workspai 0.49.0 → 0.51.0

package/docs/workspace-knowledge-graph.md

@@ -91,6 +91,12 @@ The response is intentionally bounded. `totalMatches` tells the consumer more
 results exist, `truncated` prevents silent omission, and every returned claim can
 be traced through `proofIds`.
 
+Search remains deterministic, local, and offline. Natural-language filler words
+are removed before ranking, and the remaining terms are weighted by how rare
+they are in the current graph. Exact labels and identities still win. This keeps
+a common word such as `check` from outranking a rarer term such as `user` merely
+because it appears in more files. No embedding service or model call is involved.
+
 ## Pick the command by question
 
 | You want to know…                                    | Use                                                     |
@@ -123,6 +129,31 @@ provider, source artifact, optional pointer/line, content hash, freshness,
 derivation, trust, and confidence. Secret values and machine-local absolute
 paths are excluded from the portable graph contract.
 
+## Read graph quality correctly
+
+Provider execution and graph completeness are separate signals:
+
+| Provider status | Meaning                                                                     |
+| --------------- | --------------------------------------------------------------------------- |
+| `passed`        | A matching source surface was found and graph evidence was produced.        |
+| `partial`       | The provider found applicable input but produced incomplete or no evidence. |
+| `skipped`       | No applicable source surface was present in this workspace.                 |
+| `failed`        | The provider could not complete its bounded scan.                           |
+
+`quality.providerSuccessRatio` is an execution-health ratio, not a completeness
+claim. A skipped provider is healthy but not applicable. Applicable providers
+that emit no evidence become `partial` and add an explicit unknown diagnostic,
+which contributes to `quality.unknownCount`. Bounded-scan limits and unresolved
+source relationships also contribute unknowns instead of being presented as
+complete coverage. Binding coverage remains the dimension-specific source for
+API implementation, tests, deployment, and ownership gaps; its unknowns are
+included in the aggregate count.
+
+Profiles govern workspace policy and verification expectations; they do not hide
+source providers. Running the same unchanged workspace with `minimal` and
+`polyglot` can therefore produce identical graph content. Changing a profile
+does update the canonical workspace manifest and contract identity.
+
 ## Model first, graph second
 
