From 687e210c83679ffa35d8a2d57c38ec31f0f204f2 Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sat, 10 Oct 2026 22:28:36 +0100
Subject: [PATCH 01/31] feat: add graph-cli package

The process-graph command line as a composition root over the other packages: sync from
GitHub issues into the SQLite store through sqlite-node, then ready, blocked, impact, path,
cycles, handoffs and why over the stored model, show for every view in Mermaid, DOT or the
projection as JSON, add and set to author a model and its run state, and validate for the
stored model or a model document.

runCli takes injected ports (output streams, store opener, sources by prefix, file reads,
facts and an abort signal) and resolves with an exit status, so the whole command surface runs
in tests and inside a host such as Switchboard without a process; nodePorts wires the real
ones, with the GitHub token from the adapter's environment helper. Each command's operation
returns plain data, every command writes JSON with --json, and exit statuses separate usage
errors, missing identifiers, invalid models and source refusals.

A sync merges every page into the model in one write; when a source fails part way the pages
already read are saved and the error prints the command that resumes with --after.
---
 README.md                                     |   1 +
 knip.config.ts                                |   3 +-
 packages/targets/graph-cli/AGENTS.md          |   1 +
 packages/targets/graph-cli/CLAUDE.md          |   1 +
 packages/targets/graph-cli/README.md          | 101 +++
 packages/targets/graph-cli/eslint.config.ts   |  10 +
 packages/targets/graph-cli/package.json       |  86 +++
 packages/targets/graph-cli/src/bin.ts         |   7 +
 .../graph-cli/src/cli-authoring.unit.test.ts  | 552 +++++++++++++++
 .../targets/graph-cli/src/cli.unit.test.ts    | 296 ++++++++
 packages/targets/graph-cli/src/edit.ts        | 106 +++
 packages/targets/graph-cli/src/emit/dot.ts    | 275 ++++++++
 .../graph-cli/src/emit/emit.unit.test.ts      | 279 ++++++++
 .../targets/graph-cli/src/emit/mermaid.ts     | 233 +++++++
 packages/targets/graph-cli/src/emit/text.ts   |  47 ++
 packages/targets/graph-cli/src/errors.ts      | 116 ++++
 packages/targets/graph-cli/src/exit-codes.ts  |  21 +
 packages/targets/graph-cli/src/index.ts       |  82 +++
 packages/targets/graph-cli/src/node.ts        | 173 +++++
 packages/targets/graph-cli/src/ports.ts       |  43 ++
 packages/targets/graph-cli/src/program.ts     | 633 ++++++++++++++++++
 packages/targets/graph-cli/src/queries.ts     | 215 ++++++
 packages/targets/graph-cli/src/render.ts      | 142 ++++
 packages/targets/graph-cli/src/session.ts     | 121 ++++
 packages/targets/graph-cli/src/show.ts        | 222 ++++++
 packages/targets/graph-cli/src/sync.ts        | 175 +++++
 .../graph-cli/src/test-support/fixtures.ts    |  90 +++
 .../graph-cli/src/test-support/harness.ts     | 115 ++++
 packages/targets/graph-cli/src/validate.ts    |  88 +++
 packages/targets/graph-cli/stryker.config.ts  |   3 +
 .../graph-cli/test/package.smoke.test.ts      |  64 ++
 .../targets/graph-cli/tsconfig.build.json     |  37 +
 packages/targets/graph-cli/tsconfig.json      |   8 +
 packages/targets/graph-cli/vitest.config.ts   |  16 +
 pnpm-lock.yaml                                |  64 ++
 tsconfig.build.json                           |   3 +
 36 files changed, 4428 insertions(+), 1 deletion(-)
 create mode 120000 packages/targets/graph-cli/AGENTS.md
 create mode 120000 packages/targets/graph-cli/CLAUDE.md
 create mode 100644 packages/targets/graph-cli/README.md
 create mode 100644 packages/targets/graph-cli/eslint.config.ts
 create mode 100644 packages/targets/graph-cli/package.json
 create mode 100644 packages/targets/graph-cli/src/bin.ts
 create mode 100644 packages/targets/graph-cli/src/cli-authoring.unit.test.ts
 create mode 100644 packages/targets/graph-cli/src/cli.unit.test.ts
 create mode 100644 packages/targets/graph-cli/src/edit.ts
 create mode 100644 packages/targets/graph-cli/src/emit/dot.ts
 create mode 100644 packages/targets/graph-cli/src/emit/emit.unit.test.ts
 create mode 100644 packages/targets/graph-cli/src/emit/mermaid.ts
 create mode 100644 packages/targets/graph-cli/src/emit/text.ts
 create mode 100644 packages/targets/graph-cli/src/errors.ts
 create mode 100644 packages/targets/graph-cli/src/exit-codes.ts
 create mode 100644 packages/targets/graph-cli/src/index.ts
 create mode 100644 packages/targets/graph-cli/src/node.ts
 create mode 100644 packages/targets/graph-cli/src/ports.ts
 create mode 100644 packages/targets/graph-cli/src/program.ts
 create mode 100644 packages/targets/graph-cli/src/queries.ts
 create mode 100644 packages/targets/graph-cli/src/render.ts
 create mode 100644 packages/targets/graph-cli/src/session.ts
 create mode 100644 packages/targets/graph-cli/src/show.ts
 create mode 100644 packages/targets/graph-cli/src/sync.ts
 create mode 100644 packages/targets/graph-cli/src/test-support/fixtures.ts
 create mode 100644 packages/targets/graph-cli/src/test-support/harness.ts
 create mode 100644 packages/targets/graph-cli/src/validate.ts
 create mode 100644 packages/targets/graph-cli/stryker.config.ts
 create mode 100644 packages/targets/graph-cli/test/package.smoke.test.ts
 create mode 100644 packages/targets/graph-cli/tsconfig.build.json
 create mode 100644 packages/targets/graph-cli/tsconfig.json
 create mode 100644 packages/targets/graph-cli/vitest.config.ts

diff --git a/README.md b/README.md
index cea1db8..c85d40a 100644
--- a/README.md
+++ b/README.md
@@ -61,6 +61,7 @@ Configuration lives at exactly one of two levels: in the package (`eslint.config
 | [`graph-react`](packages/ui/graph/react/README.md)                                     | Headless React hooks and unstyled components: follow a stored model, derive statuses, the ready set, blocked chains, impact and explanations, project views, filter, select and navigate by keyboard.                                             |
 | [`graph-ui`](packages/ui/graph/ui/README.md)                                           | Styled components over `graph-react` and an SVG sequence diagram, in Vanilla Extract with a typed theme contract and light and dark themes, shipped as compiled CSS.                                                                              |
 | [`graph-react-flow`](packages/ui/graph/react-flow/README.md)                           | React Flow views of the model: flowchart, swimlane with lanes as group nodes, and state machine, laid out by `graph-layout`, showing each status and the critical path; sequence projections drawn by `graph-ui`.                                 |
+| [`graph-cli`](packages/targets/graph-cli/README.md)                                    | The command line and its library entry: sync GitHub issues into the SQLite store, ready, blocked, impact, critical path, cycles, hand-offs and status explanations, and every view drawn in Mermaid or Graphviz DOT.                              |
 | [`process-graph`](packages/targets/process-graph/README.md)                            | The primary entry point: re-exports the schema, projection and domain APIs flat and the DAG API as the `dag` namespace.                                                                                                                           |
 | [`graph-web`](packages/targets/graph-web/README.md)                                    | The web app: an installable, offline-first PWA that syncs GitHub issues into SQLite on the device and shows the work in every view, with what is ready, what is blocked and why, linkable by address.                                             |
 
