limina 0.0.4 → 0.0.5

package/cli.js

@@ -1,423 +1,278 @@
 #!/usr/bin/env node
 import "./chunks/dep-lkQg1P9Q.js";
-import { c as getCheckerAdapter, d as normalizeAbsolutePath, f as normalizeSlashes, g as toRelativePath, h as toPosixPath, i as loadConfig, l as normalizeExtensions, m as toAbsolutePath, n as getActiveCheckerExtensions, p as normalizeWorkspacePath, r as getActiveCheckers, u as isPathInsideDirectory } from "./chunks/dep-DzYrmtQJ.js";
-import { $ as resolveReferencePath, A as resolveInternalImport$1, B as collectGraphProjectRouteFromRoot, C as findTargetProject, D as isDtsProjectConfig, E as inferPackageProject$1, F as getPackageRootSpecifier, G as createFormatHost, H as collectSourceGraphProjectExtensions, I as getPublishDependencySections, J as getRawReferencePaths, K as formatReferences, L as isWorkspaceDependencySpecifier, M as collectImporters, N as collectWorkspacePackages, O as isRelativeSpecifier, P as findPackageForSpecifier, Q as resolveProjectConfigPath, R as collectCheckerEntryProjectRoutes, S as findPackageForFile, T as getTypecheckConfigPath, U as createExtensionPattern, V as collectGraphProjectRoutes, W as createExtraFileExtensions, X as parseProjectFileNamesForExtensions, Y as isOrdinaryTypecheckConfigPath, Z as readJsonConfig, _ as getDeniedRefRule, a as runSourceCheck, b as createFileOwnerLookup$1, c as GraphLogger, d as ProofLogger, f as ReleaseLogger, g as getDeniedDepRuleForSpecifier, h as getDeniedDepRuleForPackage, i as runCheckerTypecheck, j as shouldResolveThroughGraph$1, k as parseProject$1, l as PackageLogger, m as formatErrorMessage$1, n as createLiminaFlowReporter, o as runInit, p as clearCliScreen, q as getDtsCompanionConfigPath, r as runCheckerBuild, s as CliLogger, u as PathsLogger, v as normalizeGraphRules, w as formatArtifactDependencyPolicy, x as findImporterForFile$1, y as collectImportsFromFile$1, z as collectGraphProjectRoute } from "./chunks/dep-ZRIm_-Zk.js";
+import { a as loadConfig, b as toPosixPath, d as parseCheckerProjectConfigForContext, f as resolveCheckerProjectExtensions, g as normalizeAbsolutePathIdentity, h as normalizeAbsolutePath, i as isStrictConfig, l as getCheckerAdapter, m as isPathInsideDirectory, n as getActiveCheckerExtensions, r as getActiveCheckers, u as normalizeExtensions, x as toRelativePath, y as toAbsolutePath } from "./chunks/dep-CBKvJc4Y.js";
+import { A as isLocalPackageDependencySpecifier, B as isDtsConfigPath, C as resolveInternalImport, D as getDependencySections, E as findPackageForSpecifier, F as collectSourceGraphProjectExtensions, G as resolveReferencePath, H as parseProjectFileNamesForExtensions, I as createExtensionPattern, L as createLiminaTsconfigSchemaPath, M as collectCheckerEntryProjectRoutes, N as collectGraphProjectRouteFromRoot, O as getPackageRootSpecifier, P as collectGraphProjectRoutes, R as getDtsCompanionConfigPath, S as createImportAnalysisContext, T as collectWorkspacePackages, U as readJsonConfig, V as isOrdinaryTypecheckConfigPath, W as resolveProjectConfigPath, _ as ReleaseLogger, a as runCheckerTypecheck, b as parseProject, c as runGraphCheck, d as collectExportEntries, f as CliLogger, g as ProofLogger, h as PathsLogger, i as runCheckerBuild, j as isWorkspaceDependencySpecifier, k as getPublishDependencySections, l as runGraphSync, m as PackageLogger, n as createLiminaFlowReporter, o as runSourceCheck, p as NxLogger, r as prepareVueTsgoCache, s as runInit, u as aliasMatchesSpecifier, v as clearCliScreen, w as collectImporters, x as collectImportsFromFile, y as formatErrorMessage$1, z as isBuildGraphConfigPath } from "./chunks/dep-DTGmTTL7.js";
 import { builtinModules, createRequire } from "node:module";
 import { cac } from "cac";
 import { createElapsedTimer } from "logaria/helper";
 import { existsSync, readFileSync } from "node:fs";
-import path from "node:path";
-import ts from "typescript";
-import { execFile, spawn, spawnSync } from "node:child_process";
-import { glob } from "tinyglobby";
 import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import path from "pathe";
+import { glob } from "tinyglobby";
+import { spawn, spawnSync } from "node:child_process";
 import { checkPackage, createPackageFromTarballData } from "@arethetypeswrong/core";
 import { pack, unpack } from "@publint/pack";
 import { init, parse } from "es-module-lexer";
 import { tmpdir } from "node:os";
 import { publint } from "publint";
 import { formatMessage } from "publint/utils";
+import rawPicomatch from "picomatch";
 
-//#region src/commands/graph.ts
-const requiredDtsCompilerOptions = [
-	["composite", true],
-	["incremental", true],
-	["noEmit", false],
-	["declaration", true],
-	["emitDeclarationOnly", true]
-];
-const requiredDtsPathOptions = [
-	"rootDir",
-	"outDir",
-	"tsBuildInfoFile"
-];
-const comparableTypecheckOptions = [
-	"allowArbitraryExtensions",
-	"allowImportingTsExtensions",
-	"allowJs",
-	"allowSyntheticDefaultImports",
-	"checkJs",
-	"customConditions",
-	"esModuleInterop",
-	"exactOptionalPropertyTypes",
-	"forceConsistentCasingInFileNames",
-	"isolatedDeclarations",
-	"isolatedModules",
-	"jsx",
-	"jsxImportSource",
-	"lib",
-	"module",
-	"moduleDetection",
-	"moduleResolution",
-	"noFallthroughCasesInSwitch",
-	"noImplicitAny",
-	"noImplicitOverride",
-	"noImplicitReturns",
-	"noImplicitThis",
-	"noPropertyAccessFromIndexSignature",
-	"noUncheckedIndexedAccess",
-	"resolveJsonModule",
-	"skipLibCheck",
-	"strict",
-	"strictBindCallApply",
-	"strictFunctionTypes",
-	"strictNullChecks",
-	"strictPropertyInitialization",
-	"target",
-	"typeRoots",
-	"types",
-	"useDefineForClassFields",
-	"verbatimModuleSyntax"
-];
-function formatCompilerOptionValue(value) {
-	if (value === void 0) return "undefined";
-	return JSON.stringify(value);
+//#region src/commands/nx.ts
+const defaultArtifactDirectories = ["dist"];
+const defaultNxTargets = ["build"];
+function stringifyJson(value) {
+	return `${JSON.stringify(value, null, 2)}\n`;
 }
-function compilerOptionEquals(left, right) {
-	return JSON.stringify(left) === JSON.stringify(right);
+function configuredArtifactDirectories(config) {
+	return config.paths?.artifactDirectories ?? defaultArtifactDirectories;
 }
-function addDtsOptionProblems(config, project, problems) {
-	if (!isDtsProjectConfig(project.configPath)) return;
-	for (const [optionName, expected] of requiredDtsCompilerOptions) {
-		const actual = project.options[optionName];
-		if (actual === expected) continue;
-		problems.push([
-			"Invalid declaration leaf compiler option:",
-			`  project: ${toRelativePath(config.rootDir, project.configPath)}`,
-			`  option: compilerOptions.${optionName}`,
-			`  expected: ${formatCompilerOptionValue(expected)}`,
-			`  actual: ${formatCompilerOptionValue(actual)}`,
-			"  reason: tsconfig*.dts.json projects are consumed by tsc -b and must emit declarations through composite incremental builds."
-		].join("\n"));
-	}
-	for (const optionName of requiredDtsPathOptions) {
-		if (project.options[optionName]) continue;
-		problems.push([
-			"Missing declaration leaf output option:",
-			`  project: ${toRelativePath(config.rootDir, project.configPath)}`,
-			`  option: compilerOptions.${optionName}`,
-			"  reason: declaration leaves need explicit root/output state so declaration output and tsbuildinfo files do not collide."
-		].join("\n"));
-	}
+function isLinkDependencySpecifier$1(specifier) {
+	return specifier.startsWith("link:");
 }
-function addTypecheckParityProblems(config, dtsProject, problems) {
-	if (!isDtsProjectConfig(dtsProject.configPath)) return;
-	const typecheckConfigPath = getTypecheckConfigPath(dtsProject.configPath);
-	if (!existsSync(typecheckConfigPath)) {
-		problems.push([
-			"Missing typecheck companion config:",
-			`  declaration leaf: ${toRelativePath(config.rootDir, dtsProject.configPath)}`,
-			`  expected typecheck config: ${toRelativePath(config.rootDir, typecheckConfigPath)}`,
-			"  reason: every tsconfig*.dts.json project should have a matching tsconfig*.json file with the same typechecking semantics."
-		].join("\n"));
-		return;
-	}
-	const typecheckProject = parseProject$1(config, typecheckConfigPath, dtsProject.extensions);
-	for (const optionName of comparableTypecheckOptions) {
-		const buildValue = dtsProject.options[optionName];
-		const typecheckValue = typecheckProject.options[optionName];
-		if (compilerOptionEquals(buildValue, typecheckValue)) continue;
-		problems.push([
-			"Typecheck option mismatch between declaration leaf and companion config:",
-			`  declaration leaf: ${toRelativePath(config.rootDir, dtsProject.configPath)}`,
-			`  typecheck config: ${toRelativePath(config.rootDir, typecheckConfigPath)}`,
-			`  option: compilerOptions.${optionName}`,
-			`  declaration value: ${formatCompilerOptionValue(buildValue)}`,
-			`  typecheck value: ${formatCompilerOptionValue(typecheckValue)}`,
-			"  reason: tsconfig*.dts.json should emit with the same typechecking semantics as its matching tsconfig*.json companion."
-		].join("\n"));
-	}
-	const typecheckFiles = new Set(typecheckProject.fileNames);
-	const missingFiles = dtsProject.fileNames.filter((fileName) => !typecheckFiles.has(fileName));
-	if (missingFiles.length === 0) return;
-	problems.push([
-		"Declaration leaf includes files missing from its companion typecheck config:",
-		`  declaration leaf: ${toRelativePath(config.rootDir, dtsProject.configPath)}`,
-		`  typecheck config: ${toRelativePath(config.rootDir, typecheckConfigPath)}`,
-		"  files:",
-		...missingFiles.slice(0, 10).map((fileName) => `    - ${toRelativePath(config.rootDir, fileName)}`),
-		...missingFiles.length > 10 ? [`    ...and ${missingFiles.length - 10} more`] : [],
-		"  reason: a declaration leaf must not emit declarations for files that are not covered by the matching typecheck target."