 The canonical direction is one-way:
@@ -138,13 +169,87 @@ CLI queries · Context · MCP · Agents · IDEs · CI
 ```
 
 The graph does not rewrite or replace the canonical Workspace Model. It is a
-derived representation bound to an exact model revision by SHA-256. Context and
-MCP consumers reject a graph whose source hash no longer matches the model.
+derived representation bound to an exact model revision by the SHA-256 hash of
+the model's stable structural projection. Volatile timestamps, run correlation,
+live evidence references, and freshness fields are intentionally excluded from
+that structural identity. Context, Doctor, MCP, and graph-stream consumers
+reject a graph whose source binding no longer matches the current model.
+
+### Model and graph relationship
+
+The current integrated CLI follows this order:
 
-The model also contains a smaller project dependency graph. That projection is
-used for impact, blast radius, verify, explain, watch, and affected fleet runs.
-The richer Knowledge Graph is used for proof-backed retrieval and cross-domain
-understanding.
+```text
+workspace files + registered projects + contracts + selected evidence
+                              |
+                              v
+                 canonical Workspace Model
+                    |                 |
+                    |                 +-- compact project dependency topology
+                    |
+                    v
+       provider scan + facts/proofs + identity reconciliation
+                              |
+                              v
+                  Workspace Knowledge Graph
+```
+
+The model owns the canonical workspace boundary: project identity, runtime and
+framework observations, policies, contract state, evidence references, and the
+compact project topology used by the intelligence loop. The Knowledge Graph
+receives that project inventory and topology, then enriches it from bounded
+source providers. It can add files, symbols, packages, APIs, infrastructure,
+tests, owners, decisions, and proof-carrying relations, but it cannot mutate the
+model that authorized the build.
+
+The canonical project inventory reconciles filesystem discovery, imported and
+adopted registries, and `workspace.contract.json` declarations. A project that
+is still declared by the contract but missing on disk is preserved in the
+model and reported as `project.path.missing`; it is never silently removed from
+the graph boundary. A persisted Knowledge Graph is accepted only when its
+workspace identity and project topology also match that model.
+
+An adopted monorepo remains one canonical project unless its internal projects
+are separately registered, discovered inside the workspace boundary, or
+declared by contract. The model still records bounded nested runtime manifests
+in `project.runtimeCandidates` and aggregates them into
+`workspace.identity.runtimeFamilies`. Graph providers can then discover the
+monorepo's internal services, contracts, delivery surfaces, and proofs without
+pretending that the primary runtime describes the whole repository.
+
+The two artifacts are published under one workspace lock using a
+rollback-capable artifact transaction. Each file replacement is atomic; if any
+write fails, Workspai restores both preimages. `graph.source.kind` is fixed to
+`workspace-model`, `graph.source.artifact` is fixed to
+`.workspai/reports/workspace-model.json`, and `graph.source.hash` contains the
+stable structural hash of the persisted model. A current-state consumer must
+reject the graph when that binding no longer matches `workspace-model.json`.
+
+This is therefore not a circular source-of-truth relationship. In the current
+CLI, the direction is **Model → Knowledge Graph**. Providers may use the same
+workspace sources that informed the model, but their output enriches the
+derived graph; it does not flow back into the model during that run. A future
+fact-first package may make normalized facts the shared input to both
+representations, but that is not the shipped contract today.
+
+The model also contains a smaller project dependency graph under the canonical
+`projectTopology` field. That projection is used for impact, blast radius,
+verify, explain, watch, and affected fleet runs. The richer Knowledge Graph is
+used for proof-backed retrieval and cross-domain understanding. The deprecated
+`graph` field is emitted only as a v1 compatibility alias and must remain
+structurally identical to `projectTopology`; new consumers must not depend on
+the alias.
+
+These rules are machine-owned, not Markdown conventions:
+
+- `workspace-intelligence-architecture.v1.json` declares the one-way direction,
+  artifact authority, mutation rule, publication rule, and stale-consumer rule;
+- `workspace-knowledge-graph.v1.json` permits only the canonical model source
+  kind and artifact path;
+- `workspace-intelligence-chain.v1.json` requires the Model stage to produce
+  both artifacts;
+- runtime source-binding guards enforce the structural hash before persisted
+  graph consumption.
 
 ## Sources and providers
 
@@ -161,9 +266,32 @@ deduplication, typed relations, reconciliation, quality metrics, diagnostics,
 and deterministic ordering. Regex-backed source observations are explicitly
 marked as observed/medium-confidence; authored contracts remain authoritative.
 
+Local source imports are resolved to indexed file entities when the target can
+be proven. External packages remain module entities, while unresolved relative
+imports are labelled `unresolved-local` and produce a diagnostic. This prevents
+an unknown local path from being silently presented as a third-party
+dependency.
+
+### Binding quality, not just graph size
+
+Entity and relation counts do not tell you whether a graph can answer useful
+engineering questions. `graph.quality.bindingCoverage` therefore reports four
+independent dimensions:
+
+- authored or observed endpoints connected to implementation evidence;
+- registered projects connected to test evidence;
+- registered projects connected to deployment evidence;
+- registered projects connected to ownership evidence.
+
+Each dimension reports eligible, bound, and unknown counts plus a ratio. A
+`null` ratio means the dimension was not applicable; zero means applicable
+surfaces were found but none were bound. Consumers must not turn either state
+into a false “complete” claim.
+
 ## Outputs and consumers
 
-`workspace model --write` publishes these two artifacts atomically:
+`workspace model --write` publishes these two artifacts as one locked,
+rollback-capable artifact set:
 
 ```text
 .workspai/reports/workspace-model.json
@@ -173,6 +301,12 @@ marked as observed/medium-confidence; authored contracts remain authoritative.
 The Knowledge Graph is consumed by:
 
 - `workspace graph search|entities|evidence|path|overlay`;
+- `doctor workspace|project`, which maps unresolved probes to structural root
+  candidates, reachable affected surfaces, proof paths, and graph-connected
+  test/pipeline verification targets. When a runtime audit names affected
+  dependencies, Doctor binds those subjects to exact package/module entities
+  instead of selecting an arbitrary project package. Names that cannot be
+  resolved remain explicit unknowns;
 - `workspace context`, which validates the model hash and publishes graph
   availability and query commands;
 - `workspace agent-sync`, which places it in the evidence index and generated

package/docs/workspace-operations.md

@@ -6,12 +6,23 @@ operation changes before you run it.
 
