limina 0.0.3 → 0.0.4

package/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import "./chunks/dep-lkQg1P9Q.js";
 import { c as getCheckerAdapter, d as normalizeAbsolutePath, f as normalizeSlashes, g as toRelativePath, h as toPosixPath, i as loadConfig, l as normalizeExtensions, m as toAbsolutePath, n as getActiveCheckerExtensions, p as normalizeWorkspacePath, r as getActiveCheckers, u as isPathInsideDirectory } from "./chunks/dep-DzYrmtQJ.js";
-import { A as shouldResolveThroughGraph$1, B as collectGraphProjectRoutes, C as formatArtifactDependencyPolicy, D as isRelativeSpecifier, E as isDtsProjectConfig, F as getPublishDependencySections, G as formatReferences, H as createExtensionPattern, I as isWorkspaceDependencySpecifier, J as isOrdinaryTypecheckConfigPath, K as getDtsCompanionConfigPath, L as collectCheckerEntryProjectRoutes, M as collectWorkspacePackages, N as findPackageForSpecifier, O as parseProject$1, P as getPackageRootSpecifier, Q as resolveReferencePath, R as collectGraphProjectRoute, S as findTargetProject, T as inferPackageProject$1, U as createExtraFileExtensions, V as collectSourceGraphProjectExtensions, W as createFormatHost, X as readJsonConfig, Y as parseProjectFileNamesForExtensions, Z as resolveProjectConfigPath, _ as normalizeGraphRules, a as runSourceCheck, b as findImporterForFile$1, c as GraphLogger, d as ProofLogger, f as clearCliScreen, g as getDeniedRefRule, h as getDeniedDepRuleForSpecifier, i as runCheckerTypecheck, j as collectImporters, k as resolveInternalImport$1, l as PackageLogger, m as getDeniedDepRuleForPackage, n as createLiminaFlowReporter, o as runInit, p as formatErrorMessage$1, q as getRawReferencePaths, r as runCheckerBuild, s as CliLogger, u as PathsLogger, v as collectImportsFromFile$1, w as getTypecheckConfigPath, x as findPackageForFile, y as createFileOwnerLookup$1, z as collectGraphProjectRouteFromRoot } from "./chunks/dep-UWxsul2A.js";
+import { $ as resolveReferencePath, A as resolveInternalImport$1, B as collectGraphProjectRouteFromRoot, C as findTargetProject, D as isDtsProjectConfig, E as inferPackageProject$1, F as getPackageRootSpecifier, G as createFormatHost, H as collectSourceGraphProjectExtensions, I as getPublishDependencySections, J as getRawReferencePaths, K as formatReferences, L as isWorkspaceDependencySpecifier, M as collectImporters, N as collectWorkspacePackages, O as isRelativeSpecifier, P as findPackageForSpecifier, Q as resolveProjectConfigPath, R as collectCheckerEntryProjectRoutes, S as findPackageForFile, T as getTypecheckConfigPath, U as createExtensionPattern, V as collectGraphProjectRoutes, W as createExtraFileExtensions, X as parseProjectFileNamesForExtensions, Y as isOrdinaryTypecheckConfigPath, Z as readJsonConfig, _ as getDeniedRefRule, a as runSourceCheck, b as createFileOwnerLookup$1, c as GraphLogger, d as ProofLogger, f as ReleaseLogger, g as getDeniedDepRuleForSpecifier, h as getDeniedDepRuleForPackage, i as runCheckerTypecheck, j as shouldResolveThroughGraph$1, k as parseProject$1, l as PackageLogger, m as formatErrorMessage$1, n as createLiminaFlowReporter, o as runInit, p as clearCliScreen, q as getDtsCompanionConfigPath, r as runCheckerBuild, s as CliLogger, u as PathsLogger, v as normalizeGraphRules, w as formatArtifactDependencyPolicy, x as findImporterForFile$1, y as collectImportsFromFile$1, z as collectGraphProjectRoute } from "./chunks/dep-ZRIm_-Zk.js";
 import { builtinModules, createRequire } from "node:module";
 import { cac } from "cac";
 import { createElapsedTimer } from "logaria/helper";
@@ -423,1072 +423,713 @@ async function runGraphCheck(config, options = {}) {
 }
 
 //#endregion
-//#region src/package-release-consistency.ts
-var PackageReleaseConsistencyError = class extends Error {
-	name = "PackageReleaseConsistencyError";
+//#region src/commands/package.ts
+const DEFAULT_PACKAGE_CHECKS = [
+	"publint",
+	"attw",
+	"boundary"
+];
+const PACKAGE_CHECK_TOOLS = new Set(DEFAULT_PACKAGE_CHECKS);
+const ATTW_PROFILE_IGNORED_RESOLUTIONS = {
+	strict: [],
+	node16: [],
+	"esm-only": ["node16-cjs"]
 };
-const semver = createRequire(import.meta.url)("semver");
+const nodeBuiltinSpecifiers = new Set(builtinModules.flatMap((specifier) => specifier.startsWith("node:") ? [specifier, specifier.slice(5)] : [specifier, `node:${specifier}`]));
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function isLinkDependencySpecifier(specifier) {
-	return specifier.startsWith("link:");
+function isPackageCheckTool(value) {
+	return PACKAGE_CHECK_TOOLS.has(value);
 }
-function createReleaseConsistencyState() {
+function isRelativeOrAbsoluteSpecifier(specifier) {
+	return specifier.startsWith(".") || specifier.startsWith("/") || specifier.startsWith("file:") || specifier.startsWith("http:") || specifier.startsWith("https:") || specifier.startsWith("data:");
+}
+function toArrayBuffer(buffer) {
+	return buffer.buffer.slice(buffer.byteOffset, buffer.byteOffset + buffer.byteLength);
+}
+function collectSelfSpecifierMatchers(packageName, exportsField) {
+	const exact = new Set([packageName]);
+	const prefixes = [];
+	if (!isRecord$1(exportsField)) return {
+		exact,
+		prefixes
+	};
+	for (const exportKey of Object.keys(exportsField)) {
+		if (exportKey === ".") {
+			exact.add(packageName);
+			continue;
+		}
+		if (!exportKey.startsWith("./")) continue;
+		const normalizedSubpath = exportKey.slice(2);
+		if (normalizedSubpath.length === 0) continue;
+		const wildcardIndex = normalizedSubpath.indexOf("*");
+		if (wildcardIndex !== -1) {
+			prefixes.push(`${packageName}/${normalizedSubpath.slice(0, wildcardIndex)}`);
+			continue;
+		}
+		exact.add(`${packageName}/${normalizedSubpath}`);
+	}
 	return {
-		directWorkspaceDependencies: [],
-		edges: /* @__PURE__ */ new Map(),
-		missingWorkspaceDependencies: [],
-		packedManifestProblems: [],
-		privateWorkspaceDependencies: [],
-		registryMetadataCache: /* @__PURE__ */ new Map(),
-		registryProblems: [],
-		sourceLinkDependencies: [],
-		unpublishedPackageNames: /* @__PURE__ */ new Set(),
-		visitedPackages: /* @__PURE__ */ new Set()
+		exact,
+		prefixes
 	};
 }
-function collectPublishDependencyEntries(manifest) {
-	const entries = [];
-	for (const { dependencies, name } of getPublishDependencySections(manifest)) for (const [dependencyName, specifier] of Object.entries(dependencies)) entries.push({
-		dependencyName,
-		sectionName: name,
-		specifier
-	});
-	return entries;
+function isAllowedSelfSpecifier(specifier, matchers) {
+	return matchers.exact.has(specifier) || matchers.prefixes.some((prefix) => specifier.startsWith(prefix));
 }
-function addEdge(edges, importerName, dependencyName) {
-	const dependencies = edges.get(importerName) ?? /* @__PURE__ */ new Set();
-	dependencies.add(dependencyName);
-	edges.set(importerName, dependencies);
+function normalizePublishedModulePath(relativeFilePath) {
+	return relativeFilePath.replaceAll("\\", "/");
 }
-function formatDependencyLocation(problem) {
-	const dependency = problem.dependencyName ? ` -> ${problem.dependencyName}` : "";
-	const section = problem.sectionName ? ` [${problem.sectionName}]` : "";
-	const specifier = problem.specifier ? ` (${problem.specifier})` : "";
-	return `${problem.importerName}${dependency}${section}${specifier}`;
+function classifyRuntimeEnvironment(target, relativeFilePath) {
+	if (typeof target.environment === "function") return target.environment(relativeFilePath);
+	if (target.environment) return target.environment;
+	const normalizedPath = normalizePublishedModulePath(relativeFilePath);
+	return normalizedPath.startsWith("node/") || normalizedPath.startsWith("plugin/") ? "node" : "browser";
 }
-function formatProblemLines(title, problems) {
-	if (problems.length === 0) return [];
-	return [
-		"",
-		title,
-		...problems.map((problem) => `  - ${formatDependencyLocation(problem)}: ${problem.message}`)
-	];
+async function collectPublishedModuleFiles(directoryPath) {
+	const entries = await readdir(directoryPath, { withFileTypes: true });
+	const files = [];
+	for (const entry of entries) {
+		const absolutePath = path.join(directoryPath, entry.name);
+		if (entry.isDirectory()) {
+			files.push(...await collectPublishedModuleFiles(absolutePath));
+			continue;
+		}
+		if (/\.[cm]?js$/u.test(entry.name)) files.push(absolutePath);
+	}
+	return files;
 }
-function getPackedDependencySpecifier(manifest, dependencyName) {
-	for (const { dependencies } of getPublishDependencySections(manifest)) {
-		const specifier = dependencies[dependencyName];
-		if (specifier) return specifier;
+function validatePublishedSpecifier(options) {
+	const { allowedExternalPackages, environment, packageName, selfSpecifiers, specifier } = options;
+	if (isRelativeOrAbsoluteSpecifier(specifier)) return null;
+	if (nodeBuiltinSpecifiers.has(specifier)) {
+		if (environment === "node") return null;
+		return `browser/runtime output must not import Node builtin "${specifier}"`;
+	}
+	const packageRoot = getPackageRootSpecifier(specifier);
+	if (packageRoot === packageName) {
+		if (isAllowedSelfSpecifier(specifier, selfSpecifiers)) return null;
+		return `self import "${specifier}" is not exposed by output package.json exports`;
 	}
+	if (allowedExternalPackages.has(packageRoot)) return null;
+	return `"${specifier}" resolves to package "${packageRoot}" which is not listed in dependencies, peerDependencies, optionalDependencies, or self exports`;
 }
-function getNpmPackageMetadataUrl(packageName) {
-	return `https://registry.npmjs.org/${encodeURIComponent(packageName)}`;
+function formatAttwProblem(problem) {
+	const resolutionKind = "resolutionKind" in problem ? ` [resolution: ${problem.resolutionKind}]` : "";
+	const entrypoint = "entrypoint" in problem ? ` [entrypoint: ${problem.entrypoint}]` : "";
+	switch (problem.kind) {
+		case "NoResolution": return `No resolution${resolutionKind}${entrypoint}`;
+		case "UntypedResolution": return `Untyped resolution${resolutionKind}${entrypoint}`;
+		case "FalseESM": return `False ESM: ${problem.typesFileName} -> ${problem.implementationFileName}`;
+		case "FalseCJS": return `False CJS: ${problem.typesFileName} -> ${problem.implementationFileName}`;
+		case "CJSResolvesToESM": return `CJS resolves to ESM${resolutionKind}${entrypoint}`;
+		case "FallbackCondition": return `Fallback condition used${resolutionKind}${entrypoint}`;
+		case "NamedExports": return problem.isMissingAllNamed ? `Named exports missing: all named exports [types: ${problem.typesFileName}] [implementation: ${problem.implementationFileName}]` : `Named exports missing: ${problem.missing.join(", ") || "(none)"} [types: ${problem.typesFileName}] [implementation: ${problem.implementationFileName}]`;
+		case "FalseExportDefault": return `False export default [types: ${problem.typesFileName}] [implementation: ${problem.implementationFileName}]`;
+		case "MissingExportEquals": return `Missing export equals [types: ${problem.typesFileName}] [implementation: ${problem.implementationFileName}]`;
+		case "InternalResolutionError": return `Internal resolution error in ${problem.fileName} [option: ${problem.resolutionOption}] [module: ${problem.moduleSpecifier}]`;
+		case "UnexpectedModuleSyntax": return `Unexpected module syntax in ${problem.fileName}`;
+		case "CJSOnlyExportsDefault": return `CJS only exports default in ${problem.fileName}`;
+		default: return `Unknown ATTW problem: ${JSON.stringify(problem)}`;
+	}
 }
-async function fetchRegistryPackageMetadata(packageName, state) {
-	if (state.registryMetadataCache.has(packageName)) return state.registryMetadataCache.get(packageName) ?? null;
-	const response = await fetch(getNpmPackageMetadataUrl(packageName), { headers: { accept: "application/vnd.npm.install-v1+json, application/json" } });
-	if (!response.ok) {
-		state.registryMetadataCache.set(packageName, null);
-		return null;
+function normalizeEntryChecks(entry) {
+	const checks = entry.checks ?? DEFAULT_PACKAGE_CHECKS;
+	const normalizedChecks = [];
+	for (const check of checks) {
+		if (!isPackageCheckTool(check)) throw new Error(`Invalid package check "${check}". Expected one of: publint, attw, boundary.`);
+		if (!normalizedChecks.includes(check)) normalizedChecks.push(check);
 	}
-	const metadata = await response.json();
-	const registryMetadata = isRecord$1(metadata) ? metadata : null;
-	state.registryMetadataCache.set(packageName, registryMetadata);
-	return registryMetadata;
+	return normalizedChecks;
 }
-function findRegistryVersionMetadata(metadata, version) {
-	if (!isRecord$1(metadata.versions)) return null;
-	const versionMetadata = metadata.versions[version];
-	return isRecord$1(versionMetadata) ? versionMetadata : null;
+function selectEntryChecks(entry, requestedTool) {
+	const configuredChecks = normalizeEntryChecks(entry);
+	if (!requestedTool || requestedTool === "all") return configuredChecks;
+	return configuredChecks.includes(requestedTool) ? [requestedTool] : [];
 }
-function execGitCommand(config, args) {
-	return new Promise((resolve, reject) => {
-		execFile("git", [
-			"-C",
-			config.rootDir,
-			...args
-		], {
-			encoding: "utf8",
-			maxBuffer: 10 * 1024 * 1024
-		}, (error, stdout) => {
-			if (error) {
-				reject(error);
-				return;
-			}
-			resolve(stdout);
-		});
-	});
+function findNearestPackageJsonPath(cwd, rootDir) {
+	const resolvedRootDir = path.resolve(rootDir);
+	let currentDir = path.resolve(cwd);
+	while (true) {
+		const relativeToRoot = path.relative(resolvedRootDir, currentDir);
+		if (!(relativeToRoot === "" || relativeToRoot !== ".." && !relativeToRoot.startsWith(`..${path.sep}`) && !path.isAbsolute(relativeToRoot))) return;
+		const packageJsonPath = path.join(currentDir, "package.json");
+		if (existsSync(packageJsonPath)) return packageJsonPath;
+		if (currentDir === resolvedRootDir) return;
+		const parentDir = path.dirname(currentDir);
+		if (parentDir === currentDir) return;
+		currentDir = parentDir;
+	}
 }
-async function hasWorkspacePackageChangesSinceGitHead(options) {
-	const relativeDirectory = toRelativePath(options.config.rootDir, options.workspacePackage.directory);
+function readCwdPackageName(cwd, rootDir) {
+	const packageJsonPath = findNearestPackageJsonPath(cwd, rootDir);
+	if (!packageJsonPath) return;
 	try {
-		await execGitCommand(options.config, [
-			"diff",
-			"--quiet",
-			options.gitHead,
-			"--",
-			relativeDirectory
-		]);
+		const manifest = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+		return typeof manifest.name === "string" && manifest.name.trim() ? manifest.name.trim() : void 0;
 	} catch (error) {
-		if (isRecord$1(error) && error.code === 1) return true;
-		throw error;
+		throw new Error(`Unable to read package name from ${packageJsonPath}: ${formatErrorMessage$1(error)}`);
 	}
-	return (await execGitCommand(options.config, [
-		"ls-files",
-		"--others",
-		"--exclude-standard",
-		"--",
-		relativeDirectory
-	])).trim().length > 0;
 }
-async function verifyWorkspacePackagePublished(options) {
-	const { state, workspacePackage } = options;
-	const version = workspacePackage.manifest.version;
-	if (!version || !semver.valid(version)) {
-		state.unpublishedPackageNames.add(workspacePackage.name);
-		state.registryProblems.push({
-			importerName: workspacePackage.name,
-			message: ["workspace package must declare a valid semver version", "before another publishable package can depend on it"].join(" "),
-			packageName: workspacePackage.name
-		});
-		return;
+function formatConfiguredPackageEntryNames(entries) {
+	const names = entries.map((entry) => entry.name).filter(Boolean);
+	return names.length > 0 ? names.join(", ") : "(none)";
+}
+function getConfiguredPackageEntries(config) {
+	return config.package?.entries ?? [];
+}
+function normalizePackageNameFilters(packageNames) {
+	const normalizedNames = [];
+	for (const packageName of packageNames ?? []) {
+		const normalizedName = packageName.trim();
+		if (normalizedName && !normalizedNames.includes(normalizedName)) normalizedNames.push(normalizedName);
 	}
-	let metadata;
-	try {
-		metadata = await fetchRegistryPackageMetadata(workspacePackage.name, state);
-	} catch (error) {
-		state.unpublishedPackageNames.add(workspacePackage.name);
-		state.registryProblems.push({
-			importerName: workspacePackage.name,
-			message: [`unable to read npm registry metadata for ${workspacePackage.name}@${version}:`, formatErrorMessage$1(error)].join(" "),
-			packageName: workspacePackage.name
+	return normalizedNames;
+}
+function resolvePackageEntryOutDir(options) {
+	const outDir = options.entry.outDir;
+	if (typeof outDir !== "string" || outDir.trim().length === 0) throw new Error(`Invalid package entry at package.entries[${options.entryIndex}].outDir. Expected a non-empty string.`);
+	return path.resolve(options.config.rootDir, outDir);
+}
+function getPackageEntryLabel(options) {
+	const name = options.entry.name;
+	if (typeof name !== "string" || name.trim().length === 0) throw new Error(`Invalid package entry at package.entries[${options.entryIndex}].name. Expected a non-empty string.`);
+	return name.trim();
+}
+function createEntryPlan(options) {
+	const outDir = resolvePackageEntryOutDir({
+		config: options.config,
+		entry: options.entry,
+		entryIndex: options.entryIndex
+	});
+	return {
+		checks: selectEntryChecks(options.entry, options.requestedTool),
+		entryIndex: options.entryIndex,
+		label: getPackageEntryLabel({
+			entry: options.entry,
+			entryIndex: options.entryIndex
+		}),
+		outDir,
+		rawEntry: options.entry
+	};
+}
+function createPackageEntrySelectionPlan(options) {
+	const entries = getConfiguredPackageEntries(options.config);
+	if (entries.length === 0) throw new Error("No package entries are configured.");
+	let selectedEntries;
+	let selectionReason;
+	const packageNames = normalizePackageNameFilters(options.packageNames);
+	if (packageNames.length > 0) {
+		selectedEntries = packageNames.map((packageName) => {
+			const entry = entries.find((candidate) => candidate.name === packageName);
+			if (!entry) throw new Error([`No package entry named "${packageName}" is configured.`, `Configured package entries: ${formatConfiguredPackageEntryNames(entries)}.`].join(" "));
+			return entry;
 		});
-		return;
+		selectionReason = `--package matched configured package entry name(s): ${packageNames.join(", ")}.`;
+	} else {
+		const cwdPackageName = readCwdPackageName(options.cwd, options.config.rootDir);
+		if (cwdPackageName) {
+			selectedEntries = entries.filter((entry) => entry.name === cwdPackageName);
+			if (selectedEntries.length > 0) selectionReason = `nearest package.json name "${cwdPackageName}" matched configured package entry name.`;