-	].join("\n"));
+function resolveLinkTargetPath(importerPackage, specifier) {
+	return normalizeAbsolutePath(path.resolve(importerPackage.directory, specifier.slice(5)));
 }
-function addDeniedReferenceProblems(options) {
-	if (!options.project.label) return;
-	for (const referencePath of options.project.references) {
-		if (!options.projectsByPath.has(referencePath)) continue;
-		const deniedRefRule = getDeniedRefRule(options.rules, options.project.label, referencePath);
-		const targetPackage = findPackageForFile(referencePath, options.packages);
-		const deniedDepRule = targetPackage ? getDeniedDepRuleForPackage(options.rules, options.project.label, targetPackage.name) : null;
-		if (!deniedRefRule && !deniedDepRule) continue;
-		const lines = [
-			"Denied graph access:",
-			`  rule: ${options.project.label}`,
-			`  referencing project: ${toRelativePath(options.config.rootDir, options.project.configPath)}`,
-			`  referenced project: ${toRelativePath(options.config.rootDir, referencePath)}`
-		];
-		if (deniedDepRule) lines.push(`  denied dependency: ${deniedDepRule.name}`, `  reason: ${deniedDepRule.reason}`);
-		else if (deniedRefRule) lines.push(`  denied ref: ${toRelativePath(options.config.rootDir, deniedRefRule.path)}`, `  reason: ${deniedRefRule.reason}`);
-		options.problems.push(lines.join("\n"));
-	}
-}
-function addDeniedDepImportProblem(options) {
-	options.problems.push([
-		"Denied graph access:",
-		`  rule: ${options.project.label}`,
-		`  importing project: ${toRelativePath(options.config.rootDir, options.project.configPath)}`,
-		`  file: ${toRelativePath(options.config.rootDir, options.importRecord.filePath)}:${options.importRecord.line}`,
-		`  imported specifier: ${options.importRecord.specifier}`,
-		`  denied dependency: ${options.rule.name}`,
-		`  reason: ${options.rule.reason}`
-	].join("\n"));
+function matchesArtifactDirectory(config, targetPackage, linkTargetPath) {
+	return configuredArtifactDirectories(config).some((artifactDirectory) => {
+		return isPathInsideDirectory(linkTargetPath, normalizeAbsolutePath(path.join(targetPackage.directory, artifactDirectory)));
+	});
 }
-function addDeniedRefImportProblem(options) {
-	options.problems.push([
-		"Denied graph access:",
-		`  rule: ${options.project.label}`,
-		`  importing project: ${toRelativePath(options.config.rootDir, options.project.configPath)}`,
-		`  file: ${toRelativePath(options.config.rootDir, options.importRecord.filePath)}:${options.importRecord.line}`,
-		`  imported specifier: ${options.importRecord.specifier}`,
-		`  target project: ${toRelativePath(options.config.rootDir, options.targetProjectPath)}`,
-		`  denied ref: ${toRelativePath(options.config.rootDir, options.rule.path)}`,
-		`  reason: ${options.rule.reason}`
-	].join("\n"));
+function createSchemaPath(config, packageDir) {
+	const schemaPath = toPosixPath(path.relative(packageDir, path.join(config.rootDir, "node_modules/nx/schemas/project-schema.json")));
+	return schemaPath.startsWith(".") ? schemaPath : `./${schemaPath}`;
 }
-function getNodeModulesPackageName(filePath) {
-	const parts = filePath.split("/");
-	const nodeModulesIndex = parts.lastIndexOf("node_modules");
-	if (nodeModulesIndex === -1) return null;
-	const packageName = parts[nodeModulesIndex + 1];
-	if (!packageName) return null;
-	if (packageName.startsWith("@")) {
-		const scopedName = parts[nodeModulesIndex + 2];
-		return scopedName ? `${packageName}/${scopedName}` : null;
-	}
-	return packageName;
-}
-function getResolvedPackageName(filePath, packages) {
-	return getNodeModulesPackageName(filePath) ?? findPackageForFile(filePath, packages)?.name ?? null;
-}
-function getResolvedWorkspacePackage(filePath, packages) {
-	if (getNodeModulesPackageName(filePath)) return null;
-	return findPackageForFile(filePath, packages);
-}
-function addWorkspaceReferenceDependencyProblems(config, project, projectsByPath, packages, importers, problems) {
-	if (!isDtsProjectConfig(project.configPath)) return;
-	const sourcePackage = findPackageForFile(project.configPath, packages);
-	const importer = sourcePackage ? findImporterForFile$1(project.configPath, importers) : null;
-	if (!sourcePackage) return;
-	for (const referencePath of project.references) {
-		if (!projectsByPath.has(referencePath)) continue;
-		const targetPackage = findPackageForFile(referencePath, packages);
-		if (!targetPackage || targetPackage.name === sourcePackage.name) continue;
-		if (importer?.workspaceDependencies.has(targetPackage.name)) continue;
-		problems.push([
-			"Project reference crosses workspace packages without a workspace:* dependency:",
-			`  referencing project: ${toRelativePath(config.rootDir, project.configPath)}`,
-			`  referenced project: ${toRelativePath(config.rootDir, referencePath)}`,
-			`  referencing package: ${sourcePackage.name}`,
-			`  referenced package: ${targetPackage.name}`,
-			`  package manifest: ${toRelativePath(config.rootDir, path.join(sourcePackage.directory, "package.json"))}`,
-			`  reason: a cross-package tsconfig*.dts.json reference is a source dependency edge, so ${sourcePackage.name} must declare ${targetPackage.name} with the workspace: protocol.`,
-			`  fix: add "${targetPackage.name}": "workspace:*" to dependencies, devDependencies, peerDependencies, or optionalDependencies in the referencing package manifest. If this package intentionally consumes built artifacts, remove the project reference; ${formatArtifactDependencyPolicy(targetPackage)}`
-		].join("\n"));
-	}
+async function readJsonFile(filePath) {
+	return JSON.parse(await readFile(filePath, "utf8"));
 }
-async function runGraphCheckInternal(config, options = {}) {
-	const graphRoute = collectSourceGraphProjectExtensions(config);
-	const projectPaths = [...graphRoute.projectExtensionsByPath.keys()].sort();
-	const projects = projectPaths.map((projectPath) => parseProject$1(config, projectPath, graphRoute.projectExtensionsByPath.get(projectPath)));
-	const projectsByPath = new Map(projects.map((project) => [project.configPath, project]));
-	const fileOwnerLookup = createFileOwnerLookup$1(projects);
-	const packages = await collectWorkspacePackages(config);
-	const importers = collectImporters(config, packages);
-	const problems = [...graphRoute.problems];
-	const graphRules = normalizeGraphRules({
-		config,
-		include: {
-			deps: true,
-			refs: true
-		},
-		packages,
-		problems,
-		projectPaths
+function isRecord$2(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function normalizeNxTargets(targets) {
+	const normalizedTargets = (targets ?? defaultNxTargets).map((target) => target.trim()).filter(Boolean);
+	const uniqueTargets = [];
+	for (const target of normalizedTargets) if (!uniqueTargets.includes(target)) uniqueTargets.push(target);
+	return uniqueTargets.length > 0 ? uniqueTargets : [...defaultNxTargets];
+}
+function formatNxTargets(targets) {
+	return targets.join(" ");
+}
+function createDependsOn(dependencyNames) {
+	return dependencyNames.length > 0 ? [{
+		projects: dependencyNames,
+		target: "build"
+	}] : [];
+}
+function createGeneratedProjectJsonContent(config, plan, targets) {
+	return stringifyJson({
+		$schema: createSchemaPath(config, path.dirname(plan.outputPath)),
+		name: plan.packageName,
+		targets: Object.fromEntries(targets.map((target) => [target, { dependsOn: createDependsOn(plan.dependencyNames) }])),
+		metadata: { limina: { generated: true } }
 	});
-	for (const project of projects) {
-		if (project.labelProblem) problems.push(project.labelProblem);
-		addDtsOptionProblems(config, project, problems);
-		addTypecheckParityProblems(config, project, problems);
-		addDeniedReferenceProblems({
-			config,
-			packages,
-			problems,
-			project,
-			projectsByPath,
-			rules: graphRules
-		});
-		addWorkspaceReferenceDependencyProblems(config, project, projectsByPath, packages, importers, problems);
-		for (const filePath of project.fileNames) for (const importRecord of collectImportsFromFile$1(filePath, config.rootDir)) {
-			const rawDeniedDepRule = getDeniedDepRuleForSpecifier(graphRules, project.label, importRecord.specifier);
-			if (rawDeniedDepRule) {
-				addDeniedDepImportProblem({
-					config,
-					importRecord,
-					problems,
-					project,
-					rule: rawDeniedDepRule
-				});
-				continue;
-			}
-			const resolvedFilePath = resolveInternalImport$1(importRecord.specifier, filePath, project.options, project.extensions);
-			const targetPackage = findPackageForSpecifier(importRecord.specifier, packages);
-			const importer = findImporterForFile$1(importRecord.filePath, importers);
-			if (!resolvedFilePath) {
-				if (!targetPackage) continue;
-				problems.push([
-					"Unresolved workspace import:",
-					`  importing project: ${toRelativePath(config.rootDir, project.configPath)}`,
-					`  file: ${toRelativePath(config.rootDir, importRecord.filePath)}:${importRecord.line}`,
-					`  imported specifier: ${importRecord.specifier}`,
-					`  matched workspace package: ${targetPackage.name}`,
-					`  current references: ${formatReferences(config.rootDir, project.references)}`
-				].join("\n"));
-				continue;
-			}
-			const targetWorkspacePackageForResolved = getResolvedWorkspacePackage(resolvedFilePath, packages);
-			const targetPackageForGraph = targetPackage;
-			const resolvedPackageName = getResolvedPackageName(resolvedFilePath, packages);
-			const deniedDepRule = resolvedPackageName ? getDeniedDepRuleForPackage(graphRules, project.label, resolvedPackageName) : null;
-			if (deniedDepRule) {
-				addDeniedDepImportProblem({
-					config,
-					importRecord,
-					problems,
-					project,
-					rule: deniedDepRule
-				});
-				continue;
-			}
-			if (isRelativeSpecifier(importRecord.specifier)) {
-				const sourcePackage = findPackageForFile(importRecord.filePath, packages);
-				if (sourcePackage && targetWorkspacePackageForResolved && sourcePackage.name !== targetWorkspacePackageForResolved.name) {
-					problems.push([
-						"Cross-package relative import:",
-						`  importing project: ${toRelativePath(config.rootDir, project.configPath)}`,
-						`  file: ${toRelativePath(config.rootDir, importRecord.filePath)}:${importRecord.line}`,
-						`  imported specifier: ${importRecord.specifier}`,
-						`  source package: ${sourcePackage.name}`,
-						`  target package: ${targetWorkspacePackageForResolved.name}`,
-						`  resolved file: ${toRelativePath(config.rootDir, resolvedFilePath)}`,
-						"  reason: workspace packages must depend through package exports."
-					].join("\n"));
-					continue;
-				}
-			}
-			if (targetPackageForGraph && shouldResolveThroughGraph$1(importer, targetPackageForGraph) && !fileOwnerLookup.has(resolvedFilePath)) {
-				const referencedProjectPath = inferPackageProject$1(resolvedFilePath, targetPackageForGraph, projectPaths);
-				const hasProjectReference = referencedProjectPath && project.references.has(referencedProjectPath);
+}
+function addUniqueDependency(dependencyNames, dependencyName) {
+	if (!dependencyNames.includes(dependencyName)) dependencyNames.push(dependencyName);
+}
+function findArtifactCycle(edgesByPackageName) {
+	const visited = /* @__PURE__ */ new Set();
+	const visiting = /* @__PURE__ */ new Set();
+	const stack = [];
+	const visit = (packageName) => {
+		if (visiting.has(packageName)) {
+			const start = stack.indexOf(packageName);
+			return [...stack.slice(start), packageName];
+		}
+		if (visited.has(packageName)) return null;
+		visiting.add(packageName);
+		stack.push(packageName);
+		for (const dependencyName of edgesByPackageName.get(packageName) ?? []) {
+			if (!edgesByPackageName.has(dependencyName)) continue;
+			const cycle = visit(dependencyName);
+			if (cycle) return cycle;
+		}
+		stack.pop();
+		visiting.delete(packageName);
+		visited.add(packageName);
+		return null;
+	};
+	for (const packageName of edgesByPackageName.keys()) {
+		const cycle = visit(packageName);
+		if (cycle) return cycle;
+	}
+	return null;
+}
+async function collectNxProjectSyncPlans(config) {
+	const rootDirIdentity = normalizeAbsolutePathIdentity(config.rootDir);
+	const workspacePackages = (await collectWorkspacePackages(config)).filter((workspacePackage) => normalizeAbsolutePathIdentity(workspacePackage.directory) !== rootDirIdentity);
+	const packagesByName = new Map(workspacePackages.map((workspacePackage) => [workspacePackage.name, workspacePackage]));
+	const buildablePackageNames = new Set(workspacePackages.filter((workspacePackage) => workspacePackage.manifest.scripts?.build).map((workspacePackage) => workspacePackage.name));
+	const edgesByPackageName = new Map(workspacePackages.map((workspacePackage) => [workspacePackage.name, []]));
+	const problems = [];
+	for (const workspacePackage of workspacePackages) {
+		const dependencyNames = edgesByPackageName.get(workspacePackage.name) ?? [];
+		for (const dependencies of getDependencySections(workspacePackage.manifest)) for (const [dependencyName, specifier] of Object.entries(dependencies)) {
+			if (!isLinkDependencySpecifier$1(specifier)) continue;
+			const targetPackage = packagesByName.get(dependencyName);
+			const dependencyLabel = `${workspacePackage.name} -> ${dependencyName}`;
+			if (!targetPackage) {
 				problems.push([
-					hasProjectReference ? "Referenced workspace dependency resolves through package exports to a build artifact:" : "Workspace source dependency resolved outside the source graph:",
-					`  importing project: ${toRelativePath(config.rootDir, project.configPath)}`,
-					...referencedProjectPath ? [`  referenced project: ${toRelativePath(config.rootDir, referencedProjectPath)}`, `  project reference present: ${hasProjectReference ? "yes" : "no"}`] : [],
-					`  file: ${toRelativePath(config.rootDir, importRecord.filePath)}:${importRecord.line}`,
-					`  imported specifier: ${importRecord.specifier}`,
-					`  resolved file: ${toRelativePath(config.rootDir, resolvedFilePath)}`,
-					"  reason: workspace:* dependencies are source dependencies, but TypeScript resolved this package export to a file not owned by the source graph. tsc -b does not rewrite package exports through project references.",
-					`  fix: expose source files from the dependency package exports, add a source paths config to this declaration leaf extends, or stop using workspace:* plus project references for artifact consumption; ${formatArtifactDependencyPolicy(targetPackageForGraph)}`,
-					"  hint: run `limina paths generate` to create a compatibility paths file, then manually add it to the first position of the listed tsconfig*.dts.json extends array."
+					"Nx build dependency points at an unknown workspace package:",
+					`  dependency: ${dependencyLabel}`,
+					`  specifier: ${specifier}`,
+					"  reason: link: workspace artifact dependencies must name a package from the pnpm workspace."
 				].join("\n"));
 				continue;
 			}
-			const targetProjectPath = findTargetProject({
-				fileOwnerLookup,
-				packages,
-				projectPaths,
-				resolvedFilePath,
-				specifier: importRecord.specifier
-			});
-			if (!targetProjectPath) {
-				if (!targetPackageForGraph) continue;
-				if (!targetWorkspacePackageForResolved) {
-					if (targetPackageForGraph && shouldResolveThroughGraph$1(importer, targetPackageForGraph)) problems.push([
-						"Workspace source import resolved outside the workspace graph:",
-						`  importing project: ${toRelativePath(config.rootDir, project.configPath)}`,
-						`  file: ${toRelativePath(config.rootDir, importRecord.filePath)}:${importRecord.line}`,
-						`  imported specifier: ${importRecord.specifier}`,
-						`  resolved file: ${toRelativePath(config.rootDir, resolvedFilePath)}`,
-						`  reason: workspace:* dependencies are source dependency edges and must resolve to files owned by the source graph; ${formatArtifactDependencyPolicy(targetPackageForGraph)}`
-					].join("\n"));
-					continue;
-				}
+			if (!buildablePackageNames.has(dependencyName)) {
 				problems.push([
-					"Unable to map workspace import to a graph project:",
-					`  importing project: ${toRelativePath(config.rootDir, project.configPath)}`,
-					`  file: ${toRelativePath(config.rootDir, importRecord.filePath)}:${importRecord.line}`,
-					`  imported specifier: ${importRecord.specifier}`,
-					`  resolved file: ${toRelativePath(config.rootDir, resolvedFilePath)}`,
-					`  current references: ${formatReferences(config.rootDir, project.references)}`
+					"Nx build dependency target has no build script:",
+					`  dependency: ${dependencyLabel}`,
+					`  package: ${toRelativePath(config.rootDir, targetPackage.directory)}`,
+					"  reason: link: artifact dependencies require the target package to define scripts.build."
 				].join("\n"));
 				continue;
 			}
-			if (targetProjectPath === project.configPath) continue;
-			const deniedRefRule = getDeniedRefRule(graphRules, project.label, targetProjectPath);
-			if (deniedRefRule) {
-				addDeniedRefImportProblem({
-					config,
-					importRecord,
-					problems,
-					project,
-					rule: deniedRefRule,
-					targetProjectPath
-				});
-				continue;
-			}
-			if (targetPackageForGraph && !shouldResolveThroughGraph$1(importer, targetPackageForGraph)) continue;
-			if (!projectsByPath.has(targetProjectPath)) {
+			const linkTargetPath = resolveLinkTargetPath(workspacePackage, specifier);
+			if (!matchesArtifactDirectory(config, targetPackage, linkTargetPath)) {
 				problems.push([
-					"Expected graph target is not reachable from any checker entry:",
-					`  importing project: ${toRelativePath(config.rootDir, project.configPath)}`,
-					`  file: ${toRelativePath(config.rootDir, importRecord.filePath)}:${importRecord.line}`,
-					`  imported specifier: ${importRecord.specifier}`,
-					`  expected graph project: ${toRelativePath(config.rootDir, targetProjectPath)}`
+					"Nx build dependency does not point at an artifact directory:",
+					`  dependency: ${dependencyLabel}`,
+					`  specifier: ${specifier}`,
+					`  resolved: ${toRelativePath(config.rootDir, linkTargetPath)}`,
+					`  expected artifact directories: ${configuredArtifactDirectories(config).join(", ")}`
 				].join("\n"));
 				continue;
 			}
-			if (!project.references.has(targetProjectPath)) problems.push([
-				"Missing project reference for workspace import:",
-				`  importing project: ${toRelativePath(config.rootDir, project.configPath)}`,
-				`  file: ${toRelativePath(config.rootDir, importRecord.filePath)}:${importRecord.line}`,
-				`  imported specifier: ${importRecord.specifier}`,
-				`  expected reference: ${toRelativePath(config.rootDir, targetProjectPath)}`,
-				`  current references: ${formatReferences(config.rootDir, project.references)}`
-			].join("\n"));
+			addUniqueDependency(dependencyNames, dependencyName);
 		}
 	}
-	if (problems.length > 0) {
-		GraphLogger.error(problems.join("\n\n"));
-		return false;
+	const cycle = findArtifactCycle(edgesByPackageName);
+	if (cycle) problems.push([
+		"Nx artifact build dependency cycle:",
+		`  cycle: ${cycle.join(" -> ")}`,
+		"  reason: link: artifact dependencies must form an acyclic build graph."