 Command syntax: [commands-reference.md](./commands-reference.md).
 
-## Import and adoption
+## Choose the operation by intent
 
-Use `import` to copy or clone an existing project into a Workspai workspace.
-Use `adopt` when the project must stay where it already lives but should become
-visible to Workspai. In both cases, the project becomes part of the shared
-system map, checks, and AI context.
+Workspai keeps project onboarding and workspace portability separate. Choose
+the operation by what should happen to the source:
+
+| Resource  | Source           | Intent                       | Command                      | Source moved or copied? | Registered? |
+| --------- | ---------------- | ---------------------------- | ---------------------------- | ----------------------- | ----------- |
+| Project   | Local folder     | Keep the project where it is | `workspai adopt`             | No                      | Yes         |
+| Project   | Local folder     | Copy it into a workspace     | `workspai import`            | Copied                  | Yes         |
+| Project   | Git URL          | Clone it into a workspace    | `workspai import --git`      | Cloned                  | Yes         |
+| Workspace | Existing folder  | Use it where it is           | `workspai workspace connect` | No                      | Yes         |
+| Workspace | Portable archive | Restore and start using it   | `workspai workspace import`  | Materialized            | Yes         |
+| Workspace | Portable archive | Extract files only           | `workspai workspace hydrate` | Materialized            | No          |
+
+All registered routes reconcile the canonical registry, workspace contract,
+and project entry surfaces. `hydrate` deliberately stops after safe extraction
+so automation can inspect the materialized files before registration.
 