+			else if (options.strictCwd) throw new Error([`Nearest package.json name "${cwdPackageName}" does not match a configured package entry.`, `Configured package entries: ${formatConfiguredPackageEntryNames(entries)}.`].join(" "));
+			else {
+				selectedEntries = entries;
+				selectionReason = `nearest package.json name "${cwdPackageName}" did not match configured package entries; running all configured entries.`;
+			}
+		} else if (options.strictCwd) throw new Error(["No package name was found from cwd up to the workspace root.", "Run from a configured package directory or pass --package <name>."].join(" "));
+		else {
+			selectedEntries = entries;
+			selectionReason = "No package name was found from cwd up to the workspace root; running all configured entries.";
+		}
 	}
-	if (!metadata) {
-		state.unpublishedPackageNames.add(workspacePackage.name);
-		state.registryProblems.push({
-			importerName: workspacePackage.name,
-			message: `${workspacePackage.name}@${version} is not published to the npm registry`,
-			packageName: workspacePackage.name
-		});
-		return;
-	}
-	const versionMetadata = findRegistryVersionMetadata(metadata, version);
-	if (!versionMetadata) {
-		state.unpublishedPackageNames.add(workspacePackage.name);
-		state.registryProblems.push({
-			importerName: workspacePackage.name,
-			message: `${workspacePackage.name}@${version} is not published to the npm registry`,
-			packageName: workspacePackage.name
-		});
-		return;
-	}
-	if (typeof versionMetadata.gitHead !== "string" || versionMetadata.gitHead.trim().length === 0) {
-		state.unpublishedPackageNames.add(workspacePackage.name);
-		state.registryProblems.push({
-			importerName: workspacePackage.name,
-			message: [`${workspacePackage.name}@${version} registry metadata has no gitHead,`, "so limina cannot prove the published source baseline"].join(" "),
-			packageName: workspacePackage.name
-		});
-		return;
-	}
-	let hasChanges;
-	try {
-		hasChanges = await hasWorkspacePackageChangesSinceGitHead({
+	return {
+		selectionReason,
+		entries: selectedEntries.map((entry) => createEntryPlan({
 			config: options.config,
-			gitHead: versionMetadata.gitHead,
-			workspacePackage
-		});
-	} catch (error) {
-		state.unpublishedPackageNames.add(workspacePackage.name);
-		state.registryProblems.push({
-			importerName: workspacePackage.name,
-			message: [
-				`unable to compare ${workspacePackage.name}@${version}`,
-				`against published gitHead ${versionMetadata.gitHead}:`,
-				formatErrorMessage$1(error)
-			].join(" "),
-			packageName: workspacePackage.name
-		});
-		return;
-	}
-	if (hasChanges) {
-		state.unpublishedPackageNames.add(workspacePackage.name);
-		state.registryProblems.push({
-			importerName: workspacePackage.name,
-			message: [`${workspacePackage.name}@${version} has workspace changes`, `after the published npm registry gitHead ${versionMetadata.gitHead}`].join(" "),
-			packageName: workspacePackage.name
-		});
-	}
+			entry,
+			entryIndex: entries.indexOf(entry),
+			requestedTool: options.tool
+		}))
+	};
 }
-async function visitWorkspacePackageDependencies(options) {
-	const { config, importerName, isRoot, manifest, state, workspacePackagesByName } = options;
-	for (const entry of collectPublishDependencyEntries(manifest)) {
-		if (isLinkDependencySpecifier(entry.specifier)) {
-			state.sourceLinkDependencies.push({
-				dependencyName: entry.dependencyName,
-				importerName,
-				message: "publishable dependency sections must not use link:",
-				sectionName: entry.sectionName,
-				specifier: entry.specifier
-			});
-			continue;
-		}
-		if (!isWorkspaceDependencySpecifier(entry.specifier)) continue;
-		const targetPackage = workspacePackagesByName.get(entry.dependencyName);
-		if (!targetPackage) {
-			state.missingWorkspaceDependencies.push({
-				dependencyName: entry.dependencyName,
-				importerName,
-				message: "workspace: publish dependency does not match a named workspace package",
-				sectionName: entry.sectionName,
-				specifier: entry.specifier
-			});
+function logPackageCheckPlan(options) {
+	PackageLogger.info([
+		"Package check plan:",
+		`  config: ${toRelativePath(options.config.rootDir, options.config.configPath)}`,
+		`  cwd: ${toRelativePath(options.config.rootDir, options.cwd)}`,
+		`  selection: ${options.plan.selectionReason}`,
+		"  entries:",
+		...options.plan.entries.map((entry) => [
+			`    - ${entry.label}`,
+			`      outDir: ${toRelativePath(options.config.rootDir, entry.outDir)}`,
+			`      checks: ${entry.checks.length > 0 ? entry.checks.join(", ") : "(none)"}`
+		].join("\n"))
+	].join("\n"));
+}
+async function packOutputTarball(outDir) {
+	const destination = await mkdtemp(path.join(tmpdir(), "__LIMINA_PACKAGE__"));
+	return {
+		cleanup: async () => {
+			await rm(destination, {
+				force: true,
+				recursive: true
+			}).catch(() => null);
+		},
+		tarball: await readFile(await pack(outDir, {
+			destination,
+			ignoreScripts: true,
+			packageManager: "pnpm"
+		}))
+	};
+}
+async function readDistPackageJson(options) {
+	if (!existsSync(options.packageJsonPath)) throw new Error(`outDir package.json not found${options.label ? ` for ${options.label}` : ""} at ${options.config ? toRelativePath(options.config.rootDir, options.packageJsonPath) : options.packageJsonPath}. Run the package build first.`);
+	return JSON.parse(await readFile(options.packageJsonPath, "utf8"));
+}
+async function runPublintCheck(options) {
+	const task = options.flow?.start(`publint: ${options.label}`, { depth: options.flowDepth ?? 0 });
+	PackageLogger.info(`publint started: ${options.label}`);
+	const publintElapsed = createElapsedTimer();
+	const { messages, pkg } = await publint({
+		pack: { tarball: toArrayBuffer(options.tarball) },
+		strict: options.strict
+	});
+	if (messages.length === 0) {
+		if (!options.flow?.interactive) PackageLogger.success(`publint passed: ${options.label}`, publintElapsed());
+		task?.pass();
+		return true;
+	}
+	for (const message of messages) {
+		const rendered = formatMessage(message, pkg) ?? message.code;
+		if (message.type === "error") {
+			PackageLogger.error(`[${options.label}] [publint] ${rendered}`);
 			continue;
 		}
-		addEdge(state.edges, importerName, targetPackage.name);
-		if (isRoot) state.directWorkspaceDependencies.push({
-			dependencyName: entry.dependencyName,
-			sectionName: entry.sectionName,
-			targetPackage
-		});
-		if (targetPackage.manifest.private === true) {
-			state.privateWorkspaceDependencies.push({
-				dependencyName: entry.dependencyName,
-				importerName,
-				message: "publishable packages cannot depend on a private workspace package",
-				packageName: targetPackage.name,
-				sectionName: entry.sectionName,
-				specifier: entry.specifier
-			});
+		if (message.type === "warning") {
+			PackageLogger.warn(`[${options.label}] [publint] ${rendered}`);
 			continue;
 		}
-		if (!state.visitedPackages.has(targetPackage.name)) {
-			state.visitedPackages.add(targetPackage.name);
-			await verifyWorkspacePackagePublished({
-				config,
-				state,
-				workspacePackage: targetPackage
-			});
-			await visitWorkspacePackageDependencies({
-				config,
-				importerName: targetPackage.name,
-				isRoot: false,
-				manifest: targetPackage.manifest,
-				state,
-				workspacePackagesByName
-			});
-		}
+		PackageLogger.info(`[${options.label}] [publint] ${rendered}`);
 	}
+	PackageLogger.error(`publint found ${messages.length} issue(s): ${options.label}`, publintElapsed());
+	task?.fail(`publint found ${messages.length} issue(s): ${options.label}`);
+	return false;
 }
-async function readPackedPackageJson(tarball) {
-	const unpacked = await unpack(tarball);
-	const packageJsonFile = unpacked.files.find((file) => file.name === `${unpacked.rootDir}/package.json`);
-	if (!packageJsonFile) throw new Error("packed tarball does not contain package.json");
-	return JSON.parse(Buffer.from(packageJsonFile.data).toString("utf8"));
-}
-function validatePackedManifest(options) {
-	const { manifest, rootPackageName, state } = options;
-	for (const entry of collectPublishDependencyEntries(manifest)) if (isWorkspaceDependencySpecifier(entry.specifier) || isLinkDependencySpecifier(entry.specifier)) state.packedManifestProblems.push({
-		dependencyName: entry.dependencyName,
-		importerName: rootPackageName,
-		message: "packed package manifest must not expose workspace: or link: dependency specifiers",
-		sectionName: entry.sectionName,
-		specifier: entry.specifier
+async function runAttwCheck(options) {
+	const task = options.flow?.start(`attw: ${options.label}`, { depth: options.flowDepth ?? 0 });
+	PackageLogger.info(`attw started: ${options.label} (profile: ${options.profile})`);
+	const attwElapsed = createElapsedTimer();
+	const result = await checkPackage(createPackageFromTarballData(options.tarball));
+	if (!result.types) {
+		PackageLogger.error(`[${options.label}] [attw] package has no types`);
+		PackageLogger.error(`attw failed: ${options.label}`, attwElapsed());
+		task?.fail(`attw failed: ${options.label}`);
+		return false;
+	}
+	const ignoredResolutions = ATTW_PROFILE_IGNORED_RESOLUTIONS[options.profile];
+	const problems = result.problems.filter((problem) => {
+		if ("resolutionKind" in problem) return !ignoredResolutions.includes(problem.resolutionKind);
+		return true;
 	});
-	for (const dependency of state.directWorkspaceDependencies) {
-		const packedSpecifier = getPackedDependencySpecifier(manifest, dependency.dependencyName);
-		if (!packedSpecifier) {
-			state.packedManifestProblems.push({
-				dependencyName: dependency.dependencyName,
-				importerName: rootPackageName,
-				message: "packed package manifest must keep every source workspace publish dependency",
-				sectionName: dependency.sectionName
-			});
-			continue;
-		}
-		if (isWorkspaceDependencySpecifier(packedSpecifier) || isLinkDependencySpecifier(packedSpecifier)) continue;
-		const targetVersion = dependency.targetPackage.manifest.version;
-		if (!targetVersion || !semver.satisfies(targetVersion, packedSpecifier, { includePrerelease: true })) state.packedManifestProblems.push({
-			dependencyName: dependency.dependencyName,
-			importerName: rootPackageName,
-			message: `packed dependency range must include ${dependency.targetPackage.name}@${targetVersion ?? "(missing version)"}`,
-			sectionName: dependency.sectionName,
-			specifier: packedSpecifier
-		});
+	if (problems.length === 0) {
+		if (!options.flow?.interactive) PackageLogger.success(`attw passed: ${options.label}`, attwElapsed());
+		task?.pass();
+		return true;
 	}
+	for (const problem of problems) PackageLogger.error(`[${options.label}] [attw] ${formatAttwProblem(problem)}`);
+	PackageLogger.error(`attw found ${problems.length} problem(s): ${options.label}`, attwElapsed());
+	task?.fail(`attw found ${problems.length} problem(s): ${options.label}`);
+	return false;
 }
-function createPublishOrder(rootPackageName, state) {
-	const publishOrder = [];
-	const seen = /* @__PURE__ */ new Set();
-	function visit(packageName) {
-		if (seen.has(packageName)) return;
-		seen.add(packageName);
-		for (const dependencyName of state.edges.get(packageName) ?? []) visit(dependencyName);
-		if (packageName === rootPackageName || state.unpublishedPackageNames.has(packageName)) publishOrder.push(packageName);
+async function runBoundaryCheck(target, label, options = {}) {
+	const task = options.flow?.start(`package boundary: ${label}`, { depth: options.flowDepth ?? 0 });
+	PackageLogger.info(`package boundary started: ${label}`);
+	const boundaryElapsed = createElapsedTimer();
+	const violations = await auditPublishedPackageBoundaries(target);
+	if (violations.length === 0) {
+		if (!options.flow?.interactive) PackageLogger.success(`package boundary passed: ${label}`, boundaryElapsed());
+		task?.pass();
+		return true;
 	}
-	visit(rootPackageName);
-	return publishOrder;
-}
-function createReleaseConsistencyError(options) {
-	const { config, label, outDir, rootPackageName, state } = options;
-	if (state.sourceLinkDependencies.length + state.privateWorkspaceDependencies.length + state.missingWorkspaceDependencies.length + state.registryProblems.length + state.packedManifestProblems.length === 0) return null;
-	const publishOrder = createPublishOrder(rootPackageName, state);
-	const lines = [
-		`package release dependency consistency failed for ${label}:`,
-		`  output: ${toRelativePath(config.rootDir, outDir)}`,
-		...formatProblemLines("Source manifest contains local link: publish dependencies:", state.sourceLinkDependencies),
-		...formatProblemLines("Source manifest depends on private workspace packages:", state.privateWorkspaceDependencies),
-		...formatProblemLines("Source manifest has invalid workspace: publish dependencies:", state.missingWorkspaceDependencies),
-		...formatProblemLines("Workspace packages must be published before this package:", state.registryProblems),
-		...formatProblemLines("Packed package manifest is inconsistent with workspace publish dependencies:", state.packedManifestProblems)
-	];
-	if (publishOrder.length > 1) lines.push("", `Suggested publish order: ${publishOrder.join(" -> ")}`);
-	return new PackageReleaseConsistencyError(lines.join("\n"));
+	for (const violation of violations) PackageLogger.error(`[${label}] [boundary] ${violation.filePath} (${violation.environment}) imports "${violation.specifier}": ${violation.message}`);
+	PackageLogger.error(`package boundary found ${violations.length} issue(s): ${label}`, boundaryElapsed());
+	task?.fail(`package boundary found ${violations.length} issue(s): ${label}`);
+	return false;
 }
-async function assertPackageReleaseConsistency(options) {
-	const workspacePackages = await collectWorkspacePackages(options.config);
-	const sourcePackage = workspacePackages.find((workspacePackage) => workspacePackage.name === options.outputManifest.name);
-	const state = createReleaseConsistencyState();
-	if (sourcePackage) {
-		state.visitedPackages.add(sourcePackage.name);
-		await visitWorkspacePackageDependencies({
+async function runPackageCheckEntry(options) {
+	const entry = {
+		...options.rawEntry,
+		outDir: options.outDir
+	};
+	const label = options.label;
+	const outputPackageJsonPath = path.join(entry.outDir, "package.json");
+	const task = options.flow?.start(`package entry: ${label}`, { depth: options.flowDepth ?? 0 });
+	let packedDist;
+	try {
+		await readDistPackageJson({
 			config: options.config,
-			importerName: sourcePackage.name,
-			isRoot: true,
-			manifest: sourcePackage.manifest,
-			state,
-			workspacePackagesByName: new Map(workspacePackages.map((workspacePackage) => [workspacePackage.name, workspacePackage]))
+			label,
+			packageJsonPath: outputPackageJsonPath
 		});
+		if (options.checks.includes("publint") || options.checks.includes("attw")) {
+			const packTask = options.flow?.start(`package tarball: ${label}`, { depth: (options.flowDepth ?? 0) + 1 });
+			PackageLogger.info(`package tarball packing started: ${label}`);
+			const packElapsed = createElapsedTimer();
+			try {
+				packedDist = await packOutputTarball(entry.outDir);
+			} catch (error) {
+				PackageLogger.error(`package tarball failed: ${label}: ${formatErrorMessage$1(error)}`, packElapsed());
+				packTask?.fail(`package tarball failed: ${label}`, { error });
+				throw error;
+			}
+			if (!options.flow?.interactive) PackageLogger.success(`package tarball packed: ${label}`, packElapsed());
+			packTask?.pass();
+		}
+		let passed = true;
+		if (options.checks.includes("publint")) passed = await runPublintCheck({
+			flow: options.flow,
+			flowDepth: (options.flowDepth ?? 0) + 1,
+			label,
+			strict: entry.publint?.strict ?? true,
+			tarball: packedDist.tarball
+		}) && passed;
+		if (options.checks.includes("attw")) passed = await runAttwCheck({
+			flow: options.flow,
+			flowDepth: (options.flowDepth ?? 0) + 1,
+			label,
+			profile: options.attwProfile ?? entry.attw?.profile ?? "esm-only",
+			tarball: packedDist.tarball
+		}) && passed;
+		if (options.checks.includes("boundary")) passed = await runBoundaryCheck({
+			...entry.boundary,
+			outDir: entry.outDir
+		}, label, {
+			flow: options.flow,
+			flowDepth: (options.flowDepth ?? 0) + 1
+		}) && passed;
+		if (passed) {
+			if (!options.flow?.interactive) PackageLogger.success(`package checks passed: ${label}`);
+			task?.pass();
+		} else {
+			PackageLogger.error(`package checks failed: ${label}`);
+			task?.fail(`package checks failed: ${label}`);
+		}
+		return passed;
+	} catch (error) {
+		PackageLogger.error(`package checks failed: ${label}: ${formatErrorMessage$1(error)}`);
+		task?.fail(`package checks failed: ${label}`, { error });
+		throw error;
+	} finally {
+		if (packedDist) await packedDist.cleanup();
 	}
-	validatePackedManifest({
-		manifest: await readPackedPackageJson(options.packedTarball),
-		rootPackageName: options.outputManifest.name,
-		state
-	});
-	const error = createReleaseConsistencyError({
-		config: options.config,
-		label: options.label,
-		outDir: options.outDir,
-		rootPackageName: options.outputManifest.name,
-		state
+}
+async function auditPublishedPackageBoundaries(target) {
+	const manifest = await readDistPackageJson({ packageJsonPath: path.join(target.outDir, "package.json") });
+	const allowedExternalPackages = new Set([
+		...Object.keys(manifest.dependencies ?? {}),
+		...Object.keys(manifest.peerDependencies ?? {}),
+		...Object.keys(manifest.optionalDependencies ?? {}),
+		...target.ignoredExternalPackages ?? []
+	]);
+	const selfSpecifiers = collectSelfSpecifierMatchers(manifest.name, manifest.exports);
+	const publishedFiles = await collectPublishedModuleFiles(target.outDir);
+	const violations = [];
+	await init;
+	for (const filePath of publishedFiles) {
+		const relativeFilePath = path.relative(target.outDir, filePath);
+		const environment = classifyRuntimeEnvironment(target, relativeFilePath);
+		const [importSpecifiers] = parse(await readFile(filePath, "utf8"));
+		for (const importSpecifier of importSpecifiers) {
+			if (!importSpecifier.n) continue;
+			const message = validatePublishedSpecifier({
+				allowedExternalPackages,
+				environment,
+				packageName: manifest.name,
+				selfSpecifiers,
+				specifier: importSpecifier.n
+			});
+			if (!message) continue;
+			violations.push({
+				environment,
+				filePath: relativeFilePath,
+				message,
+				specifier: importSpecifier.n
+			});
+		}
+	}
+	return violations.toSorted((left, right) => {
+		if (left.filePath === right.filePath) return left.specifier.localeCompare(right.specifier);
+		return left.filePath.localeCompare(right.filePath);
 	});
-	if (error) throw error;
+}
+async function runPackageCheck(options) {