+	].join("\n"));
+	if (problems.length > 0) throw new Error(problems.join("\n\n"));
+	return workspacePackages.flatMap((workspacePackage) => {
+		return [{
+			dependencyNames: edgesByPackageName.get(workspacePackage.name) ?? [],
+			outputPath: path.join(workspacePackage.directory, "project.json"),
+			packageName: workspacePackage.name
+		}];
+	}).sort((left, right) => left.outputPath.localeCompare(right.outputPath));
+}
+function readTargetConfigs(projectJson) {
+	return isRecord$2(projectJson.targets) ? projectJson.targets : void 0;
+}
+function createInvalidProjectJsonError(config, plan) {
+	return new Error([
+		"Invalid Nx project config:",
+		`  package: ${plan.packageName}`,
+		`  file: ${toRelativePath(config.rootDir, plan.outputPath)}`,
+		"  reason: project.json must contain a JSON object."
+	].join("\n"));
+}
+function createInvalidTargetConfigError(config, plan, target) {
+	return new Error([
+		"Invalid Nx project target config:",
+		`  package: ${plan.packageName}`,
+		`  file: ${toRelativePath(config.rootDir, plan.outputPath)}`,
+		`  target: ${target}`,
+		"  reason: Limina can only sync dependsOn for target configs that are JSON objects."
+	].join("\n"));
+}
+function readDependsOnProjectSet(dependsOn) {
+	if (!Array.isArray(dependsOn)) return null;
+	const projectNames = /* @__PURE__ */ new Set();
+	for (const entry of dependsOn) {
+		if (!isRecord$2(entry) || !Array.isArray(entry.projects)) return null;
+		for (const projectName of entry.projects) {
+			if (typeof projectName !== "string") return null;
+			projectNames.add(projectName);
+		}
 	}
-	if (options.logSuccess ?? true) GraphLogger.success(`Checked ${projects.length} graph projects; references are valid.`);
+	return projectNames;
+}
+function areProjectSetsEqual(currentProjectNames, expectedProjectNames) {
+	if (!currentProjectNames) return false;
+	if (currentProjectNames.size !== expectedProjectNames.size) return false;
+	for (const projectName of currentProjectNames) if (!expectedProjectNames.has(projectName)) return false;
 	return true;
 }
-async function runGraphCheck(config, options = {}) {
+async function checkNxProjectSyncPlan(config, plan, targets) {
+	if (!existsSync(plan.outputPath)) return true;
+	const currentJson = await readJsonFile(plan.outputPath);
+	if (!isRecord$2(currentJson)) throw createInvalidProjectJsonError(config, plan);
+	const targetConfigs = readTargetConfigs(currentJson);
+	if (!targetConfigs) return false;
+	const expectedProjectNames = new Set(plan.dependencyNames);
+	for (const target of targets) {
+		if (!Object.hasOwn(targetConfigs, target)) continue;
+		const targetConfig = targetConfigs[target];
+		if (!isRecord$2(targetConfig)) return true;
+		if (!areProjectSetsEqual(readDependsOnProjectSet(targetConfig.dependsOn), expectedProjectNames)) return true;
+	}
+	return false;
+}
+async function writeNxProjectSyncPlan(config, plan, targets) {
+	if (!existsSync(plan.outputPath)) {
+		await mkdir(path.dirname(plan.outputPath), { recursive: true });
+		await writeFile(plan.outputPath, createGeneratedProjectJsonContent(config, plan, targets));
+		return true;
+	}
+	const currentJson = await readJsonFile(plan.outputPath);
+	if (!isRecord$2(currentJson)) throw createInvalidProjectJsonError(config, plan);
+	const targetConfigs = readTargetConfigs(currentJson);
+	if (!targetConfigs) return false;
+	let didChange = false;
+	const expectedDependsOn = createDependsOn(plan.dependencyNames);
+	for (const target of targets) {
+		if (!Object.hasOwn(targetConfigs, target)) continue;
+		const targetConfig = targetConfigs[target];
+		if (!isRecord$2(targetConfig)) throw createInvalidTargetConfigError(config, plan, target);
+		if (JSON.stringify(targetConfig.dependsOn) === JSON.stringify(expectedDependsOn)) continue;
+		targetConfig.dependsOn = expectedDependsOn;
+		didChange = true;
+	}
+	if (!didChange) return false;
+	await writeFile(plan.outputPath, stringifyJson(currentJson));
+	return true;
+}
+async function runNxInternal(config, options = {}) {
+	const targets = normalizeNxTargets(options.targets);
+	const syncPlans = await collectNxProjectSyncPlans(config);
+	const didChange = (await Promise.all(syncPlans.map((syncPlan) => options.check ? checkNxProjectSyncPlan(config, syncPlan, targets) : writeNxProjectSyncPlan(config, syncPlan, targets)))).some(Boolean);
+	const edgeCount = syncPlans.reduce((total, syncPlan) => total + syncPlan.dependencyNames.length, 0) * targets.length;
+	const action = options.check ? didChange ? "Would update" : "Checked unchanged" : didChange ? "Synced" : "Skipped unchanged";
+	NxLogger.info(`${action} ${syncPlans.length} Nx project config files across ${targets.length} target${targets.length === 1 ? "" : "s"} with ${edgeCount} build dependency edges.`);
+	if (options.check && didChange) NxLogger.error(`Nx project config state is stale; run \`limina nx sync ${formatNxTargets(targets)}\`.`);
+	return {
+		changed: didChange,
+		edgeCount,
+		outputCount: syncPlans.length
+	};
+}
+async function runNx(config, options = {}) {
 	if (options.clearScreen ?? true) clearCliScreen();
 	const elapsed = createElapsedTimer();
-	const task = options.flow?.start("graph check", { depth: options.flowDepth ?? 0 });
-	GraphLogger.info("graph check started");
+	const targets = normalizeNxTargets(options.targets);
+	const action = options.check ? `nx check ${formatNxTargets(targets)}` : `nx sync ${formatNxTargets(targets)}`;
+	const task = options.flow?.start(action, { depth: options.flowDepth ?? 0 });
+	NxLogger.info(`${action} started`);
 	try {
-		const logSuccess = !options.flow?.interactive;
-		const passed = await runGraphCheckInternal(config, { logSuccess });
-		if (passed) {
-			if (logSuccess) GraphLogger.success("graph check finished", elapsed());
-			task?.pass();
+		const result = await runNxInternal(config, options);
+		if (options.check && result.changed) {
+			NxLogger.error(`${action} finished with stale files`, elapsed());
+			task?.fail(`${action} finished with stale files`);
 		} else {
-			GraphLogger.error("graph check finished with failures", elapsed());
-			task?.fail("graph check finished with failures");
+			if (!options.flow?.interactive) NxLogger.success(`${action} finished`, elapsed());
+			task?.pass();
 		}
-		return passed;
+		return result;
 	} catch (error) {
-		GraphLogger.error(`graph check failed: ${formatErrorMessage$1(error)}`, elapsed());
-		task?.fail("graph check failed", { error });
+		NxLogger.error(`${action} failed: ${formatErrorMessage$1(error)}`, elapsed());
+		task?.fail(`${action} failed`, { error });
 		throw error;
 	}
 }
@@ -439,6 +294,49 @@ const nodeBuiltinSpecifiers = new Set(builtinModules.flatMap((specifier) => spec
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function collectPackageDependencyEntries$1(manifest) {
+	const sectionNames = [
+		"dependencies",
+		"devDependencies",
+		"peerDependencies",
+		"optionalDependencies"
+	];
+	const entries = [];
+	for (const sectionName of sectionNames) {
+		const section = manifest[sectionName];
+		if (!isRecord$1(section)) continue;
+		for (const [dependencyName, specifier] of Object.entries(section)) {
+			if (typeof specifier !== "string") continue;
+			entries.push({
+				dependencyName,
+				sectionName,
+				specifier
+			});
+		}
+	}
+	return entries;
+}
+function collectStrictBuiltPackageManifestProblems(options) {
+	const problems = [];
+	if (typeof options.manifest.name !== "string" || options.manifest.name.trim().length === 0) problems.push([
+		`[${options.label}] [strict] output package.json is not a complete npm package manifest`,
+		`  package.json: ${options.packageJsonPath}`,
+		"  field: name",
+		"  reason: strict: true requires built package outputs to include a non-empty package name."
+	].join("\n"));
+	for (const entry of collectPackageDependencyEntries$1(options.manifest)) {
+		if (!isLocalPackageDependencySpecifier(entry.specifier)) continue;
+		problems.push([
+			`[${options.label}] [strict] output package.json exposes a pnpm-local dependency specifier`,
+			`  package.json: ${options.packageJsonPath}`,
+			`  dependency: ${entry.dependencyName}`,
+			`  section: ${entry.sectionName}`,
+			`  specifier: ${entry.specifier}`,
+			"  reason: strict: true requires built package manifests to be publish-ready npm package manifests without workspace:, link:, file:, or catalog: specifiers."
+		].join("\n"));
+	}
+	return problems;
+}
 function isPackageCheckTool(value) {
 	return PACKAGE_CHECK_TOOLS.has(value);
 }
@@ -767,11 +665,16 @@ async function runPackageCheckEntry(options) {
 	const task = options.flow?.start(`package entry: ${label}`, { depth: options.flowDepth ?? 0 });
 	let packedDist;
 	try {
-		await readDistPackageJson({
+		const outputManifest = await readDistPackageJson({
 			config: options.config,
 			label,
 			packageJsonPath: outputPackageJsonPath
 		});
+		const strictManifestProblems = isStrictConfig(options.config) ? collectStrictBuiltPackageManifestProblems({
+			label,
+			manifest: outputManifest,
+			packageJsonPath: toRelativePath(options.config.rootDir, outputPackageJsonPath)
+		}) : [];
 		if (options.checks.includes("publint") || options.checks.includes("attw")) {
 			const packTask = options.flow?.start(`package tarball: ${label}`, { depth: (options.flowDepth ?? 0) + 1 });
 			PackageLogger.info(`package tarball packing started: ${label}`);
@@ -786,7 +689,8 @@ async function runPackageCheckEntry(options) {
 			if (!options.flow?.interactive) PackageLogger.success(`package tarball packed: ${label}`, packElapsed());
 			packTask?.pass();
 		}
-		let passed = true;
+		let passed = strictManifestProblems.length === 0;
+		for (const problem of strictManifestProblems) PackageLogger.error(problem);
 		if (options.checks.includes("publint")) passed = await runPublintCheck({
 			flow: options.flow,
 			flowDepth: (options.flowDepth ?? 0) + 1,
@@ -910,194 +814,6 @@ async function runPackageCheck(options) {
 	}
 }
 
-//#endregion
-//#region src/package-exports.ts
-const defaultSourceExtensions = [
-	".ts",
-	".tsx",
-	".mts",
-	".cts",
-	".d.ts",
-	".d.mts",
-	".d.cts"
-];
-const defaultConditionPriority = [
-	"source",
-	"development",
-	"types",
-	"import",
-	"module",
-	"default",
-	"require"
-];
-const defaultArtifactDirectories = [
-	"dist",
-	"build",
-	"lib",
-	"esm",
-	"cjs",
-	"out"
-];
-function configuredArtifactDirectories(config) {
-	return config.paths?.artifactDirectories ?? defaultArtifactDirectories;
-}
-function configuredSourceExtensions(config) {
-	return config.paths?.sourceExtensions ?? defaultSourceExtensions;
-}
-function collectTargetCandidates(config, value) {
-	if (typeof value === "string") return [value];
-	if (!value || typeof value !== "object" || Array.isArray(value)) return [];
-	const record = value;
-	const candidates = [];
-	const visitedKeys = /* @__PURE__ */ new Set();
-	for (const key of config.paths?.conditionPriority ?? defaultConditionPriority) {
-		if (!(key in record)) continue;
-		visitedKeys.add(key);
-		candidates.push(...collectTargetCandidates(config, record[key]));
-	}
-	for (const key of Object.keys(record).sort()) {
-		if (visitedKeys.has(key)) continue;
-		candidates.push(...collectTargetCandidates(config, record[key]));
-	}
-	return candidates;
-}
-function normalizePackageTarget(target) {
-	if (!target.startsWith("./")) return null;
-	return target.slice(2);
-}
-function packageExportKeyToAlias(packageName, exportKey) {
-	if (exportKey === ".") return packageName;
-	if (!exportKey.startsWith("./")) return "";
-	return `${packageName}/${exportKey.slice(2)}`;
-}
-function removeKnownExtension(filePath) {
-	for (const extension of [
-		".d.mts",
-		".d.cts",
-		".d.ts",
-		".mts",
-		".cts",
-		".mjs",
-		".cjs",
-		".js",
-		".tsx",
-		".ts"
-	]) if (filePath.endsWith(extension)) return filePath.slice(0, -extension.length);
-	return filePath;
-}
-function hasConfiguredSourceExtension(config, target) {
-	return configuredSourceExtensions(config).some((extension) => target.endsWith(extension));
-}
-function isInsideArtifactDirectory(config, target) {
-	const normalizedTarget = normalizeSlashes(target);
-	return configuredArtifactDirectories(config).some((directoryName) => {
-		const normalizedDirectoryName = normalizeSlashes(directoryName).replace(/\/+$/u, "");
-		return normalizedTarget === normalizedDirectoryName || normalizedTarget.startsWith(`${normalizedDirectoryName}/`);
-	});
-}
-function isLikelySourceTarget(config, target) {
-	return hasConfiguredSourceExtension(config, target) && !isInsideArtifactDirectory(config, target);
-}
-function stripArtifactPrefix(config, target) {
-	const normalizedTarget = normalizeSlashes(target);
-	for (const directoryName of configuredArtifactDirectories(config)) {
-		const normalizedDirectoryName = normalizeSlashes(directoryName).replace(/\/+$/u, "");
-		if (normalizedTarget.startsWith(`${normalizedDirectoryName}/`)) return normalizedTarget.slice(normalizedDirectoryName.length + 1);
-	}
-	return normalizedTarget;
-}
-function sourceFileCandidates(config, target) {
-	const normalizedTarget = normalizeSlashes(target);
-	const withoutKnownExtension = removeKnownExtension(normalizedTarget);
-	const withoutArtifactPrefix = stripArtifactPrefix(config, normalizedTarget);
-	const sourceBase = removeKnownExtension(withoutArtifactPrefix);
-	const bases = withoutArtifactPrefix === normalizedTarget ? [
-		withoutKnownExtension,
-		sourceBase,
-		`src/${sourceBase}`,
-		`${sourceBase}/index`,
-		`src/${sourceBase}/index`
-	] : [
