import { glob } from "tinyglobby";
+import { checkPackage, createPackageFromTarballData } from "@arethetypeswrong/core";
+import { pack } from "@publint/pack";
+import { init, parse } from "es-module-lexer";
+import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { publint } from "publint";
+import { formatMessage } from "publint/utils";
+
+//#region src/commands/graph.ts
+const requiredDtsCompilerOptions = [
+	["composite", true],
+	["incremental", true],
+	["noEmit", false],
+	["declaration", true],
+	["emitDeclarationOnly", true]
+];
+const requiredDtsPathOptions = [
+	"rootDir",
+	"outDir",
+	"tsBuildInfoFile"
+];
+const comparableTypecheckOptions = [
+	"allowArbitraryExtensions",
+	"allowImportingTsExtensions",
+	"allowJs",
+	"allowSyntheticDefaultImports",
+	"checkJs",
+	"customConditions",
+	"esModuleInterop",
+	"exactOptionalPropertyTypes",
+	"forceConsistentCasingInFileNames",
+	"isolatedDeclarations",
+	"isolatedModules",
+	"jsx",
+	"jsxImportSource",
+	"lib",
+	"module",
+	"moduleDetection",
+	"moduleResolution",
+	"noFallthroughCasesInSwitch",
+	"noImplicitAny",
+	"noImplicitOverride",
+	"noImplicitReturns",
+	"noImplicitThis",
+	"noPropertyAccessFromIndexSignature",
+	"noUncheckedIndexedAccess",
+	"resolveJsonModule",
+	"skipLibCheck",
+	"strict",
+	"strictBindCallApply",
+	"strictFunctionTypes",
+	"strictNullChecks",
+	"strictPropertyInitialization",
+	"target",
+	"typeRoots",
+	"types",
+	"useDefineForClassFields",
+	"verbatimModuleSyntax"
+];
+function formatCompilerOptionValue(value) {
+	if (value === void 0) return "undefined";
+	return JSON.stringify(value);
+}
+function compilerOptionEquals(left, right) {
+	return JSON.stringify(left) === JSON.stringify(right);
+}
+function addDtsOptionProblems(config, project, problems) {
+	if (!isDtsProjectConfig(project.configPath)) return;
+	for (const [optionName, expected] of requiredDtsCompilerOptions) {
+		const actual = project.options[optionName];
+		if (actual === expected) continue;
+		problems.push([
+			"Invalid declaration leaf compiler option:",
+			`  project: ${toRelativePath(config.rootDir, project.configPath)}`,
+			`  option: compilerOptions.${optionName}`,
+			`  expected: ${formatCompilerOptionValue(expected)}`,
+			`  actual: ${formatCompilerOptionValue(actual)}`,
+			"  reason: tsconfig*.dts.json projects are consumed by tsc -b and must emit declarations through composite incremental builds."
+		].join("\n"));
+	}
+	for (const optionName of requiredDtsPathOptions) {
+		if (project.options[optionName]) continue;
+		problems.push([
+			"Missing declaration leaf output option:",
+			`  project: ${toRelativePath(config.rootDir, project.configPath)}`,
+			`  option: compilerOptions.${optionName}`,
+			"  reason: declaration leaves need explicit root/output state so declaration output and tsbuildinfo files do not collide."
+		].join("\n"));
+	}
+}
+function addTypecheckParityProblems(config, dtsProject, problems) {
+	if (!isDtsProjectConfig(dtsProject.configPath)) return;
+	const typecheckConfigPath = getTypecheckConfigPath(dtsProject.configPath);
+	if (!existsSync(typecheckConfigPath)) {
+		problems.push([
+			"Missing typecheck companion config:",
+			`  declaration leaf: ${toRelativePath(config.rootDir, dtsProject.configPath)}`,
+			`  expected typecheck config: ${toRelativePath(config.rootDir, typecheckConfigPath)}`,
+			"  reason: every tsconfig*.dts.json project should have a matching tsconfig*.json file with the same typechecking semantics."
+		].join("\n"));
+		return;
+	}
+	const typecheckProject = parseProject$1(config, typecheckConfigPath);
+	for (const optionName of comparableTypecheckOptions) {
+		const buildValue = dtsProject.options[optionName];
+		const typecheckValue = typecheckProject.options[optionName];
+		if (compilerOptionEquals(buildValue, typecheckValue)) continue;
+		problems.push([
+			"Typecheck option mismatch between declaration leaf and companion config:",
+			`  declaration leaf: ${toRelativePath(config.rootDir, dtsProject.configPath)}`,
+			`  typecheck config: ${toRelativePath(config.rootDir, typecheckConfigPath)}`,
+			`  option: compilerOptions.${optionName}`,
+			`  declaration value: ${formatCompilerOptionValue(buildValue)}`,
+			`  typecheck value: ${formatCompilerOptionValue(typecheckValue)}`,
+			"  reason: tsconfig*.dts.json should emit with the same typechecking semantics as its matching tsconfig*.json companion."
+		].join("\n"));
+	}
+	const typecheckFiles = new Set(typecheckProject.fileNames);
+	const missingFiles = dtsProject.fileNames.filter((fileName) => !typecheckFiles.has(fileName));
+	if (missingFiles.length === 0) return;
+	problems.push([
+		"Declaration leaf includes files missing from its companion typecheck config:",
+		`  declaration leaf: ${toRelativePath(config.rootDir, dtsProject.configPath)}`,
+		`  typecheck config: ${toRelativePath(config.rootDir, typecheckConfigPath)}`,
+		"  files:",
+		...missingFiles.slice(0, 10).map((fileName) => `    - ${toRelativePath(config.rootDir, fileName)}`),
+		...missingFiles.length > 10 ? [`    ...and ${missingFiles.length - 10} more`] : [],
+		"  reason: a declaration leaf must not emit declarations for files that are not covered by the matching typecheck target."
+	].join("\n"));
+}
+function addDeniedReferenceProblems(options) {
+	if (!options.project.label) return;
+	for (const referencePath of options.project.references) {
+		if (!options.projectsByPath.has(referencePath)) continue;
+		const deniedRefRule = getDeniedRefRule(options.rules, options.project.label, referencePath);
+		const targetPackage = findPackageForFile(referencePath, options.packages);
+		const deniedDepRule = targetPackage ? getDeniedWorkspaceDepRule(options.rules, options.project.label, targetPackage.name) : null;
+		if (!deniedRefRule && !deniedDepRule) continue;
+		const lines = [
+			"Denied graph access:",
+			`  rule: ${options.project.label}`,
+			`  referencing project: ${toRelativePath(options.config.rootDir, options.project.configPath)}`,
+			`  referenced project: ${toRelativePath(options.config.rootDir, referencePath)}`
+		];
+		if (deniedRefRule) lines.push(`  denied ref: ${toRelativePath(options.config.rootDir, deniedRefRule.path)}`, `  reason: ${deniedRefRule.reason}`);
+		else if (deniedDepRule) lines.push(`  denied dependency: ${deniedDepRule.name}`, `  reason: ${deniedDepRule.reason}`);
+		options.problems.push(lines.join("\n"));
+	}
+}
+function addDeniedPackageImportProblem(options) {
+	options.problems.push([
+		"Denied graph access:",
+		`  rule: ${options.project.label}`,
+		`  importing project: ${toRelativePath(options.config.rootDir, options.project.configPath)}`,
+		`  file: ${toRelativePath(options.config.rootDir, options.importRecord.filePath)}:${options.importRecord.line}`,
+		`  imported specifier: ${options.importRecord.specifier}`,
+		`  denied dependency: ${options.rule.name}`,
+		`  reason: ${options.rule.reason}`
+	].join("\n"));
+}
+function addDeniedRefImportProblem(options) {
+	options.problems.push([
+		"Denied graph access:",
+		`  rule: ${options.project.label}`,
+		`  importing project: ${toRelativePath(options.config.rootDir, options.project.configPath)}`,
+		`  file: ${toRelativePath(options.config.rootDir, options.importRecord.filePath)}:${options.importRecord.line}`,
+		`  imported specifier: ${options.importRecord.specifier}`,
+		`  target project: ${toRelativePath(options.config.rootDir, options.targetProjectPath)}`,
+		`  denied ref: ${toRelativePath(options.config.rootDir, options.rule.path)}`,
+		`  reason: ${options.rule.reason}`
+	].join("\n"));
+}
+function addWorkspaceReferenceDependencyProblems(config, project, projectsByPath, packages, importers, problems) {
+	if (!isDtsProjectConfig(project.configPath)) return;
+	const sourcePackage = findPackageForFile(project.configPath, packages);
+	const importer = sourcePackage ? findImporterForFile$1(project.configPath, importers) : null;
+	if (!sourcePackage) return;
+	for (const referencePath of project.references) {
+		if (!projectsByPath.has(referencePath)) continue;
+		const targetPackage = findPackageForFile(referencePath, packages);
+		if (!targetPackage || targetPackage.name === sourcePackage.name) continue;
+		if (importer?.workspaceDependencies.has(targetPackage.name)) continue;
+		problems.push([
+			"Project reference crosses workspace packages without a workspace:* dependency:",
+			`  referencing project: ${toRelativePath(config.rootDir, project.configPath)}`,
+			`  referenced project: ${toRelativePath(config.rootDir, referencePath)}`,
+			`  referencing package: ${sourcePackage.name}`,
+			`  referenced package: ${targetPackage.name}`,
+			`  package manifest: ${toRelativePath(config.rootDir, path.join(sourcePackage.directory, "package.json"))}`,
+			`  reason: a cross-package tsconfig*.dts.json reference is a source dependency edge, so ${sourcePackage.name} must declare ${targetPackage.name} with the workspace: protocol.`,
+			`  fix: add "${targetPackage.name}": "workspace:*" to dependencies, devDependencies, peerDependencies, or optionalDependencies in the referencing package manifest. If this package intentionally consumes built artifacts, remove the project reference; ${formatArtifactDependencyPolicy(targetPackage)}`
+		].join("\n"));
+	}
+}
+async function runGraphCheckInternal(config, options = {}) {
+	const graphRoute = collectGraphProjectRoute(config);
+	const projectPaths = graphRoute.projectPaths;
+	const projects = projectPaths.map((projectPath) => parseProject$1(config, projectPath));
+	const projectsByPath = new Map(projects.map((project) => [project.configPath, project]));
+	const fileOwnerLookup = createFileOwnerLookup$1(projects);
+	const packages = await collectWorkspacePackages(config);
+	const importers = collectImporters(config, packages);
+	const problems = [...graphRoute.problems];
+	const graphRules = normalizeGraphRules({
+		config,
+		include: {
+			nodeBuiltins: false,
+			refs: true,
+			workspaceDeps: true
+		},
+		packages,
+		problems,
+		projectPaths
+	});
+	for (const project of projects) {
+		if (project.labelProblem) problems.push(project.labelProblem);
+		addDtsOptionProblems(config, project, problems);
+		addTypecheckParityProblems(config, project, problems);
+		addDeniedReferenceProblems({
+			config,
+			packages,
+			problems,
+			project,
+			projectsByPath,
+			rules: graphRules
+		});
+		addWorkspaceReferenceDependencyProblems(config, project, projectsByPath, packages, importers, problems);
+		for (const filePath of project.fileNames) for (const importRecord of collectImportsFromFile$1(filePath)) {
+			const resolvedFilePath = resolveInternalImport$1(importRecord.specifier, filePath, project.options);
+			const targetPackage = findPackageForSpecifier(importRecord.specifier, packages);
+			const importer = targetPackage ? findImporterForFile$1(importRecord.filePath, importers) : null;
+			const unresolvedDeniedDepRule = targetPackage ? getDeniedWorkspaceDepRule(graphRules, project.label, targetPackage.name) : null;
+			if (!resolvedFilePath) {
+				if (unresolvedDeniedDepRule) {
+					addDeniedPackageImportProblem({
+						config,
+						importRecord,
+						problems,
+						project,
+						rule: unresolvedDeniedDepRule
+					});
+					continue;
+				}
+				if (!targetPackage) continue;
+				problems.push([
+					"Unresolved workspace import:",
+					`  importing project: ${toRelativePath(config.rootDir, project.configPath)}`,
+					`  file: ${toRelativePath(config.rootDir, importRecord.filePath)}:${importRecord.line}`,
+					`  imported specifier: ${importRecord.specifier}`,
+					`  matched workspace package: ${targetPackage.name}`,
+					`  current references: ${formatReferences(config.rootDir, project.references)}`
+				].join("\n"));
+				continue;
+			}
+			const targetWorkspacePackageForResolved = findPackageForFile(resolvedFilePath, packages);
+			const deniedDepRule = (targetPackage ? getDeniedWorkspaceDepRule(graphRules, project.label, targetPackage.name) : null) ?? (targetWorkspacePackageForResolved ? getDeniedWorkspaceDepRule(graphRules, project.label, targetWorkspacePackageForResolved.name) : null);
+			if (deniedDepRule) {
+				addDeniedPackageImportProblem({
+					config,
+					importRecord,
+					problems,
+					project,
+					rule: deniedDepRule
+				});
+				continue;
+			}
+			if (isRelativeSpecifier(importRecord.specifier)) {
+				const sourcePackage = findPackageForFile(importRecord.filePath, packages);
+				if (sourcePackage && targetWorkspacePackageForResolved && sourcePackage.name !== targetWorkspacePackageForResolved.name) {
+					problems.push([
+						"Cross-package relative import:",
+						`  importing project: ${toRelativePath(config.rootDir, project.configPath)}`,
+						`  file: ${toRelativePath(config.rootDir, importRecord.filePath)}:${importRecord.line}`,
+						`  imported specifier: ${importRecord.specifier}`,
+						`  source package: ${sourcePackage.name}`,
+						`  target package: ${targetWorkspacePackageForResolved.name}`,
+						`  resolved file: ${toRelativePath(config.rootDir, resolvedFilePath)}`,
+						"  reason: workspace packages must depend through package exports."