+	if (options.clearScreen ?? true) clearCliScreen();
+	const elapsed = createElapsedTimer();
+	const cwd = path.resolve(options.cwd ?? process.cwd());
+	const task = options.flow?.start("package check", { depth: options.flowDepth ?? 0 });
+	try {
+		PackageLogger.info("package check started");
+		const plan = createPackageEntrySelectionPlan({
+			config: options.config,
+			cwd,
+			packageNames: options.packageNames,
+			strictCwd: false,
+			tool: options.tool
+		});
+		logPackageCheckPlan({
+			config: options.config,
+			cwd,
+			plan
+		});
+		const runnableEntries = plan.entries.filter((entry) => entry.checks.length > 0);
+		if (runnableEntries.length === 0) throw new Error(options.tool && options.tool !== "all" ? `No package entries have "${options.tool}" enabled.` : "No package checks are enabled.");
+		let passed = true;
+		for (const entry of runnableEntries) passed = await runPackageCheckEntry({
+			attwProfile: options.attwProfile,
+			checks: entry.checks,
+			config: options.config,
+			flow: options.flow,
+			flowDepth: (options.flowDepth ?? 0) + 1,
+			label: entry.label,
+			outDir: entry.outDir,
+			rawEntry: entry.rawEntry
+		}) && passed;
+		if (passed) {
+			if (!options.flow?.interactive) PackageLogger.success("package check finished", elapsed());
+			task?.pass();
+		} else {
+			PackageLogger.error("package check finished with failures", elapsed());
+			task?.fail("package check finished with failures");
+		}
+		return passed;
+	} catch (error) {
+		PackageLogger.error(`package check failed: ${formatErrorMessage$1(error)}`, elapsed());
+		task?.fail("package check failed", { error });
+		throw error;
+	}
 }
 
 //#endregion
-//#region src/commands/package.ts
-const DEFAULT_PACKAGE_CHECKS = [
-	"publint",
-	"attw",
-	"boundary"
+//#region src/package-exports.ts
+const defaultSourceExtensions = [
+	".ts",
+	".tsx",
+	".mts",
+	".cts",
+	".d.ts",
+	".d.mts",
+	".d.cts"
 ];
-const PACKAGE_CHECK_TOOLS = new Set(DEFAULT_PACKAGE_CHECKS);
-const ATTW_PROFILE_IGNORED_RESOLUTIONS = {
-	strict: [],
-	node16: [],
-	"esm-only": ["node16-cjs"]
-};
-const nodeBuiltinSpecifiers = new Set(builtinModules.flatMap((specifier) => specifier.startsWith("node:") ? [specifier, specifier.slice(5)] : [specifier, `node:${specifier}`]));
-const REQUIRED_PUBLIC_PACKAGE_FILES = ["README.md", "LICENSE.md"];
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isPackageCheckTool(value) {
-	return PACKAGE_CHECK_TOOLS.has(value);
-}
-function isRelativeOrAbsoluteSpecifier(specifier) {
-	return specifier.startsWith(".") || specifier.startsWith("/") || specifier.startsWith("file:") || specifier.startsWith("http:") || specifier.startsWith("https:") || specifier.startsWith("data:");
+const defaultConditionPriority = [
+	"source",
+	"development",
+	"types",
+	"import",
+	"module",
+	"default",
+	"require"
+];
+const defaultArtifactDirectories = [
+	"dist",
+	"build",
+	"lib",
+	"esm",
+	"cjs",
+	"out"
+];
+function configuredArtifactDirectories(config) {
+	return config.paths?.artifactDirectories ?? defaultArtifactDirectories;
 }
-function toArrayBuffer(buffer) {
-	return buffer.buffer.slice(buffer.byteOffset, buffer.byteOffset + buffer.byteLength);
+function configuredSourceExtensions(config) {
+	return config.paths?.sourceExtensions ?? defaultSourceExtensions;
 }
-function collectSelfSpecifierMatchers(packageName, exportsField) {
-	const exact = new Set([packageName]);
-	const prefixes = [];
-	if (!isRecord(exportsField)) return {
-		exact,
-		prefixes
-	};
-	for (const exportKey of Object.keys(exportsField)) {
-		if (exportKey === ".") {
-			exact.add(packageName);
-			continue;
-		}
-		if (!exportKey.startsWith("./")) continue;
-		const normalizedSubpath = exportKey.slice(2);
-		if (normalizedSubpath.length === 0) continue;
-		const wildcardIndex = normalizedSubpath.indexOf("*");
-		if (wildcardIndex !== -1) {
-			prefixes.push(`${packageName}/${normalizedSubpath.slice(0, wildcardIndex)}`);
-			continue;
-		}
-		exact.add(`${packageName}/${normalizedSubpath}`);
+function collectTargetCandidates(config, value) {
+	if (typeof value === "string") return [value];
+	if (!value || typeof value !== "object" || Array.isArray(value)) return [];
+	const record = value;
+	const candidates = [];
+	const visitedKeys = /* @__PURE__ */ new Set();
+	for (const key of config.paths?.conditionPriority ?? defaultConditionPriority) {
+		if (!(key in record)) continue;
+		visitedKeys.add(key);
+		candidates.push(...collectTargetCandidates(config, record[key]));
 	}
-	return {
-		exact,
-		prefixes
-	};
-}
-function isAllowedSelfSpecifier(specifier, matchers) {
-	return matchers.exact.has(specifier) || matchers.prefixes.some((prefix) => specifier.startsWith(prefix));
+	for (const key of Object.keys(record).sort()) {
+		if (visitedKeys.has(key)) continue;
+		candidates.push(...collectTargetCandidates(config, record[key]));
+	}
+	return candidates;
 }
-function normalizePublishedModulePath(relativeFilePath) {
-	return relativeFilePath.replaceAll("\\", "/");
+function normalizePackageTarget(target) {
+	if (!target.startsWith("./")) return null;
+	return target.slice(2);
 }
-function classifyRuntimeEnvironment(target, relativeFilePath) {
-	if (typeof target.environment === "function") return target.environment(relativeFilePath);
-	if (target.environment) return target.environment;
-	const normalizedPath = normalizePublishedModulePath(relativeFilePath);
-	return normalizedPath.startsWith("node/") || normalizedPath.startsWith("plugin/") ? "node" : "browser";
+function packageExportKeyToAlias(packageName, exportKey) {
+	if (exportKey === ".") return packageName;
+	if (!exportKey.startsWith("./")) return "";
+	return `${packageName}/${exportKey.slice(2)}`;
 }
-async function collectPublishedModuleFiles(directoryPath) {
-	const entries = await readdir(directoryPath, { withFileTypes: true });
-	const files = [];
-	for (const entry of entries) {
-		const absolutePath = path.join(directoryPath, entry.name);
-		if (entry.isDirectory()) {
-			files.push(...await collectPublishedModuleFiles(absolutePath));
-			continue;
-		}
-		if (/\.[cm]?js$/u.test(entry.name)) files.push(absolutePath);
-	}
-	return files;
+function removeKnownExtension(filePath) {
+	for (const extension of [
+		".d.mts",
+		".d.cts",
+		".d.ts",
+		".mts",
+		".cts",
+		".mjs",
+		".cjs",
+		".js",
+		".tsx",
+		".ts"
+	]) if (filePath.endsWith(extension)) return filePath.slice(0, -extension.length);
+	return filePath;
 }
-function validatePublishedSpecifier(options) {
-	const { allowedExternalPackages, environment, packageName, selfSpecifiers, specifier } = options;
-	if (isRelativeOrAbsoluteSpecifier(specifier)) return null;
-	if (nodeBuiltinSpecifiers.has(specifier)) {
-		if (environment === "node") return null;
-		return `browser/runtime output must not import Node builtin "${specifier}"`;
-	}
-	const packageRoot = getPackageRootSpecifier(specifier);
-	if (packageRoot === packageName) {
-		if (isAllowedSelfSpecifier(specifier, selfSpecifiers)) return null;
-		return `self import "${specifier}" is not exposed by output package.json exports`;
-	}
-	if (allowedExternalPackages.has(packageRoot)) return null;
-	return `"${specifier}" resolves to package "${packageRoot}" which is not listed in dependencies, peerDependencies, optionalDependencies, or self exports`;
+function hasConfiguredSourceExtension(config, target) {
+	return configuredSourceExtensions(config).some((extension) => target.endsWith(extension));
 }
-function formatAttwProblem(problem) {
-	const resolutionKind = "resolutionKind" in problem ? ` [resolution: ${problem.resolutionKind}]` : "";
-	const entrypoint = "entrypoint" in problem ? ` [entrypoint: ${problem.entrypoint}]` : "";
-	switch (problem.kind) {
-		case "NoResolution": return `No resolution${resolutionKind}${entrypoint}`;
-		case "UntypedResolution": return `Untyped resolution${resolutionKind}${entrypoint}`;
-		case "FalseESM": return `False ESM: ${problem.typesFileName} -> ${problem.implementationFileName}`;
-		case "FalseCJS": return `False CJS: ${problem.typesFileName} -> ${problem.implementationFileName}`;
-		case "CJSResolvesToESM": return `CJS resolves to ESM${resolutionKind}${entrypoint}`;
-		case "FallbackCondition": return `Fallback condition used${resolutionKind}${entrypoint}`;
-		case "NamedExports": return problem.isMissingAllNamed ? `Named exports missing: all named exports [types: ${problem.typesFileName}] [implementation: ${problem.implementationFileName}]` : `Named exports missing: ${problem.missing.join(", ") || "(none)"} [types: ${problem.typesFileName}] [implementation: ${problem.implementationFileName}]`;
-		case "FalseExportDefault": return `False export default [types: ${problem.typesFileName}] [implementation: ${problem.implementationFileName}]`;
-		case "MissingExportEquals": return `Missing export equals [types: ${problem.typesFileName}] [implementation: ${problem.implementationFileName}]`;
-		case "InternalResolutionError": return `Internal resolution error in ${problem.fileName} [option: ${problem.resolutionOption}] [module: ${problem.moduleSpecifier}]`;
-		case "UnexpectedModuleSyntax": return `Unexpected module syntax in ${problem.fileName}`;
-		case "CJSOnlyExportsDefault": return `CJS only exports default in ${problem.fileName}`;
-		default: return `Unknown ATTW problem: ${JSON.stringify(problem)}`;
-	}
+function isInsideArtifactDirectory(config, target) {
+	const normalizedTarget = normalizeSlashes(target);
+	return configuredArtifactDirectories(config).some((directoryName) => {
+		const normalizedDirectoryName = normalizeSlashes(directoryName).replace(/\/+$/u, "");
+		return normalizedTarget === normalizedDirectoryName || normalizedTarget.startsWith(`${normalizedDirectoryName}/`);
+	});
 }
-function normalizeTargetChecks(target) {
-	const checks = target.checks ?? DEFAULT_PACKAGE_CHECKS;
-	const normalizedChecks = [];
-	for (const check of checks) {
-		if (!isPackageCheckTool(check)) throw new Error(`Invalid package check "${check}". Expected one of: publint, attw, boundary.`);
-		if (!normalizedChecks.includes(check)) normalizedChecks.push(check);
+function isLikelySourceTarget(config, target) {
+	return hasConfiguredSourceExtension(config, target) && !isInsideArtifactDirectory(config, target);
+}
+function stripArtifactPrefix(config, target) {
+	const normalizedTarget = normalizeSlashes(target);
+	for (const directoryName of configuredArtifactDirectories(config)) {
+		const normalizedDirectoryName = normalizeSlashes(directoryName).replace(/\/+$/u, "");
+		if (normalizedTarget.startsWith(`${normalizedDirectoryName}/`)) return normalizedTarget.slice(normalizedDirectoryName.length + 1);
 	}
-	return normalizedChecks;
+	return normalizedTarget;
 }
-function selectTargetChecks(target, requestedTool) {
-	const configuredChecks = normalizeTargetChecks(target);
-	if (!requestedTool || requestedTool === "all") return configuredChecks;
-	return configuredChecks.includes(requestedTool) ? [requestedTool] : [];
+function sourceFileCandidates(config, target) {
+	const normalizedTarget = normalizeSlashes(target);
+	const withoutKnownExtension = removeKnownExtension(normalizedTarget);
+	const withoutArtifactPrefix = stripArtifactPrefix(config, normalizedTarget);
+	const sourceBase = removeKnownExtension(withoutArtifactPrefix);
+	const bases = withoutArtifactPrefix === normalizedTarget ? [
+		withoutKnownExtension,
+		sourceBase,
+		`src/${sourceBase}`,
+		`${sourceBase}/index`,
+		`src/${sourceBase}/index`
+	] : [
+		sourceBase,
+		`src/${sourceBase}`,
+		`${sourceBase}/index`,
+		`src/${sourceBase}/index`
+	];
+	const candidates = [];
+	for (const base of bases) for (const extension of configuredSourceExtensions(config)) candidates.push(`${base}${extension}`);
+	return [...new Set(candidates)];
 }
-function findNearestPackageJsonPath(cwd, rootDir) {
-	const resolvedRootDir = path.resolve(rootDir);
-	let currentDir = path.resolve(cwd);
-	while (true) {
-		const relativeToRoot = path.relative(resolvedRootDir, currentDir);
-		if (!(relativeToRoot === "" || relativeToRoot !== ".." && !relativeToRoot.startsWith(`..${path.sep}`) && !path.isAbsolute(relativeToRoot))) return;
-		const packageJsonPath = path.join(currentDir, "package.json");
-		if (existsSync(packageJsonPath)) return packageJsonPath;
-		if (currentDir === resolvedRootDir) return;
-		const parentDir = path.dirname(currentDir);
-		if (parentDir === currentDir) return;
-		currentDir = parentDir;
-	}
+function wildcardBaseDirectory(pattern) {
+	const wildcardIndex = pattern.indexOf("*");
+	const prefix = wildcardIndex === -1 ? pattern : pattern.slice(0, wildcardIndex);
+	const lastSlashIndex = prefix.lastIndexOf("/");
+	return lastSlashIndex === -1 ? "." : prefix.slice(0, lastSlashIndex);
 }
-function readCwdPackageName(cwd, rootDir) {
-	const packageJsonPath = findNearestPackageJsonPath(cwd, rootDir);
-	if (!packageJsonPath) return;
-	try {
-		const manifest = JSON.parse(readFileSync(packageJsonPath, "utf8"));
-		return typeof manifest.name === "string" && manifest.name.trim() ? manifest.name.trim() : void 0;
-	} catch (error) {
-		throw new Error(`Unable to read package name from ${packageJsonPath}: ${formatErrorMessage$1(error)}`);
+function sourceWildcardPatternCandidates(config, target) {
+	const strippedPattern = stripArtifactPrefix(config, target);
+	const sourcePattern = removeKnownExtension(strippedPattern);
+	const preferSrcPrefix = strippedPattern !== normalizeSlashes(target);
+	const candidates = [];
+	for (const extension of configuredSourceExtensions(config)) if (preferSrcPrefix) {
+		candidates.push(`src/${sourcePattern}${extension}`);
+		candidates.push(`${sourcePattern}${extension}`);
+	} else {
+		candidates.push(`${sourcePattern}${extension}`);
+		candidates.push(`src/${sourcePattern}${extension}`);
 	}
+	return [...new Set(candidates)];
 }
-function formatConfiguredTargetNames(targets) {
-	const names = targets.map((target) => target.name).filter((name) => Boolean(name));
-	return names.length > 0 ? names.join(", ") : "(none)";
-}
-function resolveTargetOutDir(options) {
-	const outDir = options.target.outDir;
-	if (typeof outDir !== "string" || outDir.trim().length === 0) throw new Error(`Invalid package check target at packageChecks.targets[${options.targetIndex}].outDir. Expected a non-empty string.`);
-	return path.resolve(options.config.rootDir, outDir);
+function resolveWildcardTarget(config, packageDirectory, target) {
+	const sourcePatterns = sourceWildcardPatternCandidates(config, target);
+	const candidatePatterns = isLikelySourceTarget(config, target) ? [target, ...sourcePatterns] : sourcePatterns;
+	for (const candidatePattern of candidatePatterns) {
+		const baseDirectory = wildcardBaseDirectory(candidatePattern);
+		if (existsSync(path.join(packageDirectory, baseDirectory))) return toPosixPath(path.join(toRelativePath(config.rootDir, packageDirectory), candidatePattern));
+	}
+	return null;
 }
-function getTargetLabel(config, target, outDir) {
-	return target.name ?? toRelativePath(config.rootDir, outDir);
+function resolveExactTarget(config, packageDirectory, target) {
+	const absoluteTarget = path.join(packageDirectory, target);
+	if (existsSync(absoluteTarget) && isLikelySourceTarget(config, target)) return normalizeWorkspacePath(config.rootDir, absoluteTarget);
+	for (const candidate of sourceFileCandidates(config, target)) {
+		const absoluteCandidate = path.join(packageDirectory, candidate);
+		if (existsSync(absoluteCandidate)) return normalizeWorkspacePath(config.rootDir, absoluteCandidate);
+	}
+	return null;
 }
-function createTargetPlan(options) {
-	const outDir = resolveTargetOutDir({
-		config: options.config,
-		target: options.target,
-		targetIndex: options.targetIndex
-	});
-	return {
-		checks: selectTargetChecks(options.target, options.requestedTool),
-		label: getTargetLabel(options.config, options.target, outDir),
-		outDir,
-		rawTarget: options.target
-	};
+function resolvePackageTarget(config, packageDirectory, rawTarget) {
+	const target = normalizePackageTarget(rawTarget);
+	if (!target) return null;
+	if (target.includes("*")) return resolveWildcardTarget(config, packageDirectory, target);
+	return resolveExactTarget(config, packageDirectory, target);
 }
-function createPackageCheckPlan(options) {
-	const targets = options.config.packageChecks?.targets ?? [];
-	if (targets.length === 0) throw new Error("No package check targets are configured.");
-	let selectedTargets;
-	let selectionReason;
-	if (options.targetName) {
-		selectedTargets = targets.filter((target) => target.name === options.targetName);
-		if (selectedTargets.length === 0) throw new Error([`No package check target named "${options.targetName}" is configured.`, `Configured target names: ${formatConfiguredTargetNames(targets)}.`].join(" "));
-		selectionReason = `--package "${options.targetName}" matched configured target name.`;
-	} else {
-		const cwdPackageName = readCwdPackageName(options.cwd, options.config.rootDir);
-		if (cwdPackageName) {
-			selectedTargets = targets.filter((target) => target.name === cwdPackageName);
-			if (selectedTargets.length > 0) selectionReason = `nearest package.json name "${cwdPackageName}" matched configured target name.`;
-			else {
-				selectedTargets = targets;
-				selectionReason = `nearest package.json name "${cwdPackageName}" did not match configured target names; running all configured targets.`;
+function collectExportEntries(config, workspacePackage) {
+	const exportsField = workspacePackage.manifest.exports;
+	if (!exportsField) return [];
+	const exportEntries = typeof exportsField === "object" && exportsField !== null && !Array.isArray(exportsField) && Object.keys(exportsField).some((key) => key.startsWith(".")) ? Object.entries(exportsField) : [[".", exportsField]];
+	const entries = [];
+	for (const [exportKey, exportValue] of exportEntries.sort(([left], [right]) => left.localeCompare(right))) {
+		const alias = packageExportKeyToAlias(workspacePackage.name, exportKey);
+		if (!alias) continue;
+		for (const candidate of collectTargetCandidates(config, exportValue)) {
+			const resolvedTarget = resolvePackageTarget(config, workspacePackage.directory, candidate);
+			if (resolvedTarget) {
+				entries.push([alias, resolvedTarget]);
+				break;
 			}
-		} else {
-			selectedTargets = targets;
-			selectionReason = "No package name was found from cwd up to the workspace root; running all configured targets.";
 		}
 	}
-	return {
-		selectionReason,
-		targets: selectedTargets.map((target) => createTargetPlan({
-			config: options.config,
-			requestedTool: options.tool,
-			target,
-			targetIndex: targets.indexOf(target)
-		}))
-	};
+	return entries;
 }
-function logPackageCheckPlan(options) {