diff --git a/knip.config.ts b/knip.config.ts
index ae5b090..1224d3a 100644
--- a/knip.config.ts
+++ b/knip.config.ts
@@ -29,7 +29,8 @@ const config: KnipConfig = {
       project: ["src/**/*.{ts,tsx}!"],
     },
     "packages/targets/*": {
-      entry: ["src/index.{ts,tsx}"],
+      // A target's bin is an entry point of its own, run as a process rather than imported.
+      entry: ["src/index.{ts,tsx}", "src/bin.ts"],
       project: ["src/**/*.{ts,tsx}!"],
     },
     // An app rather than a library: knip's Vite plugin finds the page's module from index.html; the store's worker, which main.tsx starts by URL, the build script and the Playwright suite are entries of their own.
diff --git a/packages/targets/graph-cli/AGENTS.md b/packages/targets/graph-cli/AGENTS.md
new file mode 120000
index 0000000..42061c0
--- /dev/null
+++ b/packages/targets/graph-cli/AGENTS.md
@@ -0,0 +1 @@
+README.md
\ No newline at end of file
diff --git a/packages/targets/graph-cli/CLAUDE.md b/packages/targets/graph-cli/CLAUDE.md
new file mode 120000
index 0000000..42061c0
--- /dev/null
+++ b/packages/targets/graph-cli/CLAUDE.md
@@ -0,0 +1 @@
+README.md
\ No newline at end of file
diff --git a/packages/targets/graph-cli/README.md b/packages/targets/graph-cli/README.md
new file mode 100644
index 0000000..a1fcdbf
--- /dev/null
+++ b/packages/targets/graph-cli/README.md
@@ -0,0 +1,101 @@
+# @exadev/process-graph-cli
+
+[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![npm](https://img.shields.io/badge/npm-CB3837?logo=npm&logoColor=white)](https://www.npmjs.com/package/@exadev/process-graph-cli) [![Release](https://img.shields.io/github/v/release/ExaDev/process-graph)](https://github.com/ExaDev/process-graph/releases/latest) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+
+The process-graph command line, and the same commands as a library. It syncs work from GitHub issues into a SQLite store, answers what is ready, blocked, affected, on the critical path or handed off between owners, explains why an element has its status, builds and edits a model by hand, and draws the model as a flowchart, swimlane, state machine or sequence diagram in Mermaid or Graphviz DOT.
+
+It is a composition root and nothing else: the model, reasoning, projections, sources and store are the other packages of this repository, and this package wires them to a command line through injected ports. The unscoped [`process-graph`](../process-graph/README.md) package carries the same command line as its `process-graph` bin; this package's own bin is `process-graph-cli`.
+
+```sh
+process-graph sync github:ExaDev github:Mearman/agent-permissions
+process-graph ready
+process-graph why github:ExaDev/process-graph#12
+process-graph show --view swimlane --format mermaid
+```
+
+## Commands
+
+| Command                                                                              | What it does                                                                                                                                         |
+| ------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `sync <scope...> [--after <cursor>]`                                                 | Reads the scopes from their sources and merges them into the model in one write; prints what it wrote and any gaps.                                  |
+| `ready`                                                                              | The work that can start now.                                                                                                                         |
+| `blocked <id>`                                                                       | The open work an element is waiting on: the ends of its blocked-by chain.                                                                            |
+| `impact <id>`                                                                        | The live work that depends on an element.                                                                                                            |
+| `path`                                                                               | The critical path: the longest chain of work still ahead, each element counting one step.                                                            |
+| `cycles`                                                                             | The cycles no decision closes.                                                                                                                       |
+| `handoffs`                                                                           | The transitions from one actor's work to another's, such as a dependency across repositories or organisations.                                       |
+| `why <id>`                                                                           | The rule that decided an element's status, its needs and artefacts, and the blocked-by chain behind it.                                              |
+| `show [--view <view>] [--format <format>]`                                           | Draws the model. Views: `flowchart` (default), `swimlane`, `state`, `sequence`. Formats: `mermaid` (default), `dot`, `json` (the projection itself). |
+| `add participant <id> <label> [--kind <kind>]`                                       | Adds a `role` (default), `system` or `entity`.                                                                                                       |
+| `add activity <id> <label> [--actor <participant>]`                                  | Adds a step of work.                                                                                                                                 |
+| `add decision <id> <label> [--actor <participant>]`                                  | Adds a point where the flow branches.                                                                                                                |
+| `add state <id> <label> [--parent <state>]`                                          | Adds a state an entity rests in.                                                                                                                     |
+| `add event <id> <name>`                                                              | Adds an event that can trigger a transition.                                                                                                         |
+| `add artefact <id> <name> [--deliverable]`                                           | Adds something activities consume or produce.                                                                                                        |
+| `add transition <source> <target> [--id <id>] [--guard <label>] [--trigger <event>]` | Adds a transition; the target waits on the source. Its identifier defaults to `<source>-><target>`, the form sources use.                            |
+| `set <id> <done\|open\|unknown>`                                                     | Sets an element's run state.                                                                                                                         |
+| `validate [file]`                                                                    | Checks the stored model and run state, or a model document as JSON, for structural issues and illegal cycles.                                        |
+
+`show --view state` follows an entity given with `--subject`, and `show --view sequence` follows the transitions given with `--scenario`; each defaults to the matching projection the model declares.
+
+Every command takes the global options:
+
+| Option          | Default                                            | Meaning                                                     |
+| --------------- | -------------------------------------------------- | ----------------------------------------------------------- |
+| `--data <path>` | `PROCESS_GRAPH_DATA`, else the XDG data file below | The SQLite file the store keeps. It is created when absent. |
+| `--model <id>`  | `default`                                          | The model in the store; one file holds many.                |
+| `--json`        | off                                                | Writes the result as JSON.                                  |
+
+Without `--data` or `PROCESS_GRAPH_DATA`, the store is `process-graph/graph.sqlite3` under `XDG_DATA_HOME`, or under `~/.local/share` when that is not set.
+
+## Output
+
+Text output is stable and made for scripts: a list is one item per line with tab-separated fields (an element is its identifier and label), and an empty list prints nothing. `--json` writes the same result as one JSON document; for `show` it is the projection when the format is `json`, and otherwise the view, the format and the diagram text. Errors go to standard error as one message, with no stack trace.
+
+The Mermaid emitters name nodes by their position in the view, since Mermaid does not accept identifiers such as `github:org/repo#12`, and write every character Mermaid reads as syntax in a label as its entity code. The DOT emitters keep the model identifiers as node names. Hand-offs are drawn as thick (Mermaid) or bold (DOT) edges, and an empty swimlane lane is still drawn. DOT has no sequence notation, so a sequence diagram in DOT is a grid of lifelines with one row per message, each message numbered and prefixed with the fragments around it.
+
+## Exit status
+
+| Status | Meaning                                                                                                                                        |
+| ------ | ---------------------------------------------------------------------------------------------------------------------------------------------- |
+| 0      | Success; for `validate` and `cycles`, nothing wrong was found.                                                                                 |
+| 1      | A failure not listed below, such as a store that cannot be opened.                                                                             |
+| 2      | A usage error: an unknown command or option, a missing argument, a value outside its choices, or a view with nothing to follow.                |
+| 3      | The model, an element or another identifier named on the command line does not exist.                                                          |
+| 4      | The model has problems: `validate` found issues, `cycles` found one, a reasoning command met an illegal cycle, or the store rejected a change. |
+| 5      | A source refused the sync: credentials, a rate limit or a scope it does not accept.                                                            |
+
+## Sources and tokens
+
+Scopes are source-qualified: `github:owner` reads every repository an account owns and `github:owner/repo` one repository. The GitHub token comes from `GITHUB_TOKEN`, or from the GitHub CLI (`gh auth token`) when that is not set; it is sent only to GitHub and never printed.
+
+A sync merges everything it reads into the model in one write, so a record synced again is replaced by identifier and the rest of the model is kept. When a source fails part way, as on a rate limit, the pages read before the failure are still written and the error prints the command that resumes the sync with `--after`. Relations a source reports (sub-issues, assignees, repository membership) have no place in the store and are not kept.
+
+## Library
+
+`runCli(args, ports, identity)` runs the whole command surface as a function and resolves with the exit status; it never reads `process.argv`, writes to the process's streams or exits. `CliPorts` is everything it touches: `stdout` and `stderr`, `openStore(path)` (any `GraphStoreClient`, over any transport), `defaultDataPath`, `source(prefix)` (any `GraphSourceClient`), `readFile`, the `facts` decision conditions read, and the abort `signal`. `nodePorts(options)` builds them for a Node process, with the environment, home directory, GitHub token port, `fetch`, clock, facts, signal and streams each replaceable; `runProcess(identity)` is what the bins run.
+
+A host program mounts the command line as a subcommand by forwarding its arguments:
+
+```ts
+import { nodePorts, packageVersion, runCli } from "@exadev/process-graph-cli";
+
+// sb graph <args...>
+process.exitCode = await runCli(args, nodePorts(), {
+  name: "sb graph",
+  version: packageVersion(new URL("../package.json", import.meta.url)),
+});
+```
+
+The operation behind each command is exported on its own and returns plain data rather than text, for hosts that want results, such as tools served over MCP: `sync`, `ready`, `blocked`, `impactOf`, `path`, `cycles`, `handoffsOf`, `why`, `show`, `add`, `setState`, `validateStored` and `validateDocument`, each taking a `GraphSession` (a store client, a model id, facts and a signal). The emitters `flowchartToMermaid`, `swimlaneToMermaid`, `stateMachineToMermaid`, `sequenceToMermaid` and their `...ToDot` counterparts are pure functions of a projection.
+
+`add` reads the model and saves it whole, so a write another process makes between the two is overwritten; the store checks every save, so a duplicate identifier or a dangling reference is rejected and nothing changes.
+
+## Commands
+
+```sh
+pnpm build          # tsc -b -> dist/ (ESM + .d.ts), including the bin
+pnpm test           # unit tests, end to end against an in-memory source and a SQLite file
+pnpm test:smoke     # the built dist/ as a library and the built bin as a process
+pnpm test:mutation  # Stryker
+```
diff --git a/packages/targets/graph-cli/eslint.config.ts b/packages/targets/graph-cli/eslint.config.ts
new file mode 100644
index 0000000..c431768
--- /dev/null
+++ b/packages/targets/graph-cli/eslint.config.ts
@@ -0,0 +1,10 @@
+import { defineConfig } from "eslint/config";
+import { packageLintConfig } from "../../../eslint.shared.ts";
+
+export default defineConfig(
+  packageLintConfig({
+    tsconfigRootDir: import.meta.dirname,
+    // Node-only by design: it is the command line, opening the store with node:sqlite and writing to the process's streams.
+    projects: ["./tsconfig.json"],
+  }),
+);
diff --git a/packages/targets/graph-cli/package.json b/packages/targets/graph-cli/package.json
new file mode 100644
index 0000000..695e9e8
--- /dev/null
+++ b/packages/targets/graph-cli/package.json
@@ -0,0 +1,86 @@
+{
+  "name": "@exadev/process-graph-cli",
+  "version": "0.0.0",
+  "description": "The process-graph command line: sync work from GitHub issues into a SQLite store, ask what is ready, blocked or on the critical path, explain a status, and show the model as a flowchart, swimlane, state machine or sequence diagram in Mermaid or Graphviz DOT.",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ExaDev/process-graph.git",
+    "directory": "packages/targets/graph-cli"
+  },
+  "homepage": "https://github.com/ExaDev/process-graph/tree/main/packages/targets/graph-cli#readme",
+  "bugs": {
+    "url": "https://github.com/ExaDev/process-graph/issues"
+  },
+  "bin": {
+    "process-graph-cli": "./dist/bin.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true,
+    "registry": "https://registry.npmjs.org/"
+  },
+  "sideEffects": false,
+  "license": "MIT",
+  "scripts": {
+    "build": "turbo run _build",
+    "_build": "tsc -b tsconfig.build.json",
+    "lint": "turbo run _lint",
+    "_lint": "eslint . --cache --max-warnings 0",
+    "_lint:fix": "eslint . --fix --cache --max-warnings 0",
+    "typecheck": "turbo run _typecheck _typecheck:attw",
+    "_typecheck": "tsc -p tsconfig.json --noEmit",
+    "_typecheck:attw": "attw --pack --profile esm-only",
+    "test": "turbo run _test",
+    "_test": "vitest run --project unit",
+    "test:coverage": "turbo run _test:coverage",
+    "_test:coverage": "vitest run --project unit --coverage",
+    "test:smoke": "turbo run _test:smoke",
+    "_test:smoke": "vitest run --project smoke",
+    "test:mutation": "turbo run _test:mutation",
+    "_test:mutation": "stryker run stryker.config.ts",
+    "prepublishOnly": "pnpm run lint && pnpm run typecheck && pnpm run test && pnpm run build && publint && attw --pack --profile esm-only"
+  },
+  "keywords": [
+    "process-model",
+    "dependency-graph",
+    "cli",
+    "github-issues",
+    "mermaid",
+    "graphviz"
+  ],
+  "dependencies": {
+    "@exadev/process-graph-dag": "1.0.2",
+    "@exadev/process-graph-domain": "1.0.3",
+    "@exadev/process-graph-projection": "1.0.3",
+    "@exadev/process-graph-schema": "1.1.0",
+    "@exadev/process-graph-source-contract": "1.0.1",
+    "@exadev/process-graph-source-github-issues": "1.0.1",
+    "@exadev/process-graph-sqlite-node": "1.0.0",
+    "@exadev/process-graph-store-contract": "1.0.1",
+    "@orpc/server": "2.0.0-beta.41",
+    "commander": "15.0.0"
+  },
+  "devDependencies": {
+    "@arethetypeswrong/cli": "0.18.5",
+    "@stryker-mutator/core": "10.0.0",
+    "@stryker-mutator/typescript-checker": "10.0.0",
+    "@stryker-mutator/vitest-runner": "10.0.0",
+    "@types/node": "26.6.4",
+    "@vitest/coverage-v8": "5.0.3",
+    "eslint": "10.12.0",
+    "publint": "0.3.25",
+    "typescript": "6.0.3",
+    "vitest": "5.0.3"
+  }
+}
diff --git a/packages/targets/graph-cli/src/bin.ts b/packages/targets/graph-cli/src/bin.ts
new file mode 100644
index 0000000..5feeddf
--- /dev/null
+++ b/packages/targets/graph-cli/src/bin.ts
@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { packageVersion, runProcess } from "./node.ts";
+
+process.exitCode = await runProcess({
+  name: "process-graph-cli",
+  version: packageVersion(new URL("../package.json", import.meta.url)),
+});
diff --git a/packages/targets/graph-cli/src/cli-authoring.unit.test.ts b/packages/targets/graph-cli/src/cli-authoring.unit.test.ts
new file mode 100644
index 0000000..29b92d6
--- /dev/null
+++ b/packages/targets/graph-cli/src/cli-authoring.unit.test.ts
@@ -0,0 +1,552 @@
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, test } from "vitest";
+import { exitCodes } from "./exit-codes.ts";
+import {
+  createHarness,
+  runInOrder,
+  type Harness,
+} from "./test-support/harness.ts";
+
+let harness: Harness;
+
+beforeEach(() => {
+  harness = createHarness();
+});
+
+afterEach(() => {
+  harness.remove();
+});
+
+/** An order process built through `add`: a customer submits, the shop decides whether the order is in stock, then packs it or the customer is refunded. */
+const orderSteps: readonly (readonly string[])[] = [
+  ["add", "participant", "customer", "Customer"],
+  ["add", "participant", "shop", "Shop", "--kind", "system"],
+  ["add", "participant", "order", "Order", "--kind", "entity"],
+  ["add", "participant", "courier", "Courier", "--kind", "system"],
+  ["add", "activity", "submit", "Submit order", "--actor", "customer"],
+  ["add", "decision", "stock", "In stock?", "--actor", "shop"],
+  ["add", "activity", "pack", "Pack", "--actor", "shop"],
+  ["add", "activity", "refund", "Refund", "--actor", "customer"],
+  ["add", "transition", "submit", "stock", "--id", "t1"],
+  ["add", "transition", "stock", "pack", "--id", "t2", "--guard", "yes"],
+  ["add", "transition", "stock", "refund", "--id", "t3", "--guard", "no"],
+];
+
+describe("add", () => {
+  test("creates the model and reports each record with the revision it took", async () => {
+    const results = await runInOrder(harness, orderSteps.slice(0, 2));
+
+    expect(results).toEqual([
+      {
+        code: exitCodes.success,
+        stdout: "added participant customer at revision 1\n",
+        stderr: "",
+      },
+      {
+        code: exitCodes.success,
+        stdout: "added participant shop at revision 2\n",
+        stderr: "",
+      },
+    ]);
+  });
+
+  test("names a transition after its ends when no identifier is given", async () => {
+    await runInOrder(
+      harness,
+      orderSteps.filter(([, kind]) => kind !== "transition"),
+    );
+
+    expect(
+      JSON.parse(
+        (await harness.run("add", "transition", "submit", "stock", "--json"))
+          .stdout,
+      ),
+    ).toEqual({ added: "transition", id: "submit->stock", revision: 9 });
+  });
+
+  test("adds events, states and deliverable artefacts", async () => {
+    const results = await runInOrder(harness, [
+      ["add", "event", "paid", "Payment received"],
+      ["add", "state", "waiting", "Waiting"],
+      ["add", "artefact", "invoice", "Invoice", "--deliverable"],
+      ["validate", "--json"],
+    ]);
+
+    expect(results.map((result) => result.code)).toEqual([
+      exitCodes.success,
+      exitCodes.success,
+      exitCodes.success,
+      exitCodes.success,
+    ]);
+    expect(results.at(-1)?.stdout).toBe(
+      '{\n  "valid": true,\n  "issues": []\n}\n',
+    );
+  });
+
+  test("rejects a record that would leave the model invalid, and changes nothing", async () => {
+    await runInOrder(harness, orderSteps.slice(0, 1));
+    const duplicate = await harness.run(
+      "add",
+      "participant",
+      "customer",
+      "Again",
+    );
+    const dangling = await harness.run(
+      "add",
+      "transition",
+      "submit",
+      "nowhere",
+    );
+
+    expect(duplicate.code).toBe(exitCodes.invalidModel);
+    expect(duplicate.stderr).toContain("duplicate-id");
+    expect(dangling.code).toBe(exitCodes.invalidModel);
+    expect(dangling.stderr).toContain("unknown-reference");
+    expect(
+      JSON.parse((await harness.run("validate", "--json")).stdout),
+    ).toEqual({
+      valid: true,
+      issues: [],
+    });
+  });
+
+  test("rejects a participant kind outside its choices as a usage error", async () => {
+    const result = await harness.run(
+      "add",
+      "participant",
+      "x",
+      "X",
+      "--kind",
+      "robot",
+    );
+
+    expect(result.code).toBe(exitCodes.usage);
+    expect(result.stderr).toContain(
+      "error: option '--kind <kind>' argument 'robot' is invalid. Allowed choices are role, system, entity.",
+    );
+  });
+});
+
+describe("show", () => {
+  beforeEach(async () => {
+    const results = await runInOrder(harness, orderSteps);
+    expect(results.every((result) => result.code === exitCodes.success)).toBe(
+      true,
+    );
+  });
+
+  test("draws the flowchart in Mermaid by default", async () => {
+    expect(await harness.run("show")).toEqual({
+      code: exitCodes.success,
+      stdout: [
+        "flowchart TD",
+        '  n0["Submit order"]',
+        '  n1{"In stock?"}',
+        '  n2["Pack"]',
+        '  n3["Refund"]',
+        "  n0 --> n1",
+        '  n1 -->|"yes"| n2',
+        '  n1 -->|"no"| n3',
+        "",
+      ].join("\n"),
+      stderr: "",
+    });
+  });
+
+  test("draws the flowchart in DOT", async () => {
+    expect(
+      (await harness.run("show", "--view", "flowchart", "--format", "dot"))
+        .stdout,
+    ).toBe(
+      [
+        'digraph "flowchart" {',
+        '  rankdir="TB";',
+        '  "submit" [label="Submit order", shape="box"];',
+        '  "stock" [label="In stock?", shape="diamond"];',
+        '  "pack" [label="Pack", shape="box"];',
+        '  "refund" [label="Refund", shape="box"];',
+        '  "submit" -> "stock";',
+        '  "stock" -> "pack" [label="yes"];',
+        '  "stock" -> "refund" [label="no"];',
+        "}",
+        "",
+      ].join("\n"),
+    );
+  });
+
+  test("draws the swimlane with a lane per actor, an empty lane kept and hand-offs thick", async () => {
+    expect((await harness.run("show", "--view", "swimlane")).stdout).toBe(
+      [
+        "flowchart LR",
+        '  subgraph lane0["Customer"]',
+        '    n0["Submit order"]',
+        '    n3["Refund"]',
+        "  end",
+        '  subgraph lane1["Shop"]',
+        '    n1{"In stock?"}',
+        '    n2["Pack"]',
+        "  end",
+        '  subgraph lane2["Courier"]',
+        "  end",
+        "  n0 ==> n1",
+        '  n1 -->|"yes"| n2',
+        '  n1 ==>|"no"| n3',
+        "",
+      ].join("\n"),
+    );
+    expect(
+      (await harness.run("show", "--view", "swimlane", "--format", "dot"))
+        .stdout,
+    ).toBe(
+      [
+        'digraph "swimlane" {',
+        '  rankdir="LR";',
+        '  subgraph "cluster_lane0" {',
+        '    label="Customer";',
+        '    "submit" [label="Submit order", shape="box"];',
+        '    "refund" [label="Refund", shape="box"];',
+        "  }",
+        '  subgraph "cluster_lane1" {',
+        '    label="Shop";',
+        '    "stock" [label="In stock?", shape="diamond"];',
+        '    "pack" [label="Pack", shape="box"];',
+        "  }",
+        '  subgraph "cluster_lane2" {',
+        '    label="Courier";',
+        '    "cluster_lane2:empty" [shape="point", style="invis"];',
+        "  }",
+        '  "submit" -> "stock" [style="bold"];',
+        '  "stock" -> "pack" [label="yes"];',
+        '  "stock" -> "refund" [label="no", style="bold"];',
+        "}",
+        "",
+      ].join("\n"),
+    );
+  });
+
+  test("draws the state machine of a subject, with decisions folded into guards", async () => {
+    expect(
+      (await harness.run("show", "--view", "state", "--subject", "order"))
+        .stdout,
+    ).toBe(
+      [
+        "stateDiagram-v2",
+        '  state "Submit order" as s0',
+        '  state "Pack" as s1',
+        '  state "Refund" as s2',
+        "  s0 --> s1 : [yes]",
+        "  s0 --> s2 : [no]",
+        "",
+      ].join("\n"),
+    );
+    expect(
+      (
+        await harness.run(
+          "show",
+          "--view",
+          "state",
+          "--subject",
+          "order",
+          "--format",
+          "dot",
+        )
+      ).stdout,
+    ).toBe(
+      [
+        'digraph "state machine" {',
+        '  rankdir="LR";',
+        '  "submit" [label="Submit order", shape="box", style="rounded"];',
+        '  "pack" [label="Pack", shape="box", style="rounded"];',
+        '  "refund" [label="Refund", shape="box", style="rounded"];',
+        '  "submit" -> "pack" [label="[yes]"];',
+        '  "submit" -> "refund" [label="[no]"];',
+        "}",
+        "",
+      ].join("\n"),
+    );
+  });
+
+  test("draws a sequence diagram along a scenario", async () => {
+    expect(
+      (
+        await harness.run(
+          "show",
+          "--view",
+          "sequence",
+          "--scenario",
+          "t1",
+          "t3",
+        )
+      ).stdout,
+    ).toBe(
+      [
+        "sequenceDiagram",
+        "  participant p0 as Customer",
+        "  participant p1 as Shop",
+        "  p0->>p1: In stock?",
+        "  p1->>p0: Refund",
+        "",
+      ].join("\n"),
+    );
+    expect(
+      (
+        await harness.run(
+          "show",
+          "--view",
+          "sequence",
+          "--scenario",
+          "t1",
+          "t3",
+          "--format",
+          "dot",
+        )
+      ).stdout,
+    ).toBe(
+      [
+        'digraph "sequence" {',
+        '  rankdir="TB";',
+        '  "p0" [label="Customer", shape="box"];',
+        '  "p1" [label="Shop", shape="box"];',
+        '  { rank="same"; "p0"; "p1"; }',
+        '  "p0" -> "p1" [style="invis"];',
+        '  "p0.1" [shape="point", width="0"];',
+        '  "p1.1" [shape="point", width="0"];',
+        '  { rank="same"; "p0.1"; "p1.1"; }',
+        '  "p0.2" [shape="point", width="0"];',
+        '  "p1.2" [shape="point", width="0"];',
+        '  { rank="same"; "p0.2"; "p1.2"; }',
+        '  "p0" -> "p0.1" -> "p0.2" [style="dashed", arrowhead="none"];',
+        '  "p1" -> "p1.1" -> "p1.2" [style="dashed", arrowhead="none"];',
+        '  "p0.1" -> "p1.1" [label="1. In stock?", constraint="false"];',
+        '  "p1.2" -> "p0.2" [label="2. Refund", constraint="false"];',
+        "}",
+        "",
+      ].join("\n"),
+    );
+  });
+
+  test("writes the projection itself as JSON", async () => {
+    const flowchart: unknown = JSON.parse(
+      (await harness.run("show", "--format", "json")).stdout,
+    );
+
+    expect(flowchart).toMatchObject({
+      nodes: [
+        { id: "submit", label: "Submit order", shape: "process" },
+        { id: "stock", label: "In stock?", shape: "decision" },
+        { id: "pack", label: "Pack", shape: "process" },
+        { id: "refund", label: "Refund", shape: "process" },
+      ],
+      edges: [
+        { from: "submit", to: "stock" },
+        { from: "stock", to: "pack", label: "yes" },
+        { from: "stock", to: "refund", label: "no" },
+      ],
+    });
+    expect(JSON.parse((await harness.run("show", "--json")).stdout)).toEqual({
+      view: "flowchart",
+      format: "mermaid",
+      text: (await harness.run("show")).stdout,
+    });
+  });
+
+  test("needs a subject for the state view and a scenario for the sequence view", async () => {
+    expect(await harness.run("show", "--view", "state")).toEqual({
+      code: exitCodes.usage,
+      stdout: "",
+      stderr:
+        "the state view needs --subject <entity>: the model declares no state machine projection\n",
+    });
+    expect(
+      await harness.run("show", "--view", "state", "--subject", "shop"),
+    ).toEqual({
+      code: exitCodes.usage,
+      stdout: "",
+      stderr: '"shop" is a system; a state machine follows an entity\n',
+    });
+    expect(
+      (await harness.run("show", "--view", "state", "--subject", "nobody"))
+        .code,
+    ).toBe(exitCodes.notFound);
+    expect((await harness.run("show", "--view", "sequence")).code).toBe(
+      exitCodes.usage,
+    );
+    expect(
+      await harness.run("show", "--view", "sequence", "--scenario", "t1", "t9"),
+    ).toEqual({
+      code: exitCodes.notFound,
+      stdout: "",
+      stderr: 'no transition "t9" in the model\n',
+    });
+  });
+
+  test("rejects a view outside its choices as a usage error", async () => {
+    expect((await harness.run("show", "--view", "gantt")).code).toBe(
+      exitCodes.usage,
+    );
+  });
+});
+
+describe("cycles and validate", () => {
+  beforeEach(async () => {
+    await runInOrder(harness, [
+      ["add", "activity", "a", "A"],
+      ["add", "activity", "b", "B"],
+      ["add", "transition", "a", "b"],
+      ["add", "transition", "b", "a"],
+    ]);
+  });
+
+  test("cycles lists a cycle no decision closes and exits with the invalid model status", async () => {
+    expect(await harness.run("cycles")).toEqual({
+      code: exitCodes.invalidModel,
+      stdout: "a -> b -> a\n",
+      stderr: "",
+    });
+  });
+
+  test("validate reports the cycle as an issue", async () => {
+    expect(await harness.run("validate")).toEqual({
+      code: exitCodes.invalidModel,
+      stdout: "illegal-cycle\tcycle with no decision in it: a -> b -> a\n",
+      stderr: "",
+    });
+  });
+
+  test("a reasoning command refuses a model with an illegal cycle", async () => {
+    const result = await harness.run("ready");
+
+    expect(result.code).toBe(exitCodes.invalidModel);
+    expect(result.stderr).toBe(
+      "The graph contains a cycle: a -> b -> a; run cycles to list them\n",
+    );
+  });
+});
+
+describe("validate <file>", () => {
+  const write = (name: string, content: string): string => {
+    const path = join(harness.directory, name);
+    writeFileSync(path, content);
+
+    return path;
+  };
+
+  test("finds nothing wrong with a valid model document", async () => {
+    const path = write(
+      "model.json",
+      JSON.stringify({
+        participants: [{ id: "team", label: "Team", kind: "role" }],
+        events: [],
+        actions: [],
+        artefacts: [],
+        elements: [{ kind: "activity", id: "a", label: "A", actor: "team" }],
+        transitions: [],
+        fragments: [],
+        projections: [],
+      }),
+    );
+
+    expect(await harness.run("validate", path)).toEqual({
+      code: exitCodes.success,
+      stdout: "valid\n",
+      stderr: "",
+    });
+  });
+
+  test("locates each shape problem by JSON pointer", async () => {
+    const path = write(
+      "broken.json",
+      JSON.stringify({
+        participants: [{ id: "team", label: "Team", kind: "robot" }],
+        events: [],
+        actions: [],
+        artefacts: [],
+        elements: [],
+        transitions: [],
+        fragments: [],
+        projections: [],
+      }),
+    );
+    const result = await harness.run("validate", path, "--json");
+
+    expect(result.code).toBe(exitCodes.invalidModel);
+    expect(JSON.parse(result.stdout)).toMatchObject({
+      valid: false,
+      issues: [{ code: "schema", pointer: "/participants/0/kind" }],
+    });
+  });
+
+  test("reports a reference to an undeclared element", async () => {
+    const path = write(
+      "dangling.json",
+      JSON.stringify({
+        participants: [],
+        events: [],
+        actions: [],
+        artefacts: [],
+        elements: [{ kind: "activity", id: "a", label: "A" }],
+        transitions: [{ id: "t", source: "a", target: "z" }],
+        fragments: [],
+        projections: [],
+      }),
+    );
+
+    expect(await harness.run("validate", path)).toEqual({
+      code: exitCodes.invalidModel,
+      stdout:
+        'unknown-reference\ttransition "t" target refers to unknown id "z"\n',
+      stderr: "",
+    });
+  });
+
+  test("reports text that is not JSON at the document itself", async () => {
+    const result = await harness.run(
+      "validate",
+      write("text.json", "not json"),
+    );
+
+    expect(result.code).toBe(exitCodes.invalidModel);
+    expect(result.stdout).toMatch(/^schema\t\/\tnot JSON: /u);
+  });
+});
+
+describe("the program", () => {
+  test("prints help with the exit statuses, and exits successfully", async () => {
+    const result = await harness.run("--help");
+
+    expect(result.code).toBe(exitCodes.success);
+    expect(result.stdout).toContain("Usage: process-graph [options] [command]");
+    expect(result.stdout).toContain(
+      "  4  the model has problems: validation issues, an illegal cycle, or a change the store rejected",
+    );
+    expect(result.stdout).not.toMatch(/ -- |—/u);
+  });
+
+  test("prints its version", async () => {
+    expect(await harness.run("--version")).toEqual({
+      code: exitCodes.success,
+      stdout: "0.0.0-test\n",
+      stderr: "",
+    });
+  });
+
+  test("rejects an unknown command as a usage error", async () => {
+    const result = await harness.run("frobnicate");
+
+    expect(result.code).toBe(exitCodes.usage);
+    expect(result.stderr).toContain("error: unknown command 'frobnicate'");
+  });
+
+  test("keeps models apart by --model and files apart by --data", async () => {
+    await harness.run("add", "activity", "a", "A", "--model", "one");
+    const other = join(harness.directory, "other.sqlite3");
+    await harness.run("add", "activity", "b", "B", "--data", other);
+
+    expect((await harness.run("ready", "--model", "one")).stdout).toBe(
+      "a\tA\n",
+    );
+    expect((await harness.run("ready", "--data", other)).stdout).toBe("b\tB\n");
+    expect((await harness.run("ready")).code).toBe(exitCodes.notFound);
+  });
+});
diff --git a/packages/targets/graph-cli/src/cli.unit.test.ts b/packages/targets/graph-cli/src/cli.unit.test.ts
new file mode 100644
index 0000000..4ea74cf
--- /dev/null
+++ b/packages/targets/graph-cli/src/cli.unit.test.ts
@@ -0,0 +1,296 @@
+import {
+  createFakeGraphSource,
+  GraphSourceError,
+  type GraphSourcePager,
+} from "@exadev/process-graph-source-contract";
+import { afterEach, beforeEach, describe, expect, test } from "vitest";
+import { exitCodes } from "./exit-codes.ts";
+import { githubLikeSource, issues } from "./test-support/fixtures.ts";
+import { createHarness, type Harness } from "./test-support/harness.ts";
+
+const { design, api, ship, ui } = issues;
+
+let harness: Harness;
+
+beforeEach(() => {
+  harness = createHarness();
+});
+
+afterEach(() => {
+  harness.remove();
+});
+
+const syncFixture = async () =>
+  harness.run("sync", "github:acme/app", "github:acme/web");
+
+describe("sync", () => {
+  test("merges every page of every scope into the model and reports what it wrote", async () => {
+    const result = await harness.run(
+      "sync",
+      "github:acme/app",
+      "github:acme/web",
+      "github:acme/missing",
+    );
+
+    expect(result).toEqual({
+      code: exitCodes.success,
+      stdout:
+        'synced 4 activities, 4 transitions and 4 participants into "default" at revision 1\n' +
+        "gap\tnot-found\tgithub:acme/missing\tgithub:acme/missing does not exist\n",
+      stderr: "",
+    });
+  });
+
+  test("writes JSON with --json", async () => {
+    const result = await harness.run("sync", "github:acme/app", "--json");
+
+    expect(JSON.parse(result.stdout)).toEqual({
+      modelId: "default",
+      revision: 1,
+      participants: 4,
+      activities: 4,
+      transitions: 4,
+      gaps: [],
+    });
+  });
+
+  test("refreshes the model by identifier when synced again", async () => {
+    await syncFixture();
+    const again = await harness.run("sync", "github:acme/web");
+
+    expect(again.stdout).toBe(
+      'synced 1 activities, 0 transitions and 2 participants into "default" at revision 2\n',
+    );
+    expect((await harness.run("ready")).stdout).toBe(`${api}\tBuild the API\n`);
+  });
+
+  test("refuses --after with the scopes of more than one source", async () => {
+    harness.remove();
+    harness = createHarness(
+      createFakeGraphSource(githubLikeSource),
+      createFakeGraphSource({ source: "jira", scopes: { "jira:ACME": [] } }),
+    );
+
+    expect(
+      await harness.run("sync", "github:acme/app", "jira:ACME", "--after", "x"),
+    ).toEqual({
+      code: exitCodes.usage,
+      stdout: "",
+      stderr:
+        "--after resumes one source's sync: give only that source's scopes\n",
+    });
+  });
+
+  test("rejects a scope with no source prefix, and a prefix no source reads, as usage errors", async () => {
+    const bare = await harness.run("sync", "acme/app");
+    const jira = await harness.run("sync", "jira:ACME");
+
+    expect(bare.code).toBe(exitCodes.usage);
+    expect(bare.stderr).toBe(
+      '"acme/app" is not a scope: write <source>:<scope>, such as github:owner/repo\n',
+    );
+    expect(jira.code).toBe(exitCodes.usage);
+    expect(jira.stderr).toBe('no source reads "jira" scopes\n');
+  });
+
+  test("reports a cursor the source did not issue as a source failure", async () => {
+    const result = await harness.run(
+      "sync",
+      "github:acme/app",
+      "--after",
+      "bogus",
+    );
+
+    expect(result.code).toBe(exitCodes.sourceFailure);
+    expect(result.stderr).toBe(
+      '"bogus" is not a cursor for this scope\n' +
+        "resume with: sync github:acme/app --after bogus\n",
+    );
+  });
+
+  test("saves the pages read before a source fails and says how to resume", async () => {
+    const fake = createFakeGraphSource(githubLikeSource);
+    let reads = 0;
+    const failing: GraphSourcePager = {
+      source: fake.source,
+      page: async (request) => {
+        reads += 1;
+        if (reads > 1) {
+          throw new GraphSourceError({
+            kind: "rate-limited",
+            message: "rate limited",
+            resetAt: undefined,
+          });
+        }
+
+        return fake.page(request);
+      },
+    };
+    harness.remove();
+    harness = createHarness(
+      failing,
+      createFakeGraphSource({ source: "jira", scopes: { "jira:ACME": [] } }),
+    );
+
+    const result = await harness.run(
+      "sync",
+      "github:acme/app",
+      "jira:ACME",
+      "github:acme/web",
+    );
+
+    expect(result.code).toBe(exitCodes.sourceFailure);
+    expect(result.stderr).toBe(
+      "rate limited\n" +
+        "the pages read before the failure are saved\n" +
+        "resume with: sync github:acme/app github:acme/web --after github%3Aacme%2Fapp@0\n" +
+        "then: sync jira:ACME\n",
+    );
+    expect((await harness.run("ready")).stdout).toBe(`${api}\tBuild the API\n`);
+  });
+});
+
+describe("reasoning over a synced model", () => {
+  beforeEach(async () => {
+    await syncFixture();
+  });
+
+  test("ready lists the work that can start now", async () => {
+    expect(await harness.run("ready")).toEqual({
+      code: exitCodes.success,
+      stdout: `${api}\tBuild the API\n`,
+      stderr: "",
+    });
+    expect(JSON.parse((await harness.run("ready", "--json")).stdout)).toEqual({
+      elements: [{ id: api, label: "Build the API" }],
+    });
+  });
+
+  test("blocked lists the open work at the end of the blocked-by chain", async () => {
+    expect((await harness.run("blocked", ship)).stdout).toBe(
+      `${api}\tBuild the API\n`,
+    );
+    expect(
+      JSON.parse((await harness.run("blocked", ship, "--json")).stdout),
+    ).toEqual({
+      element: { id: ship, label: "Ship it", status: "blocked" },
+      blockedBy: [{ id: api, label: "Build the API" }],
+    });
+    expect((await harness.run("blocked", api)).stdout).toBe("");
+  });
+
+  test("impact lists the live work that depends on an element, in model order", async () => {
+    expect((await harness.run("impact", api)).stdout).toBe(
+      `${ship}\tShip it\n${ui}\tBuild the UI\n`,
+    );
+    expect((await harness.run("impact", ship)).stdout).toBe("");
+  });
+
+  test("handoffs lists the transitions that cross from one repository to another", async () => {
+    expect((await harness.run("handoffs")).stdout).toBe(
+      `${ui}->${ship}\tgithub:acme/web -> github:acme/app\n` +
+        `${api}->${ui}\tgithub:acme/app -> github:acme/web\n`,
+    );
+  });
+
+  test("path lists the longest chain of work still ahead", async () => {
+    expect((await harness.run("path")).stdout).toBe(
+      `${api}\tBuild the API\n${ui}\tBuild the UI\n${ship}\tShip it\n`,
+    );
+    expect(
+      JSON.parse((await harness.run("path", "--json")).stdout),
+    ).toMatchObject({
+      weight: 3,
+    });
+  });
+
+  test("cycles finds none and succeeds", async () => {
+    expect(await harness.run("cycles")).toEqual({
+      code: exitCodes.success,
+      stdout: "",
+      stderr: "",
+    });
+    expect(JSON.parse((await harness.run("cycles", "--json")).stdout)).toEqual({
+      cycles: [],
+    });
+  });
+
+  test("why explains a blocked element with its needs and blocked-by chain", async () => {
+    expect((await harness.run("why", ship)).stdout).toBe(
+      [
+        `${ship} is blocked: it waits on work that is not done`,
+        "needs:",
+        `  ${api} (ready) through ${api}->${ship}`,
+        `  ${ui} (blocked) through ${ui}->${ship}`,
+        "blocked-by chain:",
+        `  ${ship} (blocked) waits on ${api}, ${ui}`,
+        `  ${api} (ready)`,
+        `  ${ui} (blocked) waits on ${api}`,
+        "",
+      ].join("\n"),
+    );
+  });
+
+  test("why explains a ready and a done element by their rule alone", async () => {
+    expect((await harness.run("why", design)).stdout).toBe(
+      `${design} is done: its run state is done\n`,
+    );
+    expect((await harness.run("why", api)).stdout).toBe(
+      [
+        `${api} is ready: everything it needs is done`,
+        "needs:",
+        `  ${design} (done) through ${design}->${api}`,
+        "",
+      ].join("\n"),
+    );
+  });
+
+  test("set changes an element's run state and the reasoning follows it", async () => {
+    expect((await harness.run("set", api, "done")).stdout).toBe(
+      `set ${api} to done at revision 2\n`,
+    );
+    expect((await harness.run("ready")).stdout).toBe(`${ui}\tBuild the UI\n`);
+  });
+
+  test("validate finds nothing wrong with a synced model", async () => {
+    expect(await harness.run("validate")).toEqual({
+      code: exitCodes.success,
+      stdout: "valid\n",
+      stderr: "",
+    });
+  });
+
+  test.each(["blocked", "impact", "why"])(
+    "%s of an element the model lacks is not found",
+    async (command) => {
+      expect(await harness.run(command, "github:acme/app#99")).toEqual({
+        code: exitCodes.notFound,
+        stdout: "",
+        stderr: 'no element "github:acme/app#99" in the model\n',
+      });
+    },
+  );
+
+  test("set of an element the model lacks is not found", async () => {
+    expect((await harness.run("set", "github:acme/app#99", "done")).code).toBe(
+      exitCodes.notFound,
+    );
+  });
+});
+
+describe("a model that does not exist", () => {
+  test.each([
+    ["ready"],
+    ["path"],
+    ["cycles"],
+    ["handoffs"],
+    ["validate"],
+    ["show"],
+  ])("is not found by %s", async (command) => {
+    expect(await harness.run(command, "--model", "absent")).toEqual({
+      code: exitCodes.notFound,
+      stdout: "",
+      stderr: 'no model "absent" in the store; sync or add something first\n',
+    });
+  });
+});
diff --git a/packages/targets/graph-cli/src/edit.ts b/packages/targets/graph-cli/src/edit.ts
new file mode 100644
index 0000000..836cfc5
--- /dev/null
+++ b/packages/targets/graph-cli/src/edit.ts
@@ -0,0 +1,106 @@
+import type {
+  ArtefactDef,
+  Element,
+  EventDef,
+  Model,
+  OpenIds,
+  OverlayStatus,
+  Participant,
+  Transition,
+} from "@exadev/process-graph-schema";
+import { emptyModel } from "@exadev/process-graph-store-contract";
+import {
+  callOptions,
+  findRun,
+  loadRun,
+  requireElement,
+  type GraphSession,
+} from "./session.ts";
+
+/** A record to add to the model, by the part of the model it belongs to. */
+export type Addition =
+  | { readonly kind: "participant"; readonly record: Participant<string> }
+  | { readonly kind: "element"; readonly record: Element<string, OpenIds> }
+  | { readonly kind: "event"; readonly record: EventDef<string> }
+  | { readonly kind: "artefact"; readonly record: ArtefactDef<string> }
+  | {
+      readonly kind: "transition";
+      readonly record: Transition<string, OpenIds>;
+    };
+
+/** A change the store accepted. */
+export interface Written {
+  /** The revision the change took. */
+  readonly revision: number;
+}
+
+/** The model with one record appended to the part it belongs to. */
+const withAddition = (
+  model: Model<OpenIds>,
+  addition: Addition,
+): Model<OpenIds> => {
+  if (addition.kind === "participant") {
+    return { ...model, participants: [...model.participants, addition.record] };
+  }
+  if (addition.kind === "element") {
+    return { ...model, elements: [...model.elements, addition.record] };
+  }
+  if (addition.kind === "event") {
+    return { ...model, events: [...model.events, addition.record] };
+  }
+  if (addition.kind === "artefact") {
+    return { ...model, artefacts: [...model.artefacts, addition.record] };
+  }
+
+  return { ...model, transitions: [...model.transitions, addition.record] };
+};
+
+/**
+ * Adds a record to the session's model, creating the model when the store has none. The store checks the result, so a duplicate identifier or a reference to something undeclared is rejected and nothing changes.
+ *
+ * The model is read and then saved whole, so a write made by another process between the two is overwritten.
+ * @param session - The store and model.
+ * @param addition - The record to add.
+ * @returns The revision the save took.
+ */
+export const add = async (
+  session: GraphSession,
+  addition: Addition,
+): Promise<Written> => {
+  // A store with no such model yet starts it from the empty model, as a sync does.
+  const model = (await findRun(session))?.model ?? emptyModel;
+
+  return session.store.v1.models.save(
+    { modelId: session.modelId, model: withAddition(model, addition) },
+    callOptions(session.signal),
+  );
+};
+
+/** The run state an element was given. */
+export interface SetResult extends Written {
+  readonly element: string;
+  readonly state: OverlayStatus;
+}
+
+/**
+ * Sets an element's run state, leaving every other element's as it is.
+ * @param session - The store and model.
+ * @param id - The element.
+ * @param state - `done`, `open` or `unknown`.
+ * @returns The element, its new state and the revision the change took.
+ * @throws CliError with `notFound` when the model or the element does not exist.
+ */
+export const setState = async (
+  session: GraphSession,
+  id: string,
+  state: OverlayStatus,
+): Promise<SetResult> => {
+  const { model } = await loadRun(session);
+  requireElement(model, id);
+  const { revision } = await session.store.v1.overlay.set(
+    { modelId: session.modelId, overlay: { [id]: state } },
+    callOptions(session.signal),
+  );
+
+  return { element: id, state, revision };
+};
diff --git a/packages/targets/graph-cli/src/emit/dot.ts b/packages/targets/graph-cli/src/emit/dot.ts
new file mode 100644
index 0000000..b143f72
--- /dev/null
+++ b/packages/targets/graph-cli/src/emit/dot.ts
@@ -0,0 +1,275 @@
+import type {
+  Flowchart,
+  FlowNode,
+  SequenceDiagram,
+  SequenceItem,
+  SequenceMessage,
+  StateMachine,
+  StateMachineState,
+  Swimlane,
+} from "@exadev/process-graph-projection";
+import type { IdSpace } from "@exadev/process-graph-schema";
+import { transitionLabel } from "./mermaid.ts";
+import { dotString } from "./text.ts";
+
+const indent = "  ";
+
+/** DOT attributes as name and value pairs, in the order written. */
+type Attributes = readonly (readonly [string, string])[];
+
+/** A DOT attribute list from name and value pairs, each value quoted; empty when there are none. */
+const attributes = (pairs: Attributes): string =>
+  pairs.length === 0
+    ? ""
+    : ` [${pairs.map(([name, value]) => `${name}=${dotString(value)}`).join(", ")}]`;
+
+/** A flowchart node's DOT shape: an oval terminator, a box process, a diamond decision, and a filled bar for a fork or join. */
+const nodeShapes: Readonly<Record<FlowNode<IdSpace>["shape"], Attributes>> = {
+  terminator: [["shape", "oval"]],
+  process: [["shape", "box"]],
+  decision: [["shape", "diamond"]],
+  bar: [
+    ["shape", "box"],
+    ["style", "filled"],
+    ["fillcolor", "black"],
+    ["fontcolor", "white"],
+  ],
+};
+
+const dotNode = <I extends IdSpace>(node: FlowNode<I>, depth: string): string =>
+  `${depth}${dotString(node.id)}${attributes([["label", node.label], ...nodeShapes[node.shape]])};`;
+
+/** The edges of a flowchart, a hand-off (an edge whose ends are in different lanes) drawn bold. */
+const dotEdges = <I extends IdSpace>(
+  view: Flowchart<I>,
+  isHandoff: (from: I["element"], to: I["element"]) => boolean,
+): readonly string[] =>
+  view.edges.map(
+    (edge) =>
+      `${indent}${dotString(edge.from)} -> ${dotString(edge.to)}${attributes([
+        ...(edge.label === undefined ? [] : [["label", edge.label] as const]),
+        ...(isHandoff(edge.from, edge.to) ? [["style", "bold"] as const] : []),
+      ])};`,
+  );
+
+/**
+ * A flowchart as a Graphviz `digraph`, top to bottom. Nodes are named by their model identifiers, so the DOT source reads back to the model directly.
+ * @param view - The projected flowchart.
+ * @returns DOT source, ending with a line break.
+ */
+export const flowchartToDot = <I extends IdSpace>(view: Flowchart<I>): string =>
+  `${[
+    `digraph ${dotString("flowchart")} {`,
+    `${indent}rankdir="TB";`,
+    ...view.nodes.map((node) => dotNode(node, indent)),
+    ...dotEdges(view, () => false),
+    "}",
+  ].join("\n")}\n`;
+
+/**
+ * A swimlane as a Graphviz `digraph`, left to right, with one `cluster` subgraph per lane in the view's lane order and nodes with no actor outside every lane. An empty lane holds one invisible point so Graphviz still draws it. Hand-offs, the edges that change lane, are drawn bold.
+ * @param view - The projected swimlane.
+ * @returns DOT source, ending with a line break.
+ */
+export const swimlaneToDot = <I extends IdSpace>(view: Swimlane<I>): string => {
+  const nodes = new Map(view.nodes.map((node) => [node.id, node]));
+  const laneOf = new Map<I["element"], number>();
+  view.lanes.forEach((lane, index) => {
+    for (const id of lane.nodes) {
+      laneOf.set(id, index);
+    }
+  });
+  const declare = (id: I["element"], depth: string): string => {
+    const node = nodes.get(id);
+    if (node === undefined) {
+      throw new Error(`lane member "${id}" is not a node of the view`);
+    }
+
+    return dotNode(node, depth);
+  };
+
+  return `${[
+    `digraph ${dotString("swimlane")} {`,
+    `${indent}rankdir="LR";`,
+    ...view.lanes.flatMap((lane, index) => {
+      const cluster = `cluster_lane${String(index)}`;
+
+      return [
+        `${indent}subgraph ${dotString(cluster)} {`,
+        `${indent.repeat(2)}label=${dotString(lane.label)};`,
+        ...(lane.nodes.length === 0
+          ? [
+              `${indent.repeat(2)}${dotString(`${cluster}:empty`)}${attributes([
+                ["shape", "point"],
+                ["style", "invis"],
+              ])};`,
+            ]
+          : lane.nodes.map((id) => declare(id, indent.repeat(2)))),
+        `${indent}}`,
+      ];
+    }),
+    ...view.unassigned.map((id) => declare(id, indent)),
+    ...dotEdges(view, (from, to) => {
+      const fromLane = laneOf.get(from);
+      const toLane = laneOf.get(to);
+
+      return (
+        fromLane !== undefined && toLane !== undefined && fromLane !== toLane
+      );
+    }),
+    "}",
+  ].join("\n")}\n`;
+};
+
+/** A state's DOT shape: a filled point for an initial pseudo-state, a double circle for a final one, a rounded box for a state. */
+const stateShape = <I extends IdSpace>(
+  state: StateMachineState<I>,
+): Attributes => {
+  if (state.role === "initial") {
+    return [
+      ["label", ""],
+      ["shape", "point"],
+    ];
+  }
+  if (state.role === "final") {
+    return [
+      ["label", ""],
+      ["shape", "doublecircle"],
+    ];
+  }
+
+  return [
+    ["label", state.label],
+    ["shape", "box"],
+    ["style", "rounded"],
+  ];
+};
+
+/**
+ * A state machine as a Graphviz `digraph`, left to right. Each transition is labelled with its event, guard and effect.
+ * @param view - The projected state machine.
+ * @returns DOT source, ending with a line break.
+ */
+export const stateMachineToDot = <I extends IdSpace>(
+  view: StateMachine<I>,
+): string =>
+  `${[
+    `digraph ${dotString("state machine")} {`,
+    `${indent}rankdir="LR";`,
+    ...view.states.map(
+      (state) =>
+        `${indent}${dotString(state.id)}${attributes(stateShape(state))};`,
+    ),
+    ...view.transitions.map((transition) => {
+      const label = transitionLabel(transition);
+
+      return `${indent}${dotString(transition.source)} -> ${dotString(transition.target)}${attributes(label === "" ? [] : [["label", label]])};`;
+    }),
+    "}",
+  ].join("\n")}\n`;
+
+/** A message with the fragments around it, outermost first, each as its operator and the guard of the operand it is in. */
+interface PlacedMessage<I extends IdSpace> {
+  readonly message: SequenceMessage<I>;
+  readonly fragments: readonly string[];
+}
+
+const placeMessages = <I extends IdSpace>(
+  items: readonly SequenceItem<I>[],
+  fragments: readonly string[],
+): readonly PlacedMessage<I>[] =>
+  items.flatMap((item) =>
+    item.kind === "message"
+      ? [{ message: item.message, fragments }]
+      : item.operands.flatMap((operand) =>
+          placeMessages(operand.items, [
+            ...fragments,
+            operand.guard === undefined
+              ? item.operator
+              : `${item.operator} [${operand.guard}]`,
+          ]),
+        ),
+  );
+
+/**
+ * A sequence diagram as a Graphviz `digraph`. DOT has no sequence notation, so the diagram is drawn as a grid: a column per lifeline, headed by its participant's label, with one row per message in scenario order. Each message is an arrow across its row, numbered by its step and prefixed with the fragments around it (operator and guard, outermost first), since DOT cannot draw a box around arrows.
+ * @param view - The projected sequence diagram.
+ * @param participantLabel - The label of a lifeline's participant.
+ * @returns DOT source, ending with a line break.
+ */
+export const sequenceToDot = <I extends IdSpace>(
+  view: SequenceDiagram<I>,
+  participantLabel: (participant: I["actor"]) => string,
+): string => {
+  const columns = new Map(
+    view.lifelines.map((lifeline, index) => [lifeline, index]),
+  );
+  const column = (lifeline: I["actor"]): number => {
+    const index = columns.get(lifeline);
+    if (index === undefined) {
+      throw new Error(`"${lifeline}" is not a lifeline of the view`);
+    }
+
+    return index;
+  };
+  const head = (index: number): string => dotString(`p${String(index)}`);
+  const cell = (index: number, row: number): string =>
+    dotString(`p${String(index)}.${String(row)}`);
+  const placed = placeMessages(view.items, []);
+  const rows = placed.map((_, row) => row + 1);
+  const pointAttributes = attributes([
+    ["shape", "point"],
+    ["width", "0"],
+  ]);
+
+  return `${[
+    `digraph ${dotString("sequence")} {`,
+    `${indent}rankdir="TB";`,
+    ...view.lifelines.map(
+      (lifeline, index) =>
+        `${indent}${head(index)}${attributes([
+          ["label", participantLabel(lifeline)],
+          ["shape", "box"],
+        ])};`,
+    ),
+    `${indent}{ rank="same"; ${view.lifelines.map((_, index) => `${head(index)};`).join(" ")} }`,
+    ...view.lifelines
+      .slice(1)
+      .map(
+        (_, index) =>
+          `${indent}${head(index)} -> ${head(index + 1)}${attributes([["style", "invis"]])};`,
+      ),
+    ...rows.flatMap((row) => [
+      ...view.lifelines.map(
+        (_, index) => `${indent}${cell(index, row)}${pointAttributes};`,
+      ),
+      `${indent}{ rank="same"; ${view.lifelines.map((_, index) => `${cell(index, row)};`).join(" ")} }`,
+    ]),
+    ...(rows.length === 0
+      ? []
+      : view.lifelines.map(
+          (_, index) =>
+            `${indent}${[head(index), ...rows.map((row) => cell(index, row))].join(" -> ")}${attributes(
+              [
+                ["style", "dashed"],
+                ["arrowhead", "none"],
+              ],
+            )};`,
+        )),
+    ...placed.map(({ message, fragments }, index) => {
+      const row = index + 1;
+      const text =
+        fragments.length === 0
+          ? message.label
+          : `${fragments.join(" / ")}: ${message.label}`;
+
+      return `${indent}${cell(column(message.from), row)} -> ${cell(column(message.to), row)}${attributes(
+        [
+          ["label", `${String(row)}. ${text}`],
+          ["constraint", "false"],
+        ],
+      )};`;
+    }),
+    "}",
+  ].join("\n")}\n`;
+};
diff --git a/packages/targets/graph-cli/src/emit/emit.unit.test.ts b/packages/targets/graph-cli/src/emit/emit.unit.test.ts
new file mode 100644
index 0000000..d0d4406
--- /dev/null
+++ b/packages/targets/graph-cli/src/emit/emit.unit.test.ts
@@ -0,0 +1,279 @@
+import type {
+  Flowchart,
+  SequenceDiagram,
+  StateMachine,
+} from "@exadev/process-graph-projection";
+import type { OpenIds } from "@exadev/process-graph-schema";
+import { describe, expect, test } from "vitest";
+import { flowchartToDot, sequenceToDot, stateMachineToDot } from "./dot.ts";
+import {
+  flowchartToMermaid,
+  sequenceToMermaid,
+  stateMachineToMermaid,
+} from "./mermaid.ts";
+import { dotString, mermaidText } from "./text.ts";
+
+const lines = (...rows: readonly string[]): string => `${rows.join("\n")}\n`;
+
+describe("text", () => {
+  test("writes every character Mermaid reads as syntax as its entity code, and a line break as a space", () => {
+    expect(mermaidText('Fix "a|b" <now> & #3; then: go\nnext')).toBe(
+      "Fix #quot;a#124;b#quot; #lt;now#gt; #amp; #35;3#59; then#58; go next",
+    );
+  });
+
+  test("quotes a DOT string with backslashes, quotes and line breaks escaped", () => {
+    expect(dotString('a "b" \\ c\nd')).toBe('"a \\"b\\" \\\\ c\\nd"');
+  });
+});
+
+/** A flowchart with every node shape and an issue-style identifier. */
+const flowchart: Flowchart<OpenIds> = {
+  nodes: [
+    { id: "start", label: "Start", shape: "terminator" },
+    { id: "github:acme/app#1", label: 'Fix "login"', shape: "process" },
+    { id: "fork", label: "Fork", shape: "bar" },
+    { id: "ok", label: "OK?", shape: "decision" },
+  ],
+  edges: [
+    { from: "start", to: "github:acme/app#1" },
+    { from: "github:acme/app#1", to: "fork" },
+    { from: "fork", to: "ok", label: "a|b" },
+  ],
+  loss: [],
+};
+
+describe("flowchart", () => {
+  test("Mermaid names nodes by position and draws each shape", () => {
+    expect(flowchartToMermaid(flowchart)).toBe(
+      lines(
+        "flowchart TD",
+        '  n0(["Start"])',
+        '  n1["Fix #quot;login#quot;"]',
+        '  n2@{ shape: fork, label: "Fork" }',
+        '  n3{"OK?"}',
+        "  n0 --> n1",
+        "  n1 --> n2",
+        '  n2 -->|"a#124;b"| n3',
+      ),
+    );
+  });
+
+  test("DOT names nodes by their model identifiers and draws each shape", () => {
+    expect(flowchartToDot(flowchart)).toBe(
+      lines(
+        'digraph "flowchart" {',
+        '  rankdir="TB";',
+        '  "start" [label="Start", shape="oval"];',
+        '  "github:acme/app#1" [label="Fix \\"login\\"", shape="box"];',
+        '  "fork" [label="Fork", shape="box", style="filled", fillcolor="black", fontcolor="white"];',
+        '  "ok" [label="OK?", shape="diamond"];',
+        '  "start" -> "github:acme/app#1";',
+        '  "github:acme/app#1" -> "fork";',
+        '  "fork" -> "ok" [label="a|b"];',
+        "}",
+      ),
+    );
+  });
+});
+
+const stateMachine: StateMachine<OpenIds> = {
+  subject: "order",
+  states: [
+    { id: "begin", label: "Start", role: "initial" },
+    { id: "placed", label: "Placed", role: "state" },
+    { id: "paid", label: "Paid", role: "state" },
+    { id: "end", label: "End", role: "final" },
+  ],
+  transitions: [
+    { source: "begin", target: "placed" },
+    {
+      source: "placed",
+      target: "paid",
+      event: "pay",
+      guard: "card ok",
+      effect: "receipt",
+    },
+    { source: "paid", target: "end", effect: "archive" },
+  ],
+  loss: [],
+};
+
+describe("state machine", () => {
+  test("Mermaid draws initial and final pseudo-states as [*] and labels transitions with event, guard and effect", () => {
+    expect(stateMachineToMermaid(stateMachine)).toBe(
+      lines(
+        "stateDiagram-v2",
+        '  state "Placed" as s0',
+        '  state "Paid" as s1',
+        "  [*] --> s0",
+        "  s0 --> s1 : pay [card ok] / receipt",
+        "  s1 --> [*] : / archive",
+      ),
+    );
+  });
+
+  test("DOT draws an initial point, a final double circle and rounded states", () => {
+    expect(stateMachineToDot(stateMachine)).toBe(
+      lines(
+        'digraph "state machine" {',
+        '  rankdir="LR";',
+        '  "begin" [label="", shape="point"];',
+        '  "placed" [label="Placed", shape="box", style="rounded"];',
+        '  "paid" [label="Paid", shape="box", style="rounded"];',
+        '  "end" [label="", shape="doublecircle"];',
+        '  "begin" -> "placed";',
+        '  "placed" -> "paid" [label="pay [card ok] / receipt"];',
+        '  "paid" -> "end" [label="/ archive"];',
+        "}",
+      ),
+    );
+  });
+});
+
+const message = (transition: string, from: string, to: string, label: string) =>
+  ({ transition, from, to, label }) as const;
+
+/** A review loop holding an alternative: approved and published, or rejected; then a parallel notification. */
+const sequence: SequenceDiagram<OpenIds> = {
+  lifelines: ["author", "reviewer", "bot"],
+  messages: [
+    message("t1", "author", "reviewer", "Submit"),
+    message("t2", "reviewer", "author", "Approve"),
+    message("t3", "author", "bot", "Notify"),
+  ],
+  items: [
+    {
+      kind: "fragment",
+      fragment: "review",
+      operator: "loop",
+      operands: [
+        {
+          guard: "until approved",
+          items: [
+            {
+              kind: "message",
+              message: message("t1", "author", "reviewer", "Submit"),
+            },
+            {
+              kind: "fragment",
+              fragment: "verdict",
+              operator: "alt",
+              operands: [
+                {
+                  guard: "approved",
+                  items: [
+                    {
+                      kind: "message",
+                      message: message("t2", "reviewer", "author", "Approve"),
+                    },
+                  ],
+                },
+                { items: [] },
+              ],
+            },
+          ],
+        },
+      ],
+    },
+    {
+      kind: "fragment",
+      fragment: "tell",
+      operator: "par",
+      operands: [
+        {
+          items: [
+            {
+              kind: "message",
+              message: message("t3", "author", "bot", "Notify"),
+            },
+          ],
+        },
+        { guard: "later", items: [] },
+      ],
+    },
+  ],
+  loss: [],
+};
+
+const labels: Readonly<Record<string, string>> = {
+  author: "Author",
+  reviewer: "Reviewer: lead",
+  bot: "Bot",
+};
+const labelOf = (id: string): string => labels[id] ?? id;
+
+describe("sequence diagram", () => {
+  test("Mermaid nests fragments, separating alt operands with else and par operands with and", () => {
+    expect(sequenceToMermaid(sequence, labelOf)).toBe(
+      lines(
+        "sequenceDiagram",
+        "  participant p0 as Author",
+        "  participant p1 as Reviewer#58; lead",
+        "  participant p2 as Bot",
+        "  loop until approved",
+        "    p0->>p1: Submit",
+        "    alt approved",
+        "      p1->>p0: Approve",
+        "    else",
+        "    end",
+        "  end",
+        "  par",
+        "    p0->>p2: Notify",
+        "  and later",
+        "  end",
+      ),
+    );
+  });
+
+  test("DOT draws a lifeline grid and prefixes each message with the fragments around it", () => {
+    expect(sequenceToDot(sequence, labelOf)).toBe(
+      lines(
+        'digraph "sequence" {',
+        '  rankdir="TB";',
+        '  "p0" [label="Author", shape="box"];',
+        '  "p1" [label="Reviewer: lead", shape="box"];',
+        '  "p2" [label="Bot", shape="box"];',
+        '  { rank="same"; "p0"; "p1"; "p2"; }',
+        '  "p0" -> "p1" [style="invis"];',
+        '  "p1" -> "p2" [style="invis"];',
+        '  "p0.1" [shape="point", width="0"];',
+        '  "p1.1" [shape="point", width="0"];',
+        '  "p2.1" [shape="point", width="0"];',
+        '  { rank="same"; "p0.1"; "p1.1"; "p2.1"; }',
+        '  "p0.2" [shape="point", width="0"];',
+        '  "p1.2" [shape="point", width="0"];',
+        '  "p2.2" [shape="point", width="0"];',
+        '  { rank="same"; "p0.2"; "p1.2"; "p2.2"; }',
+        '  "p0.3" [shape="point", width="0"];',
+        '  "p1.3" [shape="point", width="0"];',
+        '  "p2.3" [shape="point", width="0"];',
+        '  { rank="same"; "p0.3"; "p1.3"; "p2.3"; }',
+        '  "p0" -> "p0.1" -> "p0.2" -> "p0.3" [style="dashed", arrowhead="none"];',
+        '  "p1" -> "p1.1" -> "p1.2" -> "p1.3" [style="dashed", arrowhead="none"];',
+        '  "p2" -> "p2.1" -> "p2.2" -> "p2.3" [style="dashed", arrowhead="none"];',
+        '  "p0.1" -> "p1.1" [label="1. loop [until approved]: Submit", constraint="false"];',
+        '  "p1.2" -> "p0.2" [label="2. loop [until approved] / alt [approved]: Approve", constraint="false"];',
+        '  "p0.3" -> "p2.3" [label="3. par: Notify", constraint="false"];',
+        "}",
+      ),
+    );
+  });
+
+  test("an empty scenario draws the lifelines alone", () => {
+    expect(
+      sequenceToDot(
+        { lifelines: ["author"], messages: [], items: [], loss: [] },
+        labelOf,
+      ),
+    ).toBe(
+      lines(
+        'digraph "sequence" {',
+        '  rankdir="TB";',
+        '  "p0" [label="Author", shape="box"];',
+        '  { rank="same"; "p0"; }',
+        "}",
+      ),
+    );
+  });
+});
diff --git a/packages/targets/graph-cli/src/emit/mermaid.ts b/packages/targets/graph-cli/src/emit/mermaid.ts
new file mode 100644
index 0000000..94450c2
--- /dev/null
+++ b/packages/targets/graph-cli/src/emit/mermaid.ts
@@ -0,0 +1,233 @@
+import type {
+  Flowchart,
+  FlowNode,
+  SequenceDiagram,
+  SequenceItem,
+  StateMachine,
+  StateMachineTransition,
+  Swimlane,
+} from "@exadev/process-graph-projection";
+import type { IdSpace } from "@exadev/process-graph-schema";
+import { mermaidText } from "./text.ts";
+
+/**
+ * Model identifiers are free text (`github:org/repo#12`), which Mermaid does not accept as a node identifier, so every emitter names things by position in the view instead: a prefix and the index. The view's order is the model's order, so the same model always gives the same names.
+ */
+const positionalIds = <Id extends string>(
+  prefix: string,
+  ids: readonly Id[],
+): ReadonlyMap<Id, string> =>
+  new Map(ids.map((id, index) => [id, `${prefix}${String(index)}`]));
+
+/** Reads a name the emitter itself assigned, which exists for every identifier the view lists. */
+const nameIn = <Id extends string>(
+  names: ReadonlyMap<Id, string>,
+  id: Id,
+): string => {
+  const name = names.get(id);
+  if (name === undefined) {
+    throw new Error(`"${id}" is not part of the view being emitted`);
+  }
+
+  return name;
+};
+
+const indent = "  ";
+
+/** Each flowchart shape in Mermaid's syntax around a node name and quoted label: a stadium for a terminator, a rectangle for a process, a rhombus for a decision and a fork bar for a fork or join. */
+const mermaidShapes: Readonly<
+  Record<FlowNode<IdSpace>["shape"], (name: string, label: string) => string>
+> = {
+  terminator: (name, label) => `${name}(["${label}"])`,
+  process: (name, label) => `${name}["${label}"]`,
+  decision: (name, label) => `${name}{"${label}"}`,
+  bar: (name, label) => `${name}@{ shape: fork, label: "${label}" }`,
+};
+
+const mermaidNode = <I extends IdSpace>(
+  name: string,
+  node: FlowNode<I>,
+): string => mermaidShapes[node.shape](name, mermaidText(node.label));
+
+/** The edges of a flowchart, a hand-off (an edge whose ends are in different lanes) drawn thick. */
+const mermaidEdges = <I extends IdSpace>(
+  view: Flowchart<I>,
+  names: ReadonlyMap<I["element"], string>,
+  isHandoff: (from: I["element"], to: I["element"]) => boolean,
+): readonly string[] =>
+  view.edges.map((edge) => {
+    const arrow = isHandoff(edge.from, edge.to) ? "==>" : "-->";
+    const label =
+      edge.label === undefined ? "" : `|"${mermaidText(edge.label)}"|`;
+
+    return `${indent}${nameIn(names, edge.from)} ${arrow}${label} ${nameIn(names, edge.to)}`;
+  });
+
+/**
+ * A flowchart as a Mermaid `flowchart`, top to bottom. Nodes are declared in the view's order, then edges, each with its guard as the edge label.
+ * @param view - The projected flowchart.
+ * @returns Mermaid source, ending with a line break.
+ */
+export const flowchartToMermaid = <I extends IdSpace>(
+  view: Flowchart<I>,
+): string => {
+  const names = positionalIds(
+    "n",
+    view.nodes.map((node) => node.id),
+  );
+
+  return `${[
+    "flowchart TD",
+    ...view.nodes.map(
+      (node) => `${indent}${mermaidNode(nameIn(names, node.id), node)}`,
+    ),
+    ...mermaidEdges(view, names, () => false),
+  ].join("\n")}\n`;
+};
+
+/**
+ * A swimlane as a Mermaid `flowchart`, left to right, with one subgraph per lane in the view's lane order (an empty lane is an empty subgraph, so it stays visible) and nodes with no actor outside every lane. Hand-offs, the edges that change lane, are drawn thick.
+ * @param view - The projected swimlane.
+ * @returns Mermaid source, ending with a line break.
+ */
+export const swimlaneToMermaid = <I extends IdSpace>(
+  view: Swimlane<I>,
+): string => {
+  const names = positionalIds(
+    "n",
+    view.nodes.map((node) => node.id),
+  );
+  const nodes = new Map(view.nodes.map((node) => [node.id, node]));
+  const laneOf = new Map<I["element"], number>();
+  view.lanes.forEach((lane, index) => {
+    for (const id of lane.nodes) {
+      laneOf.set(id, index);
+    }
+  });
+  const declare = (id: I["element"], depth: string): string => {
+    const node = nodes.get(id);
+    if (node === undefined) {
+      throw new Error(`lane member "${id}" is not a node of the view`);
+    }
+
+    return `${depth}${mermaidNode(nameIn(names, id), node)}`;
+  };
+
+  return `${[
+    "flowchart LR",
+    ...view.lanes.flatMap((lane, index) => [
+      `${indent}subgraph lane${String(index)}["${mermaidText(lane.label)}"]`,
+      ...lane.nodes.map((id) => declare(id, indent.repeat(2))),
+      `${indent}end`,
+    ]),
+    ...view.unassigned.map((id) => declare(id, indent)),
+    ...mermaidEdges(view, names, (from, to) => {
+      const fromLane = laneOf.get(from);
+      const toLane = laneOf.get(to);
+
+      return (
+        fromLane !== undefined && toLane !== undefined && fromLane !== toLane
+      );
+    }),
+  ].join("\n")}\n`;
+};
+
+/** A state machine transition's label: its event, its guard in brackets and its effect after a slash, each only when present. */
+export const transitionLabel = <I extends IdSpace>(
+  transition: StateMachineTransition<I>,
+): string =>
+  [
+    transition.event,
+    transition.guard === undefined ? undefined : `[${transition.guard}]`,
+    transition.effect === undefined ? undefined : `/ ${transition.effect}`,
+  ]
+    .filter((part) => part !== undefined)
+    .join(" ");
+
+/**
+ * A state machine as a Mermaid `stateDiagram-v2`. Initial and final pseudo-states are Mermaid's `[*]`; every other state is declared with its label. Each transition carries its event, guard and effect.
+ * @param view - The projected state machine.
+ * @returns Mermaid source, ending with a line break.
+ */
+export const stateMachineToMermaid = <I extends IdSpace>(
+  view: StateMachine<I>,
+): string => {
+  const drawn = view.states.filter((state) => state.role === "state");
+  const names = new Map<I["element"], string>([
+    ...positionalIds(
+      "s",
+      drawn.map((state) => state.id),
+    ),
+    ...view.states
+      .filter((state) => state.role !== "state")
+      .map((state): [I["element"], string] => [state.id, "[*]"]),
+  ]);
+
+  return `${[
+    "stateDiagram-v2",
+    ...drawn.map(
+      (state) =>
+        `${indent}state "${mermaidText(state.label)}" as ${nameIn(names, state.id)}`,
+    ),
+    ...view.transitions.map((transition) => {
+      const label = transitionLabel(transition);
+
+      return `${indent}${nameIn(names, transition.source)} --> ${nameIn(names, transition.target)}${label === "" ? "" : ` : ${mermaidText(label)}`}`;
+    }),
+  ].join("\n")}\n`;
+};
+
+/** The Mermaid keyword that separates one operand of a fragment from the next, for the operators with more than one operand. */
+const operandSeparator = (operator: string): string =>
+  operator === "par" ? "and" : "else";
+
+/**
+ * A sequence diagram as a Mermaid `sequenceDiagram`. Lifelines are declared in order of first appearance, labelled through `participantLabel`; messages follow in scenario order, wrapped in the fragments the projection drew (`alt` operands separated by `else`, `par` operands by `and`), each operand headed by its guard.
+ * @param view - The projected sequence diagram.
+ * @param participantLabel - The label of a lifeline's participant.
+ * @returns Mermaid source, ending with a line break.
+ */
+export const sequenceToMermaid = <I extends IdSpace>(
+  view: SequenceDiagram<I>,
+  participantLabel: (participant: I["actor"]) => string,
+): string => {
+  const names = positionalIds("p", view.lifelines);
+  const items = (
+    list: readonly SequenceItem<I>[],
+    depth: number,
+  ): readonly string[] =>
+    list.flatMap((item) => {
+      const prefix = indent.repeat(depth);
+      if (item.kind === "message") {
+        const { message } = item;
+
+        return [
+          `${prefix}${nameIn(names, message.from)}->>${nameIn(names, message.to)}: ${mermaidText(message.label)}`,
+        ];
+      }
+
+      return [
+        ...item.operands.flatMap((operand, index) => {
+          const keyword =
+            index === 0 ? item.operator : operandSeparator(item.operator);
+          const guard =
+            operand.guard === undefined ? "" : ` ${mermaidText(operand.guard)}`;
+
+          return [
+            `${prefix}${keyword}${guard}`,
+            ...items(operand.items, depth + 1),
+          ];
+        }),
+        `${prefix}end`,
+      ];
+    });
+
+  return `${[
+    "sequenceDiagram",
+    ...view.lifelines.map(
+      (lifeline) =>
+        `${indent}participant ${nameIn(names, lifeline)} as ${mermaidText(participantLabel(lifeline))}`,
+    ),
+    ...items(view.items, 1),
+  ].join("\n")}\n`;
+};
diff --git a/packages/targets/graph-cli/src/emit/text.ts b/packages/targets/graph-cli/src/emit/text.ts
new file mode 100644
index 0000000..4482750
--- /dev/null
+++ b/packages/targets/graph-cli/src/emit/text.ts
@@ -0,0 +1,47 @@
+/**
+ * The Mermaid entity code for a character that would end or change the meaning of a label: quotes, statement and edge-label delimiters, the entity marker itself and HTML. A line break becomes a space, since every label is one line.
+ */
+const mermaidEntity = (character: string): string => {
+  switch (character) {
+    case "#":
+      return "#35;";
+    case '"':
+      return "#quot;";
+    case "<":
+      return "#lt;";
+    case ">":
+      return "#gt;";
+    case "&":
+      return "#amp;";
+    case ";":
+      return "#59;";
+    case "|":
+      return "#124;";
+    case ":":
+      return "#58;";
+    case "\r":
+    case "\n":
+      return " ";
+    default:
+      return character;
+  }
+};
+
+/**
+ * Text made safe to place inside any Mermaid label: every character that Mermaid reads as syntax is written as its entity code, so a label from a source (an issue title, a repository name) can never break the diagram.
+ * @param text - The label as written.
+ * @returns The label as Mermaid source.
+ */
+export const mermaidText = (text: string): string =>
+  text.replaceAll(/[#"<>&;|:\r\n]/gu, mermaidEntity);
+
+/**
+ * A Graphviz DOT double-quoted string: backslashes and quotes escaped, line breaks written as DOT's own centred line break. Any identifier or label is valid DOT once quoted this way.
+ * @param text - The text as written.
+ * @returns The quoted DOT string, quotes included.
+ */
+export const dotString = (text: string): string =>
+  `"${text
+    .replaceAll("\\", "\\\\")
+    .replaceAll('"', '\\"')
+    .replaceAll(/\r?\n/gu, "\\n")}"`;
diff --git a/packages/targets/graph-cli/src/errors.ts b/packages/targets/graph-cli/src/errors.ts
new file mode 100644
index 0000000..4b77684
--- /dev/null
+++ b/packages/targets/graph-cli/src/errors.ts
@@ -0,0 +1,116 @@
+import { CycleError, UnknownNodeError } from "@exadev/process-graph-dag";
+import { ModelParseError } from "@exadev/process-graph-schema";
+import { ORPCError } from "@orpc/server";
+import { CommanderError } from "commander";
+import { exitCodes, type ExitCode } from "./exit-codes.ts";
+
+/** A failure the command line reports with its own exit status and message, and nothing else. */
+export class CliError extends Error {
+  /** The exit status the failure maps to. */
+  readonly exitCode: ExitCode;
+
+  /**
+   * @param exitCode - The exit status to report.
+   * @param message - What went wrong, as one line for standard error.
+   * @param options - The underlying error, kept as the cause.
+   */
+  constructor(exitCode: ExitCode, message: string, options?: ErrorOptions) {
+    super(message, options);
+    this.name = "CliError";
+    this.exitCode = exitCode;
+  }
+}
+
+/** The store's codes for a missing model or element and for a change that would leave the model invalid. */
+const notFoundCode = "NOT_FOUND";
+const unprocessableCode = "UNPROCESSABLE_CONTENT";
+
+/** The codes a source answers with when it refuses a sync. */
+const sourceRefusalCodes: ReadonlySet<string> = new Set([
+  "UNAUTHORIZED",
+  "TOO_MANY_REQUESTS",
+  "BAD_REQUEST",
+]);
+
+/** The issues an `UNPROCESSABLE_CONTENT` error carries, each as `code: message`, or nothing when its data has no issues. */
+const issueLines = (data: unknown): readonly string[] => {
+  if (
+    typeof data !== "object" ||
+    data === null ||
+    !("issues" in data) ||
+    !Array.isArray(data.issues)
+  ) {
+    return [];
+  }
+  const issues: readonly unknown[] = data.issues;
+
+  return issues.flatMap((issue) =>
+    typeof issue === "object" &&
+    issue !== null &&
+    "code" in issue &&
+    "message" in issue &&
+    typeof issue.code === "string" &&
+    typeof issue.message === "string"
+      ? [`${issue.code}: ${issue.message}`]
+      : [],
+  );
+};
+
+/** The exit status and message an error is reported with. */
+export interface Failure {
+  readonly exitCode: ExitCode;
+  readonly message: string;
+}
+
+/**
+ * Classifies anything a command threw into its exit status and the message for standard error. A commander usage error has already printed its own message, so it is reported with an empty one.
+ * @param error - What was thrown.
+ * @returns The exit status and message.
+ */
+export const failureOf = (error: unknown): Failure => {
+  if (error instanceof CliError) {
+    return { exitCode: error.exitCode, message: error.message };
+  }
+  if (error instanceof CommanderError) {
+    return {
+      exitCode:
+        error.exitCode === exitCodes.success
+          ? exitCodes.success
+          : exitCodes.usage,
+      message: "",
+    };
+  }
+  if (error instanceof CycleError) {
+    return {
+      exitCode: exitCodes.invalidModel,
+      message: `${error.message}; run cycles to list them`,
+    };
+  }
+  if (error instanceof UnknownNodeError) {
+    return { exitCode: exitCodes.notFound, message: error.message };
+  }
+  if (error instanceof ModelParseError) {
+    return { exitCode: exitCodes.invalidModel, message: error.message };
+  }
+  if (error instanceof ORPCError) {
+    const code: unknown = error.code;
+    const data: unknown = error.data;
+    if (code === notFoundCode) {
+      return { exitCode: exitCodes.notFound, message: error.message };
+    }
+    if (code === unprocessableCode) {
+      return {
+        exitCode: exitCodes.invalidModel,
+        message: [error.message, ...issueLines(data)].join("\n"),
+      };
+    }
+    if (typeof code === "string" && sourceRefusalCodes.has(code)) {
+      return { exitCode: exitCodes.sourceFailure, message: error.message };
+    }
+  }
+
+  return {
+    exitCode: exitCodes.failure,
+    message: error instanceof Error ? error.message : String(error),
+  };
+};
diff --git a/packages/targets/graph-cli/src/exit-codes.ts b/packages/targets/graph-cli/src/exit-codes.ts
new file mode 100644
index 0000000..9728210
--- /dev/null
+++ b/packages/targets/graph-cli/src/exit-codes.ts
@@ -0,0 +1,21 @@
+/**
+ * The exit status of every command, by meaning. A script tells the outcomes apart without reading the output: a model with problems is not a failure to run, and neither is an element that does not exist.
+ *
+ * - `success`: the command did what it was asked, and for `validate` and `cycles`, found nothing wrong.
+ * - `failure`: anything not listed below, such as a store that cannot be opened.
+ * - `usage`: the command line is wrong: an unknown command or option, a missing argument, a value outside its choices.
+ * - `notFound`: the model, an element or another identifier named on the command line does not exist.
+ * - `invalidModel`: the model has problems: `validate` found issues, `cycles` found an illegal cycle, a reasoning command met an illegal cycle, or the store rejected a change that would leave the model invalid.
+ * - `sourceFailure`: a source refused the sync: bad credentials, a rate limit or a scope it does not accept.
+ */
+export const exitCodes = {
+  success: 0,
+  failure: 1,
+  usage: 2,
+  notFound: 3,
+  invalidModel: 4,
+  sourceFailure: 5,
+} as const;
+
+/** One of the exit statuses in `exitCodes`. */
+export type ExitCode = (typeof exitCodes)[keyof typeof exitCodes];
diff --git a/packages/targets/graph-cli/src/index.ts b/packages/targets/graph-cli/src/index.ts
new file mode 100644
index 0000000..05a275d
--- /dev/null
+++ b/packages/targets/graph-cli/src/index.ts
@@ -0,0 +1,82 @@
+/**
+ * The process-graph command line as a library. `runCli` runs the whole command surface against injected ports and resolves with the exit status, so a host program (Switchboard's `sb graph`) mounts it as a subcommand; the operations behind each command (`ready`, `blocked`, `why` and the rest) return plain data for hosts that want results rather than text, such as tools served over MCP; and the Mermaid and DOT emitters draw any projected view. `nodePorts` wires the ports for a Node process: the SQLite store, the GitHub issues source with a token from the environment, and the process's streams.
+ */
+export { runCli, defaultModelId, type ProgramIdentity } from "./program.ts";
+export { exitCodes, type ExitCode } from "./exit-codes.ts";
+export { CliError, failureOf, type Failure } from "./errors.ts";
+export type { CliPorts, OpenedStore } from "./ports.ts";
+export {
+  defaultDataPath,
+  nodePorts,
+  packageVersion,
+  runProcess,
+  type NodePortsOptions,
+} from "./node.ts";
+export {
+  findRun,
+  loadRun,
+  type ElementSummary,
+  type GraphSession,
+  type StoredRun,
+} from "./session.ts";
+export {
+  blocked,
+  cycles,
+  handoffsOf,
+  impactOf,
+  path,
+  ready,
+  why,
+  type BlockedResult,
+  type CyclesResult,
+  type ElementStatus,
+  type HandoffsResult,
+  type ImpactResult,
+  type PathResult,
+  type ReadyResult,
+  type WhyLink,
+  type WhyResult,
+} from "./queries.ts";
+export {
+  emit,
+  formatNames,
+  project,
+  show,
+  viewNames,
+  type FormatName,
+  type ProjectedView,
+  type ShowRequest,
+  type ShowResult,
+  type ViewName,
+} from "./show.ts";
+export {
+  add,
+  setState,
+  type Addition,
+  type SetResult,
+  type Written,
+} from "./edit.ts";
+export {
+  validateDocument,
+  validateStored,
+  type ValidateResult,
+  type ValidationIssue,
+} from "./validate.ts";
+export {
+  sync,
+  type SourceLookup,
+  type SyncRequest,
+  type SyncResult,
+} from "./sync.ts";
+export {
+  flowchartToMermaid,
+  sequenceToMermaid,
+  stateMachineToMermaid,
+  swimlaneToMermaid,
+} from "./emit/mermaid.ts";
+export {
+  flowchartToDot,
+  sequenceToDot,
+  stateMachineToDot,
+  swimlaneToDot,
+} from "./emit/dot.ts";
diff --git a/packages/targets/graph-cli/src/node.ts b/packages/targets/graph-cli/src/node.ts
new file mode 100644
index 0000000..ce3fa4b
--- /dev/null
+++ b/packages/targets/graph-cli/src/node.ts
@@ -0,0 +1,173 @@
+import { mkdirSync, readFileSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import type { Facts } from "@exadev/process-graph-domain";
+import { createGraphSourceRouter } from "@exadev/process-graph-source-contract";
+import {
+  createGitHubIssuesSource,
+  githubSource,
+  type GitHubTokenPort,
+  type GraphqlFetch,
+} from "@exadev/process-graph-source-github-issues";
+import { githubTokenFromEnvironment } from "@exadev/process-graph-source-github-issues/node";
+import { openNodeGraphStore } from "@exadev/process-graph-sqlite-node";
+import { createGraphStoreRouter } from "@exadev/process-graph-store-contract";
+import { createRouterClient } from "@orpc/server";
+import type { CliPorts } from "./ports.ts";
+import type { ExitCode } from "./exit-codes.ts";
+import { runCli, type ProgramIdentity } from "./program.ts";
+
+/** Where a Node process finds its ports. Each is injectable, and each defaults to the real thing. */
+export interface NodePortsOptions {
+  /** The environment, for the data path and the GitHub token; `process.env` when absent. */
+  readonly env?: Readonly<Record<string, string | undefined>>;
+  /** The home directory the default data path falls back on; the user's when absent. */
+  readonly home?: string;
+  /** Supplies GitHub tokens; `GITHUB_TOKEN` or the GitHub CLI's token (`githubTokenFromEnvironment`) when absent. */
+  readonly token?: GitHubTokenPort;
+  /** How requests reach GitHub; the global `fetch` when absent. */
+  readonly fetch?: GraphqlFetch;
+  /** The clock, in milliseconds since the epoch, for a rate limit's retry time; `Date.now` when absent. */
+  readonly now?: () => number;
+  /** The facts decision conditions read and which input artefacts are provided; nothing is known when absent. */
+  readonly facts?: Facts;
+  /** Aborts every store and source call. */
+  readonly signal?: AbortSignal;
+  /** Standard output; the process's when absent. */
+  readonly stdout?: (text: string) => void;
+  /** Standard error; the process's when absent. */
+  readonly stderr?: (text: string) => void;
+}
+
+/** The variable that names the data file outright. */
+const dataVariable = "PROCESS_GRAPH_DATA";
+
+/** The data file's path under the data directory. */
+const dataFile = join("process-graph", "graph.sqlite3");
+
+/** `node:sqlite`'s path for a private database in memory, which has no directory to create. */
+const inMemory = ":memory:";
+
+/**
+ * The data file used when `--data` is not given: `PROCESS_GRAPH_DATA` when it is set and not empty, otherwise `process-graph/graph.sqlite3` under the XDG data directory (`XDG_DATA_HOME`, or `.local/share` in the home directory).
+ * @param env - The environment.
+ * @param home - The home directory.
+ * @returns The path.
+ */
+export const defaultDataPath = (
+  env: Readonly<Record<string, string | undefined>>,
+  home: string,
+): string => {
+  const named = env[dataVariable];
+  if (named !== undefined && named !== "") {
+    return named;
+  }
+  const xdg = env.XDG_DATA_HOME;
+
+  return join(
+    xdg !== undefined && xdg !== "" ? xdg : join(home, ".local", "share"),
+    dataFile,
+  );
+};
+
+/** A fact port that knows nothing: every condition is indeterminate and no input artefact is provided. */
+const noFacts: Facts = () => ({ found: false });
+
+/**
+ * The version in a package manifest, which `--version` prints. Each bin passes its own manifest, so the entry point reports its own version rather than this package's.
+ * @param manifest - The manifest's location, such as `new URL("../package.json", import.meta.url)` from a module in `dist/`.
+ * @returns The version.
+ * @throws Error when the manifest has no string `version`.
+ */
+export const packageVersion = (manifest: URL): string => {
+  const parsed: unknown = JSON.parse(readFileSync(manifest, "utf8"));
+  if (
+    typeof parsed !== "object" ||
+    parsed === null ||
+    !("version" in parsed) ||
+    typeof parsed.version !== "string"
+  ) {
+    throw new Error(`${manifest.pathname} has no version`);
+  }
+
+  return parsed.version;
+};
+
+/**
+ * The ports for a Node process: the SQLite store over `node:sqlite` (creating the data file's directory when needed), the GitHub issues source for `github:` scopes, the file system and the process's streams.
+ * @param options - Replacements for any of the defaults.
+ * @returns The ports.
+ */
+export const nodePorts = (options: NodePortsOptions = {}): CliPorts => {
+  const env = options.env ?? process.env;
+  const token = options.token ?? githubTokenFromEnvironment({ env });
+
+  return {
+    stdout:
+      options.stdout ??
+      ((text) => {
+        process.stdout.write(text);
+      }),
+    stderr:
+      options.stderr ??
+      ((text) => {
+        process.stderr.write(text);
+      }),
+    defaultDataPath: defaultDataPath(env, options.home ?? homedir()),
+    openStore: (path) => {
+      if (path !== inMemory) {
+        mkdirSync(dirname(path), { recursive: true });
+      }
+      const { store, close } = openNodeGraphStore(path);
+
+      return {
+        client: createRouterClient(createGraphStoreRouter(store)),
+        close,
+      };
+    },
+    source: (prefix) =>
+      prefix === githubSource
+        ? createRouterClient(
+            createGraphSourceRouter(
+              createGitHubIssuesSource({
+                token,
+                now: options.now ?? Date.now,
+                ...(options.fetch === undefined
+                  ? {}
+                  : { fetch: options.fetch }),
+              }),
+            ),
+          )
+        : undefined,
+    readFile: async (path, signal) =>
+      readFile(
+        path,
+        signal === undefined
+          ? { encoding: "utf8" }
+          : { encoding: "utf8", signal },
+      ),
+    facts: options.facts ?? noFacts,
+    signal: options.signal,
+  };
+};
+
+/**
+ * Runs the command line as the current process: its arguments, its streams and the real ports, with an interrupt aborting whatever the command is waiting on. It resolves with the exit status rather than exiting, so the bin sets `process.exitCode` and pending output is flushed.
+ * @param identity - The name and version the program presents.
+ * @returns The exit status.
+ */
+export const runProcess = async (
+  identity: ProgramIdentity,
+): Promise<ExitCode> => {
+  const controller = new AbortController();
+  process.once("SIGINT", () => {
+    controller.abort();
+  });
+
+  return runCli(
+    process.argv.slice(2),
+    nodePorts({ signal: controller.signal }),
+    identity,
+  );
+};
diff --git a/packages/targets/graph-cli/src/ports.ts b/packages/targets/graph-cli/src/ports.ts
new file mode 100644
index 0000000..1364188
--- /dev/null
+++ b/packages/targets/graph-cli/src/ports.ts
@@ -0,0 +1,43 @@
+import type { Facts } from "@exadev/process-graph-domain";
+import type { GraphSourceClient } from "@exadev/process-graph-source-contract";
+import type { GraphStoreClient } from "@exadev/process-graph-store-contract";
+
+/** A store opened for one command, and how to release it. */
+export interface OpenedStore {
+  /** The store, over whatever transport the opener chose. */
+  readonly client: GraphStoreClient;
+  /** Releases the store. Called once, after the command, whether it succeeded or not. */
+  readonly close: () => void | Promise<void>;
+}
+
+/**
+ * Everything the command line touches outside itself. Commands read and write only through these, so the whole command surface runs in a test, or inside another program such as Switchboard, with no process, file system or network of its own. `nodePorts` supplies them for a real process.
+ */
+export interface CliPorts {
+  /** Writes text to standard output, exactly as given. */
+  readonly stdout: (text: string) => void;
+  /** Writes text to standard error, exactly as given. */
+  readonly stderr: (text: string) => void;
+  /** Opens the store kept at a data path. */
+  readonly openStore: (path: string) => OpenedStore | Promise<OpenedStore>;
+  /** The data path used when `--data` is not given. */
+  readonly defaultDataPath: string;
+  /**
+   * The source that serves scopes with an identifier prefix, such as `github` for `github:owner/repo`, or `undefined` when no source has that prefix.
+   * @param prefix - The part of a scope identifier before its first colon.
+   */
+  readonly source: (prefix: string) => GraphSourceClient | undefined;
+  /**
+   * Reads a text file, for `validate <file>`.
+   * @param path - The file to read.
+   * @param signal - Aborts the read.
+   */
+  readonly readFile: (
+    path: string,
+    signal: AbortSignal | undefined,
+  ) => Promise<string>;
+  /** The facts that decision conditions read, and which input artefacts are provided. */
+  readonly facts: Facts;
+  /** Aborts every store and source call a command makes. */
+  readonly signal: AbortSignal | undefined;
+}
diff --git a/packages/targets/graph-cli/src/program.ts b/packages/targets/graph-cli/src/program.ts
new file mode 100644
index 0000000..8455289
--- /dev/null
+++ b/packages/targets/graph-cli/src/program.ts
@@ -0,0 +1,633 @@
+import {
+  overlayStatuses,
+  participantKinds,
+  type OverlayStatus,
+  type ParticipantKind,
+} from "@exadev/process-graph-schema";
+import { Argument, Command, Option } from "commander";
+import { add, setState, type Addition } from "./edit.ts";
+import { failureOf } from "./errors.ts";
+import { exitCodes, type ExitCode } from "./exit-codes.ts";
+import type { CliPorts } from "./ports.ts";
+import {
+  blocked,
+  cycles,
+  handoffsOf,
+  impactOf,
+  path,
+  ready,
+  why,
+} from "./queries.ts";
+import {
+  renderAdded,
+  renderBlocked,
+  renderCycles,
+  renderHandoffs,
+  renderImpact,
+  renderPath,
+  renderReady,
+  renderSet,
+  renderSync,
+  renderValidate,
+  renderWhy,
+} from "./render.ts";
+import type { GraphSession } from "./session.ts";
+import {
+  formatNames,
+  show,
+  viewNames,
+  type FormatName,
+  type ViewName,
+} from "./show.ts";
+import { sync } from "./sync.ts";
+import { validateDocument, validateStored } from "./validate.ts";
+
+/** How the program presents itself. */
+export interface ProgramIdentity {
+  /** The command name shown in help and usage, such as `process-graph`, or `sb graph` when embedded. */
+  readonly name: string;
+  /** The version `--version` prints. */
+  readonly version: string;
+}
+
+/** The model a command works on when `--model` is not given. */
+export const defaultModelId = "default";
+
+const exitStatusHelp = `
+Exit status:
+  ${String(exitCodes.success)}  success; for validate and cycles, nothing wrong was found
+  ${String(exitCodes.failure)}  failure not listed below
+  ${String(exitCodes.usage)}  usage error: unknown command or option, missing argument, value outside its choices
+  ${String(exitCodes.notFound)}  the model, an element or another identifier named does not exist
+  ${String(exitCodes.invalidModel)}  the model has problems: validation issues, an illegal cycle, or a change the store rejected
+  ${String(exitCodes.sourceFailure)}  a source refused the sync: credentials, rate limit or scope
+
+Every command writes JSON with --json. The store is a SQLite file, chosen with --data.`;
+
+/** What one command produced: the value `--json` writes, the text written otherwise, and the exit status. */
+interface Outcome {
+  readonly json: unknown;
+  readonly text: string;
+  readonly exitCode?: ExitCode;
+}
+
+/** The options every command shares, read from the program. */
+interface GlobalOptions {
+  readonly data: string;
+  readonly model: string;
+  readonly json: boolean;
+}
+
+const readGlobals = (command: Command, ports: CliPorts): GlobalOptions => {
+  const options: Record<string, unknown> = command.optsWithGlobals();
+  const { data, model, json } = options;
+
+  return {
+    data: typeof data === "string" ? data : ports.defaultDataPath,
+    model: typeof model === "string" ? model : defaultModelId,
+    json: json === true,
+  };
+};
+
+const isOneOf = <T extends string>(
+  values: readonly T[],
+  value: unknown,
+): value is T => values.some((candidate) => candidate === value);
+
+/** Reads an option whose choices commander has already checked, narrowing it to its type. */
+const choice = <T extends string>(
+  values: readonly T[],
+  value: unknown,
+  name: string,
+): T => {
+  if (!isOneOf(values, value)) {
+    throw new Error(`--${name} was not checked against its choices`);
+  }
+
+  return value;
+};
+
+/**
+ * Runs the command line with the given arguments, writing only through the ports, and resolves with the exit status. It never exits the process or reads its arguments itself, so a test or a host program such as Switchboard runs it as a function.
+ * @param args - The arguments after the program name, such as `["ready", "--json"]`.
+ * @param ports - Output, store, sources, facts and the abort signal.
+ * @param identity - The name and version the program presents.
+ * @returns The exit status, one of `exitCodes`.
+ */
+export const runCli = async (
+  args: readonly string[],
+  ports: CliPorts,
+  identity: ProgramIdentity,
+): Promise<ExitCode> => {
+  let exitCode: ExitCode = exitCodes.success;
+
+  const program = new Command(identity.name);
+  program
+    .description(
+      "Sync work from its sources into a process model, and ask what is ready, blocked, on the critical path or handed off, why, and what it looks like as a diagram.",
+    )
+    .version(identity.version)
+    .configureOutput({ writeOut: ports.stdout, writeErr: ports.stderr })
+    .configureHelp({ showGlobalOptions: true })
+    .exitOverride()
+    .option(
+      "--data <path>",
+      "the SQLite file the store keeps",
+      ports.defaultDataPath,
+    )
+    .option("--model <id>", "the model in the store", defaultModelId)
+    .option("--json", "write the result as JSON")
+    .addHelpText("after", exitStatusHelp)
+    .showHelpAfterError();
+
+  /** Writes a command's result, as JSON or text, and records its exit status. */
+  const respond = (globals: GlobalOptions, outcome: Outcome): void => {
+    ports.stdout(
+      globals.json
+        ? `${JSON.stringify(outcome.json, null, 2)}\n`
+        : outcome.text,
+    );
+    exitCode = outcome.exitCode ?? exitCodes.success;
+  };
+
+  /** Opens the store for one command, runs it, writes its result and records its exit status; the store is closed whatever happens. */
+  const withSession =
+    <Args extends unknown[]>(
+      handler: (session: GraphSession, ...values: Args) => Promise<Outcome>,
+    ) =>
+    async (command: Command, ...values: Args): Promise<void> => {
+      const globals = readGlobals(command, ports);
+      const opened = await ports.openStore(globals.data);
+      try {
+        const outcome = await handler(
+          {
+            store: opened.client,
+            modelId: globals.model,
+            facts: ports.facts,
+            signal: ports.signal,
+          },
+          ...values,
+        );
+        respond(globals, outcome);
+      } finally {
+        await opened.close();
+      }
+    };
+
+  program
+    .command("sync")
+    .description(
+      "read the scopes from their sources and merge them into the model",
+    )
+    .argument(
+      "<scope...>",
+      "source-qualified scopes, such as github:owner or github:owner/repo",
+    )
+    .option("--after <cursor>", "resume an interrupted sync after this cursor")
+    .action(
+      async (
+        scopes: readonly string[],
+        options: Record<string, unknown>,
+        command: Command,
+      ) => {
+        const { after } = options;
+        await withSession(async (session) => {
+          const result = await sync(
+            session,
+            ports.source,
+            typeof after === "string" ? { scopes, after } : { scopes },
+          );
+
+          return { json: result, text: renderSync(result) };
+        })(command);
+      },
+    );
+
+  program
+    .command("ready")
+    .description("list the work that can start now")
+    .action(async (_options: unknown, command: Command) => {
+      await withSession(async (session) => {
+        const result = await ready(session);
+
+        return { json: result, text: renderReady(result) };
+      })(command);
+    });
+
+  program
+    .command("blocked")
+    .description("list the open work an element is waiting on")
+    .argument("<id>", "the element")
+    .action(async (id: string, _options: unknown, command: Command) => {
+      await withSession(async (session) => {
+        const result = await blocked(session, id);
+
+        return { json: result, text: renderBlocked(result) };
+      })(command);
+    });
+
+  program
+    .command("impact")
+    .description("list the live work that depends on an element")
+    .argument("<id>", "the element")
+    .action(async (id: string, _options: unknown, command: Command) => {
+      await withSession(async (session) => {
+        const result = await impactOf(session, id);
+
+        return { json: result, text: renderImpact(result) };
+      })(command);
+    });
+
+  program
+    .command("path")
+    .description(
+      "list the critical path: the longest chain of work still ahead",
+    )
+    .action(async (_options: unknown, command: Command) => {
+      await withSession(async (session) => {
+        const result = await path(session);
+
+        return { json: result, text: renderPath(result) };
+      })(command);
+    });
+
+  program
+    .command("cycles")
+    .description(
+      "list the cycles no decision closes; exits with the invalid model status when there are any",
+    )
+    .action(async (_options: unknown, command: Command) => {
+      await withSession(async (session) => {
+        const result = await cycles(session);
+
+        return {
+          json: result,
+          text: renderCycles(result),
+          exitCode:
+            result.cycles.length === 0
+              ? exitCodes.success
+              : exitCodes.invalidModel,
+        };
+      })(command);
+    });
+
+  program
+    .command("handoffs")
+    .description("list the transitions from one actor's work to another's")
+    .action(async (_options: unknown, command: Command) => {
+      await withSession(async (session) => {
+        const result = await handoffsOf(session);
+
+        return { json: result, text: renderHandoffs(result) };
+      })(command);
+    });
+
+  program
+    .command("why")
+    .description(
+      "explain an element's status: the rule that decided it, its needs and the blocked-by chain",
+    )
+    .argument("<id>", "the element")
+    .action(async (id: string, _options: unknown, command: Command) => {
+      await withSession(async (session) => {
+        const result = await why(session, id);
+
+        return { json: result, text: renderWhy(result) };
+      })(command);
+    });
+
+  program
+    .command("show")
+    .description("draw the model as a view")
+    .addOption(
+      new Option("--view <view>", "the view to draw")
+        .choices(viewNames)
+        .default("flowchart"),
+    )
+    .addOption(
+      new Option("--format <format>", "the format to write")
+        .choices(formatNames)
+        .default("mermaid"),
+    )
+    .option(
+      "--subject <entity>",
+      "the entity a state view follows; defaults to the model's declared state machine projection",
+    )
+    .option(
+      "--scenario <transition...>",
+      "the transitions a sequence view follows, in order; defaults to the model's declared sequence projection",
+    )
+    .action(async (options: Record<string, unknown>, command: Command) => {
+      const view: ViewName = choice(viewNames, options.view, "view");
+      const format: FormatName = choice(formatNames, options.format, "format");
+      const { subject, scenario } = options;
+      await withSession(async (session) => {
+        const result = await show(session, {
+          view,
+          format,
+          ...(typeof subject === "string" ? { subject } : {}),
+          ...(Array.isArray(scenario)
+            ? {
+                scenario: scenario.filter(
+                  (id): id is string => typeof id === "string",
+                ),
+              }
+            : {}),
+        });
+
+        return {
+          json:
+            format === "json"
+              ? result.projection
+              : { view, format, text: result.text },
+          text: result.text,
+        };
+      })(command);
+    });
+
+  const addCommand = program
+    .command("add")
+    .description("add a record to the model, creating the model if needed");
+
+  const added = async (
+    command: Command,
+    addition: Addition,
+    kind: string,
+  ): Promise<void> =>
+    withSession(async (session) => {
+      const written = await add(session, addition);
+
+      return {
+        json: {
+          added: kind,
+          id: addition.record.id,
+          revision: written.revision,
+        },
+        text: renderAdded(kind, addition.record.id, written),
+      };
+    })(command);
+
+  addCommand
+    .command("participant")
+    .description(
+      "add a participant: a role or system that acts, or an entity with a lifecycle",
+    )
+    .argument("<id>", "its identifier")
+    .argument("<label>", "its label")
+    .addOption(
+      new Option("--kind <kind>", "what it is")
+        .choices(participantKinds)
+        .default("role"),
+    )
+    .action(
+      async (
+        id: string,
+        label: string,
+        options: Record<string, unknown>,
+        command: Command,
+      ) => {
+        const kind: ParticipantKind = choice(
+          participantKinds,
+          options.kind,
+          "kind",
+        );
+        await added(
+          command,
+          { kind: "participant", record: { id, label, kind } },
+          "participant",
+        );
+      },
+    );
+
+  addCommand
+    .command("activity")
+    .description("add an activity: a step of work")
+    .argument("<id>", "its identifier")
+    .argument("<label>", "its label")
+    .option("--actor <participant>", "the role or system that does it")
+    .action(
+      async (
+        id: string,
+        label: string,
+        options: Record<string, unknown>,
+        command: Command,
+      ) => {
+        const { actor } = options;
+        await added(
+          command,
+          {
+            kind: "element",
+            record: {
+              kind: "activity",
+              id,
+              label,
+              ...(typeof actor === "string" ? { actor } : {}),
+            },
+          },
+          "activity",
+        );
+      },
+    );
+
+  addCommand
+    .command("decision")
+    .description("add a decision: a point where the flow branches")
+    .argument("<id>", "its identifier")
+    .argument("<label>", "its label, the question it asks")
+    .option("--actor <participant>", "the role or system that decides")
+    .action(
+      async (
+        id: string,
+        label: string,
+        options: Record<string, unknown>,
+        command: Command,
+      ) => {
+        const { actor } = options;
+        await added(
+          command,
+          {
+            kind: "element",
+            record: {
+              kind: "decision",
+              id,
+              label,
+              ...(typeof actor === "string" ? { actor } : {}),
+            },
+          },
+          "decision",
+        );
+      },
+    );
+
+  addCommand
+    .command("state")
+    .description("add a state an entity rests in")
+    .argument("<id>", "its identifier")
+    .argument("<label>", "its label")
+    .option("--parent <state>", "the state it is nested in")
+    .action(
+      async (
+        id: string,
+        label: string,
+        options: Record<string, unknown>,
+        command: Command,
+      ) => {
+        const { parent } = options;
+        await added(
+          command,
+          {
+            kind: "element",
+            record: {
+              kind: "state",
+              id,
+              label,
+              ...(typeof parent === "string" ? { parent } : {}),
+            },
+          },
+          "state",
+        );
+      },
+    );
+
+  addCommand
+    .command("event")
+    .description("add an event that can trigger a transition")
+    .argument("<id>", "its identifier")
+    .argument("<name>", "its name")
+    .action(
+      async (id: string, name: string, _options: unknown, command: Command) => {
+        await added(command, { kind: "event", record: { id, name } }, "event");
+      },
+    );
+
+  addCommand
+    .command("artefact")
+    .description("add an artefact that activities consume or produce")
+    .argument("<id>", "its identifier")
+    .argument("<name>", "its name")
+    .option(
+      "--deliverable",
+      "mark it as an output the process exists to deliver",
+    )
+    .action(
+      async (
+        id: string,
+        name: string,
+        options: Record<string, unknown>,
+        command: Command,
+      ) => {
+        await added(
+          command,
+          {
+            kind: "artefact",
+            record:
+              options.deliverable === true
+                ? { id, name, deliverable: true }
+                : { id, name },
+          },
+          "artefact",
+        );
+      },
+    );
+
+  addCommand
+    .command("transition")
+    .description("add a transition: the target waits on the source")
+    .argument("<source>", "the element that comes first")
+    .argument("<target>", "the element that follows")
+    .option(
+      "--id <id>",
+      "its identifier; <source>-><target> when not given, as a source names its transitions",
+    )
+    .option("--guard <label>", "the label of the branch it takes")
+    .option("--trigger <event>", "the event that fires it")
+    .action(
+      async (
+        source: string,
+        target: string,
+        options: Record<string, unknown>,
+        command: Command,
+      ) => {
+        const { id, guard, trigger } = options;
+        await added(
+          command,
+          {
+            kind: "transition",
+            record: {
+              id: typeof id === "string" ? id : `${source}->${target}`,
+              source,
+              target,
+              ...(typeof guard === "string" ? { guard } : {}),
+              ...(typeof trigger === "string" ? { trigger } : {}),
+            },
+          },
+          "transition",
+        );
+      },
+    );
+
+  program
+    .command("set")
+    .description("set an element's run state")
+    .argument("<id>", "the element")
+    .addArgument(
+      new Argument("<state>", "its run state").choices(overlayStatuses),
+    )
+    .action(
+      async (
+        id: string,
+        state: string,
+        _options: unknown,
+        command: Command,
+      ) => {
+        const status: OverlayStatus = choice(overlayStatuses, state, "state");
+        await withSession(async (session) => {
+          const result = await setState(session, id, status);
+
+          return { json: result, text: renderSet(result) };
+        })(command);
+      },
+    );
+
+  program
+    .command("validate")
+    .description(
+      "check the stored model, or a model file, for problems; exits with the invalid model status when there are any",
+    )
+    .argument("[file]", "a model as JSON, checked instead of the stored model")
+    .action(
+      async (file: string | undefined, _options: unknown, command: Command) => {
+        const outcome = (
+          result: ReturnType<typeof validateDocument>,
+        ): Outcome => ({
+          json: result,
+          text: renderValidate(result),
+          exitCode: result.valid ? exitCodes.success : exitCodes.invalidModel,
+        });
+        if (file === undefined) {
+          await withSession(async (session) =>
+            outcome(await validateStored(session)),
+          )(command);
+
+          return;
+        }
+        respond(
+          readGlobals(command, ports),
+          outcome(validateDocument(await ports.readFile(file, ports.signal))),
+        );
+      },
+    );
+
+  try {
+    await program.parseAsync(args, { from: "user" });
+  } catch (error) {
+    const failure = failureOf(error);
+    if (failure.message !== "") {
+      ports.stderr(`${failure.message}\n`);
+    }
+
+    return failure.exitCode;
+  }
+
+  return exitCode;
+};
diff --git a/packages/targets/graph-cli/src/queries.ts b/packages/targets/graph-cli/src/queries.ts
new file mode 100644
index 0000000..1f55d9d
--- /dev/null
+++ b/packages/targets/graph-cli/src/queries.ts
@@ -0,0 +1,215 @@
+import {
+  blockedBy,
+  criticalPath,
+  deriveStatuses,
+  explainStatus,
+  illegalCycles,
+  impact,
+  readySet,
+  type ArtefactBasis,
+  type IncomingBasis,
+  type Status,
+  type StatusRule,
+} from "@exadev/process-graph-domain";
+import { handoffs, type Handoff } from "@exadev/process-graph-projection";
+import type { OpenIds } from "@exadev/process-graph-schema";
+import {
+  labelOf,
+  loadRun,
+  requireElement,
+  summarise,
+  type ElementSummary,
+  type GraphSession,
+} from "./session.ts";
+
+/** An element with its derived status. */
+export interface ElementStatus extends ElementSummary {
+  readonly status: Status;
+}
+
+/** Every element that can be worked on now. */
+export interface ReadyResult {
+  readonly elements: readonly ElementSummary[];
+}
+
+/** What an element is waiting on. */
+export interface BlockedResult {
+  readonly element: ElementStatus;
+  /** The open work to finish first: the ends of the element's blocked-by chain, in model order. */
+  readonly blockedBy: readonly ElementSummary[];
+}
+
+/** What finishing, delaying or dropping an element affects. */
+export interface ImpactResult {
+  readonly element: ElementStatus;
+  /** The live elements that transitively depend on it, in model order. */
+  readonly impacted: readonly ElementSummary[];
+}
+
+/** The longest chain of work still ahead. */
+export interface PathResult {
+  /** The chain in dependency order. */
+  readonly path: readonly ElementSummary[];
+  /** Its length in elements, each counting one step. */
+  readonly weight: number;
+}
+
+/** The cycles no decision closes. */
+export interface CyclesResult {
+  /** Each cycle as a closed path: each element needs the next, and the first is repeated at the end. */
+  readonly cycles: readonly (readonly string[])[];
+}
+
+/** The transitions between elements with different actors. */
+export interface HandoffsResult {
+  readonly handoffs: readonly Handoff<OpenIds>[];
+}
+
+/** One element of a blocked-by chain, with its label and status. */
+export interface WhyLink extends ElementStatus {
+  /** The unfinished needs it still waits on, in model order. */
+  readonly waitingOn: readonly string[];
+}
+
+/** Why an element has its status. */
+export interface WhyResult {
+  readonly element: ElementStatus;
+  /** The rule of the status derivation that decided it. */
+  readonly rule: StatusRule;
+  /** Its incoming transitions other than loop edges, each with its branch, its source's status and whether it is cut. */
+  readonly transitions: readonly IncomingBasis<OpenIds>[];
+  /** The artefacts it consumes, each with whether it is provided and its producers' statuses. */
+  readonly artefacts: readonly ArtefactBasis<OpenIds>[];
+  /** The element, then every unfinished need reached from it, in model order. */
+  readonly chain: readonly WhyLink[];
+}
+
+/** Each element counts as one step, so the critical path is the longest chain of elements. */
+const stepWeight = 1;
+
+/**
+ * The elements that are ready: not done, with every live need done.
+ * @param session - The store, model and facts.
+ */
+export const ready = async (session: GraphSession): Promise<ReadyResult> => {
+  const { model, overlay } = await loadRun(session);
+
+  return {
+    elements: summarise(model, readySet(model, overlay, session.facts)),
+  };
+};
+
+const statusOf = (
+  statuses: ReadonlyMap<string, Status>,
+  summary: ElementSummary,
+): ElementStatus => {
+  const status = statuses.get(summary.id);
+  if (status === undefined) {
+    throw new Error(`no status was derived for "${summary.id}"`);
+  }
+
+  return { ...summary, status };
+};
+
+/**
+ * What an element is waiting on.
+ * @param session - The store, model and facts.
+ * @param id - The element asked about.
+ */
+export const blocked = async (
+  session: GraphSession,
+  id: string,
+): Promise<BlockedResult> => {
+  const { model, overlay } = await loadRun(session);
+  const element = requireElement(model, id);
+  const statuses = deriveStatuses(model, overlay, session.facts);
+
+  return {
+    element: statusOf(statuses, { id, label: labelOf(element) }),
+    blockedBy: summarise(model, blockedBy(model, overlay, session.facts, id)),
+  };
+};
+
+/**
+ * What depends on an element.
+ * @param session - The store, model and facts.
+ * @param id - The element asked about.
+ */
+export const impactOf = async (
+  session: GraphSession,
+  id: string,
+): Promise<ImpactResult> => {
+  const { model, overlay } = await loadRun(session);
+  const element = requireElement(model, id);
+  const statuses = deriveStatuses(model, overlay, session.facts);
+
+  return {
+    element: statusOf(statuses, { id, label: labelOf(element) }),
+    impacted: summarise(model, impact(model, overlay, session.facts, id)),
+  };
+};
+
+/**
+ * The critical path: the longest chain through the work still ahead.
+ * @param session - The store, model and facts.
+ */
+export const path = async (session: GraphSession): Promise<PathResult> => {
+  const { model, overlay } = await loadRun(session);
+  const found = criticalPath(model, overlay, session.facts, () => stepWeight);
+
+  return { path: summarise(model, found.path), weight: found.weight };
+};
+
+/**
+ * The cycles of the model that no decision closes, which make every status undefined.
+ * @param session - The store and model.
+ */
+export const cycles = async (session: GraphSession): Promise<CyclesResult> => {
+  const { model } = await loadRun(session);
+
+  return { cycles: illegalCycles(model) };
+};
+
+/**
+ * The hand-offs: transitions from one actor's work to another's.
+ * @param session - The store and model.
+ */
+export const handoffsOf = async (
+  session: GraphSession,
+): Promise<HandoffsResult> => {
+  const { model } = await loadRun(session);
+
+  return { handoffs: handoffs(model) };
+};
+
+/**
+ * Why an element has its status, and the chain of unfinished work behind it.
+ * @param session - The store, model and facts.
+ * @param id - The element asked about.
+ */
+export const why = async (
+  session: GraphSession,
+  id: string,
+): Promise<WhyResult> => {
+  const { model, overlay } = await loadRun(session);
+  requireElement(model, id);
+  const explained = explainStatus(model, overlay, session.facts, id);
+  const chain = explained.chain.map((link) => ({
+    id: link.element,
+    label: labelOf(requireElement(model, link.element)),
+    status: link.status,
+    waitingOn: link.waitingOn,
+  }));
+  const [first] = chain;
+  if (first === undefined) {
+    throw new Error(`the explanation of "${id}" has no chain`);
+  }
+
+  return {
+    element: { id: first.id, label: first.label, status: first.status },
+    rule: explained.rule,
+    transitions: explained.transitions,
+    artefacts: explained.artefacts,
+    chain,
+  };
+};
diff --git a/packages/targets/graph-cli/src/render.ts b/packages/targets/graph-cli/src/render.ts
new file mode 100644
index 0000000..da8500c
--- /dev/null
+++ b/packages/targets/graph-cli/src/render.ts
@@ -0,0 +1,142 @@
+import type { Status, StatusRule } from "@exadev/process-graph-domain";
+import type { Written, SetResult } from "./edit.ts";
+import type {
+  BlockedResult,
+  CyclesResult,
+  HandoffsResult,
+  ImpactResult,
+  PathResult,
+  ReadyResult,
+  WhyResult,
+} from "./queries.ts";
+import type { ElementSummary } from "./session.ts";
+import type { SyncResult } from "./sync.ts";
+import type { ValidateResult } from "./validate.ts";
+
+/**
+ * Text renderings of each command's result. Lists are one item per line with tab-separated fields, so they cut, sort and grep cleanly, and an empty list prints nothing. Every rendering ends with a line break when it is not empty.
+ */
+const lines = (rows: readonly string[]): string =>
+  rows.length === 0 ? "" : `${rows.join("\n")}\n`;
+
+const elementRows = (elements: readonly ElementSummary[]): readonly string[] =>
+  elements.map((element) => `${element.id}\t${element.label}`);
+
+/** `ready`: each ready element's identifier and label. */
+export const renderReady = (result: ReadyResult): string =>
+  lines(elementRows(result.elements));
+
+/** `blocked`: each element at the end of the blocked-by chain. */
+export const renderBlocked = (result: BlockedResult): string =>
+  lines(elementRows(result.blockedBy));
+
+/** `impact`: each element that depends on the one asked about. */
+export const renderImpact = (result: ImpactResult): string =>
+  lines(elementRows(result.impacted));
+
+/** `path`: the critical path, one element per line in dependency order. */
+export const renderPath = (result: PathResult): string =>
+  lines(elementRows(result.path));
+
+/** `cycles`: each illegal cycle as a closed path. */
+export const renderCycles = (result: CyclesResult): string =>
+  lines(result.cycles.map((cycle) => cycle.join(" -> ")));
+
+/** `handoffs`: each hand-off's transition and the actors it passes between. */
+export const renderHandoffs = (result: HandoffsResult): string =>
+  lines(
+    result.handoffs.map(
+      (handoff) => `${handoff.transition}\t${handoff.from} -> ${handoff.to}`,
+    ),
+  );
+
+/** The sentence that says why each rule gives its status. `needs-met` gives a decision or pseudo-state `done` rather than `ready`, and says so. */
+const ruleSentences: Readonly<Record<StatusRule, string>> = {
+  "overlay-done": "its run state is done",
+  "overlay-unknown": "its run state is unknown",
+  "unknown-need":
+    "something it needs is unknown, or a condition on the way to it cannot be decided",
+  "all-cut": "every transition into it is cut",
+  "needs-met": "everything it needs is done",
+  waiting: "it waits on work that is not done",
+};
+
+const ruleSentence = (rule: StatusRule, status: Status): string =>
+  rule === "needs-met" && status === "done"
+    ? "it is a decision or pseudo-state and everything it needs is done"
+    : ruleSentences[rule];
+
+/** `why`: the status and the rule behind it, then its needs, its artefacts and the blocked-by chain, each section only when it has something in it. */
+export const renderWhy = (result: WhyResult): string => {
+  const { element } = result;
+  const needs = result.transitions.map((transition) => {
+    const notes = [
+      ...(transition.branch === "taken"
+        ? []
+        : [`condition ${transition.branch}`]),
+      ...(transition.cut ? ["cut"] : []),
+    ];
+
+    return `  ${transition.source} (${transition.sourceStatus}) through ${transition.transition}${notes.length === 0 ? "" : `, ${notes.join(", ")}`}`;
+  });
+  const artefacts = result.artefacts.map((artefact) => {
+    const producers =
+      artefact.producers.length === 0
+        ? "produced by nothing"
+        : `produced by ${artefact.producers
+            .map((producer) => `${producer.element} (${producer.status})`)
+            .join(", ")}`;
+
+    return `  ${artefact.artefact}: ${artefact.provided ? "provided" : "not provided"}, ${producers}`;
+  });
+  const chain =
+    result.chain.length > 1 ||
+    result.chain.some((link) => link.waitingOn.length > 0)
+      ? result.chain.map(
+          (link) =>
+            `  ${link.id} (${link.status})${link.waitingOn.length === 0 ? "" : ` waits on ${link.waitingOn.join(", ")}`}`,
+        )
+      : [];
+
+  return lines([
+    `${element.id} is ${element.status}: ${ruleSentence(result.rule, element.status)}`,
+    ...(needs.length === 0 ? [] : ["needs:", ...needs]),
+    ...(artefacts.length === 0 ? [] : ["artefacts:", ...artefacts]),
+    ...(chain.length === 0 ? [] : ["blocked-by chain:", ...chain]),
+  ]);
+};
+
+/** `add`: what was added and the revision it took. */
+export const renderAdded = (
+  kind: string,
+  id: string,
+  written: Written,
+): string =>
+  lines([`added ${kind} ${id} at revision ${String(written.revision)}`]);
+
+/** `set`: the element's new run state and the revision it took. */
+export const renderSet = (result: SetResult): string =>
+  lines([
+    `set ${result.element} to ${result.state} at revision ${String(result.revision)}`,
+  ]);
+
+/** `sync`: what was written, then each gap as its reason, target and message. */
+export const renderSync = (result: SyncResult): string =>
+  lines([
+    `synced ${String(result.activities)} activities, ${String(result.transitions)} transitions and ${String(result.participants)} participants into "${result.modelId}" at revision ${String(result.revision)}`,
+    ...result.gaps.map(
+      (gap) => `gap\t${gap.reason}\t${gap.target}\t${gap.message}`,
+    ),
+  ]);
+
+/** `validate`: `valid`, or each issue as its code, its JSON pointer when it has one, and its message. */
+export const renderValidate = (result: ValidateResult): string =>
+  result.valid
+    ? lines(["valid"])
+    : lines(
+        result.issues.map((issue) =>
+          issue.pointer === undefined
+            ? `${issue.code}\t${issue.message}`
+            : `${issue.code}\t${issue.pointer === "" ? "/" : issue.pointer}\t${issue.message}`,
+        ),
+      );
diff --git a/packages/targets/graph-cli/src/session.ts b/packages/targets/graph-cli/src/session.ts
new file mode 100644
index 0000000..a09ca38
--- /dev/null
+++ b/packages/targets/graph-cli/src/session.ts
@@ -0,0 +1,121 @@
+import type { Facts } from "@exadev/process-graph-domain";
+import type {
+  Element,
+  Model,
+  OpenIds,
+  Overlay,
+} from "@exadev/process-graph-schema";
+import type { GraphStoreClient } from "@exadev/process-graph-store-contract";
+import { ORPCError } from "@orpc/server";
+import { CliError } from "./errors.ts";
+import { exitCodes } from "./exit-codes.ts";
+
+/** What every operation works against: one model in one store, the facts its conditions read, and the signal that aborts its calls. */
+export interface GraphSession {
+  readonly store: GraphStoreClient;
+  /** The name the model is filed under in the store. */
+  readonly modelId: string;
+  readonly facts: Facts;
+  readonly signal: AbortSignal | undefined;
+}
+
+/** A stored model and its run state, as an operation reads them. */
+export interface StoredRun {
+  readonly revision: number;
+  readonly model: Model<OpenIds>;
+  readonly overlay: Overlay<OpenIds>;
+}
+
+/** An element as commands report it: its identifier and its human label. */
+export interface ElementSummary {
+  readonly id: string;
+  readonly label: string;
+}
+
+/**
+ * The oRPC client options carrying the session's signal. The key is left out when there is no signal, since the options type does not accept an explicit `undefined`.
+ * @param signal - The signal, if any.
+ */
+export const callOptions = (
+  signal: AbortSignal | undefined,
+): { readonly signal?: AbortSignal } =>
+  signal === undefined ? {} : { signal };
+
+/**
+ * Reads the session's model and run state, if the store has the model.
+ * @param session - The store and model.
+ * @returns The stored run, or `undefined` when the store has no such model.
+ */
+export const findRun = async (
+  session: GraphSession,
+): Promise<StoredRun | undefined> => {
+  try {
+    const stored = await session.store.v1.models.load(
+      { modelId: session.modelId },
+      callOptions(session.signal),
+    );
+
+    return {
+      revision: stored.revision,
+      model: stored.model,
+      overlay: stored.overlay,
+    };
+  } catch (error) {
+    if (error instanceof ORPCError && error.code === "NOT_FOUND") {
+      return undefined;
+    }
+    throw error;
+  }
+};
+
+/**
+ * Loads the session's model and run state.
+ * @param session - The store and model.
+ * @returns The stored run.
+ * @throws CliError with `notFound` when the store has no such model.
+ */
+export const loadRun = async (session: GraphSession): Promise<StoredRun> => {
+  const run = await findRun(session);
+  if (run === undefined) {
+    throw new CliError(
+      exitCodes.notFound,
+      `no model "${session.modelId}" in the store; sync or add something first`,
+    );
+  }
+
+  return run;
+};
+
+/** The label an element is shown with: its own label, or for a pseudo-state, its role. */
+export const labelOf = (element: Element<string, OpenIds>): string =>
+  element.kind === "pseudo" ? element.role : element.label;
+
+/**
+ * Looks an element up by identifier.
+ * @param model - The model to read.
+ * @param id - The element asked about.
+ * @returns The element.
+ * @throws CliError with `notFound` when the model declares no such element.
+ */
+export const requireElement = (
+  model: Model<OpenIds>,
+  id: string,
+): Element<string, OpenIds> => {
+  const element = model.elements.find((candidate) => candidate.id === id);
+  if (element === undefined) {
+    throw new CliError(exitCodes.notFound, `no element "${id}" in the model`);
+  }
+
+  return element;
+};
+
+/**
+ * Summaries of elements, in the order given.
+ * @param model - The model the identifiers belong to.
+ * @param ids - The element identifiers.
+ */
+export const summarise = (
+  model: Model<OpenIds>,
+  ids: readonly string[],
+): readonly ElementSummary[] =>
+  ids.map((id) => ({ id, label: labelOf(requireElement(model, id)) }));
diff --git a/packages/targets/graph-cli/src/show.ts b/packages/targets/graph-cli/src/show.ts
new file mode 100644
index 0000000..3fa9a3d
--- /dev/null
+++ b/packages/targets/graph-cli/src/show.ts
@@ -0,0 +1,222 @@
+import {
+  toFlowchart,
+  toSequence,
+  toStateMachine,
+  toSwimlane,
+  type Flowchart,
+  type SequenceDiagram,
+  type StateMachine,
+  type Swimlane,
+} from "@exadev/process-graph-projection";
+import type { Model, OpenIds } from "@exadev/process-graph-schema";
+import {
+  flowchartToDot,
+  sequenceToDot,
+  stateMachineToDot,
+  swimlaneToDot,
+} from "./emit/dot.ts";
+import {
+  flowchartToMermaid,
+  sequenceToMermaid,
+  stateMachineToMermaid,
+  swimlaneToMermaid,
+} from "./emit/mermaid.ts";
+import { CliError } from "./errors.ts";
+import { exitCodes } from "./exit-codes.ts";
+import { loadRun, type GraphSession } from "./session.ts";
+
+/** The views `show` draws, as named on the command line. */
+export const viewNames = [
+  "flowchart",
+  "swimlane",
+  "state",
+  "sequence",
+] as const;
+
+/** One of the views `show` draws. */
+export type ViewName = (typeof viewNames)[number];
+
+/** The formats `show` writes. */
+export const formatNames = ["json", "mermaid", "dot"] as const;
+
+/** One of the formats `show` writes. */
+export type FormatName = (typeof formatNames)[number];
+
+/** What to draw. */
+export interface ShowRequest {
+  readonly view: ViewName;
+  readonly format: FormatName;
+  /** The entity a state machine follows; the model's declared state machine projection when absent. */
+  readonly subject?: string;
+  /** The transitions a sequence diagram follows, in order; the model's declared sequence projection when absent. */
+  readonly scenario?: readonly string[];
+}
+
+/** A projected view, tagged by which it is. */
+export type ProjectedView =
+  | { readonly view: "flowchart"; readonly projection: Flowchart<OpenIds> }
+  | { readonly view: "swimlane"; readonly projection: Swimlane<OpenIds> }
+  | { readonly view: "state"; readonly projection: StateMachine<OpenIds> }
+  | {
+      readonly view: "sequence";
+      readonly projection: SequenceDiagram<OpenIds>;
+    };
+
+/** A drawn view: the projection, and its text in the requested format (the projection as JSON for `json`). */
+export type ShowResult = ProjectedView & {
+  readonly format: FormatName;
+  readonly text: string;
+};
+
+const subjectOf = (
+  model: Model<OpenIds>,
+  given: string | undefined,
+): string => {
+  const subject =
+    given ??
+    model.projections.find(
+      (projection) => projection.notation === "stateMachine",
+    )?.subject;
+  if (subject === undefined) {
+    throw new CliError(
+      exitCodes.usage,
+      "the state view needs --subject <entity>: the model declares no state machine projection",
+    );
+  }
+  const participant = model.participants.find(
+    (candidate) => candidate.id === subject,
+  );
+  if (participant === undefined) {
+    throw new CliError(
+      exitCodes.notFound,
+      `no participant "${subject}" in the model`,
+    );
+  }
+  if (participant.kind !== "entity") {
+    throw new CliError(
+      exitCodes.usage,
+      `"${subject}" is a ${participant.kind}; a state machine follows an entity`,
+    );
+  }
+
+  return subject;
+};
+
+const scenarioOf = (
+  model: Model<OpenIds>,
+  given: readonly string[] | undefined,
+): readonly string[] => {
+  const scenario =
+    given ??
+    model.projections.find((projection) => projection.notation === "sequence")
+      ?.scenario;
+  if (scenario === undefined) {
+    throw new CliError(
+      exitCodes.usage,
+      "the sequence view needs --scenario <transition...>: the model declares no sequence projection",
+    );
+  }
+  const declared = new Set(
+    model.transitions.map((transition) => transition.id),
+  );
+  const unknown = scenario.filter((id) => !declared.has(id));
+  if (unknown.length > 0) {
+    throw new CliError(
+      exitCodes.notFound,
+      `no transition ${unknown.map((id) => `"${id}"`).join(", ")} in the model`,
+    );
+  }
+
+  return scenario;
+};
+
+/**
+ * Projects a model into a view.
+ * @param model - The model.
+ * @param request - The view, and the subject or scenario it needs.
+ * @returns The projection, tagged by view.
+ * @throws CliError with `usage` when a state machine or sequence diagram has nothing to follow, or the subject is not an entity, and with `notFound` when the subject or a scenario transition does not exist.
+ */
+export const project = (
+  model: Model<OpenIds>,
+  request: Pick<ShowRequest, "view" | "subject" | "scenario">,
+): ProjectedView => {
+  if (request.view === "flowchart") {
+    return { view: "flowchart", projection: toFlowchart(model) };
+  }
+  if (request.view === "swimlane") {
+    return { view: "swimlane", projection: toSwimlane(model) };
+  }
+  if (request.view === "state") {
+    return {
+      view: "state",
+      projection: toStateMachine(model, subjectOf(model, request.subject)),
+    };
+  }
+
+  return {
+    view: "sequence",
+    projection: toSequence(model, scenarioOf(model, request.scenario)),
+  };
+};
+
+/**
+ * Writes a projected view as Mermaid or DOT source.
+ * @param model - The model, for participant labels.
+ * @param projected - The view.
+ * @param format - `mermaid` or `dot`.
+ * @returns The diagram source.
+ */
+export const emit = (
+  model: Model<OpenIds>,
+  projected: ProjectedView,
+  format: Exclude<FormatName, "json">,
+): string => {
+  const labels = new Map(
+    model.participants.map((participant) => [
+      participant.id,
+      participant.label,
+    ]),
+  );
+  // An actor a loaded model names without declaring has no label of its own, so it is shown by its identifier, as the swimlane projection labels its lane.
+  const participantLabel = (id: string): string => labels.get(id) ?? id;
+  const mermaid = format === "mermaid";
+  if (projected.view === "flowchart") {
+    return mermaid
+      ? flowchartToMermaid(projected.projection)
+      : flowchartToDot(projected.projection);
+  }
+  if (projected.view === "swimlane") {
+    return mermaid
+      ? swimlaneToMermaid(projected.projection)
+      : swimlaneToDot(projected.projection);
+  }
+  if (projected.view === "state") {
+    return mermaid
+      ? stateMachineToMermaid(projected.projection)
+      : stateMachineToDot(projected.projection);
+  }
+
+  return mermaid
+    ? sequenceToMermaid(projected.projection, participantLabel)
+    : sequenceToDot(projected.projection, participantLabel);
+};
+
+/**
+ * Draws the session's model as a view in a format.
+ * @param session - The store and model.
+ * @param request - The view, format, and the subject or scenario the view needs.
+ */
+export const show = async (
+  session: GraphSession,
+  request: ShowRequest,
+): Promise<ShowResult> => {
+  const { model } = await loadRun(session);
+  const projected = project(model, request);
+  const text =
+    request.format === "json"
+      ? `${JSON.stringify(projected.projection, null, 2)}\n`
+      : emit(model, projected, request.format);
+
+  return { ...projected, format: request.format, text };
+};
diff --git a/packages/targets/graph-cli/src/sync.ts b/packages/targets/graph-cli/src/sync.ts
new file mode 100644
index 0000000..4c813d6
--- /dev/null
+++ b/packages/targets/graph-cli/src/sync.ts
@@ -0,0 +1,175 @@
+import {
+  assembleSync,
+  type Gap,
+  type GraphSourceClient,
+  type SyncPage,
+} from "@exadev/process-graph-source-contract";
+import type { BoundActivity } from "@exadev/process-graph-store-contract";
+import { CliError, failureOf } from "./errors.ts";
+import { exitCodes } from "./exit-codes.ts";
+import { callOptions, type GraphSession } from "./session.ts";
+
+/** Finds the source that serves scopes with an identifier prefix, such as `github`. */
+export type SourceLookup = (prefix: string) => GraphSourceClient | undefined;
+
+/** What to sync. */
+export interface SyncRequest {
+  /** Source-qualified scope identifiers, such as `github:owner` or `github:owner/repo`, read in order. */
+  readonly scopes: readonly string[];
+  /** A cursor from an interrupted sync: the first source's sync continues after it. */
+  readonly after?: string;
+}
+
+/** What a sync wrote. */
+export interface SyncResult {
+  readonly modelId: string;
+  /** The revision the write took. */
+  readonly revision: number;
+  /** The participants, activities and transitions written, each identifier counted once. */
+  readonly participants: number;
+  readonly activities: number;
+  readonly transitions: number;
+  /** The parts of the scope the sources could not read, in the order they were met. */
+  readonly gaps: readonly Gap[];
+}
+
+/** The scopes of one source, in the order given. */
+interface SourceScopes {
+  readonly prefix: string;
+  readonly scopes: readonly string[];
+}
+
+const scopeSeparator = ":";
+
+/** Groups scopes by their source prefix, keeping the order in which each prefix first appears. */
+const bySource = (scopes: readonly string[]): readonly SourceScopes[] => {
+  const groups = new Map<string, string[]>();
+  for (const scope of scopes) {
+    const separator = scope.indexOf(scopeSeparator);
+    if (separator <= 0) {
+      throw new CliError(
+        exitCodes.usage,
+        `"${scope}" is not a scope: write <source>:<scope>, such as github:owner/repo`,
+      );
+    }
+    const prefix = scope.slice(0, separator);
+    groups.set(prefix, [...(groups.get(prefix) ?? []), scope]);
+  }
+
+  return [...groups].map(([prefix, grouped]) => ({ prefix, scopes: grouped }));
+};
+
+/** Bound activities are the only elements a sync assembles, since a page's activities are bound by schema. */
+const boundActivities = (pages: readonly SyncPage[]) => {
+  const { model, overlay, gaps } = assembleSync(pages);
+  const activities = model.elements.flatMap((element): BoundActivity[] =>
+    element.kind === "activity" && element.source !== undefined
+      ? [{ ...element, source: element.source }]
+      : [],
+  );
+
+  return {
+    items: {
+      participants: model.participants,
+      activities,
+      transitions: model.transitions,
+      overlay,
+    },
+    gaps,
+  };
+};
+
+/**
+ * Reads every page of the scopes from their sources and merges them into the session's model in one write, creating the model when the store has none. Records already in the model are replaced by identifier and the rest are kept, so syncing again refreshes what changed.
+ *
+ * When a source fails part way, the pages read before the failure are still written, and the error says how to resume: the failing source's scopes with `--after` and the cursor of its last page read.
+ * @param session - The store and model.
+ * @param sources - The source for each identifier prefix.
+ * @param request - The scopes, and a cursor to resume after.
+ * @returns What was written, and the gaps the sources reported.
+ * @throws CliError with `usage` for a scope with no source prefix, a prefix no source serves, or `after` with scopes of more than one source; and with the source's failure, the resume command added, when a source refuses the sync.
+ */
+export const sync = async (
+  session: GraphSession,
+  sources: SourceLookup,
+  request: SyncRequest,
+): Promise<SyncResult> => {
+  const groups = bySource(request.scopes);
+  if (request.after !== undefined && groups.length > 1) {
+    throw new CliError(
+      exitCodes.usage,
+      "--after resumes one source's sync: give only that source's scopes",
+    );
+  }
+  const clients = groups.map((group) => {
+    const client = sources(group.prefix);
+    if (client === undefined) {
+      throw new CliError(
+        exitCodes.usage,
+        `no source reads "${group.prefix}" scopes`,
+      );
+    }
+
+    return { ...group, client };
+  });
+
+  const pages: SyncPage[] = [];
+  const write = async () => {
+    const { items, gaps } = boundActivities(pages);
+    const { revision } = await session.store.v1.items.upsert(
+      { modelId: session.modelId, items },
+      callOptions(session.signal),
+    );
+
+    return {
+      modelId: session.modelId,
+      revision,
+      participants: items.participants.length,
+      activities: items.activities.length,
+      transitions: items.transitions.length,
+      gaps,
+    };
+  };
+
+  /** Reads the sources in order, each only after the one before has finished, since a source's failure must stop the ones after it. */
+  const readFrom = async (index: number): Promise<void> => {
+    const group = clients.at(index);
+    if (group === undefined) {
+      return;
+    }
+    let cursor = index === 0 ? request.after : undefined;
+    try {
+      const stream = await group.client.v1.sync.stream(
+        cursor === undefined
+          ? { scope: group.scopes }
+          : { scope: group.scopes, after: cursor },
+        callOptions(session.signal),
+      );
+      for await (const page of stream) {
+        pages.push(page);
+        cursor = page.next;
+      }
+    } catch (error) {
+      const failure = failureOf(error);
+      const saved = pages.length > 0;
+      if (saved) {
+        await write();
+      }
+      const later = clients.slice(index + 1).flatMap((next) => next.scopes);
+      throw new CliError(
+        failure.exitCode,
+        [
+          failure.message,
+          ...(saved ? ["the pages read before the failure are saved"] : []),
+          `resume with: sync ${group.scopes.join(" ")}${cursor === undefined ? "" : ` --after ${cursor}`}`,
+          ...(later.length === 0 ? [] : [`then: sync ${later.join(" ")}`]),
+        ].join("\n"),
+        { cause: error },
+      );
+    }
+    await readFrom(index + 1);
+  };
+  await readFrom(0);
+
+  return write();
+};
diff --git a/packages/targets/graph-cli/src/test-support/fixtures.ts b/packages/targets/graph-cli/src/test-support/fixtures.ts
new file mode 100644
index 0000000..6c2a709
--- /dev/null
+++ b/packages/targets/graph-cli/src/test-support/fixtures.ts
@@ -0,0 +1,90 @@
+import type {
+  FakeGraphSourceOptions,
+  FakePage,
+} from "@exadev/process-graph-source-contract";
+
+const acme = { id: "github:@acme", label: "acme", kind: "system" } as const;
+const app = {
+  id: "github:acme/app",
+  label: "acme/app",
+  kind: "system",
+} as const;
+const web = {
+  id: "github:acme/web",
+  label: "acme/web",
+  kind: "system",
+} as const;
+const alice = { id: "github:@alice", label: "alice", kind: "role" } as const;
+
+const issue = (
+  repo: typeof app | typeof web,
+  number: string,
+  label: string,
+) => {
+  const id = `${repo.id}#${number}`;
+
+  return { kind: "activity", id, source: id, label, actor: repo.id } as const;
+};
+
+const design = issue(app, "1", "Design the schema");
+const api = issue(app, "2", "Build the API");
+const ship = issue(app, "3", "Ship it");
+const ui = issue(web, "7", "Build the UI");
+
+const blocks = (
+  blocker: Readonly<{ id: string }>,
+  blocked: Readonly<{ id: string }>,
+) => ({
+  id: `${blocker.id}->${blocked.id}`,
+  source: blocker.id,
+  target: blocked.id,
+});
+
+const appFirst: FakePage = {
+  participants: [acme, app, alice],
+  activities: [design, api],
+  transitions: [blocks(design, api)],
+  relations: [
+    { kind: "part-of", from: app.id, to: acme.id },
+    { kind: "assigned-to", from: api.id, to: alice.id },
+  ],
+  overlay: { [design.id]: "done", [api.id]: "open" },
+  gaps: [],
+};
+
+const appSecond: FakePage = {
+  participants: [acme, app, web],
+  activities: [ship, ui],
+  transitions: [blocks(api, ship), blocks(ui, ship), blocks(api, ui)],
+  relations: [],
+  overlay: { [ship.id]: "open", [ui.id]: "open" },
+  gaps: [],
+};
+
+const webOnly: FakePage = {
+  participants: [acme, web],
+  activities: [ui],
+  transitions: [],
+  relations: [{ kind: "part-of", from: web.id, to: acme.id }],
+  overlay: { [ui.id]: "open" },
+  gaps: [],
+};
+
+/**
+ * Issues in two repositories of one organisation, shaped the way the GitHub issues source reports them: `acme/app` spans two pages and its last issue waits on work in `acme/web`, which waits on the API. Any other `github:` scope is a `not-found` gap.
+ */
+export const githubLikeSource: FakeGraphSourceOptions = {
+  source: "github",
+  scopes: {
+    "github:acme/app": [appFirst, appSecond],
+    "github:acme/web": [webOnly],
+  },
+};
+
+/** The identifiers of the fixture's issues, for assertions. */
+export const issues = {
+  design: design.id,
+  api: api.id,
+  ship: ship.id,
+  ui: ui.id,
+} as const;
diff --git a/packages/targets/graph-cli/src/test-support/harness.ts b/packages/targets/graph-cli/src/test-support/harness.ts
new file mode 100644
index 0000000..973c7fc
--- /dev/null
+++ b/packages/targets/graph-cli/src/test-support/harness.ts
@@ -0,0 +1,115 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { openNodeGraphStore } from "@exadev/process-graph-sqlite-node";
+import {
+  createFakeGraphSource,
+  createGraphSourceRouter,
+  type GraphSourcePager,
+} from "@exadev/process-graph-source-contract";
+import { createGraphStoreRouter } from "@exadev/process-graph-store-contract";
+import { createRouterClient } from "@orpc/server";
+import type { ExitCode } from "../exit-codes.ts";
+import type { CliPorts } from "../ports.ts";
+import { runCli } from "../program.ts";
+import { githubLikeSource } from "./fixtures.ts";
+
+/** What one run of the command line wrote and returned. */
+export interface Run {
+  readonly code: ExitCode;
+  readonly stdout: string;
+  readonly stderr: string;
+}
+
+/** A command line wired to a SQLite file in a fresh directory and an in-memory source, run as a function. */
+export interface Harness {
+  /** The data file the store keeps; the default data path. */
+  readonly dataPath: string;
+  /** The directory holding it, for other files a test writes. */
+  readonly directory: string;
+  /** Runs the command line with these arguments. */
+  readonly run: (...args: readonly string[]) => Promise<Run>;
+  /** Removes the directory. */
+  readonly remove: () => void;
+}
+
+/**
+ * Builds a harness whose sources serve their pages through the real oRPC router, and whose store is `node:sqlite` on a file, so every command runs exactly as it does in a process apart from the streams.
+ * @param pagers - The sources, each serving the scopes with its prefix; the fixture's `github` fake when none is given.
+ * @returns The harness.
+ */
+export const createHarness = (
+  ...pagers: readonly GraphSourcePager[]
+): Harness => {
+  const sources =
+    pagers.length === 0 ? [createFakeGraphSource(githubLikeSource)] : pagers;
+  const directory = mkdtempSync(join(tmpdir(), "process-graph-cli-"));
+  const dataPath = join(directory, "graph.sqlite3");
+
+  return {
+    dataPath,
+    directory,
+    run: async (...args) => {
+      let stdout = "";
+      let stderr = "";
+      const ports: CliPorts = {
+        stdout: (text) => {
+          stdout += text;
+        },
+        stderr: (text) => {
+          stderr += text;
+        },
+        defaultDataPath: dataPath,
+        openStore: (path) => {
+          const { store, close } = openNodeGraphStore(path);
+
+          return {
+            client: createRouterClient(createGraphStoreRouter(store)),
+            close,
+          };
+        },
+        source: (prefix) => {
+          const pager = sources.find(
+            (candidate) => candidate.source === prefix,
+          );
+
+          return pager === undefined
+            ? undefined
+            : createRouterClient(createGraphSourceRouter(pager));
+        },
+        readFile: async (path) => readFile(path, "utf8"),
+        facts: () => ({ found: false }),
+        signal: undefined,
+      };
+      const code = await runCli(args, ports, {
+        name: "process-graph",
+        version: "0.0.0-test",
+      });
+
+      return { code, stdout, stderr };
+    },
+    remove: () => {
+      rmSync(directory, { recursive: true, force: true });
+    },
+  };
+};
+
+/**
+ * Runs commands one after another, each after the one before has finished, since each reads what the one before wrote.
+ * @param harness - The harness to run them in.
+ * @param commands - The argument lists, in order.
+ * @returns Each run's result, in order.
+ */
+export const runInOrder = async (
+  harness: Harness,
+  commands: readonly (readonly string[])[],
+): Promise<readonly Run[]> => {
+  const [first, ...rest] = commands;
+  if (first === undefined) {
+    return [];
+  }
+  const result = await harness.run(...first);
+
+  return [result, ...(await runInOrder(harness, rest))];
+};
diff --git a/packages/targets/graph-cli/src/validate.ts b/packages/targets/graph-cli/src/validate.ts
new file mode 100644
index 0000000..bcde1ca
--- /dev/null
+++ b/packages/targets/graph-cli/src/validate.ts
@@ -0,0 +1,88 @@
+import { illegalCycles } from "@exadev/process-graph-domain";
+import {
+  ModelParseError,
+  parseModel,
+  validate,
+  validateOverlay,
+  type Model,
+  type OpenIds,
+} from "@exadev/process-graph-schema";
+import { loadRun, type GraphSession } from "./session.ts";
+
+/** One problem with a model. */
+export interface ValidationIssue {
+  /** What kind of problem: a `validate` issue code, `illegal-cycle`, or `schema` for a document whose shape is wrong. */
+  readonly code: string;
+  readonly message: string;
+  /** Where in a document the problem is, as a JSON pointer, for a shape problem. */
+  readonly pointer?: string;
+}
+
+/** Whether a model is valid, and every problem found. */
+export interface ValidateResult {
+  /** True exactly when `issues` is empty. */
+  readonly valid: boolean;
+  readonly issues: readonly ValidationIssue[];
+}
+
+/** A cycle that no decision closes, as an issue: status is undefined on it. */
+const cycleIssues = (model: Model<OpenIds>): readonly ValidationIssue[] =>
+  illegalCycles(model).map((cycle) => ({
+    code: "illegal-cycle",
+    message: `cycle with no decision in it: ${cycle.join(" -> ")}`,
+  }));
+
+const resultOf = (issues: readonly ValidationIssue[]): ValidateResult => ({
+  valid: issues.length === 0,
+  issues,
+});
+
+/**
+ * Checks the session's stored model and run state: the structural rules of `validate`, run state naming elements the model lacks, and cycles no decision closes.
+ * @param session - The store and model.
+ */
+export const validateStored = async (
+  session: GraphSession,
+): Promise<ValidateResult> => {
+  const { model, overlay } = await loadRun(session);
+
+  return resultOf([
+    ...validate(model),
+    ...validateOverlay(model, overlay),
+    ...cycleIssues(model),
+  ]);
+};
+
+/**
+ * Checks a model document, such as a file of JSON: its shape against the model schema (each problem located by JSON pointer), then the structural rules of `validate`, then cycles no decision closes. Text that is not JSON is one `schema` issue at the document itself.
+ * @param text - The document.
+ */
+export const validateDocument = (text: string): ValidateResult => {
+  let input: unknown;
+  try {
+    input = JSON.parse(text);
+  } catch (error) {
+    return resultOf([
+      {
+        code: "schema",
+        message: `not JSON: ${error instanceof Error ? error.message : String(error)}`,
+        pointer: "",
+      },
+    ]);
+  }
+  try {
+    return resultOf(cycleIssues(parseModel(input)));
+  } catch (error) {
+    if (!(error instanceof ModelParseError)) {
+      throw error;
+    }
+
+    return resultOf(
+      error.issues.map((issue) =>
+        issue.source === "schema"
+          ? { code: "schema", message: issue.message, pointer: issue.pointer }
+          : { code: issue.code, message: issue.message },
+      ),
+    );
+  }
+};
diff --git a/packages/targets/graph-cli/stryker.config.ts b/packages/targets/graph-cli/stryker.config.ts
new file mode 100644
index 0000000..3f6a9f3
--- /dev/null
+++ b/packages/targets/graph-cli/stryker.config.ts
@@ -0,0 +1,3 @@
+import { packageStrykerConfig } from "../../../stryker.shared.ts";
+
+export default packageStrykerConfig();
diff --git a/packages/targets/graph-cli/test/package.smoke.test.ts b/packages/targets/graph-cli/test/package.smoke.test.ts
new file mode 100644
index 0000000..27f75d0
--- /dev/null
+++ b/packages/targets/graph-cli/test/package.smoke.test.ts
@@ -0,0 +1,64 @@
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { afterEach, beforeEach, expect, test } from "vitest";
+// Deliberately imports the built dist/, not src/: this is the check that catches a wrong exports map or a build misconfiguration that a unit test importing straight from src/ never touches.
+import { exitCodes, nodePorts, runCli } from "../dist/index.js";
+
+const bin = fileURLToPath(new URL("../dist/bin.js", import.meta.url));
+
+/** Runs the built bin as a child process and waits for it. */
+const runBin = (args: readonly string[], data: string) =>
+  spawnSync(process.execPath, [bin, ...args], {
+    env: { ...process.env, PROCESS_GRAPH_DATA: data },
+    encoding: "utf8",
+  });
+
+let directory: string;
+
+beforeEach(() => {
+  directory = mkdtempSync(join(tmpdir(), "process-graph-cli-smoke-"));
+});
+
+afterEach(() => {
+  rmSync(directory, { recursive: true, force: true });
+});
+
+test("the built library runs a command against a SQLite file through the Node ports", async () => {
+  let stdout = "";
+  const ports = nodePorts({
+    env: { PROCESS_GRAPH_DATA: join(directory, "graph.sqlite3") },
+    stdout: (text) => {
+      stdout += text;
+    },
+  });
+  const identity = { name: "process-graph-cli", version: "0.0.0" };
+
+  await expect(
+    runCli(["add", "activity", "build", "Build"], ports, identity),
+  ).resolves.toBe(exitCodes.success);
+  await expect(runCli(["ready"], ports, identity)).resolves.toBe(
+    exitCodes.success,
+  );
+  expect(stdout).toBe("added activity build at revision 1\nbuild\tBuild\n");
+});
+
+test("the built bin runs as a process, creating its data directory, and reports its exit status", () => {
+  const data = join(directory, "nested", "graph.sqlite3");
+
+  expect(runBin(["add", "activity", "build", "Build"], data).status).toBe(
+    exitCodes.success,
+  );
+  const ready = runBin(["ready", "--json"], data);
+  expect(ready.status).toBe(exitCodes.success);
+  expect(JSON.parse(ready.stdout)).toEqual({
+    elements: [{ id: "build", label: "Build" }],
+  });
+  expect(runBin(["blocked", "nothing"], data)).toMatchObject({
+    status: exitCodes.notFound,
+    stdout: "",
+    stderr: 'no element "nothing" in the model\n',
+  });
+});
diff --git a/packages/targets/graph-cli/tsconfig.build.json b/packages/targets/graph-cli/tsconfig.build.json
new file mode 100644
index 0000000..63a34ba
--- /dev/null
+++ b/packages/targets/graph-cli/tsconfig.build.json
@@ -0,0 +1,37 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "composite": true,
+    "noEmit": false,
+    "declaration": true,
+    "declarationMap": false,
+    "rootDir": "src",
+    "outDir": "dist",
+    "rewriteRelativeImportExtensions": true
+  },
+  "include": ["src/**/*.ts"],
+  "exclude": ["src/**/*.test.ts", "src/test-support/**"],
+  "references": [
+    {
+      "path": "../../core/graph/schema/tsconfig.build.json"
+    },
+    {
+      "path": "../../core/graph/projection/tsconfig.build.json"
+    },
+    {
+      "path": "../../core/graph/domain/tsconfig.build.json"
+    },
+    {
+      "path": "../../core/graph/source-contract/tsconfig.build.json"
+    },
+    {
+      "path": "../../core/graph/store-contract/tsconfig.build.json"
+    },
+    {
+      "path": "../../adapters/graph/source-github-issues/tsconfig.build.json"
+    },
+    {
+      "path": "../../adapters/graph/sqlite-node/tsconfig.build.json"
+    }
+  ]
+}
diff --git a/packages/targets/graph-cli/tsconfig.json b/packages/targets/graph-cli/tsconfig.json
new file mode 100644
index 0000000..b336daf
--- /dev/null
+++ b/packages/targets/graph-cli/tsconfig.json
@@ -0,0 +1,8 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "lib": ["ES2024"],
+    "types": ["node"]
+  },
+  "include": ["src/**/*.ts", "test/**/*.ts", "*.config.ts"]
+}
diff --git a/packages/targets/graph-cli/vitest.config.ts b/packages/targets/graph-cli/vitest.config.ts
new file mode 100644
index 0000000..01b9391
--- /dev/null
+++ b/packages/targets/graph-cli/vitest.config.ts
@@ -0,0 +1,16 @@
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    projects: [
+      {
+        extends: true,
+        test: { name: "unit", include: ["src/**/*.test.ts"] },
+      },
+      {
+        extends: true,
+        test: { name: "smoke", include: ["test/package.smoke.test.ts"] },
+      },
+    ],
+  },
+});
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 6edeb45..45b5ee0 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -874,6 +874,70 @@ importers:
         specifier: 7.4.1
         version: 7.4.1
 