-		sourceBase,
-		`src/${sourceBase}`,
-		`${sourceBase}/index`,
-		`src/${sourceBase}/index`
-	];
-	const candidates = [];
-	for (const base of bases) for (const extension of configuredSourceExtensions(config)) candidates.push(`${base}${extension}`);
-	return [...new Set(candidates)];
-}
-function wildcardBaseDirectory(pattern) {
-	const wildcardIndex = pattern.indexOf("*");
-	const prefix = wildcardIndex === -1 ? pattern : pattern.slice(0, wildcardIndex);
-	const lastSlashIndex = prefix.lastIndexOf("/");
-	return lastSlashIndex === -1 ? "." : prefix.slice(0, lastSlashIndex);
-}
-function sourceWildcardPatternCandidates(config, target) {
-	const strippedPattern = stripArtifactPrefix(config, target);
-	const sourcePattern = removeKnownExtension(strippedPattern);
-	const preferSrcPrefix = strippedPattern !== normalizeSlashes(target);
-	const candidates = [];
-	for (const extension of configuredSourceExtensions(config)) if (preferSrcPrefix) {
-		candidates.push(`src/${sourcePattern}${extension}`);
-		candidates.push(`${sourcePattern}${extension}`);
-	} else {
-		candidates.push(`${sourcePattern}${extension}`);
-		candidates.push(`src/${sourcePattern}${extension}`);
-	}
-	return [...new Set(candidates)];
-}
-function resolveWildcardTarget(config, packageDirectory, target) {
-	const sourcePatterns = sourceWildcardPatternCandidates(config, target);
-	const candidatePatterns = isLikelySourceTarget(config, target) ? [target, ...sourcePatterns] : sourcePatterns;
-	for (const candidatePattern of candidatePatterns) {
-		const baseDirectory = wildcardBaseDirectory(candidatePattern);
-		if (existsSync(path.join(packageDirectory, baseDirectory))) return toPosixPath(path.join(toRelativePath(config.rootDir, packageDirectory), candidatePattern));
-	}
-	return null;
-}
-function resolveExactTarget(config, packageDirectory, target) {
-	const absoluteTarget = path.join(packageDirectory, target);
-	if (existsSync(absoluteTarget) && isLikelySourceTarget(config, target)) return normalizeWorkspacePath(config.rootDir, absoluteTarget);
-	for (const candidate of sourceFileCandidates(config, target)) {
-		const absoluteCandidate = path.join(packageDirectory, candidate);
-		if (existsSync(absoluteCandidate)) return normalizeWorkspacePath(config.rootDir, absoluteCandidate);
-	}
-	return null;
-}
-function resolvePackageTarget(config, packageDirectory, rawTarget) {
-	const target = normalizePackageTarget(rawTarget);
-	if (!target) return null;
-	if (target.includes("*")) return resolveWildcardTarget(config, packageDirectory, target);
-	return resolveExactTarget(config, packageDirectory, target);
-}
-function collectExportEntries(config, workspacePackage) {
-	const exportsField = workspacePackage.manifest.exports;
-	if (!exportsField) return [];
-	const exportEntries = typeof exportsField === "object" && exportsField !== null && !Array.isArray(exportsField) && Object.keys(exportsField).some((key) => key.startsWith(".")) ? Object.entries(exportsField) : [[".", exportsField]];
-	const entries = [];
-	for (const [exportKey, exportValue] of exportEntries.sort(([left], [right]) => left.localeCompare(right))) {
-		const alias = packageExportKeyToAlias(workspacePackage.name, exportKey);
-		if (!alias) continue;
-		for (const candidate of collectTargetCandidates(config, exportValue)) {
-			const resolvedTarget = resolvePackageTarget(config, workspacePackage.directory, candidate);
-			if (resolvedTarget) {
-				entries.push([alias, resolvedTarget]);
-				break;
-			}
-		}
-	}
-	return entries;
-}
-function aliasMatchesSpecifier(alias, specifier) {
-	if (alias === specifier) return true;
-	const wildcardIndex = alias.indexOf("*");
-	if (wildcardIndex === -1) return false;
-	const prefix = alias.slice(0, wildcardIndex);
-	const suffix = alias.slice(wildcardIndex + 1);
-	return specifier.startsWith(prefix) && specifier.endsWith(suffix);
-}
-
 //#endregion
 //#region src/commands/paths.ts
 function generatedFileName(config) {
@@ -1106,78 +822,13 @@ function generatedFileName(config) {
 function generatedFileMarker(config) {
 	return config.paths?.generatedFileMarker ?? "GENERATED FILE - DO NOT EDIT BY HAND.";
 }
-function parseProject(config, configPath) {
-	const diagnostics = [];
-	const parsed = ts.getParsedCommandLineOfConfigFile(configPath, {}, {
-		...ts.sys,
-		onUnRecoverableConfigFileDiagnostic: (diagnostic) => {
-			diagnostics.push(diagnostic);
-		}
-	});
-	if (!parsed) throw new Error(ts.formatDiagnosticsWithColorAndContext(diagnostics, {
-		getCanonicalFileName: (fileName) => fileName,
-		getCurrentDirectory: () => config.rootDir,
-		getNewLine: () => "\n"
-	}));
-	if (parsed.errors.length > 0) throw new Error(ts.formatDiagnosticsWithColorAndContext(parsed.errors, {
-		getCanonicalFileName: (fileName) => fileName,
-		getCurrentDirectory: () => config.rootDir,
-		getNewLine: () => "\n"
-	}));
-	return {
-		configPath: normalizeAbsolutePath(configPath),
-		fileNames: parsed.fileNames.filter((fileName) => /\.(?:[cm]?tsx?|d\.[cm]?ts)$/u.test(fileName)).map(normalizeAbsolutePath),
-		options: parsed.options,
-		references: new Set(getRawReferencePaths(config, configPath))
-	};
-}
-function getSourceFileKind(filePath) {
-	if (filePath.endsWith(".tsx")) return ts.ScriptKind.TSX;
-	if (filePath.endsWith(".jsx")) return ts.ScriptKind.JSX;
-	return ts.ScriptKind.TS;
-}
-function stringLiteralValue(node) {
-	return node && ts.isStringLiteralLike(node) ? node.text : null;
-}
-function collectImportsFromFile(filePath) {
-	const sourceText = readFileSync(filePath, "utf8");
-	const sourceFile = ts.createSourceFile(filePath, sourceText, ts.ScriptTarget.Latest, true, getSourceFileKind(filePath));
-	const imports = [];
-	const addImport = (specifier, node) => {
-		const location = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
-		imports.push({
-			filePath,
-			line: location.line + 1,
-			specifier
-		});
-	};
-	const visit = (node) => {
-		if (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) {
-			const specifier = stringLiteralValue(node.moduleSpecifier);
-			if (specifier) addImport(specifier, node);
-		} else if (ts.isImportTypeNode(node)) {
-			const specifier = ts.isLiteralTypeNode(node.argument) ? stringLiteralValue(node.argument.literal) : null;
-			if (specifier) addImport(specifier, node);
-		} else if (ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.ImportKeyword) {
-			const specifier = stringLiteralValue(node.arguments[0]);
-			if (specifier) addImport(specifier, node);
-		}
-		ts.forEachChild(node, visit);
-	};
-	visit(sourceFile);
-	return imports;
-}
-function resolveInternalImport(specifier, containingFile, options) {
-	const resolved = ts.resolveModuleName(specifier, containingFile, options, ts.sys).resolvedModule;
-	return resolved?.resolvedFileName ? normalizeAbsolutePath(resolved.resolvedFileName) : null;
-}
-function resolveImportWithoutMatchingPaths(specifier, containingFile, options) {
-	if (!options.paths) return resolveInternalImport(specifier, containingFile, options);
+function resolveImportWithoutMatchingPaths(specifier, containingFile, options, project, importAnalysis) {
+	if (!options.paths) return resolveInternalImport(specifier, containingFile, options, project, importAnalysis);
 	const paths = Object.fromEntries(Object.entries(options.paths).filter(([alias]) => !aliasMatchesSpecifier(alias, specifier)));
 	return resolveInternalImport(specifier, containingFile, {
 		...options,
 		paths: Object.keys(paths).length > 0 ? paths : void 0
-	});
+	}, project, importAnalysis);
 }
 function createFileOwnerLookup(projects) {
 	const ownerLookup = /* @__PURE__ */ new Map();
@@ -1244,7 +895,7 @@ function formatPaths(config, paths, outputDirectory) {
 function formatGeneratedConfig(config, paths, outputPath) {
 	const outputDirectory = path.dirname(outputPath);
 	return `{
-  "$schema": "https://json.schemastore.org/tsconfig",
+  "$schema": "${createLiminaTsconfigSchemaPath(config.rootDir, outputPath)}",
   /**
    * ${generatedFileMarker(config)}
    *
@@ -1280,24 +931,25 @@ function createGeneratedConfigs(config, drafts) {
 	})).filter((generatedConfig) => generatedConfig.aliasCount > 0).sort((left, right) => left.outputPath.localeCompare(right.outputPath));
 }
 async function collectGeneratedConfigs(config) {
-	const graphRoute = collectGraphProjectRoute(config);
-	const projectPaths = graphRoute.projectPaths;
+	const graphRoute = collectSourceGraphProjectExtensions(config);
+	const projectPaths = [...graphRoute.projectContextsByPath.keys()].sort();
 	if (graphRoute.problems.length > 0) throw new Error(graphRoute.problems.join("\n\n"));
-	const projects = projectPaths.map((projectPath) => parseProject(config, projectPath));
+	const projects = projectPaths.map((projectPath) => parseProject(config, projectPath, graphRoute.projectContextsByPath.get(projectPath)));
 	const fileOwnerLookup = createFileOwnerLookup(projects);
 	const packages = await collectWorkspacePackages(config);
 	const importers = collectImporters(config, packages);
 	const exportEntriesByPackage = /* @__PURE__ */ new Map();
 	const drafts = /* @__PURE__ */ new Map();
+	const importAnalysis = createImportAnalysisContext();
 	for (const project of projects) {
 		const keepsGeneratedPaths = projectExtendsGeneratedConfig(config, project.configPath);
-		for (const filePath of project.fileNames) for (const importRecord of collectImportsFromFile(filePath)) {
+		for (const filePath of project.fileNames) for (const importRecord of collectImportsFromFile(filePath, config.rootDir, importAnalysis)) {
 			const targetPackage = findPackageForSpecifier(importRecord.specifier, packages);
 			const importer = targetPackage ? findImporterForFile(importRecord.filePath, importers) : null;
 			if (!targetPackage || !shouldResolveThroughGraph(importer, targetPackage)) continue;
-			const resolvedFilePath = resolveInternalImport(importRecord.specifier, filePath, project.options);
+			const resolvedFilePath = resolveInternalImport(importRecord.specifier, filePath, project.options, project, importAnalysis);
 			if (!resolvedFilePath) continue;
-			const artifactResolvedFilePath = fileOwnerLookup.has(resolvedFilePath) && keepsGeneratedPaths ? resolveImportWithoutMatchingPaths(importRecord.specifier, filePath, project.options) : resolvedFilePath;
+			const artifactResolvedFilePath = fileOwnerLookup.has(resolvedFilePath) && keepsGeneratedPaths ? resolveImportWithoutMatchingPaths(importRecord.specifier, filePath, project.options, project, importAnalysis) : resolvedFilePath;
 			if (!artifactResolvedFilePath || fileOwnerLookup.has(artifactResolvedFilePath)) continue;
 			const targetProjectPath = inferPackageProject(artifactResolvedFilePath, targetPackage, projectPaths);
 			if (!targetProjectPath || !project.references.has(targetProjectPath)) continue;
@@ -1421,6 +1073,7 @@ const defaultSourceExclude = [
 	"coverage",
 	"**/tsconfig*.json",
 	"**/package.json",
+	"**/project.json",
 	".prettierrc.json",
 	".markdownlint.json",
 	"vercel.json"
@@ -1456,13 +1109,32 @@ const ignoredSemanticCompilerOptions = new Set([
 	"sourceRoot",
 	"tsBuildInfoFile"
 ]);
-const typeScriptCheckerExtensions = getCheckerAdapter("tsc")?.defaultExtensions ?? [];
-function getFirstClassCoverageExtensions(extensions) {
-	return normalizeExtensions([...typeScriptCheckerExtensions, ...extensions]);
-}
+const javaScriptConfigFilePattern = /(?:^|[/\\])[^/\\]+\.config\.[cm]?js$/u;
+const typeScriptFamilyCheckerPresets = new Set([
+	"tsc",
+	"tsgo",
+	"vue-tsc",
+	"vue-tsgo"
+]);
 function getCheckerCoverageExtensions(checker) {
-	if (!getCheckerAdapter(checker.preset)?.sourceGraph) return checker.extensions;
-	return getFirstClassCoverageExtensions(checker.extensions);
+	return checker.extensions;
+}
+function getActiveCheckerContext(config) {
+	return {
+		checkerPresets: [...new Set(getActiveCheckers(config).map((checker) => checker.preset))],
+		extensions: getActiveCheckerExtensions(config)
+	};
+}
+function createCheckerProjectContext(options) {
+	const adapterExtensions = resolveCheckerProjectExtensions({
+		configPath: options.configPath,
+		preset: options.preset,
+		projectRootDir: options.config.rootDir
+	});
+	return {
+		checkerPresets: [options.preset],
+		extensions: normalizeExtensions([...options.extensions, ...adapterExtensions])
+	};
 }
 async function collectTsconfigPaths(config, pattern) {
 	return (await glob(pattern, {
@@ -1577,7 +1249,7 @@ function collectConfiguredAllowlistEntries(config) {
 			problems
 		};
 	}
-	rawEntries.forEach((entry, index) => {
+	for (const [index, entry] of rawEntries.entries()) {
 		const field = `proof.allowlist[${index}]`;
 		if (!isPlainRecord(entry)) {
 			problems.push([
@@ -1586,7 +1258,7 @@ function collectConfiguredAllowlistEntries(config) {
 				`  value: ${formatUnknownValue(entry)}`,
 				"  reason: allowlist entries must be objects with non-empty file and reason fields."
 			].join("\n"));
-			return;
+			continue;
 		}
 		const fileValue = entry.file;
 		const reasonValue = entry.reason;
@@ -1597,7 +1269,7 @@ function collectConfiguredAllowlistEntries(config) {
 				`  value: ${formatUnknownValue(fileValue)}`,
 				"  reason: allowlist file must be a non-empty string."
 			].join("\n"));
-			return;
+			continue;
 		}
 		if (typeof reasonValue !== "string" || reasonValue.trim().length === 0) {
 			problems.push([
@@ -1606,13 +1278,13 @@ function collectConfiguredAllowlistEntries(config) {
 				`  value: ${formatUnknownValue(reasonValue)}`,
 				"  reason: allowlist reason must be a non-empty string."