-	PackageLogger.info([
-		"Package check plan:",
-		`  config: ${toRelativePath(options.config.rootDir, options.config.configPath)}`,
-		`  cwd: ${toRelativePath(options.config.rootDir, options.cwd)}`,
-		`  selection: ${options.plan.selectionReason}`,
-		"  targets:",
-		...options.plan.targets.map((target) => [
-			`    - ${target.label}`,
-			`      outDir: ${toRelativePath(options.config.rootDir, target.outDir)}`,
-			`      checks: ${target.checks.length > 0 ? target.checks.join(", ") : "(none)"}`
-		].join("\n"))
-	].join("\n"));
+function aliasMatchesSpecifier(alias, specifier) {
+	if (alias === specifier) return true;
+	const wildcardIndex = alias.indexOf("*");
+	if (wildcardIndex === -1) return false;
+	const prefix = alias.slice(0, wildcardIndex);
+	const suffix = alias.slice(wildcardIndex + 1);
+	return specifier.startsWith(prefix) && specifier.endsWith(suffix);
 }
-async function packOutputTarball(outDir) {
-	const destination = await mkdtemp(path.join(tmpdir(), "__LIMINA_PACKAGE__"));
-	return {
-		cleanup: async () => {
-			await rm(destination, {
-				force: true,
-				recursive: true
-			}).catch(() => null);
-		},
-		tarball: await readFile(await pack(outDir, {
-			destination,
-			ignoreScripts: true,
-			packageManager: "pnpm"
-		}))
-	};
+
+//#endregion
+//#region src/commands/paths.ts
+function generatedFileName(config) {
+	return config.paths?.generatedFileName ?? "tsconfig.dts.paths.generated.json";
 }
-async function readDistPackageJson(options) {
-	if (!existsSync(options.packageJsonPath)) throw new Error(`outDir package.json not found${options.label ? ` for ${options.label}` : ""} at ${options.config ? toRelativePath(options.config.rootDir, options.packageJsonPath) : options.packageJsonPath}. Run the package build first.`);
-	return JSON.parse(await readFile(options.packageJsonPath, "utf8"));
+function generatedFileMarker(config) {
+	return config.paths?.generatedFileMarker ?? "GENERATED FILE - DO NOT EDIT BY HAND.";
 }
-async function assertPublicPackageMetadata(options) {
-	const manifest = await readDistPackageJson({
-		config: options.config,
-		label: options.label,
-		packageJsonPath: options.packageJsonPath
+function parseProject(config, configPath) {
+	const diagnostics = [];
+	const parsed = ts.getParsedCommandLineOfConfigFile(configPath, {}, {
+		...ts.sys,
+		onUnRecoverableConfigFileDiagnostic: (diagnostic) => {
+			diagnostics.push(diagnostic);
+		}
 	});
-	if (manifest.private === true) return manifest;
-	const missingFiles = REQUIRED_PUBLIC_PACKAGE_FILES.filter((fileName) => !existsSync(path.join(options.outDir, fileName)));
-	if (missingFiles.length === 0) return manifest;
-	throw new Error(`publishable package output for ${options.label} at ${toRelativePath(options.config.rootDir, options.outDir)} is missing required file(s): ${missingFiles.join(", ")}. Add them to the built output or set "private": true in the output package.json.`);
-}
-async function runPublintCheck(options) {
-	const task = options.flow?.start(`publint: ${options.label}`, { depth: options.flowDepth ?? 0 });
-	PackageLogger.info(`publint started: ${options.label}`);
-	const publintElapsed = createElapsedTimer();
-	const { messages, pkg } = await publint({
-		pack: { tarball: toArrayBuffer(options.tarball) },
-		strict: options.strict
-	});
-	if (messages.length === 0) {
-		if (!options.flow?.interactive) PackageLogger.success(`publint passed: ${options.label}`, publintElapsed());
-		task?.pass();
-		return true;
-	}
-	for (const message of messages) {
-		const rendered = formatMessage(message, pkg) ?? message.code;
-		if (message.type === "error") {
-			PackageLogger.error(`[${options.label}] [publint] ${rendered}`);
-			continue;
-		}
-		if (message.type === "warning") {
-			PackageLogger.warn(`[${options.label}] [publint] ${rendered}`);
-			continue;
-		}
-		PackageLogger.info(`[${options.label}] [publint] ${rendered}`);
-	}
-	PackageLogger.error(`publint found ${messages.length} issue(s): ${options.label}`, publintElapsed());
-	task?.fail(`publint found ${messages.length} issue(s): ${options.label}`);
-	return false;
-}
-async function runAttwCheck(options) {
-	const task = options.flow?.start(`attw: ${options.label}`, { depth: options.flowDepth ?? 0 });
-	PackageLogger.info(`attw started: ${options.label} (profile: ${options.profile})`);
-	const attwElapsed = createElapsedTimer();
-	const result = await checkPackage(createPackageFromTarballData(options.tarball));
-	if (!result.types) {
-		PackageLogger.error(`[${options.label}] [attw] package has no types`);
-		PackageLogger.error(`attw failed: ${options.label}`, attwElapsed());
-		task?.fail(`attw failed: ${options.label}`);
-		return false;
-	}
-	const ignoredResolutions = ATTW_PROFILE_IGNORED_RESOLUTIONS[options.profile];
-	const problems = result.problems.filter((problem) => {
-		if ("resolutionKind" in problem) return !ignoredResolutions.includes(problem.resolutionKind);
-		return true;
-	});
-	if (problems.length === 0) {
-		if (!options.flow?.interactive) PackageLogger.success(`attw passed: ${options.label}`, attwElapsed());
-		task?.pass();
-		return true;
-	}
-	for (const problem of problems) PackageLogger.error(`[${options.label}] [attw] ${formatAttwProblem(problem)}`);
-	PackageLogger.error(`attw found ${problems.length} problem(s): ${options.label}`, attwElapsed());
-	task?.fail(`attw found ${problems.length} problem(s): ${options.label}`);
-	return false;
-}
-async function runBoundaryCheck(target, label, options = {}) {
-	const task = options.flow?.start(`package boundary: ${label}`, { depth: options.flowDepth ?? 0 });
-	PackageLogger.info(`package boundary started: ${label}`);
-	const boundaryElapsed = createElapsedTimer();
-	const violations = await auditPublishedPackageBoundaries(target);
-	if (violations.length === 0) {
-		if (!options.flow?.interactive) PackageLogger.success(`package boundary passed: ${label}`, boundaryElapsed());
-		task?.pass();
-		return true;
-	}
-	for (const violation of violations) PackageLogger.error(`[${label}] [boundary] ${violation.filePath} (${violation.environment}) imports "${violation.specifier}": ${violation.message}`);
-	PackageLogger.error(`package boundary found ${violations.length} issue(s): ${label}`, boundaryElapsed());
-	task?.fail(`package boundary found ${violations.length} issue(s): ${label}`);
-	return false;
-}
-async function runPackageCheckTarget(options) {
-	const target = {
-		...options.rawTarget,
-		outDir: options.outDir
-	};
-	const label = options.label;
-	const outputPackageJsonPath = path.join(target.outDir, "package.json");
-	const task = options.flow?.start(`package target: ${label}`, { depth: options.flowDepth ?? 0 });
-	let packedDist;
-	try {
-		const outputManifest = await assertPublicPackageMetadata({
-			config: options.config,
-			label,
-			outDir: target.outDir,
-			packageJsonPath: outputPackageJsonPath
-		});
-		if (outputManifest.private !== true || options.checks.includes("publint") || options.checks.includes("attw")) {
-			const packTask = options.flow?.start(`package tarball: ${label}`, { depth: (options.flowDepth ?? 0) + 1 });
-			PackageLogger.info(`package tarball packing started: ${label}`);
-			const packElapsed = createElapsedTimer();
-			try {
-				packedDist = await packOutputTarball(target.outDir);
-			} catch (error) {
-				PackageLogger.error(`package tarball failed: ${label}: ${formatErrorMessage$1(error)}`, packElapsed());
-				packTask?.fail(`package tarball failed: ${label}`, { error });
-				throw error;
-			}
-			if (!options.flow?.interactive) PackageLogger.success(`package tarball packed: ${label}`, packElapsed());
-			packTask?.pass();
-		}
-		if (outputManifest.private !== true) try {
-			await assertPackageReleaseConsistency({
-				config: options.config,
-				label,
-				outDir: target.outDir,
-				outputManifest,
-				packedTarball: packedDist.tarball
-			});
-		} catch (error) {
-			if (!(error instanceof PackageReleaseConsistencyError)) throw error;
-			PackageLogger.error(formatErrorMessage$1(error));
-			task?.fail(`package checks failed: ${label}`);
-			return false;
-		}
-		let passed = true;
-		if (options.checks.includes("publint")) passed = await runPublintCheck({
-			flow: options.flow,
-			flowDepth: (options.flowDepth ?? 0) + 1,
-			label,
-			strict: target.publint?.strict ?? true,
-			tarball: packedDist.tarball
-		}) && passed;
-		if (options.checks.includes("attw")) passed = await runAttwCheck({
-			flow: options.flow,
-			flowDepth: (options.flowDepth ?? 0) + 1,
-			label,
-			profile: options.attwProfile ?? target.attw?.profile ?? "esm-only",
-			tarball: packedDist.tarball
-		}) && passed;
-		if (options.checks.includes("boundary")) passed = await runBoundaryCheck({
-			...target.boundary,
-			outDir: target.outDir
-		}, label, {
-			flow: options.flow,
-			flowDepth: (options.flowDepth ?? 0) + 1
-		}) && passed;
-		if (passed) {
-			if (!options.flow?.interactive) PackageLogger.success(`package checks passed: ${label}`);
-			task?.pass();
-		} else {
-			PackageLogger.error(`package checks failed: ${label}`);
-			task?.fail(`package checks failed: ${label}`);
-		}
-		return passed;
-	} catch (error) {
-		PackageLogger.error(`package checks failed: ${label}: ${formatErrorMessage$1(error)}`);
-		task?.fail(`package checks failed: ${label}`, { error });
-		throw error;
-	} finally {
-		if (packedDist) await packedDist.cleanup();
-	}
-}
-async function auditPublishedPackageBoundaries(target) {
-	const manifest = await readDistPackageJson({ packageJsonPath: path.join(target.outDir, "package.json") });
-	const allowedExternalPackages = new Set([
-		...Object.keys(manifest.dependencies ?? {}),
-		...Object.keys(manifest.peerDependencies ?? {}),
-		...Object.keys(manifest.optionalDependencies ?? {}),
-		...target.ignoredExternalPackages ?? []
-	]);
-	const selfSpecifiers = collectSelfSpecifierMatchers(manifest.name, manifest.exports);
-	const publishedFiles = await collectPublishedModuleFiles(target.outDir);
-	const violations = [];
-	await init;
-	for (const filePath of publishedFiles) {
-		const relativeFilePath = path.relative(target.outDir, filePath);
-		const environment = classifyRuntimeEnvironment(target, relativeFilePath);
-		const [importSpecifiers] = parse(await readFile(filePath, "utf8"));
-		for (const importSpecifier of importSpecifiers) {
-			if (!importSpecifier.n) continue;
-			const message = validatePublishedSpecifier({
-				allowedExternalPackages,
-				environment,
-				packageName: manifest.name,
-				selfSpecifiers,
-				specifier: importSpecifier.n
-			});
-			if (!message) continue;
-			violations.push({
-				environment,
-				filePath: relativeFilePath,
-				message,
-				specifier: importSpecifier.n
-			});
-		}
-	}
-	return violations.toSorted((left, right) => {
-		if (left.filePath === right.filePath) return left.specifier.localeCompare(right.specifier);
-		return left.filePath.localeCompare(right.filePath);
-	});
-}
-async function runPackageCheck(options) {
-	if (options.clearScreen ?? true) clearCliScreen();
-	const elapsed = createElapsedTimer();
-	const cwd = path.resolve(options.cwd ?? process.cwd());
-	const task = options.flow?.start("package check", { depth: options.flowDepth ?? 0 });
-	try {
-		PackageLogger.info("package check started");
-		const plan = createPackageCheckPlan({
-			config: options.config,
-			cwd,
-			targetName: options.targetName,
-			tool: options.tool
-		});
-		logPackageCheckPlan({
-			config: options.config,
-			cwd,
-			plan
-		});
-		const runnableTargets = plan.targets.filter((target) => target.checks.length > 0);
-		if (runnableTargets.length === 0) throw new Error(options.tool && options.tool !== "all" ? `No package check targets have "${options.tool}" enabled.` : "No package checks are enabled.");
-		let passed = true;
-		for (const target of runnableTargets) passed = await runPackageCheckTarget({
-			attwProfile: options.attwProfile,
-			checks: target.checks,
-			config: options.config,
-			flow: options.flow,
-			flowDepth: (options.flowDepth ?? 0) + 1,
-			label: target.label,
-			outDir: target.outDir,
-			rawTarget: target.rawTarget
-		}) && passed;
-		if (passed) {
-			if (!options.flow?.interactive) PackageLogger.success("package check finished", elapsed());
-			task?.pass();
-		} else {
-			PackageLogger.error("package check finished with failures", elapsed());
-			task?.fail("package check finished with failures");
-		}
-		return passed;
-	} catch (error) {
-		PackageLogger.error(`package check failed: ${formatErrorMessage$1(error)}`, elapsed());
-		task?.fail("package check failed", { error });
-		throw error;
-	}
-}
-
-//#endregion
-//#region src/package-exports.ts
-const defaultSourceExtensions = [
-	".ts",
-	".tsx",
-	".mts",
-	".cts",
-	".d.ts",
-	".d.mts",
-	".d.cts"
-];
-const defaultConditionPriority = [
-	"source",
-	"development",
-	"types",
-	"import",
-	"module",
-	"default",
-	"require"
-];
-const defaultArtifactDirectories = [
-	"dist",
-	"build",
-	"lib",
-	"esm",
-	"cjs",
-	"out"
-];
-function configuredArtifactDirectories(config) {
-	return config.paths?.artifactDirectories ?? defaultArtifactDirectories;
-}
-function configuredSourceExtensions(config) {
-	return config.paths?.sourceExtensions ?? defaultSourceExtensions;
-}
-function collectTargetCandidates(config, value) {
-	if (typeof value === "string") return [value];
-	if (!value || typeof value !== "object" || Array.isArray(value)) return [];
-	const record = value;
-	const candidates = [];
-	const visitedKeys = /* @__PURE__ */ new Set();
-	for (const key of config.paths?.conditionPriority ?? defaultConditionPriority) {
-		if (!(key in record)) continue;
-		visitedKeys.add(key);
-		candidates.push(...collectTargetCandidates(config, record[key]));
-	}
-	for (const key of Object.keys(record).sort()) {
-		if (visitedKeys.has(key)) continue;
-		candidates.push(...collectTargetCandidates(config, record[key]));
-	}
-	return candidates;
-}
-function normalizePackageTarget(target) {
-	if (!target.startsWith("./")) return null;
-	return target.slice(2);
-}
-function packageExportKeyToAlias(packageName, exportKey) {
-	if (exportKey === ".") return packageName;
-	if (!exportKey.startsWith("./")) return "";
-	return `${packageName}/${exportKey.slice(2)}`;
-}
-function removeKnownExtension(filePath) {
-	for (const extension of [
-		".d.mts",
-		".d.cts",
-		".d.ts",
-		".mts",
-		".cts",
-		".mjs",
-		".cjs",
-		".js",
-		".tsx",
-		".ts"
-	]) if (filePath.endsWith(extension)) return filePath.slice(0, -extension.length);
-	return filePath;
-}
-function hasConfiguredSourceExtension(config, target) {
-	return configuredSourceExtensions(config).some((extension) => target.endsWith(extension));
-}
-function isInsideArtifactDirectory(config, target) {
-	const normalizedTarget = normalizeSlashes(target);
-	return configuredArtifactDirectories(config).some((directoryName) => {
-		const normalizedDirectoryName = normalizeSlashes(directoryName).replace(/\/+$/u, "");
-		return normalizedTarget === normalizedDirectoryName || normalizedTarget.startsWith(`${normalizedDirectoryName}/`);
-	});
-}
-function isLikelySourceTarget(config, target) {
-	return hasConfiguredSourceExtension(config, target) && !isInsideArtifactDirectory(config, target);
-}
-function stripArtifactPrefix(config, target) {
-	const normalizedTarget = normalizeSlashes(target);
-	for (const directoryName of configuredArtifactDirectories(config)) {
-		const normalizedDirectoryName = normalizeSlashes(directoryName).replace(/\/+$/u, "");
-		if (normalizedTarget.startsWith(`${normalizedDirectoryName}/`)) return normalizedTarget.slice(normalizedDirectoryName.length + 1);
-	}
-	return normalizedTarget;
-}
-function sourceFileCandidates(config, target) {
-	const normalizedTarget = normalizeSlashes(target);
-	const withoutKnownExtension = removeKnownExtension(normalizedTarget);
-	const withoutArtifactPrefix = stripArtifactPrefix(config, normalizedTarget);
-	const sourceBase = removeKnownExtension(withoutArtifactPrefix);
-	const bases = withoutArtifactPrefix === normalizedTarget ? [
-		withoutKnownExtension,
-		sourceBase,
-		`src/${sourceBase}`,
-		`${sourceBase}/index`,
-		`src/${sourceBase}/index`
-	] : [
-		sourceBase,
-		`src/${sourceBase}`,
-		`${sourceBase}/index`,
-		`src/${sourceBase}/index`
-	];
-	const candidates = [];
-	for (const base of bases) for (const extension of configuredSourceExtensions(config)) candidates.push(`${base}${extension}`);
-	return [...new Set(candidates)];
-}
-function wildcardBaseDirectory(pattern) {
-	const wildcardIndex = pattern.indexOf("*");
-	const prefix = wildcardIndex === -1 ? pattern : pattern.slice(0, wildcardIndex);
-	const lastSlashIndex = prefix.lastIndexOf("/");
-	return lastSlashIndex === -1 ? "." : prefix.slice(0, lastSlashIndex);
-}
-function sourceWildcardPatternCandidates(config, target) {
-	const strippedPattern = stripArtifactPrefix(config, target);
-	const sourcePattern = removeKnownExtension(strippedPattern);
-	const preferSrcPrefix = strippedPattern !== normalizeSlashes(target);
-	const candidates = [];
-	for (const extension of configuredSourceExtensions(config)) if (preferSrcPrefix) {
-		candidates.push(`src/${sourcePattern}${extension}`);
-		candidates.push(`${sourcePattern}${extension}`);
-	} else {
-		candidates.push(`${sourcePattern}${extension}`);
-		candidates.push(`src/${sourcePattern}${extension}`);
-	}
-	return [...new Set(candidates)];
-}
-function resolveWildcardTarget(config, packageDirectory, target) {
-	const sourcePatterns = sourceWildcardPatternCandidates(config, target);
-	const candidatePatterns = isLikelySourceTarget(config, target) ? [target, ...sourcePatterns] : sourcePatterns;
-	for (const candidatePattern of candidatePatterns) {
-		const baseDirectory = wildcardBaseDirectory(candidatePattern);
-		if (existsSync(path.join(packageDirectory, baseDirectory))) return toPosixPath(path.join(toRelativePath(config.rootDir, packageDirectory), candidatePattern));
-	}
-	return null;
-}
-function resolveExactTarget(config, packageDirectory, target) {
-	const absoluteTarget = path.join(packageDirectory, target);
-	if (existsSync(absoluteTarget) && isLikelySourceTarget(config, target)) return normalizeWorkspacePath(config.rootDir, absoluteTarget);
-	for (const candidate of sourceFileCandidates(config, target)) {
-		const absoluteCandidate = path.join(packageDirectory, candidate);
-		if (existsSync(absoluteCandidate)) return normalizeWorkspacePath(config.rootDir, absoluteCandidate);
-	}
-	return null;
-}
-function resolvePackageTarget(config, packageDirectory, rawTarget) {
-	const target = normalizePackageTarget(rawTarget);
-	if (!target) return null;
-	if (target.includes("*")) return resolveWildcardTarget(config, packageDirectory, target);