+  packages/targets/graph-cli:
+    dependencies:
+      '@exadev/process-graph-dag':
+        specifier: 1.0.2
+        version: link:../../core/graph/dag
+      '@exadev/process-graph-domain':
+        specifier: 1.0.3
+        version: link:../../core/graph/domain
+      '@exadev/process-graph-projection':
+        specifier: 1.0.3
+        version: link:../../core/graph/projection
+      '@exadev/process-graph-schema':
+        specifier: 1.1.0
+        version: link:../../core/graph/schema
+      '@exadev/process-graph-source-contract':
+        specifier: 1.0.1
+        version: link:../../core/graph/source-contract
+      '@exadev/process-graph-source-github-issues':
+        specifier: 1.0.1
+        version: link:../../adapters/graph/source-github-issues
+      '@exadev/process-graph-sqlite-node':
+        specifier: 1.0.0
+        version: link:../../adapters/graph/sqlite-node
+      '@exadev/process-graph-store-contract':
+        specifier: 1.0.1
+        version: link:../../core/graph/store-contract
+      '@orpc/server':
+        specifier: 2.0.0-beta.41
+        version: 2.0.0-beta.41
+      commander:
+        specifier: 15.0.0
+        version: 15.0.0
+    devDependencies:
+      '@arethetypeswrong/cli':
+        specifier: 0.18.5
+        version: 0.18.5
+      '@stryker-mutator/core':
+        specifier: 10.0.0
+        version: 10.0.0(@types/node@26.6.4)
+      '@stryker-mutator/typescript-checker':
+        specifier: 10.0.0
+        version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(typescript@6.0.3)
+      '@stryker-mutator/vitest-runner':
+        specifier: 10.0.0
+        version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(vitest@5.0.3)
+      '@types/node':
+        specifier: 26.6.4
+        version: 26.6.4
+      '@vitest/coverage-v8':
+        specifier: 5.0.3
+        version: 5.0.3(vitest@5.0.3)
+      eslint:
+        specifier: 10.12.0
+        version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
+      publint:
+        specifier: 0.3.25
+        version: 0.3.25
+      typescript:
+        specifier: 6.0.3
+        version: 6.0.3
+      vitest:
+        specifier: 5.0.3
+        version: 5.0.3(@types/node@26.6.4)(@vitest/coverage-v8@5.0.3)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(yaml@2.9.1))
+
   packages/targets/process-graph:
     dependencies:
       '@exadev/process-graph-dag':
diff --git a/tsconfig.build.json b/tsconfig.build.json
index 2c6a826..8f135a5 100644
--- a/tsconfig.build.json
+++ b/tsconfig.build.json
@@ -43,6 +43,9 @@
     {
       "path": "packages/ui/graph/react-flow/tsconfig.build.json"
     },
+    {
+      "path": "packages/targets/graph-cli/tsconfig.build.json"
+    },
     {
       "path": "packages/targets/process-graph/tsconfig.build.json"
     }

From 12cee888f84ae033006b7b72651321040c7fc869 Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sat, 10 Oct 2026 22:40:39 +0100
Subject: [PATCH 02/31] fix(cli): mark the bin as the package's one side effect

The bin runs the command line when it is loaded, so a bundler must not treat it as free of side
effects; every other module is.
---
 packages/targets/graph-cli/package.json | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/packages/targets/graph-cli/package.json b/packages/targets/graph-cli/package.json
index 695e9e8..bac13e5 100644
--- a/packages/targets/graph-cli/package.json
+++ b/packages/targets/graph-cli/package.json
@@ -30,7 +30,9 @@
     "provenance": true,
     "registry": "https://registry.npmjs.org/"
   },
-  "sideEffects": false,
+  "sideEffects": [
+    "./dist/bin.js"
+  ],
   "license": "MIT",
   "scripts": {
     "build": "turbo run _build",

From 4e4b3a18540073e3b721bea12a0e4cdc2d95fbbe Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sat, 10 Oct 2026 22:40:43 +0100
Subject: [PATCH 03/31] feat(process-graph): carry the process-graph bin

The entry point now installs the command line as process-graph, delegating to the CLI
package's library entry with its own name and version. The library it exports stays
isomorphic, because the bin is excluded from the web-only typecheck program and exempt from
the import ban, since it is run rather than imported, and the CLI is not re-exported.
---
 README.md                                     |  2 +-
 packages/targets/process-graph/README.md      | 14 +++++++++-
 .../targets/process-graph/eslint.config.ts    |  2 ++
 packages/targets/process-graph/package.json   | 10 +++++--
 packages/targets/process-graph/src/bin.ts     |  7 +++++
 .../process-graph/test/package.smoke.test.ts  | 27 +++++++++++++++++++
 .../targets/process-graph/tsconfig.build.json |  8 +++++-
 packages/targets/process-graph/tsconfig.json  |  2 +-
 pnpm-lock.yaml                                |  3 +++
 9 files changed, 69 insertions(+), 6 deletions(-)
 create mode 100644 packages/targets/process-graph/src/bin.ts

diff --git a/README.md b/README.md
index c85d40a..6272fab 100644
--- a/README.md
+++ b/README.md
@@ -62,7 +62,7 @@ Configuration lives at exactly one of two levels: in the package (`eslint.config
 | [`graph-ui`](packages/ui/graph/ui/README.md)                                           | Styled components over `graph-react` and an SVG sequence diagram, in Vanilla Extract with a typed theme contract and light and dark themes, shipped as compiled CSS.                                                                              |
 | [`graph-react-flow`](packages/ui/graph/react-flow/README.md)                           | React Flow views of the model: flowchart, swimlane with lanes as group nodes, and state machine, laid out by `graph-layout`, showing each status and the critical path; sequence projections drawn by `graph-ui`.                                 |
 | [`graph-cli`](packages/targets/graph-cli/README.md)                                    | The command line and its library entry: sync GitHub issues into the SQLite store, ready, blocked, impact, critical path, cycles, hand-offs and status explanations, and every view drawn in Mermaid or Graphviz DOT.                              |
-| [`process-graph`](packages/targets/process-graph/README.md)                            | The primary entry point: re-exports the schema, projection and domain APIs flat and the DAG API as the `dag` namespace.                                                                                                                           |
+| [`process-graph`](packages/targets/process-graph/README.md)                            | The primary entry point: re-exports the schema, projection and domain APIs flat and the DAG API as the `dag` namespace, and carries the `process-graph` bin.                                                                                      |
 | [`graph-web`](packages/targets/graph-web/README.md)                                    | The web app: an installable, offline-first PWA that syncs GitHub issues into SQLite on the device and shows the work in every view, with what is ready, what is blocked and why, linkable by address.                                             |
 
 ## Conventions
diff --git a/packages/targets/process-graph/README.md b/packages/targets/process-graph/README.md
index 1637d8c..a5b726f 100644
--- a/packages/targets/process-graph/README.md
+++ b/packages/targets/process-graph/README.md
@@ -47,7 +47,19 @@ Install `process-graph` to author, load, project and reason about a model. Insta
 | Domain     | `@exadev/process-graph-domain`     | flat                     |
 | DAG        | `@exadev/process-graph-dag`        | namespaced as `dag`      |
 
-Each package's own README documents its functions and rules; this package adds no behaviour of its own.
+Each package's own README documents its functions and rules; this package adds no behaviour of its own beyond the bin.
+
+## The command line
+
+The package carries the `process-graph` bin, the command line from [`@exadev/process-graph-cli`](../graph-cli/README.md): sync work from GitHub issues into a SQLite store, ask what is ready, blocked, affected, on the critical path or handed off, explain a status, and draw the model in Mermaid or Graphviz DOT.
+
+```sh
+npx process-graph sync github:ExaDev
+npx process-graph ready
+npx process-graph show --view swimlane
+```
+
+The bin delegates to that package's library entry, which this package does not re-export: the command line is Node-only, while everything this package exports runs unchanged in a browser or a Worker. A program that embeds the command line, or calls its operations for data, imports `@exadev/process-graph-cli` directly.
 
 ## What is exported, and under which name
 
diff --git a/packages/targets/process-graph/eslint.config.ts b/packages/targets/process-graph/eslint.config.ts
index b3ab58a..023a144 100644
--- a/packages/targets/process-graph/eslint.config.ts
+++ b/packages/targets/process-graph/eslint.config.ts
@@ -5,5 +5,7 @@ export default defineConfig(
   packageLintConfig({
     tsconfigRootDir: import.meta.dirname,
     isomorphic: true,
+    // The bin is a Node launcher that is run, never imported, so the library it carries stays isomorphic.
+    isomorphicExemptions: ["src/bin.ts"],
   }),
 );
diff --git a/packages/targets/process-graph/package.json b/packages/targets/process-graph/package.json
index 4275de5..310e386 100644
--- a/packages/targets/process-graph/package.json
+++ b/packages/targets/process-graph/package.json
@@ -1,7 +1,7 @@
 {
   "name": "process-graph",
   "version": "1.0.6",
-  "description": "A process and dependency graph model with projections into flowcharts, swimlanes, state machines and sequence diagrams, and reasoning over a run: one install for the model, projection, domain and DAG packages.",
+  "description": "A process and dependency graph model with projections into flowcharts, swimlanes, state machines and sequence diagrams, and reasoning over a run: one install for the model, projection, domain and DAG packages, and the process-graph command line.",
   "type": "module",
   "repository": {
     "type": "git",
@@ -12,6 +12,9 @@
   "bugs": {
     "url": "https://github.com/ExaDev/process-graph/issues"
   },
+  "bin": {
+    "process-graph": "./dist/bin.js"
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -27,7 +30,9 @@
     "provenance": true,
     "registry": "https://registry.npmjs.org/"
   },
-  "sideEffects": false,
+  "sideEffects": [
+    "./dist/bin.js"
+  ],
   "license": "MIT",
   "scripts": {
     "build": "turbo run _build",
@@ -57,6 +62,7 @@
     "sequence-diagram"
   ],
   "dependencies": {
+    "@exadev/process-graph-cli": "0.0.0",
     "@exadev/process-graph-dag": "1.1.0",
     "@exadev/process-graph-domain": "1.1.1",
     "@exadev/process-graph-projection": "1.1.0",
diff --git a/packages/targets/process-graph/src/bin.ts b/packages/targets/process-graph/src/bin.ts
new file mode 100644
index 0000000..d5b9ab2
--- /dev/null
+++ b/packages/targets/process-graph/src/bin.ts
@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { packageVersion, runProcess } from "@exadev/process-graph-cli";
+
+process.exitCode = await runProcess({
+  name: "process-graph",
+  version: packageVersion(new URL("../package.json", import.meta.url)),
+});
diff --git a/packages/targets/process-graph/test/package.smoke.test.ts b/packages/targets/process-graph/test/package.smoke.test.ts
index aed190a..b0b31a3 100644
--- a/packages/targets/process-graph/test/package.smoke.test.ts
+++ b/packages/targets/process-graph/test/package.smoke.test.ts
@@ -1,3 +1,6 @@
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 import { expect, test } from "vitest";
 // Deliberately imports the built dist/, not src/: this is the check that catches a wrong exports map or a build misconfiguration that a unit test importing straight from src/ never touches.
 import {
@@ -40,3 +43,27 @@ test("the built package loads a model, projects it and derives its status throug
   expect(readySet(model, {}, facts)).toEqual(["submit"]);
   expect(typeof dag.criticalPath).toBe("function");
 });
+
+test("the built process-graph bin runs the command line as a process with this package's version", () => {
+  const bin = fileURLToPath(new URL("../dist/bin.js", import.meta.url));
+  const manifest: unknown = JSON.parse(
+    readFileSync(new URL("../package.json", import.meta.url), "utf8"),
+  );
+  const version =
+    typeof manifest === "object" &&
+    manifest !== null &&
+    "version" in manifest &&
+    typeof manifest.version === "string"
+      ? manifest.version
+      : undefined;
+
+  const result = spawnSync(process.execPath, [bin, "--version"], {
+    encoding: "utf8",
+  });
+  const help = spawnSync(process.execPath, [bin, "--help"], {
+    encoding: "utf8",
+  });
+
+  expect(result).toMatchObject({ status: 0, stdout: `${String(version)}\n` });
+  expect(help.stdout).toContain("Usage: process-graph [options] [command]");
+});
diff --git a/packages/targets/process-graph/tsconfig.build.json b/packages/targets/process-graph/tsconfig.build.json
index 76d317f..d97c05c 100644
--- a/packages/targets/process-graph/tsconfig.build.json
+++ b/packages/targets/process-graph/tsconfig.build.json
@@ -7,8 +7,11 @@
     "declarationMap": false,
     "rootDir": "src",
     "outDir": "dist",
-    "rewriteRelativeImportExtensions": true
+    "rewriteRelativeImportExtensions": true,
+    "types": ["node"]
   },
+  "include": ["src/**/*.ts"],
+  "exclude": ["src/**/*.test.ts", "src/test-support/**"],
   "references": [
     {
       "path": "../../core/graph/dag/tsconfig.build.json"
@@ -21,6 +24,9 @@
     },
     {
       "path": "../../core/graph/domain/tsconfig.build.json"
+    },
+    {
+      "path": "../graph-cli/tsconfig.build.json"
     }
   ]
 }
diff --git a/packages/targets/process-graph/tsconfig.json b/packages/targets/process-graph/tsconfig.json
index 871926f..9ef2ac0 100644
--- a/packages/targets/process-graph/tsconfig.json
+++ b/packages/targets/process-graph/tsconfig.json
@@ -5,5 +5,5 @@
     "types": []
   },
   "include": ["src/**/*.ts"],
-  "exclude": ["src/**/*.test.ts", "src/test-support/**"]
+  "exclude": ["src/**/*.test.ts", "src/test-support/**", "src/bin.ts"]
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 45b5ee0..7390f17 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -940,6 +940,9 @@ importers:
 
   packages/targets/process-graph:
     dependencies:
+      '@exadev/process-graph-cli':
+        specifier: 0.0.0
+        version: link:../graph-cli
       '@exadev/process-graph-dag':
         specifier: 1.1.0
         version: link:../../core/graph/dag

From 1b3b27002805808993be4edeb5c16dce5f4339e1 Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 04:37:48 +0100
Subject: [PATCH 04/31] fix(cli): pin each sibling at its workspace version

The pins named versions the workspace has since released past, so pnpm resolved
registry copies instead of linking the siblings, and syncpack reported the
drift.
---
 packages/targets/graph-cli/package.json | 14 +++++++-------
 pnpm-lock.yaml                          | 18 +++++++++---------
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/packages/targets/graph-cli/package.json b/packages/targets/graph-cli/package.json
index bac13e5..135508d 100644
--- a/packages/targets/graph-cli/package.json
+++ b/packages/targets/graph-cli/package.json
@@ -62,14 +62,14 @@
     "graphviz"
   ],
   "dependencies": {
-    "@exadev/process-graph-dag": "1.0.2",
-    "@exadev/process-graph-domain": "1.0.3",
-    "@exadev/process-graph-projection": "1.0.3",
+    "@exadev/process-graph-dag": "1.1.0",
+    "@exadev/process-graph-domain": "1.1.1",
+    "@exadev/process-graph-projection": "1.1.0",
     "@exadev/process-graph-schema": "1.1.0",
-    "@exadev/process-graph-source-contract": "1.0.1",
-    "@exadev/process-graph-source-github-issues": "1.0.1",
-    "@exadev/process-graph-sqlite-node": "1.0.0",
-    "@exadev/process-graph-store-contract": "1.0.1",
+    "@exadev/process-graph-source-contract": "1.1.0",
+    "@exadev/process-graph-source-github-issues": "1.1.0",
+    "@exadev/process-graph-sqlite-node": "1.0.4",
+    "@exadev/process-graph-store-contract": "1.1.0",
     "@orpc/server": "2.0.0-beta.41",
     "commander": "15.0.0"
   },
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 7390f17..0d1a021 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -877,28 +877,28 @@ importers:
   packages/targets/graph-cli:
     dependencies:
       '@exadev/process-graph-dag':
-        specifier: 1.0.2
+        specifier: 1.1.0
         version: link:../../core/graph/dag
       '@exadev/process-graph-domain':
-        specifier: 1.0.3
+        specifier: 1.1.1
         version: link:../../core/graph/domain
       '@exadev/process-graph-projection':
-        specifier: 1.0.3
+        specifier: 1.1.0
         version: link:../../core/graph/projection
       '@exadev/process-graph-schema':
         specifier: 1.1.0
         version: link:../../core/graph/schema
       '@exadev/process-graph-source-contract':
-        specifier: 1.0.1
+        specifier: 1.1.0
         version: link:../../core/graph/source-contract
       '@exadev/process-graph-source-github-issues':
-        specifier: 1.0.1
+        specifier: 1.1.0
         version: link:../../adapters/graph/source-github-issues
       '@exadev/process-graph-sqlite-node':
-        specifier: 1.0.0
+        specifier: 1.0.4
         version: link:../../adapters/graph/sqlite-node
       '@exadev/process-graph-store-contract':
-        specifier: 1.0.1
+        specifier: 1.1.0
         version: link:../../core/graph/store-contract
       '@orpc/server':
         specifier: 2.0.0-beta.41
@@ -924,7 +924,7 @@ importers:
         version: 26.6.4
       '@vitest/coverage-v8':
         specifier: 5.0.3
-        version: 5.0.3(vitest@5.0.3)
+        version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
       eslint:
         specifier: 10.12.0
         version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
@@ -936,7 +936,7 @@ importers:
         version: 6.0.3
       vitest:
         specifier: 5.0.3
-        version: 5.0.3(@types/node@26.6.4)(@vitest/coverage-v8@5.0.3)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(yaml@2.9.1))
+        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(yaml@2.9.1))
 
   packages/targets/process-graph:
     dependencies:

From 4e51c9810657782c3ceab5bb0433e204a84cc7bc Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 04:36:58 +0100
Subject: [PATCH 05/31] build(process-graph): bundle the building blocks behind
 subpath exports

The package is now built with tsdown, which inlines the workspace packages it
re-exports, their declarations included, and keeps every third-party library
an import. Besides the root entry, which is unchanged, each building block is
reachable through its own subpath: layout, source/github and its node token
helper, store, store/node, store/wasm and its worker module, and cli. Each
subpath loads only the chunks and libraries it reaches.