 RapidKit Core module commands remain available only when existing project
 metadata identifies a kit that supports modules.
@@ -22,6 +33,8 @@ npx workspai import https://github.com/acme/orders-api.git --git
 npx workspai import ../orders-api --workspace ./my-workspace --name orders-api --json
 npx workspai adopt ../marketing-web --workspace ./my-workspace
 npx workspai adopt --json
+npx workspai workspace connect ../existing-workspace --json
+npx workspai workspace import team.workspai-archive.zip --output ./team --json
 ```
 
 ### Import behavior
@@ -29,8 +42,9 @@ npx workspai adopt --json
 - Local folders are copied; git sources are cloned with shallow history.
 - Outside any workspace (no `--workspace`), Workspai creates or reuses the managed `workspai` workspace. New defaults use `~/.workspai/workspaces/workspai`; valid legacy candidates under `~/rapidkit/workspaces/workspai` and `~/Workspai/rapidkits/workspai` can still be reused.
 - Existing workspaces under legacy managed roots remain registered after upgrade.
-- CLI prints the exact next `cd ...` step. JSON mode returns the same value as
-  `suggestedCdCommand`.
+- Workspai writes a validated machine-local workspace binding into the
+  imported project. Workspace commands can then be launched from that project
+  without changing directories.
 - Failed workspace sync rolls back imported files and registry entries.
 
 ### Adopt behavior
@@ -39,14 +53,110 @@ npx workspai adopt --json
 - Default workspace resolution matches import, including canonical creation and valid legacy managed-default reuse.
 - Writes `.workspai/project.json`, `.workspai/adopt.json`, and `.workspai/adopt-readiness.json`.
 - Registry and contract sync include adopted projects for `workspace model`, `workspace context`, Dashboard, and agents.
+- Managed grounding writes a portable project lens, project grounding, and a
+  bounded managed section in `AGENTS.md`. User-authored `AGENTS.md` content is
+  preserved.
 - `--dry-run --json` previews detection without writing metadata.
 
+### Existing workspace behavior
+
+- `workspace connect` registers a valid local Workspai workspace in place. It
+  does not copy its projects.
+- `workspace import` verifies an archive, materializes it atomically, removes
+  machine-local bindings from the source machine, registers the workspace, and
+  reconciles its portable contract snapshot and project entry links.
+- Archive import never silently overwrites an explicit `--output` destination.
+- External adopted projects are not copied into an archive. The manifest keeps
+  only their portable identity and reports that they must be relinked.
+- `workspace hydrate` is the lower-level extraction primitive. Use it when a
+  deployment or migration process—not Workspai—owns registration.
+
+Every registered onboarding route emits the same versioned ingestion plan in
+JSON. The plan states the resource, source kind, materialization mode,
+ownership, registration intent, destination, and grounding policy. Consumers
+should use that contract instead of inferring behavior from command names.
+`workspace hydrate` remains an unregistered archive primitive and emits the
+versioned archive operation result instead.
+
+### Automatic consumer sync
+
+Workspace creation publishes the initial contract, canonical model, Knowledge
+Graph, structural baseline, context, report index, profile-aware `README.md`,
+`AGENTS.md`, operational skills, and supported IDE/agent surfaces—even before
+the first project exists. The README's Workspai-managed section shows the
+current profile, project count, canonical intelligence loop, and consumer entry
+points while preserving user-authored content. Successful project creation,
+adoption, import, workspace connection, and workspace import refresh those same
+projections in the background. The structural baseline is created once and
+preserved; current model, graph, diff, impact, context, README, and project
+grounding move forward with workspace membership.
+
+Doctor, Analyze, Readiness, and Verify remain explicit checks because they may
+run project tools or enforce release policy. Use `workspace intelligence run`
+when you want that governed decision chain, rather than only lifecycle sync.
+
+### Work from the project directory
+
+After `adopt`, `import`, or project creation, the project is a first-class
+entry point into its canonical workspace:
+
+```bash
+cd /absolute/path/to/project
+npx workspai project workspace status --json
+npx workspai doctor project --json
+npx workspai workspace graph search "authentication endpoint" --limit 12 --json
+npx workspai workspace intelligence run --for-agent generic --strict --json
+```
+
+Workspace resolution has one stable precedence:
+`--workspace` → parent workspace → validated local link → reverse registry.
+Workspai returns a specific error for an invalid explicit workspace, malformed
+or stale link, ambiguous registration, or an unlinked project. It never picks
+one workspace silently when ownership is ambiguous.
+
+The project receives four distinct surfaces:
+
+| File                                           | Purpose                                                                       | Portable              |
+| ---------------------------------------------- | ----------------------------------------------------------------------------- | --------------------- |
+| `.workspai/workspace-link.local.json`          | Machine-local canonical workspace binding                                     | No; always gitignored |
+| `.workspai/reports/project-context-agent.json` | Bounded project view of model, graph, proofs, diagnostics, and safe commands  | Yes                   |
+| `.workspai/PROJECT-GROUNDING.md`               | Human- and agent-readable project entry guide                                 | Yes                   |
+| `AGENTS.md` managed section                    | Tells compatible agents where to start and when to cross the project boundary | Yes                   |
+
+The bounded context includes project identity and commands, dependencies and
+dependents, related API/deployment/test surfaces, current project findings,
+portable proof locators, and model/graph freshness. It deliberately references
+rather than duplicates workspace-wide evidence.
+
+Use `--project-grounding managed` (default) to publish all portable surfaces,
+`local` to keep the project lens and grounding gitignored without managing
+`AGENTS.md`, or `off` to disable project grounding for that operation. The
+machine-local link remains enabled in every mode because it owns command
+resolution; it is private to the current machine and never belongs in a commit.
+Mode reconciliation is convergent: changing modes removes stale managed
+sections, portable files, or ignore rules that the new mode no longer owns,
+while preserving user-authored `AGENTS.md` and `.gitignore` content.
+
+If a workspace moved, or a cloned project has no valid local link, reconcile
+it explicitly:
+
+```bash
+npx workspai project workspace relink --workspace /absolute/path/to/my-workspace --json
+```
+
+Relink succeeds only when the project is already a member of the canonical
+workspace contract.
+
 ### JSON output (`--json`)
 
-- Import returns `workspacePath`, `workspaceResolution`, `defaultWorkspaceCreated`, `suggestedCdCommand`, and `importedProject`. The imported project includes its `source`.
+- Import returns `workspacePath`, `workspaceResolution`,
+  `defaultWorkspaceCreated`, `projectWorkspaceCommand`,
+  `commandsResolveWorkspaceFromProject`, and `importedProject`. The imported
+  project includes its `source`.
 - Adopt returns `workspacePath`, `workspaceResolution`,
   `defaultWorkspaceCreated`, `wouldCreateDefaultWorkspace`,
-  `suggestedCdCommand`, `dryRun`, and `adoptedProject`.
+  `projectWorkspaceCommand`, `commandsResolveWorkspaceFromProject`, `dryRun`,
+  and `adoptedProject`.
 - Project results include detected `name`, `path`, `stack`, `runtime`, `framework`, `supportTier`, `moduleSupport`, and `confidence` where available.
 
 Imported projects receive `.workspai/import-readiness.json`. Adopted projects add frontend-aware detection for Next.js, React, Vite, Vue, Angular, SvelteKit, Nuxt, Astro, Remix, and Solid.
@@ -137,6 +247,20 @@ queryable through the read-mostly MCP server. This keeps CLI, CI, IDE and agent
 consumers on one contract revision without injecting the full graph into every
 agent prompt.
 
+The relationship is one-way and contract-enforced: the Workspace Model owns the
+canonical project boundary and compact dependency topology in
+`workspace-model.json.projectTopology`; providers enrich
+that inventory into the Knowledge Graph. The graph source kind and artifact
+path are fixed to the model, its source hash identifies the stable structural
+model projection, and persisted current-state consumers reject a mismatched
+graph. `workspace contract graph` follows the same model-first build path; it
+does not create a competing contract- or source-owned Knowledge Graph.
+
+The deprecated `workspace-model.json.graph` field is a temporary v1
+compatibility alias. It is emitted with the same value as `projectTopology`,
+excluded as a duplicate from the canonical hash, and rejected when the two
+fields diverge. New integrations must consume `projectTopology`.
+
 The overlay follows
 `workspace-knowledge-graph-change-overlay.v1`: graph revisions are identified
 by content-derived fingerprints (timestamps do not create false changes), and
@@ -168,9 +292,21 @@ npx workspai workspace archive inspect team-workspace.workspai-archive.zip
 npx workspai workspace archive verify team-workspace.workspai-archive.zip --strict
 npx workspai workspace archive doctor team-workspace.workspai-archive.zip
 npx workspai workspace hydrate team-workspace.workspai-archive.zip --output ./team-workspace
+npx workspai workspace import team-workspace.workspai-archive.zip --output ./team-workspace
+npx workspai workspace connect /path/to/existing-workspace
 ```
 