-	return resolveExactTarget(config, packageDirectory, target);
-}
-function collectExportEntries(config, workspacePackage) {
-	const exportsField = workspacePackage.manifest.exports;
-	if (!exportsField) return [];
-	const exportEntries = typeof exportsField === "object" && exportsField !== null && !Array.isArray(exportsField) && Object.keys(exportsField).some((key) => key.startsWith(".")) ? Object.entries(exportsField) : [[".", exportsField]];
-	const entries = [];
-	for (const [exportKey, exportValue] of exportEntries.sort(([left], [right]) => left.localeCompare(right))) {
-		const alias = packageExportKeyToAlias(workspacePackage.name, exportKey);
-		if (!alias) continue;
-		for (const candidate of collectTargetCandidates(config, exportValue)) {
-			const resolvedTarget = resolvePackageTarget(config, workspacePackage.directory, candidate);
-			if (resolvedTarget) {
-				entries.push([alias, resolvedTarget]);
-				break;
-			}
-		}
-	}
-	return entries;
-}
-function aliasMatchesSpecifier(alias, specifier) {
-	if (alias === specifier) return true;
-	const wildcardIndex = alias.indexOf("*");
-	if (wildcardIndex === -1) return false;
-	const prefix = alias.slice(0, wildcardIndex);
-	const suffix = alias.slice(wildcardIndex + 1);
-	return specifier.startsWith(prefix) && specifier.endsWith(suffix);
-}
-
-//#endregion
-//#region src/commands/paths.ts
-function generatedFileName(config) {
-	return config.paths?.generatedFileName ?? "tsconfig.dts.paths.generated.json";
-}
-function generatedFileMarker(config) {
-	return config.paths?.generatedFileMarker ?? "GENERATED FILE - DO NOT EDIT BY HAND.";
-}
-function parseProject(config, configPath) {
-	const diagnostics = [];
-	const parsed = ts.getParsedCommandLineOfConfigFile(configPath, {}, {
-		...ts.sys,
-		onUnRecoverableConfigFileDiagnostic: (diagnostic) => {
-			diagnostics.push(diagnostic);
-		}
-	});
-	if (!parsed) throw new Error(ts.formatDiagnosticsWithColorAndContext(diagnostics, {
-		getCanonicalFileName: (fileName) => fileName,
-		getCurrentDirectory: () => config.rootDir,
-		getNewLine: () => "\n"
-	}));
-	if (parsed.errors.length > 0) throw new Error(ts.formatDiagnosticsWithColorAndContext(parsed.errors, {
-		getCanonicalFileName: (fileName) => fileName,
-		getCurrentDirectory: () => config.rootDir,
-		getNewLine: () => "\n"
-	}));
-	return {
-		configPath: normalizeAbsolutePath(configPath),
-		fileNames: parsed.fileNames.filter((fileName) => /\.(?:[cm]?tsx?|d\.[cm]?ts)$/u.test(fileName)).map(normalizeAbsolutePath),
-		options: parsed.options,
-		references: new Set(getRawReferencePaths(config, configPath))
-	};
+	if (!parsed) throw new Error(ts.formatDiagnosticsWithColorAndContext(diagnostics, {
+		getCanonicalFileName: (fileName) => fileName,
+		getCurrentDirectory: () => config.rootDir,
+		getNewLine: () => "\n"
+	}));
+	if (parsed.errors.length > 0) throw new Error(ts.formatDiagnosticsWithColorAndContext(parsed.errors, {
+		getCanonicalFileName: (fileName) => fileName,
+		getCurrentDirectory: () => config.rootDir,
+		getNewLine: () => "\n"
+	}));
+	return {
+		configPath: normalizeAbsolutePath(configPath),
+		fileNames: parsed.fileNames.filter((fileName) => /\.(?:[cm]?tsx?|d\.[cm]?ts)$/u.test(fileName)).map(normalizeAbsolutePath),
+		options: parsed.options,
+		references: new Set(getRawReferencePaths(config, configPath))
+	};
 }
 function getSourceFileKind(filePath) {
 	if (filePath.endsWith(".tsx")) return ts.ScriptKind.TSX;
@@ -1836,564 +1477,1103 @@ async function collectTsconfigPaths(config, pattern) {
 		]
 	})).map(normalizeAbsolutePath).sort();
 }
-async function collectDtsConfigPaths(config) {
-	return collectTsconfigPaths(config, dtsConfigPattern);
+async function collectDtsConfigPaths(config) {
+	return collectTsconfigPaths(config, dtsConfigPattern);
+}
+async function collectBuildGraphConfigPaths(config) {
+	return collectTsconfigPaths(config, buildGraphConfigPattern);
+}
+async function collectDefaultTsconfigPaths(config) {
+	return collectTsconfigPaths(config, tsconfigJsonPattern);
+}
+async function collectOrdinaryTypecheckConfigPaths(config) {
+	return (await collectTsconfigPaths(config, tsconfigFilePattern)).filter(isOrdinaryTypecheckConfigPath);
+}
+function isPlainRecord(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function formatUnknownValue(value) {
+	if (value === void 0) return "undefined";
+	return JSON.stringify(value);
+}
+function hasGlobSyntax(pattern) {
+	return /[*?[\]{}()!+@]/u.test(pattern);
+}
+function isDirectoryShorthand(pattern) {
+	return !hasGlobSyntax(pattern) && !pattern.includes("/") && !path.extname(pattern);
+}
+function normalizeSourceExcludePattern(pattern) {
+	const normalized = pattern.replaceAll("\\", "/").replace(/\/+$/u, "");
+	if (!normalized) return [];
+	if (isDirectoryShorthand(normalized)) return [`${normalized}/**`, `**/${normalized}/**`];
+	if (hasGlobSyntax(normalized)) return [normalized];
+	if (normalized.includes("/")) return [normalized, `${normalized}/**`];
+	return [normalized, `**/${normalized}`];
+}
+function sourceIncludePatterns(config) {
+	if (config.config?.source?.include) return config.config.source.include;
+	return getActiveCheckerExtensions(config).map((extension) => `**/*${extension}`);
+}
+function sourceExcludePatterns(config) {
+	return (config.config?.source?.exclude ?? defaultSourceExclude).flatMap(normalizeSourceExcludePattern);
+}
+async function collectExpectedSourceFiles(config) {
+	const proofFilePattern = config.config?.source?.include !== void 0 ? null : createExtensionPattern(getActiveCheckerExtensions(config));
+	const files = await glob(sourceIncludePatterns(config), {
+		cwd: config.rootDir,
+		absolute: true,
+		ignore: sourceExcludePatterns(config),
+		onlyFiles: true
+	});
+	return new Set(files.map(normalizeAbsolutePath).filter((filePath) => proofFilePattern?.test(filePath) ?? true).sort());
+}
+function collectCheckerCoverageTargets(config) {
+	const problems = [];
+	const targets = [];
+	for (const checker of getActiveCheckers(config)) {
+		const configPath = resolveProjectConfigPath(config.rootDir, checker.entry);
+		if (!existsSync(configPath)) {
+			problems.push([
+				"Checker proof entry references a missing tsconfig:",
+				`  checker: ${checker.name}`,
+				`  config: ${toRelativePath(config.rootDir, configPath)}`
+			].join("\n"));
+			continue;
+		}
+		const routeCollection = collectGraphProjectRouteFromRoot({
+			rootConfigPath: configPath,
+			rootDir: config.rootDir
+		});
+		problems.push(...routeCollection.problems);
+		targets.push({
+			checker,
+			configPath,
+			coverageConfigPaths: routeCollection.projectPaths,
+			label: `${checker.name}:entry`
+		});
+	}
+	return {
+		problems,
+		targets
+	};
+}
+function collectConfiguredAllowlistEntries(config) {
+	const entries = [];
+	const problems = [];
+	const rawEntries = config.proof?.allowlist;
+	if (rawEntries === void 0) return {
+		entries,
+		problems
+	};
+	if (!Array.isArray(rawEntries)) {
+		problems.push([
+			"Invalid proof allowlist config:",
+			"  field: proof.allowlist",
+			`  value: ${formatUnknownValue(rawEntries)}`,
+			"  reason: proof.allowlist must be an array."
+		].join("\n"));
+		return {
+			entries,
+			problems
+		};
+	}
+	rawEntries.forEach((entry, index) => {
+		const field = `proof.allowlist[${index}]`;
+		if (!isPlainRecord(entry)) {
+			problems.push([
+				"Invalid proof allowlist config:",
+				`  field: ${field}`,
+				`  value: ${formatUnknownValue(entry)}`,
+				"  reason: allowlist entries must be objects with non-empty file and reason fields."
+			].join("\n"));
+			return;
+		}
+		const fileValue = entry.file;
+		const reasonValue = entry.reason;
+		if (typeof fileValue !== "string" || fileValue.trim().length === 0) {
+			problems.push([
+				"Invalid proof allowlist config:",
+				`  field: ${field}.file`,
+				`  value: ${formatUnknownValue(fileValue)}`,
+				"  reason: allowlist file must be a non-empty string."
+			].join("\n"));
+			return;
+		}
+		if (typeof reasonValue !== "string" || reasonValue.trim().length === 0) {
+			problems.push([
+				"Invalid proof allowlist config:",
+				`  field: ${field}.reason`,
+				`  value: ${formatUnknownValue(reasonValue)}`,
+				"  reason: allowlist reason must be a non-empty string."
+			].join("\n"));
+			return;
+		}
+		entries.push({
+			filePath: normalizeAbsolutePath(path.join(config.rootDir, fileValue)),
+			reason: reasonValue.trim()
+		});
+	});
+	return {
+		entries,
+		problems
+	};
+}
+function addCoverage(coverageByFile, filePath, source) {
+	const sources = coverageByFile.get(filePath) ?? [];
+	sources.push(source);
+	coverageByFile.set(filePath, sources);
 }
-async function collectBuildGraphConfigPaths(config) {
-	return collectTsconfigPaths(config, buildGraphConfigPattern);
+function collectCoverage(options) {
+	const coverageByFile = /* @__PURE__ */ new Map();
+	for (const route of options.graphRoutes) for (const graphProjectPath of route.projectPaths) for (const filePath of parseProjectFileNamesForExtensions(options.config, graphProjectPath, getFirstClassCoverageExtensions(route.extensions))) {
+		if (!options.sourceFiles.has(filePath)) continue;
+		addCoverage(coverageByFile, filePath, {
+			label: toRelativePath(options.config.rootDir, graphProjectPath),
+			type: "graph"
+		});
+	}
+	for (const checkerTarget of options.checkerTargets) for (const configPath of checkerTarget.coverageConfigPaths) for (const filePath of parseProjectFileNamesForExtensions(options.config, configPath, getCheckerCoverageExtensions(checkerTarget.checker))) {
+		if (!options.sourceFiles.has(filePath)) continue;
+		addCoverage(coverageByFile, filePath, {
+			label: `${toRelativePath(options.config.rootDir, configPath)} via ${checkerTarget.label}`,
+			type: "checker"
+		});
+	}
+	if (options.includeAllowlist !== false) for (const entry of options.allowlistEntries) {
+		if (!options.sourceFiles.has(entry.filePath)) continue;
+		addCoverage(coverageByFile, entry.filePath, {
+			label: entry.reason,
+			type: "allowlist"
+		});
+	}
+	return coverageByFile;
 }
-async function collectDefaultTsconfigPaths(config) {
-	return collectTsconfigPaths(config, tsconfigJsonPattern);
+function collectProjectExtensionsByPath(routes) {
+	const projectExtensionsByPath = /* @__PURE__ */ new Map();
+	for (const route of routes) for (const projectPath of route.projectPaths) {
+		const extensions = new Set([...projectExtensionsByPath.get(projectPath) ?? [], ...route.extensions]);
+		projectExtensionsByPath.set(projectPath, [...extensions].sort());
+	}
+	return projectExtensionsByPath;
 }
-async function collectOrdinaryTypecheckConfigPaths(config) {
-	return (await collectTsconfigPaths(config, tsconfigFilePattern)).filter(isOrdinaryTypecheckConfigPath);
+function parseConfig(config, configPath, extensions = []) {
+	const diagnostics = [];
+	const configObject = readJsonConfig(config, configPath);
+	const parsed = ts.parseJsonConfigFileContent(configObject, ts.sys, path.dirname(configPath), {}, configPath, void 0, createExtraFileExtensions(extensions));
+	if (diagnostics.length > 0) throw new Error(ts.formatDiagnosticsWithColorAndContext(diagnostics, createFormatHost(config.rootDir)));
+	if (parsed.errors.length > 0) throw new Error(ts.formatDiagnosticsWithColorAndContext(parsed.errors, createFormatHost(config.rootDir)));
+	return {
+		fileNames: parsed.fileNames.map(normalizeAbsolutePath).sort(),
+		options: parsed.options
+	};
 }
-function isPlainRecord(value) {
-	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+function formatJsonValue(value) {
+	return JSON.stringify(value ?? null);
 }
-function formatUnknownValue(value) {
-	if (value === void 0) return "undefined";
-	return JSON.stringify(value);
+function normalizeCompilerOptionValue(value) {
+	if (Array.isArray(value)) return value;
+	if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)));
+	return value;
 }
-function hasGlobSyntax(pattern) {
-	return /[*?[\]{}()!+@]/u.test(pattern);
+function addDtsConfigSemanticProblems(options) {
+	const dtsFileNames = new Set(options.dtsConfig.fileNames);
+	const localFileNames = new Set(options.localConfig.fileNames);
+	const onlyInDts = options.dtsConfig.fileNames.filter((fileName) => !localFileNames.has(fileName));
+	const onlyInLocal = options.localConfig.fileNames.filter((fileName) => !dtsFileNames.has(fileName));
+	if (onlyInDts.length > 0 || onlyInLocal.length > 0) options.problems.push([
+		"DTS config file set does not match its strict local tsconfig:",
+		`  config: ${toRelativePath(options.config.rootDir, options.dtsConfigPath)}`,
+		`  local: ${toRelativePath(options.config.rootDir, options.localConfigPath)}`,
+		...onlyInDts.length > 0 ? [
+			"  only in dts config:",
+			...onlyInDts.slice(0, 10).map((fileName) => `    - ${toRelativePath(options.config.rootDir, fileName)}`),
+			onlyInDts.length > 10 ? `    ... ${onlyInDts.length - 10} more` : ""
+		] : [],
+		...onlyInLocal.length > 0 ? [
+			"  only in local config:",
+			...onlyInLocal.slice(0, 10).map((fileName) => `    - ${toRelativePath(options.config.rootDir, fileName)}`),
+			onlyInLocal.length > 10 ? `    ... ${onlyInLocal.length - 10} more` : ""
+		] : []
+	].filter(Boolean).join("\n"));
+	const optionNames = new Set([...Object.keys(options.localConfig.options), ...Object.keys(options.dtsConfig.options)]);
+	for (const optionName of [...optionNames].sort()) {
+		if (ignoredSemanticCompilerOptions.has(optionName)) continue;
+		const localValue = normalizeCompilerOptionValue(options.localConfig.options[optionName]);
+		const dtsValue = normalizeCompilerOptionValue(options.dtsConfig.options[optionName]);
+		if (formatJsonValue(localValue) === formatJsonValue(dtsValue)) continue;
+		options.problems.push([
+			"DTS config overrides a typecheck compiler option from its strict local tsconfig:",
+			`  config: ${toRelativePath(options.config.rootDir, options.dtsConfigPath)}`,
+			`  local: ${toRelativePath(options.config.rootDir, options.localConfigPath)}`,
+			`  option: compilerOptions.${optionName}`,
+			`  local: ${formatJsonValue(localValue)}`,
+			`  dts: ${formatJsonValue(dtsValue)}`
+		].join("\n"));
+	}
 }
-function isDirectoryShorthand(pattern) {
-	return !hasGlobSyntax(pattern) && !pattern.includes("/") && !path.extname(pattern);
+function addDtsConfigProblems(options) {
+	for (const configPath of options.dtsConfigPaths) {
+		if (!options.graphProjectPaths.has(configPath)) options.problems.push(["DTS config is not reachable from any checker entry:", `  config: ${toRelativePath(options.config.rootDir, configPath)}`].join("\n"));
+		const localConfigPath = getDtsCompanionConfigPath(configPath);
+		if (!existsSync(localConfigPath)) {
+			options.problems.push([
+				"DTS config is missing its strict local tsconfig:",
+				`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
+				`  expected: ${toRelativePath(options.config.rootDir, localConfigPath)}`
+			].join("\n"));
+			continue;
+		}
+		const extensions = options.projectExtensionsByPath.get(configPath) ?? [];
+		const dtsConfig = parseConfig(options.config, configPath, extensions);
+		const localConfig = parseConfig(options.config, localConfigPath, extensions);
+		if (dtsConfig.options.composite !== true) options.problems.push([
+			"DTS config is not valid for tsc -b:",
+			`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
+			"  reason: final compilerOptions.composite must be true."
+		].join("\n"));
+		if (dtsConfig.options.noEmit === true) options.problems.push([
+			"DTS config is not valid for tsc -b:",
+			`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
+			"  reason: final compilerOptions.noEmit must not be true."
+		].join("\n"));
+		if (dtsConfig.options.declaration !== true) options.problems.push([
+			"DTS config is not valid for declaration emit:",
+			`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
+			"  reason: final compilerOptions.declaration must be true."
+		].join("\n"));
+		if (dtsConfig.options.emitDeclarationOnly !== true) options.problems.push([
+			"DTS config is not valid for declaration emit:",
+			`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
+			"  reason: final compilerOptions.emitDeclarationOnly must be true."
+		].join("\n"));
+		addDtsConfigSemanticProblems({
+			config: options.config,
+			dtsConfig,
+			dtsConfigPath: configPath,
+			localConfig,
+			localConfigPath,
+			problems: options.problems
+		});
+	}
 }
-function normalizeSourceExcludePattern(pattern) {
-	const normalized = pattern.replaceAll("\\", "/").replace(/\/+$/u, "");
-	if (!normalized) return [];
-	if (isDirectoryShorthand(normalized)) return [`${normalized}/**`, `**/${normalized}/**`];
-	if (hasGlobSyntax(normalized)) return [normalized];
-	if (normalized.includes("/")) return [normalized, `${normalized}/**`];
-	return [normalized, `**/${normalized}`];
+function isEmptyArray(value) {
+	return Array.isArray(value) && value.length === 0;
 }
-function sourceIncludePatterns(config) {
-	if (config.config?.source?.include) return config.config.source.include;
-	return getActiveCheckerExtensions(config).map((extension) => `**/*${extension}`);
+function formatConfigRole(role) {
+	return role === "build graph" ? "Build graph config" : "Default tsconfig.json";
 }
-function sourceExcludePatterns(config) {
-	return (config.config?.source?.exclude ?? defaultSourceExclude).flatMap(normalizeSourceExcludePattern);
+function addPureAggregatorProblems(options) {
+	const roleLabel = formatConfigRole(options.role);
+	const allowedKeys = new Set([
+		"$schema",
+		"files",
+		"references"
+	]);
+	const extraKeys = Object.keys(options.configObject).filter((key) => !allowedKeys.has(key));
+	if (!Object.hasOwn(options.configObject, "files")) options.problems.push([
+		`${roleLabel} is not a pure aggregator:`,
+		`  config: ${toRelativePath(options.config.rootDir, options.configPath)}`,
+		"  field: files",
+		"  reason: configs with project references must declare files: []."
+	].join("\n"));
+	else if (!isEmptyArray(options.configObject.files)) options.problems.push([
+		`${roleLabel} is not a pure aggregator:`,
+		`  config: ${toRelativePath(options.config.rootDir, options.configPath)}`,
+		"  field: files",
+		`  value: ${formatUnknownValue(options.configObject.files)}`,
+		"  reason: configs with project references must declare files: []."
+	].join("\n"));
+	if (extraKeys.length > 0) options.problems.push([
+		`${roleLabel} is not a pure aggregator:`,
+		`  config: ${toRelativePath(options.config.rootDir, options.configPath)}`,
+		`  fields: ${extraKeys.sort().join(", ")}`,
+		"  reason: pure aggregators may only declare $schema, files, and references; move source inputs and compiler options into leaf configs."