The workspace packages move to devDependencies, since nothing of them ships
but the inlined code. zod and trilean, which the root entry needs, are
dependencies; the libraries only other subpaths reach are optional peer
dependencies, so installing the package for its root entry stays light.
---
 .../targets/process-graph/eslint.config.ts    |  26 +-
 packages/targets/process-graph/package.json   |  95 ++-
 packages/targets/process-graph/src/cli.ts     |   2 +
 .../src/entrypoints.unit.test.ts              |  95 +++
 packages/targets/process-graph/src/layout.ts  |   2 +
 .../process-graph/src/source/github.ts        |   3 +
 .../process-graph/src/source/github/node.ts   |   2 +
 packages/targets/process-graph/src/store.ts   |   3 +
 .../targets/process-graph/src/store/node.ts   |   2 +
 .../targets/process-graph/src/store/wasm.ts   |   2 +
 .../process-graph/src/store/wasm/worker.ts    |   2 +
 .../targets/process-graph/tsconfig.build.json |  32 -
 packages/targets/process-graph/tsconfig.json  |   9 +-
 .../targets/process-graph/tsdown.config.ts    |  31 +
 pnpm-lock.yaml                                | 588 ++++++++++++++++--
 tsconfig.build.json                           |   3 -
 turbo.json                                    |   7 +-
 17 files changed, 801 insertions(+), 103 deletions(-)
 create mode 100644 packages/targets/process-graph/src/cli.ts
 create mode 100644 packages/targets/process-graph/src/entrypoints.unit.test.ts
 create mode 100644 packages/targets/process-graph/src/layout.ts
 create mode 100644 packages/targets/process-graph/src/source/github.ts
 create mode 100644 packages/targets/process-graph/src/source/github/node.ts
 create mode 100644 packages/targets/process-graph/src/store.ts
 create mode 100644 packages/targets/process-graph/src/store/node.ts
 create mode 100644 packages/targets/process-graph/src/store/wasm.ts
 create mode 100644 packages/targets/process-graph/src/store/wasm/worker.ts
 delete mode 100644 packages/targets/process-graph/tsconfig.build.json
 create mode 100644 packages/targets/process-graph/tsdown.config.ts

diff --git a/packages/targets/process-graph/eslint.config.ts b/packages/targets/process-graph/eslint.config.ts
index 023a144..92b9766 100644
--- a/packages/targets/process-graph/eslint.config.ts
+++ b/packages/targets/process-graph/eslint.config.ts
@@ -1,11 +1,33 @@
 import { defineConfig } from "eslint/config";
 import { packageLintConfig } from "../../../eslint.shared.ts";
 
+/** The modules behind the package's subpath exports other than the root, each a pure re-export of the private packages that subpath bundles. */
+const subpathEntries = [
+  "src/layout.ts",
+  "src/source/github.ts",
+  "src/source/github/node.ts",
+  "src/store.ts",
+  "src/store/node.ts",
+  "src/store/wasm.ts",
+  "src/store/wasm/worker.ts",
+  "src/cli.ts",
+];
+
 export default defineConfig(
   packageLintConfig({
     tsconfigRootDir: import.meta.dirname,
     isomorphic: true,
-    // The bin is a Node launcher that is run, never imported, so the library it carries stays isomorphic.
-    isomorphicExemptions: ["src/bin.ts"],
+    // The bin is a Node launcher that is run, never imported, and these subpaths are the Node-only ones by design; the root entry and every other subpath stay isomorphic.
+    isomorphicExemptions: [
+      "src/bin.ts",
+      "src/cli.ts",
+      "src/store/node.ts",
+      "src/source/github/node.ts",
+    ],
   }),
+  {
+    // Every subpath of this package is an entry point whose whole content is a re-export, the same as `src/index.ts`. The policy's `single` mode recognises only `src/index.ts` as an entry point, so the subpath modules are declared here instead; each still contains nothing but re-exports, which `entrypoints.unit.test.ts` checks against the packages it bundles.
+    files: subpathEntries,
+    rules: { "exadev/barrel-policy": "off" },
+  },
 );
diff --git a/packages/targets/process-graph/package.json b/packages/targets/process-graph/package.json
index 310e386..b15575d 100644
--- a/packages/targets/process-graph/package.json
+++ b/packages/targets/process-graph/package.json
@@ -1,7 +1,7 @@
 {
   "name": "process-graph",
   "version": "1.0.6",
-  "description": "A process and dependency graph model with projections into flowcharts, swimlanes, state machines and sequence diagrams, and reasoning over a run: one install for the model, projection, domain and DAG packages, and the process-graph command line.",
+  "description": "A process and dependency graph model with projections into flowcharts, swimlanes, state machines and sequence diagrams, reasoning over a run, layout, the GitHub issues source, the SQLite store for Node and the browser, and the process-graph command line, each behind its own subpath.",
   "type": "module",
   "repository": {
     "type": "git",
@@ -19,6 +19,38 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./layout": {
+      "types": "./dist/layout.d.ts",
+      "import": "./dist/layout.js"
+    },
+    "./source/github": {
+      "types": "./dist/source/github.d.ts",
+      "import": "./dist/source/github.js"
+    },
+    "./source/github/node": {
+      "types": "./dist/source/github/node.d.ts",
+      "import": "./dist/source/github/node.js"
+    },
+    "./store": {
+      "types": "./dist/store.d.ts",
+      "import": "./dist/store.js"
+    },
+    "./store/node": {
+      "types": "./dist/store/node.d.ts",
+      "import": "./dist/store/node.js"
+    },
+    "./store/wasm": {
+      "types": "./dist/store/wasm.d.ts",
+      "import": "./dist/store/wasm.js"
+    },
+    "./store/wasm/worker": {
+      "types": "./dist/store/wasm/worker.d.ts",
+      "import": "./dist/store/wasm/worker.js"
+    },
+    "./cli": {
+      "types": "./dist/cli.d.ts",
+      "import": "./dist/cli.js"
     }
   },
   "types": "./dist/index.d.ts",
@@ -36,7 +68,7 @@
   "license": "MIT",
   "scripts": {
     "build": "turbo run _build",
-    "_build": "tsc -b tsconfig.build.json",
+    "_build": "tsdown",
     "lint": "turbo run _lint",
     "_lint": "eslint . --cache --max-warnings 0",
     "_lint:fix": "eslint . --fix --cache --max-warnings 0",
@@ -61,23 +93,72 @@
     "state-machine",
     "sequence-diagram"
   ],
-  "dependencies": {
+  "devDependencies": {
+    "@arethetypeswrong/cli": "0.18.5",
     "@exadev/process-graph-cli": "0.0.0",
     "@exadev/process-graph-dag": "1.1.0",
     "@exadev/process-graph-domain": "1.1.1",
+    "@exadev/process-graph-layout": "1.0.3",
     "@exadev/process-graph-projection": "1.1.0",
-    "@exadev/process-graph-schema": "1.1.0"
-  },
-  "devDependencies": {
-    "@arethetypeswrong/cli": "0.18.5",
+    "@exadev/process-graph-schema": "1.1.0",
+    "@exadev/process-graph-source-contract": "1.1.0",
+    "@exadev/process-graph-source-github-issues": "1.1.0",
+    "@exadev/process-graph-sqlite-node": "1.0.4",
+    "@exadev/process-graph-sqlite-wasm": "1.0.3",
+    "@exadev/process-graph-store-contract": "1.1.0",
+    "@exadev/process-graph-store-sqlite": "1.1.0",
+    "@orpc/client": "2.0.0-beta.41",
+    "@orpc/contract": "2.0.0-beta.41",
+    "@orpc/server": "2.0.0-beta.41",
+    "@sqlite.org/sqlite-wasm": "3.53.4-build2",
     "@stryker-mutator/core": "10.0.0",
     "@stryker-mutator/typescript-checker": "10.0.0",
     "@stryker-mutator/vitest-runner": "10.0.0",
     "@types/node": "26.6.4",
     "@vitest/coverage-v8": "5.0.3",
+    "commander": "15.0.0",
+    "drizzle-orm": "1.0.0-rc.4",
+    "elkjs": "0.12.0",
     "eslint": "10.12.0",
     "publint": "0.3.25",
+    "tsdown": "0.23.0",
     "typescript": "6.0.3",
     "vitest": "5.0.3"
+  },
+  "dependencies": {
+    "trilean": "1.7.2",
+    "zod": "4.6.5"
+  },
+  "peerDependencies": {
+    "@orpc/client": "2.0.0-beta.41",
+    "@orpc/contract": "2.0.0-beta.41",
+    "@orpc/server": "2.0.0-beta.41",
+    "@sqlite.org/sqlite-wasm": "3.53.4-build2",
+    "commander": "15.0.0",
+    "drizzle-orm": "1.0.0-rc.4",
+    "elkjs": "0.12.0"
+  },
+  "peerDependenciesMeta": {
+    "@orpc/client": {
+      "optional": true
+    },
+    "@orpc/contract": {
+      "optional": true
+    },
+    "@orpc/server": {
+      "optional": true
+    },
+    "@sqlite.org/sqlite-wasm": {
+      "optional": true
+    },
+    "commander": {
+      "optional": true
+    },
+    "drizzle-orm": {
+      "optional": true
+    },
+    "elkjs": {
+      "optional": true
+    }
   }
 }
diff --git a/packages/targets/process-graph/src/cli.ts b/packages/targets/process-graph/src/cli.ts
new file mode 100644
index 0000000..1c90461
--- /dev/null
+++ b/packages/targets/process-graph/src/cli.ts
@@ -0,0 +1,2 @@
+// The `process-graph/cli` entry point: the command line as a library. `runCli` runs the whole command surface against injected ports, `nodePorts` wires those ports for a Node process, and the operations behind each command and the Mermaid and DOT emitters return plain data. Node-only, which is why the root entry point does not carry it.
+export * from "@exadev/process-graph-cli";
diff --git a/packages/targets/process-graph/src/entrypoints.unit.test.ts b/packages/targets/process-graph/src/entrypoints.unit.test.ts
new file mode 100644
index 0000000..4004074
--- /dev/null
+++ b/packages/targets/process-graph/src/entrypoints.unit.test.ts
@@ -0,0 +1,95 @@
+import * as cliPackage from "@exadev/process-graph-cli";
+import * as layoutPackage from "@exadev/process-graph-layout";
+import * as sourceContractPackage from "@exadev/process-graph-source-contract";
+import * as githubIssuesPackage from "@exadev/process-graph-source-github-issues";
+import * as githubIssuesNodePackage from "@exadev/process-graph-source-github-issues/node";
+import * as sqliteNodePackage from "@exadev/process-graph-sqlite-node";
+import * as storeContractPackage from "@exadev/process-graph-store-contract";
+import * as storeSqlitePackage from "@exadev/process-graph-store-sqlite";
+import { describe, expect, test } from "vitest";
+import * as cliEntry from "./cli.ts";
+import * as layoutEntry from "./layout.ts";
+import * as githubEntry from "./source/github.ts";
+import * as githubNodeEntry from "./source/github/node.ts";
+import * as storeEntry from "./store.ts";
+import * as storeNodeEntry from "./store/node.ts";
+
+/** One subpath entry point and the bundled packages whose exports it carries flat. */
+interface Subpath {
+  readonly name: string;
+  readonly entry: object;
+  readonly layers: readonly (readonly [string, object])[];
+}
+
+// The browser store entries load SQLite's WebAssembly build and the Web APIs a worker uses, so their surface is checked in the browser integration test and against the built package in the smoke test, not here under Node.
+const subpaths: readonly Subpath[] = [
+  {
+    name: "layout",
+    entry: layoutEntry,
+    layers: [["layout", layoutPackage]],
+  },
+  {
+    name: "source/github",
+    entry: githubEntry,
+    layers: [
+      ["source-contract", sourceContractPackage],
+      ["source-github-issues", githubIssuesPackage],
+    ],
+  },
+  {
+    name: "source/github/node",
+    entry: githubNodeEntry,
+    layers: [["source-github-issues/node", githubIssuesNodePackage]],
+  },
+  {
+    name: "store",
+    entry: storeEntry,
+    layers: [
+      ["store-contract", storeContractPackage],
+      ["store-sqlite", storeSqlitePackage],
+    ],
+  },
+  {
+    name: "store/node",
+    entry: storeNodeEntry,
+    layers: [["sqlite-node", sqliteNodePackage]],
+  },
+  {
+    name: "cli",
+    entry: cliEntry,
+    layers: [["cli", cliPackage]],
+  },
+];
+
+describe.each(subpaths)(
+  "the process-graph/$name entry point",
+  ({ entry, layers }) => {
+    test("no name is exported by more than one of its layers", () => {
+      const owners = new Map<string, string[]>();
+      for (const [layer, exports] of layers) {
+        for (const name of Object.keys(exports)) {
+          owners.set(name, [...(owners.get(name) ?? []), layer]);
+        }
+      }
+      const duplicates = [...owners]
+        .filter(([, owning]) => owning.length > 1)
+        .map(([name, owning]) => `${name}: ${owning.join(", ")}`);
+
+      expect(duplicates).toEqual([]);
+    });
+
+    test("every runtime export of its layers is present and is the same value", () => {
+      for (const [, exports] of layers) {
+        for (const [name, value] of Object.entries(exports)) {
+          expect(entry).toHaveProperty([name], value);
+        }
+      }
+    });
+
+    test("it exports its layers and nothing else", () => {
+      const expected = layers.flatMap(([, exports]) => Object.keys(exports));
+
+      expect(Object.keys(entry).sort()).toEqual(expected.sort());
+    });
+  },
+);
diff --git a/packages/targets/process-graph/src/layout.ts b/packages/targets/process-graph/src/layout.ts
new file mode 100644
index 0000000..103a1bf
--- /dev/null
+++ b/packages/targets/process-graph/src/layout.ts
@@ -0,0 +1,2 @@
+// The `process-graph/layout` entry point: layered layout of a projected flowchart, swimlane or state machine into positions in the model's `views` shape. A subpath of its own because it carries elkjs, which an application that only reasons over a model never loads.
+export * from "@exadev/process-graph-layout";
diff --git a/packages/targets/process-graph/src/source/github.ts b/packages/targets/process-graph/src/source/github.ts
new file mode 100644
index 0000000..7cdef14
--- /dev/null
+++ b/packages/targets/process-graph/src/source/github.ts
@@ -0,0 +1,3 @@
+// The `process-graph/source/github` entry point: the `GraphSource` port (its oRPC contract, schemas, errors, router, pagination and in-memory fake) and the GitHub issues adapter that implements it. The adapter's token comes from an injected port; the Node token helper is `process-graph/source/github/node`, so this entry runs unchanged in a browser or a Worker. The two layers share no export name, which `entrypoints.unit.test.ts` checks.
+export * from "@exadev/process-graph-source-contract";
+export * from "@exadev/process-graph-source-github-issues";
diff --git a/packages/targets/process-graph/src/source/github/node.ts b/packages/targets/process-graph/src/source/github/node.ts
new file mode 100644
index 0000000..a81278e
--- /dev/null
+++ b/packages/targets/process-graph/src/source/github/node.ts
@@ -0,0 +1,2 @@
+// The `process-graph/source/github/node` entry point: `githubTokenFromEnvironment`, the Node token port that reads `GITHUB_TOKEN` or asks the GitHub CLI. Node-only, so it is apart from `process-graph/source/github`.
+export * from "@exadev/process-graph-source-github-issues/node";
diff --git a/packages/targets/process-graph/src/store.ts b/packages/targets/process-graph/src/store.ts
new file mode 100644
index 0000000..ebee95c
--- /dev/null
+++ b/packages/targets/process-graph/src/store.ts
@@ -0,0 +1,3 @@
+// The `process-graph/store` entry point: the `GraphStore` port (its oRPC contract, schemas, errors, change feed, structural queries, router and in-memory fake) and the SQLite store that implements it on any Drizzle SQLite database. A driver supplies the database: `process-graph/store/node` for Node, `process-graph/store/wasm` for the browser. The two layers share no export name, which `entrypoints.unit.test.ts` checks.
+export * from "@exadev/process-graph-store-contract";
+export * from "@exadev/process-graph-store-sqlite";
diff --git a/packages/targets/process-graph/src/store/node.ts b/packages/targets/process-graph/src/store/node.ts
new file mode 100644
index 0000000..e4e7d46
--- /dev/null
+++ b/packages/targets/process-graph/src/store/node.ts
@@ -0,0 +1,2 @@
+// The `process-graph/store/node` entry point: `openNodeGraphStore`, the SQLite store on Node's built-in `node:sqlite`, for the command line and servers.
+export * from "@exadev/process-graph-sqlite-node";
diff --git a/packages/targets/process-graph/src/store/wasm.ts b/packages/targets/process-graph/src/store/wasm.ts
new file mode 100644
index 0000000..f424844
--- /dev/null
+++ b/packages/targets/process-graph/src/store/wasm.ts
@@ -0,0 +1,2 @@
+// The `process-graph/store/wasm` entry point: `connectGraphStore`, which connects a page to the store a dedicated worker serves. The worker module imports `process-graph/store/wasm/worker`; the two are apart so the page never loads SQLite's WebAssembly build.
+export * from "@exadev/process-graph-sqlite-wasm";
diff --git a/packages/targets/process-graph/src/store/wasm/worker.ts b/packages/targets/process-graph/src/store/wasm/worker.ts
new file mode 100644
index 0000000..092be52
--- /dev/null
+++ b/packages/targets/process-graph/src/store/wasm/worker.ts
@@ -0,0 +1,2 @@
+// The `process-graph/store/wasm/worker` entry point: `serveGraphStoreInWorker`, called once at the top level of a dedicated worker module, which serves the SQLite store over SQLite compiled to WebAssembly on the OPFS `opfs-sahpool` VFS.
+export * from "@exadev/process-graph-sqlite-wasm/worker";
diff --git a/packages/targets/process-graph/tsconfig.build.json b/packages/targets/process-graph/tsconfig.build.json
deleted file mode 100644
index d97c05c..0000000
--- a/packages/targets/process-graph/tsconfig.build.json
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  "extends": "./tsconfig.json",
-  "compilerOptions": {
-    "composite": true,
-    "noEmit": false,
-    "declaration": true,
-    "declarationMap": false,
-    "rootDir": "src",
-    "outDir": "dist",
-    "rewriteRelativeImportExtensions": true,
-    "types": ["node"]
-  },
-  "include": ["src/**/*.ts"],
-  "exclude": ["src/**/*.test.ts", "src/test-support/**"],
-  "references": [
-    {
-      "path": "../../core/graph/dag/tsconfig.build.json"
-    },
-    {
-      "path": "../../core/graph/schema/tsconfig.build.json"
-    },
-    {
-      "path": "../../core/graph/projection/tsconfig.build.json"
-    },
-    {
-      "path": "../../core/graph/domain/tsconfig.build.json"
-    },
-    {
-      "path": "../graph-cli/tsconfig.build.json"
-    }
-  ]
-}
diff --git a/packages/targets/process-graph/tsconfig.json b/packages/targets/process-graph/tsconfig.json
index 9ef2ac0..2106378 100644
--- a/packages/targets/process-graph/tsconfig.json
+++ b/packages/targets/process-graph/tsconfig.json
@@ -5,5 +5,12 @@
     "types": []
   },
   "include": ["src/**/*.ts"],
-  "exclude": ["src/**/*.test.ts", "src/test-support/**", "src/bin.ts"]
+  "exclude": [
+    "src/**/*.test.ts",
+    "src/test-support/**",
+    "src/bin.ts",
+    "src/cli.ts",
+    "src/store/node.ts",
+    "src/source/github/node.ts"
+  ]
 }
diff --git a/packages/targets/process-graph/tsdown.config.ts b/packages/targets/process-graph/tsdown.config.ts
new file mode 100644
index 0000000..6068272
--- /dev/null
+++ b/packages/targets/process-graph/tsdown.config.ts
@@ -0,0 +1,31 @@
+import { defineConfig } from "tsdown";
+
+/**
+ * The published `process-graph` package is a bundle. Each subpath of its exports map is one entry here, built from the `src/` module of the same path, and the private workspace packages those modules re-export are inlined, JavaScript and declarations alike, so the published files never name a package that is not on the registry. Code two entries share is emitted once as a chunk, so importing one subpath loads only what that subpath reaches.
+ *
+ * `onlyBundle` is the guarantee rather than a hint: the build fails if anything from `node_modules` other than a workspace package would be inlined, so every third-party library stays an import resolved from the consumer's own install, as declared in `package.json`. Node builtins stay imports too, since the neutral platform leaves them unresolved; the entries that reach them (`cli`, `bin`, `store/node`, `source/github/node`) are the Node-only ones.
+ */
+export default defineConfig({
+  entry: {
+    index: "src/index.ts",
+    layout: "src/layout.ts",
+    "source/github": "src/source/github.ts",
+    "source/github/node": "src/source/github/node.ts",
+    store: "src/store.ts",
+    "store/node": "src/store/node.ts",
+    "store/wasm": "src/store/wasm.ts",
+    "store/wasm/worker": "src/store/wasm/worker.ts",
+    cli: "src/cli.ts",
+    bin: "src/bin.ts",
+  },
+  format: ["esm"],
+  platform: "neutral",
+  dts: { resolver: "tsc" },
+  deps: {
+    neverBundle: [/^node:/],
+    onlyBundle: [/^@exadev\/process-graph-/],
+    dts: { alwaysBundle: [/^@exadev\/process-graph-/] },
+  },
+  tsconfig: "tsconfig.node.json",
+  clean: true,
+});
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 0d1a021..75d78ad 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -774,6 +774,70 @@ importers:
         specifier: 5.0.3
         version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
 
+  packages/targets/graph-cli:
+    dependencies:
+      '@exadev/process-graph-dag':
+        specifier: 1.1.0
+        version: link:../../core/graph/dag
+      '@exadev/process-graph-domain':
+        specifier: 1.1.1
+        version: link:../../core/graph/domain
+      '@exadev/process-graph-projection':
+        specifier: 1.1.0
+        version: link:../../core/graph/projection
+      '@exadev/process-graph-schema':
+        specifier: 1.1.0
+        version: link:../../core/graph/schema
+      '@exadev/process-graph-source-contract':
+        specifier: 1.1.0
+        version: link:../../core/graph/source-contract
+      '@exadev/process-graph-source-github-issues':
+        specifier: 1.1.0
+        version: link:../../adapters/graph/source-github-issues
+      '@exadev/process-graph-sqlite-node':
+        specifier: 1.0.4
+        version: link:../../adapters/graph/sqlite-node
+      '@exadev/process-graph-store-contract':
+        specifier: 1.1.0
+        version: link:../../core/graph/store-contract
+      '@orpc/server':
+        specifier: 2.0.0-beta.41
+        version: 2.0.0-beta.41
+      commander:
+        specifier: 15.0.0
+        version: 15.0.0
+    devDependencies:
+      '@arethetypeswrong/cli':
+        specifier: 0.18.5
+        version: 0.18.5
+      '@stryker-mutator/core':
+        specifier: 10.0.0
+        version: 10.0.0(@types/node@26.6.4)
+      '@stryker-mutator/typescript-checker':
+        specifier: 10.0.0
+        version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(typescript@6.0.3)
+      '@stryker-mutator/vitest-runner':
+        specifier: 10.0.0
+        version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(vitest@5.0.3)
+      '@types/node':
+        specifier: 26.6.4
+        version: 26.6.4
+      '@vitest/coverage-v8':
+        specifier: 5.0.3
+        version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
+      eslint:
+        specifier: 10.12.0
+        version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
+      publint:
+        specifier: 0.3.25
+        version: 0.3.25
+      typescript:
+        specifier: 6.0.3
+        version: 6.0.3
+      vitest:
+        specifier: 5.0.3
+        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+
   packages/targets/graph-web:
     dependencies:
       '@exadev/process-graph-domain':
@@ -874,14 +938,30 @@ importers:
         specifier: 7.4.1
         version: 7.4.1
 
-  packages/targets/graph-cli:
+  packages/targets/process-graph:
     dependencies:
+      trilean:
+        specifier: 1.7.2
+        version: 1.7.2
+      zod:
+        specifier: 4.6.5
+        version: 4.6.5
+    devDependencies:
+      '@arethetypeswrong/cli':
+        specifier: 0.18.5
+        version: 0.18.5
+      '@exadev/process-graph-cli':
+        specifier: 0.0.0
+        version: link:../graph-cli
       '@exadev/process-graph-dag':
         specifier: 1.1.0
         version: link:../../core/graph/dag
       '@exadev/process-graph-domain':
         specifier: 1.1.1
         version: link:../../core/graph/domain
+      '@exadev/process-graph-layout':
+        specifier: 1.0.3
+        version: link:../../core/graph/layout
       '@exadev/process-graph-projection':
         specifier: 1.1.0
         version: link:../../core/graph/projection
@@ -897,68 +977,27 @@ importers:
       '@exadev/process-graph-sqlite-node':
         specifier: 1.0.4
         version: link:../../adapters/graph/sqlite-node
+      '@exadev/process-graph-sqlite-wasm':
+        specifier: 1.0.3
+        version: link:../../adapters/graph/sqlite-wasm
       '@exadev/process-graph-store-contract':
         specifier: 1.1.0
         version: link:../../core/graph/store-contract
+      '@exadev/process-graph-store-sqlite':
+        specifier: 1.1.0
+        version: link:../../adapters/graph/store-sqlite
+      '@orpc/client':
+        specifier: 2.0.0-beta.41
+        version: 2.0.0-beta.41
+      '@orpc/contract':
+        specifier: 2.0.0-beta.41
+        version: 2.0.0-beta.41
       '@orpc/server':
         specifier: 2.0.0-beta.41
         version: 2.0.0-beta.41
-      commander:
-        specifier: 15.0.0
-        version: 15.0.0
-    devDependencies:
-      '@arethetypeswrong/cli':
-        specifier: 0.18.5
-        version: 0.18.5
-      '@stryker-mutator/core':
-        specifier: 10.0.0
-        version: 10.0.0(@types/node@26.6.4)
-      '@stryker-mutator/typescript-checker':
-        specifier: 10.0.0
-        version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(typescript@6.0.3)
-      '@stryker-mutator/vitest-runner':
-        specifier: 10.0.0
-        version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(vitest@5.0.3)
-      '@types/node':
-        specifier: 26.6.4
-        version: 26.6.4
-      '@vitest/coverage-v8':
-        specifier: 5.0.3
-        version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
-      eslint:
-        specifier: 10.12.0
-        version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
-      publint:
-        specifier: 0.3.25
-        version: 0.3.25
-      typescript:
-        specifier: 6.0.3
-        version: 6.0.3
-      vitest:
-        specifier: 5.0.3
-        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(yaml@2.9.1))
-
-  packages/targets/process-graph:
-    dependencies:
-      '@exadev/process-graph-cli':
-        specifier: 0.0.0
-        version: link:../graph-cli
-      '@exadev/process-graph-dag':
-        specifier: 1.1.0
-        version: link:../../core/graph/dag
-      '@exadev/process-graph-domain':
-        specifier: 1.1.1
-        version: link:../../core/graph/domain
-      '@exadev/process-graph-projection':
-        specifier: 1.1.0
-        version: link:../../core/graph/projection
-      '@exadev/process-graph-schema':
-        specifier: 1.1.0
-        version: link:../../core/graph/schema
-    devDependencies:
-      '@arethetypeswrong/cli':
-        specifier: 0.18.5
-        version: 0.18.5
+      '@sqlite.org/sqlite-wasm':
+        specifier: 3.53.4-build2
+        version: 3.53.4-build2
       '@stryker-mutator/core':
         specifier: 10.0.0
         version: 10.0.0(@types/node@26.6.4)
@@ -974,12 +1013,24 @@ importers:
       '@vitest/coverage-v8':
         specifier: 5.0.3
         version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
+      commander:
+        specifier: 15.0.0
+        version: 15.0.0
+      drizzle-orm:
+        specifier: 1.0.0-rc.4
+        version: 1.0.0-rc.4(zod@4.6.5)
+      elkjs:
+        specifier: 0.12.0
+        version: 0.12.0
       eslint:
         specifier: 10.12.0
         version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
       publint:
         specifier: 0.3.25
         version: 0.3.25
+      tsdown:
+        specifier: 0.23.0
+        version: 0.23.0(@arethetypeswrong/core@0.18.5)(oxc-resolver@11.24.2)(publint@0.3.25)(typescript@6.0.3)
       typescript:
         specifier: 6.0.3
         version: 6.0.3
@@ -2883,6 +2934,9 @@ packages:
     resolution: {integrity: sha512-4EDEmvxWtgsCnnVeBvtFIFZtUhPPt1+bA9JrSwU4Sa//6oKtzCSlGGXYJr44OD9aGISymbieJ4mCKHUygUDU+g==}
     engines: {node: '>=18'}
 
+  '@quansync/fs@1.1.0':
+    resolution: {integrity: sha512-qAPG/t3HqML1TlN7sY/pTbEjzFVAKsMjNNMGheyDosro+kT4iw2KCUoHcVdmliwWjorm4elZbgNQyU2eD97eDg==}
+
   '@resvg/resvg-js-android-arm-eabi@2.6.2':
     resolution: {integrity: sha512-FrJibrAk6v29eabIPgcTUMPXiEz8ssrAk7TXxsiZzww9UTQ1Z5KAbFJs+Z0Ez+VZTYgnE5IQJqBcoSiMebtPHA==}
     engines: {node: '>= 10'}
@@ -3760,6 +3814,141 @@ packages:
   '@xyflow/system@0.0.83':
     resolution: {integrity: sha512-a//eDjez3WZF47aaPTfVUDD0OINOq+WVwBZCRTqG+m0a5euX8EwlJ4jMY1Wxz0Ocj4xOeekJ70V22Pq0ll8RJw==}
 
+  '@yuku-codegen/binding-android-arm64@0.10.2':
+    resolution: {integrity: sha512-Oc2KInVkPfUjEB4PeV6X0NvIoyYTzDe/WmqFrTwBqKs6YKnz4A7XwWQvJTb7M0rLz9a6WgpUUiiS5QKaCi4O/g==}
+    cpu: [arm64]
+    os: [android]
+
+  '@yuku-codegen/binding-darwin-arm64@0.10.2':
+    resolution: {integrity: sha512-3H7eNPIHJndUJXZ4QUGBPq1zC6RGcUZfm7bymJes+/N7wTVWUn1bxZ9JcozYHpkWQNm9f23G8YWbaHD9aYH72A==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@yuku-codegen/binding-darwin-x64@0.10.2':
+    resolution: {integrity: sha512-AJOUpR2s3LF9AWiiub/Uyc/UoXNTWcq8hK3cVI6fUSXtwh34dG21J6hRuNlO6JVJFTo4o3ScVvZOrh/YFfUEAA==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@yuku-codegen/binding-freebsd-x64@0.10.2':
+    resolution: {integrity: sha512-ms7DcZu87u5CiK/wMwvpKAvAmtaqKjCQIXNweMLypG6qbuiaOMQf1jpbB5+j46xBcgCovo8TQMcv0bCQLKIL9w==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@yuku-codegen/binding-linux-arm-gnu@0.10.2':
+    resolution: {integrity: sha512-xJDpYAsKV5+eaiBhTYl05fvT6sst4PsCeuIFMRu9b0/WCSrNQPfCDtAQ5/MS6xNpsdujdZEPR+gmfWk3ZG5i3A==}
+    cpu: [arm]
+    os: [linux]
+    libc: [glibc]
+
+  '@yuku-codegen/binding-linux-arm-musl@0.10.2':
+    resolution: {integrity: sha512-qfTkgd7AEx61l4K9VtXWCGTxc/fmXJ4ZheDz3i+/AAJUtg4sa0bPrc0VBxPggB/rayR8Z3+JfrBItuyanBJJ9Q==}
+    cpu: [arm]
+    os: [linux]
+    libc: [musl]
+
+  '@yuku-codegen/binding-linux-arm64-gnu@0.10.2':
+    resolution: {integrity: sha512-4e6Mifm/4UdjtU3D8mATIrvgP+xEiH8xtQOjd0zpd72XKWT7ug3sdyhq2utkkZFP6BvYp7SgZrI+aR4VeIOHdw==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@yuku-codegen/binding-linux-arm64-musl@0.10.2':
+    resolution: {integrity: sha512-RdsJrUfDYFVV3JOmWFUWwSu31fa1APn12xDeIKxgl/YWxrabwtxsDBNjF2561c7tmcbiewdCUvngqRs8AyGVLA==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@yuku-codegen/binding-linux-x64-gnu@0.10.2':
+    resolution: {integrity: sha512-mVzWimEPPreaPyXIUvxsHoJzvO7ckZ5j0LgQFHz04zQIRwt9A9T2hA7K5/jYjJKkMxWG/U2VjhGNwVhtyU+uqg==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@yuku-codegen/binding-linux-x64-musl@0.10.2':
+    resolution: {integrity: sha512-Y77fyISurmr2mvO1yeq3u+x/WJbACgPR4w+lzEVx30ViCxZzIGrZPRN1yEdZ9xUNPNsIO5thBHIdRNG+UGUG+Q==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@yuku-codegen/binding-win32-arm64@0.10.2':
+    resolution: {integrity: sha512-1+tGLyG0u5YYy0lev4ck7/0sd8xJ9SZde0dLut7qLDPZV5WVTV8x6OxNXUne/PGuHZyO1vK+txPQzzHOyXHGSw==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@yuku-codegen/binding-win32-x64@0.10.2':
+    resolution: {integrity: sha512-8a2SExRohRbwC0MY4VpOF0/RSckrJ2ASZqAor5/RYSJJaeadR93n10gZzcKT6pY9ukiSOIZCRKVRD2tH73T0qA==}
+    cpu: [x64]
+    os: [win32]
+
+  '@yuku-parser/binding-android-arm64@0.10.2':
+    resolution: {integrity: sha512-2VPBU9fRGRAQ2xPAvghnec3oou5Nrxm2Bezhf+13UMspAxQSkF/32r+ySKXSwIPA5/RivumDJDxAxc301Sgicw==}
+    cpu: [arm64]
+    os: [android]
+
+  '@yuku-parser/binding-darwin-arm64@0.10.2':
+    resolution: {integrity: sha512-LD+PMZE51tCYTOss5HBkm3/AE39MvcMDBfWJx7A4yDcjfNbAQDnHZKtzSOuqrswx+TQHY0ws5xn6+fWOwtmfBA==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@yuku-parser/binding-darwin-x64@0.10.2':
+    resolution: {integrity: sha512-mmZ8cND+AoIIMRERyMinlg5ApHxP23B9jH2B5wT7T+dliPa9rubLxneB/SUjFwyUjGaFnB5G7t4YvpfbO5zbkQ==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@yuku-parser/binding-freebsd-x64@0.10.2':
+    resolution: {integrity: sha512-gVIjaaIddbRfAhHlC8N809wQWml7mxfSVnzaLtzGXObTeFTPAg/YVnQXt1UOhPM1ah5eG/8Y0RUlNpB4GVe7eQ==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@yuku-parser/binding-linux-arm-gnu@0.10.2':
+    resolution: {integrity: sha512-q/XPPQQAPdlw05aPj30ygBhekmQryGOwxVraBgApjKK8yY1kNQgqq6XCYLF1WHSee+lhxclrTO7W0/bt7dR1GA==}
+    cpu: [arm]
+    os: [linux]
+    libc: [glibc]
+
+  '@yuku-parser/binding-linux-arm-musl@0.10.2':
+    resolution: {integrity: sha512-A+Cb0I1hFF4wilTQpWs79k1aNnj4B2tkrHx3zsuUNF9BtVY2zPZ4yeQEM/zjXrS/qJlNMZVK9NrWJjwdpnTrfg==}
+    cpu: [arm]
+    os: [linux]
+    libc: [musl]
+
+  '@yuku-parser/binding-linux-arm64-gnu@0.10.2':
+    resolution: {integrity: sha512-aGNSzqIqqphFwAdIFwVvKIyXD1Iy3CxrEJVIZAT87Ecyi4vCmmDD2v2l9h+Gd3/wSy3JZlOI792LJbKAjyy9rQ==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@yuku-parser/binding-linux-arm64-musl@0.10.2':
+    resolution: {integrity: sha512-Ddl1sF0rtuCXyHGSOV6dcmdx+ETv1iD+IVFqQuOjzkJZWclxJxdBWX6ZJMRtTiGqGUTbqLEKiTXxpR/Bvqk+2A==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@yuku-parser/binding-linux-x64-gnu@0.10.2':
+    resolution: {integrity: sha512-/nlcpR6IF5U+0m5L9wvAIXeQa2DT+BXuvqKDsTcOTlcc0B4dHNyqE5hTXsS4hAyimpy2ZK8A1zMNF5hTrjg2cg==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@yuku-parser/binding-linux-x64-musl@0.10.2':
+    resolution: {integrity: sha512-GX80dxTQD/M/OryyuxJcFzFENzry3cDFPvCFTyWogNWQH3fSHfMrNfpwpl1YzMos1eV9NygK5GSDG7VArQlb4w==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@yuku-parser/binding-win32-arm64@0.10.2':
+    resolution: {integrity: sha512-agePQBV4VHewiGU0ACSjscZ/hJd283f9JfAF19Gf1rI5+wy5tTgx4GS36i0b3xim15AQ4RCpDRosEvhLZ4zAOw==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@yuku-parser/binding-win32-x64@0.10.2':
+    resolution: {integrity: sha512-s8//CMpgL5+y1lvDCdyh1rwGI5+ytDJywFJRe1vnhI7n0j+caxshNucurikYLLVeQ2SYFex6aPrzgQxkabBQRA==}
+    cpu: [x64]
+    os: [win32]
+
+  '@yuku-toolchain/types@0.10.2':
+    resolution: {integrity: sha512-sSeo4SSSToiS+sSD+bwn/s94EEcaLJ7tG5LCp8gFYC1G5VzxzX7fqB6m9RU1yMD8KTpu6zdU/I1NlQf8hVBJ9Q==}
+
   acorn-jsx@5.3.2:
     resolution: {integrity: sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==}
     peerDependencies:
@@ -4295,6 +4484,9 @@ packages:
     resolution: {integrity: sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg==}
     engines: {node: '>= 0.4'}
 
+  defu@6.1.7:
+    resolution: {integrity: sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==}
+
   dequal@2.0.3:
     resolution: {integrity: sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==}
     engines: {node: '>=6'}
@@ -4481,6 +4673,15 @@ packages:
       zod:
         optional: true
 
+  dts-resolver@3.0.0:
+    resolution: {integrity: sha512-1T1f+z+4tl9XD+m+0HBgWoL/nm0bOIffyWaUuUSBlFg/86IWvfx+wjNaO/ybU0AJzG9/Mi5hBUgGV6zCmWEN7Q==}
+    engines: {node: ^22.18.0 || >=24.0.0}
+    peerDependencies:
+      oxc-resolver: '>=11.0.0'
+    peerDependenciesMeta:
+      oxc-resolver:
+        optional: true
+
   dunder-proto@1.0.1:
     resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
     engines: {node: '>= 0.4'}
@@ -4915,6 +5116,10 @@ packages:
   get-tsconfig@4.14.3:
     resolution: {integrity: sha512-++QEw4DIY7WGoukz+/+A/8dGYPT9l9yIadnmSgZ8Rjr3YVSVDipQSO9CdnJo9ePqFqUUqh+wk9uIaoiAwsiPkA==}
 
+  get-tsconfig@5.0.0-beta.6:
+    resolution: {integrity: sha512-X6fBC0pmImC70gvX2zm56go9hx0MyoGVdG0tUCkg/D+Xnh5TJsOZ7iDbOdI3PvmtrDxnu1YdDufpK2QJX1Meqw==}
+    engines: {node: '>=20.20.0'}
+
   git-log-parser@1.2.1:
     resolution: {integrity: sha512-PI+sPDvHXNPl5WNOErAK05s3j0lgwUzMN6o8cyQrDaKfT3qd7TmNJKeXX+SknI5I0QhG5fVPAEwSY4tRGDtYoQ==}
 
@@ -5010,6 +5215,9 @@ packages:
     resolution: {integrity: sha512-IHI4bEVOt3vRUDJ+bFA9VUJlo7SzvFARPNLw75pqSmAOP2HmTWfFJtPvLBrDrlgjEYXY9zs7SFdHPQaJShkSCQ==}
     engines: {node: '>=20'}
 
+  hookable@6.1.2:
+    resolution: {integrity: sha512-+abwxtiEA52GCVIsQqut3S/uKTbUwYIp4Pe/vv+6py5XiXBCqMZHg6pA6Y5qhgLSEys0/cYuPbO0z1QFj5ZCmg==}
+
   hookified@1.15.1:
     resolution: {integrity: sha512-MvG/clsADq1GPM2KGo2nyfaWVyn9naPiXrqIe4jYjXNZQt238kWyOGrsyc/DmRAQ+Re6yeo6yX/yoNCG5KAEVg==}
 
@@ -5074,6 +5282,10 @@ packages:
   import-meta-resolve@4.2.0:
     resolution: {integrity: sha512-Iqv2fzaTQN28s/FwZAoFq0ZSs/7hMAHJVX+w8PZl3cY19Pxk6jFFalxQoIfW2826i/fDLXv8IiEZRIT0lDuWcg==}
 
+  import-without-cache@0.4.1:
+    resolution: {integrity: sha512-vXoV9PjKHEednCUu01e98TkImxy67e3BJXbTIOmIq4Hyzw3IAwYRcuPkfeTzJzwyyts4kjuA73x+pWJLc4f86A==}
+    engines: {node: ^22.18.0 || >=24.0.0}
+
   imurmurhash@0.1.4:
     resolution: {integrity: sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==}
     engines: {node: '>=0.8.19'}
@@ -5926,6 +6138,10 @@ packages:
     resolution: {integrity: sha512-XrsrhT5sybtKI6wakr2SPOlGZWWYbUXZ7a0jT8/QOeAPau+1X/bSegNe5YR75oJmEZQbKningirmGOEJCIk61Q==}
     engines: {node: '>=12.20.0'}
 
+  obug@3.0.0:
+    resolution: {integrity: sha512-5vvB5+W7ePv+p3uqxi+RcW1XAzLW0/hxt3/4X4Lc4qHudzOhmBiBwOY6DRob4WnanAEGvNcLjF+KNOufrUoEQw==}
+    engines: {node: '>=12.20.0'}
+
   onetime@6.0.0:
     resolution: {integrity: sha512-1FlR+gjXK7X+AsAHso35MnyN5KqGwJRi/31ft6x0M194ht7S+rWAvd7PHss9xSKMzE0asv1pyIHaJYq+BbacAQ==}
     engines: {node: '>=12'}
@@ -6172,6 +6388,9 @@ packages:
     resolution: {integrity: sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==}
     engines: {node: '>=0.6'}
 
+  quansync@1.0.0:
+    resolution: {integrity: sha512-5xZacEEufv3HSTPQuchrvV6soaiACMFnq1H8wkVioctoH3TRha9Sz66lOxRwPK/qZj7HPiSveih9yAyh98gvqA==}
+
   radash@12.1.1:
     resolution: {integrity: sha512-h36JMxKRqrAxVD8201FrCpyeNuUY9Y5zZwujr20fFO77tpUtGa6EZzfKw/3WaiBX95fq7+MpsuMLNdSnORAwSA==}
     engines: {node: '>=14.18.0'}
@@ -6280,6 +6499,28 @@ packages:
     engines: {node: '>= 0.4'}
     hasBin: true
 
+  rolldown-plugin-dts@0.28.6:
+    resolution: {integrity: sha512-qKrFtBfRfR2hP233m7Ic9zf3wv6MSYdZghWKMdEO6dRYZGlNfINJAa1P5ZVvyHh3mrcd7IJQvIY8L9vnm+v5rQ==}
+    engines: {node: ^22.18.0 || ^24.11.0 || >=26.0.0}
+    peerDependencies:
+      '@typescript/native-preview': '*'
+      '@volar/typescript': ~2.4.0
+      '@vue/language-core': ~3.2.0 || ~3.3.0
+      rolldown: ^1.2.0
+      typescript: ^5.0.0 || ^6.0.0 || ~7.0.0
+      vue-tsc: ~3.2.0 || ~3.3.0
+    peerDependenciesMeta:
+      '@typescript/native-preview':
+        optional: true
+      '@volar/typescript':
+        optional: true
+      '@vue/language-core':
+        optional: true
+      typescript:
+        optional: true
+      vue-tsc:
+        optional: true
+
   rolldown@1.2.12:
     resolution: {integrity: sha512-8wafseiaG80xmXSfqidUNqZcylTlhmPZZt+za2m+js2sFZ8dTNlhIOV2WcbIPx2hgwPBJpEUGFAMZ9bgBBLTSQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
@@ -6686,6 +6927,40 @@ packages:
     peerDependencies:
       typescript: '>=4.8.4'
 
+  tsdown@0.23.0:
+    resolution: {integrity: sha512-BaT+ep1xnj5hdyICLd5r5SYYE+TXnI1ATePLykv9vcKpHpFTWUWRH+x1AF/E2qcu3YB6+vI8IdyxIIIffEqw5Q==}
+    engines: {node: ^22.18.0 || ^24.11.0 || >=26.0.0}
+    hasBin: true
+    peerDependencies:
+      '@arethetypeswrong/core': ^0.18.1
+      '@tsdown/css': 0.23.0
+      '@tsdown/exe': 0.23.0
+      '@vitejs/devtools': '*'
+      publint: ^0.3.8
+      tsx: '*'
+      typescript: ^5.0.0 || ^6.0.0 || ^7.0.0
+      unplugin-unused: '>=0.5.0'
+      unrun: '*'
+    peerDependenciesMeta:
+      '@arethetypeswrong/core':
+        optional: true
+      '@tsdown/css':
+        optional: true
+      '@tsdown/exe':
+        optional: true
+      '@vitejs/devtools':
+        optional: true
+      publint:
+        optional: true
+      tsx:
+        optional: true
+      typescript:
+        optional: true
+      unplugin-unused:
+        optional: true
+      unrun:
+        optional: true
+
   tslib@2.8.1:
     resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
 
@@ -6778,6 +7053,9 @@ packages:
     resolution: {integrity: sha512-nWJ91DjeOkej/TA8pXQ3myruKpKEYgqvpw9lz4OPHj/NWFNluYrjbz9j01CJ8yKQd2g4jFoOkINCTW2I5LEEyw==}
     engines: {node: '>= 0.4'}
 
+  unconfig-core@7.5.0:
+    resolution: {integrity: sha512-Su3FauozOGP44ZmKdHy2oE6LPjk51M/TRRjHv2HNCWiDvfvCoxC2lno6jevMA91MYAdCdwP05QnWdWpSbncX/w==}
+
   underscore@1.13.8:
     resolution: {integrity: sha512-DXtD3ZtEQzc7M8m4cXotyHR+FAS18C64asBYY5vqZexfYryNNnDc02W4hKg3rdQuqOYas1jkseX0+nZXjTXnvQ==}
 
@@ -6894,6 +7172,10 @@ packages:
     resolution: {integrity: sha512-zj/ob3UsvJGN0whEAKFp53REA5X66hvffVqoCtVQAakJKnKlH+/PcOfMoFwIG/o4rElqLv/ycAFlx8ZlXUorCg==}
     engines: {node: '>=18.12.0'}
 
+  verkit@0.4.1:
+    resolution: {integrity: sha512-mMVzj0TXExtVdlDEq+Mzp0eyOuyznNpFobNM3uAqe3HVm/Ps2c+u17BligMkZjZCA6EiXpoon8iRTer3iu40SQ==}
+    engines: {node: '>=18.12.0'}
+
   vite-node@6.0.0:
     resolution: {integrity: sha512-oj4PVrT+pDh6GYf5wfUXkcZyekYS8kKPfLPXVl8qe324Ec6l4K2DUKNadRbZ3LQl0qGcDz+PyOo7ZAh00Y+JjQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
@@ -7160,6 +7442,15 @@ packages:
     resolution: {integrity: sha512-xYqdZFUK/VYazNl/oCDYN+3WloWQwMfZxBoiNt6qNyk+xfOdi598muWE42rNZFp1kNOiqW936q5RhUdnpqElSg==}
     engines: {node: '>=18'}
 
+  yuku-ast@0.10.2:
+    resolution: {integrity: sha512-UnG9mA6giglCvSErft2/40TVFX750Sj1xgwddPLpG7J7rlr/P1wPADg9G2RK+d/1tNLtRVoLdMMOMVBB9561TQ==}
+
+  yuku-codegen@0.10.2:
+    resolution: {integrity: sha512-hentl2dtrF6cPjiAirtkfxfFZBA6Hdm61UqRJ7cA0qrlDNMk9PZGOjw5w1mx3E0hu/6pHcJF4dJW+D0SXHPZOA==}
+
+  yuku-parser@0.10.2:
+    resolution: {integrity: sha512-CgaU0/PPjCAIEZ3WQroosOxTY3eeKldAN3h+vk8pMNz4+jl1CZzBR4pW+K/rRPF112VooCL5FdjJoiMNjDrL2A==}
+
   zod-validation-error@4.0.2:
     resolution: {integrity: sha512-Q6/nZLe6jxuU80qb/4uJ4t5v2VEZ44lzQjPDhYJNztRQ4wyWc6VF3D3Kb/fAuPetZQnhS3hnajCf9CsWesghLQ==}
     engines: {node: '>=18.0.0'}
@@ -8938,6 +9229,10 @@ snapshots:
     dependencies:
       tinyexec: 1.3.1
 
+  '@quansync/fs@1.1.0':
+    dependencies:
+      quansync: 1.0.0
+
   '@resvg/resvg-js-android-arm-eabi@2.6.2':
     optional: true
 
@@ -9906,6 +10201,80 @@ snapshots:
       d3-selection: 3.0.0
       d3-zoom: 3.0.0
 
+  '@yuku-codegen/binding-android-arm64@0.10.2':
+    optional: true
+
+  '@yuku-codegen/binding-darwin-arm64@0.10.2':
+    optional: true
+
+  '@yuku-codegen/binding-darwin-x64@0.10.2':
+    optional: true
+
+  '@yuku-codegen/binding-freebsd-x64@0.10.2':
+    optional: true
+
+  '@yuku-codegen/binding-linux-arm-gnu@0.10.2':
+    optional: true
+
+  '@yuku-codegen/binding-linux-arm-musl@0.10.2':
+    optional: true
+
+  '@yuku-codegen/binding-linux-arm64-gnu@0.10.2':
+    optional: true
+
+  '@yuku-codegen/binding-linux-arm64-musl@0.10.2':
+    optional: true
+
+  '@yuku-codegen/binding-linux-x64-gnu@0.10.2':
+    optional: true
+
+  '@yuku-codegen/binding-linux-x64-musl@0.10.2':
+    optional: true
+
+  '@yuku-codegen/binding-win32-arm64@0.10.2':
+    optional: true
+
+  '@yuku-codegen/binding-win32-x64@0.10.2':
+    optional: true
+
+  '@yuku-parser/binding-android-arm64@0.10.2':
+    optional: true
+
+  '@yuku-parser/binding-darwin-arm64@0.10.2':
+    optional: true
+
+  '@yuku-parser/binding-darwin-x64@0.10.2':
+    optional: true
+
+  '@yuku-parser/binding-freebsd-x64@0.10.2':
+    optional: true
+
+  '@yuku-parser/binding-linux-arm-gnu@0.10.2':
+    optional: true
+
+  '@yuku-parser/binding-linux-arm-musl@0.10.2':
+    optional: true
+
+  '@yuku-parser/binding-linux-arm64-gnu@0.10.2':
+    optional: true
+
+  '@yuku-parser/binding-linux-arm64-musl@0.10.2':
+    optional: true
+
+  '@yuku-parser/binding-linux-x64-gnu@0.10.2':
+    optional: true
+
+  '@yuku-parser/binding-linux-x64-musl@0.10.2':
+    optional: true
+
+  '@yuku-parser/binding-win32-arm64@0.10.2':
+    optional: true
+
+  '@yuku-parser/binding-win32-x64@0.10.2':
+    optional: true
+
+  '@yuku-toolchain/types@0.10.2': {}
+
   acorn-jsx@5.3.2(acorn@8.18.0):
     dependencies:
       acorn: 8.18.0
@@ -10432,6 +10801,8 @@ snapshots:
       has-property-descriptors: 1.0.2
       object-keys: 1.1.1
 
+  defu@6.1.7: {}
+
   dequal@2.0.3: {}
 
   des.js@1.1.0:
@@ -10475,6 +10846,10 @@ snapshots:
     optionalDependencies:
       zod: 4.6.5
 
+  dts-resolver@3.0.0(oxc-resolver@11.24.2):
+    optionalDependencies:
+      oxc-resolver: 11.24.2
+
   dunder-proto@1.0.1:
     dependencies:
       call-bind-apply-helpers: 1.0.2
@@ -11091,6 +11466,10 @@ snapshots:
     dependencies:
       resolve-pkg-maps: 1.0.0
 
+  get-tsconfig@5.0.0-beta.6:
+    dependencies:
+      resolve-pkg-maps: 1.0.0
+
   git-log-parser@1.2.1:
     dependencies:
       argv-formatter: 1.0.0
@@ -11192,6 +11571,8 @@ snapshots:
 
   hook-std@4.0.0: {}
 
+  hookable@6.1.2: {}
+
   hookified@1.15.1: {}
 
   hookified@2.2.0: {}
@@ -11254,6 +11635,8 @@ snapshots:
 
   import-meta-resolve@4.2.0: {}
 
+  import-without-cache@0.4.1: {}
+
   imurmurhash@0.1.4: {}
 
   indent-string@5.0.0: {}
@@ -12199,6 +12582,8 @@ snapshots:
 
   obug@2.2.1: {}
 
+  obug@3.0.0: {}
+
   onetime@6.0.0:
     dependencies:
       mimic-fn: 4.0.0
@@ -12448,6 +12833,8 @@ snapshots:
     dependencies:
       side-channel: 1.1.1
 
+  quansync@1.0.0: {}
+
   radash@12.1.1: {}
 
   rc@1.2.8:
@@ -12581,6 +12968,20 @@ snapshots:
       path-parse: 1.0.7
       supports-preserve-symlinks-flag: 1.0.0
 
+  rolldown-plugin-dts@0.28.6(oxc-resolver@11.24.2)(rolldown@1.2.12)(typescript@6.0.3):
+    dependencies:
+      dts-resolver: 3.0.0(oxc-resolver@11.24.2)
+      get-tsconfig: 5.0.0-beta.6
+      obug: 3.0.0
+      rolldown: 1.2.12
+      yuku-ast: 0.10.2
+      yuku-codegen: 0.10.2
+      yuku-parser: 0.10.2
+    optionalDependencies:
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - oxc-resolver
+
   rolldown@1.2.12:
     dependencies:
       '@oxc-project/types': 0.152.0
@@ -13079,6 +13480,33 @@ snapshots:
     dependencies:
       typescript: 6.0.3
 
+  tsdown@0.23.0(@arethetypeswrong/core@0.18.5)(oxc-resolver@11.24.2)(publint@0.3.25)(typescript@6.0.3):
+    dependencies:
+      cac: 7.0.0
+      defu: 6.1.7
+      empathic: 2.1.0
+      hookable: 6.1.2
+      import-without-cache: 0.4.1
+      obug: 2.2.1
+      picomatch: 4.0.7
+      rolldown: 1.2.12
+      rolldown-plugin-dts: 0.28.6(oxc-resolver@11.24.2)(rolldown@1.2.12)(typescript@6.0.3)
+      tinyexec: 1.3.1
+      tinyglobby: 0.2.17
+      tree-kill: 1.2.2
+      unconfig-core: 7.5.0
+      verkit: 0.4.1
+    optionalDependencies:
+      '@arethetypeswrong/core': 0.18.5
+      publint: 0.3.25
+      typescript: 6.0.3
+    transitivePeerDependencies:
+      - '@typescript/native-preview'
+      - '@volar/typescript'
+      - '@vue/language-core'
+      - oxc-resolver
+      - vue-tsc
+
   tslib@2.8.1: {}
 
   tunnel@0.0.6: {}
@@ -13179,6 +13607,11 @@ snapshots:
       has-symbols: 1.1.0
       which-boxed-primitive: 1.1.1
 
+  unconfig-core@7.5.0:
+    dependencies:
+      '@quansync/fs': 1.1.0
+      quansync: 1.0.0
+
   underscore@1.13.8: {}
 
   undici-types@8.9.0: {}
@@ -13273,6 +13706,8 @@ snapshots:
 
   verkit@0.3.2: {}
 
+  verkit@0.4.1: {}
+
   vite-node@6.0.0(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1):
     dependencies:
       cac: 7.0.0
@@ -13572,6 +14007,45 @@ snapshots:
 
   yoctocolors@2.2.0: {}
 
+  yuku-ast@0.10.2:
+    dependencies:
+      '@yuku-toolchain/types': 0.10.2
+
+  yuku-codegen@0.10.2:
+    dependencies:
+      '@yuku-toolchain/types': 0.10.2
+    optionalDependencies:
+      '@yuku-codegen/binding-android-arm64': 0.10.2
+      '@yuku-codegen/binding-darwin-arm64': 0.10.2
+      '@yuku-codegen/binding-darwin-x64': 0.10.2
+      '@yuku-codegen/binding-freebsd-x64': 0.10.2
+      '@yuku-codegen/binding-linux-arm-gnu': 0.10.2
+      '@yuku-codegen/binding-linux-arm-musl': 0.10.2
+      '@yuku-codegen/binding-linux-arm64-gnu': 0.10.2
+      '@yuku-codegen/binding-linux-arm64-musl': 0.10.2
+      '@yuku-codegen/binding-linux-x64-gnu': 0.10.2
+      '@yuku-codegen/binding-linux-x64-musl': 0.10.2
+      '@yuku-codegen/binding-win32-arm64': 0.10.2
+      '@yuku-codegen/binding-win32-x64': 0.10.2
+
+  yuku-parser@0.10.2:
+    dependencies:
+      '@yuku-toolchain/types': 0.10.2
+      yuku-ast: 0.10.2
+    optionalDependencies:
+      '@yuku-parser/binding-android-arm64': 0.10.2
+      '@yuku-parser/binding-darwin-arm64': 0.10.2
+      '@yuku-parser/binding-darwin-x64': 0.10.2
+      '@yuku-parser/binding-freebsd-x64': 0.10.2
+      '@yuku-parser/binding-linux-arm-gnu': 0.10.2
+      '@yuku-parser/binding-linux-arm-musl': 0.10.2
+      '@yuku-parser/binding-linux-arm64-gnu': 0.10.2
+      '@yuku-parser/binding-linux-arm64-musl': 0.10.2
+      '@yuku-parser/binding-linux-x64-gnu': 0.10.2
+      '@yuku-parser/binding-linux-x64-musl': 0.10.2
+      '@yuku-parser/binding-win32-arm64': 0.10.2
+      '@yuku-parser/binding-win32-x64': 0.10.2
+
   zod-validation-error@4.0.2(zod@4.6.5):
     dependencies:
       zod: 4.6.5
diff --git a/tsconfig.build.json b/tsconfig.build.json
index 8f135a5..952697f 100644
--- a/tsconfig.build.json
+++ b/tsconfig.build.json
@@ -45,9 +45,6 @@
     },
     {
       "path": "packages/targets/graph-cli/tsconfig.build.json"
-    },
-    {
-      "path": "packages/targets/process-graph/tsconfig.build.json"
     }
   ]
 }
diff --git a/turbo.json b/turbo.json
index ec52686..9935a45 100644
--- a/turbo.json
+++ b/turbo.json
@@ -13,7 +13,12 @@
   "tasks": {
     "_build": {
       "dependsOn": ["^_build"],
-      "inputs": ["src/**", "tsconfig.build.json", "package.json"],
+      "inputs": [
+        "src/**",
+        "tsconfig.build.json",
+        "tsdown.config.ts",
+        "package.json"
+      ],
       "outputs": ["dist/**"]
     },
     "_typecheck": {

From 722f748305114ddbc9a2e2703362e56f3d9f116e Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 04:43:04 +0100
Subject: [PATCH 06/31] build(knip): read the process-graph entries from its
 bundler

knip takes the package's entry points from its tsdown configuration. The bundle's
optional peers that only the built output imports are named, since knip traces
src/, which reaches them through the workspace packages the bundle inlines.
---
 knip.config.ts | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/knip.config.ts b/knip.config.ts
index 1224d3a..9144abf 100644
--- a/knip.config.ts
+++ b/knip.config.ts
@@ -28,6 +28,17 @@ const config: KnipConfig = {
       entry: ["src/index.{ts,tsx}"],
       project: ["src/**/*.{ts,tsx}!"],
     },
+    "packages/targets/process-graph": {
+      // Its entries are its tsdown entries, the bin included, which knip's tsdown plugin reads.
+      project: ["src/**/*.{ts,tsx}!"],
+      // Optional peer dependencies of the bundle that nothing else in this workspace declares as a peer. Each is also a devDependency, as `pnpm add --save-peer` writes it, so the built bundle that the smoke tests run resolves it here; only the bundle imports it, since `src/` reaches it through the workspace packages it inlines, and knip traces `src/`. knip reports an entry here that stops being needed and a new peer missing from it, so the list cannot drift silently.
+      ignoreDependencies: [
+        "@orpc/client",
+        "@sqlite.org/sqlite-wasm",
+        "commander",
+        "elkjs",
+      ],
+    },
     "packages/targets/*": {
       // A target's bin is an entry point of its own, run as a process rather than imported.
       entry: ["src/index.{ts,tsx}", "src/bin.ts"],

From 44c25fcd971d506c01765a21bd217ed0edc4cde9 Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 04:43:22 +0100
Subject: [PATCH 07/31] feat(process-graph): expose the React UI packages as
 subpaths

The headless hooks and components, the styled components and the React Flow
views are bundled as process-graph/react, process-graph/ui and
process-graph/react-flow. They stay three subpaths because the styled
components reuse the headless components' names. The bundler carries no CSS
across, so the two compiled stylesheets are copied beside their subpaths and
exported as ui/style.css and react-flow/style.css, and stylesheets are listed
as side effects. React, React DOM, React Flow and Vanilla Extract are optional
peer dependencies.
---
 .../targets/process-graph/eslint.config.ts    |  5 +-
 packages/targets/process-graph/package.json   | 52 +++++++++++++++++--
 .../src/entrypoints.unit.test.ts              | 21 ++++++++
 .../targets/process-graph/src/react-flow.ts   |  2 +
 packages/targets/process-graph/src/react.ts   |  2 +
 packages/targets/process-graph/src/ui.ts      |  2 +
 .../targets/process-graph/tsdown.config.ts    | 17 ++++++
 pnpm-lock.yaml                                | 27 ++++++++++
 8 files changed, 123 insertions(+), 5 deletions(-)
 create mode 100644 packages/targets/process-graph/src/react-flow.ts
 create mode 100644 packages/targets/process-graph/src/react.ts
 create mode 100644 packages/targets/process-graph/src/ui.ts

diff --git a/packages/targets/process-graph/eslint.config.ts b/packages/targets/process-graph/eslint.config.ts
index 92b9766..9a175af 100644
--- a/packages/targets/process-graph/eslint.config.ts
+++ b/packages/targets/process-graph/eslint.config.ts
@@ -10,6 +10,9 @@ const subpathEntries = [
   "src/store/node.ts",
   "src/store/wasm.ts",
   "src/store/wasm/worker.ts",
+  "src/react.ts",
+  "src/ui.ts",
+  "src/react-flow.ts",
   "src/cli.ts",
 ];
 
@@ -26,7 +29,7 @@ export default defineConfig(
     ],
   }),
   {
-    // Every subpath of this package is an entry point whose whole content is a re-export, the same as `src/index.ts`. The policy's `single` mode recognises only `src/index.ts` as an entry point, so the subpath modules are declared here instead; each still contains nothing but re-exports, which `entrypoints.unit.test.ts` checks against the packages it bundles.
+    // Every subpath of this package is an entry point whose whole content is a re-export, the same as `src/index.ts`. The policy's `single` mode recognises only `src/index.ts` as an entry point, so the subpath modules are declared here instead; each still contains nothing but re-exports, and `entrypoints.unit.test.ts` and the smoke test check each one's surface against the packages it bundles.
     files: subpathEntries,
     rules: { "exadev/barrel-policy": "off" },
   },
diff --git a/packages/targets/process-graph/package.json b/packages/targets/process-graph/package.json
index b15575d..f9a14a2 100644
--- a/packages/targets/process-graph/package.json
+++ b/packages/targets/process-graph/package.json
@@ -48,6 +48,20 @@
       "types": "./dist/store/wasm/worker.d.ts",
       "import": "./dist/store/wasm/worker.js"
     },
+    "./react": {
+      "types": "./dist/react.d.ts",
+      "import": "./dist/react.js"
+    },
+    "./ui": {
+      "types": "./dist/ui.d.ts",
+      "import": "./dist/ui.js"
+    },
+    "./react-flow": {
+      "types": "./dist/react-flow.d.ts",
+      "import": "./dist/react-flow.js"
+    },
+    "./ui/style.css": "./dist/ui/style.css",
+    "./react-flow/style.css": "./dist/react-flow/style.css",
     "./cli": {
       "types": "./dist/cli.d.ts",
       "import": "./dist/cli.js"
@@ -63,7 +77,8 @@
     "registry": "https://registry.npmjs.org/"
   },
   "sideEffects": [
-    "./dist/bin.js"
+    "./dist/bin.js",
+    "*.css"
   ],
   "license": "MIT",
   "scripts": {
@@ -74,7 +89,7 @@
     "_lint:fix": "eslint . --fix --cache --max-warnings 0",
     "typecheck": "turbo run _typecheck _typecheck:attw",
     "_typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.node.json --noEmit",
-    "_typecheck:attw": "attw --pack --profile esm-only",
+    "_typecheck:attw": "attw --pack --profile esm-only --exclude-entrypoints ./ui/style.css ./react-flow/style.css",
     "test": "turbo run _test",
     "_test": "vitest run --project unit",
     "test:coverage": "turbo run _test:coverage",
@@ -83,7 +98,7 @@
     "_test:smoke": "vitest run --project smoke",
     "test:mutation": "turbo run _test:mutation",
     "_test:mutation": "stryker run stryker.config.ts",
-    "prepublishOnly": "pnpm run lint && pnpm run typecheck && pnpm run test && pnpm run build && publint && attw --pack --profile esm-only"
+    "prepublishOnly": "pnpm run lint && pnpm run typecheck && pnpm run test && pnpm run build && publint && attw --pack --profile esm-only --exclude-entrypoints ./ui/style.css ./react-flow/style.css"
   },
   "keywords": [
     "process-model",
@@ -100,6 +115,8 @@
     "@exadev/process-graph-domain": "1.1.1",
     "@exadev/process-graph-layout": "1.0.3",
     "@exadev/process-graph-projection": "1.1.0",
+    "@exadev/process-graph-react": "1.0.1",
+    "@exadev/process-graph-react-flow": "1.0.1",
     "@exadev/process-graph-schema": "1.1.0",
     "@exadev/process-graph-source-contract": "1.1.0",
     "@exadev/process-graph-source-github-issues": "1.1.0",
@@ -107,6 +124,7 @@
     "@exadev/process-graph-sqlite-wasm": "1.0.3",
     "@exadev/process-graph-store-contract": "1.1.0",
     "@exadev/process-graph-store-sqlite": "1.1.0",
+    "@exadev/process-graph-ui": "1.0.1",
     "@orpc/client": "2.0.0-beta.41",
     "@orpc/contract": "2.0.0-beta.41",
     "@orpc/server": "2.0.0-beta.41",
@@ -115,12 +133,18 @@
     "@stryker-mutator/typescript-checker": "10.0.0",
     "@stryker-mutator/vitest-runner": "10.0.0",
     "@types/node": "26.6.4",
+    "@types/react": "19.3.0",
+    "@vanilla-extract/css": "1.21.2",
+    "@vanilla-extract/recipes": "0.5.7",
     "@vitest/coverage-v8": "5.0.3",
+    "@xyflow/react": "12.12.0",
     "commander": "15.0.0",
     "drizzle-orm": "1.0.0-rc.4",
     "elkjs": "0.12.0",
     "eslint": "10.12.0",
     "publint": "0.3.25",
+    "react": "19.3.0",
+    "react-dom": "19.3.0",
     "tsdown": "0.23.0",
     "typescript": "6.0.3",
     "vitest": "5.0.3"
@@ -134,9 +158,14 @@
     "@orpc/contract": "2.0.0-beta.41",
     "@orpc/server": "2.0.0-beta.41",
     "@sqlite.org/sqlite-wasm": "3.53.4-build2",
+    "@vanilla-extract/css": "1.21.2",
+    "@vanilla-extract/recipes": "0.5.7",
+    "@xyflow/react": "12.12.0",
     "commander": "15.0.0",
     "drizzle-orm": "1.0.0-rc.4",
-    "elkjs": "0.12.0"
+    "elkjs": "0.12.0",
+    "react": "19.3.0",
+    "react-dom": "19.3.0"
   },
   "peerDependenciesMeta": {
     "@orpc/client": {
@@ -151,6 +180,15 @@
     "@sqlite.org/sqlite-wasm": {
       "optional": true
     },
+    "@vanilla-extract/css": {
+      "optional": true
+    },
+    "@vanilla-extract/recipes": {
+      "optional": true
+    },
+    "@xyflow/react": {
+      "optional": true
+    },
     "commander": {
       "optional": true
     },
@@ -159,6 +197,12 @@
     },
     "elkjs": {
       "optional": true
+    },
+    "react": {
+      "optional": true
+    },
+    "react-dom": {
+      "optional": true
     }
   }
 }
diff --git a/packages/targets/process-graph/src/entrypoints.unit.test.ts b/packages/targets/process-graph/src/entrypoints.unit.test.ts
index 4004074..81fb4b5 100644
--- a/packages/targets/process-graph/src/entrypoints.unit.test.ts
+++ b/packages/targets/process-graph/src/entrypoints.unit.test.ts
@@ -1,18 +1,24 @@
 import * as cliPackage from "@exadev/process-graph-cli";
 import * as layoutPackage from "@exadev/process-graph-layout";
+import * as reactPackage from "@exadev/process-graph-react";
+import * as reactFlowPackage from "@exadev/process-graph-react-flow";
 import * as sourceContractPackage from "@exadev/process-graph-source-contract";
 import * as githubIssuesPackage from "@exadev/process-graph-source-github-issues";
 import * as githubIssuesNodePackage from "@exadev/process-graph-source-github-issues/node";
 import * as sqliteNodePackage from "@exadev/process-graph-sqlite-node";
 import * as storeContractPackage from "@exadev/process-graph-store-contract";
 import * as storeSqlitePackage from "@exadev/process-graph-store-sqlite";
+import * as uiPackage from "@exadev/process-graph-ui";
 import { describe, expect, test } from "vitest";
 import * as cliEntry from "./cli.ts";
 import * as layoutEntry from "./layout.ts";
+import * as reactFlowEntry from "./react-flow.ts";
+import * as reactEntry from "./react.ts";
 import * as githubEntry from "./source/github.ts";
 import * as githubNodeEntry from "./source/github/node.ts";
 import * as storeEntry from "./store.ts";
 import * as storeNodeEntry from "./store/node.ts";
+import * as uiEntry from "./ui.ts";
 