 			].join("\n"));
-			return;
+			continue;
 		}
 		entries.push({
 			filePath: normalizeAbsolutePath(path.join(config.rootDir, fileValue)),
 			reason: reasonValue.trim()
 		});
-	});
+	}
 	return {
 		entries,
 		problems
@@ -1623,45 +1295,123 @@ function addCoverage(coverageByFile, filePath, source) {
 	sources.push(source);
 	coverageByFile.set(filePath, sources);
 }
+function findTypeScriptFamilyChecker(config) {
+	return getActiveCheckers(config).find((checker) => typeScriptFamilyCheckerPresets.has(checker.preset)) ?? null;
+}
+function addPresetJavaScriptConfigCoverage(options) {
+	const checker = findTypeScriptFamilyChecker(options.config);
+	if (!checker) return;
+	for (const filePath of options.sourceFiles) {
+		if (options.coverageByFile.has(filePath) || !javaScriptConfigFilePattern.test(filePath)) continue;
+		addCoverage(options.coverageByFile, filePath, {
+			label: `${checker.name}:${checker.preset} preset`,
+			type: "preset"
+		});
+	}
+}
+function parseProjectCoverageFileNames(options) {
+	return parseCheckerProjectConfigForContext({
+		configPath: options.configPath,
+		context: options.context,
+		projectRootDir: options.config.rootDir
+	}).fileNames;
+}
 function collectCoverage(options) {
 	const coverageByFile = /* @__PURE__ */ new Map();
-	for (const route of options.graphRoutes) for (const graphProjectPath of route.projectPaths) for (const filePath of parseProjectFileNamesForExtensions(options.config, graphProjectPath, getFirstClassCoverageExtensions(route.extensions))) {
-		if (!options.sourceFiles.has(filePath)) continue;
-		addCoverage(coverageByFile, filePath, {
-			label: toRelativePath(options.config.rootDir, graphProjectPath),
-			type: "graph"
+	for (const route of options.graphRoutes) for (const graphProjectPath of route.projectPaths) {
+		const projectContext = createCheckerProjectContext({
+			config: options.config,
+			configPath: graphProjectPath,
+			extensions: route.extensions,
+			preset: route.checkerPreset
 		});
+		for (const filePath of parseProjectCoverageFileNames({
+			config: options.config,
+			configPath: graphProjectPath,
+			context: projectContext
+		})) {
+			const coverageSource = {
+				label: toRelativePath(options.config.rootDir, graphProjectPath),
+				type: "graph"
+			};
+			if (!options.sourceFiles.has(filePath)) {
+				if (options.outsideSourceCoverageByFile) addCoverage(options.outsideSourceCoverageByFile, filePath, coverageSource);
+				continue;
+			}
+			addCoverage(coverageByFile, filePath, coverageSource);
+		}
 	}
-	for (const checkerTarget of options.checkerTargets) for (const configPath of checkerTarget.coverageConfigPaths) for (const filePath of parseProjectFileNamesForExtensions(options.config, configPath, getCheckerCoverageExtensions(checkerTarget.checker))) {
-		if (!options.sourceFiles.has(filePath)) continue;
-		addCoverage(coverageByFile, filePath, {
-			label: `${toRelativePath(options.config.rootDir, configPath)} via ${checkerTarget.label}`,
-			type: "checker"
+	for (const checkerTarget of options.checkerTargets) for (const configPath of checkerTarget.coverageConfigPaths) {
+		const projectContext = createCheckerProjectContext({
+			config: options.config,
+			configPath,
+			extensions: getCheckerCoverageExtensions(checkerTarget.checker),
+			preset: checkerTarget.checker.preset
 		});
+		for (const filePath of parseProjectCoverageFileNames({
+			config: options.config,
+			configPath,
+			context: projectContext
+		})) {
+			const coverageSource = {
+				label: `${toRelativePath(options.config.rootDir, configPath)} via ${checkerTarget.label}`,
+				type: "checker"
+			};
+			if (!options.sourceFiles.has(filePath)) {
+				if (options.outsideSourceCoverageByFile) addCoverage(options.outsideSourceCoverageByFile, filePath, coverageSource);
+				continue;
+			}
+			addCoverage(coverageByFile, filePath, coverageSource);
+		}
 	}
-	if (options.includeAllowlist !== false) for (const entry of options.allowlistEntries) {
+	addPresetJavaScriptConfigCoverage({
+		config: options.config,
+		coverageByFile,
+		sourceFiles: options.sourceFiles
+	});
+	return coverageByFile;
+}
+function cloneCoverageByFile(coverageByFile) {
+	return new Map([...coverageByFile.entries()].map(([filePath, sources]) => [filePath, [...sources]]));
+}
+function addAllowlistCoverage(options) {
+	for (const entry of options.allowlistEntries) {
 		if (!options.sourceFiles.has(entry.filePath)) continue;
-		addCoverage(coverageByFile, entry.filePath, {
+		addCoverage(options.coverageByFile, entry.filePath, {
 			label: entry.reason,
 			type: "allowlist"
 		});
 	}
-	return coverageByFile;
 }
-function collectProjectExtensionsByPath(routes) {
-	const projectExtensionsByPath = /* @__PURE__ */ new Map();
+function collectProjectContextsByPath(config, routes) {
+	const projectContextsByPath = /* @__PURE__ */ new Map();
 	for (const route of routes) for (const projectPath of route.projectPaths) {
-		const extensions = new Set([...projectExtensionsByPath.get(projectPath) ?? [], ...route.extensions]);
-		projectExtensionsByPath.set(projectPath, [...extensions].sort());
+		const existingContext = projectContextsByPath.get(projectPath) ?? {
+			checkerPresets: [],
+			extensions: []
+		};
+		const routeContext = createCheckerProjectContext({
+			config,
+			configPath: projectPath,
+			extensions: route.extensions,
+			preset: route.checkerPreset
+		});
+		projectContextsByPath.set(projectPath, {
+			checkerPresets: [...new Set([...existingContext.checkerPresets, ...routeContext.checkerPresets])],
+			extensions: normalizeExtensions([...existingContext.extensions, ...routeContext.extensions])
+		});
 	}
-	return projectExtensionsByPath;
+	return projectContextsByPath;
 }
-function parseConfig(config, configPath, extensions = []) {
-	const diagnostics = [];
-	const configObject = readJsonConfig(config, configPath);
-	const parsed = ts.parseJsonConfigFileContent(configObject, ts.sys, path.dirname(configPath), {}, configPath, void 0, createExtraFileExtensions(extensions));
-	if (diagnostics.length > 0) throw new Error(ts.formatDiagnosticsWithColorAndContext(diagnostics, createFormatHost(config.rootDir)));
-	if (parsed.errors.length > 0) throw new Error(ts.formatDiagnosticsWithColorAndContext(parsed.errors, createFormatHost(config.rootDir)));
+function parseConfig(config, configPath, context = {
+	checkerPresets: [],
+	extensions: []
+}) {
+	const parsed = parseCheckerProjectConfigForContext({
+		configPath,
+		context,
+		projectRootDir: config.rootDir
+	});
 	return {
 		fileNames: parsed.fileNames.map(normalizeAbsolutePath).sort(),
 		options: parsed.options
@@ -1711,8 +1461,55 @@ function addDtsConfigSemanticProblems(options) {
 		].join("\n"));
 	}
 }
+function getDtsConfigPathForTypecheckConfig(configPath) {
+	const directory = path.dirname(configPath);
+	const fileName = path.basename(configPath);
+	const dtsFileName = fileName === "tsconfig.json" ? "tsconfig.dts.json" : fileName.replace(/\.json$/u, ".dts.json");
+	return normalizeAbsolutePath(path.join(directory, dtsFileName));
+}
+function isDefaultTypecheckAggregator(configObject) {
+	return Object.hasOwn(configObject, "references");
+}
+function normalizeRawExtends(value) {
+	if (typeof value === "string") return [value];
+	if (!Array.isArray(value)) return [];
+	return value.filter((entry) => typeof entry === "string");
+}
+function resolveRawExtendsPath(configPath, rawExtends) {
+	const resolvedPath = path.resolve(path.dirname(configPath), rawExtends);
+	return normalizeAbsolutePath(path.extname(resolvedPath) ? resolvedPath : `${resolvedPath}.json`);
+}
+function configExtendsPathTransitively(options) {
+	const visited = new Set([options.configPath]);
+	const pending = normalizeRawExtends(options.configObject.extends).map((entry) => resolveRawExtendsPath(options.configPath, entry));
+	for (const configPath of pending) {
+		if (configPath === options.targetConfigPath) return true;
+		if (visited.has(configPath) || !existsSync(configPath)) continue;
+		visited.add(configPath);
+		const configObject = readJsonConfig(options.config, configPath);
+		pending.push(...normalizeRawExtends(configObject.extends).map((entry) => resolveRawExtendsPath(configPath, entry)));
+	}
+	return false;
+}
+function addStrictDtsCompanionExtendsProblems(options) {
+	const rawExtends = normalizeRawExtends(options.configObject.extends);
+	if (configExtendsPathTransitively({
+		config: options.config,
+		configObject: options.configObject,
+		configPath: options.dtsConfigPath,
+		targetConfigPath: options.localConfigPath
+	})) return;
+	options.problems.push([
+		"Strict mode requires declaration leaves to transitively extend their companion typecheck config:",
+		`  declaration leaf: ${toRelativePath(options.config.rootDir, options.dtsConfigPath)}`,
+		`  expected companion: ${toRelativePath(options.config.rootDir, options.localConfigPath)}`,
+		`  direct extends: ${rawExtends.length > 0 ? rawExtends.join(", ") : "(none)"}`,
+		"  reason: strict: true requires tsconfig*.dts.json to add only declaration/build output behavior on top of the matching tsconfig*.json."
+	].join("\n"));
+}
 function addDtsConfigProblems(options) {
 	for (const configPath of options.dtsConfigPaths) {
+		const configObject = readJsonConfig(options.config, configPath);
 		if (!options.graphProjectPaths.has(configPath)) options.problems.push(["DTS config is not reachable from any checker entry:", `  config: ${toRelativePath(options.config.rootDir, configPath)}`].join("\n"));
 		const localConfigPath = getDtsCompanionConfigPath(configPath);
 		if (!existsSync(localConfigPath)) {
@@ -1723,9 +1520,16 @@ function addDtsConfigProblems(options) {
 			].join("\n"));
 			continue;
 		}
-		const extensions = options.projectExtensionsByPath.get(configPath) ?? [];
-		const dtsConfig = parseConfig(options.config, configPath, extensions);
-		const localConfig = parseConfig(options.config, localConfigPath, extensions);
+		if (isStrictConfig(options.config)) addStrictDtsCompanionExtendsProblems({
+			config: options.config,
+			configObject,
+			dtsConfigPath: configPath,
+			localConfigPath,
+			problems: options.problems
+		});
+		const context = options.projectContextsByPath.get(configPath);
+		const dtsConfig = parseConfig(options.config, configPath, context);
+		const localConfig = parseConfig(options.config, localConfigPath, context);
 		if (dtsConfig.options.composite !== true) options.problems.push([
 			"DTS config is not valid for tsc -b:",
 			`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
@@ -1800,6 +1604,21 @@ function addBuildGraphConfigProblems(options) {
 			problems: options.problems,
 			role: "build graph"
 		});
+		if (!isStrictConfig(options.config)) continue;
+		if (!Array.isArray(configObject.references)) continue;
+		for (const [index, reference] of configObject.references.entries()) {
+			if (!isPlainRecord(reference) || typeof reference.path !== "string") continue;
+			const referencePath = resolveReferencePath(configPath, reference.path);
+			if (isBuildGraphConfigPath(referencePath) || isDtsConfigPath(referencePath)) continue;
+			options.problems.push([
+				"Strict mode build graph references a non-build project:",
+				`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
+				`  field: references[${index}].path`,
+				`  reference: ${reference.path}`,
+				`  resolved: ${toRelativePath(options.config.rootDir, referencePath)}`,
+				"  reason: strict: true requires tsconfig*.build.json to reference only tsconfig*.build.json aggregators or tsconfig*.dts.json declaration leaves."
+			].join("\n"));
+		}
 	}
 }
 function addDefaultTsconfigShapeProblems(options) {
@@ -1814,10 +1633,10 @@ function addDefaultTsconfigShapeProblems(options) {
 			role: "tsconfig.json"
 		});
 		if (!Array.isArray(configObject.references)) continue;
-		configObject.references.forEach((reference, index) => {
-			if (!isPlainRecord(reference) || typeof reference.path !== "string") return;
+		for (const [index, reference] of configObject.references.entries()) {
+			if (!isPlainRecord(reference) || typeof reference.path !== "string") continue;
 			const referencePath = resolveReferencePath(configPath, reference.path);
-			if (isOrdinaryTypecheckConfigPath(referencePath)) return;
+			if (isOrdinaryTypecheckConfigPath(referencePath)) continue;
 			options.problems.push([
 				"Default tsconfig.json references a non-typecheck config:",
 				`  config: ${toRelativePath(options.config.rootDir, configPath)}`,
@@ -1826,7 +1645,7 @@ function addDefaultTsconfigShapeProblems(options) {
 				`  resolved: ${toRelativePath(options.config.rootDir, referencePath)}`,
 				"  reason: tsconfig.json is the default IDE/typecheck entry and must not reference declaration build graph configs."
 			].join("\n"));
-		});
+		}
 	}
 }
 function addDefaultTsconfigEnvironmentProblems(options) {
@@ -1870,10 +1689,19 @@ function collectConfigFileOwners(config, graphRoutes, sourceFiles) {
 	const ownersByFile = /* @__PURE__ */ new Map();
 	for (const route of graphRoutes) for (const configPath of route.projectPaths) {
 		if (!existsSync(configPath)) continue;
-		for (const filePath of parseProjectFileNamesForExtensions(config, configPath, route.extensions)) {
+		const projectContext = createCheckerProjectContext({
+			config,
+			configPath,
+			extensions: route.extensions,
+			preset: route.checkerPreset
+		});
+		for (const filePath of parseProjectFileNamesForExtensions(config, configPath, projectContext)) {
 			if (!sourceFiles.has(filePath)) continue;
 			const owners = ownersByFile.get(filePath) ?? [];
-			owners.push(configPath);
+			owners.push({
+				checkerPreset: route.checkerPreset,
+				configPath
+			});
 			ownersByFile.set(filePath, owners);
 		}
 	}
@@ -1881,14 +1709,60 @@ function collectConfigFileOwners(config, graphRoutes, sourceFiles) {
 }
 function addDuplicateGraphCoverageProblems(options) {
 	for (const [filePath, owners] of [...options.ownersByFile.entries()].sort(([left], [right]) => toRelativePath(options.config.rootDir, left).localeCompare(toRelativePath(options.config.rootDir, right)))) {
+		const ownersByPreset = /* @__PURE__ */ new Map();
+		for (const owner of owners) {
+			const presetOwners = ownersByPreset.get(owner.checkerPreset) ?? [];
+			presetOwners.push(owner);
+			ownersByPreset.set(owner.checkerPreset, presetOwners);
+		}
+		for (const presetOwners of ownersByPreset.values()) {
+			const uniqueOwners = [...new Set(presetOwners.map((owner) => owner.configPath))];
+			if (uniqueOwners.length <= 1) continue;
+			options.problems.push([
+				"Duplicate checker graph coverage:",
+				`  file: ${toRelativePath(options.config.rootDir, filePath)}`,
+				"  covered by:",
+				...uniqueOwners.sort((left, right) => toRelativePath(options.config.rootDir, left).localeCompare(toRelativePath(options.config.rootDir, right))).map((configPath) => `    - ${toRelativePath(options.config.rootDir, configPath)}`),
+				"  reason: a checker graph file must have a single declaration owner; move the file to one dts leaf or narrow include/exclude patterns."