-Export excludes dependency folders, build output, git history, logs, `.env`, and private keys by default. Use `--include-env` only for trusted internal handoffs. Hydrate accepts legacy `.rapidkit-workspace` and `.rapidkit/*` archive entries, but restores them as canonical `.workspai-workspace` and `.workspai/*` paths.
+Export excludes dependency folders, build output, git history, logs, `.env`,
+private keys, machine-local project links, derived registries, and raw
+absolute-path workspace contracts by default. The manifest carries a
+path-neutral contract snapshot so manual ports, APIs, ownership, events, and
+dependency declarations survive transfer. External projects and their absolute
+paths are excluded and reported as explicit relink actions. Use `--include-env`
+only for trusted internal handoffs. Hydrate accepts legacy
+`.rapidkit-workspace` and `.rapidkit/*` archive entries, but restores them as
+canonical `.workspai-workspace` and `.workspai/*` paths. Workspace import then
+reconciles the portable snapshot with project metadata on the destination
+machine and rebuilds machine-local bindings.
 
 Archive export, verification, and hydrate stream file payloads instead of loading the workspace into memory. Exports use ZIP64, so multi-gigabyte workspaces and archives with more than 65,535 files are supported. Stored ZIP entries are the default; use `--archive-compression deflate` when transfer size matters more than export CPU time.
 