 /** One subpath entry point and the bundled packages whose exports it carries flat. */
 interface Subpath {
@@ -54,6 +60,21 @@ const subpaths: readonly Subpath[] = [
     entry: storeNodeEntry,
     layers: [["sqlite-node", sqliteNodePackage]],
   },
+  {
+    name: "react",
+    entry: reactEntry,
+    layers: [["react", reactPackage]],
+  },
+  {
+    name: "ui",
+    entry: uiEntry,
+    layers: [["ui", uiPackage]],
+  },
+  {
+    name: "react-flow",
+    entry: reactFlowEntry,
+    layers: [["react-flow", reactFlowPackage]],
+  },
   {
     name: "cli",
     entry: cliEntry,
diff --git a/packages/targets/process-graph/src/react-flow.ts b/packages/targets/process-graph/src/react-flow.ts
new file mode 100644
index 0000000..e3971c7
--- /dev/null
+++ b/packages/targets/process-graph/src/react-flow.ts
@@ -0,0 +1,2 @@
+// The `process-graph/react-flow` entry point: React Flow views of the model (flowchart, swimlane and state machine) laid out by `process-graph/layout`. Its rules, with React Flow's own, are `process-graph/react-flow/style.css`, imported beside `process-graph/ui/style.css`.
+export * from "@exadev/process-graph-react-flow";
diff --git a/packages/targets/process-graph/src/react.ts b/packages/targets/process-graph/src/react.ts
new file mode 100644
index 0000000..5290482
--- /dev/null
+++ b/packages/targets/process-graph/src/react.ts
@@ -0,0 +1,2 @@
+// The `process-graph/react` entry point: headless React hooks and unstyled components over the model, which follow a stored model and derive statuses, the ready set, blocked chains, impact and explanations. A subpath apart from `process-graph/ui` because the styled components there reuse these components' names.
+export * from "@exadev/process-graph-react";
diff --git a/packages/targets/process-graph/src/ui.ts b/packages/targets/process-graph/src/ui.ts
new file mode 100644
index 0000000..9c99502
--- /dev/null
+++ b/packages/targets/process-graph/src/ui.ts
@@ -0,0 +1,2 @@
+// The `process-graph/ui` entry point: the styled components over `process-graph/react`, the SVG sequence diagram and the Vanilla Extract theme contract with its light and dark themes. Its compiled rules are `process-graph/ui/style.css`, which a consumer imports once.
+export * from "@exadev/process-graph-ui";
diff --git a/packages/targets/process-graph/tsdown.config.ts b/packages/targets/process-graph/tsdown.config.ts
index 6068272..2c0b52d 100644
--- a/packages/targets/process-graph/tsdown.config.ts
+++ b/packages/targets/process-graph/tsdown.config.ts
@@ -1,8 +1,15 @@
+import { fileURLToPath } from "node:url";
 import { defineConfig } from "tsdown";
 
+/** Where a bundled UI package's compiled stylesheet is, resolved through that package's own `./style.css` export. */
+const stylesheetOf = (name: string): string =>
+  fileURLToPath(import.meta.resolve(`${name}/style.css`));
+
 /**
  * The published `process-graph` package is a bundle. Each subpath of its exports map is one entry here, built from the `src/` module of the same path, and the private workspace packages those modules re-export are inlined, JavaScript and declarations alike, so the published files never name a package that is not on the registry. Code two entries share is emitted once as a chunk, so importing one subpath loads only what that subpath reaches.
  *
+ * The bundler carries no CSS across from the UI packages, which compile their Vanilla Extract styles into a `style.css` of their own, so each stylesheet is copied beside its subpath and exported as `<subpath>/style.css`.
+ *
  * `onlyBundle` is the guarantee rather than a hint: the build fails if anything from `node_modules` other than a workspace package would be inlined, so every third-party library stays an import resolved from the consumer's own install, as declared in `package.json`. Node builtins stay imports too, since the neutral platform leaves them unresolved; the entries that reach them (`cli`, `bin`, `store/node`, `source/github/node`) are the Node-only ones.
  */
 export default defineConfig({
@@ -15,6 +22,9 @@ export default defineConfig({
     "store/node": "src/store/node.ts",
     "store/wasm": "src/store/wasm.ts",
     "store/wasm/worker": "src/store/wasm/worker.ts",
+    react: "src/react.ts",
+    ui: "src/ui.ts",
+    "react-flow": "src/react-flow.ts",
     cli: "src/cli.ts",
     bin: "src/bin.ts",
   },
@@ -26,6 +36,13 @@ export default defineConfig({
     onlyBundle: [/^@exadev\/process-graph-/],
     dts: { alwaysBundle: [/^@exadev\/process-graph-/] },
   },
+  copy: [
+    { from: stylesheetOf("@exadev/process-graph-ui"), to: "dist/ui" },
+    {
+      from: stylesheetOf("@exadev/process-graph-react-flow"),
+      to: "dist/react-flow",
+    },
+  ],
   tsconfig: "tsconfig.node.json",
   clean: true,
 });
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 75d78ad..f533b89 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -965,6 +965,12 @@ importers:
       '@exadev/process-graph-projection':
         specifier: 1.1.0
         version: link:../../core/graph/projection
+      '@exadev/process-graph-react':
+        specifier: 1.0.1
+        version: link:../../ui/graph/react
+      '@exadev/process-graph-react-flow':
+        specifier: 1.0.1
+        version: link:../../ui/graph/react-flow
       '@exadev/process-graph-schema':
         specifier: 1.1.0
         version: link:../../core/graph/schema
@@ -986,6 +992,9 @@ importers:
       '@exadev/process-graph-store-sqlite':
         specifier: 1.1.0
         version: link:../../adapters/graph/store-sqlite
+      '@exadev/process-graph-ui':
+        specifier: 1.0.1
+        version: link:../../ui/graph/ui
       '@orpc/client':
         specifier: 2.0.0-beta.41
         version: 2.0.0-beta.41
@@ -1010,9 +1019,21 @@ importers:
       '@types/node':
         specifier: 26.6.4
         version: 26.6.4
+      '@types/react':
+        specifier: 19.3.0
+        version: 19.3.0
+      '@vanilla-extract/css':
+        specifier: 1.21.2
+        version: 1.21.2
+      '@vanilla-extract/recipes':
+        specifier: 0.5.7
+        version: 0.5.7(@vanilla-extract/css@1.21.2)
       '@vitest/coverage-v8':
         specifier: 5.0.3
         version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
+      '@xyflow/react':
+        specifier: 12.12.0
+        version: 12.12.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
       commander:
         specifier: 15.0.0
         version: 15.0.0
@@ -1028,6 +1049,12 @@ importers:
       publint:
         specifier: 0.3.25
         version: 0.3.25
+      react:
+        specifier: 19.3.0
+        version: 19.3.0
+      react-dom:
+        specifier: 19.3.0
+        version: 19.3.0(react@19.3.0)
       tsdown:
         specifier: 0.23.0
         version: 0.23.0(@arethetypeswrong/core@0.18.5)(oxc-resolver@11.24.2)(publint@0.3.25)(typescript@6.0.3)

From 8b4994e79cca42cbc67df04f087b842d5a1cdbbd Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 04:46:25 +0100
Subject: [PATCH 08/31] test(cli): expect the derived alt fragment in a drawn
 sequence

A scenario through a decision's branch now projects that branch as an alt
fragment, which the Mermaid emitter draws as a block and the DOT emitter as a
message label prefix.
---
 packages/targets/graph-cli/src/cli-authoring.unit.test.ts | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/packages/targets/graph-cli/src/cli-authoring.unit.test.ts b/packages/targets/graph-cli/src/cli-authoring.unit.test.ts
index 29b92d6..9d6a407 100644
--- a/packages/targets/graph-cli/src/cli-authoring.unit.test.ts
+++ b/packages/targets/graph-cli/src/cli-authoring.unit.test.ts
@@ -285,7 +285,9 @@ describe("show", () => {
         "  participant p0 as Customer",
         "  participant p1 as Shop",
         "  p0->>p1: In stock?",
-        "  p1->>p0: Refund",
+        "  alt no",
+        "    p1->>p0: Refund",
+        "  end",
         "",
       ].join("\n"),
     );
@@ -319,7 +321,7 @@ describe("show", () => {
         '  "p0" -> "p0.1" -> "p0.2" [style="dashed", arrowhead="none"];',
         '  "p1" -> "p1.1" -> "p1.2" [style="dashed", arrowhead="none"];',
         '  "p0.1" -> "p1.1" [label="1. In stock?", constraint="false"];',
-        '  "p1.2" -> "p0.2" [label="2. Refund", constraint="false"];',
+        '  "p1.2" -> "p0.2" [label="2. alt [no]: Refund", constraint="false"];',
         "}",
         "",
       ].join("\n"),

From cf17951fa6b5f3628719b3e0a58532c6f4383a3b Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 04:49:36 +0100
Subject: [PATCH 09/31] test(cli): name the model transitions behind each drawn
 edge

Projected flowchart edges and state machine transitions now carry the model
transitions they stand for, so the emitter fixtures state them.
---
 packages/targets/graph-cli/src/emit/emit.unit.test.ts | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/packages/targets/graph-cli/src/emit/emit.unit.test.ts b/packages/targets/graph-cli/src/emit/emit.unit.test.ts
index d0d4406..97dda42 100644
--- a/packages/targets/graph-cli/src/emit/emit.unit.test.ts
+++ b/packages/targets/graph-cli/src/emit/emit.unit.test.ts
@@ -36,9 +36,9 @@ const flowchart: Flowchart<OpenIds> = {
     { id: "ok", label: "OK?", shape: "decision" },
   ],
   edges: [
-    { from: "start", to: "github:acme/app#1" },
-    { from: "github:acme/app#1", to: "fork" },
-    { from: "fork", to: "ok", label: "a|b" },
+    { from: "start", to: "github:acme/app#1", transitions: ["t1"] },
+    { from: "github:acme/app#1", to: "fork", transitions: ["t2"] },
+    { from: "fork", to: "ok", label: "a|b", transitions: ["t3"] },
   ],
   loss: [],
 };
@@ -86,15 +86,16 @@ const stateMachine: StateMachine<OpenIds> = {
     { id: "end", label: "End", role: "final" },
   ],
   transitions: [
-    { source: "begin", target: "placed" },
+    { source: "begin", target: "placed", transitions: ["t1"] },
     {
       source: "placed",
       target: "paid",
       event: "pay",
       guard: "card ok",
       effect: "receipt",
+      transitions: ["t2"],
     },
-    { source: "paid", target: "end", effect: "archive" },
+    { source: "paid", target: "end", effect: "archive", transitions: ["t3"] },
   ],
   loss: [],
 };

From 4028950b4ec2189aea90f14000bbb48127d11cd8 Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 04:52:10 +0100
Subject: [PATCH 10/31] build: make every building-block package private

Only process-graph is published; it bundles the others, so they need no place on
the registry of their own. The versions already published stay where they are.
---
 packages/adapters/graph/source-github-issues/package.json | 1 +
 packages/adapters/graph/sqlite-node/package.json          | 1 +
 packages/adapters/graph/store-sqlite/package.json         | 1 +
 packages/core/graph/dag/package.json                      | 1 +
 packages/core/graph/domain/package.json                   | 1 +
 packages/core/graph/layout/package.json                   | 1 +
 packages/core/graph/projection/package.json               | 1 +
 packages/core/graph/schema/package.json                   | 1 +
 packages/core/graph/source-contract/package.json          | 1 +
 packages/core/graph/store-contract/package.json           | 1 +
 packages/targets/graph-cli/package.json                   | 1 +
 11 files changed, 11 insertions(+)

diff --git a/packages/adapters/graph/source-github-issues/package.json b/packages/adapters/graph/source-github-issues/package.json
index 812fa1e..5c59ff2 100644
--- a/packages/adapters/graph/source-github-issues/package.json
+++ b/packages/adapters/graph/source-github-issues/package.json
@@ -2,6 +2,7 @@
   "name": "@exadev/process-graph-source-github-issues",
   "version": "1.1.0",
   "description": "The GitHub issues GraphSource adapter: issues as bound activities, blockedBy and blocking as transitions, sub-issues, repositories, organisations and assignees, read through the GraphQL API with server-side filters, pagination, rate-limit handling and typed errors across organisations, repositories and Projects v2 boards, with a scope listing for pickers.",
+  "private": true,
   "type": "module",
   "repository": {
     "type": "git",
diff --git a/packages/adapters/graph/sqlite-node/package.json b/packages/adapters/graph/sqlite-node/package.json
index b2e1a25..e106e6b 100644
--- a/packages/adapters/graph/sqlite-node/package.json
+++ b/packages/adapters/graph/sqlite-node/package.json
@@ -2,6 +2,7 @@
   "name": "@exadev/process-graph-sqlite-node",
   "version": "1.0.4",
   "description": "The SQLite graph store on Node's built-in node:sqlite through drizzle-orm/node-sqlite, for the command line and servers.",
+  "private": true,
   "type": "module",
   "repository": {
     "type": "git",
diff --git a/packages/adapters/graph/store-sqlite/package.json b/packages/adapters/graph/store-sqlite/package.json
index 7f7aa0c..8b2769a 100644
--- a/packages/adapters/graph/store-sqlite/package.json
+++ b/packages/adapters/graph/store-sqlite/package.json
@@ -2,6 +2,7 @@
   "name": "@exadev/process-graph-store-sqlite",
   "version": "1.1.0",
   "description": "The GraphStore port on SQLite through Drizzle: one schema, committed drizzle-kit migrations applied the same way in every runtime, recursive SQL for the structural queries, written against Drizzle's async SQLite database so any driver plugs in.",
+  "private": true,
   "type": "module",
   "repository": {
     "type": "git",
diff --git a/packages/core/graph/dag/package.json b/packages/core/graph/dag/package.json
index 17aa931..29e87e5 100644
--- a/packages/core/graph/dag/package.json
+++ b/packages/core/graph/dag/package.json
@@ -2,6 +2,7 @@
   "name": "@exadev/process-graph-dag",
   "version": "1.1.0",
   "description": "Model-independent dependency-graph primitives over a node set and a needs accessor: layers, ancestors, descendants, cycles, transitive reduction and the critical path.",
+  "private": true,
   "type": "module",
   "repository": {
     "type": "git",
diff --git a/packages/core/graph/domain/package.json b/packages/core/graph/domain/package.json
index 9c8b65f..b9f27c5 100644
--- a/packages/core/graph/domain/package.json
+++ b/packages/core/graph/domain/package.json
@@ -2,6 +2,7 @@
   "name": "@exadev/process-graph-domain",
   "version": "1.1.1",
   "description": "Reasoning over the process model and a run overlay: control graph, illegal cycles, three-valued status, decision evaluation, ready set, blocked-by, impact, what-if and critical path.",
+  "private": true,
   "type": "module",
   "repository": {
     "type": "git",
diff --git a/packages/core/graph/layout/package.json b/packages/core/graph/layout/package.json
index 1fd7010..a8166c4 100644
--- a/packages/core/graph/layout/package.json
+++ b/packages/core/graph/layout/package.json
@@ -2,6 +2,7 @@
   "name": "@exadev/process-graph-layout",
   "version": "1.0.3",
   "description": "Layered layout of a projected process view into positions keyed by element id, in the model's views shape.",
+  "private": true,
   "type": "module",
   "repository": {
     "type": "git",
diff --git a/packages/core/graph/projection/package.json b/packages/core/graph/projection/package.json
index 61de230..ec970bf 100644
--- a/packages/core/graph/projection/package.json
+++ b/packages/core/graph/projection/package.json
@@ -2,6 +2,7 @@
   "name": "@exadev/process-graph-projection",
   "version": "1.1.0",
   "description": "Projections of the process model into a flowchart, swimlane, state machine and sequence diagram, plus the derived hand-offs.",
+  "private": true,
   "type": "module",
   "repository": {
     "type": "git",
diff --git a/packages/core/graph/schema/package.json b/packages/core/graph/schema/package.json
index 31a2724..ead86d0 100644
--- a/packages/core/graph/schema/package.json
+++ b/packages/core/graph/schema/package.json
@@ -2,6 +2,7 @@
   "name": "@exadev/process-graph-schema",
   "version": "1.1.0",
   "description": "The process model: typed identifier spaces, defineModel with compile-time reference checking, structural validation, and a Zod schema for the open runtime shape.",
+  "private": true,
   "type": "module",
   "repository": {
     "type": "git",
diff --git a/packages/core/graph/source-contract/package.json b/packages/core/graph/source-contract/package.json
index 89a9734..0d0e1e2 100644
--- a/packages/core/graph/source-contract/package.json
+++ b/packages/core/graph/source-contract/package.json
@@ -2,6 +2,7 @@
   "name": "@exadev/process-graph-source-contract",
   "version": "1.1.0",
   "description": "The GraphSource port as an oRPC contract: versioned, paginated and streamed sync of bound activities, participants, transitions and overlay status, with an in-memory fake and a conformance kit every adapter must pass.",
+  "private": true,
   "type": "module",
   "repository": {
     "type": "git",
diff --git a/packages/core/graph/store-contract/package.json b/packages/core/graph/store-contract/package.json
index b80df6d..50d8960 100644
--- a/packages/core/graph/store-contract/package.json
+++ b/packages/core/graph/store-contract/package.json
@@ -2,6 +2,7 @@
   "name": "@exadev/process-graph-store-contract",
   "version": "1.1.0",
   "description": "The persistence port for process models and run overlays as an oRPC contract: versioned procedures with Zod inputs and outputs, an in-memory fake and a conformance kit every store adapter runs.",
+  "private": true,
   "type": "module",
   "repository": {
     "type": "git",
diff --git a/packages/targets/graph-cli/package.json b/packages/targets/graph-cli/package.json
index 135508d..7e898e7 100644
--- a/packages/targets/graph-cli/package.json
+++ b/packages/targets/graph-cli/package.json
@@ -2,6 +2,7 @@
   "name": "@exadev/process-graph-cli",
   "version": "0.0.0",
   "description": "The process-graph command line: sync work from GitHub issues into a SQLite store, ask what is ready, blocked or on the critical path, explain a status, and show the model as a flowchart, swimlane, state machine or sequence diagram in Mermaid or Graphviz DOT.",
+  "private": true,
   "type": "module",
   "repository": {
     "type": "git",

From 764deb28bff5f3d039c493635dbc85c7cb49521f Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 04:52:18 +0100
Subject: [PATCH 11/31] build(release): give private packages a version and tag
 only

A private package now runs only the npm plugin, which bumps its version and
skips publishing, so it writes no changelog and creates no GitHub Release. It
keeps its tag, which the orchestrator reads to find its last release, and its
release still cascades to process-graph through devDependencies.
---
 release-workspace.config.ts           | 41 +++++++++++++++++++++------
 release-workspace.config.unit.test.ts | 20 +++++++++++++
 2 files changed, 53 insertions(+), 8 deletions(-)

diff --git a/release-workspace.config.ts b/release-workspace.config.ts
index fd916ff..13356a3 100644
--- a/release-workspace.config.ts
+++ b/release-workspace.config.ts
@@ -1,8 +1,12 @@
-import type { ReleaseWorkspaceOptions } from "@exadev/semantic-release-workspace";
+import {
+  discoverWorkspace,
+  type PublishPluginSpec,
+  type ReleaseWorkspaceOptions,
+} from "@exadev/semantic-release-workspace";
 import { commitTypes } from "./commit-types.ts";
 
 /**
- * Independent per-package releases through `@exadev/semantic-release-workspace`, invoked as `pnpm release`. Each publishable package gets its own version, `<name>@<version>` tag, CHANGELOG.md and GitHub Release, decided from the commits that touched its own directory, and a package is released after every sibling it depends on.
+ * Independent per-package releases through `@exadev/semantic-release-workspace`, invoked as `pnpm release`. Every package gets its own version and `<name>@<version>` tag, decided from the commits that touched its own directory, and a package is released after every sibling it depends on. `process-graph`, the one published package, also gets a CHANGELOG.md and a GitHub Release; the private packages it bundles get neither (see `privatePlugins`).
  *
  * The commit types and which of them release come from `commit-types.ts`, the same list `commitlint.config.ts` validates against, so a type cannot trigger a release without also passing commit-message validation, or the reverse.
  *
@@ -31,17 +35,38 @@ const noteTypes = commitTypes.map((entry) => ({
   hidden: false,
 }));
 
+const plugins: readonly PublishPluginSpec[] = [
+  "@semantic-release/changelog",
+  ["@semantic-release/npm", { npmPublish: true }],
+  "@semantic-release/github",
+];
+
+/**
+ * A private package is bundled into `process-graph` and never published, so it keeps only the step that bumps its version: `@semantic-release/npm`, which skips publishing for a manifest marked `private`. It writes no CHANGELOG.md and creates no GitHub Release, since neither describes anything a consumer installs; the orchestrator would drop the Release on its own, but an explicit list is taken exactly as written. It still takes a version and a `<name>@<version>` tag, which the orchestrator needs to find its last release, and its release still cascades: `process-graph` lists it in `devDependencies`, which the orchestrator follows like any other dependency field, so a change to a bundled package releases `process-graph`.
+ */
+const privatePlugins: readonly PublishPluginSpec[] = [
+  ["@semantic-release/npm", { npmPublish: true }],
+];
+
+const workspace = await discoverWorkspace(import.meta.dirname);
+
 const config: Pick<
   ReleaseWorkspaceOptions,
-  "branches" | "commitStrategy" | "plugins" | "analyzeCommits" | "generateNotes"
+  | "branches"
+  | "commitStrategy"
+  | "plugins"
+  | "packagePlugins"
+  | "analyzeCommits"
+  | "generateNotes"
 > = {
   branches: ["main"],
   commitStrategy: "single",
-  plugins: [
-    "@semantic-release/changelog",
-    ["@semantic-release/npm", { npmPublish: true }],
-    "@semantic-release/github",
-  ],
+  plugins,
+  packagePlugins: Object.fromEntries(
+    workspace.packages
+      .filter((pkg) => pkg.private)
+      .map((pkg) => [pkg.name, privatePlugins]),
+  ),
   analyzeCommits: {
     preset: "conventionalcommits",
     releaseRules,
diff --git a/release-workspace.config.unit.test.ts b/release-workspace.config.unit.test.ts
index e6a6db5..a13a5f1 100644
--- a/release-workspace.config.unit.test.ts
+++ b/release-workspace.config.unit.test.ts
@@ -1,3 +1,4 @@
+import { discoverWorkspace } from "@exadev/semantic-release-workspace";
 import { describe, expect, it } from "vitest";
 
 import { commitTypes } from "./commit-types.ts";
@@ -111,4 +112,23 @@ describe("release-workspace.config.ts", () => {
       ).toBe(false);
     }
   });
+
+  it("gives every private package the version step alone and the published package the whole pipeline", async () => {
+    const workspace = await discoverWorkspace(import.meta.dirname);
+    const overridden = Object.keys(config.packagePlugins ?? {}).sort();
+    const privateNames = workspace.packages
+      .filter((pkg) => pkg.private)
+      .map((pkg) => pkg.name)
+      .sort();
+
+    expect(overridden).toStrictEqual(privateNames);
+    expect(privateNames).not.toContain("process-graph");
+    for (const name of privateNames) {
+      expect(config.packagePlugins?.[name]).toStrictEqual([
+        ["@semantic-release/npm", { npmPublish: true }],
+      ]);
+    }
+    expect(config.plugins).toContain("@semantic-release/changelog");
+    expect(config.plugins).toContain("@semantic-release/github");
+  });
 });

From f9a051ac99d3a87f0b943b9499800e8e582110a8 Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 04:57:56 +0100
Subject: [PATCH 12/31] build(deps): take versions from a pnpm catalog and
 siblings from the workspace

With only process-graph published, the private packages need not name
installable versions. Each now takes its third-party versions from the one
catalog in pnpm-workspace.yaml and its siblings through workspace:*, so a
version is written once. The published manifest keeps exact literals, because
@semantic-release/npm publishes with npm publish, which ships a catalog or
workspace protocol specifier verbatim.

syncpack enforces the catalog and the workspace protocol in private manifests.
scripts/check-published-manifests.ts, now part of deps:lint, fails on a
protocol specifier or a range in a published manifest, on a version there
that differs from the catalog's or the sibling's own, and on a catalog entry
that is not exact. The process-graph packages leave the install age
exclusions, since nothing installs them from the registry any more.
---
 knip.config.ts                                |   17 +-
 package.json                                  |   75 +-
 .../graph/source-github-issues/package.json   |   24 +-
 .../adapters/graph/sqlite-node/package.json   |   30 +-
 .../adapters/graph/sqlite-wasm/package.json   |   30 +-
 .../adapters/graph/store-sqlite/package.json  |   34 +-
 packages/core/graph/dag/package.json          |   20 +-
 packages/core/graph/domain/package.json       |   26 +-
 packages/core/graph/layout/package.json       |   26 +-
 packages/core/graph/projection/package.json   |   24 +-
 packages/core/graph/schema/package.json       |   24 +-
 .../core/graph/source-contract/package.json   |   34 +-
 .../core/graph/store-contract/package.json    |   36 +-
 packages/targets/graph-cli/package.json       |   40 +-
 packages/targets/graph-web/package.json       |   64 +-
 packages/ui/graph/react-flow/package.json     |   56 +-
 packages/ui/graph/react/package.json          |   48 +-
 packages/ui/graph/ui/package.json             |   50 +-
 pnpm-lock.yaml                                | 1364 +++++++++++------
 pnpm-workspace.yaml                           |   80 +-
 scripts/check-published-manifests.ts          |  149 ++
 .../check-published-manifests.unit.test.ts    |  146 ++
 syncpack.config.ts                            |   27 +-
 tsconfig.json                                 |    3 +-
 vitest.config.ts                              |    1 +
 25 files changed, 1656 insertions(+), 772 deletions(-)
 create mode 100644 scripts/check-published-manifests.ts
 create mode 100644 scripts/check-published-manifests.unit.test.ts

diff --git a/knip.config.ts b/knip.config.ts
index 9144abf..84f975a 100644
--- a/knip.config.ts
+++ b/knip.config.ts
@@ -8,9 +8,10 @@ import type { KnipConfig } from "knip";
 const config: KnipConfig = {
   workspaces: {
     ".": {
-      entry: ["*.config.ts"],
+      entry: ["*.config.ts", "scripts/*.ts"],
       project: [
         "*.config.ts",
+        "scripts/*.ts",
         "commit-types.ts",
         "eslint.shared.ts",
         "stryker.shared.ts",
@@ -20,6 +21,20 @@ const config: KnipConfig = {
       entry: ["src/index.{ts,tsx}"],
       project: ["src/**/*.{ts,tsx}!"],
     },
+    // The contracts' Zod schemas embed the model's, which are built on trilean's expression and JSON schemas, so their emitted declarations import trilean although no source file names it, and knip traces source alone.
+    ...Object.fromEntries(
+      [
+        "packages/core/graph/source-contract",
+        "packages/core/graph/store-contract",
+      ].map((workspace) => [
+        workspace,
+        {
+          entry: ["src/index.{ts,tsx}"],
+          project: ["src/**/*.{ts,tsx}!"],
+          ignoreDependencies: ["trilean"],
+        },
+      ]),
+    ),
     "packages/adapters/*/*": {
       entry: ["src/index.{ts,tsx}"],
       project: ["src/**/*.{ts,tsx}!"],
diff --git a/package.json b/package.json
index 6d6fa09..136ff9f 100644
--- a/package.json
+++ b/package.json
@@ -29,7 +29,7 @@
     "test:smoke": "turbo run _test:smoke",
     "test:e2e": "turbo run _test:e2e",
     "test:mutation": "turbo run _test:mutation",
-    "deps:lint": "syncpack lint",
+    "deps:lint": "syncpack lint && node scripts/check-published-manifests.ts",
     "deps:fix": "syncpack fix",
     "release": "semantic-release-workspace release --config release-workspace.config.ts",
     "prepare": "husky",
@@ -40,41 +40,42 @@
     "_prepush": "turbo run _lint _lint-all _typecheck _typecheck-all _test _test-all _test:integration _test:smoke"
   },
   "devDependencies": {
-    "@commitlint/cli": "21.2.3",
-    "@commitlint/config-conventional": "21.2.3",
-    "@commitlint/types": "21.2.3",
-    "@eslint/js": "10.0.1",
-    "@eslint/json": "2.1.0",
-    "@eslint/markdown": "8.0.3",
-    "@exadev/eslint-config": "2.36.3",
-    "@exadev/semantic-release-workspace": "3.1.29",
-    "@semantic-release/changelog": "7.0.0",
-    "@semantic-release/commit-analyzer": "13.0.1",
-    "@semantic-release/git": "11.0.1",
-    "@semantic-release/github": "12.0.10",
-    "@semantic-release/npm": "13.2.0",
-    "@semantic-release/release-notes-generator": "14.1.1",
-    "@stryker-mutator/api": "10.0.0",
-    "@types/node": "26.6.4",
-    "conventional-changelog-conventionalcommits": "9.3.1",
-    "eslint": "10.12.0",
-    "eslint-config-prettier": "10.1.8",
-    "eslint-plugin-depend": "1.5.0",
-    "eslint-plugin-jsx-a11y": "6.10.2",
-    "eslint-plugin-prettier": "5.5.6",
-    "eslint-plugin-react": "7.37.5",
-    "eslint-plugin-react-hooks": "7.1.1",
-    "eslint-plugin-yml": "3.8.1",
-    "globals": "17.13.0",
-    "husky": "9.1.7",
-    "knip": "6.39.0",
-    "lint-staged": "17.6.0",
-    "prettier": "3.9.9",
-    "semantic-release": "25.0.9",
-    "syncpack": "15.3.3",
-    "turbo": "2.11.7",
-    "typescript": "6.0.3",
-    "typescript-eslint": "8.71.0",
-    "vitest": "5.0.3"
+    "@commitlint/cli": "catalog:",
+    "@commitlint/config-conventional": "catalog:",
+    "@commitlint/types": "catalog:",
+    "@eslint/js": "catalog:",
+    "@eslint/json": "catalog:",
+    "@eslint/markdown": "catalog:",
+    "@exadev/eslint-config": "catalog:",
+    "@exadev/semantic-release-workspace": "catalog:",
+    "@semantic-release/changelog": "catalog:",
+    "@semantic-release/commit-analyzer": "catalog:",
+    "@semantic-release/git": "catalog:",
+    "@semantic-release/github": "catalog:",
+    "@semantic-release/npm": "catalog:",
+    "@semantic-release/release-notes-generator": "catalog:",
+    "@stryker-mutator/api": "catalog:",
+    "@types/node": "catalog:",
+    "conventional-changelog-conventionalcommits": "catalog:",
+    "eslint": "catalog:",
+    "eslint-config-prettier": "catalog:",
+    "eslint-plugin-depend": "catalog:",
+    "eslint-plugin-jsx-a11y": "catalog:",
+    "eslint-plugin-prettier": "catalog:",
+    "eslint-plugin-react": "catalog:",
+    "eslint-plugin-react-hooks": "catalog:",
+    "eslint-plugin-yml": "catalog:",
+    "globals": "catalog:",
+    "husky": "catalog:",
+    "knip": "catalog:",
+    "lint-staged": "catalog:",
+    "prettier": "catalog:",
+    "semantic-release": "catalog:",
+    "syncpack": "catalog:",
+    "turbo": "catalog:",
+    "typescript": "catalog:",
+    "typescript-eslint": "catalog:",
+    "vitest": "catalog:",
+    "yaml": "catalog:"
   }
 }
diff --git a/packages/adapters/graph/source-github-issues/package.json b/packages/adapters/graph/source-github-issues/package.json
index 5c59ff2..998f2c3 100644
--- a/packages/adapters/graph/source-github-issues/package.json
+++ b/packages/adapters/graph/source-github-issues/package.json
@@ -64,19 +64,19 @@
     "orpc"
   ],
   "devDependencies": {
-    "@arethetypeswrong/cli": "0.18.5",
-    "@stryker-mutator/core": "10.0.0",
-    "@stryker-mutator/typescript-checker": "10.0.0",
-    "@stryker-mutator/vitest-runner": "10.0.0",
-    "@types/node": "26.6.4",
-    "@vitest/coverage-v8": "5.0.3",
-    "eslint": "10.12.0",
-    "publint": "0.3.25",
-    "typescript": "6.0.3",
-    "vitest": "5.0.3"
+    "@arethetypeswrong/cli": "catalog:",
+    "@stryker-mutator/core": "catalog:",
+    "@stryker-mutator/typescript-checker": "catalog:",
+    "@stryker-mutator/vitest-runner": "catalog:",
+    "@types/node": "catalog:",
+    "@vitest/coverage-v8": "catalog:",
+    "eslint": "catalog:",
+    "publint": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
   },
   "dependencies": {
-    "@exadev/process-graph-source-contract": "1.1.0",
-    "zod": "4.6.5"
+    "@exadev/process-graph-source-contract": "workspace:*",
+    "zod": "catalog:"
   }
 }
diff --git a/packages/adapters/graph/sqlite-node/package.json b/packages/adapters/graph/sqlite-node/package.json
index e106e6b..d0da0ef 100644
--- a/packages/adapters/graph/sqlite-node/package.json
+++ b/packages/adapters/graph/sqlite-node/package.json
@@ -57,22 +57,22 @@
     "drizzle"
   ],
   "dependencies": {
-    "@exadev/process-graph-store-contract": "1.1.0",
-    "@exadev/process-graph-store-sqlite": "1.1.0",
-    "drizzle-orm": "1.0.0-rc.4"
+    "@exadev/process-graph-store-contract": "workspace:*",
+    "@exadev/process-graph-store-sqlite": "workspace:*",
+    "drizzle-orm": "catalog:"
   },
   "devDependencies": {
-    "@arethetypeswrong/cli": "0.18.5",
-    "@orpc/client": "2.0.0-beta.41",
-    "@orpc/server": "2.0.0-beta.41",
-    "@stryker-mutator/core": "10.0.0",
-    "@stryker-mutator/typescript-checker": "10.0.0",
-    "@stryker-mutator/vitest-runner": "10.0.0",
-    "@types/node": "26.6.4",
-    "@vitest/coverage-v8": "5.0.3",
-    "eslint": "10.12.0",
-    "publint": "0.3.25",
-    "typescript": "6.0.3",
-    "vitest": "5.0.3"
+    "@arethetypeswrong/cli": "catalog:",
+    "@orpc/client": "catalog:",
+    "@orpc/server": "catalog:",
+    "@stryker-mutator/core": "catalog:",
+    "@stryker-mutator/typescript-checker": "catalog:",
+    "@stryker-mutator/vitest-runner": "catalog:",
+    "@types/node": "catalog:",
+    "@vitest/coverage-v8": "catalog:",
+    "eslint": "catalog:",
+    "publint": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
   }
 }
diff --git a/packages/adapters/graph/sqlite-wasm/package.json b/packages/adapters/graph/sqlite-wasm/package.json
index d7063b8..b214bbc 100644
--- a/packages/adapters/graph/sqlite-wasm/package.json
+++ b/packages/adapters/graph/sqlite-wasm/package.json
@@ -62,22 +62,22 @@
     "worker"
   ],
   "dependencies": {
-    "@exadev/process-graph-store-contract": "1.1.0",
-    "@exadev/process-graph-store-sqlite": "1.1.0",
-    "@orpc/client": "2.0.0-beta.41",
-    "@orpc/server": "2.0.0-beta.41",
-    "@sqlite.org/sqlite-wasm": "3.53.4-build2",
-    "drizzle-orm": "1.0.0-rc.4"
+    "@exadev/process-graph-store-contract": "workspace:*",
+    "@exadev/process-graph-store-sqlite": "workspace:*",
+    "@orpc/client": "catalog:",
+    "@orpc/server": "catalog:",
+    "@sqlite.org/sqlite-wasm": "catalog:",
+    "drizzle-orm": "catalog:"
   },
   "devDependencies": {
-    "@arethetypeswrong/cli": "0.18.5",
-    "@types/node": "26.6.4",
-    "@vitest/browser-playwright": "5.0.3",
-    "@vitest/coverage-v8": "5.0.3",
-    "eslint": "10.12.0",
-    "playwright": "1.63.0",
-    "publint": "0.3.25",
-    "typescript": "6.0.3",
-    "vitest": "5.0.3"
+    "@arethetypeswrong/cli": "catalog:",
+    "@types/node": "catalog:",
+    "@vitest/browser-playwright": "catalog:",
+    "@vitest/coverage-v8": "catalog:",
+    "eslint": "catalog:",
+    "playwright": "catalog:",
+    "publint": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
   }
 }
diff --git a/packages/adapters/graph/store-sqlite/package.json b/packages/adapters/graph/store-sqlite/package.json
index 8b2769a..0af747b 100644
--- a/packages/adapters/graph/store-sqlite/package.json
+++ b/packages/adapters/graph/store-sqlite/package.json
@@ -58,24 +58,24 @@
     "orpc"
   ],
   "dependencies": {
-    "@exadev/process-graph-domain": "1.1.1",
-    "@exadev/process-graph-schema": "1.1.0",
-    "@exadev/process-graph-store-contract": "1.1.0",
-    "@orpc/server": "2.0.0-beta.41",
-    "drizzle-orm": "1.0.0-rc.4",
-    "zod": "4.6.5"
+    "@exadev/process-graph-domain": "workspace:*",
+    "@exadev/process-graph-schema": "workspace:*",
+    "@exadev/process-graph-store-contract": "workspace:*",
+    "@orpc/server": "catalog:",
+    "drizzle-orm": "catalog:",
+    "zod": "catalog:"
   },
   "devDependencies": {
-    "@arethetypeswrong/cli": "0.18.5",
-    "@stryker-mutator/core": "10.0.0",
-    "@stryker-mutator/typescript-checker": "10.0.0",
-    "@stryker-mutator/vitest-runner": "10.0.0",
-    "@types/node": "26.6.4",
-    "@vitest/coverage-v8": "5.0.3",
-    "drizzle-kit": "1.0.0-rc.4",
-    "eslint": "10.12.0",
-    "publint": "0.3.25",
-    "typescript": "6.0.3",
-    "vitest": "5.0.3"
+    "@arethetypeswrong/cli": "catalog:",
+    "@stryker-mutator/core": "catalog:",
+    "@stryker-mutator/typescript-checker": "catalog:",
+    "@stryker-mutator/vitest-runner": "catalog:",
+    "@types/node": "catalog:",
+    "@vitest/coverage-v8": "catalog:",
+    "drizzle-kit": "catalog:",
+    "eslint": "catalog:",
+    "publint": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
   }
 }
diff --git a/packages/core/graph/dag/package.json b/packages/core/graph/dag/package.json
index 29e87e5..5dcca40 100644
--- a/packages/core/graph/dag/package.json
+++ b/packages/core/graph/dag/package.json
@@ -58,15 +58,15 @@
     "cycle-detection"
   ],
   "devDependencies": {
-    "@arethetypeswrong/cli": "0.18.5",
-    "@stryker-mutator/core": "10.0.0",
-    "@stryker-mutator/typescript-checker": "10.0.0",
-    "@stryker-mutator/vitest-runner": "10.0.0",
-    "@types/node": "26.6.4",
-    "@vitest/coverage-v8": "5.0.3",
-    "eslint": "10.12.0",
-    "publint": "0.3.25",
-    "typescript": "6.0.3",
-    "vitest": "5.0.3"
+    "@arethetypeswrong/cli": "catalog:",
+    "@stryker-mutator/core": "catalog:",
+    "@stryker-mutator/typescript-checker": "catalog:",
+    "@stryker-mutator/vitest-runner": "catalog:",
+    "@types/node": "catalog:",
+    "@vitest/coverage-v8": "catalog:",
+    "eslint": "catalog:",
+    "publint": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
   }
 }
diff --git a/packages/core/graph/domain/package.json b/packages/core/graph/domain/package.json
index b9f27c5..3f7b222 100644
--- a/packages/core/graph/domain/package.json
+++ b/packages/core/graph/domain/package.json
@@ -57,20 +57,20 @@
     "what-if"
   ],
   "devDependencies": {
-    "@arethetypeswrong/cli": "0.18.5",
-    "@stryker-mutator/core": "10.0.0",
-    "@stryker-mutator/typescript-checker": "10.0.0",
-    "@stryker-mutator/vitest-runner": "10.0.0",
-    "@types/node": "26.6.4",
-    "@vitest/coverage-v8": "5.0.3",
-    "eslint": "10.12.0",
-    "publint": "0.3.25",
-    "typescript": "6.0.3",
-    "vitest": "5.0.3"
+    "@arethetypeswrong/cli": "catalog:",
+    "@stryker-mutator/core": "catalog:",
+    "@stryker-mutator/typescript-checker": "catalog:",
+    "@stryker-mutator/vitest-runner": "catalog:",
+    "@types/node": "catalog:",
+    "@vitest/coverage-v8": "catalog:",
+    "eslint": "catalog:",
+    "publint": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
   },
   "dependencies": {
-    "@exadev/process-graph-dag": "1.1.0",
-    "@exadev/process-graph-schema": "1.1.0",
-    "trilean": "1.7.2"
+    "@exadev/process-graph-dag": "workspace:*",
+    "@exadev/process-graph-schema": "workspace:*",
+    "trilean": "catalog:"
   }
 }
diff --git a/packages/core/graph/layout/package.json b/packages/core/graph/layout/package.json
index a8166c4..2826cab 100644
--- a/packages/core/graph/layout/package.json
+++ b/packages/core/graph/layout/package.json
@@ -58,20 +58,20 @@
     "state-machine"
   ],
   "devDependencies": {
-    "@arethetypeswrong/cli": "0.18.5",
-    "@stryker-mutator/core": "10.0.0",
-    "@stryker-mutator/typescript-checker": "10.0.0",
-    "@stryker-mutator/vitest-runner": "10.0.0",
-    "@types/node": "26.6.4",
-    "@vitest/coverage-v8": "5.0.3",
-    "eslint": "10.12.0",
-    "publint": "0.3.25",
-    "typescript": "6.0.3",
-    "vitest": "5.0.3"
+    "@arethetypeswrong/cli": "catalog:",
+    "@stryker-mutator/core": "catalog:",
+    "@stryker-mutator/typescript-checker": "catalog:",
+    "@stryker-mutator/vitest-runner": "catalog:",
+    "@types/node": "catalog:",
+    "@vitest/coverage-v8": "catalog:",
+    "eslint": "catalog:",
+    "publint": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
   },
   "dependencies": {
-    "@exadev/process-graph-projection": "1.1.0",
-    "@exadev/process-graph-schema": "1.1.0",
-    "elkjs": "0.12.0"
+    "@exadev/process-graph-projection": "workspace:*",
+    "@exadev/process-graph-schema": "workspace:*",
+    "elkjs": "catalog:"
   }
 }
diff --git a/packages/core/graph/projection/package.json b/packages/core/graph/projection/package.json
index ec970bf..90acfdb 100644
--- a/packages/core/graph/projection/package.json
+++ b/packages/core/graph/projection/package.json
@@ -58,19 +58,19 @@
     "projection"
   ],
   "devDependencies": {
-    "@arethetypeswrong/cli": "0.18.5",
-    "@stryker-mutator/core": "10.0.0",
-    "@stryker-mutator/typescript-checker": "10.0.0",
-    "@stryker-mutator/vitest-runner": "10.0.0",
-    "@types/node": "26.6.4",
-    "@vitest/coverage-v8": "5.0.3",
-    "eslint": "10.12.0",
-    "publint": "0.3.25",
-    "typescript": "6.0.3",
-    "vitest": "5.0.3"
+    "@arethetypeswrong/cli": "catalog:",
+    "@stryker-mutator/core": "catalog:",
+    "@stryker-mutator/typescript-checker": "catalog:",
+    "@stryker-mutator/vitest-runner": "catalog:",
+    "@types/node": "catalog:",
+    "@vitest/coverage-v8": "catalog:",
+    "eslint": "catalog:",
+    "publint": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
   },
   "dependencies": {
-    "@exadev/process-graph-dag": "1.1.0",
-    "@exadev/process-graph-schema": "1.1.0"
+    "@exadev/process-graph-dag": "workspace:*",
+    "@exadev/process-graph-schema": "workspace:*"
   }
 }
diff --git a/packages/core/graph/schema/package.json b/packages/core/graph/schema/package.json
index ead86d0..357b731 100644
--- a/packages/core/graph/schema/package.json
+++ b/packages/core/graph/schema/package.json
@@ -59,19 +59,19 @@
     "typescript"
   ],
   "devDependencies": {
-    "@arethetypeswrong/cli": "0.18.5",
-    "@stryker-mutator/core": "10.0.0",
-    "@stryker-mutator/typescript-checker": "10.0.0",
-    "@stryker-mutator/vitest-runner": "10.0.0",
-    "@types/node": "26.6.4",
-    "@vitest/coverage-v8": "5.0.3",
-    "eslint": "10.12.0",
-    "publint": "0.3.25",
-    "typescript": "6.0.3",
-    "vitest": "5.0.3"
+    "@arethetypeswrong/cli": "catalog:",
+    "@stryker-mutator/core": "catalog:",
+    "@stryker-mutator/typescript-checker": "catalog:",
+    "@stryker-mutator/vitest-runner": "catalog:",
+    "@types/node": "catalog:",
+    "@vitest/coverage-v8": "catalog:",
+    "eslint": "catalog:",
+    "publint": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
   },
   "dependencies": {
-    "trilean": "1.7.2",
-    "zod": "4.6.5"
+    "trilean": "catalog:",
+    "zod": "catalog:"
   }
 }
diff --git a/packages/core/graph/source-contract/package.json b/packages/core/graph/source-contract/package.json
index 0d0e1e2..acff657 100644
--- a/packages/core/graph/source-contract/package.json
+++ b/packages/core/graph/source-contract/package.json
@@ -61,27 +61,27 @@
     "conformance"
   ],
   "devDependencies": {
-    "@arethetypeswrong/cli": "0.18.5",
-    "@stryker-mutator/core": "10.0.0",
-    "@stryker-mutator/typescript-checker": "10.0.0",
-    "@stryker-mutator/vitest-runner": "10.0.0",
-    "@types/node": "26.6.4",
-    "@vitest/coverage-v8": "5.0.3",
-    "eslint": "10.12.0",
-    "publint": "0.3.25",
-    "typescript": "6.0.3",
-    "vitest": "5.0.3"
+    "@arethetypeswrong/cli": "catalog:",
+    "@stryker-mutator/core": "catalog:",
+    "@stryker-mutator/typescript-checker": "catalog:",
+    "@stryker-mutator/vitest-runner": "catalog:",
+    "@types/node": "catalog:",
+    "@vitest/coverage-v8": "catalog:",
+    "eslint": "catalog:",
+    "publint": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
   },
   "dependencies": {
-    "@exadev/process-graph-schema": "1.1.0",
-    "@orpc/client": "2.0.0-beta.41",
-    "@orpc/contract": "2.0.0-beta.41",
-    "@orpc/server": "2.0.0-beta.41",
-    "trilean": "1.7.2",
-    "zod": "4.6.5"
+    "@exadev/process-graph-schema": "workspace:*",
+    "@orpc/client": "catalog:",
+    "@orpc/contract": "catalog:",
+    "@orpc/server": "catalog:",
+    "trilean": "catalog:",
+    "zod": "catalog:"
   },
   "peerDependencies": {
-    "vitest": "5.0.3"
+    "vitest": "catalog:"
   },
   "peerDependenciesMeta": {
     "vitest": {
diff --git a/packages/core/graph/store-contract/package.json b/packages/core/graph/store-contract/package.json
index 50d8960..86948c1 100644
--- a/packages/core/graph/store-contract/package.json
+++ b/packages/core/graph/store-contract/package.json
@@ -61,28 +61,28 @@
     "conformance"
   ],
   "devDependencies": {
-    "@arethetypeswrong/cli": "0.18.5",
-    "@orpc/client": "2.0.0-beta.41",
-    "@stryker-mutator/core": "10.0.0",
-    "@stryker-mutator/typescript-checker": "10.0.0",
-    "@stryker-mutator/vitest-runner": "10.0.0",
-    "@types/node": "26.6.4",
-    "@vitest/coverage-v8": "5.0.3",
-    "eslint": "10.12.0",
-    "publint": "0.3.25",
-    "typescript": "6.0.3",
-    "vitest": "5.0.3"
+    "@arethetypeswrong/cli": "catalog:",
+    "@orpc/client": "catalog:",
+    "@stryker-mutator/core": "catalog:",
+    "@stryker-mutator/typescript-checker": "catalog:",
+    "@stryker-mutator/vitest-runner": "catalog:",
+    "@types/node": "catalog:",
+    "@vitest/coverage-v8": "catalog:",
+    "eslint": "catalog:",
+    "publint": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
   },
   "dependencies": {
-    "@exadev/process-graph-domain": "1.1.1",
-    "@exadev/process-graph-schema": "1.1.0",
-    "@orpc/contract": "2.0.0-beta.41",
-    "@orpc/server": "2.0.0-beta.41",
-    "trilean": "1.7.2",
-    "zod": "4.6.5"
+    "@exadev/process-graph-domain": "workspace:*",
+    "@exadev/process-graph-schema": "workspace:*",
+    "@orpc/contract": "catalog:",
+    "@orpc/server": "catalog:",
+    "trilean": "catalog:",
+    "zod": "catalog:"
   },
   "peerDependencies": {
-    "vitest": "5.0.3"
+    "vitest": "catalog:"
   },
   "peerDependenciesMeta": {
     "vitest": {
diff --git a/packages/targets/graph-cli/package.json b/packages/targets/graph-cli/package.json
index 7e898e7..0b7e3ff 100644
--- a/packages/targets/graph-cli/package.json
+++ b/packages/targets/graph-cli/package.json
@@ -63,27 +63,27 @@
     "graphviz"
   ],
   "dependencies": {
-    "@exadev/process-graph-dag": "1.1.0",
-    "@exadev/process-graph-domain": "1.1.1",
-    "@exadev/process-graph-projection": "1.1.0",
-    "@exadev/process-graph-schema": "1.1.0",
-    "@exadev/process-graph-source-contract": "1.1.0",
-    "@exadev/process-graph-source-github-issues": "1.1.0",
-    "@exadev/process-graph-sqlite-node": "1.0.4",
-    "@exadev/process-graph-store-contract": "1.1.0",
-    "@orpc/server": "2.0.0-beta.41",
-    "commander": "15.0.0"
+    "@exadev/process-graph-dag": "workspace:*",
+    "@exadev/process-graph-domain": "workspace:*",
+    "@exadev/process-graph-projection": "workspace:*",
+    "@exadev/process-graph-schema": "workspace:*",
+    "@exadev/process-graph-source-contract": "workspace:*",
+    "@exadev/process-graph-source-github-issues": "workspace:*",
+    "@exadev/process-graph-sqlite-node": "workspace:*",
+    "@exadev/process-graph-store-contract": "workspace:*",
+    "@orpc/server": "catalog:",
+    "commander": "catalog:"
   },
   "devDependencies": {
-    "@arethetypeswrong/cli": "0.18.5",
-    "@stryker-mutator/core": "10.0.0",
-    "@stryker-mutator/typescript-checker": "10.0.0",
-    "@stryker-mutator/vitest-runner": "10.0.0",
-    "@types/node": "26.6.4",
-    "@vitest/coverage-v8": "5.0.3",
-    "eslint": "10.12.0",
-    "publint": "0.3.25",
-    "typescript": "6.0.3",
-    "vitest": "5.0.3"
+    "@arethetypeswrong/cli": "catalog:",
+    "@stryker-mutator/core": "catalog:",
+    "@stryker-mutator/typescript-checker": "catalog:",
+    "@stryker-mutator/vitest-runner": "catalog:",
+    "@types/node": "catalog:",
+    "@vitest/coverage-v8": "catalog:",
+    "eslint": "catalog:",
+    "publint": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
   }
 }
diff --git a/packages/targets/graph-web/package.json b/packages/targets/graph-web/package.json
index eae35a7..017c6d0 100644
--- a/packages/targets/graph-web/package.json
+++ b/packages/targets/graph-web/package.json
@@ -41,39 +41,39 @@
     "react"
   ],
   "dependencies": {
-    "@exadev/process-graph-domain": "1.1.1",
-    "@exadev/process-graph-projection": "1.1.0",
-    "@exadev/process-graph-react": "1.0.1",
-    "@exadev/process-graph-react-flow": "1.0.1",
-    "@exadev/process-graph-schema": "1.1.0",
-    "@exadev/process-graph-source-contract": "1.1.0",
-    "@exadev/process-graph-source-github-issues": "1.1.0",
-    "@exadev/process-graph-sqlite-wasm": "1.0.3",
-    "@exadev/process-graph-store-contract": "1.1.0",
-    "@exadev/process-graph-ui": "1.0.1",
-    "@orpc/client": "2.0.0-beta.41",
-    "@orpc/server": "2.0.0-beta.41",
-    "react": "19.3.0",
-    "react-dom": "19.3.0",
-    "zod": "4.6.5"
+    "@exadev/process-graph-domain": "workspace:*",
+    "@exadev/process-graph-projection": "workspace:*",
+    "@exadev/process-graph-react": "workspace:*",
+    "@exadev/process-graph-react-flow": "workspace:*",
+    "@exadev/process-graph-schema": "workspace:*",
+    "@exadev/process-graph-source-contract": "workspace:*",
+    "@exadev/process-graph-source-github-issues": "workspace:*",
+    "@exadev/process-graph-sqlite-wasm": "workspace:*",
+    "@exadev/process-graph-store-contract": "workspace:*",
+    "@exadev/process-graph-ui": "workspace:*",
+    "@orpc/client": "catalog:",
+    "@orpc/server": "catalog:",
+    "react": "catalog:",
+    "react-dom": "catalog:",
+    "zod": "catalog:"
   },
   "devDependencies": {
-    "@playwright/test": "1.63.0",
-    "@resvg/resvg-js": "2.6.2",
-    "@testing-library/dom": "10.4.2",
-    "@testing-library/react": "16.3.3",
-    "@types/node": "26.6.4",
-    "@types/react": "19.3.0",
-    "@types/react-dom": "19.3.0",
-    "@vanilla-extract/css": "1.21.2",
-    "@vanilla-extract/vite-plugin": "5.2.6",
-    "@vitest/coverage-v8": "5.0.3",
-    "eslint": "10.12.0",
-    "happy-dom": "20.14.5",
-    "typescript": "6.0.3",
-    "vite": "8.3.2",
-    "vite-plugin-pwa": "2.0.0",
-    "vitest": "5.0.3",
-    "workbox-window": "7.4.1"
+    "@playwright/test": "catalog:",
+    "@resvg/resvg-js": "catalog:",
+    "@testing-library/dom": "catalog:",
+    "@testing-library/react": "catalog:",
+    "@types/node": "catalog:",
+    "@types/react": "catalog:",
+    "@types/react-dom": "catalog:",
+    "@vanilla-extract/css": "catalog:",
+    "@vanilla-extract/vite-plugin": "catalog:",
+    "@vitest/coverage-v8": "catalog:",
+    "eslint": "catalog:",
+    "happy-dom": "catalog:",
+    "typescript": "catalog:",
+    "vite": "catalog:",
+    "vite-plugin-pwa": "catalog:",
+    "vitest": "catalog:",
+    "workbox-window": "catalog:"
   }
 }
diff --git a/packages/ui/graph/react-flow/package.json b/packages/ui/graph/react-flow/package.json
index 4a2130f..81628da 100644
--- a/packages/ui/graph/react-flow/package.json
+++ b/packages/ui/graph/react-flow/package.json
@@ -56,37 +56,37 @@
     "state-machine"
   ],
   "dependencies": {
-    "@exadev/process-graph-domain": "1.1.1",
-    "@exadev/process-graph-layout": "1.0.3",
-    "@exadev/process-graph-projection": "1.1.0",
-    "@exadev/process-graph-react": "1.0.1",
-    "@exadev/process-graph-schema": "1.1.0",
-    "@exadev/process-graph-ui": "1.0.1",
-    "@xyflow/react": "12.12.0"
+    "@exadev/process-graph-domain": "workspace:*",
+    "@exadev/process-graph-layout": "workspace:*",
+    "@exadev/process-graph-projection": "workspace:*",
+    "@exadev/process-graph-react": "workspace:*",
+    "@exadev/process-graph-schema": "workspace:*",
+    "@exadev/process-graph-ui": "workspace:*",
+    "@xyflow/react": "catalog:"
   },
   "devDependencies": {
-    "@arethetypeswrong/cli": "0.18.5",
-    "@stryker-mutator/core": "10.0.0",
-    "@stryker-mutator/typescript-checker": "10.0.0",
-    "@stryker-mutator/vitest-runner": "10.0.0",
-    "@testing-library/dom": "10.4.2",
-    "@testing-library/react": "16.3.3",
-    "@types/node": "26.6.4",
-    "@types/react": "19.3.0",
-    "@types/react-dom": "19.3.0",
-    "@vanilla-extract/css": "1.21.2",
-    "@vanilla-extract/vite-plugin": "5.2.6",
-    "@vitest/coverage-v8": "5.0.3",
-    "eslint": "10.12.0",
-    "happy-dom": "20.14.5",
-    "react": "19.3.0",
-    "react-dom": "19.3.0",
-    "typescript": "6.0.3",
-    "vite": "8.3.2",
-    "vitest": "5.0.3"
+    "@arethetypeswrong/cli": "catalog:",
+    "@stryker-mutator/core": "catalog:",
+    "@stryker-mutator/typescript-checker": "catalog:",
+    "@stryker-mutator/vitest-runner": "catalog:",
+    "@testing-library/dom": "catalog:",
+    "@testing-library/react": "catalog:",
+    "@types/node": "catalog:",
+    "@types/react": "catalog:",
+    "@types/react-dom": "catalog:",
+    "@vanilla-extract/css": "catalog:",
+    "@vanilla-extract/vite-plugin": "catalog:",
+    "@vitest/coverage-v8": "catalog:",
+    "eslint": "catalog:",
+    "happy-dom": "catalog:",
+    "react": "catalog:",
+    "react-dom": "catalog:",
+    "typescript": "catalog:",
+    "vite": "catalog:",
+    "vitest": "catalog:"
   },
   "peerDependencies": {
-    "react": "19.3.0",
-    "react-dom": "19.3.0"
+    "react": "catalog:",
+    "react-dom": "catalog:"
   }
 }
diff --git a/packages/ui/graph/react/package.json b/packages/ui/graph/react/package.json
index cb61bc8..87e0e8a 100644
--- a/packages/ui/graph/react/package.json
+++ b/packages/ui/graph/react/package.json
@@ -51,33 +51,33 @@
     "dependency-graph"
   ],
   "dependencies": {
-    "@exadev/process-graph-dag": "1.1.0",
-    "@exadev/process-graph-domain": "1.1.1",
-    "@exadev/process-graph-projection": "1.1.0",
-    "@exadev/process-graph-schema": "1.1.0",
-    "@exadev/process-graph-store-contract": "1.1.0",
-    "@orpc/client": "2.0.0-beta.41"
+    "@exadev/process-graph-dag": "workspace:*",
+    "@exadev/process-graph-domain": "workspace:*",
+    "@exadev/process-graph-projection": "workspace:*",
+    "@exadev/process-graph-schema": "workspace:*",
+    "@exadev/process-graph-store-contract": "workspace:*",
+    "@orpc/client": "catalog:"
   },
   "devDependencies": {
-    "@arethetypeswrong/cli": "0.18.5",
-    "@orpc/server": "2.0.0-beta.41",
-    "@stryker-mutator/core": "10.0.0",
-    "@stryker-mutator/typescript-checker": "10.0.0",
-    "@stryker-mutator/vitest-runner": "10.0.0",
-    "@testing-library/dom": "10.4.2",
-    "@testing-library/react": "16.3.3",
-    "@types/node": "26.6.4",
-    "@types/react": "19.3.0",
-    "@types/react-dom": "19.3.0",
-    "@vitest/coverage-v8": "5.0.3",
-    "eslint": "10.12.0",
-    "happy-dom": "20.14.5",
-    "react": "19.3.0",
-    "react-dom": "19.3.0",
-    "typescript": "6.0.3",
-    "vitest": "5.0.3"
+    "@arethetypeswrong/cli": "catalog:",
+    "@orpc/server": "catalog:",
+    "@stryker-mutator/core": "catalog:",
+    "@stryker-mutator/typescript-checker": "catalog:",
+    "@stryker-mutator/vitest-runner": "catalog:",
+    "@testing-library/dom": "catalog:",
+    "@testing-library/react": "catalog:",
+    "@types/node": "catalog:",
+    "@types/react": "catalog:",
+    "@types/react-dom": "catalog:",
+    "@vitest/coverage-v8": "catalog:",
+    "eslint": "catalog:",
+    "happy-dom": "catalog:",
+    "react": "catalog:",
+    "react-dom": "catalog:",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
   },
   "peerDependencies": {
-    "react": "19.3.0"
+    "react": "catalog:"
   }
 }
diff --git a/packages/ui/graph/ui/package.json b/packages/ui/graph/ui/package.json
index 6de7574..17ab30c 100644
--- a/packages/ui/graph/ui/package.json
+++ b/packages/ui/graph/ui/package.json
@@ -55,34 +55,34 @@
     "sequence-diagram"
   ],
   "dependencies": {
-    "@exadev/process-graph-domain": "1.1.1",
-    "@exadev/process-graph-projection": "1.1.0",
-    "@exadev/process-graph-react": "1.0.1",
-    "@exadev/process-graph-schema": "1.1.0",
-    "@vanilla-extract/recipes": "0.5.7"
+    "@exadev/process-graph-domain": "workspace:*",
+    "@exadev/process-graph-projection": "workspace:*",
+    "@exadev/process-graph-react": "workspace:*",
+    "@exadev/process-graph-schema": "workspace:*",
+    "@vanilla-extract/recipes": "catalog:"
   },
   "devDependencies": {
-    "@arethetypeswrong/cli": "0.18.5",
-    "@stryker-mutator/core": "10.0.0",
-    "@stryker-mutator/typescript-checker": "10.0.0",
-    "@stryker-mutator/vitest-runner": "10.0.0",
-    "@testing-library/dom": "10.4.2",
-    "@testing-library/react": "16.3.3",
-    "@types/node": "26.6.4",
-    "@types/react": "19.3.0",
-    "@types/react-dom": "19.3.0",
-    "@vanilla-extract/css": "1.21.2",
-    "@vanilla-extract/vite-plugin": "5.2.6",
-    "@vitest/coverage-v8": "5.0.3",
-    "eslint": "10.12.0",
-    "happy-dom": "20.14.5",
-    "react": "19.3.0",
-    "react-dom": "19.3.0",
-    "typescript": "6.0.3",
-    "vite": "8.3.2",
-    "vitest": "5.0.3"
+    "@arethetypeswrong/cli": "catalog:",
+    "@stryker-mutator/core": "catalog:",
+    "@stryker-mutator/typescript-checker": "catalog:",
+    "@stryker-mutator/vitest-runner": "catalog:",
+    "@testing-library/dom": "catalog:",
+    "@testing-library/react": "catalog:",
+    "@types/node": "catalog:",
+    "@types/react": "catalog:",
+    "@types/react-dom": "catalog:",
+    "@vanilla-extract/css": "catalog:",
+    "@vanilla-extract/vite-plugin": "catalog:",
+    "@vitest/coverage-v8": "catalog:",
+    "eslint": "catalog:",
+    "happy-dom": "catalog:",
+    "react": "catalog:",
+    "react-dom": "catalog:",
+    "typescript": "catalog:",
+    "vite": "catalog:",
+    "vitest": "catalog:"
   },
   "peerDependencies": {
-    "react": "19.3.0"
+    "react": "catalog:"
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index f533b89..05fbcbf 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -162,780 +162,999 @@ settings:
   autoInstallPeers: true
   excludeLinksFromLockfile: false
 