+					].join("\n"));
+					continue;
+				}
+			}
+			if (targetPackage && !shouldResolveThroughGraph$1(importer, targetPackage)) continue;
+			if (targetPackage && shouldResolveThroughGraph$1(importer, targetPackage) && !fileOwnerLookup.has(resolvedFilePath)) {
+				const referencedProjectPath = inferPackageProject$1(resolvedFilePath, targetPackage, projectPaths);
+				const hasProjectReference = referencedProjectPath && project.references.has(referencedProjectPath);
+				problems.push([
+					hasProjectReference ? "Referenced workspace dependency resolves through package exports to a build artifact:" : "Workspace source dependency resolved outside the source graph:",
+					`  importing project: ${toRelativePath(config.rootDir, project.configPath)}`,
+					...referencedProjectPath ? [`  referenced project: ${toRelativePath(config.rootDir, referencedProjectPath)}`, `  project reference present: ${hasProjectReference ? "yes" : "no"}`] : [],
+					`  file: ${toRelativePath(config.rootDir, importRecord.filePath)}:${importRecord.line}`,
+					`  imported specifier: ${importRecord.specifier}`,
+					`  resolved file: ${toRelativePath(config.rootDir, resolvedFilePath)}`,
+					"  reason: workspace:* dependencies are source dependencies, but TypeScript resolved this package export to a file not owned by the source graph. tsc -b does not rewrite package exports through project references.",
+					`  fix: expose source files from the dependency package exports, add a source paths config to this declaration leaf extends, or stop using workspace:* plus project references for artifact consumption; ${formatArtifactDependencyPolicy(targetPackage)}`,
+					"  hint: run `limina paths generate` to create a compatibility paths file, then manually add it to the first position of the listed tsconfig*.dts.json extends array."
+				].join("\n"));
+				continue;
+			}
+			const targetProjectPath = findTargetProject({
+				fileOwnerLookup,
+				packages,
+				projectPaths,
+				resolvedFilePath,
+				specifier: importRecord.specifier
+			});
+			if (!targetProjectPath) {
+				if (!targetPackage) continue;
+				if (!isWorkspacePackageFile(resolvedFilePath, packages)) {
+					if (targetPackage && shouldResolveThroughGraph$1(importer, targetPackage)) problems.push([
+						"Workspace source import resolved outside the workspace graph:",
+						`  importing project: ${toRelativePath(config.rootDir, project.configPath)}`,
+						`  file: ${toRelativePath(config.rootDir, importRecord.filePath)}:${importRecord.line}`,
+						`  imported specifier: ${importRecord.specifier}`,
+						`  resolved file: ${toRelativePath(config.rootDir, resolvedFilePath)}`,
+						`  reason: workspace:* dependencies are source dependency edges and must resolve to files owned by the source graph; ${formatArtifactDependencyPolicy(targetPackage)}`
+					].join("\n"));
+					continue;
+				}
+				problems.push([
+					"Unable to map workspace import to a graph project:",
+					`  importing project: ${toRelativePath(config.rootDir, project.configPath)}`,
+					`  file: ${toRelativePath(config.rootDir, importRecord.filePath)}:${importRecord.line}`,
+					`  imported specifier: ${importRecord.specifier}`,
+					`  resolved file: ${toRelativePath(config.rootDir, resolvedFilePath)}`,
+					`  current references: ${formatReferences(config.rootDir, project.references)}`
+				].join("\n"));
+				continue;
+			}
+			if (targetProjectPath === project.configPath) continue;
+			const deniedRefRule = getDeniedRefRule(graphRules, project.label, targetProjectPath);
+			if (deniedRefRule) {
+				addDeniedRefImportProblem({
+					config,
+					importRecord,
+					problems,
+					project,
+					rule: deniedRefRule,
+					targetProjectPath
+				});
+				continue;
+			}
+			if (!projectsByPath.has(targetProjectPath)) {
+				problems.push([
+					"Expected graph target is not reachable from any checker entry:",
+					`  importing project: ${toRelativePath(config.rootDir, project.configPath)}`,
+					`  file: ${toRelativePath(config.rootDir, importRecord.filePath)}:${importRecord.line}`,
+					`  imported specifier: ${importRecord.specifier}`,
+					`  expected graph project: ${toRelativePath(config.rootDir, targetProjectPath)}`
+				].join("\n"));
+				continue;
+			}
+			if (!project.references.has(targetProjectPath)) problems.push([
+				"Missing project reference for workspace import:",
+				`  importing project: ${toRelativePath(config.rootDir, project.configPath)}`,
+				`  file: ${toRelativePath(config.rootDir, importRecord.filePath)}:${importRecord.line}`,
+				`  imported specifier: ${importRecord.specifier}`,
+				`  expected reference: ${toRelativePath(config.rootDir, targetProjectPath)}`,
+				`  current references: ${formatReferences(config.rootDir, project.references)}`
+			].join("\n"));
+		}
+	}
+	if (problems.length > 0) {
+		GraphLogger.error(problems.join("\n\n"));
+		return false;
+	}
+	if (options.logSuccess ?? true) GraphLogger.success(`Checked ${projects.length} graph projects; references are valid.`);
+	return true;
+}
+async function runGraphCheck(config, options = {}) {
+	if (options.clearScreen ?? true) clearCliScreen();
+	const elapsed = createElapsedTimer();
+	const task = options.flow?.start("graph check", { depth: options.flowDepth ?? 0 });
+	GraphLogger.info("graph check started");
+	try {
+		const logSuccess = !options.flow?.interactive;
+		const passed = await runGraphCheckInternal(config, { logSuccess });
+		if (passed) {
+			if (logSuccess) GraphLogger.success("graph check finished", elapsed());
+			task?.pass();
+		} else {
+			GraphLogger.error("graph check finished with failures", elapsed());
+			task?.fail("graph check finished with failures");
+		}
+		return passed;
+	} catch (error) {
+		GraphLogger.error(`graph check failed: ${formatErrorMessage$1(error)}`, elapsed());
+		task?.fail("graph check failed", { error });
+		throw error;
+	}
+}
+
+//#endregion
+//#region src/commands/package.ts
+const DEFAULT_PACKAGE_CHECKS = [
+	"publint",
+	"attw",
+	"boundary"
+];
+const PACKAGE_CHECK_TOOLS = new Set(DEFAULT_PACKAGE_CHECKS);
+const ATTW_PROFILE_IGNORED_RESOLUTIONS = {
+	strict: [],
+	node16: [],
+	"esm-only": ["node16-cjs"]
+};
+const nodeBuiltinSpecifiers = new Set(builtinModules.flatMap((specifier) => specifier.startsWith("node:") ? [specifier, specifier.slice(5)] : [specifier, `node:${specifier}`]));
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isPackageCheckTool(value) {
+	return PACKAGE_CHECK_TOOLS.has(value);
+}
+function isRelativeOrAbsoluteSpecifier(specifier) {
+	return specifier.startsWith(".") || specifier.startsWith("/") || specifier.startsWith("file:") || specifier.startsWith("http:") || specifier.startsWith("https:") || specifier.startsWith("data:");
+}
+function toArrayBuffer(buffer) {
+	return buffer.buffer.slice(buffer.byteOffset, buffer.byteOffset + buffer.byteLength);
+}
+function collectSelfSpecifierMatchers(packageName, exportsField) {
+	const exact = new Set([packageName]);
+	const prefixes = [];
+	if (!isRecord(exportsField)) return {
+		exact,
+		prefixes
+	};
+	for (const exportKey of Object.keys(exportsField)) {
+		if (exportKey === ".") {
+			exact.add(packageName);
+			continue;
+		}
+		if (!exportKey.startsWith("./")) continue;
+		const normalizedSubpath = exportKey.slice(2);
+		if (normalizedSubpath.length === 0) continue;
+		const wildcardIndex = normalizedSubpath.indexOf("*");
+		if (wildcardIndex !== -1) {
+			prefixes.push(`${packageName}/${normalizedSubpath.slice(0, wildcardIndex)}`);
+			continue;
+		}
+		exact.add(`${packageName}/${normalizedSubpath}`);
+	}
+	return {
+		exact,
+		prefixes
+	};
+}
+function isAllowedSelfSpecifier(specifier, matchers) {
+	return matchers.exact.has(specifier) || matchers.prefixes.some((prefix) => specifier.startsWith(prefix));
+}
+function normalizePublishedModulePath(relativeFilePath) {
+	return relativeFilePath.replaceAll("\\", "/");
+}
+function classifyRuntimeEnvironment(target, relativeFilePath) {
+	if (typeof target.environment === "function") return target.environment(relativeFilePath);
+	if (target.environment) return target.environment;
+	const normalizedPath = normalizePublishedModulePath(relativeFilePath);
+	return normalizedPath.startsWith("node/") || normalizedPath.startsWith("plugin/") ? "node" : "browser";
+}
+async function collectPublishedModuleFiles(directoryPath) {
+	const entries = await readdir(directoryPath, { withFileTypes: true });
+	const files = [];
+	for (const entry of entries) {
+		const absolutePath = path.join(directoryPath, entry.name);
+		if (entry.isDirectory()) {
+			files.push(...await collectPublishedModuleFiles(absolutePath));
+			continue;
+		}
+		if (/\.[cm]?js$/u.test(entry.name)) files.push(absolutePath);
+	}
+	return files;
+}
+function validatePublishedSpecifier(options) {
+	const { allowedExternalPackages, environment, packageName, selfSpecifiers, specifier } = options;
+	if (isRelativeOrAbsoluteSpecifier(specifier)) return null;
+	if (nodeBuiltinSpecifiers.has(specifier)) {
+		if (environment === "node") return null;
+		return `browser/runtime output must not import Node builtin "${specifier}"`;
+	}
+	const packageRoot = getPackageRootSpecifier(specifier);
+	if (packageRoot === packageName) {
+		if (isAllowedSelfSpecifier(specifier, selfSpecifiers)) return null;
+		return `self import "${specifier}" is not exposed by output package.json exports`;
+	}
+	if (allowedExternalPackages.has(packageRoot)) return null;
+	return `"${specifier}" resolves to package "${packageRoot}" which is not listed in dependencies, peerDependencies, optionalDependencies, or self exports`;
+}
+function formatAttwProblem(problem) {
+	const resolutionKind = "resolutionKind" in problem ? ` [resolution: ${problem.resolutionKind}]` : "";
+	const entrypoint = "entrypoint" in problem ? ` [entrypoint: ${problem.entrypoint}]` : "";
+	switch (problem.kind) {
+		case "NoResolution": return `No resolution${resolutionKind}${entrypoint}`;
+		case "UntypedResolution": return `Untyped resolution${resolutionKind}${entrypoint}`;
+		case "FalseESM": return `False ESM: ${problem.typesFileName} -> ${problem.implementationFileName}`;
+		case "FalseCJS": return `False CJS: ${problem.typesFileName} -> ${problem.implementationFileName}`;
+		case "CJSResolvesToESM": return `CJS resolves to ESM${resolutionKind}${entrypoint}`;
+		case "FallbackCondition": return `Fallback condition used${resolutionKind}${entrypoint}`;
+		case "NamedExports": return problem.isMissingAllNamed ? `Named exports missing: all named exports [types: ${problem.typesFileName}] [implementation: ${problem.implementationFileName}]` : `Named exports missing: ${problem.missing.join(", ") || "(none)"} [types: ${problem.typesFileName}] [implementation: ${problem.implementationFileName}]`;
+		case "FalseExportDefault": return `False export default [types: ${problem.typesFileName}] [implementation: ${problem.implementationFileName}]`;
+		case "MissingExportEquals": return `Missing export equals [types: ${problem.typesFileName}] [implementation: ${problem.implementationFileName}]`;
+		case "InternalResolutionError": return `Internal resolution error in ${problem.fileName} [option: ${problem.resolutionOption}] [module: ${problem.moduleSpecifier}]`;
+		case "UnexpectedModuleSyntax": return `Unexpected module syntax in ${problem.fileName}`;
+		case "CJSOnlyExportsDefault": return `CJS only exports default in ${problem.fileName}`;
+		default: return `Unknown ATTW problem: ${JSON.stringify(problem)}`;
+	}
+}
+function normalizeTargetChecks(target) {
+	const checks = target.checks ?? DEFAULT_PACKAGE_CHECKS;
+	const normalizedChecks = [];
+	for (const check of checks) {
+		if (!isPackageCheckTool(check)) throw new Error(`Invalid package check "${check}". Expected one of: publint, attw, boundary.`);
+		if (!normalizedChecks.includes(check)) normalizedChecks.push(check);
+	}
+	return normalizedChecks;
+}
+function selectTargetChecks(target, requestedTool) {
+	const configuredChecks = normalizeTargetChecks(target);
+	if (!requestedTool || requestedTool === "all") return configuredChecks;
+	return configuredChecks.includes(requestedTool) ? [requestedTool] : [];