+	].join("\n"));
 }
-async function collectExpectedSourceFiles(config) {
-	const proofFilePattern = config.config?.source?.include !== void 0 ? null : createExtensionPattern(getActiveCheckerExtensions(config));
-	const files = await glob(sourceIncludePatterns(config), {
-		cwd: config.rootDir,
-		absolute: true,
-		ignore: sourceExcludePatterns(config),
-		onlyFiles: true
-	});
-	return new Set(files.map(normalizeAbsolutePath).filter((filePath) => proofFilePattern?.test(filePath) ?? true).sort());
+function addBuildGraphConfigProblems(options) {
+	for (const configPath of options.buildGraphConfigPaths) {
+		const configObject = readJsonConfig(options.config, configPath);
+		addPureAggregatorProblems({
+			config: options.config,
+			configObject,
+			configPath,
+			problems: options.problems,
+			role: "build graph"
+		});
+	}
 }
-function collectCheckerCoverageTargets(config) {
-	const problems = [];
-	const targets = [];
-	for (const checker of getActiveCheckers(config)) {
-		const configPath = resolveProjectConfigPath(config.rootDir, checker.entry);
-		if (!existsSync(configPath)) {
-			problems.push([
-				"Checker proof entry references a missing tsconfig:",
-				`  checker: ${checker.name}`,
-				`  config: ${toRelativePath(config.rootDir, configPath)}`
+function addDefaultTsconfigShapeProblems(options) {
+	for (const configPath of options.tsconfigPaths) {
+		const configObject = readJsonConfig(options.config, configPath);
+		if (!Object.hasOwn(configObject, "references")) continue;
+		addPureAggregatorProblems({
+			config: options.config,
+			configObject,
+			configPath,
+			problems: options.problems,
+			role: "tsconfig.json"
+		});
+		if (!Array.isArray(configObject.references)) continue;
+		configObject.references.forEach((reference, index) => {
+			if (!isPlainRecord(reference) || typeof reference.path !== "string") return;
+			const referencePath = resolveReferencePath(configPath, reference.path);
+			if (isOrdinaryTypecheckConfigPath(referencePath)) return;
+			options.problems.push([
+				"Default tsconfig.json references a non-typecheck config:",
+				`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
+				`  field: references[${index}].path`,
+				`  reference: ${reference.path}`,
+				`  resolved: ${toRelativePath(options.config.rootDir, referencePath)}`,
+				"  reason: tsconfig.json is the default IDE/typecheck entry and must not reference declaration build graph configs."
 			].join("\n"));
-			continue;
-		}
-		const routeCollection = collectGraphProjectRouteFromRoot({
-			rootConfigPath: configPath,
-			rootDir: config.rootDir
-		});
-		problems.push(...routeCollection.problems);
-		targets.push({
-			checker,
-			configPath,
-			coverageConfigPaths: routeCollection.projectPaths,
-			label: `${checker.name}:entry`
 		});
 	}
-	return {
-		problems,
-		targets
-	};
 }
-function collectConfiguredAllowlistEntries(config) {
-	const entries = [];
-	const problems = [];
-	const rawEntries = config.proof?.allowlist;
-	if (rawEntries === void 0) return {
-		entries,
-		problems
-	};
-	if (!Array.isArray(rawEntries)) {
-		problems.push([
-			"Invalid proof allowlist config:",
-			"  field: proof.allowlist",
-			`  value: ${formatUnknownValue(rawEntries)}`,
-			"  reason: proof.allowlist must be an array."
-		].join("\n"));
-		return {
-			entries,
-			problems
-		};
+function addDefaultTsconfigEnvironmentProblems(options) {
+	const configsByDirectory = /* @__PURE__ */ new Map();
+	for (const configPath of options.ordinaryConfigPaths) {
+		const directory = path.dirname(configPath);
+		const configs = configsByDirectory.get(directory) ?? [];
+		configs.push(configPath);
+		configsByDirectory.set(directory, configs);
 	}
-	rawEntries.forEach((entry, index) => {
-		const field = `proof.allowlist[${index}]`;
-		if (!isPlainRecord(entry)) {
-			problems.push([
-				"Invalid proof allowlist config:",
-				`  field: ${field}`,
-				`  value: ${formatUnknownValue(entry)}`,
-				"  reason: allowlist entries must be objects with non-empty file and reason fields."
+	for (const [directory, configPaths] of configsByDirectory.entries()) {
+		const scopedConfigPaths = configPaths.filter((configPath) => path.basename(configPath) !== "tsconfig.json");
+		if (scopedConfigPaths.length === 0) continue;
+		const defaultConfigPath = normalizeAbsolutePath(path.join(directory, "tsconfig.json"));
+		if (!existsSync(defaultConfigPath)) {
+			options.problems.push([
+				"Directory with typecheck environments is missing default tsconfig.json:",
+				`  directory: ${toRelativePath(options.config.rootDir, directory)}`,
+				"  reason: tsconfig.json is the default IDE/typecheck entry for its directory."
 			].join("\n"));
-			return;
+			continue;
 		}
-		const fileValue = entry.file;
-		const reasonValue = entry.reason;
-		if (typeof fileValue !== "string" || fileValue.trim().length === 0) {
-			problems.push([
-				"Invalid proof allowlist config:",
-				`  field: ${field}.file`,
-				`  value: ${formatUnknownValue(fileValue)}`,
-				"  reason: allowlist file must be a non-empty string."
+		if (scopedConfigPaths.length === 1) {
+			options.problems.push([
+				"Single typecheck environment should use default tsconfig.json:",
+				`  config: ${toRelativePath(options.config.rootDir, scopedConfigPaths[0])}`,
+				`  default: ${toRelativePath(options.config.rootDir, defaultConfigPath)}`,
+				"  reason: directories with only one type environment should make tsconfig.json the leaf entry."
 			].join("\n"));
-			return;
+			continue;
 		}
-		if (typeof reasonValue !== "string" || reasonValue.trim().length === 0) {
-			problems.push([
-				"Invalid proof allowlist config:",
-				`  field: ${field}.reason`,
-				`  value: ${formatUnknownValue(reasonValue)}`,
-				"  reason: allowlist reason must be a non-empty string."
+		const defaultConfigObject = readJsonConfig(options.config, defaultConfigPath);
+		if (!Object.hasOwn(defaultConfigObject, "references")) options.problems.push([
+			"Directory with multiple typecheck environments must use tsconfig.json as an aggregator:",
+			`  config: ${toRelativePath(options.config.rootDir, defaultConfigPath)}`,
+			"  reason: multiple type environments require a default IDE/typecheck aggregator."
+		].join("\n"));
+	}
+}
+function collectConfigFileOwners(config, graphRoutes, sourceFiles) {
+	const ownersByFile = /* @__PURE__ */ new Map();
+	for (const route of graphRoutes) for (const configPath of route.projectPaths) {
+		if (!existsSync(configPath)) continue;
+		for (const filePath of parseProjectFileNamesForExtensions(config, configPath, route.extensions)) {
+			if (!sourceFiles.has(filePath)) continue;
+			const owners = ownersByFile.get(filePath) ?? [];
+			owners.push(configPath);
+			ownersByFile.set(filePath, owners);
+		}
+	}
+	return ownersByFile;
+}
+function addDuplicateGraphCoverageProblems(options) {
+	for (const [filePath, owners] of [...options.ownersByFile.entries()].sort(([left], [right]) => toRelativePath(options.config.rootDir, left).localeCompare(toRelativePath(options.config.rootDir, right)))) {
+		const uniqueOwners = [...new Set(owners)];
+		if (uniqueOwners.length <= 1) continue;
+		options.problems.push([
+			"Duplicate checker graph coverage:",
+			`  file: ${toRelativePath(options.config.rootDir, filePath)}`,
+			"  covered by:",
+			...uniqueOwners.sort((left, right) => toRelativePath(options.config.rootDir, left).localeCompare(toRelativePath(options.config.rootDir, right))).map((configPath) => `    - ${toRelativePath(options.config.rootDir, configPath)}`),
+			"  reason: a checker graph file must have a single declaration owner; move the file to one dts leaf or narrow include/exclude patterns."
+		].join("\n"));
+	}
+}
+function addAllowlistProblems(options) {
+	for (const entry of options.allowlistEntries) {
+		if (!existsSync(entry.filePath)) {
+			options.problems.push(["Typecheck proof allowlist references a missing file:", `  file: ${toRelativePath(options.config.rootDir, entry.filePath)}`].join("\n"));
+			continue;
+		}
+		if (!options.sourceFiles.has(entry.filePath)) {
+			options.problems.push([
+				"Typecheck proof allowlist file is outside the configured source boundary:",
+				`  file: ${toRelativePath(options.config.rootDir, entry.filePath)}`,
+				"  reason: allowlist entries should only describe source files that proof would otherwise require coverage for."
 			].join("\n"));
-			return;
+			continue;
 		}
-		entries.push({
-			filePath: normalizeAbsolutePath(path.join(config.rootDir, fileValue)),
-			reason: reasonValue.trim()
-		});
+		if (options.baseCoverageByFile.has(entry.filePath)) options.problems.push(["Typecheck proof allowlist file is already covered without the allowlist:", `  file: ${toRelativePath(options.config.rootDir, entry.filePath)}`].join("\n"));
+	}
+}
+function addUncoveredSourceProblems(options) {
+	const uncoveredFiles = [...options.sourceFiles].filter((filePath) => !options.coverageByFile.has(filePath));
+	if (uncoveredFiles.length === 0) return;
+	options.problems.push([
+		"Source files are not covered by typecheck proof:",
+		...uncoveredFiles.slice(0, 20).map((filePath) => `  - ${toRelativePath(options.config.rootDir, filePath)}`),
+		uncoveredFiles.length > 20 ? `  ... ${uncoveredFiles.length - 20} more` : "",
+		"  reason: every file in config.source must be covered by a checker entry or an explicit allowlist entry."
+	].filter(Boolean).join("\n"));
+}
+async function runProofCheckInternal(config, options = {}) {
+	const problems = [];
+	const graphRouteCollection = collectGraphProjectRoutes(config);
+	const entryRouteCollection = collectCheckerEntryProjectRoutes(config);
+	const entryProjectPaths = [...new Set(entryRouteCollection.routes.flatMap((route) => route.projectPaths))].sort();
+	const entryProjectPathSet = new Set(entryProjectPaths);
+	const entryProjectExtensionsByPath = collectProjectExtensionsByPath(entryRouteCollection.routes);
+	const dtsConfigPaths = await collectDtsConfigPaths(config);
+	const buildGraphConfigPaths = await collectBuildGraphConfigPaths(config);
+	const defaultTsconfigPaths = await collectDefaultTsconfigPaths(config);
+	const ordinaryTypecheckConfigPaths = await collectOrdinaryTypecheckConfigPaths(config);
+	problems.push(...graphRouteCollection.problems);
+	problems.push(...entryRouteCollection.problems);
+	addDtsConfigProblems({
+		config,
+		dtsConfigPaths,
+		graphProjectPaths: entryProjectPathSet,
+		problems,
+		projectExtensionsByPath: entryProjectExtensionsByPath
+	});
+	addBuildGraphConfigProblems({
+		buildGraphConfigPaths,
+		config,
+		problems
+	});
+	addDefaultTsconfigShapeProblems({
+		config,
+		problems,
+		tsconfigPaths: defaultTsconfigPaths
+	});
+	addDefaultTsconfigEnvironmentProblems({
+		config,
+		ordinaryConfigPaths: ordinaryTypecheckConfigPaths,
+		problems
+	});
+	if (problems.length > 0) {
+		ProofLogger.error(problems.join("\n\n"));
+		return false;
+	}
+	const checkerTargetCollection = collectCheckerCoverageTargets(config);
+	const checkerTargets = checkerTargetCollection.targets;
+	problems.push(...checkerTargetCollection.problems);
+	if (problems.length > 0) {
+		ProofLogger.error(problems.join("\n\n"));
+		return false;
+	}
+	const sourceFiles = await collectExpectedSourceFiles(config);
+	const allowlistCollection = collectConfiguredAllowlistEntries(config);
+	const allowlistEntries = allowlistCollection.entries;
+	problems.push(...allowlistCollection.problems);
+	const baseCoverageByFile = collectCoverage({
+		allowlistEntries,
+		checkerTargets,
+		config,
+		graphRoutes: graphRouteCollection.routes,
+		includeAllowlist: false,
+		sourceFiles
+	});
+	const coverageByFile = collectCoverage({
+		allowlistEntries,
+		checkerTargets,
+		config,
+		graphRoutes: graphRouteCollection.routes,
+		sourceFiles
+	});
+	addDuplicateGraphCoverageProblems({
+		config,
+		ownersByFile: collectConfigFileOwners(config, graphRouteCollection.routes, sourceFiles),
+		problems
+	});
+	addAllowlistProblems({
+		allowlistEntries,
+		baseCoverageByFile,
+		config,
+		problems,
+		sourceFiles
+	});
+	addUncoveredSourceProblems({
+		config,
+		coverageByFile,
+		problems,
+		sourceFiles
 	});
+	if (problems.length > 0) {
+		ProofLogger.error(problems.join("\n\n"));
+		return false;
+	}
+	const graphFileCount = [...coverageByFile.values()].filter((sources) => sources.some((source) => source.type === "graph")).length;
+	const checkerFileCount = [...coverageByFile.values()].filter((sources) => sources.some((source) => source.type === "checker")).length;
+	if (options.logSuccess ?? true) ProofLogger.success([
+		`Checked ${entryProjectPaths.length} checker entry projects and ${dtsConfigPaths.length} dts configs.`,
+		`Graph-capable checker entries cover ${graphFileCount} files; checker entries cover ${checkerFileCount} files.`,
+		`Configured source boundary covers ${sourceFiles.size} files.`
+	].join("\n"));
+	if ((options.logSuccess ?? true) && (config.proof?.allowlist ?? []).length > 0) ProofLogger.info(`Explicit typecheck proof allowlist: ${(config.proof?.allowlist ?? []).map((entry) => entry.file).join(", ")}`);
+	return true;
+}
+async function runProofCheck(config, options = {}) {
+	if (options.clearScreen ?? true) clearCliScreen();
+	const elapsed = createElapsedTimer();
+	const task = options.flow?.start("proof check", { depth: options.flowDepth ?? 0 });
+	ProofLogger.info("proof check started");
+	try {
+		const logSuccess = !options.flow?.interactive;
+		const passed = await runProofCheckInternal(config, { logSuccess });
+		if (passed) {
+			if (logSuccess) ProofLogger.success("proof check finished", elapsed());
+			task?.pass();
+		} else {
+			ProofLogger.error("proof check finished with failures", elapsed());
+			task?.fail("proof check finished with failures");
+		}
+		return passed;
+	} catch (error) {
+		ProofLogger.error(`proof check failed: ${formatErrorMessage$1(error)}`, elapsed());
+		task?.fail("proof check failed", { error });
+		throw error;
+	}
+}
+
+//#endregion
+//#region src/package-release-consistency.ts
+var PackageReleaseConsistencyError = class extends Error {
+	name = "PackageReleaseConsistencyError";
+};
+const semver = createRequire(import.meta.url)("semver");
+const REQUIRED_RELEASE_FILES = ["README.md", "LICENSE.md"];
+const SOURCE_MAPPING_URL_PATTERN = /(?:\/\/\s*#\s*sourceMappingURL\s*=|\/\*\s*#\s*sourceMappingURL\s*=)/u;
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isLinkDependencySpecifier(specifier) {
+	return specifier.startsWith("link:");
+}
+function createReleaseConsistencyState() {
 	return {
-		entries,
-		problems
+		directWorkspaceDependencies: [],
+		edges: /* @__PURE__ */ new Map(),
+		missingWorkspaceDependencies: [],
+		packedManifestProblems: [],
+		privateWorkspaceDependencies: [],
+		releaseHygieneProblems: [],
+		registryMetadataCache: /* @__PURE__ */ new Map(),
+		registryProblems: [],
+		sourceLinkDependencies: [],
+		unpublishedPackageNames: /* @__PURE__ */ new Set(),
+		visitedPackages: /* @__PURE__ */ new Set()
 	};
 }
-function addCoverage(coverageByFile, filePath, source) {
-	const sources = coverageByFile.get(filePath) ?? [];
-	sources.push(source);
-	coverageByFile.set(filePath, sources);
+function collectPublishDependencyEntries(manifest) {
+	const entries = [];
+	for (const { dependencies, name } of getPublishDependencySections(manifest)) for (const [dependencyName, specifier] of Object.entries(dependencies)) entries.push({
+		dependencyName,
+		sectionName: name,
+		specifier
+	});
+	return entries;
 }
-function collectCoverage(options) {
-	const coverageByFile = /* @__PURE__ */ new Map();
-	for (const route of options.graphRoutes) for (const graphProjectPath of route.projectPaths) for (const filePath of parseProjectFileNamesForExtensions(options.config, graphProjectPath, getFirstClassCoverageExtensions(route.extensions))) {
-		if (!options.sourceFiles.has(filePath)) continue;
-		addCoverage(coverageByFile, filePath, {
-			label: toRelativePath(options.config.rootDir, graphProjectPath),
-			type: "graph"
-		});
-	}
-	for (const checkerTarget of options.checkerTargets) for (const configPath of checkerTarget.coverageConfigPaths) for (const filePath of parseProjectFileNamesForExtensions(options.config, configPath, getCheckerCoverageExtensions(checkerTarget.checker))) {
-		if (!options.sourceFiles.has(filePath)) continue;
-		addCoverage(coverageByFile, filePath, {
-			label: `${toRelativePath(options.config.rootDir, configPath)} via ${checkerTarget.label}`,
-			type: "checker"
-		});
-	}
-	if (options.includeAllowlist !== false) for (const entry of options.allowlistEntries) {
-		if (!options.sourceFiles.has(entry.filePath)) continue;
-		addCoverage(coverageByFile, entry.filePath, {
-			label: entry.reason,
-			type: "allowlist"
-		});
-	}
-	return coverageByFile;
+function addEdge(edges, importerName, dependencyName) {
+	const dependencies = edges.get(importerName) ?? /* @__PURE__ */ new Set();
+	dependencies.add(dependencyName);
+	edges.set(importerName, dependencies);
 }
-function collectProjectExtensionsByPath(routes) {
-	const projectExtensionsByPath = /* @__PURE__ */ new Map();
-	for (const route of routes) for (const projectPath of route.projectPaths) {
-		const extensions = new Set([...projectExtensionsByPath.get(projectPath) ?? [], ...route.extensions]);
-		projectExtensionsByPath.set(projectPath, [...extensions].sort());
+function formatDependencyLocation(problem) {
+	const dependency = problem.dependencyName ? ` -> ${problem.dependencyName}` : "";
+	const section = problem.sectionName ? ` [${problem.sectionName}]` : "";
+	const specifier = problem.specifier ? ` (${problem.specifier})` : "";
+	return `${problem.importerName}${dependency}${section}${specifier}`;
+}
+function formatProblemLines(title, problems) {
+	if (problems.length === 0) return [];
+	return [
+		"",
+		title,
+		...problems.map((problem) => `  - ${formatDependencyLocation(problem)}: ${problem.message}`)
+	];
+}
+function getPackedDependencySpecifier(manifest, dependencyName) {
+	for (const { dependencies } of getPublishDependencySections(manifest)) {
+		const specifier = dependencies[dependencyName];
+		if (specifier) return specifier;
 	}
-	return projectExtensionsByPath;
 }
-function parseConfig(config, configPath, extensions = []) {
-	const diagnostics = [];
-	const configObject = readJsonConfig(config, configPath);
-	const parsed = ts.parseJsonConfigFileContent(configObject, ts.sys, path.dirname(configPath), {}, configPath, void 0, createExtraFileExtensions(extensions));
-	if (diagnostics.length > 0) throw new Error(ts.formatDiagnosticsWithColorAndContext(diagnostics, createFormatHost(config.rootDir)));
-	if (parsed.errors.length > 0) throw new Error(ts.formatDiagnosticsWithColorAndContext(parsed.errors, createFormatHost(config.rootDir)));
-	return {
-		fileNames: parsed.fileNames.map(normalizeAbsolutePath).sort(),
-		options: parsed.options
-	};
+function getNpmPackageMetadataUrl(packageName) {
+	return `https://registry.npmjs.org/${encodeURIComponent(packageName)}`;
 }
-function formatJsonValue(value) {
-	return JSON.stringify(value ?? null);
+async function fetchRegistryPackageMetadata(packageName, state) {
+	if (state.registryMetadataCache.has(packageName)) return state.registryMetadataCache.get(packageName) ?? null;
+	const response = await fetch(getNpmPackageMetadataUrl(packageName), { headers: { accept: "application/json" } });
+	if (!response.ok) {
+		state.registryMetadataCache.set(packageName, null);
+		return null;
+	}
+	const metadata = await response.json();
+	const registryMetadata = isRecord(metadata) ? metadata : null;
+	state.registryMetadataCache.set(packageName, registryMetadata);
+	return registryMetadata;
 }
-function normalizeCompilerOptionValue(value) {
-	if (Array.isArray(value)) return value;
-	if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)));
-	return value;
+function findRegistryVersionMetadata(metadata, version) {
+	if (!isRecord(metadata.versions)) return null;
+	const versionMetadata = metadata.versions[version];
+	return isRecord(versionMetadata) ? versionMetadata : null;
 }
-function addDtsConfigSemanticProblems(options) {
-	const dtsFileNames = new Set(options.dtsConfig.fileNames);
-	const localFileNames = new Set(options.localConfig.fileNames);
-	const onlyInDts = options.dtsConfig.fileNames.filter((fileName) => !localFileNames.has(fileName));
-	const onlyInLocal = options.localConfig.fileNames.filter((fileName) => !dtsFileNames.has(fileName));
-	if (onlyInDts.length > 0 || onlyInLocal.length > 0) options.problems.push([
-		"DTS config file set does not match its strict local tsconfig:",
-		`  config: ${toRelativePath(options.config.rootDir, options.dtsConfigPath)}`,
-		`  local: ${toRelativePath(options.config.rootDir, options.localConfigPath)}`,
-		...onlyInDts.length > 0 ? [
-			"  only in dts config:",
-			...onlyInDts.slice(0, 10).map((fileName) => `    - ${toRelativePath(options.config.rootDir, fileName)}`),
-			onlyInDts.length > 10 ? `    ... ${onlyInDts.length - 10} more` : ""
-		] : [],
-		...onlyInLocal.length > 0 ? [
-			"  only in local config:",
-			...onlyInLocal.slice(0, 10).map((fileName) => `    - ${toRelativePath(options.config.rootDir, fileName)}`),
-			onlyInLocal.length > 10 ? `    ... ${onlyInLocal.length - 10} more` : ""
-		] : []
-	].filter(Boolean).join("\n"));
-	const optionNames = new Set([...Object.keys(options.localConfig.options), ...Object.keys(options.dtsConfig.options)]);
-	for (const optionName of [...optionNames].sort()) {
-		if (ignoredSemanticCompilerOptions.has(optionName)) continue;
-		const localValue = normalizeCompilerOptionValue(options.localConfig.options[optionName]);
-		const dtsValue = normalizeCompilerOptionValue(options.dtsConfig.options[optionName]);
-		if (formatJsonValue(localValue) === formatJsonValue(dtsValue)) continue;
-		options.problems.push([
-			"DTS config overrides a typecheck compiler option from its strict local tsconfig:",
-			`  config: ${toRelativePath(options.config.rootDir, options.dtsConfigPath)}`,
-			`  local: ${toRelativePath(options.config.rootDir, options.localConfigPath)}`,
-			`  option: compilerOptions.${optionName}`,
-			`  local: ${formatJsonValue(localValue)}`,
-			`  dts: ${formatJsonValue(dtsValue)}`
-		].join("\n"));
+function execGitCommand(config, args) {
+	return new Promise((resolve, reject) => {
+		execFile("git", [
+			"-C",
+			config.rootDir,
+			...args
+		], {
+			encoding: "utf8",
+			maxBuffer: 10 * 1024 * 1024
+		}, (error, stdout) => {
+			if (error) {
+				reject(error);
+				return;
+			}
+			resolve(stdout);
+		});
+	});
+}
+async function hasWorkspacePackageChangesSinceGitHead(options) {
+	const relativeDirectory = toRelativePath(options.config.rootDir, options.workspacePackage.directory);
+	try {
+		await execGitCommand(options.config, [
+			"diff",
+			"--quiet",
+			options.gitHead,
+			"--",
+			relativeDirectory
+		]);
+	} catch (error) {
+		if (isRecord(error) && error.code === 1) return true;
+		throw error;
 	}
+	return (await execGitCommand(options.config, [
+		"ls-files",
+		"--others",
+		"--exclude-standard",
+		"--",
+		relativeDirectory
+	])).trim().length > 0;
 }
-function addDtsConfigProblems(options) {
-	for (const configPath of options.dtsConfigPaths) {
-		if (!options.graphProjectPaths.has(configPath)) options.problems.push(["DTS config is not reachable from any checker entry:", `  config: ${toRelativePath(options.config.rootDir, configPath)}`].join("\n"));
-		const localConfigPath = getDtsCompanionConfigPath(configPath);
-		if (!existsSync(localConfigPath)) {
-			options.problems.push([
-				"DTS config is missing its strict local tsconfig:",
-				`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
-				`  expected: ${toRelativePath(options.config.rootDir, localConfigPath)}`
-			].join("\n"));
-			continue;
-		}
-		const extensions = options.projectExtensionsByPath.get(configPath) ?? [];
-		const dtsConfig = parseConfig(options.config, configPath, extensions);
-		const localConfig = parseConfig(options.config, localConfigPath, extensions);
-		if (dtsConfig.options.composite !== true) options.problems.push([
-			"DTS config is not valid for tsc -b:",
-			`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
-			"  reason: final compilerOptions.composite must be true."