+catalogs:
+  default:
+    '@arethetypeswrong/cli':
+      specifier: 0.18.5
+      version: 0.18.5
+    '@commitlint/cli':
+      specifier: 21.2.3
+      version: 21.2.3
+    '@commitlint/config-conventional':
+      specifier: 21.2.3
+      version: 21.2.3
+    '@commitlint/types':
+      specifier: 21.2.3
+      version: 21.2.3
+    '@eslint/js':
+      specifier: 10.0.1
+      version: 10.0.1
+    '@eslint/json':
+      specifier: 2.1.0
+      version: 2.1.0
+    '@eslint/markdown':
+      specifier: 8.0.3
+      version: 8.0.3
+    '@exadev/eslint-config':
+      specifier: 2.36.3
+      version: 2.36.3
+    '@exadev/semantic-release-workspace':
+      specifier: 3.1.29
+      version: 3.1.29
+    '@orpc/client':
+      specifier: 2.0.0-beta.41
+      version: 2.0.0-beta.41
+    '@orpc/contract':
+      specifier: 2.0.0-beta.41
+      version: 2.0.0-beta.41
+    '@orpc/server':
+      specifier: 2.0.0-beta.41
+      version: 2.0.0-beta.41
+    '@playwright/test':
+      specifier: 1.63.0
+      version: 1.63.0
+    '@resvg/resvg-js':
+      specifier: 2.6.2
+      version: 2.6.2
+    '@semantic-release/changelog':
+      specifier: 7.0.0
+      version: 7.0.0
+    '@semantic-release/commit-analyzer':
+      specifier: 13.0.1
+      version: 13.0.1
+    '@semantic-release/git':
+      specifier: 11.0.1
+      version: 11.0.1
+    '@semantic-release/github':
+      specifier: 12.0.10
+      version: 12.0.10
+    '@semantic-release/npm':
+      specifier: 13.2.0
+      version: 13.2.0
+    '@semantic-release/release-notes-generator':
+      specifier: 14.1.1
+      version: 14.1.1
+    '@sqlite.org/sqlite-wasm':
+      specifier: 3.53.4-build2
+      version: 3.53.4-build2
+    '@stryker-mutator/api':
+      specifier: 10.0.0
+      version: 10.0.0
+    '@stryker-mutator/core':
+      specifier: 10.0.0
+      version: 10.0.0
+    '@stryker-mutator/typescript-checker':
+      specifier: 10.0.0
+      version: 10.0.0
+    '@stryker-mutator/vitest-runner':
+      specifier: 10.0.0
+      version: 10.0.0
+    '@testing-library/dom':
+      specifier: 10.4.2
+      version: 10.4.2
+    '@testing-library/react':
+      specifier: 16.3.3
+      version: 16.3.3
+    '@types/node':
+      specifier: 26.6.4
+      version: 26.6.4
+    '@types/react':
+      specifier: 19.3.0
+      version: 19.3.0
+    '@types/react-dom':
+      specifier: 19.3.0
+      version: 19.3.0
+    '@vanilla-extract/css':
+      specifier: 1.21.2
+      version: 1.21.2
+    '@vanilla-extract/recipes':
+      specifier: 0.5.7
+      version: 0.5.7
+    '@vanilla-extract/vite-plugin':
+      specifier: 5.2.6
+      version: 5.2.6
+    '@vitest/browser-playwright':
+      specifier: 5.0.3
+      version: 5.0.3
+    '@vitest/coverage-v8':
+      specifier: 5.0.3
+      version: 5.0.3
+    '@xyflow/react':
+      specifier: 12.12.0
+      version: 12.12.0
+    commander:
+      specifier: 15.0.0
+      version: 15.0.0
+    conventional-changelog-conventionalcommits:
+      specifier: 9.3.1
+      version: 9.3.1
+    drizzle-kit:
+      specifier: 1.0.0-rc.4
+      version: 1.0.0-rc.4
+    drizzle-orm:
+      specifier: 1.0.0-rc.4
+      version: 1.0.0-rc.4
+    elkjs:
+      specifier: 0.12.0
+      version: 0.12.0
+    eslint:
+      specifier: 10.12.0
+      version: 10.12.0
+    eslint-config-prettier:
+      specifier: 10.1.8
+      version: 10.1.8
+    eslint-plugin-depend:
+      specifier: 1.5.0
+      version: 1.5.0
+    eslint-plugin-jsx-a11y:
+      specifier: 6.10.2
+      version: 6.10.2
+    eslint-plugin-prettier:
+      specifier: 5.5.6
+      version: 5.5.6
+    eslint-plugin-react:
+      specifier: 7.37.5
+      version: 7.37.5
+    eslint-plugin-react-hooks:
+      specifier: 7.1.1
+      version: 7.1.1
+    eslint-plugin-yml:
+      specifier: 3.8.1
+      version: 3.8.1
+    globals:
+      specifier: 17.13.0
+      version: 17.13.0
+    happy-dom:
+      specifier: 20.14.5
+      version: 20.14.5
+    husky:
+      specifier: 9.1.7
+      version: 9.1.7
+    knip:
+      specifier: 6.39.0
+      version: 6.39.0
+    lint-staged:
+      specifier: 17.6.0
+      version: 17.6.0
+    playwright:
+      specifier: 1.63.0
+      version: 1.63.0
+    prettier:
+      specifier: 3.9.9
+      version: 3.9.9
+    publint:
+      specifier: 0.3.25
+      version: 0.3.25
+    react:
+      specifier: 19.3.0
+      version: 19.3.0
+    react-dom:
+      specifier: 19.3.0
+      version: 19.3.0
+    semantic-release:
+      specifier: 25.0.9
+      version: 25.0.9
+    syncpack:
+      specifier: 15.3.3
+      version: 15.3.3
+    trilean:
+      specifier: 1.7.2
+      version: 1.7.2
+    turbo:
+      specifier: 2.11.7
+      version: 2.11.7
+    typescript:
+      specifier: 6.0.3
+      version: 6.0.3
+    typescript-eslint:
+      specifier: 8.71.0
+      version: 8.71.0
+    vite:
+      specifier: 8.3.2
+      version: 8.3.2
+    vite-plugin-pwa:
+      specifier: 2.0.0
+      version: 2.0.0
+    vitest:
+      specifier: 5.0.3
+      version: 5.0.3
+    workbox-window:
+      specifier: 7.4.1
+      version: 7.4.1
+    yaml:
+      specifier: 2.9.1
+      version: 2.9.1
+    zod:
+      specifier: 4.6.5
+      version: 4.6.5
+
 importers:
 
   .:
     devDependencies:
       '@commitlint/cli':
-        specifier: 21.2.3
+        specifier: 'catalog:'
         version: 21.2.3(@types/node@26.6.4)(conventional-commits-parser@7.1.2)(typescript@6.0.3)
       '@commitlint/config-conventional':
-        specifier: 21.2.3
+        specifier: 'catalog:'
         version: 21.2.3
       '@commitlint/types':
-        specifier: 21.2.3
+        specifier: 'catalog:'
         version: 21.2.3
       '@eslint/js':
-        specifier: 10.0.1
+        specifier: 'catalog:'
         version: 10.0.1(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))
       '@eslint/json':
-        specifier: 2.1.0
+        specifier: 'catalog:'
         version: 2.1.0
       '@eslint/markdown':
-        specifier: 8.0.3
+        specifier: 'catalog:'
         version: 8.0.3(supports-color@7.2.0)
       '@exadev/eslint-config':
-        specifier: 2.36.3
+        specifier: 'catalog:'
         version: 2.36.3(@eslint/json@2.1.0)(@eslint/markdown@8.0.3(supports-color@7.2.0))(eslint-plugin-jsx-a11y@6.10.2(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0)))(eslint-plugin-react-hooks@7.1.1(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0))(eslint-plugin-react@7.37.5(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0)))(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript-eslint@8.71.0(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3))(typescript@6.0.3)
       '@exadev/semantic-release-workspace':
-        specifier: 3.1.29
+        specifier: 'catalog:'
         version: 3.1.29(@semantic-release/changelog@7.0.0(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3)))(@semantic-release/commit-analyzer@13.0.1(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0))(@semantic-release/git@11.0.1(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0))(@semantic-release/github@12.0.10(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0))(@semantic-release/npm@13.2.0(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3)))(@semantic-release/release-notes-generator@14.1.1(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0))(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0)(typescript@6.0.3)
       '@semantic-release/changelog':
-        specifier: 7.0.0
+        specifier: 'catalog:'
         version: 7.0.0(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3))
       '@semantic-release/commit-analyzer':
-        specifier: 13.0.1
+        specifier: 'catalog:'
         version: 13.0.1(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0)
       '@semantic-release/git':
-        specifier: 11.0.1
+        specifier: 'catalog:'
         version: 11.0.1(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0)
       '@semantic-release/github':
-        specifier: 12.0.10
+        specifier: 'catalog:'
         version: 12.0.10(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0)
       '@semantic-release/npm':
-        specifier: 13.2.0
+        specifier: 'catalog:'
         version: 13.2.0(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3))
       '@semantic-release/release-notes-generator':
-        specifier: 14.1.1
+        specifier: 'catalog:'
         version: 14.1.1(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0)
       '@stryker-mutator/api':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0
       '@types/node':
-        specifier: 26.6.4
+        specifier: 'catalog:'
         version: 26.6.4
       conventional-changelog-conventionalcommits:
-        specifier: 9.3.1
+        specifier: 'catalog:'
         version: 9.3.1
       eslint:
-        specifier: 10.12.0
+        specifier: 'catalog:'
         version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
       eslint-config-prettier:
-        specifier: 10.1.8
+        specifier: 'catalog:'
         version: 10.1.8(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))
       eslint-plugin-depend:
-        specifier: 1.5.0
+        specifier: 'catalog:'
         version: 1.5.0(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))
       eslint-plugin-jsx-a11y:
-        specifier: 6.10.2
+        specifier: 'catalog:'
         version: 6.10.2(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))
       eslint-plugin-prettier:
-        specifier: 5.5.6
+        specifier: 'catalog:'
         version: 5.5.6(eslint-config-prettier@10.1.8(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0)))(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(prettier@3.9.9)
       eslint-plugin-react:
-        specifier: 7.37.5
+        specifier: 'catalog:'
         version: 7.37.5(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))
       eslint-plugin-react-hooks:
-        specifier: 7.1.1
+        specifier: 'catalog:'
         version: 7.1.1(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)
       eslint-plugin-yml:
-        specifier: 3.8.1
+        specifier: 'catalog:'
         version: 3.8.1(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))
       globals:
-        specifier: 17.13.0
+        specifier: 'catalog:'
         version: 17.13.0
       husky:
-        specifier: 9.1.7
+        specifier: 'catalog:'
         version: 9.1.7
       knip:
-        specifier: 6.39.0
+        specifier: 'catalog:'
         version: 6.39.0
       lint-staged:
-        specifier: 17.6.0
+        specifier: 'catalog:'
         version: 17.6.0
       prettier:
-        specifier: 3.9.9
+        specifier: 'catalog:'
         version: 3.9.9
       semantic-release:
-        specifier: 25.0.9
+        specifier: 'catalog:'
         version: 25.0.9(supports-color@7.2.0)(typescript@6.0.3)
       syncpack:
-        specifier: 15.3.3
+        specifier: 'catalog:'
         version: 15.3.3
       turbo:
-        specifier: 2.11.7
+        specifier: 'catalog:'
         version: 2.11.7
       typescript:
-        specifier: 6.0.3
+        specifier: 'catalog:'
         version: 6.0.3
       typescript-eslint:
-        specifier: 8.71.0
+        specifier: 'catalog:'
         version: 8.71.0(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)
       vitest:
-        specifier: 5.0.3
-        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+        specifier: 'catalog:'
+        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      yaml:
+        specifier: 'catalog:'
+        version: 2.9.1
 
   packages/adapters/graph/source-github-issues:
     dependencies:
       '@exadev/process-graph-source-contract':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../../core/graph/source-contract
       zod:
-        specifier: 4.6.5
+        specifier: 'catalog:'
         version: 4.6.5
     devDependencies:
       '@arethetypeswrong/cli':
-        specifier: 0.18.5
+        specifier: 'catalog:'
         version: 0.18.5
       '@stryker-mutator/core':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@types/node@26.6.4)
       '@stryker-mutator/typescript-checker':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(typescript@6.0.3)
       '@stryker-mutator/vitest-runner':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(vitest@5.0.3)
       '@types/node':
-        specifier: 26.6.4
+        specifier: 'catalog:'
         version: 26.6.4
       '@vitest/coverage-v8':
-        specifier: 5.0.3
+        specifier: 'catalog:'
         version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
       eslint:
-        specifier: 10.12.0
+        specifier: 'catalog:'
         version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
       publint:
-        specifier: 0.3.25
+        specifier: 'catalog:'
         version: 0.3.25
       typescript:
-        specifier: 6.0.3
+        specifier: 'catalog:'
         version: 6.0.3
       vitest:
-        specifier: 5.0.3
-        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+        specifier: 'catalog:'
+        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
 
   packages/adapters/graph/sqlite-node:
     dependencies:
       '@exadev/process-graph-store-contract':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../../core/graph/store-contract
       '@exadev/process-graph-store-sqlite':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../store-sqlite
       drizzle-orm:
-        specifier: 1.0.0-rc.4
+        specifier: 'catalog:'
         version: 1.0.0-rc.4(zod@4.6.5)
     devDependencies:
       '@arethetypeswrong/cli':
-        specifier: 0.18.5
+        specifier: 'catalog:'
         version: 0.18.5
       '@orpc/client':
-        specifier: 2.0.0-beta.41
+        specifier: 'catalog:'
         version: 2.0.0-beta.41
       '@orpc/server':
-        specifier: 2.0.0-beta.41
+        specifier: 'catalog:'
         version: 2.0.0-beta.41
       '@stryker-mutator/core':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@types/node@26.6.4)
       '@stryker-mutator/typescript-checker':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(typescript@6.0.3)
       '@stryker-mutator/vitest-runner':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(vitest@5.0.3)
       '@types/node':
-        specifier: 26.6.4
+        specifier: 'catalog:'
         version: 26.6.4
       '@vitest/coverage-v8':
-        specifier: 5.0.3
+        specifier: 'catalog:'
         version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
       eslint:
-        specifier: 10.12.0
+        specifier: 'catalog:'
         version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
       publint:
-        specifier: 0.3.25
+        specifier: 'catalog:'
         version: 0.3.25
       typescript:
-        specifier: 6.0.3
+        specifier: 'catalog:'
         version: 6.0.3
       vitest:
-        specifier: 5.0.3
-        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+        specifier: 'catalog:'
+        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
 
   packages/adapters/graph/sqlite-wasm:
     dependencies:
       '@exadev/process-graph-store-contract':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../../core/graph/store-contract
       '@exadev/process-graph-store-sqlite':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../store-sqlite
       '@orpc/client':
-        specifier: 2.0.0-beta.41
+        specifier: 'catalog:'
         version: 2.0.0-beta.41
       '@orpc/server':
-        specifier: 2.0.0-beta.41
+        specifier: 'catalog:'
         version: 2.0.0-beta.41
       '@sqlite.org/sqlite-wasm':
-        specifier: 3.53.4-build2
+        specifier: 'catalog:'
         version: 3.53.4-build2
       drizzle-orm:
-        specifier: 1.0.0-rc.4
+        specifier: 'catalog:'
         version: 1.0.0-rc.4(zod@4.6.5)
     devDependencies:
       '@arethetypeswrong/cli':
-        specifier: 0.18.5
+        specifier: 'catalog:'
         version: 0.18.5
       '@types/node':
-        specifier: 26.6.4
+        specifier: 'catalog:'
         version: 26.6.4
       '@vitest/browser-playwright':
-        specifier: 5.0.3
-        version: 5.0.3(playwright@1.63.0)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vitest@5.0.3)
+        specifier: 'catalog:'
+        version: 5.0.3(playwright@1.63.0)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vitest@5.0.3)
       '@vitest/coverage-v8':
-        specifier: 5.0.3
+        specifier: 'catalog:'
         version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
       eslint:
-        specifier: 10.12.0
+        specifier: 'catalog:'
         version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
       playwright:
-        specifier: 1.63.0
+        specifier: 'catalog:'
         version: 1.63.0
       publint:
-        specifier: 0.3.25
+        specifier: 'catalog:'
         version: 0.3.25
       typescript:
-        specifier: 6.0.3
+        specifier: 'catalog:'
         version: 6.0.3
       vitest:
-        specifier: 5.0.3
-        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+        specifier: 'catalog:'
+        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
 
   packages/adapters/graph/store-sqlite:
     dependencies:
       '@exadev/process-graph-domain':
-        specifier: 1.1.1
+        specifier: workspace:*
         version: link:../../../core/graph/domain
       '@exadev/process-graph-schema':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../../core/graph/schema
       '@exadev/process-graph-store-contract':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../../core/graph/store-contract
       '@orpc/server':
-        specifier: 2.0.0-beta.41
+        specifier: 'catalog:'
         version: 2.0.0-beta.41
       drizzle-orm:
-        specifier: 1.0.0-rc.4
+        specifier: 'catalog:'
         version: 1.0.0-rc.4(zod@4.6.5)
       zod:
-        specifier: 4.6.5
+        specifier: 'catalog:'
         version: 4.6.5
     devDependencies:
       '@arethetypeswrong/cli':
-        specifier: 0.18.5
+        specifier: 'catalog:'
         version: 0.18.5
       '@stryker-mutator/core':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@types/node@26.6.4)
       '@stryker-mutator/typescript-checker':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(typescript@6.0.3)
       '@stryker-mutator/vitest-runner':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(vitest@5.0.3)
       '@types/node':
-        specifier: 26.6.4
+        specifier: 'catalog:'
         version: 26.6.4
       '@vitest/coverage-v8':
-        specifier: 5.0.3
+        specifier: 'catalog:'
         version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
       drizzle-kit:
-        specifier: 1.0.0-rc.4
+        specifier: 'catalog:'
         version: 1.0.0-rc.4
       eslint:
-        specifier: 10.12.0
+        specifier: 'catalog:'
         version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
       publint:
-        specifier: 0.3.25
+        specifier: 'catalog:'
         version: 0.3.25
       typescript:
-        specifier: 6.0.3
+        specifier: 'catalog:'
         version: 6.0.3
       vitest:
-        specifier: 5.0.3
-        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+        specifier: 'catalog:'
+        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
 
   packages/core/graph/dag:
     devDependencies:
       '@arethetypeswrong/cli':
-        specifier: 0.18.5
+        specifier: 'catalog:'
         version: 0.18.5
       '@stryker-mutator/core':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@types/node@26.6.4)
       '@stryker-mutator/typescript-checker':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(typescript@6.0.3)
       '@stryker-mutator/vitest-runner':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(vitest@5.0.3)
       '@types/node':
-        specifier: 26.6.4
+        specifier: 'catalog:'
         version: 26.6.4
       '@vitest/coverage-v8':
-        specifier: 5.0.3
+        specifier: 'catalog:'
         version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
       eslint:
-        specifier: 10.12.0
+        specifier: 'catalog:'
         version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
       publint:
-        specifier: 0.3.25
+        specifier: 'catalog:'
         version: 0.3.25
       typescript:
-        specifier: 6.0.3
+        specifier: 'catalog:'
         version: 6.0.3
       vitest:
-        specifier: 5.0.3
-        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+        specifier: 'catalog:'
+        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
 
   packages/core/graph/domain:
     dependencies:
       '@exadev/process-graph-dag':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../dag
       '@exadev/process-graph-schema':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../schema
       trilean:
-        specifier: 1.7.2
+        specifier: 'catalog:'
         version: 1.7.2
     devDependencies:
       '@arethetypeswrong/cli':
-        specifier: 0.18.5
+        specifier: 'catalog:'
         version: 0.18.5
       '@stryker-mutator/core':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@types/node@26.6.4)
       '@stryker-mutator/typescript-checker':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(typescript@6.0.3)
       '@stryker-mutator/vitest-runner':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(vitest@5.0.3)
       '@types/node':
-        specifier: 26.6.4
+        specifier: 'catalog:'
         version: 26.6.4
       '@vitest/coverage-v8':
-        specifier: 5.0.3
+        specifier: 'catalog:'
         version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
       eslint:
-        specifier: 10.12.0
+        specifier: 'catalog:'
         version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
       publint:
-        specifier: 0.3.25
+        specifier: 'catalog:'
         version: 0.3.25
       typescript:
-        specifier: 6.0.3
+        specifier: 'catalog:'
         version: 6.0.3
       vitest:
-        specifier: 5.0.3
-        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+        specifier: 'catalog:'
+        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
 
   packages/core/graph/layout:
     dependencies:
       '@exadev/process-graph-projection':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../projection
       '@exadev/process-graph-schema':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../schema
       elkjs:
-        specifier: 0.12.0
+        specifier: 'catalog:'
         version: 0.12.0
     devDependencies:
       '@arethetypeswrong/cli':
-        specifier: 0.18.5
+        specifier: 'catalog:'
         version: 0.18.5
       '@stryker-mutator/core':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@types/node@26.6.4)
       '@stryker-mutator/typescript-checker':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(typescript@6.0.3)
       '@stryker-mutator/vitest-runner':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(vitest@5.0.3)
       '@types/node':
-        specifier: 26.6.4
+        specifier: 'catalog:'
         version: 26.6.4
       '@vitest/coverage-v8':
-        specifier: 5.0.3
+        specifier: 'catalog:'
         version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
       eslint:
-        specifier: 10.12.0
+        specifier: 'catalog:'
         version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
       publint:
-        specifier: 0.3.25
+        specifier: 'catalog:'
         version: 0.3.25
       typescript:
-        specifier: 6.0.3
+        specifier: 'catalog:'
         version: 6.0.3
       vitest:
-        specifier: 5.0.3
-        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+        specifier: 'catalog:'
+        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
 
   packages/core/graph/projection:
     dependencies:
       '@exadev/process-graph-dag':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../dag
       '@exadev/process-graph-schema':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../schema
     devDependencies:
       '@arethetypeswrong/cli':
-        specifier: 0.18.5
+        specifier: 'catalog:'
         version: 0.18.5
       '@stryker-mutator/core':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@types/node@26.6.4)
       '@stryker-mutator/typescript-checker':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(typescript@6.0.3)
       '@stryker-mutator/vitest-runner':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(vitest@5.0.3)
       '@types/node':
-        specifier: 26.6.4
+        specifier: 'catalog:'
         version: 26.6.4
       '@vitest/coverage-v8':
-        specifier: 5.0.3
+        specifier: 'catalog:'
         version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
       eslint:
-        specifier: 10.12.0
+        specifier: 'catalog:'
         version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
       publint:
-        specifier: 0.3.25
+        specifier: 'catalog:'
         version: 0.3.25
       typescript:
-        specifier: 6.0.3
+        specifier: 'catalog:'
         version: 6.0.3
       vitest:
-        specifier: 5.0.3
-        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+        specifier: 'catalog:'
+        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
 
   packages/core/graph/schema:
     dependencies:
       trilean:
-        specifier: 1.7.2
+        specifier: 'catalog:'
         version: 1.7.2
       zod:
-        specifier: 4.6.5
+        specifier: 'catalog:'
         version: 4.6.5
     devDependencies:
       '@arethetypeswrong/cli':
-        specifier: 0.18.5
+        specifier: 'catalog:'
         version: 0.18.5
       '@stryker-mutator/core':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@types/node@26.6.4)
       '@stryker-mutator/typescript-checker':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(typescript@6.0.3)
       '@stryker-mutator/vitest-runner':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(vitest@5.0.3)
       '@types/node':
-        specifier: 26.6.4
+        specifier: 'catalog:'
         version: 26.6.4
       '@vitest/coverage-v8':
-        specifier: 5.0.3
+        specifier: 'catalog:'
         version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
       eslint:
-        specifier: 10.12.0
+        specifier: 'catalog:'
         version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
       publint:
-        specifier: 0.3.25
+        specifier: 'catalog:'
         version: 0.3.25
       typescript:
-        specifier: 6.0.3
+        specifier: 'catalog:'
         version: 6.0.3
       vitest:
-        specifier: 5.0.3
-        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+        specifier: 'catalog:'
+        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
 
   packages/core/graph/source-contract:
     dependencies:
       '@exadev/process-graph-schema':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../schema
       '@orpc/client':
-        specifier: 2.0.0-beta.41
+        specifier: 'catalog:'
         version: 2.0.0-beta.41
       '@orpc/contract':
-        specifier: 2.0.0-beta.41
+        specifier: 'catalog:'
         version: 2.0.0-beta.41
       '@orpc/server':
-        specifier: 2.0.0-beta.41
+        specifier: 'catalog:'
         version: 2.0.0-beta.41
       trilean:
-        specifier: 1.7.2
+        specifier: 'catalog:'
         version: 1.7.2
       zod:
-        specifier: 4.6.5
+        specifier: 'catalog:'
         version: 4.6.5
     devDependencies:
       '@arethetypeswrong/cli':
-        specifier: 0.18.5
+        specifier: 'catalog:'
         version: 0.18.5
       '@stryker-mutator/core':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@types/node@26.6.4)
       '@stryker-mutator/typescript-checker':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(typescript@6.0.3)
       '@stryker-mutator/vitest-runner':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(vitest@5.0.3)
       '@types/node':
-        specifier: 26.6.4
+        specifier: 'catalog:'
         version: 26.6.4
       '@vitest/coverage-v8':
-        specifier: 5.0.3
+        specifier: 'catalog:'
         version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
       eslint:
-        specifier: 10.12.0
+        specifier: 'catalog:'
         version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
       publint:
-        specifier: 0.3.25
+        specifier: 'catalog:'
         version: 0.3.25
       typescript:
-        specifier: 6.0.3
+        specifier: 'catalog:'
         version: 6.0.3
       vitest:
-        specifier: 5.0.3
-        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+        specifier: 'catalog:'
+        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
 
   packages/core/graph/store-contract:
     dependencies:
       '@exadev/process-graph-domain':
-        specifier: 1.1.1
+        specifier: workspace:*
         version: link:../domain
       '@exadev/process-graph-schema':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../schema
       '@orpc/contract':
-        specifier: 2.0.0-beta.41
+        specifier: 'catalog:'
         version: 2.0.0-beta.41
       '@orpc/server':
-        specifier: 2.0.0-beta.41
+        specifier: 'catalog:'
         version: 2.0.0-beta.41
       trilean:
-        specifier: 1.7.2
+        specifier: 'catalog:'
         version: 1.7.2
       zod:
-        specifier: 4.6.5
+        specifier: 'catalog:'
         version: 4.6.5
     devDependencies:
       '@arethetypeswrong/cli':
-        specifier: 0.18.5
+        specifier: 'catalog:'
         version: 0.18.5
       '@orpc/client':
-        specifier: 2.0.0-beta.41
+        specifier: 'catalog:'
         version: 2.0.0-beta.41
       '@stryker-mutator/core':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@types/node@26.6.4)
       '@stryker-mutator/typescript-checker':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(typescript@6.0.3)
       '@stryker-mutator/vitest-runner':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(vitest@5.0.3)
       '@types/node':
-        specifier: 26.6.4
+        specifier: 'catalog:'
         version: 26.6.4
       '@vitest/coverage-v8':
-        specifier: 5.0.3
+        specifier: 'catalog:'
         version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
       eslint:
-        specifier: 10.12.0
+        specifier: 'catalog:'
         version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
       publint:
-        specifier: 0.3.25
+        specifier: 'catalog:'
         version: 0.3.25
       typescript:
-        specifier: 6.0.3
+        specifier: 'catalog:'
         version: 6.0.3
       vitest:
-        specifier: 5.0.3
-        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+        specifier: 'catalog:'
+        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
 
   packages/targets/graph-cli:
     dependencies:
       '@exadev/process-graph-dag':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../core/graph/dag
       '@exadev/process-graph-domain':
-        specifier: 1.1.1
+        specifier: workspace:*
         version: link:../../core/graph/domain
       '@exadev/process-graph-projection':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../core/graph/projection
       '@exadev/process-graph-schema':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../core/graph/schema
       '@exadev/process-graph-source-contract':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../core/graph/source-contract
       '@exadev/process-graph-source-github-issues':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../adapters/graph/source-github-issues
       '@exadev/process-graph-sqlite-node':
-        specifier: 1.0.4
+        specifier: workspace:*
         version: link:../../adapters/graph/sqlite-node
       '@exadev/process-graph-store-contract':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../core/graph/store-contract
       '@orpc/server':
-        specifier: 2.0.0-beta.41
+        specifier: 'catalog:'
         version: 2.0.0-beta.41
       commander:
-        specifier: 15.0.0
+        specifier: 'catalog:'
         version: 15.0.0
     devDependencies:
       '@arethetypeswrong/cli':
-        specifier: 0.18.5
+        specifier: 'catalog:'
         version: 0.18.5
       '@stryker-mutator/core':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@types/node@26.6.4)
       '@stryker-mutator/typescript-checker':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(typescript@6.0.3)
       '@stryker-mutator/vitest-runner':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(vitest@5.0.3)
       '@types/node':
-        specifier: 26.6.4
+        specifier: 'catalog:'
         version: 26.6.4
       '@vitest/coverage-v8':
-        specifier: 5.0.3
+        specifier: 'catalog:'
         version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
       eslint:
-        specifier: 10.12.0
+        specifier: 'catalog:'
         version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
       publint:
-        specifier: 0.3.25
+        specifier: 'catalog:'
         version: 0.3.25
       typescript:
-        specifier: 6.0.3
+        specifier: 'catalog:'
         version: 6.0.3
       vitest:
-        specifier: 5.0.3
-        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+        specifier: 'catalog:'
+        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
 
   packages/targets/graph-web:
     dependencies:
       '@exadev/process-graph-domain':
-        specifier: 1.1.1
+        specifier: workspace:*
         version: link:../../core/graph/domain
       '@exadev/process-graph-projection':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../core/graph/projection
       '@exadev/process-graph-react':
-        specifier: 1.0.1
+        specifier: workspace:*
         version: link:../../ui/graph/react
       '@exadev/process-graph-react-flow':
-        specifier: 1.0.1
+        specifier: workspace:*
         version: link:../../ui/graph/react-flow
       '@exadev/process-graph-schema':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../core/graph/schema
       '@exadev/process-graph-source-contract':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../core/graph/source-contract
       '@exadev/process-graph-source-github-issues':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../adapters/graph/source-github-issues
       '@exadev/process-graph-sqlite-wasm':
-        specifier: 1.0.3
+        specifier: workspace:*
         version: link:../../adapters/graph/sqlite-wasm
       '@exadev/process-graph-store-contract':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../core/graph/store-contract
       '@exadev/process-graph-ui':
-        specifier: 1.0.1
+        specifier: workspace:*
         version: link:../../ui/graph/ui
       '@orpc/client':
-        specifier: 2.0.0-beta.41
+        specifier: 'catalog:'
         version: 2.0.0-beta.41
       '@orpc/server':
-        specifier: 2.0.0-beta.41
+        specifier: 'catalog:'
         version: 2.0.0-beta.41
       react:
-        specifier: 19.3.0
+        specifier: 'catalog:'
         version: 19.3.0
       react-dom:
-        specifier: 19.3.0
+        specifier: 'catalog:'
         version: 19.3.0(react@19.3.0)
       zod:
-        specifier: 4.6.5
+        specifier: 'catalog:'
         version: 4.6.5
     devDependencies:
       '@playwright/test':
-        specifier: 1.63.0
+        specifier: 'catalog:'
         version: 1.63.0
       '@resvg/resvg-js':
-        specifier: 2.6.2
+        specifier: 'catalog:'
         version: 2.6.2
       '@testing-library/dom':
-        specifier: 10.4.2
+        specifier: 'catalog:'
         version: 10.4.2
       '@testing-library/react':
-        specifier: 16.3.3
+        specifier: 'catalog:'
         version: 16.3.3(@testing-library/dom@10.4.2)(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
       '@types/node':
-        specifier: 26.6.4
+        specifier: 'catalog:'
         version: 26.6.4
       '@types/react':
-        specifier: 19.3.0
+        specifier: 'catalog:'
         version: 19.3.0
       '@types/react-dom':
-        specifier: 19.3.0
+        specifier: 'catalog:'
         version: 19.3.0(@types/react@19.3.0)
       '@vanilla-extract/css':
-        specifier: 1.21.2
+        specifier: 'catalog:'
         version: 1.21.2
       '@vanilla-extract/vite-plugin':
-        specifier: 5.2.6
-        version: 5.2.6(@types/node@26.6.4)(jiti@2.7.0)(supports-color@7.2.0)(terser@5.51.2)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(yaml@2.9.1)
+        specifier: 'catalog:'
+        version: 5.2.6(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(supports-color@7.2.0)(terser@5.51.2)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(yaml@2.9.1)
       '@vitest/coverage-v8':
-        specifier: 5.0.3
+        specifier: 'catalog:'
         version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
       eslint:
-        specifier: 10.12.0
+        specifier: 'catalog:'
         version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
       happy-dom:
-        specifier: 20.14.5
+        specifier: 'catalog:'
         version: 20.14.5
       typescript:
-        specifier: 6.0.3
+        specifier: 'catalog:'
         version: 6.0.3
       vite:
-        specifier: 8.3.2
-        version: 8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+        specifier: 'catalog:'
+        version: 8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
       vite-plugin-pwa:
-        specifier: 2.0.0
-        version: 2.0.0(supports-color@7.2.0)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(workbox-build@7.4.1(supports-color@7.2.0))(workbox-window@7.4.1)
+        specifier: 'catalog:'
+        version: 2.0.0(supports-color@7.2.0)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(workbox-build@7.4.1(supports-color@7.2.0))(workbox-window@7.4.1)
       vitest:
-        specifier: 5.0.3
-        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+        specifier: 'catalog:'
+        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
       workbox-window:
-        specifier: 7.4.1
+        specifier: 'catalog:'
         version: 7.4.1
 
   packages/targets/process-graph:
@@ -1063,238 +1282,238 @@ importers:
         version: 6.0.3
       vitest:
         specifier: 5.0.3
-        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
 
   packages/ui/graph/react:
     dependencies:
       '@exadev/process-graph-dag':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../../core/graph/dag
       '@exadev/process-graph-domain':
-        specifier: 1.1.1
+        specifier: workspace:*
         version: link:../../../core/graph/domain
       '@exadev/process-graph-projection':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../../core/graph/projection
       '@exadev/process-graph-schema':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../../core/graph/schema
       '@exadev/process-graph-store-contract':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../../core/graph/store-contract
       '@orpc/client':
-        specifier: 2.0.0-beta.41
+        specifier: 'catalog:'
         version: 2.0.0-beta.41
     devDependencies:
       '@arethetypeswrong/cli':
-        specifier: 0.18.5
+        specifier: 'catalog:'
         version: 0.18.5
       '@orpc/server':
-        specifier: 2.0.0-beta.41
+        specifier: 'catalog:'
         version: 2.0.0-beta.41
       '@stryker-mutator/core':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@types/node@26.6.4)
       '@stryker-mutator/typescript-checker':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(typescript@6.0.3)
       '@stryker-mutator/vitest-runner':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(vitest@5.0.3)
       '@testing-library/dom':
-        specifier: 10.4.2
+        specifier: 'catalog:'
         version: 10.4.2
       '@testing-library/react':
-        specifier: 16.3.3
+        specifier: 'catalog:'
         version: 16.3.3(@testing-library/dom@10.4.2)(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
       '@types/node':
-        specifier: 26.6.4
+        specifier: 'catalog:'
         version: 26.6.4
       '@types/react':
-        specifier: 19.3.0
+        specifier: 'catalog:'
         version: 19.3.0
       '@types/react-dom':
-        specifier: 19.3.0
+        specifier: 'catalog:'
         version: 19.3.0(@types/react@19.3.0)
       '@vitest/coverage-v8':
-        specifier: 5.0.3
+        specifier: 'catalog:'
         version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
       eslint:
-        specifier: 10.12.0
+        specifier: 'catalog:'
         version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
       happy-dom:
-        specifier: 20.14.5
+        specifier: 'catalog:'
         version: 20.14.5
       react:
-        specifier: 19.3.0
+        specifier: 'catalog:'
         version: 19.3.0
       react-dom:
-        specifier: 19.3.0
+        specifier: 'catalog:'
         version: 19.3.0(react@19.3.0)
       typescript:
-        specifier: 6.0.3
+        specifier: 'catalog:'
         version: 6.0.3
       vitest:
-        specifier: 5.0.3
-        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+        specifier: 'catalog:'
+        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
 
   packages/ui/graph/react-flow:
     dependencies:
       '@exadev/process-graph-domain':
-        specifier: 1.1.1
+        specifier: workspace:*
         version: link:../../../core/graph/domain
       '@exadev/process-graph-layout':
-        specifier: 1.0.3
+        specifier: workspace:*
         version: link:../../../core/graph/layout
       '@exadev/process-graph-projection':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../../core/graph/projection
       '@exadev/process-graph-react':
-        specifier: 1.0.1
+        specifier: workspace:*
         version: link:../react
       '@exadev/process-graph-schema':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../../core/graph/schema
       '@exadev/process-graph-ui':
-        specifier: 1.0.1
+        specifier: workspace:*
         version: link:../ui
       '@xyflow/react':
-        specifier: 12.12.0
+        specifier: 'catalog:'
         version: 12.12.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
     devDependencies:
       '@arethetypeswrong/cli':
-        specifier: 0.18.5
+        specifier: 'catalog:'
         version: 0.18.5
       '@stryker-mutator/core':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@types/node@26.6.4)
       '@stryker-mutator/typescript-checker':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(typescript@6.0.3)
       '@stryker-mutator/vitest-runner':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(vitest@5.0.3)
       '@testing-library/dom':
-        specifier: 10.4.2
+        specifier: 'catalog:'
         version: 10.4.2
       '@testing-library/react':
-        specifier: 16.3.3
+        specifier: 'catalog:'
         version: 16.3.3(@testing-library/dom@10.4.2)(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
       '@types/node':
-        specifier: 26.6.4
+        specifier: 'catalog:'
         version: 26.6.4
       '@types/react':
-        specifier: 19.3.0
+        specifier: 'catalog:'
         version: 19.3.0
       '@types/react-dom':
-        specifier: 19.3.0
+        specifier: 'catalog:'
         version: 19.3.0(@types/react@19.3.0)
       '@vanilla-extract/css':
-        specifier: 1.21.2
+        specifier: 'catalog:'
         version: 1.21.2
       '@vanilla-extract/vite-plugin':
-        specifier: 5.2.6
-        version: 5.2.6(@types/node@26.6.4)(jiti@2.7.0)(supports-color@7.2.0)(terser@5.51.2)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(yaml@2.9.1)
+        specifier: 'catalog:'
+        version: 5.2.6(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(supports-color@7.2.0)(terser@5.51.2)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(yaml@2.9.1)
       '@vitest/coverage-v8':
-        specifier: 5.0.3
+        specifier: 'catalog:'
         version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
       eslint:
-        specifier: 10.12.0
+        specifier: 'catalog:'
         version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
       happy-dom:
-        specifier: 20.14.5
+        specifier: 'catalog:'
         version: 20.14.5
       react:
-        specifier: 19.3.0
+        specifier: 'catalog:'
         version: 19.3.0
       react-dom:
-        specifier: 19.3.0
+        specifier: 'catalog:'
         version: 19.3.0(react@19.3.0)
       typescript:
-        specifier: 6.0.3
+        specifier: 'catalog:'
         version: 6.0.3
       vite:
-        specifier: 8.3.2
-        version: 8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+        specifier: 'catalog:'
+        version: 8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
       vitest:
-        specifier: 5.0.3
-        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+        specifier: 'catalog:'
+        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
 
   packages/ui/graph/ui:
     dependencies:
       '@exadev/process-graph-domain':
-        specifier: 1.1.1
+        specifier: workspace:*
         version: link:../../../core/graph/domain
       '@exadev/process-graph-projection':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../../core/graph/projection
       '@exadev/process-graph-react':
-        specifier: 1.0.1
+        specifier: workspace:*
         version: link:../react
       '@exadev/process-graph-schema':
-        specifier: 1.1.0
+        specifier: workspace:*
         version: link:../../../core/graph/schema
       '@vanilla-extract/recipes':
-        specifier: 0.5.7
+        specifier: 'catalog:'
         version: 0.5.7(@vanilla-extract/css@1.21.2)
     devDependencies:
       '@arethetypeswrong/cli':
-        specifier: 0.18.5
+        specifier: 'catalog:'
         version: 0.18.5
       '@stryker-mutator/core':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@types/node@26.6.4)
       '@stryker-mutator/typescript-checker':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(typescript@6.0.3)
       '@stryker-mutator/vitest-runner':
-        specifier: 10.0.0
+        specifier: 'catalog:'
         version: 10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(vitest@5.0.3)
       '@testing-library/dom':
-        specifier: 10.4.2
+        specifier: 'catalog:'
         version: 10.4.2
       '@testing-library/react':
-        specifier: 16.3.3
+        specifier: 'catalog:'
         version: 16.3.3(@testing-library/dom@10.4.2)(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
       '@types/node':
-        specifier: 26.6.4
+        specifier: 'catalog:'
         version: 26.6.4
       '@types/react':
-        specifier: 19.3.0
+        specifier: 'catalog:'
         version: 19.3.0
       '@types/react-dom':
-        specifier: 19.3.0
+        specifier: 'catalog:'
         version: 19.3.0(@types/react@19.3.0)
       '@vanilla-extract/css':
-        specifier: 1.21.2
+        specifier: 'catalog:'
         version: 1.21.2
       '@vanilla-extract/vite-plugin':
-        specifier: 5.2.6
-        version: 5.2.6(@types/node@26.6.4)(jiti@2.7.0)(supports-color@7.2.0)(terser@5.51.2)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(yaml@2.9.1)
+        specifier: 'catalog:'
+        version: 5.2.6(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(supports-color@7.2.0)(terser@5.51.2)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(yaml@2.9.1)
       '@vitest/coverage-v8':
-        specifier: 5.0.3
+        specifier: 'catalog:'
         version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
       eslint:
-        specifier: 10.12.0
+        specifier: 'catalog:'
         version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
       happy-dom:
-        specifier: 20.14.5
+        specifier: 'catalog:'
         version: 20.14.5
       react:
-        specifier: 19.3.0
+        specifier: 'catalog:'
         version: 19.3.0
       react-dom:
-        specifier: 19.3.0
+        specifier: 'catalog:'
         version: 19.3.0(react@19.3.0)
       typescript:
-        specifier: 6.0.3
+        specifier: 'catalog:'
         version: 6.0.3
       vite:
-        specifier: 8.3.2
-        version: 8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+        specifier: 'catalog:'
+        version: 8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
       vitest:
-        specifier: 5.0.3
-        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+        specifier: 'catalog:'
+        version: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
 
 packages:
 
@@ -2154,156 +2373,312 @@ packages:
     cpu: [ppc64]
     os: [aix]
 
+  '@esbuild/aix-ppc64@0.28.2':
+    resolution: {integrity: sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
   '@esbuild/android-arm64@0.25.12':
     resolution: {integrity: sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [android]
 
+  '@esbuild/android-arm64@0.28.2':
+    resolution: {integrity: sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
   '@esbuild/android-arm@0.25.12':
     resolution: {integrity: sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==}
     engines: {node: '>=18'}
     cpu: [arm]
     os: [android]
 
+  '@esbuild/android-arm@0.28.2':
+    resolution: {integrity: sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
   '@esbuild/android-x64@0.25.12':
     resolution: {integrity: sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [android]
 
+  '@esbuild/android-x64@0.28.2':
+    resolution: {integrity: sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
   '@esbuild/darwin-arm64@0.25.12':
     resolution: {integrity: sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [darwin]
 
+  '@esbuild/darwin-arm64@0.28.2':
+    resolution: {integrity: sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
   '@esbuild/darwin-x64@0.25.12':
     resolution: {integrity: sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [darwin]
 
+  '@esbuild/darwin-x64@0.28.2':
+    resolution: {integrity: sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
   '@esbuild/freebsd-arm64@0.25.12':
     resolution: {integrity: sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [freebsd]
 
+  '@esbuild/freebsd-arm64@0.28.2':
+    resolution: {integrity: sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
   '@esbuild/freebsd-x64@0.25.12':
     resolution: {integrity: sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [freebsd]
 
+  '@esbuild/freebsd-x64@0.28.2':
+    resolution: {integrity: sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
   '@esbuild/linux-arm64@0.25.12':
     resolution: {integrity: sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [linux]
 
+  '@esbuild/linux-arm64@0.28.2':
+    resolution: {integrity: sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
   '@esbuild/linux-arm@0.25.12':
     resolution: {integrity: sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==}
     engines: {node: '>=18'}
     cpu: [arm]
     os: [linux]
 
+  '@esbuild/linux-arm@0.28.2':
+    resolution: {integrity: sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
   '@esbuild/linux-ia32@0.25.12':
     resolution: {integrity: sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [linux]
 
+  '@esbuild/linux-ia32@0.28.2':
+    resolution: {integrity: sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
   '@esbuild/linux-loong64@0.25.12':
     resolution: {integrity: sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==}
     engines: {node: '>=18'}
     cpu: [loong64]
     os: [linux]
 
+  '@esbuild/linux-loong64@0.28.2':
+    resolution: {integrity: sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
   '@esbuild/linux-mips64el@0.25.12':
     resolution: {integrity: sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==}
     engines: {node: '>=18'}
     cpu: [mips64el]
     os: [linux]
 
+  '@esbuild/linux-mips64el@0.28.2':
+    resolution: {integrity: sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
   '@esbuild/linux-ppc64@0.25.12':
     resolution: {integrity: sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==}
     engines: {node: '>=18'}
     cpu: [ppc64]
     os: [linux]
 
+  '@esbuild/linux-ppc64@0.28.2':
+    resolution: {integrity: sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
   '@esbuild/linux-riscv64@0.25.12':
     resolution: {integrity: sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==}
     engines: {node: '>=18'}
     cpu: [riscv64]
     os: [linux]
 
+  '@esbuild/linux-riscv64@0.28.2':
+    resolution: {integrity: sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
   '@esbuild/linux-s390x@0.25.12':
     resolution: {integrity: sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==}
     engines: {node: '>=18'}
     cpu: [s390x]
     os: [linux]
 
+  '@esbuild/linux-s390x@0.28.2':
+    resolution: {integrity: sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
   '@esbuild/linux-x64@0.25.12':
     resolution: {integrity: sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [linux]
 
+  '@esbuild/linux-x64@0.28.2':
+    resolution: {integrity: sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
   '@esbuild/netbsd-arm64@0.25.12':
     resolution: {integrity: sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [netbsd]
 
+  '@esbuild/netbsd-arm64@0.28.2':
+    resolution: {integrity: sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
   '@esbuild/netbsd-x64@0.25.12':
     resolution: {integrity: sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [netbsd]
 
+  '@esbuild/netbsd-x64@0.28.2':
+    resolution: {integrity: sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
   '@esbuild/openbsd-arm64@0.25.12':
     resolution: {integrity: sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [openbsd]
 
+  '@esbuild/openbsd-arm64@0.28.2':
+    resolution: {integrity: sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
   '@esbuild/openbsd-x64@0.25.12':
     resolution: {integrity: sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [openbsd]
 
+  '@esbuild/openbsd-x64@0.28.2':
+    resolution: {integrity: sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
   '@esbuild/openharmony-arm64@0.25.12':
     resolution: {integrity: sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [openharmony]
 
+  '@esbuild/openharmony-arm64@0.28.2':
+    resolution: {integrity: sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
   '@esbuild/sunos-x64@0.25.12':
     resolution: {integrity: sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [sunos]
 
+  '@esbuild/sunos-x64@0.28.2':
+    resolution: {integrity: sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
   '@esbuild/win32-arm64@0.25.12':
     resolution: {integrity: sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [win32]
 
+  '@esbuild/win32-arm64@0.28.2':
+    resolution: {integrity: sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
   '@esbuild/win32-ia32@0.25.12':
     resolution: {integrity: sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [win32]
 
+  '@esbuild/win32-ia32@0.28.2':
+    resolution: {integrity: sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
   '@esbuild/win32-x64@0.25.12':
     resolution: {integrity: sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [win32]
 
+  '@esbuild/win32-x64@0.28.2':
+    resolution: {integrity: sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
   '@eslint-community/eslint-utils@4.10.1':
     resolution: {integrity: sha512-cuadcxVFE8sDK6iWJbs8Sn0av2Nrh2QSGQhVlBW9AaAHqHwjWsZHT8LJ4hFGPh7ASBV2deFdM7H/DPjulmh8rg==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
@@ -3404,31 +3779,31 @@ packages:
   '@standard-schema/spec@1.1.0':
     resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
 
-  '@standard-server/aws-lambda@0.10.0':
-    resolution: {integrity: sha512-UOT2gtDvRaMPEYWsfGIKdIgDillMjF1LdvvpACWfqKn0krkOQ4x7wfhMwwD4rCN5g/5iI5qO8tlvKJLlJtdInQ==}
+  '@standard-server/aws-lambda@0.10.1':
+    resolution: {integrity: sha512-Rba4wyO9T0ta+Ze2Gu+c27vfzEjFKBqwUobtODvoo0ArZvcycY9Pr5Bf5iFcDX1NAWPFjnyEg5YQe2d+lJqu4g==}
 
-  '@standard-server/core@0.10.0':
-    resolution: {integrity: sha512-t3anpLtP/Qr64TT8OsJbH4b7T3/ho2r2MYZMzT972yh/MGj6iH2SizXTtKdrN9vU1LvZ8BKldAtGNVCu8lW/Ow==}
+  '@standard-server/core@0.10.1':
+    resolution: {integrity: sha512-LtTjCg2x2FfbExGRdtu5J1biNVyNOfLs1/4zHAh/t0qZlbY+jIIbFYT5BPwbiYjF4o+Va5/JKjrA6uZeOQ184w==}
 
-  '@standard-server/fastify@0.10.0':
-    resolution: {integrity: sha512-kDpujjB0eujp9Da06i+yhHXU1ZO3nJxL365lVys6BS3yVJ6CgNh03xO2tODUvOL7NvX29bE6P6WO+yQedwoURg==}
+  '@standard-server/fastify@0.10.1':
+    resolution: {integrity: sha512-8up+11uSaZRNlJ+ejyLPoxgAkftVeV1XCH+afmEbsaQ8YZlLGXQlf12mHFBoS+6Mr0NqtpYn4eBmC6yTnS7llw==}
     peerDependencies:
       fastify: '>=5.6.1'
     peerDependenciesMeta:
       fastify:
         optional: true
 
-  '@standard-server/fetch@0.10.0':
-    resolution: {integrity: sha512-PEyo2yCggoBjQzslvxUGzRkJSr2PWaCFvDw8+JJnCEDvEdTv8hzaTCyU2nog+zPu4XFq6zzVYh1Q6A80gGNlQg==}
+  '@standard-server/fetch@0.10.1':
+    resolution: {integrity: sha512-YK16ZUjJNRl7BZkqsA9dimTqNgjC/pfhXVcRcox22G1x4hrzTd993JLaQSduJ79g8hEyx0LuMCkjLavumwmonQ==}
 
-  '@standard-server/node@0.10.0':
-    resolution: {integrity: sha512-Jiqzuo/50kQCuD6ET9kDir3tgq4CpMxKHr1kXP/dFkTaxIWKmsgoAlw9oDTpok8TYVvpHtHrnENTBvAavNJpMg==}
+  '@standard-server/node@0.10.1':
+    resolution: {integrity: sha512-tVH85dY/qxflrqoGDXy/BiKmzw7w8ELif8yVbIx8XRGsc1qkTere51jsoJlx3tAQN/AC9SUoGjvgcVXVS6IwYw==}
 
-  '@standard-server/peer@0.10.0':
-    resolution: {integrity: sha512-HdNxcZsnYXcHySD31RsGOynQXYWUOOSVWSjdb9di2Gm6FW9EP1mB+h6b+5UkzNSs7hMdhL2z1zlaIFhplznQtg==}
+  '@standard-server/peer@0.10.1':
+    resolution: {integrity: sha512-M1CXBNKMzCSTq33bNHxvUoGSwjjw6rqA+EJ1Cv6UJZSdAN9GoXQPVkmf1qmpPIDlc+0WhXHPoMbND1pqrblMog==}
 
-  '@standard-server/shared@0.10.0':
-    resolution: {integrity: sha512-yHBLREnJzZg9kugvG7zpaFL25wGLbdKgSCavmjOj4wgJ2dwZZ/w4nl503Y+44Kt87Z1gbd2OjwNIz379QAaZ3Q==}
+  '@standard-server/shared@0.10.1':
+    resolution: {integrity: sha512-8OhXcAY13iAtEzprBFDlfOvGVLCrNnf31oiPOJ/aZaR+i2BzT8U7qsUhYU5VPbD++KKfkzsJ7hN2kDlOxJ9C6w==}
 
   '@stryker-mutator/api@10.0.0':
     resolution: {integrity: sha512-ZtAJ0ZT3MVRCWJTBE2h90XB/6E+4lifHYtcTyNG6nU2nLekPgTo4gD5esjX6Okxo1b/JB4jJzyxYB54fwKAoJw==}
@@ -4809,6 +5184,11 @@ packages:
     engines: {node: '>=18'}
     hasBin: true
 
+  esbuild@0.28.2:
+    resolution: {integrity: sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA==}
+    engines: {node: '>=18'}
+    hasBin: true
+
   escalade@3.2.0:
     resolution: {integrity: sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==}
     engines: {node: '>=6'}
@@ -5800,8 +6180,8 @@ packages:
   mdast-util-find-and-replace@3.0.2:
     resolution: {integrity: sha512-Tmd1Vg/m3Xz43afeNxDIhWRtFZgM2VLyaf4vSTYwudTyeuTneoL3qtWMA5jeLyz/O1vDJmmV4QuScFCA2tBPwg==}
 
-  mdast-util-from-markdown@2.0.3:
-    resolution: {integrity: sha512-W4mAWTvSlKvf8L6J+VN9yLSqQ9AOAAvHuoDAmPkz4dHf553m5gVj2ejadHJhoJmcmxEnOv6Pa8XJhpxE93kb8Q==}
+  mdast-util-from-markdown@2.1.0:
+    resolution: {integrity: sha512-KRLgmPaP2H1ul2bpoJkOS+9pAcDAAj9Nu1mqLnh8NLeJG5tlvj42TH80PIGBpROWlRXLk0lDrWNuZCFy/tsB4A==}
 
   mdast-util-frontmatter@2.0.1:
     resolution: {integrity: sha512-LRqI9+wdgC25P0URIJY9vwocIzCcksduHQ9OF2joxQoyTNVduwLAFUzjoopuRJbJAReaKrNQKAZKL3uCMugWJA==}
@@ -5830,8 +6210,8 @@ packages:
   mdast-util-phrasing@4.1.0:
     resolution: {integrity: sha512-TqICwyvJJpBwvGAMZjj4J2n0X8QWp21b9l0o7eXyVJ25YNWYbJDVIyD1bZXE6WtV6RmKJVYmQAKWa0zWOABz2w==}
 
-  mdast-util-to-markdown@2.1.3:
-    resolution: {integrity: sha512-wgyJtgUkUcdU7zci7uuwc/tzoAhm0TswWhaXuvnWolqug+8jY7bgNkBBL0dYBnHgc/tHL7lCzRdPsdUxUKKBqw==}
+  mdast-util-to-markdown@2.2.0:
+    resolution: {integrity: sha512-2Jn/ADrHFFyyniBMi0bncTbJqU78K3/TEYvzvwrWWzD9MYPUa/Gm4r3nOeKFQg/PDM5BsbDYdc8ackW4NTY6NA==}
 
   mdast-util-to-string@4.0.0:
     resolution: {integrity: sha512-0H44vDimn51F0YwvxSJSm0eCDOJTRlmN0R1yBh4HLj9wiV1Dn0QoXGbvFAWj2hSItVTlCmBF1hqKlIyUBVFLPg==}
@@ -7308,8 +7688,8 @@ packages:
     resolution: {integrity: sha512-3hu+tD8YzSLGuFYtPRb48vdhKMi0KQV5sn+uWr8+7dMEq/2G/dtLrdDinkLjqq5TIbIBjYJ4Ax/n3YiaW7QM8A==}
     engines: {node: 20 || >=22}
 
-  weapon-regex@2.0.5:
-    resolution: {integrity: sha512-BJZkSdtcae9Wb8+hKNtAqR+Q61EMOAuQnpCCHKwT50K7fIWg7/2/RnbKR27YB+sMcYxYLUVj+Asm5Y2XhD8mZg==}
+  weapon-regex@2.0.6:
+    resolution: {integrity: sha512-iJC2vqYp+bh3r4X6zjuP0h65XqXjgUX3nJgmhj0PQMrdhAbUwCfN76CSTEEQqV3G7468kjOJ69PmytTG8l/8Gg==}
 
   web-worker@1.5.0:
     resolution: {integrity: sha512-RiMReJrTAiA+mBjGONMnjVDP2u3p9R1vkcGz6gDIrOMT3oGuYwX2WRMYI9ipkphSuE5XKEhydbhNEJh4NY9mlw==}
@@ -8617,81 +8997,159 @@ snapshots:
   '@esbuild/aix-ppc64@0.25.12':
     optional: true
 
+  '@esbuild/aix-ppc64@0.28.2':
+    optional: true
+
   '@esbuild/android-arm64@0.25.12':
     optional: true
 
+  '@esbuild/android-arm64@0.28.2':
+    optional: true
+
   '@esbuild/android-arm@0.25.12':
     optional: true
 
+  '@esbuild/android-arm@0.28.2':
+    optional: true
+
   '@esbuild/android-x64@0.25.12':
     optional: true
 
+  '@esbuild/android-x64@0.28.2':
+    optional: true
+
   '@esbuild/darwin-arm64@0.25.12':
     optional: true
 
+  '@esbuild/darwin-arm64@0.28.2':
+    optional: true
+
   '@esbuild/darwin-x64@0.25.12':
     optional: true
 
+  '@esbuild/darwin-x64@0.28.2':
+    optional: true
+
   '@esbuild/freebsd-arm64@0.25.12':
     optional: true
 
+  '@esbuild/freebsd-arm64@0.28.2':
+    optional: true
+
   '@esbuild/freebsd-x64@0.25.12':
     optional: true
 
+  '@esbuild/freebsd-x64@0.28.2':
+    optional: true
+
   '@esbuild/linux-arm64@0.25.12':
     optional: true
 
+  '@esbuild/linux-arm64@0.28.2':
+    optional: true
+
   '@esbuild/linux-arm@0.25.12':
     optional: true
 
+  '@esbuild/linux-arm@0.28.2':
+    optional: true
+
   '@esbuild/linux-ia32@0.25.12':
     optional: true
 
+  '@esbuild/linux-ia32@0.28.2':
+    optional: true
+
   '@esbuild/linux-loong64@0.25.12':
     optional: true
 
+  '@esbuild/linux-loong64@0.28.2':
+    optional: true
+
   '@esbuild/linux-mips64el@0.25.12':
     optional: true
 
+  '@esbuild/linux-mips64el@0.28.2':
+    optional: true
+
   '@esbuild/linux-ppc64@0.25.12':
     optional: true
 
+  '@esbuild/linux-ppc64@0.28.2':
+    optional: true
+
   '@esbuild/linux-riscv64@0.25.12':
     optional: true
 
+  '@esbuild/linux-riscv64@0.28.2':
+    optional: true
+
   '@esbuild/linux-s390x@0.25.12':
     optional: true
 
+  '@esbuild/linux-s390x@0.28.2':
+    optional: true
+
   '@esbuild/linux-x64@0.25.12':
     optional: true
 
+  '@esbuild/linux-x64@0.28.2':
+    optional: true
+
   '@esbuild/netbsd-arm64@0.25.12':
     optional: true
 
+  '@esbuild/netbsd-arm64@0.28.2':
+    optional: true
+
   '@esbuild/netbsd-x64@0.25.12':
     optional: true
 
+  '@esbuild/netbsd-x64@0.28.2':
+    optional: true
+
   '@esbuild/openbsd-arm64@0.25.12':
     optional: true
 
+  '@esbuild/openbsd-arm64@0.28.2':
+    optional: true
+
   '@esbuild/openbsd-x64@0.25.12':
     optional: true
 
+  '@esbuild/openbsd-x64@0.28.2':
+    optional: true
+
   '@esbuild/openharmony-arm64@0.25.12':
     optional: true
 
+  '@esbuild/openharmony-arm64@0.28.2':
+    optional: true
+
   '@esbuild/sunos-x64@0.25.12':
     optional: true
 
+  '@esbuild/sunos-x64@0.28.2':
+    optional: true
+
   '@esbuild/win32-arm64@0.25.12':
     optional: true
 
+  '@esbuild/win32-arm64@0.28.2':
+    optional: true
+
   '@esbuild/win32-ia32@0.25.12':
     optional: true
 
+  '@esbuild/win32-ia32@0.28.2':
+    optional: true
+
   '@esbuild/win32-x64@0.25.12':
     optional: true
 
+  '@esbuild/win32-x64@0.28.2':
+    optional: true
+
   '@eslint-community/eslint-utils@4.10.1(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))':
     dependencies:
       eslint: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
@@ -8731,7 +9189,7 @@ snapshots:
       '@eslint/core': 1.2.1
       '@eslint/plugin-kit': 0.7.3
       github-slugger: 2.0.0
-      mdast-util-from-markdown: 2.0.3(supports-color@7.2.0)
+      mdast-util-from-markdown: 2.1.0(supports-color@7.2.0)
       mdast-util-frontmatter: 2.0.1(supports-color@7.2.0)
       mdast-util-gfm: 3.1.0(supports-color@7.2.0)
       mdast-util-math: 3.0.0(supports-color@7.2.0)
@@ -9079,9 +9537,9 @@ snapshots:
   '@orpc/client@2.0.0-beta.41':
     dependencies:
       '@orpc/shared': 2.0.0-beta.41
-      '@standard-server/core': 0.10.0
-      '@standard-server/fetch': 0.10.0
-      '@standard-server/peer': 0.10.0
+      '@standard-server/core': 0.10.1
+      '@standard-server/fetch': 0.10.1
+      '@standard-server/peer': 0.10.1
 
   '@orpc/contract@2.0.0-beta.41':
     dependencies:
@@ -9094,17 +9552,17 @@ snapshots:
       '@orpc/client': 2.0.0-beta.41
       '@orpc/contract': 2.0.0-beta.41
       '@orpc/shared': 2.0.0-beta.41
-      '@standard-server/aws-lambda': 0.10.0
-      '@standard-server/core': 0.10.0
-      '@standard-server/fastify': 0.10.0
-      '@standard-server/fetch': 0.10.0
-      '@standard-server/node': 0.10.0
-      '@standard-server/peer': 0.10.0
+      '@standard-server/aws-lambda': 0.10.1
+      '@standard-server/core': 0.10.1
+      '@standard-server/fastify': 0.10.1
+      '@standard-server/fetch': 0.10.1
+      '@standard-server/node': 0.10.1
+      '@standard-server/peer': 0.10.1
       cookie: 2.0.1
 