+			].join("\n"));
+		}
+	}
+}
+function addStrictOrdinaryTypecheckCompanionProblems(options) {
+	for (const configPath of options.ordinaryConfigPaths) {
+		const configObject = readJsonConfig(options.config, configPath);
+		if (path.basename(configPath) === "tsconfig.json" && isDefaultTypecheckAggregator(configObject)) continue;
+		const expectedDtsConfigPath = getDtsConfigPathForTypecheckConfig(configPath);
+		if (existsSync(expectedDtsConfigPath)) continue;
+		options.problems.push([
+			"Strict mode typecheck config is missing its declaration leaf:",
+			`  typecheck config: ${toRelativePath(options.config.rootDir, configPath)}`,
+			`  expected declaration leaf: ${toRelativePath(options.config.rootDir, expectedDtsConfigPath)}`,
+			"  reason: strict: true requires every tsconfig*.json typecheck leaf to have a same-named tsconfig*.dts.json build leaf."
+		].join("\n"));
+	}
+}
+function addStrictDuplicateTypecheckOwnershipProblems(options) {
+	const fileOwners = /* @__PURE__ */ new Map();
+	const context = getActiveCheckerContext(options.config);
+	for (const configPath of options.ordinaryConfigPaths) {
+		const configObject = readJsonConfig(options.config, configPath);
+		if (path.basename(configPath) === "tsconfig.json" && isDefaultTypecheckAggregator(configObject)) continue;
+		for (const fileName of parseConfig(options.config, configPath, context).fileNames) {
+			const owners = fileOwners.get(fileName) ?? [];
+			owners.push(configPath);
+			fileOwners.set(fileName, owners);
+		}
+	}
+	for (const [fileName, owners] of [...fileOwners.entries()].sort(([left], [right]) => toRelativePath(options.config.rootDir, left).localeCompare(toRelativePath(options.config.rootDir, right)))) {
 		const uniqueOwners = [...new Set(owners)];
 		if (uniqueOwners.length <= 1) continue;
 		options.problems.push([
-			"Duplicate checker graph coverage:",
-			`  file: ${toRelativePath(options.config.rootDir, filePath)}`,
-			"  covered by:",
-			...uniqueOwners.sort((left, right) => toRelativePath(options.config.rootDir, left).localeCompare(toRelativePath(options.config.rootDir, right))).map((configPath) => `    - ${toRelativePath(options.config.rootDir, configPath)}`),
-			"  reason: a checker graph file must have a single declaration owner; move the file to one dts leaf or narrow include/exclude patterns."
+			"Strict mode source file belongs to multiple typecheck configs:",
+			`  file: ${toRelativePath(options.config.rootDir, fileName)}`,
+			"  typecheck configs:",
+			...uniqueOwners.sort((left, right) => toRelativePath(options.config.rootDir, left).localeCompare(toRelativePath(options.config.rootDir, right))).map((owner) => `    - ${toRelativePath(options.config.rootDir, owner)}`),
+			"  reason: strict: true requires each source module to belong to exactly one tsconfig*.json typecheck leaf."
 		].join("\n"));
 	}
 }
@@ -1919,25 +1793,39 @@ function addUncoveredSourceProblems(options) {
 		"  reason: every file in config.source must be covered by a checker entry or an explicit allowlist entry."
 	].filter(Boolean).join("\n"));
 }
+function addSourceBoundaryMismatchProblems(options) {
+	const outsideSourceFiles = [...options.outsideSourceCoverageByFile.entries()].sort(([left], [right]) => left.localeCompare(right));
+	if (outsideSourceFiles.length === 0) return;
+	options.problems.push([
+		"Typecheck proof source boundary does not match tsconfig coverage:",
+		...outsideSourceFiles.slice(0, 20).flatMap(([filePath, sources]) => [
+			`  - ${toRelativePath(options.config.rootDir, filePath)}`,
+			...sources.slice(0, 3).map((source) => `    covered by: ${source.label}`),
+			sources.length > 3 ? `    ... ${sources.length - 3} more` : ""
+		]),
+		outsideSourceFiles.length > 20 ? `  ... ${outsideSourceFiles.length - 20} more` : "",
+		"  reason: config.source and tsconfig*.json coverage describe different module sets.",
+		"  fix: include these files in config.source, exclude them from the related tsconfig*.json, or move intentionally unmanaged files out of checker coverage."
+	].filter(Boolean).join("\n"));
+}
 async function runProofCheckInternal(config, options = {}) {
 	const problems = [];
 	const graphRouteCollection = collectGraphProjectRoutes(config);
 	const entryRouteCollection = collectCheckerEntryProjectRoutes(config);
 	const entryProjectPaths = [...new Set(entryRouteCollection.routes.flatMap((route) => route.projectPaths))].sort();
 	const entryProjectPathSet = new Set(entryProjectPaths);
-	const entryProjectExtensionsByPath = collectProjectExtensionsByPath(entryRouteCollection.routes);
+	const entryProjectContextsByPath = collectProjectContextsByPath(config, entryRouteCollection.routes);
 	const dtsConfigPaths = await collectDtsConfigPaths(config);
 	const buildGraphConfigPaths = await collectBuildGraphConfigPaths(config);
 	const defaultTsconfigPaths = await collectDefaultTsconfigPaths(config);
 	const ordinaryTypecheckConfigPaths = await collectOrdinaryTypecheckConfigPaths(config);
-	problems.push(...graphRouteCollection.problems);
-	problems.push(...entryRouteCollection.problems);
+	problems.push(...graphRouteCollection.problems, ...entryRouteCollection.problems);
 	addDtsConfigProblems({
 		config,
 		dtsConfigPaths,
 		graphProjectPaths: entryProjectPathSet,
 		problems,
-		projectExtensionsByPath: entryProjectExtensionsByPath
+		projectContextsByPath: entryProjectContextsByPath
 	});
 	addBuildGraphConfigProblems({
 		buildGraphConfigPaths,
@@ -1954,6 +1842,18 @@ async function runProofCheckInternal(config, options = {}) {
 		ordinaryConfigPaths: ordinaryTypecheckConfigPaths,
 		problems
 	});
+	if (isStrictConfig(config)) {
+		addStrictOrdinaryTypecheckCompanionProblems({
+			config,
+			ordinaryConfigPaths: ordinaryTypecheckConfigPaths,
+			problems
+		});
+		addStrictDuplicateTypecheckOwnershipProblems({
+			config,
+			ordinaryConfigPaths: ordinaryTypecheckConfigPaths,
+			problems
+		});
+	}
 	if (problems.length > 0) {
 		ProofLogger.error(problems.join("\n\n"));
 		return false;
@@ -1969,19 +1869,18 @@ async function runProofCheckInternal(config, options = {}) {
 	const allowlistCollection = collectConfiguredAllowlistEntries(config);
 	const allowlistEntries = allowlistCollection.entries;
 	problems.push(...allowlistCollection.problems);
+	const outsideSourceCoverageByFile = /* @__PURE__ */ new Map();
 	const baseCoverageByFile = collectCoverage({
-		allowlistEntries,
 		checkerTargets,
 		config,
 		graphRoutes: graphRouteCollection.routes,
-		includeAllowlist: false,
+		outsideSourceCoverageByFile,
 		sourceFiles
 	});
-	const coverageByFile = collectCoverage({
+	const coverageByFile = cloneCoverageByFile(baseCoverageByFile);
+	addAllowlistCoverage({
 		allowlistEntries,
-		checkerTargets,
-		config,
-		graphRoutes: graphRouteCollection.routes,
+		coverageByFile,
 		sourceFiles
 	});
 	addDuplicateGraphCoverageProblems({
@@ -2002,6 +1901,11 @@ async function runProofCheckInternal(config, options = {}) {
 		problems,
 		sourceFiles
 	});
+	addSourceBoundaryMismatchProblems({
+		config,
+		outsideSourceCoverageByFile,
+		problems
+	});
 	if (problems.length > 0) {
 		ProofLogger.error(problems.join("\n\n"));
 		return false;
@@ -2044,9 +1948,68 @@ async function runProofCheck(config, options = {}) {
 var PackageReleaseConsistencyError = class extends Error {
 	name = "PackageReleaseConsistencyError";
 };
-const semver = createRequire(import.meta.url)("semver");
+const require = createRequire(import.meta.url);
+const semver = require("semver");
+const { NpmPackageJsonLint } = require("npm-package-json-lint");
+const picomatch = rawPicomatch;
+const DEFAULT_CONTENT_HASH_BASELINE_TAG = "latest";
+const CONTENT_HASH_DIFF_KINDS = [
+	"local-only",
+	"remote-only",
+	"changed"
+];
 const REQUIRED_RELEASE_FILES = ["README.md", "LICENSE.md"];
-const SOURCE_MAPPING_URL_PATTERN = /(?:\/\/\s*#\s*sourceMappingURL\s*=|\/\*\s*#\s*sourceMappingURL\s*=)/u;
+const ARTIFACT_HASH_IGNORED_FILES = new Set([
+	"README",
+	"README.md",
+	"CHANGELOG.md",
+	"HISTORY.md",
+	"CONTRIBUTING.md",
+	"CODE_OF_CONDUCT.md",
+	"SECURITY.md"
+]);
+const SOURCE_MAPPING_URL_PATTERN = /\/\/\s*#\s*sourceMappingURL\s*=|\/\*\s*#\s*sourceMappingURL\s*=/u;
+const PACKED_MANIFEST_LINT_CONFIG = { rules: {
+	"bin-type": "error",
+	"bundledDependencies-type": "error",
+	"config-type": "error",
+	"cpu-type": "error",
+	"dependencies-type": "error",
+	"description-type": "error",
+	"devDependencies-type": "error",
+	"directories-type": "error",
+	"engines-type": "error",
+	"files-type": "error",
+	"homepage-type": "error",
+	"keywords-type": "error",
+	"license-type": "error",
+	"main-type": "error",
+	"man-type": "error",
+	"name-format": "error",
+	"name-type": "error",
+	"no-archive-dependencies": "error",
+	"no-archive-devDependencies": "error",
+	"no-file-dependencies": "error",
+	"no-file-devDependencies": "error",
+	"no-git-dependencies": "error",
+	"no-git-devDependencies": "error",
+	"no-repeated-dependencies": "error",
+	"optionalDependencies-type": "error",
+	"os-type": "error",
+	"peerDependencies-type": "error",
+	"preferGlobal-type": "error",
+	"private-type": "error",
+	"repository-type": "error",
+	"require-license": "error",
+	"require-name": "error",
+	"require-types": "error",
+	"require-version": "error",
+	"scripts-type": "error",
+	"type-type": "error",
+	"valid-values-private": ["error", [false]],
+	"version-format": "error",
+	"version-type": "error"
+} };
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -2058,6 +2021,7 @@ function createReleaseConsistencyState() {
 		directWorkspaceDependencies: [],
 		edges: /* @__PURE__ */ new Map(),
 		missingWorkspaceDependencies: [],
+		packedManifestLintProblems: [],
 		packedManifestProblems: [],
 		privateWorkspaceDependencies: [],
 		releaseHygieneProblems: [],
@@ -2077,6 +2041,36 @@ function collectPublishDependencyEntries(manifest) {
 	});
 	return entries;
 }
+function collectPackageDependencyEntries(manifest) {
+	const entries = [];
+	const sections = [
+		{
+			dependencies: manifest.dependencies,
+			name: "dependencies"
+		},
+		{
+			dependencies: manifest.devDependencies,
+			name: "devDependencies"
+		},
+		{
+			dependencies: manifest.peerDependencies,
+			name: "peerDependencies"
+		},
+		{
+			dependencies: manifest.optionalDependencies,
+			name: "optionalDependencies"
+		}
+	];
+	for (const { dependencies, name } of sections) {
+		if (!dependencies) continue;
+		for (const [dependencyName, specifier] of Object.entries(dependencies)) entries.push({
+			dependencyName,
+			sectionName: name,
+			specifier
+		});
+	}
+	return entries;
+}
 function addEdge(edges, importerName, dependencyName) {
 	const dependencies = edges.get(importerName) ?? /* @__PURE__ */ new Set();
 	dependencies.add(dependencyName);
@@ -2122,126 +2116,319 @@ function findRegistryVersionMetadata(metadata, version) {
 	const versionMetadata = metadata.versions[version];
 	return isRecord(versionMetadata) ? versionMetadata : null;
 }
-function execGitCommand(config, args) {
-	return new Promise((resolve, reject) => {
-		execFile("git", [
-			"-C",
-			config.rootDir,
-			...args
-		], {
-			encoding: "utf8",
-			maxBuffer: 10 * 1024 * 1024
-		}, (error, stdout) => {
-			if (error) {
-				reject(error);
-				return;
-			}
-			resolve(stdout);
-		});
+function findRegistryDistTagVersion(metadata, distTag) {
+	if (!isRecord(metadata["dist-tags"])) return null;
+	const version = metadata["dist-tags"][distTag];
+	return typeof version === "string" && version.trim().length > 0 ? version : null;
+}
+function getRegistryTarballUrl(versionMetadata) {
+	if (!isRecord(versionMetadata.dist)) return null;
+	const tarballUrl = versionMetadata.dist.tarball;
+	return typeof tarballUrl === "string" && tarballUrl.trim().length > 0 ? tarballUrl : null;
+}
+async function fetchRegistryTarball(tarballUrl) {
+	const response = await fetch(tarballUrl, { headers: { accept: "application/octet-stream" } });
+	if (!response.ok) throw new Error(`unable to download npm tarball ${tarballUrl}: ${response.status} ${response.statusText}`);
+	return Buffer.from(await response.arrayBuffer());
+}
+function resolveWorkspacePackageOutputDir(config, workspacePackage) {
+	const configuredEntry = config.package?.entries?.find((entry) => entry.name === workspacePackage.name);
+	return configuredEntry ? path.resolve(config.rootDir, configuredEntry.outDir) : path.join(workspacePackage.directory, "dist");
+}
+function isIgnoredArtifactHashFile(relativePath) {
+	return ARTIFACT_HASH_IGNORED_FILES.has(relativePath) || relativePath.startsWith("docs/") || relativePath.startsWith("examples/");
+}
+function resolveReleaseContentHashBaselineTag(config, args) {
+	const configuredBaselineTag = config.release?.contentHash?.baselineTag;
+	const baselineTag = typeof configuredBaselineTag === "function" ? configuredBaselineTag(args) : configuredBaselineTag ?? DEFAULT_CONTENT_HASH_BASELINE_TAG;
+	if (typeof baselineTag !== "string" || baselineTag.trim().length === 0) throw new Error("release.contentHash.baselineTag must resolve to a non-empty string");
+	return baselineTag.trim();
+}
+function normalizeReleaseContentHashIgnorePatterns(value) {
+	if (!Array.isArray(value)) throw new TypeError("release.contentHash.ignore must resolve to an array of non-empty strings or undefined");
+	return value.map((pattern, index) => {
+		if (typeof pattern !== "string" || pattern.trim().length === 0) throw new Error(`release.contentHash.ignore[${index}] must resolve to a non-empty string`);
+		return pattern.trim();
 	});
 }
-async function hasWorkspacePackageChangesSinceGitHead(options) {
-	const relativeDirectory = toRelativePath(options.config.rootDir, options.workspacePackage.directory);
+function createUserContentHashIgnoreRules(patterns) {
+	return patterns.map((pattern) => {