+}
+function findNearestPackageJsonPath(cwd, rootDir) {
+	const resolvedRootDir = path.resolve(rootDir);
+	let currentDir = path.resolve(cwd);
+	while (true) {
+		const relativeToRoot = path.relative(resolvedRootDir, currentDir);
+		if (!(relativeToRoot === "" || relativeToRoot !== ".." && !relativeToRoot.startsWith(`..${path.sep}`) && !path.isAbsolute(relativeToRoot))) return;
+		const packageJsonPath = path.join(currentDir, "package.json");
+		if (existsSync(packageJsonPath)) return packageJsonPath;
+		if (currentDir === resolvedRootDir) return;
+		const parentDir = path.dirname(currentDir);
+		if (parentDir === currentDir) return;
+		currentDir = parentDir;
+	}
+}
+function readCwdPackageName(cwd, rootDir) {
+	const packageJsonPath = findNearestPackageJsonPath(cwd, rootDir);
+	if (!packageJsonPath) return;
+	try {
+		const manifest = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+		return typeof manifest.name === "string" && manifest.name.trim() ? manifest.name.trim() : void 0;
+	} catch (error) {
+		throw new Error(`Unable to read package name from ${packageJsonPath}: ${formatErrorMessage$1(error)}`);
+	}
+}
+function formatConfiguredTargetNames(targets) {
+	const names = targets.map((target) => target.name).filter((name) => Boolean(name));
+	return names.length > 0 ? names.join(", ") : "(none)";
+}
+function resolveTargetOutDir(options) {
+	const outDir = options.target.outDir;
+	if (typeof outDir !== "string" || outDir.trim().length === 0) throw new Error(`Invalid package check target at packageChecks.targets[${options.targetIndex}].outDir. Expected a non-empty string.`);
+	return path.resolve(options.config.rootDir, outDir);
+}
+function getTargetLabel(config, target, outDir) {
+	return target.name ?? toRelativePath(config.rootDir, outDir);
+}
+function createTargetPlan(options) {
+	const outDir = resolveTargetOutDir({
+		config: options.config,
+		target: options.target,
+		targetIndex: options.targetIndex
+	});
+	return {
+		checks: selectTargetChecks(options.target, options.requestedTool),
+		label: getTargetLabel(options.config, options.target, outDir),
+		outDir,
+		rawTarget: options.target
+	};
+}
+function createPackageCheckPlan(options) {
+	const targets = options.config.packageChecks?.targets ?? [];
+	if (targets.length === 0) throw new Error("No package check targets are configured.");
+	let selectedTargets;
+	let selectionReason;
+	if (options.targetName) {
+		selectedTargets = targets.filter((target) => target.name === options.targetName);
+		if (selectedTargets.length === 0) throw new Error([`No package check target named "${options.targetName}" is configured.`, `Configured target names: ${formatConfiguredTargetNames(targets)}.`].join(" "));
+		selectionReason = `--package "${options.targetName}" matched configured target name.`;
+	} else {
+		const cwdPackageName = readCwdPackageName(options.cwd, options.config.rootDir);
+		if (cwdPackageName) {
+			selectedTargets = targets.filter((target) => target.name === cwdPackageName);
+			if (selectedTargets.length > 0) selectionReason = `nearest package.json name "${cwdPackageName}" matched configured target name.`;
+			else {
+				selectedTargets = targets;
+				selectionReason = `nearest package.json name "${cwdPackageName}" did not match configured target names; running all configured targets.`;
+			}
+		} else {
+			selectedTargets = targets;
+			selectionReason = "No package name was found from cwd up to the workspace root; running all configured targets.";
+		}
+	}
+	return {
+		selectionReason,
+		targets: selectedTargets.map((target) => createTargetPlan({
+			config: options.config,
+			requestedTool: options.tool,
+			target,
+			targetIndex: targets.indexOf(target)
+		}))
+	};
+}
+function logPackageCheckPlan(options) {
+	PackageLogger.info([
+		"Package check plan:",
+		`  config: ${toRelativePath(options.config.rootDir, options.config.configPath)}`,
+		`  cwd: ${toRelativePath(options.config.rootDir, options.cwd)}`,
+		`  selection: ${options.plan.selectionReason}`,
+		"  targets:",
+		...options.plan.targets.map((target) => [
+			`    - ${target.label}`,
+			`      outDir: ${toRelativePath(options.config.rootDir, target.outDir)}`,
+			`      checks: ${target.checks.length > 0 ? target.checks.join(", ") : "(none)"}`
+		].join("\n"))
+	].join("\n"));
+}
+async function packOutputTarball(outDir) {
+	const destination = await mkdtemp(path.join(tmpdir(), "__LATTICE_PACKAGE__"));
+	return {
+		cleanup: async () => {
+			await rm(destination, {
+				force: true,
+				recursive: true
+			}).catch(() => null);
+		},
+		tarball: await readFile(await pack(outDir, {
+			destination,
+			ignoreScripts: true,
+			packageManager: "pnpm"
+		}))
+	};
+}
+async function runPublintCheck(options) {
+	const task = options.flow?.start(`publint: ${options.label}`, { depth: options.flowDepth ?? 0 });
+	PackageLogger.info(`publint started: ${options.label}`);
+	const publintElapsed = createElapsedTimer();
+	const { messages, pkg } = await publint({
+		pack: { tarball: toArrayBuffer(options.tarball) },
+		strict: options.strict
+	});
+	if (messages.length === 0) {
+		if (!options.flow?.interactive) PackageLogger.success(`publint passed: ${options.label}`, publintElapsed());
+		task?.pass();
+		return true;
+	}
+	for (const message of messages) {
+		const rendered = formatMessage(message, pkg) ?? message.code;
+		if (message.type === "error") {
+			PackageLogger.error(`[${options.label}] [publint] ${rendered}`);
+			continue;
+		}
+		if (message.type === "warning") {
+			PackageLogger.warn(`[${options.label}] [publint] ${rendered}`);
+			continue;
+		}
+		PackageLogger.info(`[${options.label}] [publint] ${rendered}`);
+	}
+	PackageLogger.error(`publint found ${messages.length} issue(s): ${options.label}`, publintElapsed());
+	task?.fail(`publint found ${messages.length} issue(s): ${options.label}`);
+	return false;
+}
+async function runAttwCheck(options) {
+	const task = options.flow?.start(`attw: ${options.label}`, { depth: options.flowDepth ?? 0 });
+	PackageLogger.info(`attw started: ${options.label} (profile: ${options.profile})`);
+	const attwElapsed = createElapsedTimer();
+	const result = await checkPackage(createPackageFromTarballData(options.tarball));
+	if (!result.types) {
+		PackageLogger.error(`[${options.label}] [attw] package has no types`);
+		PackageLogger.error(`attw failed: ${options.label}`, attwElapsed());
+		task?.fail(`attw failed: ${options.label}`);
+		return false;
+	}
+	const ignoredResolutions = ATTW_PROFILE_IGNORED_RESOLUTIONS[options.profile];
+	const problems = result.problems.filter((problem) => {
+		if ("resolutionKind" in problem) return !ignoredResolutions.includes(problem.resolutionKind);
+		return true;
+	});
+	if (problems.length === 0) {
+		if (!options.flow?.interactive) PackageLogger.success(`attw passed: ${options.label}`, attwElapsed());
+		task?.pass();
+		return true;
+	}
+	for (const problem of problems) PackageLogger.error(`[${options.label}] [attw] ${formatAttwProblem(problem)}`);
+	PackageLogger.error(`attw found ${problems.length} problem(s): ${options.label}`, attwElapsed());
+	task?.fail(`attw found ${problems.length} problem(s): ${options.label}`);
+	return false;
+}
+async function runBoundaryCheck(target, label, options = {}) {
+	const task = options.flow?.start(`package boundary: ${label}`, { depth: options.flowDepth ?? 0 });
+	PackageLogger.info(`package boundary started: ${label}`);
+	const boundaryElapsed = createElapsedTimer();
+	const violations = await auditPublishedPackageBoundaries(target);
+	if (violations.length === 0) {
+		if (!options.flow?.interactive) PackageLogger.success(`package boundary passed: ${label}`, boundaryElapsed());
+		task?.pass();
+		return true;
+	}
+	for (const violation of violations) PackageLogger.error(`[${label}] [boundary] ${violation.filePath} (${violation.environment}) imports "${violation.specifier}": ${violation.message}`);
+	PackageLogger.error(`package boundary found ${violations.length} issue(s): ${label}`, boundaryElapsed());
+	task?.fail(`package boundary found ${violations.length} issue(s): ${label}`);
+	return false;
+}
+async function runPackageCheckTarget(options) {
+	const target = {
+		...options.rawTarget,
+		outDir: options.outDir
+	};
+	const label = options.label;
+	const outputPackageJsonPath = path.join(target.outDir, "package.json");
+	const task = options.flow?.start(`package target: ${label}`, { depth: options.flowDepth ?? 0 });
+	let packedDist;
+	try {
+		if (!existsSync(outputPackageJsonPath)) throw new Error(`outDir package.json not found for ${label} at ${toRelativePath(options.config.rootDir, outputPackageJsonPath)}. Run the package build first.`);
+		if (options.checks.includes("publint") || options.checks.includes("attw")) {
+			const packTask = options.flow?.start(`package tarball: ${label}`, { depth: (options.flowDepth ?? 0) + 1 });
+			PackageLogger.info(`package tarball packing started: ${label}`);
+			const packElapsed = createElapsedTimer();
+			try {
+				packedDist = await packOutputTarball(target.outDir);
+			} catch (error) {
+				PackageLogger.error(`package tarball failed: ${label}: ${formatErrorMessage$1(error)}`, packElapsed());
+				packTask?.fail(`package tarball failed: ${label}`, { error });
+				throw error;
+			}
+			if (!options.flow?.interactive) PackageLogger.success(`package tarball packed: ${label}`, packElapsed());
+			packTask?.pass();
+		}
+		let passed = true;
+		if (options.checks.includes("publint")) passed = await runPublintCheck({
+			flow: options.flow,
+			flowDepth: (options.flowDepth ?? 0) + 1,
+			label,
+			strict: target.publint?.strict ?? true,
+			tarball: packedDist.tarball
+		}) && passed;
+		if (options.checks.includes("attw")) passed = await runAttwCheck({
+			flow: options.flow,
+			flowDepth: (options.flowDepth ?? 0) + 1,
+			label,
+			profile: options.attwProfile ?? target.attw?.profile ?? "esm-only",
+			tarball: packedDist.tarball
+		}) && passed;
+		if (options.checks.includes("boundary")) passed = await runBoundaryCheck({
+			...target.boundary,
+			outDir: target.outDir
+		}, label, {
+			flow: options.flow,
+			flowDepth: (options.flowDepth ?? 0) + 1
+		}) && passed;
+		if (passed) {
+			if (!options.flow?.interactive) PackageLogger.success(`package checks passed: ${label}`);
+			task?.pass();
+		} else {
+			PackageLogger.error(`package checks failed: ${label}`);
+			task?.fail(`package checks failed: ${label}`);
+		}
+		return passed;
+	} catch (error) {
+		PackageLogger.error(`package checks failed: ${label}: ${formatErrorMessage$1(error)}`);
+		task?.fail(`package checks failed: ${label}`, { error });
+		throw error;
+	} finally {
+		if (packedDist) await packedDist.cleanup();
+	}
+}
+async function auditPublishedPackageBoundaries(target) {
+	const manifestPath = path.join(target.outDir, "package.json");
+	const manifest = JSON.parse(await readFile(manifestPath, "utf8"));
+	const allowedExternalPackages = new Set([
+		...Object.keys(manifest.dependencies ?? {}),
+		...Object.keys(manifest.peerDependencies ?? {}),
+		...Object.keys(manifest.optionalDependencies ?? {}),
+		...target.ignoredExternalPackages ?? []
+	]);
+	const selfSpecifiers = collectSelfSpecifierMatchers(manifest.name, manifest.exports);
+	const publishedFiles = await collectPublishedModuleFiles(target.outDir);
+	const violations = [];
+	await init;
+	for (const filePath of publishedFiles) {
+		const relativeFilePath = path.relative(target.outDir, filePath);
+		const environment = classifyRuntimeEnvironment(target, relativeFilePath);
+		const [importSpecifiers] = parse(await readFile(filePath, "utf8"));
+		for (const importSpecifier of importSpecifiers) {
+			if (!importSpecifier.n) continue;
+			const message = validatePublishedSpecifier({
+				allowedExternalPackages,
+				environment,
+				packageName: manifest.name,
+				selfSpecifiers,
+				specifier: importSpecifier.n
+			});
+			if (!message) continue;
+			violations.push({
+				environment,
+				filePath: relativeFilePath,
+				message,
+				specifier: importSpecifier.n
+			});
+		}
+	}
+	return violations.toSorted((left, right) => {