@@ -228,6 +364,9 @@ Artifacts:
 | `autopilot release`                                         | Wrapper orchestrator   | End-to-end release gate evidence                   |
 | `import`                                                    | Workspace ingestion    | Rollback-safe sync                                 |
 | `adopt`                                                     | Workspace adoption     | In-place linking + registry sync                   |
+| `workspace connect`                                         | Workspace ingestion    | In-place workspace registration + reconciliation   |
+| `workspace import`                                          | Workspace ingestion    | Verified archive restore + registration            |
+| `workspace hydrate`                                         | Archive primitive      | Verified extraction without registration           |
 | `workspace model/context/diff/impact/verify`                | Workspace intelligence | Model, context packs, blast radius                 |
 | `workspace intelligence run`                                | Workspace intelligence | Canonical contract-backed chain and strict gate    |
 | `snapshot`                                                  | Workspace recovery     | Metadata or full snapshots                         |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "workspai",
-  "version": "0.49.0",
+  "version": "0.51.0",
   "type": "module",
   "description": "Open-source workspace intelligence CLI for software systems: create, adopt, govern, verify, and align polyglot workspaces for humans, CI, IDEs, and AI agents.",
   "keywords": [
@@ -95,7 +95,7 @@
     "validate:contracts": "corepack npm run check:shared-contracts && vitest run src/__tests__/contracts/",
     "test:parity-contract": "corepack npm run check:shared-contracts && vitest run src/__tests__/contracts/import-stack-parity.snapshot.test.ts",
     "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage --reporter=default --reporter=json --outputFile.json=test-results/vitest.json",
+    "test:coverage": "corepack npm run test:prebuild && vitest run --coverage --reporter=default --reporter=json --outputFile.json=test-results/vitest.json",
     "test:prepare-embeddings": "node scripts/prepare-mock-embeddings.mjs",
     "generate-embeddings": "npx tsx src/ai/generate-embeddings.ts",
     "verify:package-cli": "node scripts/verify-package-cli.mjs",
@@ -128,13 +128,16 @@
     "validate:docs": "corepack npm run check:markdown-links && corepack npm run check:docs-drift && corepack npm run validate:docs-examples && corepack npm run check:github-release-notes && corepack npm run smoke:readme",
     "smoke:frontend-generators": "tsup && node scripts/smoke-frontend-generators.mjs",
     "smoke:frontend-generators:network": "tsup && node scripts/smoke-frontend-generators.mjs --execute",
+    "smoke:official-generators": "tsup && node scripts/smoke-official-generators.mjs",
+    "smoke:official-generators:network": "tsup && node scripts/smoke-official-generators.mjs --execute",
+    "check:generator-smoke-coverage": "node scripts/check-generator-smoke-coverage.mjs",
     "sync:contracts": "node scripts/sync-contracts.mjs",
     "check:contracts": "node scripts/sync-contracts.mjs --check",
     "bundle-size": "corepack npm run build && node scripts/report-dist-size.mjs",
     "analyze": "corepack npm run build && node scripts/analyze-dist.mjs",
     "size-check": "corepack npm run build && size-limit",
     "bench": "npx tsx scripts/benchmarks.ts",
-    "quality": "corepack npm run check:package-manager && corepack npm run typecheck && corepack npm run lint && corepack npm run format:check && corepack npm test && corepack npm run size-check && corepack npm run check:workspace-intelligence-runtime && corepack npm run check:workspace-intelligence-adversarial && corepack npm run security && corepack npm run validate:docs && corepack npm run smoke:frontend-generators && corepack npm run check:contracts && corepack npm run check:shared-contracts && corepack npm run check:parity-snapshot && corepack npm run check:agent-customization-drift",
+    "quality": "corepack npm run check:package-manager && corepack npm run typecheck && corepack npm run lint && corepack npm run format:check && corepack npm test && corepack npm run size-check && corepack npm run check:workspace-intelligence-runtime && corepack npm run check:workspace-intelligence-adversarial && corepack npm run security && corepack npm run validate:docs && corepack npm run check:generator-smoke-coverage && corepack npm run smoke:official-generators && corepack npm run check:contracts && corepack npm run check:shared-contracts && corepack npm run check:parity-snapshot && corepack npm run check:agent-customization-drift",
     "act-matrix": "act -P ubuntu-latest=ghcr.io/catthehacker/ubuntu:act-22.04 -P macos-latest=ghcr.io/catthehacker/ubuntu:act-22.04 -P windows-latest=ghcr.io/catthehacker/ubuntu:act-22.04 --pull=false -j build-test-matrix",
     "release:dry": "bash scripts/release.sh --no-publish --yes --allow-dirty",
     "release:patch": "bash scripts/release.sh patch",
@@ -146,7 +149,7 @@
     "contracts:check": "corepack npm run check:contracts && corepack npm run check:shared-contracts && corepack npm run check:parity-snapshot && corepack npm run check:generated-contracts && corepack npm run check:agent-customization-drift",
     "contracts:validate": "corepack npm run contracts:check && corepack npm run validate:contracts && corepack npm run build && corepack npm run check:workspace-intelligence-runtime && corepack npm run check:workspace-intelligence-adversarial",
     "docs:validate": "corepack npm run validate:docs",
-    "smoke": "corepack npm run smoke:enterprise-package && corepack npm run smoke:readme && corepack npm run smoke:frontend-generators",
+    "smoke": "corepack npm run smoke:enterprise-package && corepack npm run smoke:readme && corepack npm run check:generator-smoke-coverage && corepack npm run smoke:official-generators",
     "fix": "corepack npm run lint:fix && corepack npm run format && corepack npm run sync:contracts && corepack npm run sync:shared-contracts && corepack npm run sync-kits"
   },
   "dependencies": {