-		].join("\n"));
-		if (dtsConfig.options.noEmit === true) options.problems.push([
-			"DTS config is not valid for tsc -b:",
-			`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
-			"  reason: final compilerOptions.noEmit must not be true."
-		].join("\n"));
-		if (dtsConfig.options.declaration !== true) options.problems.push([
-			"DTS config is not valid for declaration emit:",
-			`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
-			"  reason: final compilerOptions.declaration must be true."
-		].join("\n"));
-		if (dtsConfig.options.emitDeclarationOnly !== true) options.problems.push([
-			"DTS config is not valid for declaration emit:",
-			`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
-			"  reason: final compilerOptions.emitDeclarationOnly must be true."
-		].join("\n"));
-		addDtsConfigSemanticProblems({
-			config: options.config,
-			dtsConfig,
-			dtsConfigPath: configPath,
-			localConfig,
-			localConfigPath,
-			problems: options.problems
+async function verifyWorkspacePackagePublished(options) {
+	const { state, workspacePackage } = options;
+	const version = workspacePackage.manifest.version;
+	if (!version || !semver.valid(version)) {
+		state.unpublishedPackageNames.add(workspacePackage.name);
+		state.registryProblems.push({
+			importerName: workspacePackage.name,
+			message: ["workspace package must declare a valid semver version", "before another publishable package can depend on it"].join(" "),
+			packageName: workspacePackage.name
+		});
+		return;
+	}
+	let metadata;
+	try {
+		metadata = await fetchRegistryPackageMetadata(workspacePackage.name, state);
+	} catch (error) {
+		state.unpublishedPackageNames.add(workspacePackage.name);
+		state.registryProblems.push({
+			importerName: workspacePackage.name,
+			message: [`unable to read npm registry metadata for ${workspacePackage.name}@${version}:`, formatErrorMessage$1(error)].join(" "),
+			packageName: workspacePackage.name
 		});
+		return;
 	}
-}
-function isEmptyArray(value) {
-	return Array.isArray(value) && value.length === 0;
-}
-function formatConfigRole(role) {
-	return role === "build graph" ? "Build graph config" : "Default tsconfig.json";
-}
-function addPureAggregatorProblems(options) {
-	const roleLabel = formatConfigRole(options.role);
-	const allowedKeys = new Set([
-		"$schema",
-		"files",
-		"references"
-	]);
-	const extraKeys = Object.keys(options.configObject).filter((key) => !allowedKeys.has(key));
-	if (!Object.hasOwn(options.configObject, "files")) options.problems.push([
-		`${roleLabel} is not a pure aggregator:`,
-		`  config: ${toRelativePath(options.config.rootDir, options.configPath)}`,
-		"  field: files",
-		"  reason: configs with project references must declare files: []."
-	].join("\n"));
-	else if (!isEmptyArray(options.configObject.files)) options.problems.push([
-		`${roleLabel} is not a pure aggregator:`,
-		`  config: ${toRelativePath(options.config.rootDir, options.configPath)}`,
-		"  field: files",
-		`  value: ${formatUnknownValue(options.configObject.files)}`,
-		"  reason: configs with project references must declare files: []."
-	].join("\n"));
-	if (extraKeys.length > 0) options.problems.push([
-		`${roleLabel} is not a pure aggregator:`,
-		`  config: ${toRelativePath(options.config.rootDir, options.configPath)}`,
-		`  fields: ${extraKeys.sort().join(", ")}`,
-		"  reason: pure aggregators may only declare $schema, files, and references; move source inputs and compiler options into leaf configs."
-	].join("\n"));
-}
-function addBuildGraphConfigProblems(options) {
-	for (const configPath of options.buildGraphConfigPaths) {
-		const configObject = readJsonConfig(options.config, configPath);
-		addPureAggregatorProblems({
-			config: options.config,
-			configObject,
-			configPath,
-			problems: options.problems,
-			role: "build graph"
+	if (!metadata) {
+		state.unpublishedPackageNames.add(workspacePackage.name);
+		state.registryProblems.push({
+			importerName: workspacePackage.name,
+			message: `${workspacePackage.name}@${version} is not published to the npm registry`,
+			packageName: workspacePackage.name
 		});
+		return;
 	}
-}
-function addDefaultTsconfigShapeProblems(options) {
-	for (const configPath of options.tsconfigPaths) {
-		const configObject = readJsonConfig(options.config, configPath);
-		if (!Object.hasOwn(configObject, "references")) continue;
-		addPureAggregatorProblems({
+	const versionMetadata = findRegistryVersionMetadata(metadata, version);
+	if (!versionMetadata) {
+		state.unpublishedPackageNames.add(workspacePackage.name);
+		state.registryProblems.push({
+			importerName: workspacePackage.name,
+			message: `${workspacePackage.name}@${version} is not published to the npm registry`,
+			packageName: workspacePackage.name
+		});
+		return;
+	}
+	if (typeof versionMetadata.gitHead !== "string" || versionMetadata.gitHead.trim().length === 0) {
+		state.unpublishedPackageNames.add(workspacePackage.name);
+		state.registryProblems.push({
+			importerName: workspacePackage.name,
+			message: [`${workspacePackage.name}@${version} registry metadata has no gitHead,`, "so limina cannot prove the published source baseline"].join(" "),
+			packageName: workspacePackage.name
+		});
+		return;
+	}
+	let hasChanges;
+	try {
+		hasChanges = await hasWorkspacePackageChangesSinceGitHead({
 			config: options.config,
-			configObject,
-			configPath,
-			problems: options.problems,
-			role: "tsconfig.json"
+			gitHead: versionMetadata.gitHead,
+			workspacePackage
 		});
-		if (!Array.isArray(configObject.references)) continue;
-		configObject.references.forEach((reference, index) => {
-			if (!isPlainRecord(reference) || typeof reference.path !== "string") return;
-			const referencePath = resolveReferencePath(configPath, reference.path);
-			if (isOrdinaryTypecheckConfigPath(referencePath)) return;
-			options.problems.push([
-				"Default tsconfig.json references a non-typecheck config:",
-				`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
-				`  field: references[${index}].path`,
-				`  reference: ${reference.path}`,
-				`  resolved: ${toRelativePath(options.config.rootDir, referencePath)}`,
-				"  reason: tsconfig.json is the default IDE/typecheck entry and must not reference declaration build graph configs."
-			].join("\n"));
+	} catch (error) {
+		state.unpublishedPackageNames.add(workspacePackage.name);
+		state.registryProblems.push({
+			importerName: workspacePackage.name,
+			message: [
+				`unable to compare ${workspacePackage.name}@${version}`,
+				`against published gitHead ${versionMetadata.gitHead}:`,
+				formatErrorMessage$1(error)
+			].join(" "),
+			packageName: workspacePackage.name
 		});
+		return;
 	}
-}
-function addDefaultTsconfigEnvironmentProblems(options) {
-	const configsByDirectory = /* @__PURE__ */ new Map();
-	for (const configPath of options.ordinaryConfigPaths) {
-		const directory = path.dirname(configPath);
-		const configs = configsByDirectory.get(directory) ?? [];
-		configs.push(configPath);
-		configsByDirectory.set(directory, configs);
+	if (hasChanges) {
+		state.unpublishedPackageNames.add(workspacePackage.name);
+		state.registryProblems.push({
+			importerName: workspacePackage.name,
+			message: [`${workspacePackage.name}@${version} has workspace changes`, `after the published npm registry gitHead ${versionMetadata.gitHead}`].join(" "),
+			packageName: workspacePackage.name
+		});
 	}
-	for (const [directory, configPaths] of configsByDirectory.entries()) {
-		const scopedConfigPaths = configPaths.filter((configPath) => path.basename(configPath) !== "tsconfig.json");
-		if (scopedConfigPaths.length === 0) continue;
-		const defaultConfigPath = normalizeAbsolutePath(path.join(directory, "tsconfig.json"));
-		if (!existsSync(defaultConfigPath)) {
-			options.problems.push([
-				"Directory with typecheck environments is missing default tsconfig.json:",
-				`  directory: ${toRelativePath(options.config.rootDir, directory)}`,
-				"  reason: tsconfig.json is the default IDE/typecheck entry for its directory."
-			].join("\n"));
+}
+async function visitWorkspacePackageDependencies(options) {
+	const { config, importerName, isRoot, manifest, state, workspacePackagesByName } = options;
+	for (const entry of collectPublishDependencyEntries(manifest)) {
+		if (isLinkDependencySpecifier(entry.specifier)) {
+			state.sourceLinkDependencies.push({
+				dependencyName: entry.dependencyName,
+				importerName,
+				message: "publishable dependency sections must not use link:",
+				sectionName: entry.sectionName,
+				specifier: entry.specifier
+			});
 			continue;
 		}
-		if (scopedConfigPaths.length === 1) {
-			options.problems.push([
-				"Single typecheck environment should use default tsconfig.json:",
-				`  config: ${toRelativePath(options.config.rootDir, scopedConfigPaths[0])}`,
-				`  default: ${toRelativePath(options.config.rootDir, defaultConfigPath)}`,
-				"  reason: directories with only one type environment should make tsconfig.json the leaf entry."
-			].join("\n"));
+		if (!isWorkspaceDependencySpecifier(entry.specifier)) continue;
+		const targetPackage = workspacePackagesByName.get(entry.dependencyName);
+		if (!targetPackage) {
+			state.missingWorkspaceDependencies.push({
+				dependencyName: entry.dependencyName,
+				importerName,
+				message: "workspace: publish dependency does not match a named workspace package",
+				sectionName: entry.sectionName,
+				specifier: entry.specifier
+			});
 			continue;
 		}
-		const defaultConfigObject = readJsonConfig(options.config, defaultConfigPath);
-		if (!Object.hasOwn(defaultConfigObject, "references")) options.problems.push([
-			"Directory with multiple typecheck environments must use tsconfig.json as an aggregator:",
-			`  config: ${toRelativePath(options.config.rootDir, defaultConfigPath)}`,
-			"  reason: multiple type environments require a default IDE/typecheck aggregator."
-		].join("\n"));
-	}
-}
-function collectConfigFileOwners(config, graphRoutes, sourceFiles) {
-	const ownersByFile = /* @__PURE__ */ new Map();
-	for (const route of graphRoutes) for (const configPath of route.projectPaths) {
-		if (!existsSync(configPath)) continue;
-		for (const filePath of parseProjectFileNamesForExtensions(config, configPath, route.extensions)) {
-			if (!sourceFiles.has(filePath)) continue;
-			const owners = ownersByFile.get(filePath) ?? [];
-			owners.push(configPath);
-			ownersByFile.set(filePath, owners);
+		addEdge(state.edges, importerName, targetPackage.name);
+		if (isRoot) state.directWorkspaceDependencies.push({
+			dependencyName: entry.dependencyName,
+			sectionName: entry.sectionName,
+			targetPackage
+		});
+		if (targetPackage.manifest.private === true) {
+			state.privateWorkspaceDependencies.push({
+				dependencyName: entry.dependencyName,
+				importerName,
+				message: "publishable packages cannot depend on a private workspace package",
+				packageName: targetPackage.name,
+				sectionName: entry.sectionName,
+				specifier: entry.specifier
+			});
+			continue;
+		}
+		if (!state.visitedPackages.has(targetPackage.name)) {
+			state.visitedPackages.add(targetPackage.name);
+			await verifyWorkspacePackagePublished({
+				config,
+				state,
+				workspacePackage: targetPackage
+			});
+			await visitWorkspacePackageDependencies({
+				config,
+				importerName: targetPackage.name,
+				isRoot: false,
+				manifest: targetPackage.manifest,
+				state,
+				workspacePackagesByName
+			});
 		}
 	}
-	return ownersByFile;
 }
-function addDuplicateGraphCoverageProblems(options) {
-	for (const [filePath, owners] of [...options.ownersByFile.entries()].sort(([left], [right]) => toRelativePath(options.config.rootDir, left).localeCompare(toRelativePath(options.config.rootDir, right)))) {
-		const uniqueOwners = [...new Set(owners)];
-		if (uniqueOwners.length <= 1) continue;
-		options.problems.push([
-			"Duplicate checker graph coverage:",
-			`  file: ${toRelativePath(options.config.rootDir, filePath)}`,
-			"  covered by:",
-			...uniqueOwners.sort((left, right) => toRelativePath(options.config.rootDir, left).localeCompare(toRelativePath(options.config.rootDir, right))).map((configPath) => `    - ${toRelativePath(options.config.rootDir, configPath)}`),
-			"  reason: a checker graph file must have a single declaration owner; move the file to one dts leaf or narrow include/exclude patterns."
-		].join("\n"));
+async function unpackPackedPackage(tarball) {
+	return await unpack(tarball);
+}
+function getPackedContentFiles(packedPackage) {
+	const rootPrefix = `${packedPackage.rootDir}/`;
+	const files = [];
+	for (const file of packedPackage.files) {
+		if (!file.name.startsWith(rootPrefix)) continue;
+		files.push({
+			data: file.data,
+			relativePath: file.name.slice(rootPrefix.length).replaceAll("\\", "/")
+		});
 	}
+	return files;
 }
-function addAllowlistProblems(options) {
-	for (const entry of options.allowlistEntries) {
-		if (!existsSync(entry.filePath)) {
-			options.problems.push(["Typecheck proof allowlist references a missing file:", `  file: ${toRelativePath(options.config.rootDir, entry.filePath)}`].join("\n"));
-			continue;
-		}
-		if (!options.sourceFiles.has(entry.filePath)) {
-			options.problems.push([
-				"Typecheck proof allowlist file is outside the configured source boundary:",
-				`  file: ${toRelativePath(options.config.rootDir, entry.filePath)}`,
-				"  reason: allowlist entries should only describe source files that proof would otherwise require coverage for."
-			].join("\n"));
-			continue;
-		}
-		if (options.baseCoverageByFile.has(entry.filePath)) options.problems.push(["Typecheck proof allowlist file is already covered without the allowlist:", `  file: ${toRelativePath(options.config.rootDir, entry.filePath)}`].join("\n"));
+function readPackedPackageJson(options) {
+	const packageJsonFile = options.contentFiles.find((file) => file.relativePath === "package.json");
+	if (!packageJsonFile) {
+		options.state.releaseHygieneProblems.push({
+			importerName: options.rootPackageName,
+			message: "tarball does not contain package.json"
+		});
+		return null;
+	}
+	try {
+		return JSON.parse(Buffer.from(packageJsonFile.data).toString("utf8"));
+	} catch (error) {
+		options.state.releaseHygieneProblems.push({
+			importerName: options.rootPackageName,
+			message: `tarball package.json is not valid JSON: ${formatErrorMessage$1(error)}`
+		});
+		return null;
 	}
 }
-function addUncoveredSourceProblems(options) {
-	const uncoveredFiles = [...options.sourceFiles].filter((filePath) => !options.coverageByFile.has(filePath));
-	if (uncoveredFiles.length === 0) return;
-	options.problems.push([
-		"Source files are not covered by typecheck proof:",
-		...uncoveredFiles.slice(0, 20).map((filePath) => `  - ${toRelativePath(options.config.rootDir, filePath)}`),
-		uncoveredFiles.length > 20 ? `  ... ${uncoveredFiles.length - 20} more` : "",
-		"  reason: every file in config.source must be covered by a checker entry or an explicit allowlist entry."