+		if (left.filePath === right.filePath) return left.specifier.localeCompare(right.specifier);
+		return left.filePath.localeCompare(right.filePath);
+	});
+}
+async function runPackageCheck(options) {
+	if (options.clearScreen ?? true) clearCliScreen();
+	const elapsed = createElapsedTimer();
+	const cwd = path.resolve(options.cwd ?? process.cwd());
+	const task = options.flow?.start("package check", { depth: options.flowDepth ?? 0 });
+	try {
+		PackageLogger.info("package check started");
+		const plan = createPackageCheckPlan({
+			config: options.config,
+			cwd,
+			targetName: options.targetName,
+			tool: options.tool
+		});
+		logPackageCheckPlan({
+			config: options.config,
+			cwd,
+			plan
+		});
+		const runnableTargets = plan.targets.filter((target) => target.checks.length > 0);
+		if (runnableTargets.length === 0) throw new Error(options.tool && options.tool !== "all" ? `No package check targets have "${options.tool}" enabled.` : "No package checks are enabled.");
+		let passed = true;
+		for (const target of runnableTargets) passed = await runPackageCheckTarget({
+			attwProfile: options.attwProfile,
+			checks: target.checks,
+			config: options.config,
+			flow: options.flow,
+			flowDepth: (options.flowDepth ?? 0) + 1,
+			label: target.label,
+			outDir: target.outDir,
+			rawTarget: target.rawTarget
+		}) && passed;
+		if (passed) {
+			if (!options.flow?.interactive) PackageLogger.success("package check finished", elapsed());
+			task?.pass();
+		} else {
+			PackageLogger.error("package check finished with failures", elapsed());
+			task?.fail("package check finished with failures");
+		}
+		return passed;
+	} catch (error) {
+		PackageLogger.error(`package check failed: ${formatErrorMessage$1(error)}`, elapsed());
+		task?.fail("package check failed", { error });
+		throw error;
+	}
+}
+
+//#endregion
+//#region src/commands/paths.ts
+const defaultSourceExtensions = [
+	".ts",
+	".tsx",
+	".mts",
+	".cts",
+	".d.ts",
+	".d.mts",
+	".d.cts"
+];
+const defaultConditionPriority = [
+	"source",
+	"development",
+	"types",
+	"import",
+	"module",
+	"default",
+	"require"
+];
+const defaultArtifactDirectories = [
+	"dist",
+	"build",
+	"lib",
+	"esm",
+	"cjs",
+	"out"
+];
+function generatedFileName(config) {
+	return config.paths?.generatedFileName ?? "tsconfig.dts.paths.generated.json";
+}
+function generatedFileMarker(config) {
+	return config.paths?.generatedFileMarker ?? "GENERATED FILE - DO NOT EDIT BY HAND.";
+}
+function parseProject(config, configPath) {
+	const diagnostics = [];
+	const parsed = ts.getParsedCommandLineOfConfigFile(configPath, {}, {
+		...ts.sys,
+		onUnRecoverableConfigFileDiagnostic: (diagnostic) => {
+			diagnostics.push(diagnostic);
+		}
+	});
+	if (!parsed) throw new Error(ts.formatDiagnosticsWithColorAndContext(diagnostics, {
+		getCanonicalFileName: (fileName) => fileName,
+		getCurrentDirectory: () => config.rootDir,
+		getNewLine: () => "\n"
+	}));
+	if (parsed.errors.length > 0) throw new Error(ts.formatDiagnosticsWithColorAndContext(parsed.errors, {
+		getCanonicalFileName: (fileName) => fileName,
+		getCurrentDirectory: () => config.rootDir,
+		getNewLine: () => "\n"
+	}));
+	return {
+		configPath: normalizeAbsolutePath(configPath),
+		fileNames: parsed.fileNames.filter((fileName) => /\.(?:[cm]?tsx?|d\.[cm]?ts)$/u.test(fileName)).map(normalizeAbsolutePath),
+		options: parsed.options,
+		references: new Set(getRawReferencePaths(config, configPath))
+	};
+}
+function getSourceFileKind(filePath) {
+	if (filePath.endsWith(".tsx")) return ts.ScriptKind.TSX;
+	if (filePath.endsWith(".jsx")) return ts.ScriptKind.JSX;
+	return ts.ScriptKind.TS;
+}
+function stringLiteralValue(node) {
+	return node && ts.isStringLiteralLike(node) ? node.text : null;
+}
+function collectImportsFromFile(filePath) {
+	const sourceText = readFileSync(filePath, "utf8");
+	const sourceFile = ts.createSourceFile(filePath, sourceText, ts.ScriptTarget.Latest, true, getSourceFileKind(filePath));
+	const imports = [];
+	const addImport = (specifier, node) => {
+		const location = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
+		imports.push({
+			filePath,
+			line: location.line + 1,
+			specifier
+		});
+	};
+	const visit = (node) => {
+		if (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) {
+			const specifier = stringLiteralValue(node.moduleSpecifier);
+			if (specifier) addImport(specifier, node);
+		} else if (ts.isImportTypeNode(node)) {
+			const specifier = ts.isLiteralTypeNode(node.argument) ? stringLiteralValue(node.argument.literal) : null;
+			if (specifier) addImport(specifier, node);
+		} else if (ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.ImportKeyword) {
+			const specifier = stringLiteralValue(node.arguments[0]);
+			if (specifier) addImport(specifier, node);
+		}
+		ts.forEachChild(node, visit);
+	};
+	visit(sourceFile);
+	return imports;
+}
+function resolveInternalImport(specifier, containingFile, options) {
+	const resolved = ts.resolveModuleName(specifier, containingFile, options, ts.sys).resolvedModule;
+	return resolved?.resolvedFileName ? normalizeAbsolutePath(resolved.resolvedFileName) : null;
+}
+function resolveImportWithoutMatchingPaths(specifier, containingFile, options) {
+	if (!options.paths) return resolveInternalImport(specifier, containingFile, options);
+	const paths = Object.fromEntries(Object.entries(options.paths).filter(([alias]) => !aliasMatchesSpecifier(alias, specifier)));
+	return resolveInternalImport(specifier, containingFile, {
+		...options,
+		paths: Object.keys(paths).length > 0 ? paths : void 0
+	});
+}
+function createFileOwnerLookup(projects) {
+	const ownerLookup = /* @__PURE__ */ new Map();
+	for (const project of projects) for (const fileName of project.fileNames) {
+		const owners = ownerLookup.get(fileName) ?? [];
+		owners.push(project.configPath);
+		ownerLookup.set(fileName, owners);
+	}
+	return ownerLookup;
+}
+function projectExtendsGeneratedConfig(config, configPath) {
+	const extendsValue = readJsonConfig(config, configPath).extends;
+	return (typeof extendsValue === "string" ? [extendsValue] : Array.isArray(extendsValue) ? extendsValue : []).some((entry) => typeof entry === "string" && path.basename(entry) === generatedFileName(config));
+}
+function findImporterForFile(filePath, importers) {
+	return importers.find((importer) => isPathInsideDirectory(filePath, importer.directory)) ?? null;
+}
+function shouldResolveThroughGraph(importer, targetPackage) {
+	if (!importer || !targetPackage) return false;
+	return importer.name === targetPackage.name || importer.workspaceDependencies.has(targetPackage.name);
+}
+function inferPackageProject(resolvedFilePath, workspacePackage, projectPaths) {
+	if (!isPathInsideDirectory(resolvedFilePath, workspacePackage.directory)) return null;
+	return projectPaths.find((projectPath) => {
+		return projectPath.startsWith(`${workspacePackage.directory}/`) && projectPath.endsWith("/tsconfig.lib.dts.json");
+	}) ?? null;
+}
+function collectTargetCandidates(config, value) {
+	if (typeof value === "string") return [value];
+	if (!value || typeof value !== "object" || Array.isArray(value)) return [];
+	const record = value;
+	const candidates = [];
+	const visitedKeys = /* @__PURE__ */ new Set();
+	for (const key of config.paths?.conditionPriority ?? defaultConditionPriority) {
+		if (!(key in record)) continue;
+		visitedKeys.add(key);
+		candidates.push(...collectTargetCandidates(config, record[key]));
+	}
+	for (const key of Object.keys(record).sort()) {
+		if (visitedKeys.has(key)) continue;
+		candidates.push(...collectTargetCandidates(config, record[key]));
+	}
+	return candidates;
+}
+function normalizePackageTarget(target) {
+	if (!target.startsWith("./")) return null;
+	return target.slice(2);
+}
+function packageExportKeyToAlias(packageName, exportKey) {
+	if (exportKey === ".") return packageName;
+	if (!exportKey.startsWith("./")) return "";
+	return `${packageName}/${exportKey.slice(2)}`;
+}
+function removeKnownExtension(filePath) {
+	for (const extension of [
+		".d.mts",
+		".d.cts",
+		".d.ts",
+		".mts",
+		".cts",
+		".mjs",
+		".cjs",
+		".js",
+		".tsx",
+		".ts"
+	]) if (filePath.endsWith(extension)) return filePath.slice(0, -extension.length);
+	return filePath;
+}
+function configuredArtifactDirectories(config) {
+	return config.paths?.artifactDirectories ?? defaultArtifactDirectories;
+}
+function configuredSourceExtensions(config) {
+	return config.paths?.sourceExtensions ?? defaultSourceExtensions;
+}
+function hasConfiguredSourceExtension(config, target) {
+	return configuredSourceExtensions(config).some((extension) => target.endsWith(extension));
+}
+function isInsideArtifactDirectory(config, target) {
+	const normalizedTarget = normalizeSlashes(target);
+	return configuredArtifactDirectories(config).some((directoryName) => {
+		const normalizedDirectoryName = normalizeSlashes(directoryName).replace(/\/+$/u, "");
+		return normalizedTarget === normalizedDirectoryName || normalizedTarget.startsWith(`${normalizedDirectoryName}/`);
+	});
+}
+function isLikelySourceTarget(config, target) {
+	return hasConfiguredSourceExtension(config, target) && !isInsideArtifactDirectory(config, target);
+}
+function stripArtifactPrefix(config, target) {
+	const normalizedTarget = normalizeSlashes(target);
+	for (const directoryName of configuredArtifactDirectories(config)) {
+		const normalizedDirectoryName = normalizeSlashes(directoryName).replace(/\/+$/u, "");
+		if (normalizedTarget.startsWith(`${normalizedDirectoryName}/`)) return normalizedTarget.slice(normalizedDirectoryName.length + 1);
+	}
+	return normalizedTarget;
+}
+function sourceFileCandidates(config, target) {
+	const normalizedTarget = normalizeSlashes(target);
+	const withoutKnownExtension = removeKnownExtension(normalizedTarget);
+	const withoutArtifactPrefix = stripArtifactPrefix(config, normalizedTarget);
+	const sourceBase = removeKnownExtension(withoutArtifactPrefix);
+	const bases = withoutArtifactPrefix === normalizedTarget ? [
+		withoutKnownExtension,
+		sourceBase,
+		`src/${sourceBase}`,
+		`${sourceBase}/index`,
+		`src/${sourceBase}/index`
+	] : [
+		sourceBase,
+		`src/${sourceBase}`,
+		`${sourceBase}/index`,
+		`src/${sourceBase}/index`
+	];
+	const candidates = [];
+	for (const base of bases) for (const extension of configuredSourceExtensions(config)) candidates.push(`${base}${extension}`);
+	return [...new Set(candidates)];
+}
+function wildcardBaseDirectory(pattern) {
+	const wildcardIndex = pattern.indexOf("*");
+	const prefix = wildcardIndex === -1 ? pattern : pattern.slice(0, wildcardIndex);
+	const lastSlashIndex = prefix.lastIndexOf("/");
+	return lastSlashIndex === -1 ? "." : prefix.slice(0, lastSlashIndex);
+}
+function sourceWildcardPatternCandidates(config, target) {
+	const strippedPattern = stripArtifactPrefix(config, target);
+	const sourcePattern = removeKnownExtension(strippedPattern);
+	const preferSrcPrefix = strippedPattern !== normalizeSlashes(target);
+	const candidates = [];
+	for (const extension of configuredSourceExtensions(config)) if (preferSrcPrefix) {
+		candidates.push(`src/${sourcePattern}${extension}`);
+		candidates.push(`${sourcePattern}${extension}`);
+	} else {
+		candidates.push(`${sourcePattern}${extension}`);
+		candidates.push(`src/${sourcePattern}${extension}`);
+	}
+	return [...new Set(candidates)];
+}
+function resolveWildcardTarget(config, packageDirectory, target) {
+	const sourcePatterns = sourceWildcardPatternCandidates(config, target);
+	const candidatePatterns = isLikelySourceTarget(config, target) ? [target, ...sourcePatterns] : sourcePatterns;
+	for (const candidatePattern of candidatePatterns) {
+		const baseDirectory = wildcardBaseDirectory(candidatePattern);
+		if (existsSync(path.join(packageDirectory, baseDirectory))) return toPosixPath(path.join(toRelativePath(config.rootDir, packageDirectory), candidatePattern));
+	}
+	return null;
+}
+function resolveExactTarget(config, packageDirectory, target) {
+	const absoluteTarget = path.join(packageDirectory, target);
+	if (existsSync(absoluteTarget) && isLikelySourceTarget(config, target)) return normalizeWorkspacePath(config.rootDir, absoluteTarget);