+		const matches = picomatch(pattern, { dot: true });
+		return {
+			label: `user "${pattern}"`,
+			matches
+		};
+	});
+}
+function createBuiltinContentHashIgnoreRule() {
+	return {
+		label: "builtin",
+		matches: isIgnoredArtifactHashFile
+	};
+}
+function resolveReleaseContentHashIgnoreRules(config, args) {
+	const contentHash = config.release?.contentHash;
+	const configuredIgnore = contentHash?.ignore;
+	const useBuiltinFallback = contentHash?.builtinIgnore === true;
+	if (configuredIgnore === void 0) return useBuiltinFallback ? [createBuiltinContentHashIgnoreRule()] : [];
+	if (typeof configuredIgnore === "function") {
+		const resolvedIgnore = configuredIgnore(args);
+		if (resolvedIgnore === void 0) return useBuiltinFallback ? [createBuiltinContentHashIgnoreRule()] : [];
+		return createUserContentHashIgnoreRules(normalizeReleaseContentHashIgnorePatterns(resolvedIgnore));
+	}
+	return createUserContentHashIgnoreRules(normalizeReleaseContentHashIgnorePatterns(configuredIgnore));
+}
+function createContentHashDiffGroup() {
+	return {
+		changed: [],
+		"local-only": [],
+		"remote-only": []
+	};
+}
+function addContentHashDiff(group, diff) {
+	group[diff.kind].push(diff.relativePath);
+}
+function sortContentHashDiffGroup(group) {
+	for (const kind of CONTENT_HASH_DIFF_KINDS) group[kind].sort((a, b) => a.localeCompare(b));
+}
+function countContentHashDiffs(group) {
+	return CONTENT_HASH_DIFF_KINDS.reduce((count, kind) => count + group[kind].length, 0);
+}
+function hasContentHashDiffs(group) {
+	return countContentHashDiffs(group) > 0;
+}
+function readPackedPackageVersion(contentFiles) {
+	const packageJsonFile = contentFiles.find((file) => file.relativePath === "package.json");
+	if (!packageJsonFile) return null;
 	try {
-		await execGitCommand(options.config, [
-			"diff",
-			"--quiet",
-			options.gitHead,
-			"--",
-			relativeDirectory
-		]);
-	} catch (error) {
-		if (isRecord(error) && error.code === 1) return true;
-		throw error;
+		const manifest = JSON.parse(Buffer.from(packageJsonFile.data).toString("utf8"));
+		if (!isRecord(manifest) || typeof manifest.version !== "string") return null;
+		const version = manifest.version.trim();
+		return version.length > 0 ? version : null;
+	} catch {
+		return null;
+	}
+}
+async function readPackedArtifactContent(tarball) {
+	const contentFiles = getPackedContentFiles(await unpackPackedPackage(tarball));
+	return {
+		filesByPath: new Map(contentFiles.map((file) => [file.relativePath, file])),
+		packageVersion: readPackedPackageVersion(contentFiles)
+	};
+}
+function fileDataEquals(left, right) {
+	if (left.byteLength !== right.byteLength) return false;
+	for (let index = 0; index < left.byteLength; index += 1) if (left[index] !== right[index]) return false;
+	return true;
+}
+function createContentHashDiffs(options) {
+	const paths = new Set([...options.localArtifact.filesByPath.keys(), ...options.remoteArtifact.filesByPath.keys()]);
+	const diffs = [];
+	for (const relativePath of [...paths].sort((a, b) => a.localeCompare(b))) {
+		const localFile = options.localArtifact.filesByPath.get(relativePath);
+		const remoteFile = options.remoteArtifact.filesByPath.get(relativePath);
+		if (localFile && !remoteFile) {
+			diffs.push({
+				kind: "local-only",
+				relativePath
+			});
+			continue;
+		}
+		if (!localFile && remoteFile) {
+			diffs.push({
+				kind: "remote-only",
+				relativePath
+			});
+			continue;
+		}
+		if (localFile && remoteFile && !fileDataEquals(localFile.data, remoteFile.data)) diffs.push({
+			kind: "changed",
+			relativePath
+		});
+	}
+	return diffs;
+}
+function partitionContentHashDiffs(options) {
+	const releaseRelevantDiffs = createContentHashDiffGroup();
+	const ignoredDiffGroups = options.ignoreRules.map((rule) => ({
+		diffs: createContentHashDiffGroup(),
+		label: rule.label
+	}));
+	for (const diff of options.diffs) {
+		const ignoredGroupIndex = options.ignoreRules.findIndex((rule) => rule.matches(diff.relativePath));
+		if (ignoredGroupIndex === -1) {
+			addContentHashDiff(releaseRelevantDiffs, diff);
+			continue;
+		}
+		addContentHashDiff(ignoredDiffGroups[ignoredGroupIndex].diffs, diff);
+	}
+	sortContentHashDiffGroup(releaseRelevantDiffs);
+	for (const group of ignoredDiffGroups) sortContentHashDiffGroup(group.diffs);
+	return {
+		ignoredDiffGroups: ignoredDiffGroups.filter((group) => hasContentHashDiffs(group.diffs)),
+		releaseRelevantDiffs
+	};
+}
+function formatReleaseRelevantContentHashDiffs(diffs) {
+	if (!hasContentHashDiffs(diffs)) return [];
+	const lines = ["", "Release-relevant diffs:"];
+	for (const kind of CONTENT_HASH_DIFF_KINDS) {
+		const paths = diffs[kind];
+		if (paths.length === 0) continue;
+		lines.push(`  ${kind}:`, ...paths.map((relativePath) => `    ${relativePath}`));
+	}
+	return lines;
+}
+function formatIgnoredContentHashDiffs(groups) {
+	if (groups.length === 0) return [];
+	const lines = ["", "Ignored contentHash diffs:"];
+	for (const group of groups) lines.push(`  ${group.label}:`, ...CONTENT_HASH_DIFF_KINDS.map((kind) => `    ${kind}: ${group.diffs[kind].length}`));
+	return lines;
+}
+function formatContentHashComparisonReport(options) {
+	const { comparison, dependencyName } = options;
+	const status = comparison.matchesBaseline ? "PASS" : "FAIL";
+	const localVersion = comparison.localVersion ?? options.localVersionFallback ?? "(missing version)";
+	return [
+		`[release-check] ${status} ${options.importerName} -> ${dependencyName}`,
+		`Baseline: npm ${options.baselineTag} -> ${dependencyName}@${options.baselineVersion}`,
+		`Local: ${dependencyName}@${localVersion}`,
+		...formatReleaseRelevantContentHashDiffs(comparison.releaseRelevantDiffs),
+		...formatIgnoredContentHashDiffs(comparison.ignoredDiffGroups)
+	].join("\n");
+}
+async function compareLocalWorkspacePackageOutputToBaseline(options) {
+	let localPackedTarball;
+	try {
+		const localOutDir = resolveWorkspacePackageOutputDir(options.config, options.workspacePackage);
+		const publishedTarball = await fetchRegistryTarball(options.tarballUrl);
+		localPackedTarball = await packOutputTarball(localOutDir);
+		const [remoteArtifact, localArtifact] = await Promise.all([readPackedArtifactContent(publishedTarball), readPackedArtifactContent(localPackedTarball.tarball)]);
+		const { ignoredDiffGroups, releaseRelevantDiffs } = partitionContentHashDiffs({
+			diffs: createContentHashDiffs({
+				localArtifact,
+				remoteArtifact
+			}),
+			ignoreRules: options.ignoreRules
+		});
+		return {
+			ignoredDiffGroups,
+			localVersion: localArtifact.packageVersion,
+			matchesBaseline: !hasContentHashDiffs(releaseRelevantDiffs),
+			releaseRelevantDiffs
+		};
+	} finally {
+		if (localPackedTarball) await localPackedTarball.cleanup();
 	}
-	return (await execGitCommand(options.config, [
-		"ls-files",
-		"--others",
-		"--exclude-standard",
-		"--",
-		relativeDirectory
-	])).trim().length > 0;
 }
 async function verifyWorkspacePackagePublished(options) {
-	const { state, workspacePackage } = options;
-	const version = workspacePackage.manifest.version;
-	if (!version || !semver.valid(version)) {
-		state.unpublishedPackageNames.add(workspacePackage.name);
+	const { importerName, state, workspacePackage } = options;
+	const dependencyName = workspacePackage.name;
+	const problemBase = {
+		dependencyName,
+		importerName,
+		packageName: dependencyName
+	};
+	const contentHashArgs = {
+		dependencyName,
+		importerName
+	};
+	let baselineTag;
+	let ignoreRules;
+	try {
+		baselineTag = resolveReleaseContentHashBaselineTag(options.config, contentHashArgs);
+		ignoreRules = resolveReleaseContentHashIgnoreRules(options.config, contentHashArgs);
+	} catch (error) {
+		state.unpublishedPackageNames.add(dependencyName);
 		state.registryProblems.push({
-			importerName: workspacePackage.name,
-			message: ["workspace package must declare a valid semver version", "before another publishable package can depend on it"].join(" "),
-			packageName: workspacePackage.name
+			...problemBase,
+			message: [`invalid release.contentHash config for ${dependencyName}:`, formatErrorMessage$1(error)].join(" ")
 		});
 		return;
 	}
 	let metadata;
 	try {
-		metadata = await fetchRegistryPackageMetadata(workspacePackage.name, state);
+		metadata = await fetchRegistryPackageMetadata(dependencyName, state);
 	} catch (error) {
-		state.unpublishedPackageNames.add(workspacePackage.name);
+		state.unpublishedPackageNames.add(dependencyName);
 		state.registryProblems.push({
-			importerName: workspacePackage.name,
-			message: [`unable to read npm registry metadata for ${workspacePackage.name}@${version}:`, formatErrorMessage$1(error)].join(" "),
-			packageName: workspacePackage.name
+			...problemBase,
+			message: [`unable to read npm registry metadata for ${dependencyName}:`, formatErrorMessage$1(error)].join(" ")
 		});
 		return;
 	}
 	if (!metadata) {
-		state.unpublishedPackageNames.add(workspacePackage.name);
+		state.unpublishedPackageNames.add(dependencyName);
 		state.registryProblems.push({
-			importerName: workspacePackage.name,
-			message: `${workspacePackage.name}@${version} is not published to the npm registry`,
-			packageName: workspacePackage.name
+			...problemBase,
+			message: `${dependencyName} is not published to the npm registry`
+		});
+		return;
+	}
+	const baselineVersion = findRegistryDistTagVersion(metadata, baselineTag);
+	if (!baselineVersion) {
+		state.unpublishedPackageNames.add(dependencyName);
+		state.registryProblems.push({
+			...problemBase,
+			message: `${dependencyName} registry metadata has no "${baselineTag}" dist-tag`
 		});
 		return;
 	}
-	const versionMetadata = findRegistryVersionMetadata(metadata, version);
+	const versionMetadata = findRegistryVersionMetadata(metadata, baselineVersion);
 	if (!versionMetadata) {
-		state.unpublishedPackageNames.add(workspacePackage.name);
+		state.unpublishedPackageNames.add(dependencyName);
 		state.registryProblems.push({
-			importerName: workspacePackage.name,
-			message: `${workspacePackage.name}@${version} is not published to the npm registry`,
-			packageName: workspacePackage.name
+			...problemBase,
+			message: `${dependencyName}@${baselineVersion} is not published to the npm registry`
 		});
 		return;
 	}
-	if (typeof versionMetadata.gitHead !== "string" || versionMetadata.gitHead.trim().length === 0) {
-		state.unpublishedPackageNames.add(workspacePackage.name);
+	const tarballUrl = getRegistryTarballUrl(versionMetadata);
+	if (!tarballUrl) {
+		state.unpublishedPackageNames.add(dependencyName);
 		state.registryProblems.push({
-			importerName: workspacePackage.name,
-			message: [`${workspacePackage.name}@${version} registry metadata has no gitHead,`, "so limina cannot prove the published source baseline"].join(" "),
-			packageName: workspacePackage.name
+			...problemBase,
+			message: `${dependencyName}@${baselineVersion} registry metadata has no dist.tarball`
 		});
 		return;
 	}
-	let hasChanges;
+	let comparison;
 	try {
-		hasChanges = await hasWorkspacePackageChangesSinceGitHead({
+		comparison = await compareLocalWorkspacePackageOutputToBaseline({
 			config: options.config,
-			gitHead: versionMetadata.gitHead,
+			ignoreRules,
+			tarballUrl,
 			workspacePackage
 		});
 	} catch (error) {
-		state.unpublishedPackageNames.add(workspacePackage.name);
+		state.unpublishedPackageNames.add(dependencyName);
 		state.registryProblems.push({
-			importerName: workspacePackage.name,
+			...problemBase,
 			message: [
-				`unable to compare ${workspacePackage.name}@${version}`,
-				`against published gitHead ${versionMetadata.gitHead}:`,
+				`unable to compare local package output for ${dependencyName}`,
+				`against npm ${baselineTag} ${dependencyName}@${baselineVersion}:`,
 				formatErrorMessage$1(error)
-			].join(" "),
-			packageName: workspacePackage.name
+			].join(" ")
 		});
 		return;
 	}
-	if (hasChanges) {
-		state.unpublishedPackageNames.add(workspacePackage.name);
+	const comparisonReport = formatContentHashComparisonReport({
+		baselineTag,
+		baselineVersion,
+		comparison,
+		dependencyName,
+		importerName,
+		localVersionFallback: workspacePackage.manifest.version
+	});
+	if (!comparison.matchesBaseline) {
+		state.unpublishedPackageNames.add(dependencyName);
 		state.registryProblems.push({
-			importerName: workspacePackage.name,
-			message: [`${workspacePackage.name}@${version} has workspace changes`, `after the published npm registry gitHead ${versionMetadata.gitHead}`].join(" "),
-			packageName: workspacePackage.name
+			...problemBase,
+			message: comparisonReport
 		});
+		return;
 	}
+	ReleaseLogger.info(comparisonReport);
 }
 async function visitWorkspacePackageDependencies(options) {
 	const { config, importerName, isRoot, manifest, state, workspacePackagesByName } = options;
@@ -2289,6 +2476,7 @@ async function visitWorkspacePackageDependencies(options) {
 			state.visitedPackages.add(targetPackage.name);
 			await verifyWorkspacePackagePublished({
 				config,
+				importerName,
 				state,
 				workspacePackage: targetPackage
 			});
@@ -2337,6 +2525,27 @@ function readPackedPackageJson(options) {
 		return null;
 	}
 }
+function formatNpmPackageJsonLintIssue(issue) {
+	return `${issue.lintId} [${issue.node || "package.json"}]: ${issue.lintMessage}`;
+}
+function validatePackedManifestLint(options) {
+	const lintResult = new NpmPackageJsonLint({
+		config: PACKED_MANIFEST_LINT_CONFIG,
+		cwd: options.config.rootDir,
+		packageJsonFilePath: path.join(options.outDir, "package.json"),
+		packageJsonObject: options.manifest
+	}).lint();
+	for (const result of lintResult.results) {
+		if (result.errorCount === 0) continue;
+		for (const issue of result.issues) {