-	].filter(Boolean).join("\n"));
+function isJavaScriptPackageFile(relativePath) {
+	return /\.(?:cjs|mjs|js)$/u.test(relativePath);
 }
-async function runProofCheckInternal(config, options = {}) {
-	const problems = [];
-	const graphRouteCollection = collectGraphProjectRoutes(config);
-	const entryRouteCollection = collectCheckerEntryProjectRoutes(config);
-	const entryProjectPaths = [...new Set(entryRouteCollection.routes.flatMap((route) => route.projectPaths))].sort();
-	const entryProjectPathSet = new Set(entryProjectPaths);
-	const entryProjectExtensionsByPath = collectProjectExtensionsByPath(entryRouteCollection.routes);
-	const dtsConfigPaths = await collectDtsConfigPaths(config);
-	const buildGraphConfigPaths = await collectBuildGraphConfigPaths(config);
-	const defaultTsconfigPaths = await collectDefaultTsconfigPaths(config);
-	const ordinaryTypecheckConfigPaths = await collectOrdinaryTypecheckConfigPaths(config);
-	problems.push(...graphRouteCollection.problems);
-	problems.push(...entryRouteCollection.problems);
-	addDtsConfigProblems({
-		config,
-		dtsConfigPaths,
-		graphProjectPaths: entryProjectPathSet,
-		problems,
-		projectExtensionsByPath: entryProjectExtensionsByPath
-	});
-	addBuildGraphConfigProblems({
-		buildGraphConfigPaths,
-		config,
-		problems
-	});
-	addDefaultTsconfigShapeProblems({
-		config,
-		problems,
-		tsconfigPaths: defaultTsconfigPaths
+function validateReleaseTarballHygiene(options) {
+	const filePaths = new Set(options.contentFiles.map((file) => file.relativePath));
+	const missingReleaseFiles = REQUIRED_RELEASE_FILES.filter((fileName) => !filePaths.has(fileName));
+	if (missingReleaseFiles.length > 0) options.state.releaseHygieneProblems.push({
+		importerName: options.rootPackageName,
+		message: `tarball is missing required file(s): ${missingReleaseFiles.join(", ")}`
 	});
-	addDefaultTsconfigEnvironmentProblems({
-		config,
-		ordinaryConfigPaths: ordinaryTypecheckConfigPaths,
-		problems
+	for (const file of options.contentFiles) {
+		if (/\.map$/u.test(file.relativePath)) {
+			options.state.releaseHygieneProblems.push({
+				importerName: options.rootPackageName,
+				message: `tarball contains source map file: ${file.relativePath}`
+			});
+			continue;
+		}
+		if (!isJavaScriptPackageFile(file.relativePath)) continue;
+		const source = Buffer.from(file.data).toString("utf8");
+		if (SOURCE_MAPPING_URL_PATTERN.test(source)) options.state.releaseHygieneProblems.push({
+			importerName: options.rootPackageName,
+			message: `tarball JavaScript file contains sourceMappingURL directive: ${file.relativePath}`
+		});
+	}
+}
+function validatePackedManifest(options) {
+	const { manifest, rootPackageName, state } = options;
+	for (const entry of collectPublishDependencyEntries(manifest)) if (isWorkspaceDependencySpecifier(entry.specifier) || isLinkDependencySpecifier(entry.specifier)) state.packedManifestProblems.push({
+		dependencyName: entry.dependencyName,
+		importerName: rootPackageName,
+		message: "packed package manifest must not expose workspace: or link: dependency specifiers",
+		sectionName: entry.sectionName,
+		specifier: entry.specifier
 	});
-	if (problems.length > 0) {
-		ProofLogger.error(problems.join("\n\n"));
-		return false;
+	for (const dependency of state.directWorkspaceDependencies) {
+		const packedSpecifier = getPackedDependencySpecifier(manifest, dependency.dependencyName);
+		if (!packedSpecifier) {
+			state.packedManifestProblems.push({
+				dependencyName: dependency.dependencyName,
+				importerName: rootPackageName,
+				message: "packed package manifest must keep every source workspace publish dependency",
+				sectionName: dependency.sectionName
+			});
+			continue;
+		}
+		if (isWorkspaceDependencySpecifier(packedSpecifier) || isLinkDependencySpecifier(packedSpecifier)) continue;
+		const targetVersion = dependency.targetPackage.manifest.version;
+		if (!targetVersion || !semver.satisfies(targetVersion, packedSpecifier, { includePrerelease: true })) state.packedManifestProblems.push({
+			dependencyName: dependency.dependencyName,
+			importerName: rootPackageName,
+			message: `packed dependency range must include ${dependency.targetPackage.name}@${targetVersion ?? "(missing version)"}`,
+			sectionName: dependency.sectionName,
+			specifier: packedSpecifier
+		});
 	}
-	const checkerTargetCollection = collectCheckerCoverageTargets(config);
-	const checkerTargets = checkerTargetCollection.targets;
-	problems.push(...checkerTargetCollection.problems);
-	if (problems.length > 0) {
-		ProofLogger.error(problems.join("\n\n"));
-		return false;
+}
+function createPublishOrder(rootPackageName, state) {
+	const publishOrder = [];
+	const seen = /* @__PURE__ */ new Set();
+	function visit(packageName) {
+		if (seen.has(packageName)) return;
+		seen.add(packageName);
+		for (const dependencyName of state.edges.get(packageName) ?? []) visit(dependencyName);
+		if (packageName === rootPackageName || state.unpublishedPackageNames.has(packageName)) publishOrder.push(packageName);
 	}
-	const sourceFiles = await collectExpectedSourceFiles(config);
-	const allowlistCollection = collectConfiguredAllowlistEntries(config);
-	const allowlistEntries = allowlistCollection.entries;
-	problems.push(...allowlistCollection.problems);
-	const baseCoverageByFile = collectCoverage({
-		allowlistEntries,
-		checkerTargets,
-		config,
-		graphRoutes: graphRouteCollection.routes,
-		includeAllowlist: false,
-		sourceFiles
-	});
-	const coverageByFile = collectCoverage({
-		allowlistEntries,
-		checkerTargets,
-		config,
-		graphRoutes: graphRouteCollection.routes,
-		sourceFiles
+	visit(rootPackageName);
+	return publishOrder;
+}
+function createReleaseConsistencyError(options) {
+	const { config, label, outDir, rootPackageName, state } = options;
+	if (state.sourceLinkDependencies.length + state.privateWorkspaceDependencies.length + state.missingWorkspaceDependencies.length + state.registryProblems.length + state.releaseHygieneProblems.length + state.packedManifestProblems.length === 0) return null;
+	const publishOrder = createPublishOrder(rootPackageName, state);
+	const lines = [
+		`package release check failed for ${label}:`,
+		`  output: ${toRelativePath(config.rootDir, outDir)}`,
+		...formatProblemLines("Release tarball is not publishable:", state.releaseHygieneProblems),
+		...formatProblemLines("Source manifest contains local link: publish dependencies:", state.sourceLinkDependencies),
+		...formatProblemLines("Source manifest depends on private workspace packages:", state.privateWorkspaceDependencies),
+		...formatProblemLines("Source manifest has invalid workspace: publish dependencies:", state.missingWorkspaceDependencies),
+		...formatProblemLines("Workspace packages must be published before this package:", state.registryProblems),
+		...formatProblemLines("Packed package manifest is inconsistent with workspace publish dependencies:", state.packedManifestProblems)
+	];
+	if (publishOrder.length > 1) lines.push("", `Suggested publish order: ${publishOrder.join(" -> ")}`);
+	return new PackageReleaseConsistencyError(lines.join("\n"));
+}
+async function assertPackageReleaseConsistency(options) {
+	const workspacePackages = await collectWorkspacePackages(options.config);
+	const sourcePackage = workspacePackages.find((workspacePackage) => workspacePackage.name === options.outputManifest.name);
+	const state = createReleaseConsistencyState();
+	if (sourcePackage) {
+		state.visitedPackages.add(sourcePackage.name);
+		await visitWorkspacePackageDependencies({
+			config: options.config,
+			importerName: sourcePackage.name,
+			isRoot: true,
+			manifest: sourcePackage.manifest,
+			state,
+			workspacePackagesByName: new Map(workspacePackages.map((workspacePackage) => [workspacePackage.name, workspacePackage]))
+		});
+	}
+	const contentFiles = getPackedContentFiles(await unpackPackedPackage(options.packedTarball));
+	validateReleaseTarballHygiene({
+		contentFiles,
+		rootPackageName: options.outputManifest.name,
+		state
 	});
-	addDuplicateGraphCoverageProblems({
-		config,
-		ownersByFile: collectConfigFileOwners(config, graphRouteCollection.routes, sourceFiles),
-		problems
+	const packedManifest = readPackedPackageJson({
+		contentFiles,
+		rootPackageName: options.outputManifest.name,
+		state
 	});
-	addAllowlistProblems({
-		allowlistEntries,
-		baseCoverageByFile,
-		config,
-		problems,
-		sourceFiles
+	if (packedManifest) validatePackedManifest({
+		manifest: packedManifest,
+		rootPackageName: options.outputManifest.name,
+		state
 	});
-	addUncoveredSourceProblems({
-		config,
-		coverageByFile,
-		problems,
-		sourceFiles
+	const error = createReleaseConsistencyError({
+		config: options.config,
+		label: options.label,
+		outDir: options.outDir,
+		rootPackageName: options.outputManifest.name,
+		state
 	});
-	if (problems.length > 0) {
-		ProofLogger.error(problems.join("\n\n"));
-		return false;
-	}
-	const graphFileCount = [...coverageByFile.values()].filter((sources) => sources.some((source) => source.type === "graph")).length;
-	const checkerFileCount = [...coverageByFile.values()].filter((sources) => sources.some((source) => source.type === "checker")).length;
-	if (options.logSuccess ?? true) ProofLogger.success([
-		`Checked ${entryProjectPaths.length} checker entry projects and ${dtsConfigPaths.length} dts configs.`,
-		`Graph-capable checker entries cover ${graphFileCount} files; checker entries cover ${checkerFileCount} files.`,
-		`Configured source boundary covers ${sourceFiles.size} files.`
+	if (error) throw error;
+}
+
+//#endregion
+//#region src/commands/release.ts
+function logReleaseCheckPlan(options) {
+	ReleaseLogger.info([
+		"Release check plan:",
+		`  config: ${toRelativePath(options.config.rootDir, options.config.configPath)}`,
+		`  cwd: ${toRelativePath(options.config.rootDir, options.cwd)}`,
+		`  selection: ${options.plan.selectionReason}`,
+		"  entries:",
+		...options.plan.entries.map((entry) => [`    - ${entry.label}`, `      outDir: ${toRelativePath(options.config.rootDir, entry.outDir)}`].join("\n"))
 	].join("\n"));
-	if ((options.logSuccess ?? true) && (config.proof?.allowlist ?? []).length > 0) ProofLogger.info(`Explicit typecheck proof allowlist: ${(config.proof?.allowlist ?? []).map((entry) => entry.file).join(", ")}`);
-	return true;
 }
-async function runProofCheck(config, options = {}) {
+async function packReleaseTarball(options) {
+	const packTask = options.flow?.start(`release tarball: ${options.label}`, { depth: options.flowDepth ?? 0 });
+	ReleaseLogger.info(`release tarball packing started: ${options.label}`);
+	const packElapsed = createElapsedTimer();
+	try {
+		const packedDist = await packOutputTarball(options.outDir);
+		if (!options.flow?.interactive) ReleaseLogger.success(`release tarball packed: ${options.label}`, packElapsed());
+		packTask?.pass();
+		return packedDist;
+	} catch (error) {
+		ReleaseLogger.error(`release tarball failed: ${options.label}: ${formatErrorMessage$1(error)}`, packElapsed());
+		packTask?.fail(`release tarball failed: ${options.label}`, { error });
+		throw error;
+	}
+}
+async function runReleaseCheckEntry(options) {
+	const task = options.flow?.start(`release entry: ${options.label}`, { depth: options.flowDepth ?? 0 });
+	let packedDist;
+	try {
+		const outputPackageJsonPath = path.join(options.outDir, "package.json");
+		const outputManifest = await readDistPackageJson({
+			config: options.config,
+			label: options.label,
+			packageJsonPath: outputPackageJsonPath
+		});
+		if (outputManifest.private === true) throw new PackageReleaseConsistencyError([
+			`package release check failed for ${options.label}:`,
+			`  output: ${toRelativePath(options.config.rootDir, options.outDir)}`,
+			"",
+			"Release tarball is not publishable:",
+			`  - ${outputManifest.name}: selected release package has "private": true; npm publish would reject it`
+		].join("\n"));
+		packedDist = await packReleaseTarball({
+			flow: options.flow,
+			flowDepth: (options.flowDepth ?? 0) + 1,
+			label: options.label,
+			outDir: options.outDir
+		});
+		await assertPackageReleaseConsistency({
+			config: options.config,
+			label: options.label,
+			outDir: options.outDir,
+			outputManifest,
+			packedTarball: packedDist.tarball
+		});
+		if (!options.flow?.interactive) ReleaseLogger.success(`release checks passed: ${options.label}`);
+		task?.pass();
+		return true;
+	} catch (error) {
+		if (error instanceof PackageReleaseConsistencyError) {
+			ReleaseLogger.error(formatErrorMessage$1(error));
+			task?.fail(`release checks failed: ${options.label}`);
+			return false;
+		}
+		ReleaseLogger.error(`release checks failed: ${options.label}: ${formatErrorMessage$1(error)}`);
+		task?.fail(`release checks failed: ${options.label}`, { error });
+		throw error;
+	} finally {
+		if (packedDist) await packedDist.cleanup();
+	}
+}
+async function runReleaseCheck(options) {
 	if (options.clearScreen ?? true) clearCliScreen();
 	const elapsed = createElapsedTimer();
-	const task = options.flow?.start("proof check", { depth: options.flowDepth ?? 0 });
-	ProofLogger.info("proof check started");
+	const cwd = path.resolve(options.cwd ?? process.cwd());
+	const task = options.flow?.start("release check", { depth: options.flowDepth ?? 0 });
 	try {
-		const logSuccess = !options.flow?.interactive;
-		const passed = await runProofCheckInternal(config, { logSuccess });
+		ReleaseLogger.info("release check started");
+		const plan = createPackageEntrySelectionPlan({
+			config: options.config,
+			cwd,
+			packageNames: options.packageNames,
+			strictCwd: true
+		});
+		logReleaseCheckPlan({
+			config: options.config,
+			cwd,
+			plan
+		});
+		let passed = true;
+		for (const entry of plan.entries) passed = await runReleaseCheckEntry({
+			config: options.config,
+			flow: options.flow,
+			flowDepth: (options.flowDepth ?? 0) + 1,
+			label: entry.label,
+			outDir: entry.outDir
+		}) && passed;
 		if (passed) {
-			if (logSuccess) ProofLogger.success("proof check finished", elapsed());
+			if (!options.flow?.interactive) ReleaseLogger.success("release check finished", elapsed());
 			task?.pass();
 		} else {
-			ProofLogger.error("proof check finished with failures", elapsed());
-			task?.fail("proof check finished with failures");
+			ReleaseLogger.error("release check finished with failures", elapsed());
+			task?.fail("release check finished with failures");
 		}
 		return passed;
 	} catch (error) {
-		ProofLogger.error(`proof check failed: ${formatErrorMessage$1(error)}`, elapsed());
-		task?.fail("proof check failed", { error });
+		ReleaseLogger.error(`release check failed: ${formatErrorMessage$1(error)}`, elapsed());
+		task?.fail("release check failed", { error });
 		throw error;
 	}
 }
@@ -2406,6 +2586,7 @@ const builtInTaskNames = new Set([
 	"graph:check",
 	"package:check",
 	"proof:check",
+	"release:check",
 	"source:check"
 ]);
 const defaultCheckPipeline = [
@@ -2461,7 +2642,16 @@ async function runBuiltinTask(config, taskName, options = {}) {
 			config,
 			cwd: options.cwd,
 			flow: options.flow,
-			flowDepth: 1
+			flowDepth: 1,
+			packageNames: options.packageNames
+		});
+		case "release:check": return runReleaseCheck({
+			clearScreen: false,
+			config,
+			cwd: options.cwd,
+			flow: options.flow,
+			flowDepth: 1,
+			packageNames: options.packageNames
 		});
 		case "checker:typecheck": return (await runCheckerTypecheck({
 			clearScreen: false,
@@ -2591,6 +2781,11 @@ function parsePackageAttwProfile(profile) {
 	if (profile === "strict" || profile === "node16" || profile === "esm-only") return profile;
 	throw new Error(`Invalid package check --attw-profile "${profile}". Expected one of: strict, node16, esm-only.`);
 }
+function parsePackageNames(packageName) {
+	if (!packageName) return;
+	const packageNames = (Array.isArray(packageName) ? packageName : [packageName]).map((name) => name.trim()).filter(Boolean);
+	return packageNames.length > 0 ? packageNames : void 0;
+}
 function createCliFlow() {
 	clearCliScreen();
 	return createLiminaFlowReporter();
@@ -2611,13 +2806,14 @@ async function main() {
 		});
 		flow.outro("limina init finished");
 	});
-	cli.command("check [pipeline]", "Run the default check or a configured pipeline").action(async (pipeline, flags) => {
+	cli.command("check [pipeline]", "Run the default check or a configured pipeline").option("-p, --package <name>", "Run package-aware pipeline tasks for one package entry").action(async (pipeline, flags) => {
 		const flow = createCliFlow();
 		flow.intro("limina check");
 		const config = await load(flags, "check");
 		const passed = pipeline ? await runPipeline(config, pipeline, {
 			cwd: process.cwd(),
-			flow
+			flow,
+			packageNames: parsePackageNames(flags.package)
 		}) : await runDefaultCheck(config, {
 			cwd: process.cwd(),
 			flow
@@ -2694,7 +2890,7 @@ async function main() {
 		if (!result.passed) process.exitCode = 1;
 		flow.outro(result.passed ? "limina checker passed" : "limina checker failed");
 	});
-	cli.command("package <action>", "Check configured published package outputs").option("-p, --package <name>", "Run a single package check target").option("--tool <tool>", "Run one package check tool").option("--attw-profile <profile>", "Override the configured ATTW profile").action(async (action, flags) => {
+	cli.command("package <action>", "Check configured published package outputs").option("-p, --package <name>", "Run one package check entry").option("--tool <tool>", "Run one package check tool").option("--attw-profile <profile>", "Override the configured ATTW profile").action(async (action, flags) => {
 		if (action !== "check") throw new Error(`Unknown package action "${action}". Expected check.`);
 		const flow = createCliFlow();
 		flow.intro("limina package check");
@@ -2705,12 +2901,26 @@ async function main() {
 			config,
 			cwd: process.cwd(),
 			flow,
-			targetName: flags.package,
+			packageNames: parsePackageNames(flags.package),
 			tool: parsePackageTool(flags.tool)
 		});
 		if (!passed) process.exitCode = 1;
 		flow.outro(passed ? "limina package passed" : "limina package failed");
 	});
+	cli.command("release <action>", "Check package release readiness").option("-p, --package <name>", "Run one release check package entry").action(async (action, flags) => {
+		if (action !== "check") throw new Error(`Unknown release action "${action}". Expected check.`);
+		const flow = createCliFlow();
+		flow.intro("limina release check");
+		const passed = await runReleaseCheck({
+			clearScreen: false,
+			config: await load(flags, "release"),
+			cwd: process.cwd(),
+			flow,
+			packageNames: parsePackageNames(flags.package)
+		});
+		if (!passed) process.exitCode = 1;
+		flow.outro(passed ? "limina release passed" : "limina release failed");
+	});
 	cli.parse(process.argv, { run: false });
 	try {
 		await cli.runMatchedCommand();