+	for (const candidate of sourceFileCandidates(config, target)) {
+		const absoluteCandidate = path.join(packageDirectory, candidate);
+		if (existsSync(absoluteCandidate)) return normalizeWorkspacePath(config.rootDir, absoluteCandidate);
+	}
+	return null;
+}
+function resolvePackageTarget(config, packageDirectory, rawTarget) {
+	const target = normalizePackageTarget(rawTarget);
+	if (!target) return null;
+	if (target.includes("*")) return resolveWildcardTarget(config, packageDirectory, target);
+	return resolveExactTarget(config, packageDirectory, target);
+}
+function collectExportEntries(config, workspacePackage) {
+	const exportsField = workspacePackage.manifest.exports;
+	if (!exportsField) return [];
+	const exportEntries = typeof exportsField === "object" && exportsField !== null && !Array.isArray(exportsField) && Object.keys(exportsField).some((key) => key.startsWith(".")) ? Object.entries(exportsField) : [[".", exportsField]];
+	const entries = [];
+	for (const [exportKey, exportValue] of exportEntries.sort(([left], [right]) => left.localeCompare(right))) {
+		const alias = packageExportKeyToAlias(workspacePackage.name, exportKey);
+		if (!alias) continue;
+		for (const candidate of collectTargetCandidates(config, exportValue)) {
+			const resolvedTarget = resolvePackageTarget(config, workspacePackage.directory, candidate);
+			if (resolvedTarget) {
+				entries.push([alias, resolvedTarget]);
+				break;
+			}
+		}
+	}
+	return entries;
+}
+function aliasMatchesSpecifier(alias, specifier) {
+	if (alias === specifier) return true;
+	const wildcardIndex = alias.indexOf("*");
+	if (wildcardIndex === -1) return false;
+	const prefix = alias.slice(0, wildcardIndex);
+	const suffix = alias.slice(wildcardIndex + 1);
+	return specifier.startsWith(prefix) && specifier.endsWith(suffix);
+}
+function addPathEntry(paths, alias, target) {
+	const targets = paths.get(alias) ?? [];
+	if (!targets.includes(target)) targets.push(target);
+	paths.set(alias, targets);
+}
+function compareAliases(left, right) {
+	const leftGroup = left.startsWith("@") ? 1 : 0;
+	const rightGroup = right.startsWith("@") ? 1 : 0;
+	if (leftGroup !== rightGroup) return leftGroup - rightGroup;
+	if ((left.startsWith("@") ? left.split("/").slice(0, 2).join("/") : left.split("/")[0] ?? left) === (right.startsWith("@") ? right.split("/").slice(0, 2).join("/") : right.split("/")[0] ?? right)) {
+		const leftPrefixLength = left.split("*")[0]?.length ?? left.length;
+		const rightPrefixLength = right.split("*")[0]?.length ?? right.length;
+		if (leftPrefixLength !== rightPrefixLength) return rightPrefixLength - leftPrefixLength;
+	}
+	return left.localeCompare(right);
+}
+function toTsconfigPathTarget(config, outputDirectory, target) {
+	const relativeTarget = toPosixPath(path.relative(outputDirectory, toAbsolutePath(config.rootDir, target)));
+	if (relativeTarget.startsWith("./") || relativeTarget.startsWith("../")) return relativeTarget;
+	return `./${relativeTarget}`;
+}
+function formatPaths(config, paths, outputDirectory) {
+	const lines = [];
+	const entries = [...paths.entries()].sort(([left], [right]) => compareAliases(left, right));
+	for (const [alias, targets] of entries) {
+		const pathTargets = targets.map((target) => toTsconfigPathTarget(config, outputDirectory, target));
+		if (pathTargets.length === 1 && `${JSON.stringify(alias)}: [${JSON.stringify(pathTargets[0])}],`.length < 80) {
+			lines.push(`      ${JSON.stringify(alias)}: [${JSON.stringify(pathTargets[0])}],`);
+			continue;
+		}
+		lines.push(`      ${JSON.stringify(alias)}: [`);
+		for (const target of pathTargets) lines.push(`        ${JSON.stringify(target)},`);
+		lines.push("      ],");
+	}
+	return lines.join("\n");
+}
+function formatGeneratedConfig(config, paths, outputPath) {
+	const outputDirectory = path.dirname(outputPath);
+	return `{
+  "$schema": "https://json.schemastore.org/tsconfig",
+  /**
+   * ${generatedFileMarker(config)}
+   *
+   * Compatibility paths for workspace:* source dependencies whose package
+   * exports resolve to build artifacts. Run \`limina paths generate\` to
+   * refresh this file, then manually extend it from the relevant
+   * tsconfig*.dts.json files.
+   */
+  "compilerOptions": {
+    "paths": {
+${formatPaths(config, paths, outputDirectory)}
+    }
+  }
+}
+`;
+}
+function getDraft(drafts, outputPath) {
+	const existing = drafts.get(outputPath);
+	if (existing) return existing;
+	const created = {
+		configPaths: /* @__PURE__ */ new Set(),
+		paths: /* @__PURE__ */ new Map()
+	};
+	drafts.set(outputPath, created);
+	return created;
+}
+function createGeneratedConfigs(config, drafts) {
+	return [...drafts.entries()].map(([outputPath, draft]) => ({
+		aliasCount: draft.paths.size,
+		configPaths: [...draft.configPaths].sort((left, right) => left.localeCompare(right)),
+		content: formatGeneratedConfig(config, draft.paths, outputPath),
+		outputPath
+	})).filter((generatedConfig) => generatedConfig.aliasCount > 0).sort((left, right) => left.outputPath.localeCompare(right.outputPath));
+}
+async function collectGeneratedConfigs(config) {
+	const graphRoute = collectGraphProjectRoute(config);
+	const projectPaths = graphRoute.projectPaths;
+	if (graphRoute.problems.length > 0) throw new Error(graphRoute.problems.join("\n\n"));
+	const projects = projectPaths.map((projectPath) => parseProject(config, projectPath));
+	const fileOwnerLookup = createFileOwnerLookup(projects);
+	const packages = await collectWorkspacePackages(config);
+	const importers = collectImporters(config, packages);
+	const exportEntriesByPackage = /* @__PURE__ */ new Map();
+	const drafts = /* @__PURE__ */ new Map();
+	for (const project of projects) {
+		const keepsGeneratedPaths = projectExtendsGeneratedConfig(config, project.configPath);
+		for (const filePath of project.fileNames) for (const importRecord of collectImportsFromFile(filePath)) {
+			const targetPackage = findPackageForSpecifier(importRecord.specifier, packages);
+			const importer = targetPackage ? findImporterForFile(importRecord.filePath, importers) : null;
+			if (!targetPackage || !shouldResolveThroughGraph(importer, targetPackage)) continue;
+			const resolvedFilePath = resolveInternalImport(importRecord.specifier, filePath, project.options);
+			if (!resolvedFilePath) continue;
+			const artifactResolvedFilePath = fileOwnerLookup.has(resolvedFilePath) && keepsGeneratedPaths ? resolveImportWithoutMatchingPaths(importRecord.specifier, filePath, project.options) : resolvedFilePath;
+			if (!artifactResolvedFilePath || fileOwnerLookup.has(artifactResolvedFilePath)) continue;
+			const targetProjectPath = inferPackageProject(artifactResolvedFilePath, targetPackage, projectPaths);
+			if (!targetProjectPath || !project.references.has(targetProjectPath)) continue;
+			const exportEntries = exportEntriesByPackage.get(targetPackage.name) ?? collectExportEntries(config, targetPackage);
+			exportEntriesByPackage.set(targetPackage.name, exportEntries);
+			if (!exportEntries.some(([alias]) => aliasMatchesSpecifier(alias, importRecord.specifier))) continue;
+			const draft = getDraft(drafts, path.join(path.dirname(project.configPath), generatedFileName(config)));
+			draft.configPaths.add(project.configPath);
+			for (const [alias, target] of exportEntries) addPathEntry(draft.paths, alias, target);
+		}
+	}
+	return createGeneratedConfigs(config, drafts);
+}
+async function isGeneratedTsconfigPathsFile(config, filePath) {
+	try {
+		return (await readFile(filePath, "utf8")).includes(generatedFileMarker(config));
+	} catch {
+		return false;
+	}
+}
+async function collectExistingGeneratedConfigPaths(config) {
+	return (await glob(`**/${generatedFileName(config)}`, {
+		cwd: config.rootDir,
+		absolute: true,
+		ignore: ["**/node_modules/**", "**/dist/**"]
+	})).map((filePath) => path.resolve(filePath)).sort();
+}
+async function writeGeneratedConfigs(config, generatedConfigs) {
+	let didChange = false;
+	const expectedOutputPaths = new Set(generatedConfigs.map((generatedConfig) => path.resolve(generatedConfig.outputPath)));
+	for (const existingFile of await collectExistingGeneratedConfigPaths(config)) {
+		if (expectedOutputPaths.has(existingFile)) continue;
+		if (await isGeneratedTsconfigPathsFile(config, existingFile)) {
+			await rm(existingFile);
+			didChange = true;
+		}
+	}
+	for (const generatedConfig of generatedConfigs) {
+		if ((existsSync(generatedConfig.outputPath) ? await readFile(generatedConfig.outputPath, "utf8") : null) === generatedConfig.content) continue;
+		await mkdir(path.dirname(generatedConfig.outputPath), { recursive: true });
+		await writeFile(generatedConfig.outputPath, generatedConfig.content);
+		didChange = true;
+	}
+	return didChange;
+}
+async function checkGeneratedConfigs(config, generatedConfigs) {
+	const expectedOutputPaths = new Set(generatedConfigs.map((generatedConfig) => path.resolve(generatedConfig.outputPath)));
+	for (const existingFile of await collectExistingGeneratedConfigPaths(config)) {
+		if (expectedOutputPaths.has(existingFile)) continue;
+		if (await isGeneratedTsconfigPathsFile(config, existingFile)) return true;
+	}
+	for (const generatedConfig of generatedConfigs) if ((existsSync(generatedConfig.outputPath) ? await readFile(generatedConfig.outputPath, "utf8") : null) !== generatedConfig.content) return true;
+	return false;
+}
+function toTsconfigExtendsPath(configPath, targetPath) {
+	const relativeTarget = toPosixPath(path.relative(path.dirname(configPath), targetPath));
+	if (relativeTarget.startsWith("./") || relativeTarget.startsWith("../")) return relativeTarget;
+	return `./${relativeTarget}`;
+}
+function logManualExtendsSuggestions(config, generatedConfigs) {
+	if (generatedConfigs.reduce((total, generatedConfig) => total + generatedConfig.configPaths.length, 0) === 0) {
+		PathsLogger.info("No workspace:* artifact-export compatibility paths are needed.");
+		return;
+	}
+	PathsLogger.info("Generated path configs are not injected automatically. Add them manually to the first position of each listed extends array:");
+	for (const generatedConfig of generatedConfigs) {
+		PathsLogger.info(`  ${toRelativePath(config.rootDir, generatedConfig.outputPath)} (${generatedConfig.aliasCount} aliases)`);
+		for (const configPath of generatedConfig.configPaths) PathsLogger.info(`    - ${toRelativePath(config.rootDir, configPath)} extends ${toTsconfigExtendsPath(configPath, generatedConfig.outputPath)}`);
+	}
+}
+async function runPathsInternal(config, options = {}) {
+	const generatedConfigs = await collectGeneratedConfigs(config);
+	const didChange = options.check ? await checkGeneratedConfigs(config, generatedConfigs) : await writeGeneratedConfigs(config, generatedConfigs);
+	const aliasCount = generatedConfigs.reduce((total, generatedConfig) => total + generatedConfig.aliasCount, 0);
+	const suggestionCount = generatedConfigs.reduce((total, generatedConfig) => total + generatedConfig.configPaths.length, 0);
+	const action = options.check ? didChange ? "Would update" : "Checked unchanged" : didChange ? "Generated" : "Skipped unchanged";
+	PathsLogger.info(`${action} ${generatedConfigs.length} TypeScript graph path config files with ${aliasCount} path aliases.`);
+	logManualExtendsSuggestions(config, generatedConfigs);
+	if (options.check && didChange) PathsLogger.error("TypeScript graph path state is stale; run `limina paths generate`, then manually extend the listed tsconfig*.dts.json files.");
+	return {
+		aliasCount,
+		changed: didChange,
+		outputCount: generatedConfigs.length,
+		suggestionCount
+	};
+}
+async function runPaths(config, options = {}) {
+	if (options.clearScreen ?? true) clearCliScreen();
+	const elapsed = createElapsedTimer();
+	const action = options.check ? "paths check" : "paths generate";
+	const task = options.flow?.start(action, { depth: options.flowDepth ?? 0 });
+	PathsLogger.info(`${action} started`);
+	try {
+		const result = await runPathsInternal(config, options);
+		if (options.check && result.changed) {
+			PathsLogger.error(`${action} finished with stale files`, elapsed());
+			task?.fail(`${action} finished with stale files`);