+			if (issue.severity !== "error") continue;
+			options.state.packedManifestLintProblems.push({
+				importerName: options.rootPackageName,
+				message: formatNpmPackageJsonLintIssue(issue)
+			});
+		}
+	}
+}
 function isJavaScriptPackageFile(relativePath) {
 	return /\.(?:cjs|mjs|js)$/u.test(relativePath);
 }
@@ -2372,6 +2581,17 @@ function validatePackedManifest(options) {
 		sectionName: entry.sectionName,
 		specifier: entry.specifier
 	});
+	if (options.strict) for (const entry of collectPackageDependencyEntries(manifest)) {
+		if (!isLocalPackageDependencySpecifier(entry.specifier)) continue;
+		if (entry.sectionName !== "devDependencies" && (isWorkspaceDependencySpecifier(entry.specifier) || isLinkDependencySpecifier(entry.specifier))) continue;
+		state.packedManifestProblems.push({
+			dependencyName: entry.dependencyName,
+			importerName: rootPackageName,
+			message: "strict packed package manifest must not expose workspace:, link:, file:, or catalog: dependency specifiers in any dependency section",
+			sectionName: entry.sectionName,
+			specifier: entry.specifier
+		});
+	}
 	for (const dependency of state.directWorkspaceDependencies) {
 		const packedSpecifier = getPackedDependencySpecifier(manifest, dependency.dependencyName);
 		if (!packedSpecifier) {
@@ -2408,7 +2628,7 @@ function createPublishOrder(rootPackageName, state) {
 }
 function createReleaseConsistencyError(options) {
 	const { config, label, outDir, rootPackageName, state } = options;
-	if (state.sourceLinkDependencies.length + state.privateWorkspaceDependencies.length + state.missingWorkspaceDependencies.length + state.registryProblems.length + state.releaseHygieneProblems.length + state.packedManifestProblems.length === 0) return null;
+	if (state.sourceLinkDependencies.length + state.privateWorkspaceDependencies.length + state.missingWorkspaceDependencies.length + state.registryProblems.length + state.releaseHygieneProblems.length + state.packedManifestLintProblems.length + state.packedManifestProblems.length === 0) return null;
 	const publishOrder = createPublishOrder(rootPackageName, state);
 	const lines = [
 		`package release check failed for ${label}:`,
@@ -2418,6 +2638,7 @@ function createReleaseConsistencyError(options) {
 		...formatProblemLines("Source manifest depends on private workspace packages:", state.privateWorkspaceDependencies),
 		...formatProblemLines("Source manifest has invalid workspace: publish dependencies:", state.missingWorkspaceDependencies),
 		...formatProblemLines("Workspace packages must be published before this package:", state.registryProblems),
+		...formatProblemLines("Packed package manifest failed npm-package-json-lint:", state.packedManifestLintProblems),
 		...formatProblemLines("Packed package manifest is inconsistent with workspace publish dependencies:", state.packedManifestProblems)
 	];
 	if (publishOrder.length > 1) lines.push("", `Suggested publish order: ${publishOrder.join(" -> ")}`);
@@ -2449,11 +2670,21 @@ async function assertPackageReleaseConsistency(options) {
 		rootPackageName: options.outputManifest.name,
 		state
 	});
-	if (packedManifest) validatePackedManifest({
-		manifest: packedManifest,
-		rootPackageName: options.outputManifest.name,
-		state
-	});
+	if (packedManifest) {
+		validatePackedManifestLint({
+			config: options.config,
+			manifest: packedManifest,
+			outDir: options.outDir,
+			rootPackageName: options.outputManifest.name,
+			state
+		});
+		validatePackedManifest({
+			manifest: packedManifest,
+			rootPackageName: options.outputManifest.name,
+			state,
+			strict: options.config.strict === true
+		});
+	}
 	const error = createReleaseConsistencyError({
 		config: options.config,
 		label: options.label,
@@ -2476,6 +2707,24 @@ function logReleaseCheckPlan(options) {
 		...options.plan.entries.map((entry) => [`    - ${entry.label}`, `      outDir: ${toRelativePath(options.config.rootDir, entry.outDir)}`].join("\n"))
 	].join("\n"));
 }
+function collectStrictOutputManifestProblems(options) {
+	const sections = [
+		"dependencies",
+		"devDependencies",
+		"peerDependencies",
+		"optionalDependencies"
+	];
+	const problems = [];
+	for (const sectionName of sections) {
+		const section = options.manifest[sectionName];
+		if (!section || typeof section !== "object" || Array.isArray(section)) continue;
+		for (const [dependencyName, specifier] of Object.entries(section)) {
+			if (typeof specifier !== "string" || !isLocalPackageDependencySpecifier(specifier)) continue;
+			problems.push([`${options.label}: ${options.manifest.name} -> ${dependencyName} [${sectionName}] (${specifier}): output package manifest must not expose workspace:, link:, file:, or catalog: dependency specifiers when strict: true`, `  output: ${toRelativePath(options.rootDir, options.outDir)}`].join("\n"));
+		}
+	}
+	return problems;
+}
 async function packReleaseTarball(options) {
 	const packTask = options.flow?.start(`release tarball: ${options.label}`, { depth: options.flowDepth ?? 0 });
 	ReleaseLogger.info(`release tarball packing started: ${options.label}`);
@@ -2501,6 +2750,19 @@ async function runReleaseCheckEntry(options) {
 			label: options.label,
 			packageJsonPath: outputPackageJsonPath
 		});
+		const strictOutputProblems = isStrictConfig(options.config) ? collectStrictOutputManifestProblems({
+			label: options.label,
+			manifest: outputManifest,
+			outDir: options.outDir,
+			rootDir: options.config.rootDir
+		}) : [];
+		if (strictOutputProblems.length > 0) throw new PackageReleaseConsistencyError([
+			`package release check failed for ${options.label}:`,
+			`  output: ${toRelativePath(options.config.rootDir, options.outDir)}`,
+			"",
+			"Output package manifest is not publish-ready:",
+			...strictOutputProblems.map((problem) => `  - ${problem}`)
+		].join("\n"));
 		if (outputManifest.private === true) throw new PackageReleaseConsistencyError([
 			`package release check failed for ${options.label}:`,
 			`  output: ${toRelativePath(options.config.rootDir, options.outDir)}`,
@@ -2584,6 +2846,7 @@ const builtInTaskNames = new Set([
 	"checker:build",
 	"checker:typecheck",
 	"graph:check",
+	"nx:check",
 	"package:check",
 	"proof:check",
 	"release:check",
@@ -2592,34 +2855,77 @@ const builtInTaskNames = new Set([
 const defaultCheckPipeline = [
 	"graph:check",
 	"source:check",
+	"nx:check",
 	"proof:check",
 	"checker:build",
 	"checker:typecheck"
 ];
 function reportCheckerCapabilities(config, flow) {
 	if (!flow) return;
-	const firstClass = [];
-	const sourceOnly = [];
+	const buildExecution = [];
+	const typecheckExecution = [];
+	const sourceGraph = [];
+	const noSourceGraph = [];
 	for (const checker of getActiveCheckers(config)) {
 		const adapter = getCheckerAdapter(checker.preset);
 		const label = `${checker.name} (${checker.preset})`;
-		if (adapter?.tier === "first-class") firstClass.push(label);
-		else if (adapter?.tier === "source-only") sourceOnly.push(label);
+		if (adapter?.execution === "build") buildExecution.push(label);
+		else if (adapter?.execution === "typecheck") typecheckExecution.push(label);
+		if (adapter?.sourceGraph) sourceGraph.push(label);
+		else noSourceGraph.push(label);
 	}
 	flow.info([
 		"checker capability summary:",
-		`  first-class: ${firstClass.length > 0 ? firstClass.join(", ") : "(none)"}`,
-		`  source-only: ${sourceOnly.length > 0 ? sourceOnly.join(", ") : "(none)"}`,
-		...sourceOnly.length > 0 ? ["  note: source-only checkers get coverage proof and direct typecheck, but Limina does not parse their internal import graph."] : []
+		`  first-class build execution: ${buildExecution.length > 0 ? buildExecution.join(", ") : "(none)"}`,
+		`  second-class typecheck execution: ${typecheckExecution.length > 0 ? typecheckExecution.join(", ") : "(none)"}`,
+		`  source graph: ${sourceGraph.length > 0 ? sourceGraph.join(", ") : "(none)"}`,
+		`  no source graph: ${noSourceGraph.length > 0 ? noSourceGraph.join(", ") : "(none)"}`,
+		...typecheckExecution.length > 0 ? ["  note: second-class checkers run through checker:typecheck; source graph participation is reported separately."] : []
 	].join("\n"), { depth: 1 });
 }
 function isBuiltinTaskName(value) {
 	return builtInTaskNames.has(value);
 }
+function assertNeverTaskName(taskName) {
+	throw new Error(`Unsupported built-in task: ${taskName}`);
+}
 function getPipelineStepLabel(step) {
 	if (step.type === "task") return step.name;
 	return [step.command, ...step.args ?? []].join(" ");
 }
+function createCommandStepEnvironment(cwd, step) {
+	const basePath = step.env?.PATH ?? process.env.PATH;
+	return {
+		...process.env,
+		...step.env,
+		PATH: [path.join(cwd, "node_modules/.bin"), basePath].filter(Boolean).join(path.delimiter)
+	};
+}
+function isVueTsgoCommand(command) {
+	const commandName = path.basename(command).toLowerCase();
+	return commandName === "vue-tsgo" || commandName === "vue-tsgo.cmd";
+}
+function collectVueTsgoCommandConfigPaths(step, cwd) {
+	if (!isVueTsgoCommand(step.command)) return [];
+	const args = step.args ?? [];
+	const configPaths = [];
+	for (const [index, arg] of args.entries()) {
+		if (arg !== "--build" && arg !== "-b" && arg !== "--project" && arg !== "-p") continue;
+		const configArg = args[index + 1];
+		if (!configArg || configArg.startsWith("-")) continue;
+		configPaths.push(path.resolve(cwd, configArg));
+	}
+	return configPaths.length > 0 ? configPaths : [path.resolve(cwd, "tsconfig.json")];
+}
+async function prepareCommandStepCache(step, cwd) {
+	await Promise.all(collectVueTsgoCommandConfigPaths(step, cwd).map((configPath) => prepareVueTsgoCache({
+		args: step.args ?? [],
+		command: step.command,
+		configPath,
+		cwd,
+		label: getPipelineStepLabel(step)
+	})));
+}
 async function runBuiltinTask(config, taskName, options = {}) {
 	switch (taskName) {
 		case "graph:check": return runGraphCheck(config, {
@@ -2637,6 +2943,12 @@ async function runBuiltinTask(config, taskName, options = {}) {
 			flow: options.flow,
 			flowDepth: 1
 		});
+		case "nx:check": return !(await runNx(config, {
+			check: true,
+			clearScreen: false,
+			flow: options.flow,
+			flowDepth: 1
+		})).changed;
 		case "package:check": return runPackageCheck({
 			clearScreen: false,
 			config,
@@ -2667,6 +2979,7 @@ async function runBuiltinTask(config, taskName, options = {}) {
 			flow: options.flow,
 			flowDepth: 1
 		})).passed;
+		default: return assertNeverTaskName(taskName);
 	}
 }
 function normalizePipelineStep(step) {
@@ -2683,17 +2996,16 @@ function normalizePipelineStep(step) {
 		type: "command"
 	};
 }
-function runCommandStep(config, step, options = {}) {
+async function runCommandStep(config, step, options = {}) {
 	const label = getPipelineStepLabel(step);
 	const task = options.flow?.start(`command: ${label}`, { depth: 1 });
+	const cwd = step.cwd ? path.resolve(config.rootDir, step.cwd) : config.rootDir;
 	const commandOptions = {
-		cwd: step.cwd ? path.resolve(config.rootDir, step.cwd) : config.rootDir,
-		env: {
-			...process.env,
-			...step.env
-		},
+		cwd,
+		env: createCommandStepEnvironment(cwd, step),
 		shell: process.platform === "win32"
 	};
+	await prepareCommandStepCache(step, cwd);
 	if (options.flow?.interactive) return new Promise((resolve, reject) => {
 		const child = spawn(step.command, step.args ?? [], {
 			...commandOptions,
@@ -2833,16 +3145,46 @@ async function main() {
 		if (action === "check" && result.changed) process.exitCode = 1;
 		flow.outro(action === "check" && result.changed ? "limina paths failed" : "limina paths passed");
 	});
-	cli.command("graph <action>", "Check TypeScript graph architecture").action(async (action, flags) => {
-		if (action !== "check") throw new Error(`Unknown graph action "${action}". Expected check.`);
+	cli.command("nx <action> [...targets]", "Sync or check Nx project target dependencies from workspace artifact dependencies").action(async (action, targets, flags) => {
+		if (action !== "sync" && action !== "check") throw new Error(`Unknown nx action "${action}". Expected sync or check.`);
 		const flow = createCliFlow();
-		flow.intro("limina graph check");
-		const passed = await runGraphCheck(await load(flags, "graph"), {
+		flow.intro(`limina nx ${action}`);
+		const result = await runNx(await load(flags, "nx"), {
+			check: action === "check",
 			clearScreen: false,
-			flow
+			flow,
+			targets
 		});
-		if (!passed) process.exitCode = 1;
-		flow.outro(passed ? "limina graph passed" : "limina graph failed");
+		if (action === "check" && result.changed) process.exitCode = 1;
+		flow.outro(action === "check" && result.changed ? "limina nx failed" : "limina nx passed");
+	});
+	cli.command("graph <action> [entryPath]", "Check or sync TypeScript graph architecture").action(async (action, entryPath, flags) => {
+		if (action !== "check" && action !== "sync") throw new Error(`Unknown graph action "${action}". Expected check or sync.`);
+		const flow = createCliFlow();
+		flow.intro(`limina graph ${action}`);
+		const config = await load(flags, "graph");
+		if (action === "check") {
+			const passed = await runGraphCheck(config, {
+				clearScreen: false,
+				flow
+			});
+			if (!passed) process.exitCode = 1;
+			flow.outro(passed ? "limina graph passed" : "limina graph failed");
+			return;
+		}
+		try {
+			await runGraphSync(config, {
+				clearScreen: false,
+				cwd: process.cwd(),
+				entryPath,
+				flow
+			});
+		} catch (error) {
+			process.exitCode = 1;
+			flow.outro("limina graph failed");
+			throw error;
+		}
+		flow.outro("limina graph passed");
 	});
 	cli.command("proof <action>", "Check root typecheck coverage proof").action(async (action, flags) => {
 		if (action !== "check") throw new Error(`Unknown proof action "${action}". Expected check.`);