   '@orpc/shared@2.0.0-beta.41':
     dependencies:
-      '@standard-server/shared': 0.10.0
+      '@standard-server/shared': 0.10.1
       radash: 12.1.1
       type-fest: 5.10.0
 
@@ -9590,39 +10048,39 @@ snapshots:
 
   '@standard-schema/spec@1.1.0': {}
 
-  '@standard-server/aws-lambda@0.10.0':
+  '@standard-server/aws-lambda@0.10.1':
     dependencies:
-      '@standard-server/core': 0.10.0
-      '@standard-server/fetch': 0.10.0
-      '@standard-server/node': 0.10.0
-      '@standard-server/shared': 0.10.0
+      '@standard-server/core': 0.10.1
+      '@standard-server/fetch': 0.10.1
+      '@standard-server/node': 0.10.1
+      '@standard-server/shared': 0.10.1
 
-  '@standard-server/core@0.10.0':
+  '@standard-server/core@0.10.1':
     dependencies:
-      '@standard-server/shared': 0.10.0
+      '@standard-server/shared': 0.10.1
 
-  '@standard-server/fastify@0.10.0':
+  '@standard-server/fastify@0.10.1':
     dependencies:
-      '@standard-server/core': 0.10.0
-      '@standard-server/node': 0.10.0
+      '@standard-server/core': 0.10.1
+      '@standard-server/node': 0.10.1
 
-  '@standard-server/fetch@0.10.0':
+  '@standard-server/fetch@0.10.1':
     dependencies:
-      '@standard-server/core': 0.10.0
-      '@standard-server/shared': 0.10.0
+      '@standard-server/core': 0.10.1
+      '@standard-server/shared': 0.10.1
 
-  '@standard-server/node@0.10.0':
+  '@standard-server/node@0.10.1':
     dependencies:
-      '@standard-server/core': 0.10.0
-      '@standard-server/fetch': 0.10.0
-      '@standard-server/shared': 0.10.0
+      '@standard-server/core': 0.10.1
+      '@standard-server/fetch': 0.10.1
+      '@standard-server/shared': 0.10.1
 
-  '@standard-server/peer@0.10.0':
+  '@standard-server/peer@0.10.1':
     dependencies:
-      '@standard-server/core': 0.10.0
-      '@standard-server/shared': 0.10.0
+      '@standard-server/core': 0.10.1
+      '@standard-server/shared': 0.10.1
 
-  '@standard-server/shared@0.10.0': {}
+  '@standard-server/shared@0.10.1': {}
 
   '@stryker-mutator/api@10.0.0':
     dependencies:
@@ -9677,7 +10135,7 @@ snapshots:
       angular-html-parser: 10.11.0
       semver: 7.8.5
       tslib: 2.8.1
-      weapon-regex: 2.0.5
+      weapon-regex: 2.0.6
 
   '@stryker-mutator/typescript-checker@10.0.0(@stryker-mutator/core@10.0.0(@types/node@26.6.4))(typescript@6.0.3)':
     dependencies:
@@ -9696,7 +10154,7 @@ snapshots:
       '@stryker-mutator/util': 10.0.0
       semver: 7.8.5
       tslib: 2.8.1
-      vitest: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      vitest: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
 
   '@stylistic/eslint-plugin@6.0.0-beta.6(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))':
     dependencies:
@@ -10040,12 +10498,12 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@vanilla-extract/compiler@0.7.2(@types/node@26.6.4)(jiti@2.7.0)(supports-color@7.2.0)(terser@5.51.2)(yaml@2.9.1)':
+  '@vanilla-extract/compiler@0.7.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(supports-color@7.2.0)(terser@5.51.2)(yaml@2.9.1)':
     dependencies:
       '@vanilla-extract/css': 1.21.2
       '@vanilla-extract/integration': 8.0.10(supports-color@7.2.0)
-      vite: 8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
-      vite-node: 6.0.0(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      vite-node: 6.0.0(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
     transitivePeerDependencies:
       - '@types/node'
       - '@vitejs/devtools'
@@ -10085,7 +10543,7 @@ snapshots:
       '@vanilla-extract/babel-plugin-debug-ids': 1.2.2(supports-color@7.2.0)
       '@vanilla-extract/css': 1.21.2
       dedent: 1.7.2
-      esbuild: 0.25.12
+      esbuild: 0.28.2
       eval: 0.1.8
       find-up: 5.0.0
       javascript-stringify: 2.1.0
@@ -10100,11 +10558,11 @@ snapshots:
     dependencies:
       '@vanilla-extract/css': 1.21.2
 
-  '@vanilla-extract/vite-plugin@5.2.6(@types/node@26.6.4)(jiti@2.7.0)(supports-color@7.2.0)(terser@5.51.2)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(yaml@2.9.1)':
+  '@vanilla-extract/vite-plugin@5.2.6(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(supports-color@7.2.0)(terser@5.51.2)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(yaml@2.9.1)':
     dependencies:
-      '@vanilla-extract/compiler': 0.7.2(@types/node@26.6.4)(jiti@2.7.0)(supports-color@7.2.0)(terser@5.51.2)(yaml@2.9.1)
+      '@vanilla-extract/compiler': 0.7.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(supports-color@7.2.0)(terser@5.51.2)(yaml@2.9.1)
       '@vanilla-extract/integration': 8.0.10(supports-color@7.2.0)
-      vite: 8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
     transitivePeerDependencies:
       - '@types/node'
       - '@vitejs/devtools'
@@ -10121,30 +10579,30 @@ snapshots:
       - tsx
       - yaml
 
-  '@vitest/browser-playwright@5.0.3(playwright@1.63.0)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vitest@5.0.3)':
+  '@vitest/browser-playwright@5.0.3(playwright@1.63.0)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vitest@5.0.3)':
     dependencies:
-      '@vitest/browser': 5.0.3(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vitest@5.0.3)
-      '@vitest/mocker': 5.0.3(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      '@vitest/browser': 5.0.3(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vitest@5.0.3)
+      '@vitest/mocker': 5.0.3(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
       playwright: 1.63.0
       tinyrainbow: 3.2.0
-      vitest: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      vitest: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
     transitivePeerDependencies:
       - bufferutil
       - msw
       - utf-8-validate
       - vite
 
-  '@vitest/browser@5.0.3(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vitest@5.0.3)':
+  '@vitest/browser@5.0.3(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vitest@5.0.3)':
     dependencies:
       '@blazediff/core': 1.10.0
-      '@vitest/mocker': 5.0.3(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      '@vitest/mocker': 5.0.3(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
       '@vitest/ui': 5.0.3(vitest@5.0.3)
       '@vitest/utils': 5.0.3
       magic-string: 1.4.2
       pngjs: 7.0.0
       sirv: 3.0.2
       tinyrainbow: 3.2.0
-      vitest: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      vitest: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
       ws: 8.22.0
     transitivePeerDependencies:
       - bufferutil
@@ -10162,9 +10620,9 @@ snapshots:
       obug: 2.2.1
       std-env: 4.3.0
       tinyrainbow: 3.2.0
-      vitest: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      vitest: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
     optionalDependencies:
-      '@vitest/browser': 5.0.3(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vitest@5.0.3)
+      '@vitest/browser': 5.0.3(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vitest@5.0.3)
 
   '@vitest/istanbul-lib-coverage@1.0.2': {}
 
@@ -10172,14 +10630,14 @@ snapshots:
     dependencies:
       '@vitest/istanbul-lib-coverage': 1.0.2
 
-  '@vitest/mocker@5.0.3(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))':
+  '@vitest/mocker@5.0.3(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))':
     dependencies:
       '@jridgewell/trace-mapping': 0.3.31
       '@vitest/spy': 5.0.3
       estree-walker: 3.0.3
       magic-string: 1.4.2
     optionalDependencies:
-      vite: 8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
 
   '@vitest/pretty-format@5.0.3':
     dependencies:
@@ -10195,7 +10653,7 @@ snapshots:
       pathe: 2.0.3
       sirv: 3.0.2
       tinyrainbow: 3.2.0
-      vitest: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      vitest: 5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
 
   '@vitest/utils@5.0.3':
     dependencies:
@@ -11064,6 +11522,35 @@ snapshots:
       '@esbuild/win32-ia32': 0.25.12
       '@esbuild/win32-x64': 0.25.12
 
+  esbuild@0.28.2:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.28.2
+      '@esbuild/android-arm': 0.28.2
+      '@esbuild/android-arm64': 0.28.2
+      '@esbuild/android-x64': 0.28.2
+      '@esbuild/darwin-arm64': 0.28.2
+      '@esbuild/darwin-x64': 0.28.2
+      '@esbuild/freebsd-arm64': 0.28.2
+      '@esbuild/freebsd-x64': 0.28.2
+      '@esbuild/linux-arm': 0.28.2
+      '@esbuild/linux-arm64': 0.28.2
+      '@esbuild/linux-ia32': 0.28.2
+      '@esbuild/linux-loong64': 0.28.2
+      '@esbuild/linux-mips64el': 0.28.2
+      '@esbuild/linux-ppc64': 0.28.2
+      '@esbuild/linux-riscv64': 0.28.2
+      '@esbuild/linux-s390x': 0.28.2
+      '@esbuild/linux-x64': 0.28.2
+      '@esbuild/netbsd-arm64': 0.28.2
+      '@esbuild/netbsd-x64': 0.28.2
+      '@esbuild/openbsd-arm64': 0.28.2
+      '@esbuild/openbsd-x64': 0.28.2
+      '@esbuild/openharmony-arm64': 0.28.2
+      '@esbuild/sunos-x64': 0.28.2
+      '@esbuild/win32-arm64': 0.28.2
+      '@esbuild/win32-ia32': 0.28.2
+      '@esbuild/win32-x64': 0.28.2
+
   escalade@3.2.0: {}
 
   escape-string-regexp@1.0.5: {}
@@ -12114,7 +12601,7 @@ snapshots:
       unist-util-is: 6.0.1
       unist-util-visit-parents: 6.0.2
 
-  mdast-util-from-markdown@2.0.3(supports-color@7.2.0):
+  mdast-util-from-markdown@2.1.0(supports-color@7.2.0):
     dependencies:
       '@types/mdast': 4.0.4
       '@types/unist': 3.0.3
@@ -12136,8 +12623,8 @@ snapshots:
       '@types/mdast': 4.0.4
       devlop: 1.1.0
       escape-string-regexp: 5.0.0
-      mdast-util-from-markdown: 2.0.3(supports-color@7.2.0)
-      mdast-util-to-markdown: 2.1.3
+      mdast-util-from-markdown: 2.1.0(supports-color@7.2.0)
+      mdast-util-to-markdown: 2.2.0
       micromark-extension-frontmatter: 2.0.0
     transitivePeerDependencies:
       - supports-color
@@ -12154,8 +12641,8 @@ snapshots:
     dependencies:
       '@types/mdast': 4.0.4
       devlop: 1.1.0
-      mdast-util-from-markdown: 2.0.3(supports-color@7.2.0)
-      mdast-util-to-markdown: 2.1.3
+      mdast-util-from-markdown: 2.1.0(supports-color@7.2.0)
+      mdast-util-to-markdown: 2.2.0
       micromark-util-normalize-identifier: 2.0.1
     transitivePeerDependencies:
       - supports-color
@@ -12163,8 +12650,8 @@ snapshots:
   mdast-util-gfm-strikethrough@2.0.1(supports-color@7.2.0):
     dependencies:
       '@types/mdast': 4.0.4
-      mdast-util-from-markdown: 2.0.3(supports-color@7.2.0)
-      mdast-util-to-markdown: 2.1.3
+      mdast-util-from-markdown: 2.1.0(supports-color@7.2.0)
+      mdast-util-to-markdown: 2.2.0
     transitivePeerDependencies:
       - supports-color
 
@@ -12173,8 +12660,8 @@ snapshots:
       '@types/mdast': 4.0.4
       devlop: 1.1.0
       markdown-table: 3.0.4
-      mdast-util-from-markdown: 2.0.3(supports-color@7.2.0)
-      mdast-util-to-markdown: 2.1.3
+      mdast-util-from-markdown: 2.1.0(supports-color@7.2.0)
+      mdast-util-to-markdown: 2.2.0
     transitivePeerDependencies:
       - supports-color
 
@@ -12182,20 +12669,20 @@ snapshots:
     dependencies:
       '@types/mdast': 4.0.4
       devlop: 1.1.0
-      mdast-util-from-markdown: 2.0.3(supports-color@7.2.0)
-      mdast-util-to-markdown: 2.1.3
+      mdast-util-from-markdown: 2.1.0(supports-color@7.2.0)
+      mdast-util-to-markdown: 2.2.0
     transitivePeerDependencies:
       - supports-color
 
   mdast-util-gfm@3.1.0(supports-color@7.2.0):
     dependencies:
-      mdast-util-from-markdown: 2.0.3(supports-color@7.2.0)
+      mdast-util-from-markdown: 2.1.0(supports-color@7.2.0)
       mdast-util-gfm-autolink-literal: 2.0.1
       mdast-util-gfm-footnote: 2.1.0(supports-color@7.2.0)
       mdast-util-gfm-strikethrough: 2.0.1(supports-color@7.2.0)
       mdast-util-gfm-table: 2.0.0(supports-color@7.2.0)
       mdast-util-gfm-task-list-item: 2.0.0(supports-color@7.2.0)
-      mdast-util-to-markdown: 2.1.3
+      mdast-util-to-markdown: 2.2.0
     transitivePeerDependencies:
       - supports-color
 
@@ -12205,8 +12692,8 @@ snapshots:
       '@types/mdast': 4.0.4
       devlop: 1.1.0
       longest-streak: 3.1.0
-      mdast-util-from-markdown: 2.0.3(supports-color@7.2.0)
-      mdast-util-to-markdown: 2.1.3
+      mdast-util-from-markdown: 2.1.0(supports-color@7.2.0)
+      mdast-util-to-markdown: 2.2.0
       unist-util-remove-position: 5.0.0
     transitivePeerDependencies:
       - supports-color
@@ -12216,7 +12703,7 @@ snapshots:
       '@types/mdast': 4.0.4
       unist-util-is: 6.0.1
 
-  mdast-util-to-markdown@2.1.3:
+  mdast-util-to-markdown@2.2.0:
     dependencies:
       '@types/mdast': 4.0.4
       '@types/unist': 3.0.3
@@ -13735,13 +14222,13 @@ snapshots:
 
   verkit@0.4.1: {}
 
-  vite-node@6.0.0(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1):
+  vite-node@6.0.0(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1):
     dependencies:
       cac: 7.0.0
       es-module-lexer: 2.3.2
       obug: 2.2.1
       pathe: 2.0.3
-      vite: 8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
     transitivePeerDependencies:
       - '@types/node'
       - '@vitejs/devtools'
@@ -13756,18 +14243,18 @@ snapshots:
       - tsx
       - yaml
 
-  vite-plugin-pwa@2.0.0(supports-color@7.2.0)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(workbox-build@7.4.1(supports-color@7.2.0))(workbox-window@7.4.1):
+  vite-plugin-pwa@2.0.0(supports-color@7.2.0)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(workbox-build@7.4.1(supports-color@7.2.0))(workbox-window@7.4.1):
     dependencies:
       debug: 4.4.3(supports-color@7.2.0)
       pretty-bytes: 6.1.1
       tinyglobby: 0.2.17
-      vite: 8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
       workbox-build: 7.4.1(supports-color@7.2.0)
       workbox-window: 7.4.1
     transitivePeerDependencies:
       - supports-color
 
-  vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1):
+  vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1):
     dependencies:
       lightningcss: 1.33.0
       picomatch: 4.0.7
@@ -13776,15 +14263,16 @@ snapshots:
       tinyglobby: 0.2.17
     optionalDependencies:
       '@types/node': 26.6.4
+      esbuild: 0.28.2
       fsevents: 2.3.3
       jiti: 2.7.0
       terser: 5.51.2
       yaml: 2.9.1
 
-  vitest@5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)):
+  vitest@5.0.3(@types/node@26.6.4)(@vitest/browser-playwright@5.0.3)(@vitest/coverage-v8@5.0.3)(@vitest/ui@5.0.3)(happy-dom@20.14.5)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)):
     dependencies:
       '@types/chai': 5.2.3
-      '@vitest/mocker': 5.0.3(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
+      '@vitest/mocker': 5.0.3(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))
       chai: 6.3.0
       es-module-lexer: 2.3.2
       expect-type: 1.4.0
@@ -13795,11 +14283,11 @@ snapshots:
       tinybench: 6.2.0
       tinyexec: 1.3.1
       tinyglobby: 0.2.17
-      vite: 8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
+      vite: 8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1)
       why-is-node-running: 3.2.1
     optionalDependencies:
       '@types/node': 26.6.4
-      '@vitest/browser-playwright': 5.0.3(playwright@1.63.0)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vitest@5.0.3)
+      '@vitest/browser-playwright': 5.0.3(playwright@1.63.0)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vitest@5.0.3)
       '@vitest/coverage-v8': 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
       '@vitest/ui': 5.0.3(vitest@5.0.3)
       happy-dom: 20.14.5
@@ -13808,7 +14296,7 @@ snapshots:
 
   walk-up-path@4.0.0: {}
 
-  weapon-regex@2.0.5: {}
+  weapon-regex@2.0.6: {}
 
   web-worker@1.5.0: {}
 
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 8bcc59f..4f88567 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -10,11 +10,9 @@ packages:
 # - ui/<domain>/<package>: components that render the model.
 # - targets/<package>: deployable entry points, deliberately flat.
 
+# Every private package names its siblings with `workspace:*` and its third-party libraries with `catalog:`, so a version is written once, in the catalog below, and nothing installs a sibling from the registry. The published `process-graph` package is the exception: `@semantic-release/npm` publishes with `npm publish`, which ships a `workspace:` or `catalog:` specifier verbatim, so its manifest names exact versions, which `scripts/check-published-manifests.ts` holds equal to the catalog and to each sibling's own version. linkWorkspacePackages lets those exact sibling versions link the workspace copy rather than resolve from the registry.
 linkWorkspacePackages: true
 
-# Sibling dependencies are declared as plain exact versions, never with the `workspace:` protocol: a published manifest must stay installable from the registry, and linkWorkspacePackages above still symlinks a sibling locally whenever the workspace version satisfies the range. pnpm's default writes `workspace:^` on `pnpm add <sibling>`; false writes the plain version, pinned exact by saveExact below.
-saveWorkspaceProtocol: false
-
 saveExact: true
 
 # A decision recorded, not merely a permission granted: each entry names why that package's install script is safe to run.
@@ -28,9 +26,81 @@ minimumReleaseAge: 10080
 minimumReleaseAgeExclude:
   - "@exadev/eslint-config"
   - "@exadev/json-compose"
-  - "@exadev/process-graph-*"
   - "@exadev/semantic-release-workspace"
-  - process-graph
   - cosmiconfig-extends
   - trilean
   - trilean-regex
+
+# One exact version per third-party library (and per ExaDev tool), referenced as `catalog:` from every private manifest. Add or bump an entry with `pnpm add --save-catalog <name>@<version>` in a private package; the install age gate above applies to every entry.
+catalog:
+  "@arethetypeswrong/cli": 0.18.5
+  "@commitlint/cli": 21.2.3
+  "@commitlint/config-conventional": 21.2.3
+  "@commitlint/types": 21.2.3
+  "@eslint/js": 10.0.1
+  "@eslint/json": 2.1.0
+  "@eslint/markdown": 8.0.3
+  "@exadev/eslint-config": 2.36.3
+  "@exadev/semantic-release-workspace": 3.1.29
+  "@orpc/client": 2.0.0-beta.41
+  "@orpc/contract": 2.0.0-beta.41
+  "@orpc/server": 2.0.0-beta.41
+  "@playwright/test": 1.63.0
+  "@resvg/resvg-js": 2.6.2
+  "@semantic-release/changelog": 7.0.0
+  "@semantic-release/commit-analyzer": 13.0.1
+  "@semantic-release/git": 11.0.1
+  "@semantic-release/github": 12.0.10
+  "@semantic-release/npm": 13.2.0
+  "@semantic-release/release-notes-generator": 14.1.1
+  "@sqlite.org/sqlite-wasm": 3.53.4-build2
+  "@stryker-mutator/api": 10.0.0
+  "@stryker-mutator/core": 10.0.0
+  "@stryker-mutator/typescript-checker": 10.0.0
+  "@stryker-mutator/vitest-runner": 10.0.0
+  "@testing-library/dom": 10.4.2
+  "@testing-library/react": 16.3.3
+  "@types/node": 26.6.4
+  "@types/react": 19.3.0
+  "@types/react-dom": 19.3.0
+  "@vanilla-extract/css": 1.21.2
+  "@vanilla-extract/recipes": 0.5.7
+  "@vanilla-extract/vite-plugin": 5.2.6
+  "@vitest/browser-playwright": 5.0.3
+  "@vitest/coverage-v8": 5.0.3
+  "@xyflow/react": 12.12.0
+  commander: 15.0.0
+  conventional-changelog-conventionalcommits: 9.3.1
+  drizzle-kit: 1.0.0-rc.4
+  drizzle-orm: 1.0.0-rc.4
+  elkjs: 0.12.0
+  eslint: 10.12.0
+  eslint-config-prettier: 10.1.8
+  eslint-plugin-depend: 1.5.0
+  eslint-plugin-jsx-a11y: 6.10.2
+  eslint-plugin-prettier: 5.5.6
+  eslint-plugin-react: 7.37.5
+  eslint-plugin-react-hooks: 7.1.1
+  eslint-plugin-yml: 3.8.1
+  globals: 17.13.0
+  happy-dom: 20.14.5
+  husky: 9.1.7
+  knip: 6.39.0
+  lint-staged: 17.6.0
+  playwright: 1.63.0
+  prettier: 3.9.9
+  publint: 0.3.25
+  react: 19.3.0
+  react-dom: 19.3.0
+  semantic-release: 25.0.9
+  syncpack: 15.3.3
+  trilean: 1.7.2
+  turbo: 2.11.7
+  typescript: 6.0.3
+  typescript-eslint: 8.71.0
+  vite: 8.3.2
+  vite-plugin-pwa: 2.0.0
+  vitest: 5.0.3
+  workbox-window: 7.4.1
+  yaml: 2.9.1
+  zod: 4.6.5
diff --git a/scripts/check-published-manifests.ts b/scripts/check-published-manifests.ts
new file mode 100644
index 0000000..bb4bb49
--- /dev/null
+++ b/scripts/check-published-manifests.ts
@@ -0,0 +1,149 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import {
+  discoverWorkspace,
+  type WorkspacePackage,
+} from "@exadev/semantic-release-workspace";
+import { parse } from "yaml";
+
+/**
+ * The half of `deps:lint` that syncpack cannot express. A published manifest ships every specifier exactly as written, because `@semantic-release/npm` publishes with `npm publish`, so it must name exact versions, never a `workspace:`, `catalog:`, `link:` or `file:` protocol; each third-party version the catalog names must equal the catalog's, and each sibling version the sibling's own, so the published package was built and tested against what it declares. Every catalog entry must be an exact version too, since the catalog is where the private packages take theirs.
+ */
+
+/** One rule a manifest or the catalog breaks. */
+export interface Finding {
+  /** Where: a manifest path relative to the workspace root, or `pnpm-workspace.yaml` for the catalog. */
+  readonly where: string;
+  /** The dependency field, for a manifest finding. */
+  readonly field?: string;
+  /** The dependency. */
+  readonly name: string;
+  /** What is written. */
+  readonly specifier: string;
+  /** Why it is wrong. */
+  readonly reason: string;
+}
+
+/** A protocol specifier that pnpm resolves inside the workspace and npm ships verbatim. */
+const protocolSpecifier = /^(?:workspace|catalog|link|file):/;
+
+/** An exact semantic version, prerelease and build metadata allowed, with no range operator. */
+const exactVersion = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+
+/**
+ * Checks the catalog's entries.
+ * @param catalog - The default catalog, library name to version.
+ * @returns One finding per entry that is not an exact version.
+ */
+export const checkCatalog = (catalog: ReadonlyMap<string, string>): Finding[] =>
+  [...catalog]
+    .filter(([, version]) => !exactVersion.test(version))
+    .map(([name, version]) => ({
+      where: "pnpm-workspace.yaml",
+      name,
+      specifier: version,
+      reason: "a catalog entry must be an exact version",
+    }));
+
+/**
+ * Checks one published package's manifest against the catalog and its siblings.
+ * @param pkg - The published package, as the release orchestrator discovers it.
+ * @param catalog - The default catalog, library name to version.
+ * @param siblings - Every workspace package's version, by name.
+ * @returns One finding per dependency that breaks a rule; empty when the manifest is publishable as written.
+ */
+export const checkPublishedManifest = (
+  pkg: Pick<WorkspacePackage, "relativeDirectory" | "dependencies">,
+  catalog: ReadonlyMap<string, string>,
+  siblings: ReadonlyMap<string, string>,
+): Finding[] => {
+  const where = `${pkg.relativeDirectory}/package.json`;
+
+  return [...pkg.dependencies].flatMap(([field, entries]) =>
+    [...entries].flatMap(([name, specifier]): Finding[] => {
+      const finding = (reason: string): Finding[] => [
+        { where, field, name, specifier, reason },
+      ];
+      if (protocolSpecifier.test(specifier)) {
+        return finding(
+          "npm publish ships a protocol specifier verbatim, which no consumer can install",
+        );
+      }
+      if (!exactVersion.test(specifier)) {
+        return finding("a published dependency must be an exact version");
+      }
+      const expected = siblings.get(name) ?? catalog.get(name);
+      if (expected !== undefined && specifier !== expected) {
+        return finding(
+          `must equal ${siblings.has(name) ? "the sibling's own version" : "the catalog entry"}, ${expected}`,
+        );
+      }
+
+      return [];
+    }),
+  );
+};
+
+/**
+ * Reads the default catalog from a `pnpm-workspace.yaml` document.
+ * @param text - The document.
+ * @returns The catalog, library name to version; empty when the document has none.
+ * @throws Error when the catalog is not a mapping of names to version strings.
+ */
+export const readCatalog = (text: string): Map<string, string> => {
+  const document: unknown = parse(text);
+  if (
+    typeof document !== "object" ||
+    document === null ||
+    !("catalog" in document)
+  ) {
+    return new Map();
+  }
+  const { catalog } = document;
+  if (typeof catalog !== "object" || catalog === null) {
+    throw new Error("pnpm-workspace.yaml: catalog is not a mapping");
+  }
+
+  return new Map(
+    Object.entries(catalog).map(([name, version]: [string, unknown]) => {
+      if (typeof version !== "string") {
+        throw new Error(
+          `pnpm-workspace.yaml: catalog entry ${name} is not a version string`,
+        );
+      }
+
+      return [name, version];
+    }),
+  );
+};
+
+/**
+ * Checks every published manifest in the workspace and the catalog.
+ * @param root - The workspace root.
+ * @returns Every finding, in workspace order.
+ */
+export const checkWorkspace = async (root: string): Promise<Finding[]> => {
+  const workspace = await discoverWorkspace(root);
+  const catalog = readCatalog(
+    readFileSync(join(root, "pnpm-workspace.yaml"), "utf8"),
+  );
+  const siblings = new Map(
+    workspace.packages.map((pkg) => [pkg.name, pkg.version]),
+  );
+
+  return [
+    ...checkCatalog(catalog),
+    ...workspace.packages
+      .filter((pkg) => !pkg.private)
+      .flatMap((pkg) => checkPublishedManifest(pkg, catalog, siblings)),
+  ];
+};
+
+if (import.meta.main) {
+  const findings = await checkWorkspace(process.cwd());
+  for (const { where, field, name, specifier, reason } of findings) {
+    const location = field === undefined ? where : `${where} ${field}`;
+    process.stderr.write(`${location}: ${name} ${specifier}: ${reason}\n`);
+  }
+  process.exitCode = findings.length === 0 ? 0 : 1;
+}
diff --git a/scripts/check-published-manifests.unit.test.ts b/scripts/check-published-manifests.unit.test.ts
new file mode 100644
index 0000000..4355644
--- /dev/null
+++ b/scripts/check-published-manifests.unit.test.ts
@@ -0,0 +1,146 @@
+import { join } from "node:path";
+import { describe, expect, test } from "vitest";
+import {
+  checkCatalog,
+  checkPublishedManifest,
+  checkWorkspace,
+  readCatalog,
+} from "./check-published-manifests.ts";
+
+const catalog = new Map([
+  ["zod", "4.6.5"],
+  ["drizzle-orm", "1.0.0-rc.4"],
+]);
+const siblings = new Map([["@example/sibling", "1.2.3"]]);
+
+/** A published package declaring the given dependencies, all in one field. */
+const published = (
+  field: "dependencies" | "devDependencies" | "peerDependencies",
+  entries: Readonly<Record<string, string>>,
+) => ({
+  relativeDirectory: "packages/targets/example",
+  dependencies: new Map([[field, new Map(Object.entries(entries))]]),
+});
+
+describe("checkPublishedManifest", () => {
+  test("accepts exact versions equal to the catalog and to the siblings", () => {
+    expect(
+      checkPublishedManifest(
+        published("dependencies", {
+          zod: "4.6.5",
+          "drizzle-orm": "1.0.0-rc.4",
+          "@example/sibling": "1.2.3",
+        }),
+        catalog,
+        siblings,
+      ),
+    ).toEqual([]);
+  });
+
+  test.each([
+    "catalog:",
+    "workspace:*",
+    "workspace:^1.2.3",
+    "link:../x",
+    "file:../x",
+  ])("rejects the protocol specifier %s in any shipped field", (specifier) => {
+    expect(
+      checkPublishedManifest(
+        published("devDependencies", { zod: specifier }),
+        catalog,
+        siblings,
+      ),
+    ).toEqual([
+      {
+        where: "packages/targets/example/package.json",
+        field: "devDependencies",
+        name: "zod",
+        specifier,
+        reason:
+          "npm publish ships a protocol specifier verbatim, which no consumer can install",
+      },
+    ]);
+  });
+
+  test("rejects a range", () => {
+    expect(
+      checkPublishedManifest(
+        published("peerDependencies", { zod: "^4.6.5" }),
+        catalog,
+        siblings,
+      ).map((finding) => finding.reason),
+    ).toEqual(["a published dependency must be an exact version"]);
+  });
+
+  test("rejects a version that differs from the catalog's or the sibling's", () => {
+    expect(
+      checkPublishedManifest(
+        published("dependencies", {
+          zod: "4.6.4",
+          "@example/sibling": "1.2.2",
+        }),
+        catalog,
+        siblings,
+      ).map((finding) => finding.reason),
+    ).toEqual([
+      "must equal the catalog entry, 4.6.5",
+      "must equal the sibling's own version, 1.2.3",
+    ]);
+  });
+
+  test("accepts an exact third-party version the catalog does not name", () => {
+    expect(
+      checkPublishedManifest(
+        published("devDependencies", { tsdown: "0.23.0" }),
+        catalog,
+        siblings,
+      ),
+    ).toEqual([]);
+  });
+});
+
+describe("checkCatalog", () => {
+  test("accepts exact versions, prereleases included, and rejects a range", () => {
+    expect(
+      checkCatalog(
+        new Map([
+          ["zod", "4.6.5"],
+          ["drizzle-orm", "1.0.0-rc.4"],
+          ["elkjs", "~0.12.0"],
+        ]),
+      ),
+    ).toEqual([
+      {
+        where: "pnpm-workspace.yaml",
+        name: "elkjs",
+        specifier: "~0.12.0",
+        reason: "a catalog entry must be an exact version",
+      },
+    ]);
+  });
+});
+
+describe("readCatalog", () => {
+  test("reads the default catalog's entries", () => {
+    expect(
+      readCatalog(
+        'packages:\n  - "packages/*"\ncatalog:\n  "@scope/name": 1.0.0\n  zod: 4.6.5\n',
+      ),
+    ).toEqual(
+      new Map([
+        ["@scope/name", "1.0.0"],
+        ["zod", "4.6.5"],
+      ]),
+    );
+  });
+
+  test("reads a document without a catalog as an empty one", () => {
+    expect(readCatalog('packages:\n  - "packages/*"\n')).toEqual(new Map());
+  });
+});
+
+test("this workspace's published manifests and catalog pass", async () => {
+  await expect(
+    checkWorkspace(join(import.meta.dirname, "..")),
+  ).resolves.toEqual([]);
+});
diff --git a/syncpack.config.ts b/syncpack.config.ts
index be227f5..34b35a7 100644
--- a/syncpack.config.ts
+++ b/syncpack.config.ts
@@ -1,17 +1,30 @@
 import type { RcFile } from "syncpack";
 
 /**
- * Exact-pin everywhere, third-party and internal-sibling dependencies alike, matching documents.js's own convention: an exact pin means a version bump anywhere is a visible, reviewable diff, at the cost of dependencies no longer deduping against a compatible range a consumer's other dependencies might bring in. `deps:lint` is a required CI check and a pre-commit hook step against any staged package.json.
+ * One version per library, written once. The private packages, the workspace root included, take every third-party version from the catalog in `pnpm-workspace.yaml` (`catalog:`) and every sibling through the workspace protocol (`workspace:*`).
  *
- * `versionGroups` deliberately has no entry exempting the root `monorepo-template` manifest: an earlier draft ignored it outright via `isIgnored: true`, which turned out to suppress every check on the root's dependencies, not just cross-package version-mismatch comparison. A caret range reintroduced into the root `package.json` for testing passed `syncpack lint` silently while that exemption was in effect. Root's own shared tool pins (`typescript`, `vitest`, ...) are meant to be kept in sync with every package's copy of the same dependency, so they belong in the default version group like everything else.
+ * The published `process-graph` package cannot: `@semantic-release/npm` publishes with `npm publish`, which ships a `catalog:` or `workspace:` specifier verbatim, so its manifest names exact versions. syncpack's catalog policy would rewrite those into `catalog:`, so the package is left to `scripts/check-published-manifests.ts`, the other half of `deps:lint`, which holds each of its versions exact and equal to the catalog entry or the sibling's own version, and each catalog entry exact. Version groups match first to last, so that exemption comes before the two groups that would otherwise claim its dependencies.
  */
 const config: RcFile = {
-  semverGroups: [
+  versionGroups: [
     {
-      label: "exact versions everywhere",
-      dependencies: ["**"],
-      dependencyTypes: ["prod", "dev"],
-      range: "",
+      label:
+        "the published package, checked by scripts/check-published-manifests.ts instead",
+      packages: ["process-graph"],
+      isIgnored: true,
+    },
+    {
+      label:
+        "a private package names its siblings through the workspace protocol",
+      dependencies: ["$LOCAL"],
+      dependencyTypes: ["!local"],
+      pinVersion: "workspace:*",
+    },
+    {
+      label:
+        "a private package takes every third-party version from the catalog",
+      dependencyTypes: ["!local"],
+      policy: "catalog",
     },
   ],
 };
diff --git a/tsconfig.json b/tsconfig.json
index 23ef8eb..6bf41e2 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -11,6 +11,7 @@
     "release-workspace.config.unit.test.ts",
     "eslint.shared.ts",
     "stryker.shared.ts",
-    ".github/scripts/**/*.ts"
+    ".github/scripts/**/*.ts",
+    "scripts/**/*.ts"
   ]
 }
diff --git a/vitest.config.ts b/vitest.config.ts
index f552d25..54143c8 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -9,6 +9,7 @@ export default defineConfig({
           name: "unit",
           include: [
             ".github/scripts/**/*.test.ts",
+            "scripts/**/*.test.ts",
             "release-workspace.config.unit.test.ts",
           ],
         },

From de99f0341844ff8d83d7096f878fe65db9753813 Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 05:08:18 +0100
Subject: [PATCH 13/31] test(process-graph): smoke-test the packed package as a
 consumer installs it

The smoke test now packs the package with pnpm pack, installs the tarball and
its peer dependencies with npm into a throwaway project outside the repository,
and imports every subpath from there, running real work through each: a model
projected and reasoned over, a flowchart laid out, a store saved and loaded on
node:sqlite, a command run through the Node ports, and the bin's help and
version. It also checks that the packed manifest ships no catalog or workspace
specifier, that no shipped file names a private workspace package, and that
both stylesheets resolve through their subpaths.
---
 knip.config.ts                                |   2 +-
 .../test/consumer.global-setup.ts             |  83 +++++
 .../process-graph/test/package.smoke.test.ts  | 293 ++++++++++++++----
 .../targets/process-graph/vitest.config.ts    |   6 +-
 4 files changed, 330 insertions(+), 54 deletions(-)
 create mode 100644 packages/targets/process-graph/test/consumer.global-setup.ts

diff --git a/knip.config.ts b/knip.config.ts
index 84f975a..ff8a968 100644
--- a/knip.config.ts
+++ b/knip.config.ts
@@ -46,7 +46,7 @@ const config: KnipConfig = {
     "packages/targets/process-graph": {
       // Its entries are its tsdown entries, the bin included, which knip's tsdown plugin reads.
       project: ["src/**/*.{ts,tsx}!"],
-      // Optional peer dependencies of the bundle that nothing else in this workspace declares as a peer. Each is also a devDependency, as `pnpm add --save-peer` writes it, so the built bundle that the smoke tests run resolves it here; only the bundle imports it, since `src/` reaches it through the workspace packages it inlines, and knip traces `src/`. knip reports an entry here that stops being needed and a new peer missing from it, so the list cannot drift silently.
+      // Optional peer dependencies of the bundle that nothing else in this workspace declares as a peer. Each is also a devDependency, as `pnpm add --save-peer` writes it, and only the built bundle imports it, since `src/` reaches it through the workspace packages it inlines, and knip traces `src/`. knip reports an entry here that stops being needed and a new peer missing from it, so the list cannot drift silently.
       ignoreDependencies: [
         "@orpc/client",
         "@sqlite.org/sqlite-wasm",
diff --git a/packages/targets/process-graph/test/consumer.global-setup.ts b/packages/targets/process-graph/test/consumer.global-setup.ts
new file mode 100644
index 0000000..3e12e99
--- /dev/null
+++ b/packages/targets/process-graph/test/consumer.global-setup.ts
@@ -0,0 +1,83 @@
+import { execFileSync } from "node:child_process";
+import {
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import type { TestProject } from "vitest/node";
+
+declare module "vitest" {
+  export interface ProvidedContext {
+    /** The throwaway project the packed package is installed into. */
+    readonly consumer: string;
+  }
+}
+
+/** The package's own directory. */
+const packageDirectory = fileURLToPath(new URL("..", import.meta.url));
+
+/**
+ * Each peer dependency the manifest declares, as `name@version`, so the consumer installs every optional subpath's libraries at the versions the package was built against.
+ * @returns The install specifiers.
+ */
+const peerSpecifiers = (): string[] => {
+  const manifest: unknown = JSON.parse(
+    readFileSync(join(packageDirectory, "package.json"), "utf8"),
+  );
+  if (
+    typeof manifest !== "object" ||
+    manifest === null ||
+    !("peerDependencies" in manifest) ||
+    typeof manifest.peerDependencies !== "object" ||
+    manifest.peerDependencies === null
+  ) {
+    throw new Error("package.json declares no peerDependencies");
+  }
+
+  return Object.entries(manifest.peerDependencies).map(
+    ([name, version]: [string, unknown]) => `${name}@${String(version)}`,
+  );
+};
+
+/**
+ * Packs the built package with `pnpm pack`, as it would be published, and installs the tarball with npm into a new directory outside the repository, beside its peer dependencies, so the smoke tests import it exactly as a consumer would: through its exports map, with no workspace package reachable.
+ * @param project - The smoke project, given the consumer's directory.
+ * @returns Removes the consumer's directory.
+ */
+export default function setup(project: TestProject): () => void {
+  const consumer = mkdtempSync(join(tmpdir(), "process-graph-consumer-"));
+  execFileSync("pnpm", ["pack", "--pack-destination", consumer], {
+    cwd: packageDirectory,
+    stdio: "ignore",
+  });
+  const tarball = readdirSync(consumer).find((name) => name.endsWith(".tgz"));
+  if (tarball === undefined) {
+    throw new Error(`pnpm pack wrote no tarball to ${consumer}`);
+  }
+  writeFileSync(
+    join(consumer, "package.json"),
+    JSON.stringify({ name: "consumer", private: true, type: "module" }),
+  );
+  execFileSync(
+    "npm",
+    [
+      "install",
+      "--no-audit",
+      "--no-fund",
+      "--ignore-scripts",
+      `./${tarball}`,
+      ...peerSpecifiers(),
+    ],
+    { cwd: consumer, stdio: "ignore" },
+  );
+  project.provide("consumer", consumer);
+
+  return () => {
+    rmSync(consumer, { recursive: true, force: true });
+  };
+}
diff --git a/packages/targets/process-graph/test/package.smoke.test.ts b/packages/targets/process-graph/test/package.smoke.test.ts
index b0b31a3..2bfa8f1 100644
--- a/packages/targets/process-graph/test/package.smoke.test.ts
+++ b/packages/targets/process-graph/test/package.smoke.test.ts
@@ -1,53 +1,236 @@
 import { spawnSync } from "node:child_process";
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { expect, test } from "vitest";
-// Deliberately imports the built dist/, not src/: this is the check that catches a wrong exports map or a build misconfiguration that a unit test importing straight from src/ never touches.
-import {
-  dag,
-  deriveStatuses,
-  parseModel,
-  readySet,
-  toSwimlane,
-} from "../dist/index.js";
-
-test("the built package loads a model, projects it and derives its status through one import", () => {
-  const model = parseModel({
-    participants: [
-      { id: "customer", label: "Customer", kind: "role" },
-      { id: "shop", label: "Shop", kind: "system" },
-    ],
-    events: [],
-    actions: [],
-    artefacts: [],
-    elements: [
-      { kind: "activity", id: "submit", label: "Submit", actor: "customer" },
-      { kind: "activity", id: "pack", label: "Pack", actor: "shop" },
-    ],
-    transitions: [{ id: "t1", source: "submit", target: "pack" }],
-    fragments: [],
-    projections: [],
+import { readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, inject, test } from "vitest";
+
+// Every test here runs against the packed tarball installed into a throwaway project by `consumer.global-setup.ts`, never against src/ or the workspace: this is the check that catches a wrong exports map, a declaration or import that still names a private workspace package, or a manifest that ships a specifier no consumer can install.
+const consumer = inject("consumer");
+const installed = join(consumer, "node_modules", "process-graph");
+
+/**
+ * Runs an ES module in the consumer's project, as a consumer's own code would run, and parses the JSON it prints.
+ * @param source - The module's source; it prints one JSON document.
+ * @returns The printed document.
+ */
+const evaluate = (source: string): unknown => {
+  const result = spawnSync(
+    process.execPath,
+    ["--input-type=module", "--eval", source],
+    { cwd: consumer, encoding: "utf8" },
+  );
+  if (result.status !== 0) {
+    throw new Error(result.stderr);
+  }
+  const printed: unknown = JSON.parse(result.stdout);
+
+  return printed;
+};
+
+/** A two-actor model, the same in every test that needs one. */
+const model = `{
+  participants: [
+    { id: "customer", label: "Customer", kind: "role" },
+    { id: "shop", label: "Shop", kind: "system" },
+  ],
+  events: [],
+  actions: [],
+  artefacts: [],
+  elements: [
+    { kind: "activity", id: "submit", label: "Submit", actor: "customer" },
+    { kind: "activity", id: "pack", label: "Pack", actor: "shop" },
+  ],
+  transitions: [{ id: "t1", source: "submit", target: "pack" }],
+  fragments: [],
+  projections: [],
+}`;
+
+/** Every file under a directory, recursively. */
+const filesUnder = (directory: string): string[] =>
+  readdirSync(directory, { recursive: true, withFileTypes: true })
+    .filter((entry) => entry.isFile())
+    .map((entry) => join(entry.parentPath, entry.name));
+
+describe("the packed package", () => {
+  test("ships no protocol specifier in its manifest", () => {
+    const manifest = readFileSync(join(installed, "package.json"), "utf8");
+
+    expect(manifest).not.toMatch(/"(?:catalog|workspace):/);
+  });
+
+  test("names no private workspace package in any file it ships", () => {
+    const naming = filesUnder(join(installed, "dist")).filter((file) =>
+      readFileSync(file, "utf8").includes("@exadev/process-graph-"),
+    );
+
+    expect(naming).toEqual([]);
+  });
+
+  test.each([
+    {
+      subpath: "process-graph/ui/style.css",
+      holding: "a rule",
+      rule: /\{[^}]+\}/,
+    },
+    {
+      subpath: "process-graph/react-flow/style.css",
+      holding: "React Flow's own rules",
+      rule: /\.react-flow/,
+    },
+  ])(
+    "ships $subpath, resolvable through its subpath and holding $holding",
+    ({ subpath, rule }) => {
+      const stylesheet = evaluate(`
+      import { readFileSync } from "node:fs";
+      import { fileURLToPath } from "node:url";
+      console.log(JSON.stringify(readFileSync(fileURLToPath(import.meta.resolve("${subpath}")), "utf8")));
+    `);
+
+      expect(typeof stylesheet === "string" && rule.test(stylesheet)).toBe(
+        true,
+      );
+    },
+  );
+});
+
+describe("each subpath, imported from the installed package", () => {
+  test("process-graph loads a model, projects it and derives its status", () => {
+    expect(
+      evaluate(`
+        import { dag, deriveStatuses, parseModel, readySet, toSwimlane } from "process-graph";
+        const model = parseModel(${model});
+        const facts = () => ({ found: false });
+        console.log(JSON.stringify({
+          lanes: toSwimlane(model).lanes.map((lane) => [lane.participant, lane.nodes]),
+          statuses: [...deriveStatuses(model, { submit: "done" }, facts)],
+          ready: readySet(model, {}, facts),
+          layers: dag.topologicalLayers(dag.buildDag(["a", "b"], (id) => (id === "b" ? ["a"] : []))).layers,
+        }));
+      `),
+    ).toEqual({
+      lanes: [
+        ["customer", ["submit"]],
+        ["shop", ["pack"]],
+      ],
+      statuses: [
+        ["submit", "done"],
+        ["pack", "ready"],
+      ],
+      ready: ["submit"],
+      layers: [["a"], ["b"]],
+    });
+  });
+
+  test("process-graph/layout places a projected flowchart", () => {
+    expect(
+      evaluate(`
+        import { parseModel, toFlowchart } from "process-graph";
+        import { layout } from "process-graph/layout";
+        const placed = await layout(toFlowchart(parseModel(${model})));
+        console.log(JSON.stringify(Object.keys(placed.sizes).sort()));
+      `),
+    ).toEqual(expect.arrayContaining(["pack", "submit"]));
+  });
+
+  test("process-graph/source/github and its node entry build a GitHub source and its token port", () => {
+    expect(
+      evaluate(`
+        import { createFakeGraphSource, createGitHubIssuesSource, graphSourceContract } from "process-graph/source/github";
+        import { githubTokenFromEnvironment } from "process-graph/source/github/node";
+        console.log(JSON.stringify({
+          adapter: typeof createGitHubIssuesSource,
+          fake: typeof createFakeGraphSource,
+          contract: typeof graphSourceContract,
+          token: await githubTokenFromEnvironment({ env: { GITHUB_TOKEN: "example-token" } })(),
+        }));
+      `),
+    ).toEqual({
+      adapter: "function",
+      fake: "function",
+      contract: "object",
+      token: "example-token",
+    });
+  });
+
+  test("process-graph/store and process-graph/store/node save and load a model on node:sqlite", () => {
+    expect(
+      evaluate(`
+        import { createGraphStoreRouter } from "process-graph/store";
+        import { openNodeGraphStore } from "process-graph/store/node";
+        import { parseModel } from "process-graph";
+        const { store, close } = openNodeGraphStore(":memory:");
+        await store.saveModel({ modelId: "orders", model: parseModel(${model}), signal: undefined });
+        const loaded = await store.loadModel({ modelId: "orders", signal: undefined });
+        close();
+        console.log(JSON.stringify({
+          router: typeof createGraphStoreRouter(store),
+          elements: loaded.model.elements.map((element) => element.id),
+        }));
+      `),
+    ).toEqual({ router: "object", elements: ["submit", "pack"] });
+  });
+
+  test("process-graph/store/wasm and its worker entry resolve to the page and worker halves", () => {
+    expect(
+      evaluate(`
+        import { connectGraphStore } from "process-graph/store/wasm";
+        import { serveGraphStoreInWorker } from "process-graph/store/wasm/worker";
+        console.log(JSON.stringify([typeof connectGraphStore, typeof serveGraphStoreInWorker]));
+      `),
+    ).toEqual(["function", "function"]);
+  });
+
+  test("process-graph/react, ui and react-flow are separate subpaths, the styled components apart from the headless ones", () => {
+    expect(
+      evaluate(`
+        import * as react from "process-graph/react";
+        import * as ui from "process-graph/ui";
+        import { ProcessFlow, toFlow } from "process-graph/react-flow";
+        console.log(JSON.stringify({
+          hook: typeof react.useModel,
+          theme: typeof ui.GraphTheme,
+          flow: [typeof ProcessFlow, typeof toFlow],
+          distinctCards: react.ElementCard !== ui.ElementCard,
+        }));
+      `),
+    ).toEqual({
+      hook: "function",
+      theme: "function",
+      flow: ["function", "function"],
+      distinctCards: true,
+    });
+  });
+
+  test("process-graph/cli runs a command through the Node ports", () => {
+    expect(
+      evaluate(`
+        import { mkdtempSync, rmSync } from "node:fs";
+        import { tmpdir } from "node:os";
+        import { join } from "node:path";
+        import { exitCodes, nodePorts, runCli } from "process-graph/cli";
+        const directory = mkdtempSync(join(tmpdir(), "process-graph-cli-"));
+        let stdout = "";
+        const ports = nodePorts({
+          env: { PROCESS_GRAPH_DATA: join(directory, "graph.sqlite3") },
+          stdout: (text) => { stdout += text; },
+        });
+        const identity = { name: "process-graph", version: "0.0.0" };
+        const added = await runCli(["add", "activity", "build", "Build"], ports, identity);
+        const ready = await runCli(["ready"], ports, identity);
+        rmSync(directory, { recursive: true, force: true });
+        console.log(JSON.stringify({ added: added === exitCodes.success, ready: ready === exitCodes.success, stdout }));
+      `),
+    ).toEqual({
+      added: true,
+      ready: true,
+      stdout: "added activity build at revision 1\nbuild\tBuild\n",
+    });
   });
-  const facts = () => ({ found: false }) as const;
-
-  expect(
-    toSwimlane(model).lanes.map((lane) => [lane.participant, lane.nodes]),
-  ).toEqual([
-    ["customer", ["submit"]],
-    ["shop", ["pack"]],
-  ]);
-  expect([...deriveStatuses(model, { submit: "done" }, facts)]).toEqual([
-    ["submit", "done"],
-    ["pack", "ready"],
-  ]);
-  expect(readySet(model, {}, facts)).toEqual(["submit"]);
-  expect(typeof dag.criticalPath).toBe("function");
 });
 
-test("the built process-graph bin runs the command line as a process with this package's version", () => {
-  const bin = fileURLToPath(new URL("../dist/bin.js", import.meta.url));
+describe("the installed bin", () => {
+  const bin = join(consumer, "node_modules", ".bin", "process-graph");
   const manifest: unknown = JSON.parse(
-    readFileSync(new URL("../package.json", import.meta.url), "utf8"),
+    readFileSync(join(installed, "package.json"), "utf8"),
   );
   const version =
     typeof manifest === "object" &&
@@ -57,13 +240,19 @@ test("the built process-graph bin runs the command line as a process with this p
       ? manifest.version
       : undefined;
 
-  const result = spawnSync(process.execPath, [bin, "--version"], {
-    encoding: "utf8",
-  });
-  const help = spawnSync(process.execPath, [bin, "--help"], {
-    encoding: "utf8",
+  test("prints the command line's help", () => {
+    const help = spawnSync(bin, ["--help"], {
+      cwd: consumer,
+      encoding: "utf8",
+    });
+
+    expect(help).toMatchObject({ status: 0 });
+    expect(help.stdout).toContain("Usage: process-graph [options] [command]");
   });
 
-  expect(result).toMatchObject({ status: 0, stdout: `${String(version)}\n` });
-  expect(help.stdout).toContain("Usage: process-graph [options] [command]");
+  test("reports the package's version", () => {
+    expect(
+      spawnSync(bin, ["--version"], { cwd: consumer, encoding: "utf8" }),
+    ).toMatchObject({ status: 0, stdout: `${String(version)}\n` });
+  });
 });
diff --git a/packages/targets/process-graph/vitest.config.ts b/packages/targets/process-graph/vitest.config.ts
index 01b9391..082a3f9 100644
--- a/packages/targets/process-graph/vitest.config.ts
+++ b/packages/targets/process-graph/vitest.config.ts
@@ -9,7 +9,11 @@ export default defineConfig({
       },
       {
         extends: true,
-        test: { name: "smoke", include: ["test/package.smoke.test.ts"] },
+        test: {
+          name: "smoke",
+          include: ["test/package.smoke.test.ts"],
+          globalSetup: ["test/consumer.global-setup.ts"],
+        },
       },
     ],
   },

From 333522c527836a1789e100f062d8ccdd35e80dec Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 05:09:39 +0100
Subject: [PATCH 14/31] test(process-graph): run the store conformance kit on
 the bundled wasm store

A browser integration test starts workers on the bundle's store/wasm/worker
entry and connects through its store/wasm entry in Chromium, with no
cross-origin isolation, and runs the store contract's conformance kit and a
reopen check against them. Integration tests now wait for the package's own
build, since this one runs its built output.
---
 .../targets/process-graph/eslint.config.ts    |  7 +++
 packages/targets/process-graph/package.json   |  6 ++-
 .../test/browser/store.integration.test.ts    | 51 +++++++++++++++++++
 .../test/browser/store.worker.ts              |  5 ++
 .../process-graph/tsconfig.browser.json       |  8 +++
 .../targets/process-graph/tsconfig.node.json  |  3 +-
 .../targets/process-graph/vitest.config.ts    | 21 ++++++++
 pnpm-lock.yaml                                |  6 +++
 turbo.json                                    |  2 +-
 9 files changed, 106 insertions(+), 3 deletions(-)
 create mode 100644 packages/targets/process-graph/test/browser/store.integration.test.ts
 create mode 100644 packages/targets/process-graph/test/browser/store.worker.ts
 create mode 100644 packages/targets/process-graph/tsconfig.browser.json

diff --git a/packages/targets/process-graph/eslint.config.ts b/packages/targets/process-graph/eslint.config.ts
index 9a175af..f1f99f3 100644
--- a/packages/targets/process-graph/eslint.config.ts
+++ b/packages/targets/process-graph/eslint.config.ts
@@ -19,7 +19,14 @@ const subpathEntries = [
 export default defineConfig(
   packageLintConfig({
     tsconfigRootDir: import.meta.dirname,
+    projects: [
+      "./tsconfig.json",
+      "./tsconfig.node.json",
+      "./tsconfig.browser.json",
+    ],
     isomorphic: true,
+    // The browser integration test starts workers on the bundled browser store.
+    browserGlobals: true,
     // The bin is a Node launcher that is run, never imported, and these subpaths are the Node-only ones by design; the root entry and every other subpath stay isomorphic.
     isomorphicExemptions: [
       "src/bin.ts",
diff --git a/packages/targets/process-graph/package.json b/packages/targets/process-graph/package.json
index f9a14a2..a332ce1 100644
--- a/packages/targets/process-graph/package.json
+++ b/packages/targets/process-graph/package.json
@@ -88,12 +88,14 @@
     "_lint": "eslint . --cache --max-warnings 0",
     "_lint:fix": "eslint . --fix --cache --max-warnings 0",
     "typecheck": "turbo run _typecheck _typecheck:attw",
-    "_typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.node.json --noEmit",
+    "_typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.node.json --noEmit && tsc -p tsconfig.browser.json --noEmit",
     "_typecheck:attw": "attw --pack --profile esm-only --exclude-entrypoints ./ui/style.css ./react-flow/style.css",
     "test": "turbo run _test",
     "_test": "vitest run --project unit",
     "test:coverage": "turbo run _test:coverage",
     "_test:coverage": "vitest run --project unit --coverage",
+    "test:integration": "turbo run _test:integration",
+    "_test:integration": "vitest run --project browser",
     "test:smoke": "turbo run _test:smoke",
     "_test:smoke": "vitest run --project smoke",
     "test:mutation": "turbo run _test:mutation",
@@ -136,12 +138,14 @@
     "@types/react": "19.3.0",
     "@vanilla-extract/css": "1.21.2",
     "@vanilla-extract/recipes": "0.5.7",
+    "@vitest/browser-playwright": "5.0.3",
     "@vitest/coverage-v8": "5.0.3",
     "@xyflow/react": "12.12.0",
     "commander": "15.0.0",
     "drizzle-orm": "1.0.0-rc.4",
     "elkjs": "0.12.0",
     "eslint": "10.12.0",
+    "playwright": "1.63.0",
     "publint": "0.3.25",
     "react": "19.3.0",
     "react-dom": "19.3.0",
diff --git a/packages/targets/process-graph/test/browser/store.integration.test.ts b/packages/targets/process-graph/test/browser/store.integration.test.ts
new file mode 100644
index 0000000..d7e89e1
--- /dev/null
+++ b/packages/targets/process-graph/test/browser/store.integration.test.ts
@@ -0,0 +1,51 @@
+import {
+  graphStoreConformance,
+  everyFieldModel,
+} from "@exadev/process-graph-store-contract/conformance";
+import { describe, expect, test } from "vitest";
+// The built bundle's page entry, as `process-graph/store/wasm` resolves for a consumer.
+import { connectGraphStore } from "../../dist/store/wasm.js";
+
+/** Starts a worker serving the named database from the bundle's worker entry, as one tab of an app would. */
+const startWorker = (name: string): Worker =>
+  new Worker(new URL("store.worker.ts", import.meta.url), {
+    type: "module",
+    name,
+  });
+
+graphStoreConformance({
+  name: "the bundled SQLite wasm store in a worker, no cross-origin isolation",
+  createClient: async () => {
+    const worker = startWorker(`conformance-${crypto.randomUUID()}`);
+
+    return Promise.resolve({
+      client: connectGraphStore(worker),
+      close: async () => {
+        worker.terminate();
+
+        return Promise.resolve();
+      },
+    });
+  },
+});
+
+describe("the bundled browser store", () => {
+  test("keeps a database after the worker that wrote it has gone", async () => {
+    const name = `reopen-${crypto.randomUUID()}`;
+    const writer = startWorker(name);
+    await connectGraphStore(writer).v1.models.save({
+      modelId: "orders",
+      model: everyFieldModel,
+    });
+    writer.terminate();
+
+    const reader = startWorker(name);
+    try {
+      await expect(
+        connectGraphStore(reader).v1.models.load({ modelId: "orders" }),
+      ).resolves.toMatchObject({ model: everyFieldModel });
+    } finally {
+      reader.terminate();
+    }
+  });
+});
diff --git a/packages/targets/process-graph/test/browser/store.worker.ts b/packages/targets/process-graph/test/browser/store.worker.ts
new file mode 100644
index 0000000..603ad88
--- /dev/null
+++ b/packages/targets/process-graph/test/browser/store.worker.ts
@@ -0,0 +1,5 @@
+// Deliberately the built bundle's worker entry, not a workspace package: this checks that `process-graph/store/wasm/worker` is emitted and that a bundler resolves it and its SQLite wasm import as a consumer's would.
+import { serveGraphStoreInWorker } from "../../dist/store/wasm/worker.js";
+
+// The test names each worker after the database it should serve.
+serveGraphStoreInWorker({ name: self.name });
diff --git a/packages/targets/process-graph/tsconfig.browser.json b/packages/targets/process-graph/tsconfig.browser.json
new file mode 100644
index 0000000..391f92c
--- /dev/null
+++ b/packages/targets/process-graph/tsconfig.browser.json
@@ -0,0 +1,8 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "lib": ["ES2024", "WebWorker"],
+    "types": []
+  },
+  "include": ["test/browser/**/*.ts"]
+}
diff --git a/packages/targets/process-graph/tsconfig.node.json b/packages/targets/process-graph/tsconfig.node.json
index 426f00b..7809401 100644
--- a/packages/targets/process-graph/tsconfig.node.json
+++ b/packages/targets/process-graph/tsconfig.node.json
@@ -4,5 +4,6 @@
     "lib": ["ES2024"],
     "types": ["node"]
   },
-  "include": ["src/**/*.ts", "test/**/*.ts", "scripts/**/*.ts", "*.config.ts"]
+  "include": ["src/**/*.ts", "test/**/*.ts", "scripts/**/*.ts", "*.config.ts"],
+  "exclude": ["test/browser/**"]
 }
diff --git a/packages/targets/process-graph/vitest.config.ts b/packages/targets/process-graph/vitest.config.ts
index 082a3f9..dd5e6f7 100644
--- a/packages/targets/process-graph/vitest.config.ts
+++ b/packages/targets/process-graph/vitest.config.ts
@@ -1,3 +1,4 @@
+import { playwright } from "@vitest/browser-playwright";
 import { defineConfig } from "vitest/config";
 
 export default defineConfig({
@@ -15,6 +16,26 @@ export default defineConfig({
           globalSetup: ["test/consumer.global-setup.ts"],
         },
       },
+      {
+        extends: true,
+        optimizeDeps: {
+          // The worker module is only found when a test starts a worker, so Vite would discover its dependencies mid-run and reload the page under the running tests. Scanning every browser test file, the worker included, up front optimises them before the first test.
+          entries: ["test/browser/**/*.ts"],
+          // SQLite's wasm module loads its own .wasm file relative to itself, which pre-bundling would break.
+          exclude: ["@sqlite.org/sqlite-wasm"],
+        },
+        test: {
+          name: "browser",
+          include: ["test/browser/**/*.test.ts"],
+          // The bundled browser store, served by Vite with no Cross-Origin-Opener-Policy or Cross-Origin-Embedder-Policy headers, as a consumer's page would be.
+          browser: {
+            enabled: true,
+            headless: true,
+            provider: playwright(),
+            instances: [{ browser: "chromium" }],
+          },
+        },
+      },
     ],
   },
 });
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 05fbcbf..5120884 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1247,6 +1247,9 @@ importers:
       '@vanilla-extract/recipes':
         specifier: 0.5.7
         version: 0.5.7(@vanilla-extract/css@1.21.2)
+      '@vitest/browser-playwright':
+        specifier: 5.0.3
+        version: 5.0.3(playwright@1.63.0)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(yaml@2.9.1))(vitest@5.0.3)
       '@vitest/coverage-v8':
         specifier: 5.0.3
         version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)
@@ -1265,6 +1268,9 @@ importers:
       eslint:
         specifier: 10.12.0
         version: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
+      playwright:
+        specifier: 1.63.0
+        version: 1.63.0
       publint:
         specifier: 0.3.25
         version: 0.3.25
diff --git a/turbo.json b/turbo.json
index 9935a45..ee111fa 100644
--- a/turbo.json
+++ b/turbo.json
@@ -51,7 +51,7 @@
       "outputs": ["coverage/**"]
     },
     "_test:integration": {
-      "dependsOn": ["^_build"],
+      "dependsOn": ["_build", "^_build"],
       "outputs": []
     },
     "_test:smoke": {

From ee86c7bf2e13a2b98dbe8912fbc326b08978ad9a Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 05:12:25 +0100
Subject: [PATCH 15/31] docs(process-graph): document the subpaths, their peers
 and the command line

---
 packages/targets/process-graph/README.md | 100 ++++++++++++++++++-----
 1 file changed, 78 insertions(+), 22 deletions(-)

diff --git a/packages/targets/process-graph/README.md b/packages/targets/process-graph/README.md
index a5b726f..5e66fb5 100644
--- a/packages/targets/process-graph/README.md
+++ b/packages/targets/process-graph/README.md
@@ -2,7 +2,7 @@
 
 [![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![npm](https://img.shields.io/badge/npm-CB3837?logo=npm&logoColor=white)](https://www.npmjs.com/package/process-graph) [![Release](https://img.shields.io/github/v/release/ExaDev/process-graph)](https://github.com/ExaDev/process-graph/releases/latest) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
 
-The one install for the process-graph model: a layout-free description of a process, its projections into a flowchart, a swimlane, a state machine and a sequence diagram, and reasoning over a run (what is ready, what blocks what, what finishing something changes). It re-exports the building-block packages so a consumer depends on one package and imports from one place. `src/` imports nothing Node-only and runs unchanged in a browser or a Worker.
+The one install for the process-graph model: a layout-free description of a process, its projections into a flowchart, a swimlane, a state machine and a sequence diagram, and reasoning over a run (what is ready, what blocks what, what finishing something changes). Layout, the GitHub issues source, the SQLite store for Node and the browser, the React UI and the command line each sit behind a subpath of their own, so an application loads only the parts it imports. ESM only.
 
 ```ts
 import {
@@ -36,38 +36,93 @@ toSwimlane(model).lanes; // one lane per actor, each with the elements it owns
 deriveStatuses(model, { submit: "done" }, facts); // Map { "submit" => "done", "pack" => "ready" }
 ```
 
-## This package or a building block
+## Subpaths
+
+The package is built from the repository's internal packages, which are bundled into it and not published on their own; each internal package's README documents its functions and rules. Each subpath loads only the code it reaches.
+
+| Import                               | What it is                                                                                                                                                                         | Runs in               |
+| ------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
+| `process-graph`                      | The model (`defineModel`, `parseModel`, `validate`), its projections and inverses, and the reasoning over a run (statuses, ready set, blocked-by, impact, what-if, critical path). | Browser, Worker, Node |
+| `process-graph/layout`               | `layout`: positions for a projected flowchart, swimlane or state machine, in the model's `views` shape, through elkjs.                                                             | Browser, Worker, Node |
+| `process-graph/source/github`        | The `GraphSource` port (contract, schemas, router, pagination and an in-memory fake) and the GitHub issues adapter, `createGitHubIssuesSource`.                                    | Browser, Worker, Node |
+| `process-graph/source/github/node`   | `githubTokenFromEnvironment`: a token port reading `GITHUB_TOKEN` or the GitHub CLI's token.                                                                                       | Node                  |
+| `process-graph/store`                | The `GraphStore` port (contract, schemas, router, change feed, structural queries and an in-memory fake) and the SQLite store over any Drizzle SQLite database.                    | Browser, Worker, Node |
+| `process-graph/store/node`           | `openNodeGraphStore`: the SQLite store on Node's built-in `node:sqlite`.                                                                                                           | Node                  |
+| `process-graph/store/wasm`           | `connectGraphStore`: connects a page to the store a dedicated worker serves.                                                                                                       | Browser               |
+| `process-graph/store/wasm/worker`    | `serveGraphStoreInWorker`: serves the store from a dedicated worker on SQLite wasm and OPFS, shared between tabs with no special headers.                                          | Dedicated worker      |
+| `process-graph/react`                | Headless React hooks and unstyled components: follow a stored model, derive its run, project, filter and select.                                                                   | Browser               |
+| `process-graph/ui`                   | Styled components over `process-graph/react`, the SVG sequence diagram and the theme contract with light and dark themes.                                                          | Browser               |
+| `process-graph/ui/style.css`         | The compiled styles for `process-graph/ui`.                                                                                                                                        | Browser               |
+| `process-graph/react-flow`           | React Flow views of a flowchart, swimlane or state machine, laid out by `process-graph/layout`.                                                                                    | Browser               |
+| `process-graph/react-flow/style.css` | The compiled styles for `process-graph/react-flow`, React Flow's own included.                                                                                                     | Browser               |
+| `process-graph/cli`                  | The command line as a library: `runCli` over injected ports, `nodePorts` for a Node process, and each command's operation returning plain data.                                    | Node                  |
+
+`zod` and `trilean`, which the root entry needs, are dependencies. The libraries only other subpaths need are optional peer dependencies, so installing `process-graph` for its root entry pulls in nothing else; install the peers of each subpath you import beside it:
+
+| Subpath             | Peer dependencies                                                            |
+| ------------------- | ---------------------------------------------------------------------------- |
+| `layout`            | `elkjs`                                                                      |
+| `source/github`     | `@orpc/client`, `@orpc/contract`, `@orpc/server`                             |
+| `store`             | `@orpc/contract`, `@orpc/server`, `drizzle-orm`                              |
+| `store/node`        | `drizzle-orm`                                                                |
+| `store/wasm`        | `@orpc/client`                                                               |
+| `store/wasm/worker` | `@orpc/contract`, `@orpc/server`, `drizzle-orm`, `@sqlite.org/sqlite-wasm`   |
+| `react`             | `react`                                                                      |
+| `ui`                | `react`, `@vanilla-extract/recipes`, `@vanilla-extract/css` (types)          |
+| `react-flow`        | `react`, `react-dom`, `@xyflow/react`, `elkjs`, `@vanilla-extract/recipes`   |
+| `cli` and the bin   | `commander`, `@orpc/client`, `@orpc/contract`, `@orpc/server`, `drizzle-orm` |
+
+The versions are the ones `package.json` declares under `peerDependencies`.
+
+With Vite, exclude `@sqlite.org/sqlite-wasm` from dependency pre-bundling (`optimizeDeps.exclude`), since it loads its `.wasm` file relative to itself. A worker module serving the browser store is one call:
 
-Install `process-graph` to author, load, project and reason about a model. Install a building-block package instead when only one layer is needed and the rest should stay out of the dependency tree, or when another package of this repository imports a layer directly.
+```ts
+// store.worker.ts
+import { serveGraphStoreInWorker } from "process-graph/store/wasm/worker";
+
+serveGraphStoreInWorker({ name: "graph" });
+```
+
+```ts
+// in the page
+import { connectGraphStore } from "process-graph/store/wasm";
+
+const store = connectGraphStore(
+  new Worker(new URL("./store.worker.ts", import.meta.url), { type: "module" }),
+);
+```
 
-| Layer      | Package                            | Exported by this package |
-| ---------- | ---------------------------------- | ------------------------ |
-| Model      | `@exadev/process-graph-schema`     | flat                     |
-| Projection | `@exadev/process-graph-projection` | flat                     |
-| Domain     | `@exadev/process-graph-domain`     | flat                     |
-| DAG        | `@exadev/process-graph-dag`        | namespaced as `dag`      |
+The styled components need their stylesheets imported once:
 
-Each package's own README documents its functions and rules; this package adds no behaviour of its own beyond the bin.
+```tsx
+import "process-graph/ui/style.css";
+import "process-graph/react-flow/style.css";
+import { GraphTheme } from "process-graph/ui";
+import { ProcessView } from "process-graph/react-flow";
+```
 
 ## The command line
 
-The package carries the `process-graph` bin, the command line from [`@exadev/process-graph-cli`](../graph-cli/README.md): sync work from GitHub issues into a SQLite store, ask what is ready, blocked, affected, on the critical path or handed off, explain a status, and draw the model in Mermaid or Graphviz DOT.
+The package carries the `process-graph` bin: sync work from GitHub issues into a SQLite store, ask what is ready, blocked, affected, on the critical path or handed off, explain a status, and draw the model in Mermaid or Graphviz DOT. Its peers are installed beside it:
 
 ```sh
-npx process-graph sync github:ExaDev
-npx process-graph ready
-npx process-graph show --view swimlane
+npm install --global process-graph commander @orpc/client @orpc/contract @orpc/server drizzle-orm
+process-graph sync github:ExaDev
+process-graph ready
+process-graph why github:ExaDev/process-graph#12
+process-graph show --view swimlane --format mermaid
 ```
 
-The bin delegates to that package's library entry, which this package does not re-export: the command line is Node-only, while everything this package exports runs unchanged in a browser or a Worker. A program that embeds the command line, or calls its operations for data, imports `@exadev/process-graph-cli` directly.
+Every command, its options and its exit statuses are in the [command line's README](../graph-cli/README.md). A program that mounts the command line as a subcommand, or wants each command's result as data, imports `process-graph/cli`.
 