+		} else {
+			if (!options.flow?.interactive) PathsLogger.success(`${action} finished`, elapsed());
+			task?.pass();
+		}
+		return result;
+	} catch (error) {
+		PathsLogger.error(`${action} failed: ${formatErrorMessage$1(error)}`, elapsed());
+		task?.fail(`${action} failed`, { error });
+		throw error;
+	}
+}
+
+//#endregion
+//#region src/commands/proof.ts
+const dtsConfigPattern = "**/tsconfig*.dts.json";
+const buildGraphConfigPattern = "**/tsconfig*.build.json";
+const tsconfigJsonPattern = "**/tsconfig.json";
+const tsconfigFilePattern = "**/tsconfig*.json";
+const defaultSourceExclude = [
+	"node_modules",
+	"dist",
+	".git",
+	".tsbuild",
+	"coverage",
+	"**/tsconfig*.json",
+	"**/package.json",
+	".prettierrc.json",
+	".markdownlint.json",
+	"vercel.json"
+];
+const ignoredSemanticCompilerOptions = new Set([
+	"baseUrl",
+	"build",
+	"composite",
+	"configFilePath",
+	"declaration",
+	"declarationDir",
+	"declarationMap",
+	"emitBOM",
+	"emitDeclarationOnly",
+	"incremental",
+	"inlineSourceMap",
+	"inlineSources",
+	"mapRoot",
+	"newLine",
+	"noEmit",
+	"noEmitOnError",
+	"out",
+	"outDir",
+	"outFile",
+	"paths",
+	"pathsBasePath",
+	"preserveConstEnums",
+	"project",
+	"removeComments",
+	"rootDir",
+	"showConfig",
+	"sourceMap",
+	"sourceRoot",
+	"tsBuildInfoFile"
+]);
+async function collectTsconfigPaths(config, pattern) {
+	return (await glob(pattern, {
+		cwd: config.rootDir,
+		absolute: true,
+		ignore: [
+			"**/.git/**",
+			"**/.tsbuild/**",
+			"**/coverage/**",
+			"**/dist/**",
+			"**/node_modules/**"
+		]
+	})).map(normalizeAbsolutePath).sort();
+}
+async function collectDtsConfigPaths(config) {
+	return collectTsconfigPaths(config, dtsConfigPattern);
+}
+async function collectBuildGraphConfigPaths(config) {
+	return collectTsconfigPaths(config, buildGraphConfigPattern);
+}
+async function collectDefaultTsconfigPaths(config) {
+	return collectTsconfigPaths(config, tsconfigJsonPattern);
+}
+async function collectOrdinaryTypecheckConfigPaths(config) {
+	return (await collectTsconfigPaths(config, tsconfigFilePattern)).filter(isOrdinaryTypecheckConfigPath);
+}
+function isPlainRecord(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function formatUnknownValue(value) {
+	if (value === void 0) return "undefined";
+	return JSON.stringify(value);
+}
+function hasGlobSyntax(pattern) {
+	return /[*?[\]{}()!+@]/u.test(pattern);
+}
+function isDirectoryShorthand(pattern) {
+	return !hasGlobSyntax(pattern) && !pattern.includes("/") && !path.extname(pattern);
+}
+function normalizeSourceExcludePattern(pattern) {
+	const normalized = pattern.replaceAll("\\", "/").replace(/\/+$/u, "");
+	if (!normalized) return [];
+	if (isDirectoryShorthand(normalized)) return [`${normalized}/**`, `**/${normalized}/**`];
+	if (hasGlobSyntax(normalized)) return [normalized];
+	if (normalized.includes("/")) return [normalized, `${normalized}/**`];
+	return [normalized, `**/${normalized}`];
+}
+function sourceIncludePatterns(config) {
+	if (config.config?.source?.include) return config.config.source.include;
+	return getActiveCheckerExtensions(config).map((extension) => `**/*${extension}`);
+}
+function sourceExcludePatterns(config) {
+	return (config.config?.source?.exclude ?? defaultSourceExclude).flatMap(normalizeSourceExcludePattern);
+}
+async function collectExpectedSourceFiles(config) {
+	const proofFilePattern = config.config?.source?.include !== void 0 ? null : createExtensionPattern(getActiveCheckerExtensions(config));
+	const files = await glob(sourceIncludePatterns(config), {
+		cwd: config.rootDir,
+		absolute: true,
+		ignore: sourceExcludePatterns(config),
+		onlyFiles: true
+	});
+	return new Set(files.map(normalizeAbsolutePath).filter((filePath) => proofFilePattern?.test(filePath) ?? true).sort());
+}
+function collectCheckerCoverageTargets(config) {
+	const problems = [];
+	const targets = [];
+	for (const checker of getActiveCheckers(config)) {
+		const configPath = resolveProjectConfigPath(config.rootDir, checker.entry);
+		if (!existsSync(configPath)) {
+			problems.push([
+				"Checker proof entry references a missing tsconfig:",
+				`  checker: ${checker.name}`,
+				`  config: ${toRelativePath(config.rootDir, configPath)}`
+			].join("\n"));
+			continue;
+		}
+		const routeCollection = collectGraphProjectRouteFromRoot({
+			rootConfigPath: configPath,
+			rootDir: config.rootDir
+		});
+		problems.push(...routeCollection.problems);
+		targets.push({
+			checker,
+			configPath,
+			coverageConfigPaths: routeCollection.projectPaths,
+			label: `${checker.name}:entry`
+		});
+	}
+	return {
+		problems,
+		targets
+	};
+}
+function collectConfiguredAllowlistEntries(config) {
+	const entries = [];
+	const problems = [];
+	const rawEntries = config.proof?.allowlist;
+	if (rawEntries === void 0) return {
+		entries,
+		problems
+	};
+	if (!Array.isArray(rawEntries)) {
+		problems.push([
+			"Invalid proof allowlist config:",
+			"  field: proof.allowlist",
+			`  value: ${formatUnknownValue(rawEntries)}`,
+			"  reason: proof.allowlist must be an array."
+		].join("\n"));
+		return {
+			entries,
+			problems
+		};
+	}
+	rawEntries.forEach((entry, index) => {
+		const field = `proof.allowlist[${index}]`;
+		if (!isPlainRecord(entry)) {
+			problems.push([
+				"Invalid proof allowlist config:",
+				`  field: ${field}`,
+				`  value: ${formatUnknownValue(entry)}`,
+				"  reason: allowlist entries must be objects with non-empty file and reason fields."
+			].join("\n"));
+			return;
+		}
+		const fileValue = entry.file;
+		const reasonValue = entry.reason;
+		if (typeof fileValue !== "string" || fileValue.trim().length === 0) {
+			problems.push([
+				"Invalid proof allowlist config:",
+				`  field: ${field}.file`,
+				`  value: ${formatUnknownValue(fileValue)}`,
+				"  reason: allowlist file must be a non-empty string."
+			].join("\n"));
+			return;
+		}
+		if (typeof reasonValue !== "string" || reasonValue.trim().length === 0) {
+			problems.push([
+				"Invalid proof allowlist config:",
+				`  field: ${field}.reason`,
+				`  value: ${formatUnknownValue(reasonValue)}`,
+				"  reason: allowlist reason must be a non-empty string."
+			].join("\n"));
+			return;
+		}
+		entries.push({
+			filePath: normalizeAbsolutePath(path.join(config.rootDir, fileValue)),
+			reason: reasonValue.trim()
+		});
+	});
+	return {
+		entries,
+		problems
+	};
+}
+function addCoverage(coverageByFile, filePath, source) {
+	const sources = coverageByFile.get(filePath) ?? [];
+	sources.push(source);
+	coverageByFile.set(filePath, sources);
+}
+function collectCoverage(options) {
+	const coverageByFile = /* @__PURE__ */ new Map();
+	const proofFilePattern = createExtensionPattern(getActiveCheckerExtensions(options.config));
+	const typeScriptChecker = getActiveCheckers(options.config).find((checker) => checker.preset === "tsc");
+	for (const graphProjectPath of options.graphProjectPaths) for (const filePath of parseProjectFileNames(options.config, graphProjectPath, proofFilePattern)) {
+		if (!options.sourceFiles.has(filePath)) continue;
+		addCoverage(coverageByFile, filePath, {
+			label: toRelativePath(options.config.rootDir, graphProjectPath),
+			type: "graph"
+		});
+	}
+	for (const checkerTarget of options.checkerTargets) {
+		const checkerExtensions = [...typeScriptChecker?.extensions ?? [], ...checkerTarget.checker.extensions];
+		for (const configPath of checkerTarget.coverageConfigPaths) for (const filePath of parseProjectFileNamesForExtensions(options.config, configPath, checkerExtensions)) {
+			if (!options.sourceFiles.has(filePath)) continue;
+			addCoverage(coverageByFile, filePath, {
+				label: `${toRelativePath(options.config.rootDir, configPath)} via ${checkerTarget.label}`,
+				type: "checker"
+			});
+		}
+	}
+	if (options.includeAllowlist !== false) for (const entry of options.allowlistEntries) {
+		if (!options.sourceFiles.has(entry.filePath)) continue;
+		addCoverage(coverageByFile, entry.filePath, {
+			label: entry.reason,
+			type: "allowlist"
+		});
+	}
+	return coverageByFile;
+}
+function parseConfig(config, configPath) {
+	const diagnostics = [];
+	const parsed = ts.getParsedCommandLineOfConfigFile(configPath, {}, {
+		...ts.sys,
+		onUnRecoverableConfigFileDiagnostic: (diagnostic) => {
+			diagnostics.push(diagnostic);
+		}
+	});
+	if (!parsed) throw new Error(ts.formatDiagnosticsWithColorAndContext(diagnostics, createFormatHost(config.rootDir)));
+	if (parsed.errors.length > 0) throw new Error(ts.formatDiagnosticsWithColorAndContext(parsed.errors, createFormatHost(config.rootDir)));
+	return {
+		fileNames: parsed.fileNames.map(normalizeAbsolutePath).sort(),
+		options: parsed.options
+	};
+}
+function formatJsonValue(value) {
+	return JSON.stringify(value ?? null);
+}
+function normalizeCompilerOptionValue(value) {
+	if (Array.isArray(value)) return value;
+	if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)));
+	return value;
+}
+function addDtsConfigSemanticProblems(options) {
+	const dtsFileNames = new Set(options.dtsConfig.fileNames);
+	const localFileNames = new Set(options.localConfig.fileNames);
+	const onlyInDts = options.dtsConfig.fileNames.filter((fileName) => !localFileNames.has(fileName));
+	const onlyInLocal = options.localConfig.fileNames.filter((fileName) => !dtsFileNames.has(fileName));
+	if (onlyInDts.length > 0 || onlyInLocal.length > 0) options.problems.push([
+		"DTS config file set does not match its strict local tsconfig:",
+		`  config: ${toRelativePath(options.config.rootDir, options.dtsConfigPath)}`,
+		`  local: ${toRelativePath(options.config.rootDir, options.localConfigPath)}`,
+		...onlyInDts.length > 0 ? [
+			"  only in dts config:",
+			...onlyInDts.slice(0, 10).map((fileName) => `    - ${toRelativePath(options.config.rootDir, fileName)}`),
+			onlyInDts.length > 10 ? `    ... ${onlyInDts.length - 10} more` : ""
+		] : [],
+		...onlyInLocal.length > 0 ? [
+			"  only in local config:",
+			...onlyInLocal.slice(0, 10).map((fileName) => `    - ${toRelativePath(options.config.rootDir, fileName)}`),
+			onlyInLocal.length > 10 ? `    ... ${onlyInLocal.length - 10} more` : ""
+		] : []
+	].filter(Boolean).join("\n"));
+	const optionNames = new Set([...Object.keys(options.localConfig.options), ...Object.keys(options.dtsConfig.options)]);
+	for (const optionName of [...optionNames].sort()) {
+		if (ignoredSemanticCompilerOptions.has(optionName)) continue;
+		const localValue = normalizeCompilerOptionValue(options.localConfig.options[optionName]);
+		const dtsValue = normalizeCompilerOptionValue(options.dtsConfig.options[optionName]);
+		if (formatJsonValue(localValue) === formatJsonValue(dtsValue)) continue;
+		options.problems.push([
+			"DTS config overrides a typecheck compiler option from its strict local tsconfig:",
+			`  config: ${toRelativePath(options.config.rootDir, options.dtsConfigPath)}`,
+			`  local: ${toRelativePath(options.config.rootDir, options.localConfigPath)}`,
+			`  option: compilerOptions.${optionName}`,
+			`  local: ${formatJsonValue(localValue)}`,
+			`  dts: ${formatJsonValue(dtsValue)}`
+		].join("\n"));
+	}
+}
+function addDtsConfigProblems(options) {
+	for (const configPath of options.dtsConfigPaths) {
+		if (!options.graphProjectPaths.has(configPath)) options.problems.push(["DTS config is not reachable from any checker entry:", `  config: ${toRelativePath(options.config.rootDir, configPath)}`].join("\n"));
+		const localConfigPath = getDtsCompanionConfigPath(configPath);
+		if (!existsSync(localConfigPath)) {
+			options.problems.push([
+				"DTS config is missing its strict local tsconfig:",
+				`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
+				`  expected: ${toRelativePath(options.config.rootDir, localConfigPath)}`
+			].join("\n"));
+			continue;
+		}
+		const dtsConfig = parseConfig(options.config, configPath);
+		const localConfig = parseConfig(options.config, localConfigPath);
+		if (dtsConfig.options.composite !== true) options.problems.push([
+			"DTS config is not valid for tsc -b:",
+			`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
+			"  reason: final compilerOptions.composite must be true."