package/scripts/enterprise-package-smoke.mjs

@@ -8,6 +8,11 @@ import process from 'node:process';
 
 const repoRoot = process.cwd();
 const cliPath = path.join(repoRoot, 'dist', 'index.js');
+const isolatedHome = fs.mkdtempSync(path.join(os.tmpdir(), 'workspai-enterprise-home-'));
+
+process.on('exit', () => {
+  fs.rmSync(isolatedHome, { recursive: true, force: true });
+});
 
 function fail(message) {
   console.error(`[enterprise-package-smoke] ${message}`);
@@ -19,7 +24,14 @@ function log(message) {
 }
 
 function cliEnv(extraEnv = {}) {
-  const env = { ...process.env, ...extraEnv };
+  const env = {
+    ...process.env,
+    HOME: isolatedHome,
+    USERPROFILE: isolatedHome,
+    XDG_CONFIG_HOME: path.join(isolatedHome, '.config'),
+    XDG_CACHE_HOME: path.join(isolatedHome, '.cache'),
+    ...extraEnv,
+  };
   delete env.NODE_ENV;
   delete env.NODE_OPTIONS;
   for (const key of Object.keys(env)) {
@@ -364,6 +376,17 @@ function smokeCreateNpmBackedKits() {
         'rapidkit',
       ],
     },
+    {
+      kit: 'rust.axum',
+      name: 'enterprise-rust-axum',
+      extraArgs: [],
+      expectedFiles: [
+        'Cargo.toml',
+        'src/main.rs',
+        '.workspai/project.json',
+        'rapidkit',
+      ],
+    },
   ];
 
   try {

package/templates/kits/fastapi-ddd/README.md.j2

@@ -35,7 +35,7 @@ make audit
 
 > Re-run `rapidkit init` (or `make init`) when dependencies change. If you only need to refresh tooling/hooks, run `SKIP_INIT=1 make install` or rely on `./bootstrap.sh`.
 
-> Lockfiles are generated automatically during scaffolding. Set `RAPIDKIT_SKIP_LOCKS=1` (or `RAPIDKIT_GENERATE_LOCKS=0`) before running `rapidkit create` if you want to skip the lockfile attempt.
+> Lockfiles are generated automatically during scaffolding. Set `RAPIDKIT_SKIP_LOCKS=1` (or `RAPIDKIT_GENERATE_LOCKS=0`) in the environment before scaffolding if you want to skip the lockfile attempt.
 
 > Need to see every project-local RapidKit Core command? Run `rapidkit --help`. If this project is part of a Workspai workspace, run `npx workspai --help` from the workspace root for workspace intelligence commands.
 

package/templates/kits/fastapi-standard/README.md.j2

@@ -34,7 +34,7 @@ rapidkit start
 
 > Re-run `rapidkit init` (or `make init`) whenever dependencies change, or use `SKIP_INIT=1 make install` if you only need to refresh tooling/hooks without reinstalling packages.
 