+		].join("\n"));
+		if (dtsConfig.options.noEmit === true) options.problems.push([
+			"DTS config is not valid for tsc -b:",
+			`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
+			"  reason: final compilerOptions.noEmit must not be true."
+		].join("\n"));
+		if (dtsConfig.options.declaration !== true) options.problems.push([
+			"DTS config is not valid for declaration emit:",
+			`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
+			"  reason: final compilerOptions.declaration must be true."
+		].join("\n"));
+		if (dtsConfig.options.emitDeclarationOnly !== true) options.problems.push([
+			"DTS config is not valid for declaration emit:",
+			`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
+			"  reason: final compilerOptions.emitDeclarationOnly must be true."
+		].join("\n"));
+		addDtsConfigSemanticProblems({
+			config: options.config,
+			dtsConfig,
+			dtsConfigPath: configPath,
+			localConfig,
+			localConfigPath,
+			problems: options.problems
+		});
+	}
+}
+function isEmptyArray(value) {
+	return Array.isArray(value) && value.length === 0;
+}
+function formatConfigRole(role) {
+	return role === "build graph" ? "Build graph config" : "Default tsconfig.json";
+}
+function addPureAggregatorProblems(options) {
+	const roleLabel = formatConfigRole(options.role);
+	const allowedKeys = new Set([
+		"$schema",
+		"files",
+		"references"
+	]);
+	const extraKeys = Object.keys(options.configObject).filter((key) => !allowedKeys.has(key));
+	if (!Object.hasOwn(options.configObject, "files")) options.problems.push([
+		`${roleLabel} is not a pure aggregator:`,
+		`  config: ${toRelativePath(options.config.rootDir, options.configPath)}`,
+		"  field: files",
+		"  reason: configs with project references must declare files: []."
+	].join("\n"));
+	else if (!isEmptyArray(options.configObject.files)) options.problems.push([
+		`${roleLabel} is not a pure aggregator:`,
+		`  config: ${toRelativePath(options.config.rootDir, options.configPath)}`,
+		"  field: files",
+		`  value: ${formatUnknownValue(options.configObject.files)}`,
+		"  reason: configs with project references must declare files: []."
+	].join("\n"));
+	if (extraKeys.length > 0) options.problems.push([
+		`${roleLabel} is not a pure aggregator:`,
+		`  config: ${toRelativePath(options.config.rootDir, options.configPath)}`,
+		`  fields: ${extraKeys.sort().join(", ")}`,
+		"  reason: pure aggregators may only declare $schema, files, and references; move source inputs and compiler options into leaf configs."
+	].join("\n"));
+}
+function addBuildGraphConfigProblems(options) {
+	for (const configPath of options.buildGraphConfigPaths) {
+		const configObject = readJsonConfig(options.config, configPath);
+		addPureAggregatorProblems({
+			config: options.config,
+			configObject,
+			configPath,
+			problems: options.problems,
+			role: "build graph"
+		});
+	}
+}
+function addDefaultTsconfigShapeProblems(options) {
+	for (const configPath of options.tsconfigPaths) {
+		const configObject = readJsonConfig(options.config, configPath);
+		if (!Object.hasOwn(configObject, "references")) continue;
+		addPureAggregatorProblems({
+			config: options.config,
+			configObject,
+			configPath,
+			problems: options.problems,
+			role: "tsconfig.json"
+		});
+		if (!Array.isArray(configObject.references)) continue;
+		configObject.references.forEach((reference, index) => {
+			if (!isPlainRecord(reference) || typeof reference.path !== "string") return;
+			const referencePath = resolveReferencePath(configPath, reference.path);
+			if (isOrdinaryTypecheckConfigPath(referencePath)) return;
+			options.problems.push([
+				"Default tsconfig.json references a non-typecheck config:",
+				`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
+				`  field: references[${index}].path`,
+				`  reference: ${reference.path}`,
+				`  resolved: ${toRelativePath(options.config.rootDir, referencePath)}`,
+				"  reason: tsconfig.json is the default IDE/typecheck entry and must not reference declaration build graph configs."
+			].join("\n"));
+		});
+	}
+}
+function addDefaultTsconfigEnvironmentProblems(options) {
+	const configsByDirectory = /* @__PURE__ */ new Map();
+	for (const configPath of options.ordinaryConfigPaths) {
+		const directory = path.dirname(configPath);
+		const configs = configsByDirectory.get(directory) ?? [];
+		configs.push(configPath);
+		configsByDirectory.set(directory, configs);
+	}
+	for (const [directory, configPaths] of configsByDirectory.entries()) {
+		const scopedConfigPaths = configPaths.filter((configPath) => path.basename(configPath) !== "tsconfig.json");
+		if (scopedConfigPaths.length === 0) continue;
+		const defaultConfigPath = normalizeAbsolutePath(path.join(directory, "tsconfig.json"));
+		if (!existsSync(defaultConfigPath)) {
+			options.problems.push([
+				"Directory with typecheck environments is missing default tsconfig.json:",
+				`  directory: ${toRelativePath(options.config.rootDir, directory)}`,
+				"  reason: tsconfig.json is the default IDE/typecheck entry for its directory."
+			].join("\n"));
+			continue;
+		}
+		if (scopedConfigPaths.length === 1) {
+			options.problems.push([
+				"Single typecheck environment should use default tsconfig.json:",
+				`  config: ${toRelativePath(options.config.rootDir, scopedConfigPaths[0])}`,
+				`  default: ${toRelativePath(options.config.rootDir, defaultConfigPath)}`,
+				"  reason: directories with only one type environment should make tsconfig.json the leaf entry."
+			].join("\n"));
+			continue;
+		}
+		const defaultConfigObject = readJsonConfig(options.config, defaultConfigPath);
+		if (!Object.hasOwn(defaultConfigObject, "references")) options.problems.push([
+			"Directory with multiple typecheck environments must use tsconfig.json as an aggregator:",
+			`  config: ${toRelativePath(options.config.rootDir, defaultConfigPath)}`,
+			"  reason: multiple type environments require a default IDE/typecheck aggregator."
+		].join("\n"));
+	}
+}
+function collectConfigFileOwners(config, configPaths, sourceFiles) {
+	const ownersByFile = /* @__PURE__ */ new Map();
+	const proofFilePattern = createExtensionPattern(getActiveCheckerExtensions(config));
+	for (const configPath of configPaths) {
+		if (!existsSync(configPath)) continue;
+		for (const filePath of parseProjectFileNames(config, configPath, proofFilePattern)) {
+			if (!sourceFiles.has(filePath)) continue;
+			const owners = ownersByFile.get(filePath) ?? [];
+			owners.push(configPath);
+			ownersByFile.set(filePath, owners);
+		}
+	}
+	return ownersByFile;
+}
+function addDuplicateGraphCoverageProblems(options) {
+	for (const [filePath, owners] of [...options.ownersByFile.entries()].sort(([left], [right]) => toRelativePath(options.config.rootDir, left).localeCompare(toRelativePath(options.config.rootDir, right)))) {
+		const uniqueOwners = [...new Set(owners)];
+		if (uniqueOwners.length <= 1) continue;
+		options.problems.push([
+			"Duplicate checker graph coverage:",
+			`  file: ${toRelativePath(options.config.rootDir, filePath)}`,
+			"  covered by:",
+			...uniqueOwners.sort((left, right) => toRelativePath(options.config.rootDir, left).localeCompare(toRelativePath(options.config.rootDir, right))).map((configPath) => `    - ${toRelativePath(options.config.rootDir, configPath)}`),
+			"  reason: a checker graph file must have a single declaration owner; move the file to one dts leaf or narrow include/exclude patterns."
+		].join("\n"));
+	}
+}
+function addDuplicateGraphOwnerProblems(options) {
+	for (const [configPath, ownerCheckerNames] of options.graphOwnersByConfigPath.entries()) {
+		const uniqueOwnerCheckerNames = [...new Set(ownerCheckerNames)].sort();
+		if (uniqueOwnerCheckerNames.length <= 1) continue;
+		options.problems.push([
+			"Duplicate checker graph declaration owner:",
+			`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
+			"  owned by:",
+			...uniqueOwnerCheckerNames.map((checkerName) => `    - ${checkerName}`),
+			"  reason: each tsconfig*.dts.json must be reached by exactly one graph-capable checker entry."
+		].join("\n"));
+	}
+}
+function addAllowlistProblems(options) {
+	for (const entry of options.allowlistEntries) {
+		if (!existsSync(entry.filePath)) {
+			options.problems.push(["Typecheck proof allowlist references a missing file:", `  file: ${toRelativePath(options.config.rootDir, entry.filePath)}`].join("\n"));
+			continue;
+		}
+		if (!options.sourceFiles.has(entry.filePath)) {
+			options.problems.push([
+				"Typecheck proof allowlist file is outside the configured source boundary:",
+				`  file: ${toRelativePath(options.config.rootDir, entry.filePath)}`,
+				"  reason: allowlist entries should only describe source files that proof would otherwise require coverage for."
+			].join("\n"));
+			continue;
+		}
+		if (options.baseCoverageByFile.has(entry.filePath)) options.problems.push(["Typecheck proof allowlist file is already covered without the allowlist:", `  file: ${toRelativePath(options.config.rootDir, entry.filePath)}`].join("\n"));
+	}
+}
+function addUncoveredSourceProblems(options) {
+	const uncoveredFiles = [...options.sourceFiles].filter((filePath) => !options.coverageByFile.has(filePath));
+	if (uncoveredFiles.length === 0) return;
+	options.problems.push([
+		"Source files are not covered by typecheck proof:",
+		...uncoveredFiles.slice(0, 20).map((filePath) => `  - ${toRelativePath(options.config.rootDir, filePath)}`),
+		uncoveredFiles.length > 20 ? `  ... ${uncoveredFiles.length - 20} more` : "",
+		"  reason: every file in config.source must be covered by a checker entry or an explicit allowlist entry."
+	].filter(Boolean).join("\n"));
+}
+function addGraphOwner(ownersByConfigPath, configPath, checkerName) {
+	const owners = ownersByConfigPath.get(configPath) ?? [];
+	owners.push(checkerName);
+	ownersByConfigPath.set(configPath, owners);
+}
+async function runProofCheckInternal(config, options = {}) {
+	const problems = [];
+	const graphRouteCollection = collectGraphProjectRoutes(config);
+	const entryRouteCollection = collectCheckerEntryProjectRoutes(config);
+	const graphProjectPaths = [...new Set(graphRouteCollection.routes.flatMap((route) => route.projectPaths))].sort();
+	const entryProjectPaths = [...new Set(entryRouteCollection.routes.flatMap((route) => route.projectPaths))].sort();
+	const entryProjectPathSet = new Set(entryProjectPaths);
+	const dtsConfigPaths = await collectDtsConfigPaths(config);
+	const buildGraphConfigPaths = await collectBuildGraphConfigPaths(config);
+	const defaultTsconfigPaths = await collectDefaultTsconfigPaths(config);
+	const ordinaryTypecheckConfigPaths = await collectOrdinaryTypecheckConfigPaths(config);
+	const graphOwnersByConfigPath = /* @__PURE__ */ new Map();
+	problems.push(...graphRouteCollection.problems);
+	problems.push(...entryRouteCollection.problems);
+	for (const route of graphRouteCollection.routes) for (const projectPath of route.projectPaths) {
+		if (!isDtsConfigPath(projectPath)) continue;
+		addGraphOwner(graphOwnersByConfigPath, projectPath, route.checkerName);
+	}
+	addDtsConfigProblems({
+		config,
+		dtsConfigPaths,
+		graphProjectPaths: entryProjectPathSet,
+		problems
+	});
+	addBuildGraphConfigProblems({
+		buildGraphConfigPaths,
+		config,
+		problems
+	});
+	addDefaultTsconfigShapeProblems({
+		config,
+		problems,
+		tsconfigPaths: defaultTsconfigPaths
+	});
+	addDefaultTsconfigEnvironmentProblems({
+		config,
+		ordinaryConfigPaths: ordinaryTypecheckConfigPaths,
+		problems
+	});
+	addDuplicateGraphOwnerProblems({
+		config,
+		graphOwnersByConfigPath,
+		problems
+	});
+	if (problems.length > 0) {
+		ProofLogger.error(problems.join("\n\n"));
+		return false;
+	}
+	const checkerTargetCollection = collectCheckerCoverageTargets(config);
+	const checkerTargets = checkerTargetCollection.targets;
+	problems.push(...checkerTargetCollection.problems);
+	if (problems.length > 0) {
+		ProofLogger.error(problems.join("\n\n"));
+		return false;
+	}
+	const sourceFiles = await collectExpectedSourceFiles(config);
+	const allowlistCollection = collectConfiguredAllowlistEntries(config);
+	const allowlistEntries = allowlistCollection.entries;
+	problems.push(...allowlistCollection.problems);
+	const baseCoverageByFile = collectCoverage({
+		allowlistEntries,
+		checkerTargets,
+		config,
+		graphProjectPaths,
+		includeAllowlist: false,
+		sourceFiles
+	});
+	const coverageByFile = collectCoverage({
+		allowlistEntries,
+		checkerTargets,
+		config,
+		graphProjectPaths,
+		sourceFiles
+	});
+	addDuplicateGraphCoverageProblems({
+		config,
+		ownersByFile: collectConfigFileOwners(config, graphProjectPaths, sourceFiles),
+		problems
+	});
+	addAllowlistProblems({
+		allowlistEntries,
+		baseCoverageByFile,
+		config,
+		problems,
+		sourceFiles
+	});
+	addUncoveredSourceProblems({
+		config,
+		coverageByFile,
+		problems,
+		sourceFiles
+	});
+	if (problems.length > 0) {
+		ProofLogger.error(problems.join("\n\n"));
+		return false;
+	}
+	const graphFileCount = [...coverageByFile.values()].filter((sources) => sources.some((source) => source.type === "graph")).length;
+	const checkerFileCount = [...coverageByFile.values()].filter((sources) => sources.some((source) => source.type === "checker")).length;
+	if (options.logSuccess ?? true) ProofLogger.success([
+		`Checked ${entryProjectPaths.length} checker entry projects and ${dtsConfigPaths.length} dts configs.`,
+		`Graph-capable checker entries cover ${graphFileCount} files; checker entries cover ${checkerFileCount} files.`,
+		`Configured source boundary covers ${sourceFiles.size} files.`
+	].join("\n"));
+	if ((options.logSuccess ?? true) && (config.proof?.allowlist ?? []).length > 0) ProofLogger.info(`Explicit typecheck proof allowlist: ${(config.proof?.allowlist ?? []).map((entry) => entry.file).join(", ")}`);
+	return true;
+}
+async function runProofCheck(config, options = {}) {
+	if (options.clearScreen ?? true) clearCliScreen();
+	const elapsed = createElapsedTimer();
+	const task = options.flow?.start("proof check", { depth: options.flowDepth ?? 0 });
+	ProofLogger.info("proof check started");
+	try {
+		const logSuccess = !options.flow?.interactive;
+		const passed = await runProofCheckInternal(config, { logSuccess });
+		if (passed) {
+			if (logSuccess) ProofLogger.success("proof check finished", elapsed());
+			task?.pass();
+		} else {
+			ProofLogger.error("proof check finished with failures", elapsed());
+			task?.fail("proof check finished with failures");
+		}
+		return passed;
+	} catch (error) {
+		ProofLogger.error(`proof check failed: ${formatErrorMessage$1(error)}`, elapsed());
+		task?.fail("proof check failed", { error });
+		throw error;
+	}
+}
+
+//#endregion
+//#region src/pipeline.ts
+const builtInTaskNames = new Set([
+	"checker:build",
+	"checker:typecheck",
+	"graph:check",
+	"package:check",
+	"proof:check",
+	"source:check"
+]);
+function isBuiltinTaskName(value) {
+	return builtInTaskNames.has(value);
+}
+function getPipelineStepLabel(step) {
+	if (step.type === "task") return step.name;
+	return [step.command, ...step.args ?? []].join(" ");
+}
+async function runBuiltinTask(config, taskName, options = {}) {
+	switch (taskName) {
+		case "graph:check": return runGraphCheck(config, {
+			clearScreen: false,
+			flow: options.flow,
+			flowDepth: 1
+		});
+		case "proof:check": return runProofCheck(config, {
+			clearScreen: false,
+			flow: options.flow,
+			flowDepth: 1
+		});
+		case "source:check": return runSourceCheck(config, {
+			clearScreen: false,
+			flow: options.flow,
+			flowDepth: 1
+		});
+		case "package:check": return runPackageCheck({
+			clearScreen: false,
+			config,
+			cwd: options.cwd,
+			flow: options.flow,
+			flowDepth: 1
+		});
+		case "checker:typecheck": return (await runCheckerTypecheck({
+			clearScreen: false,
+			config,
+			cwd: config.rootDir,
+			flow: options.flow,
+			flowDepth: 1
+		})).passed;
+		case "checker:build": return (await runCheckerBuild({
+			clearScreen: false,
+			config,
+			cwd: config.rootDir,
+			flow: options.flow,
+			flowDepth: 1
+		})).passed;
+	}
+}
+function normalizePipelineStep(step) {
+	if (typeof step !== "string") return step;
+	if (isBuiltinTaskName(step)) return {
+		name: step,
+		type: "task"
+	};
+	const [command, ...args] = step.split(/\s+/u).filter(Boolean);
+	if (!command) throw new Error("Pipeline command step must not be empty.");
+	return {
+		args,
+		command,
+		type: "command"
+	};
+}
+function runCommandStep(config, step, options = {}) {
+	const label = getPipelineStepLabel(step);
+	const task = options.flow?.start(`command: ${label}`, { depth: 1 });
+	const commandOptions = {
+		cwd: step.cwd ? path.resolve(config.rootDir, step.cwd) : config.rootDir,
+		env: {
+			...process.env,
+			...step.env
+		},
+		shell: process.platform === "win32"
+	};
+	if (options.flow?.interactive) return new Promise((resolve, reject) => {
+		const child = spawn(step.command, step.args ?? [], {
+			...commandOptions,
+			stdio: [
+				"inherit",
+				"pipe",
+				"pipe"
+			]
+		});
+		child.stdout?.on("data", (chunk) => {
+			options.flow?.writeOutput(chunk, { stream: "stdout" });
+		});
+		child.stderr?.on("data", (chunk) => {
+			options.flow?.writeOutput(chunk, { stream: "stderr" });
+		});
+		child.on("error", (error) => {
+			task?.fail(void 0, { error });
+			reject(error);
+		});
+		child.on("close", (code) => {
+			const passed = (code ?? 1) === 0;
+			if (passed) task?.pass();
+			else task?.fail(`command failed: ${label} exited with code ${code ?? 1}`);
+			resolve(passed);
+		});
+	});
+	const result = spawnSync(step.command, step.args ?? [], {
+		...commandOptions,
+		stdio: "inherit"
+	});
+	if (result.error) {
+		task?.fail(void 0, { error: result.error });
+		throw result.error;
+	}
+	const passed = (result.status ?? 1) === 0;
+	if (passed) task?.pass();
+	else task?.fail(`command failed: ${label} exited with code ${result.status ?? 1}`);
+	return passed;
+}
+async function runPipeline(config, pipelineName, options = {}) {
+	const steps = config.pipelines?.[pipelineName];
+	if (!steps) throw new Error(`Unknown limina pipeline "${pipelineName}".`);
+	const normalizedSteps = steps.map(normalizePipelineStep);
+	const pipelineTask = options.flow?.start(`pipeline: ${pipelineName}`, { collapseOnSuccess: false });
+	for (const [stepIndex, step] of normalizedSteps.entries()) if (!(step.type === "task" ? await runBuiltinTask(config, step.name, options) : await runCommandStep(config, step, options))) {
+		const label = getPipelineStepLabel(step);
+		pipelineTask?.fail(`pipeline blocked: ${pipelineName} at ${label}`);
+		for (const remainingStep of normalizedSteps.slice(stepIndex + 1)) options.flow?.skip(`skipped: ${getPipelineStepLabel(remainingStep)}`, { depth: 1 });
+		return false;
+	}
+	pipelineTask?.pass();
+	return true;
+}
+
+//#endregion
+//#region src/cli.ts
+async function load(flags, command) {
+	return loadConfig({
+		command,
+		configPath: flags.config,
+		cwd: process.cwd(),
+		mode: flags.mode
+	});
+}
+function parsePackageTool(tool) {
+	if (!tool) return;
+	if (tool === "all" || tool === "publint" || tool === "attw" || tool === "boundary") return tool;
+	throw new Error(`Invalid package check --tool "${tool}". Expected one of: all, publint, attw, boundary.`);
+}
+function parsePackageAttwProfile(profile) {
+	if (!profile) return;
+	if (profile === "strict" || profile === "node16" || profile === "esm-only") return profile;
+	throw new Error(`Invalid package check --attw-profile "${profile}". Expected one of: strict, node16, esm-only.`);
+}
+function parseConcurrency(value) {
+	if (value === void 0) return;
+	const parsed = Number(value);
+	if (!Number.isInteger(parsed) || parsed < 1) throw new Error("Invalid --concurrency value. Expected a positive integer.");
+	return parsed;
+}
+function createCliFlow() {
+	clearCliScreen();
+	return createLiminaFlowReporter();
+}
+async function main() {
+	const cli = cac("limina");
+	cli.option("--config <path>", "Path to limina.config.mjs");
+	cli.option("--mode <mode>", "Mode passed to limina config functions");
+	cli.help();
+	cli.command("check <pipeline>", "Run a configured governance pipeline").action(async (pipeline, flags) => {
+		const flow = createCliFlow();
+		flow.intro("limina check");
+		const passed = await runPipeline(await load(flags, "check"), pipeline, {
+			cwd: process.cwd(),
+			flow
+		});
+		if (!passed) process.exitCode = 1;
+		flow.outro(passed ? "limina check passed" : "limina check failed");
+	});
+	cli.command("paths <action>", "Generate source paths for workspace dependency artifact exports").action(async (action, flags) => {
+		if (action !== "generate" && action !== "apply" && action !== "check") throw new Error(`Unknown paths action "${action}". Expected generate, apply, or check.`);
+		const flow = createCliFlow();
+		flow.intro(`limina paths ${action}`);
+		const result = await runPaths(await load(flags, "paths"), {
+			check: action === "check",
+			clearScreen: false,
+			flow
+		});
+		if (action === "check" && result.changed) process.exitCode = 1;
+		flow.outro(action === "check" && result.changed ? "limina paths failed" : "limina paths passed");
+	});
+	cli.command("graph <action>", "Check TypeScript graph architecture").action(async (action, flags) => {
+		if (action !== "check") throw new Error(`Unknown graph action "${action}". Expected check.`);
+		const flow = createCliFlow();
+		flow.intro("limina graph check");
+		const passed = await runGraphCheck(await load(flags, "graph"), {
+			clearScreen: false,
+			flow
+		});
+		if (!passed) process.exitCode = 1;
+		flow.outro(passed ? "limina graph passed" : "limina graph failed");
+	});
+	cli.command("proof <action>", "Check root typecheck coverage proof").action(async (action, flags) => {
+		if (action !== "check") throw new Error(`Unknown proof action "${action}". Expected check.`);
+		const flow = createCliFlow();
+		flow.intro("limina proof check");
+		const passed = await runProofCheck(await load(flags, "proof"), {
+			clearScreen: false,
+			flow
+		});
+		if (!passed) process.exitCode = 1;
+		flow.outro(passed ? "limina proof passed" : "limina proof failed");
+	});
+	cli.command("source <action>", "Check source package boundaries").action(async (action, flags) => {
+		if (action !== "check") throw new Error(`Unknown source action "${action}". Expected check.`);
+		const flow = createCliFlow();
+		flow.intro("limina source check");
+		const passed = await runSourceCheck(await load(flags, "source"), {
+			clearScreen: false,
+			flow
+		});
+		if (!passed) process.exitCode = 1;
+		flow.outro(passed ? "limina source passed" : "limina source failed");
+	});
+	cli.command("checker <action>", "Run configured checker typecheck or build entries").option("--concurrency <n>", "Maximum concurrent checker processes").action(async (action, flags) => {
+		if (action !== "typecheck" && action !== "build") throw new Error(`Unknown checker action "${action}". Expected typecheck or build.`);
+		const flow = createCliFlow();
+		flow.intro(`limina checker ${action}`);
+		if (action === "build") {
+			const result = await runCheckerBuild({
+				clearScreen: false,
+				config: await load(flags, "check"),
+				cwd: process.cwd(),
+				flow
+			});
+			if (!result.passed) process.exitCode = 1;
+			flow.outro(result.passed ? "limina checker passed" : "limina checker failed");
+			return;
+		}
+		const result = await runCheckerTypecheck({
+			clearScreen: false,
+			config: await load(flags, "check"),
+			concurrency: parseConcurrency(flags.concurrency),
+			cwd: process.cwd(),
+			flow
+		});
+		if (!result.passed) process.exitCode = 1;
+		flow.outro(result.passed ? "limina checker passed" : "limina checker failed");
+	});
+	cli.command("package <action>", "Check configured published package outputs").option("-p, --package <name>", "Run a single package check target").option("--tool <tool>", "Run one package check tool").option("--attw-profile <profile>", "Override the configured ATTW profile").action(async (action, flags) => {
+		if (action !== "check") throw new Error(`Unknown package action "${action}". Expected check.`);
+		const flow = createCliFlow();
+		flow.intro("limina package check");
+		const config = await load(flags, "package");
+		const passed = await runPackageCheck({
+			attwProfile: parsePackageAttwProfile(flags.attwProfile),
+			clearScreen: false,
+			config,
+			cwd: process.cwd(),
+			flow,
+			targetName: flags.package,
+			tool: parsePackageTool(flags.tool)
+		});
+		if (!passed) process.exitCode = 1;
+		flow.outro(passed ? "limina package passed" : "limina package failed");
+	});
+	cli.parse(process.argv, { run: false });
+	try {
+		await cli.runMatchedCommand();
+	} catch (error) {
+		CliLogger.error(`limina failed: ${formatErrorMessage$1(error)}`);
+		process.exitCode = 1;
+	}
+}
+await main();
+
+//#endregion
+export {  };