-> Lockfiles are generated automatically during scaffolding. Set `RAPIDKIT_SKIP_LOCKS=1` (or `RAPIDKIT_GENERATE_LOCKS=0`) before running `rapidkit create` if you need to opt out.
+> Lockfiles are generated automatically during scaffolding. Set `RAPIDKIT_SKIP_LOCKS=1` (or `RAPIDKIT_GENERATE_LOCKS=0`) in the environment before scaffolding if you need to opt out.
 
 > Want the project-local RapidKit Core catalog? Run `rapidkit --help`. If this project is part of a Workspai workspace, run `npx workspai --help` from the workspace root for workspace intelligence commands.
 

package/templates/kits/nestjs-standard/Dockerfile.j2

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1.6
-ARG NODE_VERSION=20.19.0-alpine
+ARG NODE_VERSION=24.18.0-alpine
 FROM node:${NODE_VERSION} as builder
 
 WORKDIR /usr/src/app

package/templates/kits/nestjs-standard/README.md.j2

@@ -34,7 +34,7 @@ rapidkit test
 
 > Use `rapidkit init` (or `make init`) whenever dependencies change. Pass `SKIP_INIT=1` (for example `SKIP_INIT=1 make install`) if you only need to refresh tooling/hooks.
 
-> Lockfiles are generated automatically during scaffolding. Set `RAPIDKIT_SKIP_LOCKS=1` (or `RAPIDKIT_GENERATE_LOCKS=0`) before running `rapidkit create` if you need to skip this step.
+> Lockfiles are generated automatically during scaffolding. Set `RAPIDKIT_SKIP_LOCKS=1` (or `RAPIDKIT_GENERATE_LOCKS=0`) in the environment before scaffolding if you need to skip this step.
 
 > Need the project-local RapidKit Core command list? Run `rapidkit --help`. If this project is part of a Workspai workspace, run `npx workspai --help` from the workspace root for workspace intelligence commands.
 

package/templates/kits/nestjs-standard/package.json.j2

@@ -76,7 +76,7 @@
     "@types/compression": "^1.8.1",
     "@types/express": "^5.0.6",
     "@types/jest": "^30.0.0",
-    "@types/node": "^18.19.130",
+    "@types/node": "^24.13.3",
     "@types/supertest": "^6.0.3",
     "@typescript-eslint/eslint-plugin": "^8.50.1",
     "@typescript-eslint/parser": "^8.50.1",
@@ -96,6 +96,15 @@
   },
   "overrides": {
     "cross-spawn": "7.0.5",
-    "glob": "10.5.0"
+    "glob": "10.5.0",
+    "js-yaml": "5.2.2"
+  },
+  "resolutions": {
+    "js-yaml": "5.2.2"
+  },
+  "pnpm": {
+    "overrides": {
+      "js-yaml": "5.2.2"
+    }
   }
 }

package/dist/analyze-EEEU3MIF.js

@@ -1 +0,0 @@
-export{b as printAnalyzeReport,a as runAnalyze}from'./chunk-54EP5CEV.js';

package/dist/autopilot-release-R4XRTWEM.js

@@ -1 +0,0 @@
-export{b as AUTOPILOT_RELEASE_ALIAS_FILENAME,a as AUTOPILOT_RELEASE_LAST_RUN_FILENAME,c as runAutopilotRelease}from'./chunk-K4X3DM7R.js';

package/dist/chunk-22DT744Z.js

@@ -1 +0,0 @@
-import {c,d,a,b}from'./chunk-5XATWNME.js';import s from'fs';import o from'path';function R(i){let n=o.resolve(i);for(;;){if(s.existsSync(o.join(n,c))||s.existsSync(o.join(n,d))||s.existsSync(o.join(n,a,"workspace.json"))||s.existsSync(o.join(n,b,"workspace.json")))return n;let r=o.dirname(n);if(r===n)return null;n=r;}}function l(i){let n=o.resolve(i),r=s.existsSync(o.join(n,c))||s.existsSync(o.join(n,d))||s.existsSync(o.join(n,a,"workspace.json"))||s.existsSync(o.join(n,b,"workspace.json")),p=s.existsSync(o.join(n,a,"project.json"))||s.existsSync(o.join(n,a,"context.json"))||s.existsSync(o.join(n,b,"project.json"))||s.existsSync(o.join(n,b,"context.json"));return r&&!p}export{R as a,l as b};