 ## What is exported, and under which name
 
-The model, projection and domain packages are exported flat, under their own names. The DAG package is exported as the namespace `dag`, in its entirety: `dag.buildDag`, `dag.topologicalLayers`, `dag.criticalPath`, `dag.CycleError` and the rest. It is the only layer namespaced, because its `criticalPath` has the same name as the domain package's, which answers a different question (the heaviest chain through the work still ahead of a run, not through a bare node set). The whole layer is namespaced rather than only the colliding name, so a name added to a layer later cannot start colliding silently.
+The root entry exports the model, projection and domain layers flat, under their own names, and the DAG layer as the namespace `dag`, in its entirety: `dag.buildDag`, `dag.topologicalLayers`, `dag.criticalPath`, `dag.CycleError` and the rest. The DAG layer is namespaced because its `criticalPath` has the same name as the domain's, which answers a different question (the heaviest chain through the work still ahead of a run, not through a bare node set). The whole layer is namespaced rather than only the colliding name, so a name added to a layer later cannot start colliding silently.
 
-- A name is never shadowed. Two flat layers exporting the same name is a compile error in this package, and its unit test also compares the runtime exports of each package against the entry point's.
+- A name is never shadowed. Two layers exporting the same name on one entry point is a compile error, and the unit tests compare each entry point's runtime exports with the layers it carries.
 - Types follow the same rule as values: a model, projection or domain type is a flat import, a DAG type is `dag.Dag` and so on.
-- Errors thrown by the domain functions (`CycleError`, `UnknownNodeError`) are the DAG package's, so a handler imports them from `dag`.
+- Errors thrown by the domain functions (`CycleError`, `UnknownNodeError`) are the DAG layer's, so a handler imports them from `dag`.
+- The headless and styled components share names (`ElementCard`, `DetailPanel` and others), which is why `process-graph/react` and `process-graph/ui` are separate subpaths.
 
 ```ts
 import { criticalPath, dag } from "process-graph";
@@ -79,8 +134,9 @@ dag.criticalPath; // the DAG function: over a node set and a `needs` accessor
 ## Commands
 
 ```sh
-pnpm build          # tsc -b -> dist/ (ESM + .d.ts)
-pnpm test           # unit tests
-pnpm test:smoke     # the built dist/ exercised as a real artefact
-pnpm test:mutation  # Stryker
+pnpm build             # tsdown: the bundle in dist/, declarations included, with each internal package inlined
+pnpm test              # unit tests
+pnpm test:smoke        # packs the package, installs the tarball into a throwaway project, imports every subpath and runs the bin
+pnpm test:integration  # the bundled browser store in Chromium, against the store contract's conformance kit
+pnpm test:mutation     # Stryker
 ```

From 433ac4a23b3ec272be4090123264fe37be278b1e Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 05:12:28 +0100
Subject: [PATCH 16/31] docs: describe one published package, catalogs and
 private-by-default packages

The package table separates process-graph from the internal packages, the
release section says what a private package gets, and adding a package now
means a private package exposed through a subpath of process-graph, with no
npm name to reserve.
---
 CONTRIBUTING.md | 41 +++++++++++++++--------------------------
 README.md       | 28 +++++++++++++++++++---------
 2 files changed, 34 insertions(+), 35 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 92d0c8d..cb281b6 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -2,43 +2,32 @@
 
 ## Adding a package
 
+A new package is private and reaches consumers through a subpath of the published `process-graph` package, which bundles it. It needs no name on npm and no trusted publisher.
+
 1. Pick the layer: `packages/core/<domain>/<name>` for the model, its analysis and ports; `packages/adapters/<domain>/<name>` for an implementation of a port against one external system; `packages/ui/<domain>/<name>` for components; `packages/targets/<name>` (flat) for a deployable entry point.
 2. Copy the closest existing package's shape: `package.json` (`exports` map, script set), `tsconfig.json` plus `tsconfig.build.json` (and `tsconfig.node.json` for an isomorphic package), `eslint.config.ts`, `vitest.config.ts`, `stryker.config.ts`, `test/package.smoke.test.ts`.
-3. Name it `@exadev/process-graph-<name>` and pin every internal dependency exact (`syncpack lint` enforces it). `workspace:` ranges are not used.
-4. Add its `tsconfig.build.json` to the root `tsconfig.build.json` `references`.
-5. If it is the first package in its layer, add that layer's workspace entry to `knip.config.ts` (an entry that matches nothing is a knip hint).
-6. Write its `README.md`, then `ln -s README.md AGENTS.md && ln -s README.md CLAUDE.md`.
-7. Add it to the packages table in the root `README.md`, and to the Dependabot `ignore` list only if its name does not already match `@exadev/process-graph-*`.
-8. Give the manifest what the release orchestrator needs (see [Release strategy](#release-strategy)): `version` `0.0.0`, `repository.directory` set to the package's path, `publishConfig` with `access`, `provenance` and the registry as in its siblings, and each sibling dependency as the sibling's exact version.
-9. Reserve the name on npm and register its trusted publisher before its first releasable commit reaches `main` (see [Bootstrapping a package name](#bootstrapping-a-package-name)).
+3. Name it `@exadev/process-graph-<name>`, mark it `"private": true`, and set `version` to `0.0.0` and `repository.directory` to the package's path. Give it no `publishConfig`.
+4. Add dependencies with pnpm: a sibling as `workspace:*` (`pnpm add @exadev/process-graph-<sibling>@workspace:*`), and a third-party library from the catalog in `pnpm-workspace.yaml` (`pnpm add --save-catalog <library>@<exact version>`, which adds the catalog entry when there is none). `pnpm run deps:lint` rejects anything else.
+5. Add its `tsconfig.build.json` to the root `tsconfig.build.json` `references`.
+6. If it is the first package in its layer, add that layer's workspace entry to `knip.config.ts` (an entry that matches nothing is a knip hint).
+7. Expose it through `process-graph`, in `packages/targets/process-graph`: a module under `src/` that re-exports it, named for the subpath (`src/<subpath>.ts`), an entry for that module in `tsdown.config.ts`, the subpath in the `exports` map, the module in the subpath list in `eslint.config.ts`, a case in `src/entrypoints.unit.test.ts` and an import of the subpath in `test/package.smoke.test.ts`. Add the package to `devDependencies` at its exact version (`pnpm add -D --save-exact @exadev/process-graph-<name>@<version>`), never `workspace:*`, since that manifest is published as written. Each third-party library the new subpath needs that the root entry does not goes in `peerDependencies`, marked optional in `peerDependenciesMeta`, at the catalog's exact version (`pnpm add --save-peer --save-exact <library>@<version>`). Where a layer's names collide with another layer's on the same subpath, namespace one layer rather than shadow a name.
+8. Write its `README.md`, then `ln -s README.md AGENTS.md && ln -s README.md CLAUDE.md`.
+9. Add it to the internal packages table in the root `README.md`, and the subpath to the `process-graph` README.
 10. Verify with the repository scripts: `pnpm lint`, `pnpm typecheck`, `pnpm test`, `pnpm test:smoke`, `pnpm exec knip`, `pnpm run deps:lint`.
 11. Commit as `feat: add <name> package`, describing the package's role and any deliberate decision, not the process that produced it.
 
 ## Release strategy
 
-Every publishable package versions and publishes on its own. `release-workspace.config.ts` configures [`@exadev/semantic-release-workspace`](https://github.com/ExaDev/semantic-release-workspace), which the `release` job in `.github/workflows/ci.yml` runs as `pnpm release` on every push to `main` once the other jobs have passed.
+Only `process-graph` is published. `release-workspace.config.ts` configures [`@exadev/semantic-release-workspace`](https://github.com/ExaDev/semantic-release-workspace), which the `release` job in `.github/workflows/ci.yml` runs as `pnpm release` on every push to `main` once the other jobs have passed.
 
-- The orchestrator discovers the packages from `pnpm-workspace.yaml`, orders them by their dependencies on one another and releases each after every sibling it depends on, so the `process-graph` entry point is released after the building-block packages it re-exports.
+- The orchestrator discovers the packages from `pnpm-workspace.yaml`, orders them by their dependencies on one another, `devDependencies` included, and releases each after every sibling it depends on, so `process-graph` is released after every package it bundles.
 - A package's release is decided from the commits that touched its own directory, using the types and release levels in `commit-types.ts`. A commit that touches no package directory releases nothing, and a commit scope has no effect on which package releases.
-- Each release is a `<name>@<version>` tag, a package-level `CHANGELOG.md` and a GitHub Release. The whole run's version bumps, changelog entries and dependency-range rewrites are committed once and pushed atomically with the tags before anything is published.
-- When a package releases, every dependent's sibling range is rewritten to the new version, the lockfile is regenerated and the dependent releases a patch even if nothing else about it changed, so a published manifest never names a version the repository has moved past. Sibling dependencies are exact versions rather than the `workspace:` protocol for this reason: `npm publish` ships a specifier as written.
-- Publishing uses npm trusted publishing (OIDC): `id-token: write` on the job, no `NPM_TOKEN`, and no `registry-url` on `setup-node`, because that writes a token line that wins over the OIDC exchange.
+- Every package gets a `<name>@<version>` tag, which the orchestrator reads to find its last release. A private package gets nothing else: it runs only `@semantic-release/npm`, which bumps its version and skips publishing because the manifest is private, so it writes no `CHANGELOG.md` and creates no GitHub Release. `process-graph` gets its `CHANGELOG.md`, its GitHub Release and its npm publish.
+- When a package releases, every dependent's range on it is rewritten to the new version where the range names one, the lockfile is regenerated, and the dependent releases a patch even if nothing else about it changed. `process-graph` names each bundled package's exact version in `devDependencies`, so a change confined to a private package's directory still releases `process-graph`, as a patch, carrying the new bundle. A feature in a private package therefore reaches consumers in a `process-graph` patch release unless a commit touching `process-graph` itself says otherwise.
+- The whole run's version bumps, changelog entries and dependency-range rewrites are committed once and pushed atomically with the tags before anything is published.
+- Publishing uses npm trusted publishing (OIDC): `id-token: write` on the job, no `NPM_TOKEN`, and no `registry-url` on `setup-node`, because that writes a token line that wins over the OIDC exchange. `@semantic-release/npm` publishes with `npm publish`, which ships every specifier as written, which is why the `process-graph` manifest uses literal versions where the private ones use `catalog:` and `workspace:*`.
 - The release commit and tags reach the protected `main` through a repository deploy key with write access (the `RELEASE_DEPLOY_KEY` secret), which the `main` ruleset lists as a bypass actor; `GITHUB_TOKEN` cannot bypass a ruleset. The `release` job checks out without persisting a credential, writes the key to the runner's temporary directory only in the step before the release, and removes it afterwards. The orchestrator pushes with plain `git push origin`, so the release step rewrites https GitHub URLs to SSH through git's per-process config and sets `GIT_SSH_COMMAND` to use only that key; `GITHUB_TOKEN` stays in that step's environment for the GitHub API calls that create releases and comment on issues and pull requests.
 
 Release configuration lives only in `release-workspace.config.ts`. The orchestrator sets the tag format, plugins and analysis options on every per-package run, so a `release.config.*` inside a package would be overridden rather than honoured.
 
 To see what a run would do without tagging, committing, pushing or publishing, run `pnpm release --dry-run` from the root on a clean tree and a pushed branch, with `--branches <branch>` naming it and a `GITHUB_TOKEN` in the environment.
-
-### Bootstrapping a package name
-
-npm has no trusted publisher settings page for a name that has never been published, so a new package's name is reserved and its trusted publisher registered by a person before CI publishes it for the first time:
-
-```sh
-npm-reserve <name> --trust ExaDev/process-graph --workflow ci.yml
-```
-
-A first publish from CI under an unregistered name fails the OIDC exchange. The run has already pushed the tag by then, so that version is skipped rather than retried; see the orchestrator's README for recovering from it.
-
-### Adding a package to releases
-
-A package joins releases by being a non-private workspace package: no other registration exists. Its manifest carries the fields named in the steps of [Adding a package](#adding-a-package), its first release is `1.0.0` because it has no earlier tag, and a private package is still versioned and tagged but never published.
diff --git a/README.md b/README.md
index 6272fab..81d8cde 100644
--- a/README.md
+++ b/README.md
@@ -16,12 +16,12 @@ pnpm build
 pnpm test
 ```
 
-Dependencies are added with `pnpm add`, never by editing a version by hand. Every manifest pins exact versions (`syncpack` enforces it), and the install age gate in `pnpm-workspace.yaml` is never lowered; ExaDev's own packages are the only entries in `minimumReleaseAgeExclude`.
+Dependencies are added with `pnpm add`, never by editing a version by hand. Every third-party version is written once, exactly, in the catalog in `pnpm-workspace.yaml`: a private package names it as `catalog:` (`pnpm add --save-catalog <name>@<version>`) and a sibling as `workspace:*`. The published `process-graph` manifest names exact literal versions instead, because `npm publish` ships a protocol specifier verbatim; `pnpm run deps:lint` (`syncpack` and `scripts/check-published-manifests.ts`) holds both rules. The install age gate in `pnpm-workspace.yaml` is never lowered; ExaDev's own packages are the only entries in `minimumReleaseAgeExclude`.
 
 ## Commands
 
 ```sh
-pnpm build              # tsc -b across the workspace, dependency-ordered
+pnpm build              # every package, dependency-ordered; process-graph last, bundled by tsdown
 pnpm lint               pnpm lint:fix               pnpm typecheck
 pnpm test               pnpm test:coverage          pnpm test:smoke
 pnpm test:mutation      pnpm exec knip              pnpm run deps:lint
@@ -39,12 +39,20 @@ packages/
 └── targets/<package>/              # deployable entry points, deliberately flat
 ```
 
-A package may depend on its own layer and the layers below it, never above; `no-uphill-dependency` and `no-dependency-cycle` from `@exadev/eslint-config` enforce it from the manifests, configured in `eslint.shared.ts`. Published names are `@exadev/process-graph-<name>`; the unscoped [`process-graph`](packages/targets/process-graph/README.md) package, in the `targets` layer, is the primary entry point: it re-exports the model, projection, domain and DAG packages so a consumer installs one dependency.
+A package may depend on its own layer and the layers below it, never above; `no-uphill-dependency` and `no-dependency-cycle` from `@exadev/eslint-config` enforce it from the manifests, configured in `eslint.shared.ts`. One package is published: the unscoped [`process-graph`](packages/targets/process-graph/README.md), in the `targets` layer. Every other package is private, named `@exadev/process-graph-<name>`, and reaches consumers only bundled into `process-graph` behind one of its subpath exports, so a consumer installs one dependency and imports each part from its own subpath.
 
 Configuration lives at exactly one of two levels: in the package (`eslint.config.ts`, `tsconfig*.json`, Vitest projects, Stryker) or at the root (commit rules, git hooks, formatting, release).
 
 ## Packages
 
+The published package:
+
+| Package                                                     | What it is                                                                                                                                                                                                                                                |
+| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [`process-graph`](packages/targets/process-graph/README.md) | The one install: the model, projection, domain and DAG APIs at the root entry, layout, the GitHub issues source, the SQLite store for Node and the browser, the React UI and the command line library each behind a subpath, and the `process-graph` bin. |
+
+The internal packages, private and bundled into `process-graph`:
+
 | Package                                                                                | What it is                                                                                                                                                                                                                                        |
 | -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | [`graph-dag`](packages/core/graph/dag/README.md)                                       | Model-independent dependency-graph primitives over a node set and a `needs` accessor: layers, ancestors, descendants, cycles, transitive reduction, critical path.                                                                                |
@@ -62,8 +70,12 @@ Configuration lives at exactly one of two levels: in the package (`eslint.config
 | [`graph-ui`](packages/ui/graph/ui/README.md)                                           | Styled components over `graph-react` and an SVG sequence diagram, in Vanilla Extract with a typed theme contract and light and dark themes, shipped as compiled CSS.                                                                              |
 | [`graph-react-flow`](packages/ui/graph/react-flow/README.md)                           | React Flow views of the model: flowchart, swimlane with lanes as group nodes, and state machine, laid out by `graph-layout`, showing each status and the critical path; sequence projections drawn by `graph-ui`.                                 |
 | [`graph-cli`](packages/targets/graph-cli/README.md)                                    | The command line and its library entry: sync GitHub issues into the SQLite store, ready, blocked, impact, critical path, cycles, hand-offs and status explanations, and every view drawn in Mermaid or Graphviz DOT.                              |
-| [`process-graph`](packages/targets/process-graph/README.md)                            | The primary entry point: re-exports the schema, projection and domain APIs flat and the DAG API as the `dag` namespace, and carries the `process-graph` bin.                                                                                      |
-| [`graph-web`](packages/targets/graph-web/README.md)                                    | The web app: an installable, offline-first PWA that syncs GitHub issues into SQLite on the device and shows the work in every view, with what is ready, what is blocked and why, linkable by address.                                             |
+
+The web app, private and deployed rather than published:
+
+| Package                                             | What it is                                                                                                                                                                                            |
+| --------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [`graph-web`](packages/targets/graph-web/README.md) | The web app: an installable, offline-first PWA that syncs GitHub issues into SQLite on the device and shows the work in every view, with what is ready, what is blocked and why, linkable by address. |
 
 ## Conventions
 
@@ -77,12 +89,10 @@ Configuration lives at exactly one of two levels: in the package (`eslint.config
 
 ## Releases
 
-Each package versions and publishes independently through [`@exadev/semantic-release-workspace`](https://github.com/ExaDev/semantic-release-workspace), configured in `release-workspace.config.ts` and run by the `release` job in CI. A package releases when commits touch its own directory, or when a sibling it depends on releases; packages release in dependency order, so the entry point follows the packages it re-exports. Tags are `<name>@<version>`, and each package keeps its own `CHANGELOG.md`.
+Releases run through [`@exadev/semantic-release-workspace`](https://github.com/ExaDev/semantic-release-workspace), configured in `release-workspace.config.ts` and run by the `release` job in CI. Every package versions independently and is tagged `<name>@<version>`; a package releases when commits touch its own directory, or when a sibling it depends on releases, in dependency order. Only `process-graph` is published, with its own `CHANGELOG.md` and GitHub Release; a private package gets a version and a tag and nothing else. Because `process-graph` lists every package it bundles in `devDependencies`, a change to any of them releases `process-graph` too.
 
 The release commit and tags are pushed to the protected `main` with a repository deploy key (the `RELEASE_DEPLOY_KEY` secret) over SSH, because `GITHUB_TOKEN` cannot bypass a ruleset; the `main` ruleset lists that deploy key as a bypass actor. `GITHUB_TOKEN` is still used for the GitHub API calls that create releases and comment on issues and pull requests.
 
-A new package name must be reserved on npm, and its trusted publisher registered, by a person before its first CI publish; the steps are in CONTRIBUTING.md.
-
 ## Contributing
 
-See [CONTRIBUTING.md](CONTRIBUTING.md) for adding a package, the release strategy and bootstrapping a package name.
+See [CONTRIBUTING.md](CONTRIBUTING.md) for adding a package and the release strategy.

From e49e33918753d6f0c3c2fe39da26931522a12b49 Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 05:12:31 +0100
Subject: [PATCH 17/31] docs: point each internal package's README at the
 process-graph subpath

Each internal package's README drops its npm and release badges and says where
process-graph exposes it.
---
 packages/adapters/graph/source-github-issues/README.md | 4 +++-
 packages/adapters/graph/sqlite-node/README.md          | 4 +++-
 packages/adapters/graph/sqlite-wasm/README.md          | 4 +++-
 packages/adapters/graph/store-sqlite/README.md         | 4 +++-
 packages/core/graph/dag/README.md                      | 4 +++-
 packages/core/graph/domain/README.md                   | 4 +++-
 packages/core/graph/layout/README.md                   | 4 +++-
 packages/core/graph/projection/README.md               | 4 +++-
 packages/core/graph/schema/README.md                   | 4 +++-
 packages/core/graph/source-contract/README.md          | 4 +++-
 packages/core/graph/store-contract/README.md           | 4 +++-
 packages/targets/graph-cli/README.md                   | 8 +++++---
 12 files changed, 38 insertions(+), 14 deletions(-)

diff --git a/packages/adapters/graph/source-github-issues/README.md b/packages/adapters/graph/source-github-issues/README.md
index e00e818..09463f3 100644
--- a/packages/adapters/graph/source-github-issues/README.md
+++ b/packages/adapters/graph/source-github-issues/README.md
@@ -1,6 +1,8 @@
 # @exadev/process-graph-source-github-issues
 
-[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![npm](https://img.shields.io/badge/npm-CB3837?logo=npm&logoColor=white)](https://www.npmjs.com/package/@exadev/process-graph-source-github-issues) [![Release](https://img.shields.io/github/v/release/ExaDev/process-graph)](https://github.com/ExaDev/process-graph/releases/latest) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+
+A private workspace package, not published on its own: it is bundled into [`process-graph`](../../../targets/process-graph/README.md), which exposes it as `process-graph/source/github`, with its Node token port at `process-graph/source/github/node`.
 
 The GitHub issues adapter for the `GraphSource` port in `@exadev/process-graph-source-contract`. It reads issues, what blocks them, what they block and their sub-issues through GitHub's GraphQL API across any number of organisations, repositories and Projects v2 boards, and returns them as pages of the process model. It also lists the scopes a picker offers. It passes the port's conformance kit. The main entry point imports nothing Node-only; `./node` adds a token helper for Node.
 
diff --git a/packages/adapters/graph/sqlite-node/README.md b/packages/adapters/graph/sqlite-node/README.md
index cf408f2..2902aa3 100644
--- a/packages/adapters/graph/sqlite-node/README.md
+++ b/packages/adapters/graph/sqlite-node/README.md
@@ -1,6 +1,8 @@
 # @exadev/process-graph-sqlite-node
 
-[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![npm](https://img.shields.io/badge/npm-CB3837?logo=npm&logoColor=white)](https://www.npmjs.com/package/@exadev/process-graph-sqlite-node) [![Release](https://img.shields.io/github/v/release/ExaDev/process-graph)](https://github.com/ExaDev/process-graph/releases/latest) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+
+A private workspace package, not published on its own: it is bundled into [`process-graph`](../../../targets/process-graph/README.md), which exposes it as `process-graph/store/node`.
 
 The SQLite graph store from `@exadev/process-graph-store-sqlite` on Node's built-in `node:sqlite`, through `drizzle-orm/node-sqlite`. It is the driver for the command line and for servers, and needs no native module.
 
diff --git a/packages/adapters/graph/sqlite-wasm/README.md b/packages/adapters/graph/sqlite-wasm/README.md
index c7f6089..f2e8908 100644
--- a/packages/adapters/graph/sqlite-wasm/README.md
+++ b/packages/adapters/graph/sqlite-wasm/README.md
@@ -1,6 +1,8 @@
 # @exadev/process-graph-sqlite-wasm
 
-[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![npm](https://img.shields.io/badge/npm-CB3837?logo=npm&logoColor=white)](https://www.npmjs.com/package/@exadev/process-graph-sqlite-wasm) [![Release](https://img.shields.io/github/v/release/ExaDev/process-graph)](https://github.com/ExaDev/process-graph/releases/latest) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+
+A private workspace package, not published on its own: it is bundled into [`process-graph`](../../../targets/process-graph/README.md), which exposes it as `process-graph/store/wasm`, with its worker entry at `process-graph/store/wasm/worker`.
 
 The SQLite graph store from `@exadev/process-graph-store-sqlite` in the browser. SQLite compiled to WebAssembly (`@sqlite.org/sqlite-wasm`) runs in a dedicated worker on the origin private file system, Drizzle reaches it through `drizzle-orm/sqlite-proxy`, and the page talks to the store over oRPC's message-port transport. Any number of tabs can use one database, and the page needs no `Cross-Origin-Opener-Policy` or `Cross-Origin-Embedder-Policy` headers.
 
diff --git a/packages/adapters/graph/store-sqlite/README.md b/packages/adapters/graph/store-sqlite/README.md
index 2908394..145530f 100644
--- a/packages/adapters/graph/store-sqlite/README.md
+++ b/packages/adapters/graph/store-sqlite/README.md
@@ -1,6 +1,8 @@
 # @exadev/process-graph-store-sqlite
 
-[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![npm](https://img.shields.io/badge/npm-CB3837?logo=npm&logoColor=white)](https://www.npmjs.com/package/@exadev/process-graph-store-sqlite) [![Release](https://img.shields.io/github/v/release/ExaDev/process-graph)](https://github.com/ExaDev/process-graph/releases/latest) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+
+A private workspace package, not published on its own: it is bundled into [`process-graph`](../../../targets/process-graph/README.md), which exposes it as `process-graph/store`, beside the store contract.
 
 The `GraphStore` port from `@exadev/process-graph-store-contract` on SQLite through [Drizzle](https://orm.drizzle.team) (`drizzle-orm` 1.0.0-rc.4). It is written against Drizzle's async SQLite database type, so any Drizzle SQLite driver plugs in: `@exadev/process-graph-sqlite-node` supplies `node:sqlite`, `@exadev/process-graph-sqlite-wasm` supplies SQLite in a browser worker on OPFS. `src/` imports nothing Node-only.
 
diff --git a/packages/core/graph/dag/README.md b/packages/core/graph/dag/README.md
index 73dc1c3..71eaa5d 100644
--- a/packages/core/graph/dag/README.md
+++ b/packages/core/graph/dag/README.md
@@ -1,6 +1,8 @@
 # @exadev/process-graph-dag
 
-[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![npm](https://img.shields.io/badge/npm-CB3837?logo=npm&logoColor=white)](https://www.npmjs.com/package/@exadev/process-graph-dag) [![Release](https://img.shields.io/github/v/release/ExaDev/process-graph)](https://github.com/ExaDev/process-graph/releases/latest) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+
+A private workspace package, not published on its own: it is bundled into [`process-graph`](../../../targets/process-graph/README.md), which exposes it as the `dag` namespace of the root entry, `process-graph`.
 
 Dependency-graph primitives over any node set and a `needs` accessor: topological layers, ancestors, descendants, cycle detection, transitive reduction and the critical path. No runtime dependencies, no knowledge of any process model, and no recursion, so a deep graph cannot overflow the call stack. `src/` imports nothing Node-only and runs unchanged in a browser or a Worker.
 
diff --git a/packages/core/graph/domain/README.md b/packages/core/graph/domain/README.md
index 3bbe363..93ddf6d 100644
--- a/packages/core/graph/domain/README.md
+++ b/packages/core/graph/domain/README.md
@@ -1,6 +1,8 @@
 # @exadev/process-graph-domain
 
-[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![npm](https://img.shields.io/badge/npm-CB3837?logo=npm&logoColor=white)](https://www.npmjs.com/package/@exadev/process-graph-domain) [![Release](https://img.shields.io/github/v/release/ExaDev/process-graph)](https://github.com/ExaDev/process-graph/releases/latest) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+
+A private workspace package, not published on its own: it is bundled into [`process-graph`](../../../targets/process-graph/README.md), which exposes it as its exports at the root entry, `process-graph`.
 
 Reasoning over the process model from `@exadev/process-graph-schema` and a run overlay: which work is ready, what blocks what, what a decision's branches do, which cycles are legal, and what finishing something changes. Pure functions over `Model<I>` and `Overlay<I>`, built on `@exadev/process-graph-dag`. Run state is an input, never part of the model. `src/` imports nothing Node-only.
 
diff --git a/packages/core/graph/layout/README.md b/packages/core/graph/layout/README.md
index a8fe942..901c3f2 100644
--- a/packages/core/graph/layout/README.md
+++ b/packages/core/graph/layout/README.md
@@ -1,6 +1,8 @@
 # @exadev/process-graph-layout
 
-[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![npm](https://img.shields.io/badge/npm-CB3837?logo=npm&logoColor=white)](https://www.npmjs.com/package/@exadev/process-graph-layout) [![Release](https://img.shields.io/github/v/release/ExaDev/process-graph)](https://github.com/ExaDev/process-graph/releases/latest) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+
+A private workspace package, not published on its own: it is bundled into [`process-graph`](../../../targets/process-graph/README.md), which exposes it as `process-graph/layout`.
 
 Layered layout of a projected view from `@exadev/process-graph-projection`. `layout(view, options)` is a pure async function: it reads a flowchart, swimlane or state machine, never mutates anything, and returns positions in the model's `views` shape, so layout stays apart from the semantic model and no projection reads a coordinate. It runs unchanged in a browser, a Worker or Node: `src/` imports nothing Node-only, and the default engine is elkjs's bundled build, which needs no Worker.
 
diff --git a/packages/core/graph/projection/README.md b/packages/core/graph/projection/README.md
index e59567f..0a7614f 100644
--- a/packages/core/graph/projection/README.md
+++ b/packages/core/graph/projection/README.md
@@ -1,6 +1,8 @@
 # @exadev/process-graph-projection
 
-[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![npm](https://img.shields.io/badge/npm-CB3837?logo=npm&logoColor=white)](https://www.npmjs.com/package/@exadev/process-graph-projection) [![Release](https://img.shields.io/github/v/release/ExaDev/process-graph)](https://github.com/ExaDev/process-graph/releases/latest) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+
+A private workspace package, not published on its own: it is bundled into [`process-graph`](../../../targets/process-graph/README.md), which exposes it as its exports at the root entry, `process-graph`.
 
 Projections of the process model from `@exadev/process-graph-schema` into each notation. Every projection is a pure function of the model plus the extra input its notation needs, and none of them reads or preserves layout. `src/` imports nothing Node-only.
 
diff --git a/packages/core/graph/schema/README.md b/packages/core/graph/schema/README.md
index 6d1d2e5..5b6261a 100644
--- a/packages/core/graph/schema/README.md
+++ b/packages/core/graph/schema/README.md
@@ -1,6 +1,8 @@
 # @exadev/process-graph-schema
 
-[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![npm](https://img.shields.io/badge/npm-CB3837?logo=npm&logoColor=white)](https://www.npmjs.com/package/@exadev/process-graph-schema) [![Release](https://img.shields.io/github/v/release/ExaDev/process-graph)](https://github.com/ExaDev/process-graph/releases/latest) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+
+A private workspace package, not published on its own: it is bundled into [`process-graph`](../../../targets/process-graph/README.md), which exposes it as its exports at the root entry, `process-graph`.
 
 The process model: one layout-free description of a process that a flowchart, a swimlane, a state machine and a sequence diagram are all views of. Participants, events, actions, elements, transitions and fragments are declared once and cross-referenced by identifier. `src/` imports nothing Node-only and runs unchanged in a browser or a Worker.
 
diff --git a/packages/core/graph/source-contract/README.md b/packages/core/graph/source-contract/README.md
index ef21284..964cce1 100644
--- a/packages/core/graph/source-contract/README.md
+++ b/packages/core/graph/source-contract/README.md
@@ -1,6 +1,8 @@
 # @exadev/process-graph-source-contract
 
-[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![npm](https://img.shields.io/badge/npm-CB3837?logo=npm&logoColor=white)](https://www.npmjs.com/package/@exadev/process-graph-source-contract) [![Release](https://img.shields.io/github/v/release/ExaDev/process-graph)](https://github.com/ExaDev/process-graph/releases/latest) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+
+A private workspace package, not published on its own: it is bundled into [`process-graph`](../../../targets/process-graph/README.md), which exposes it as `process-graph/source/github`, beside the GitHub issues adapter.
 
 The `GraphSource` port: how the process model from `@exadev/process-graph-schema` reads work from an external tracker. It is an [oRPC](https://orpc.dev) router contract (`@orpc/contract`), so one definition is called in process, across a `MessagePort` to a worker, or over HTTP, and a consumer never changes with the transport. The package also ships the router builder adapters use, an in-memory fake and the conformance kit every adapter must pass. `src/` imports nothing Node-only.
 
diff --git a/packages/core/graph/store-contract/README.md b/packages/core/graph/store-contract/README.md
index 2ef9656..8c40d11 100644
--- a/packages/core/graph/store-contract/README.md
+++ b/packages/core/graph/store-contract/README.md
@@ -1,6 +1,8 @@
 # @exadev/process-graph-store-contract
 
-[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![npm](https://img.shields.io/badge/npm-CB3837?logo=npm&logoColor=white)](https://www.npmjs.com/package/@exadev/process-graph-store-contract) [![Release](https://img.shields.io/github/v/release/ExaDev/process-graph)](https://github.com/ExaDev/process-graph/releases/latest) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+
+A private workspace package, not published on its own: it is bundled into [`process-graph`](../../../targets/process-graph/README.md), which exposes it as `process-graph/store`, beside the SQLite store.
 
 The persistence port for process models and their run overlays, as an [oRPC](https://orpc.dev) router contract. One definition runs in process (a router client called directly), across a `MessagePort` to a worker, or over HTTP, with no change to its consumers. Inputs and outputs are Zod schemas built from `@exadev/process-graph-schema`'s `modelSchema` and `overlaySchema`, so the port carries the model as it is and storage layout never reaches it. `src/` imports nothing Node-only.
 
diff --git a/packages/targets/graph-cli/README.md b/packages/targets/graph-cli/README.md
index a1fcdbf..4a0b9dd 100644
--- a/packages/targets/graph-cli/README.md
+++ b/packages/targets/graph-cli/README.md
@@ -1,6 +1,8 @@
 # @exadev/process-graph-cli
 
-[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![npm](https://img.shields.io/badge/npm-CB3837?logo=npm&logoColor=white)](https://www.npmjs.com/package/@exadev/process-graph-cli) [![Release](https://img.shields.io/github/v/release/ExaDev/process-graph)](https://github.com/ExaDev/process-graph/releases/latest) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+[![GitHub](https://img.shields.io/badge/GitHub-181717?logo=github&logoColor=white)](https://github.com/ExaDev/process-graph) [![CI](https://img.shields.io/github/actions/workflow/status/ExaDev/process-graph/ci.yml?branch=main)](https://github.com/ExaDev/process-graph/actions)
+
+A private workspace package, not published on its own: it is bundled into [`process-graph`](../process-graph/README.md), which exposes it as `process-graph/cli`, and its command line is the `process-graph` bin.
 
 The process-graph command line, and the same commands as a library. It syncs work from GitHub issues into a SQLite store, answers what is ready, blocked, affected, on the critical path or handed off between owners, explains why an element has its status, builds and edits a model by hand, and draws the model as a flowchart, swimlane, state machine or sequence diagram in Mermaid or Graphviz DOT.
 
@@ -75,10 +77,10 @@ A sync merges everything it reads into the model in one write, so a record synce
 
 `runCli(args, ports, identity)` runs the whole command surface as a function and resolves with the exit status; it never reads `process.argv`, writes to the process's streams or exits. `CliPorts` is everything it touches: `stdout` and `stderr`, `openStore(path)` (any `GraphStoreClient`, over any transport), `defaultDataPath`, `source(prefix)` (any `GraphSourceClient`), `readFile`, the `facts` decision conditions read, and the abort `signal`. `nodePorts(options)` builds them for a Node process, with the environment, home directory, GitHub token port, `fetch`, clock, facts, signal and streams each replaceable; `runProcess(identity)` is what the bins run.
 
-A host program mounts the command line as a subcommand by forwarding its arguments:
+A host program imports the library from `process-graph/cli` and mounts the command line as a subcommand by forwarding its arguments:
 
 ```ts
-import { nodePorts, packageVersion, runCli } from "@exadev/process-graph-cli";
+import { nodePorts, packageVersion, runCli } from "process-graph/cli";
 
 // sb graph <args...>
 process.exitCode = await runCli(args, nodePorts(), {

From 263dcdaaad3d23d2d82744cecf12cc2e6fee60ff Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 05:15:44 +0100
Subject: [PATCH 18/31] docs(process-graph): link the barrel-policy limitation
 behind the subpath override

---
 packages/targets/process-graph/eslint.config.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/targets/process-graph/eslint.config.ts b/packages/targets/process-graph/eslint.config.ts
index f1f99f3..6bade62 100644
--- a/packages/targets/process-graph/eslint.config.ts
+++ b/packages/targets/process-graph/eslint.config.ts
@@ -36,7 +36,7 @@ export default defineConfig(
     ],
   }),
   {
-    // Every subpath of this package is an entry point whose whole content is a re-export, the same as `src/index.ts`. The policy's `single` mode recognises only `src/index.ts` as an entry point, so the subpath modules are declared here instead; each still contains nothing but re-exports, and `entrypoints.unit.test.ts` and the smoke test check each one's surface against the packages it bundles.
+    // Every subpath of this package is an entry point whose whole content is a re-export, the same as `src/index.ts`. The policy's `single` mode recognises only `src/index.ts` as an entry point (https://github.com/ExaDev/eslint-config/issues/135), so the subpath modules are declared here instead; each still contains nothing but re-exports, and `entrypoints.unit.test.ts` and the smoke test check each one's surface against the packages it bundles.
     files: subpathEntries,
     rules: { "exadev/barrel-policy": "off" },
   },

From f5467c4cc793396185576ef3cac712ca0bbe0650 Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 05:20:32 +0100
Subject: [PATCH 19/31] test(process-graph): report why packing or installing
 the consumer failed

---
 packages/targets/process-graph/test/consumer.global-setup.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/packages/targets/process-graph/test/consumer.global-setup.ts b/packages/targets/process-graph/test/consumer.global-setup.ts
index 3e12e99..45cc002 100644
--- a/packages/targets/process-graph/test/consumer.global-setup.ts
+++ b/packages/targets/process-graph/test/consumer.global-setup.ts
@@ -53,7 +53,7 @@ export default function setup(project: TestProject): () => void {
   const consumer = mkdtempSync(join(tmpdir(), "process-graph-consumer-"));
   execFileSync("pnpm", ["pack", "--pack-destination", consumer], {
     cwd: packageDirectory,
-    stdio: "ignore",
+    encoding: "utf8",
   });
   const tarball = readdirSync(consumer).find((name) => name.endsWith(".tgz"));
   if (tarball === undefined) {
@@ -73,7 +73,8 @@ export default function setup(project: TestProject): () => void {
       `./${tarball}`,
       ...peerSpecifiers(),
     ],
-    { cwd: consumer, stdio: "ignore" },
+    // Output is captured rather than shown, and a failure's error carries npm's own report of why.
+    { cwd: consumer, encoding: "utf8" },
   );
   project.provide("consumer", consumer);
 

From 21dd88346c426f1eaa336b8a4d7b712f534f5a55 Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 05:24:33 +0100
Subject: [PATCH 20/31] test(process-graph): install the packed consumer with
 pnpm

npm 11.19.0, which the pinned Node ships, fails with ERESOLVE on drizzle-orm
1.0.0-rc.4's optional effect peer range even when drizzle-orm is installed on
its own; npm 11.19.1 resolves it.
---
 .../process-graph/test/consumer.global-setup.ts  | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/packages/targets/process-graph/test/consumer.global-setup.ts b/packages/targets/process-graph/test/consumer.global-setup.ts
index 45cc002..a6ecbac 100644
--- a/packages/targets/process-graph/test/consumer.global-setup.ts
+++ b/packages/targets/process-graph/test/consumer.global-setup.ts
@@ -45,7 +45,7 @@ const peerSpecifiers = (): string[] => {
 };
 
 /**
- * Packs the built package with `pnpm pack`, as it would be published, and installs the tarball with npm into a new directory outside the repository, beside its peer dependencies, so the smoke tests import it exactly as a consumer would: through its exports map, with no workspace package reachable.
+ * Packs the built package with `pnpm pack`, as it would be published, and installs the tarball with pnpm into a new directory outside the repository, beside its peer dependencies, so the smoke tests import it exactly as a consumer would: through its exports map, with no workspace package reachable.
  * @param project - The smoke project, given the consumer's directory.
  * @returns Removes the consumer's directory.
  */
@@ -63,17 +63,11 @@ export default function setup(project: TestProject): () => void {
     join(consumer, "package.json"),
     JSON.stringify({ name: "consumer", private: true, type: "module" }),
   );
+  // pnpm rather than npm: npm 11.19.0, the npm the pinned Node ships, cannot resolve drizzle-orm 1.0.0-rc.4's optional `effect` peer range at all (ERESOLVE, with or without this package), which npm 11.19.1 fixes.
   execFileSync(
-    "npm",
-    [
-      "install",
-      "--no-audit",
-      "--no-fund",
-      "--ignore-scripts",
-      `./${tarball}`,
-      ...peerSpecifiers(),
-    ],
-    // Output is captured rather than shown, and a failure's error carries npm's own report of why.
+    "pnpm",
+    ["add", "--ignore-scripts", `./${tarball}`, ...peerSpecifiers()],
+    // Output is captured rather than shown, and a failure's error carries pnpm's own report of why.
     { cwd: consumer, encoding: "utf8" },
   );
   project.provide("consumer", consumer);

From ccdcf2b7fc7c3d3cb46eb2738eadd69b83593509 Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 05:35:02 +0100
Subject: [PATCH 21/31] test(projection): run the work-growth cases without a
 clock bound

They count reads at a size and its double, so their duration is the machine's,
not a property of the code. The largest diffFlowchart case sat near the
default per-test timeout under coverage and crossed it whenever CI ran every
package uncached.

Fixes #42
---
 .../projection/src/bounded-work.unit.test.ts  | 43 +++++++++++--------
 1 file changed, 24 insertions(+), 19 deletions(-)

diff --git a/packages/core/graph/projection/src/bounded-work.unit.test.ts b/packages/core/graph/projection/src/bounded-work.unit.test.ts
index cc201a1..2c4a4fe 100644
--- a/packages/core/graph/projection/src/bounded-work.unit.test.ts
+++ b/packages/core/graph/projection/src/bounded-work.unit.test.ts
@@ -782,28 +782,33 @@ const doubled = 2;
 /** Each projected shape's smaller size in the table: large enough that quadratic work doubles per item while linear work stays level, small enough that a shape whose output is itself quadratic stays quick to build with every collection call counted. */
 const tableSize = 100;
 
-describe("work at most doubles when a reported shape doubles", () => {
-  describe.each(shapes)("%s", (_shape, build, own = tableSize) => {
-    const small = build(own);
-    const large = build(doubled * own);
-
-    it.each(entries)("through %s", (_entry, enter) => {
-      expect(workPerItem(large, enter)).toBeLessThan(
-        (growthLimit / doubled) * workPerItem(small, enter),
-      );
+// These cases count reads through a proxy at a size and its double, so how long they take is the machine's, not a property of the code: a clock bound only fails them under load, as with coverage instrumentation on a busy runner. No per-test timeout applies; the CI job's own timeout still ends a hang.
+describe(
+  "work at most doubles when a reported shape doubles",
+  { timeout: 0 },
+  () => {
+    describe.each(shapes)("%s", (_shape, build, own = tableSize) => {
+      const small = build(own);
+      const large = build(doubled * own);
+
+      it.each(entries)("through %s", (_entry, enter) => {
+        expect(workPerItem(large, enter)).toBeLessThan(
+          (growthLimit / doubled) * workPerItem(small, enter),
+        );
+      });
     });
-  });
 
-  it.each(edits)("%s", (_edit, prepare) => {
-    // Edits re-project the model before reading the edit, a fixed cost per item that a rescan per edited item only overtakes at the larger size.
-    const small = prepare(size);
-    const large = prepare(doubled * size);
+    it.each(edits)("%s", (_edit, prepare) => {
+      // Edits re-project the model before reading the edit, a fixed cost per item that a rescan per edited item only overtakes at the larger size.
+      const small = prepare(size);
+      const large = prepare(doubled * size);
 
-    expect(workOf(large.run) / large.input).toBeLessThan(
-      (growthLimit / doubled) * (workOf(small.run) / small.input),
-    );
-  });
-});
+      expect(workOf(large.run) / large.input).toBeLessThan(
+        (growthLimit / doubled) * (workOf(small.run) / small.input),
+      );
+    });
+  },
+);
 
 describe("folding never multiplies edges", () => {
   it.each([1, 2])(

From 269e011fb4c27e7ed40659b79dcc892519e984c9 Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 05:42:48 +0100
Subject: [PATCH 22/31] feat(cli): name an exit status for missing peer
 dependencies

The process-graph bin exits with it when the optional peers the command line
imports are not installed. exit-codes is its own entry so the bin can read the
status without loading the command line.
---
 packages/targets/graph-cli/README.md         | 17 +++++++++--------
 packages/targets/graph-cli/package.json      |  4 ++++
 packages/targets/graph-cli/src/exit-codes.ts |  2 ++
 3 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/packages/targets/graph-cli/README.md b/packages/targets/graph-cli/README.md
index 4a0b9dd..4c0639a 100644
--- a/packages/targets/graph-cli/README.md
+++ b/packages/targets/graph-cli/README.md
@@ -58,14 +58,15 @@ The Mermaid emitters name nodes by their position in the view, since Mermaid doe
 
 ## Exit status
 
-| Status | Meaning                                                                                                                                        |
-| ------ | ---------------------------------------------------------------------------------------------------------------------------------------------- |
-| 0      | Success; for `validate` and `cycles`, nothing wrong was found.                                                                                 |
-| 1      | A failure not listed below, such as a store that cannot be opened.                                                                             |
-| 2      | A usage error: an unknown command or option, a missing argument, a value outside its choices, or a view with nothing to follow.                |
-| 3      | The model, an element or another identifier named on the command line does not exist.                                                          |
-| 4      | The model has problems: `validate` found issues, `cycles` found one, a reasoning command met an illegal cycle, or the store rejected a change. |
-| 5      | A source refused the sync: credentials, a rate limit or a scope it does not accept.                                                            |
+| Status | Meaning                                                                                                                                                                   |
+| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 0      | Success; for `validate` and `cycles`, nothing wrong was found.                                                                                                            |
+| 1      | A failure not listed below, such as a store that cannot be opened.                                                                                                        |
+| 2      | A usage error: an unknown command or option, a missing argument, a value outside its choices, or a view with nothing to follow.                                           |
+| 3      | The model, an element or another identifier named on the command line does not exist.                                                                                     |
+| 4      | The model has problems: `validate` found issues, `cycles` found one, a reasoning command met an illegal cycle, or the store rejected a change.                            |
+| 5      | A source refused the sync: credentials, a rate limit or a scope it does not accept.                                                                                       |
+| 6      | The `process-graph` bin could not start: optional peer dependencies the command line needs are not installed beside it. It names them and the command that installs them. |
 
 ## Sources and tokens
 
diff --git a/packages/targets/graph-cli/package.json b/packages/targets/graph-cli/package.json
index 0b7e3ff..77fa9a7 100644
--- a/packages/targets/graph-cli/package.json
+++ b/packages/targets/graph-cli/package.json
@@ -20,6 +20,10 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./exit-codes": {
+      "types": "./dist/exit-codes.d.ts",
+      "import": "./dist/exit-codes.js"
     }
   },
   "types": "./dist/index.d.ts",
diff --git a/packages/targets/graph-cli/src/exit-codes.ts b/packages/targets/graph-cli/src/exit-codes.ts
index 9728210..c1abbcd 100644
--- a/packages/targets/graph-cli/src/exit-codes.ts
+++ b/packages/targets/graph-cli/src/exit-codes.ts
@@ -7,6 +7,7 @@
  * - `notFound`: the model, an element or another identifier named on the command line does not exist.
  * - `invalidModel`: the model has problems: `validate` found issues, `cycles` found an illegal cycle, a reasoning command met an illegal cycle, or the store rejected a change that would leave the model invalid.
  * - `sourceFailure`: a source refused the sync: bad credentials, a rate limit or a scope it does not accept.
+ * - `missingPeers`: the `process-graph` bin could not start because optional peer dependencies the command line needs are not installed beside it.
  */
 export const exitCodes = {
   success: 0,
@@ -15,6 +16,7 @@ export const exitCodes = {
   notFound: 3,
   invalidModel: 4,
   sourceFailure: 5,
+  missingPeers: 6,
 } as const;
 
 /** One of the exit statuses in `exitCodes`. */

From 17a7efa49f5fb48174ed67c19bbc8505804ff989 Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 05:42:55 +0100
Subject: [PATCH 23/31] feat(process-graph): say which peers the bin needs when
 they are missing

Before loading the command line, the bin checks that the optional peers it
imports resolve. When any do not, it prints one message naming them and the
command that installs them at their declared versions with the package manager
that ran it (npm when none did), and exits with the missing-peers status
without a stack trace. The smoke test installs the packed package without its
peers and checks that message and status.
---
 packages/targets/process-graph/README.md      |  2 +-
 packages/targets/process-graph/src/bin.ts     | 74 +++++++++++++++--
 .../process-graph/src/missing-peers.ts        | 79 ++++++++++++++++++
 .../src/missing-peers.unit.test.ts            | 81 +++++++++++++++++++
 .../test/consumer.global-setup.ts             | 56 ++++++++-----
 .../process-graph/test/package.smoke.test.ts  | 70 ++++++++++++++++
 6 files changed, 337 insertions(+), 25 deletions(-)
 create mode 100644 packages/targets/process-graph/src/missing-peers.ts
 create mode 100644 packages/targets/process-graph/src/missing-peers.unit.test.ts

diff --git a/packages/targets/process-graph/README.md b/packages/targets/process-graph/README.md
index 5e66fb5..85751f8 100644
--- a/packages/targets/process-graph/README.md
+++ b/packages/targets/process-graph/README.md
@@ -113,7 +113,7 @@ process-graph why github:ExaDev/process-graph#12
 process-graph show --view swimlane --format mermaid
 ```
 
-Every command, its options and its exit statuses are in the [command line's README](../graph-cli/README.md). A program that mounts the command line as a subcommand, or wants each command's result as data, imports `process-graph/cli`.
+Run without them, the bin starts nothing: it names the missing peers and the command that installs them with the package manager that ran it, and exits with status 6. Every command, its options and its exit statuses are in the [command line's README](../graph-cli/README.md). A program that mounts the command line as a subcommand, or wants each command's result as data, imports `process-graph/cli`.
 
 ## What is exported, and under which name
 
diff --git a/packages/targets/process-graph/src/bin.ts b/packages/targets/process-graph/src/bin.ts
index d5b9ab2..df6af4a 100644
--- a/packages/targets/process-graph/src/bin.ts
+++ b/packages/targets/process-graph/src/bin.ts
@@ -1,7 +1,71 @@
 #!/usr/bin/env node
-import { packageVersion, runProcess } from "@exadev/process-graph-cli";
+import { readFileSync } from "node:fs";
+import { exitCodes } from "@exadev/process-graph-cli/exit-codes";
+import {
+  commandLinePeers,
+  missingPeers,
+  missingPeersMessage,
+} from "./missing-peers.ts";
 
-process.exitCode = await runProcess({
-  name: "process-graph",
-  version: packageVersion(new URL("../package.json", import.meta.url)),
-});
+/** This package's manifest, beside `dist/`. */
+const manifest = new URL("../package.json", import.meta.url);
+
+/** The peer dependency versions the manifest declares, by name. */
+const declaredPeers = (): Map<string, string> => {
+  const parsed: unknown = JSON.parse(readFileSync(manifest, "utf8"));
+  if (
+    typeof parsed !== "object" ||
+    parsed === null ||
+    !("peerDependencies" in parsed) ||
+    typeof parsed.peerDependencies !== "object" ||
+    parsed.peerDependencies === null
+  ) {
+    throw new Error(`${manifest.pathname} declares no peerDependencies`);
+  }
+
+  return new Map(
+    Object.entries(parsed.peerDependencies).flatMap(
+      ([name, version]: [string, unknown]) =>
+        typeof version === "string" ? [[name, version] as const] : [],
+    ),
+  );
+};
+
+/** Whether a package resolves from this bin's own location, as the command line's imports would. Only a package that is not installed counts as missing; any other resolution error is the import's to report. */
+const resolves = (name: string): boolean => {
+  try {
+    import.meta.resolve(name);
+
+    return true;
+  } catch (error: unknown) {
+    if (
+      error instanceof Error &&
+      "code" in error &&
+      error.code === "ERR_MODULE_NOT_FOUND"
+    ) {
+      return false;
+    }
+    throw error;
+  }
+};
+
+const missing = missingPeers(commandLinePeers, resolves);
+
+if (missing.length > 0) {
+  process.stderr.write(
+    missingPeersMessage(
+      missing,
+      declaredPeers(),
+      process.env.npm_config_user_agent,
+    ),
+  );
+  process.exitCode = exitCodes.missingPeers;
+} else {
+  // Imported only once its peers are known to resolve, so a missing one is reported above rather than as an import failure.
+  const { packageVersion, runProcess } =
+    await import("@exadev/process-graph-cli");
+  process.exitCode = await runProcess({
+    name: "process-graph",
+    version: packageVersion(manifest),
+  });
+}
diff --git a/packages/targets/process-graph/src/missing-peers.ts b/packages/targets/process-graph/src/missing-peers.ts
new file mode 100644
index 0000000..5d05dc2
--- /dev/null
+++ b/packages/targets/process-graph/src/missing-peers.ts
@@ -0,0 +1,79 @@
+/**
+ * The optional peer dependencies the command line imports. `process-graph` declares them optional so that installing it for its root entry stays light, which means the bin can start without them; it checks for these first and says what to install rather than failing on the first missing import. The smoke test runs the packed bin where none is installed and expects exactly these to be named, so a peer the command line starts needing that is missing here fails that test.
+ */
+export const commandLinePeers = [
+  "@orpc/client",
+  "@orpc/contract",
+  "@orpc/server",
+  "commander",
+  "drizzle-orm",
+] as const;
+
+/**
+ * The peers that do not resolve.
+ * @param peers - The package names to look for.
+ * @param resolves - Whether a package name resolves from the bin's own location.
+ * @returns The names that do not, in the order given.
+ */
+export const missingPeers = (
+  peers: readonly string[],
+  resolves: (name: string) => boolean,
+): string[] => peers.filter((name) => !resolves(name));
+
+/** The command each package manager installs a package with, keyed by the name its `npm_config_user_agent` starts with. */
+const installCommands: ReadonlyMap<string, string> = new Map([
+  ["npm", "npm install"],
+  ["pnpm", "pnpm add"],
+  ["yarn", "yarn add"],
+  ["bun", "bun add"],
+]);
+
+/** npm's command, for a bin run directly or by a package manager not listed. */
+const defaultInstallCommand = "npm install";
+
+/**
+ * The command that installs packages with the package manager that ran the bin.
+ * @param userAgent - `npm_config_user_agent`, which every package manager sets for the processes it runs (`pnpm/12.4.1 npm/? node/v26.8.1 darwin arm64`), or `undefined` when the bin was run directly.
+ * @param packages - The `name@version` specifiers to install.
+ * @returns The command, with npm's when the package manager is not recognised.
+ */
+export const installCommand = (
+  userAgent: string | undefined,
+  packages: readonly string[],
+): string => {
+  const manager = userAgent?.split("/", 1)[0];
+  const command =
+    (manager === undefined ? undefined : installCommands.get(manager)) ??
+    defaultInstallCommand;
+
+  return [command, ...packages].join(" ");
+};
+
+/**
+ * The one message the bin prints when peers are missing.
+ * @param missing - The missing package names.
+ * @param versions - The version `process-graph` declares for each peer, by name.
+ * @param userAgent - `npm_config_user_agent`, to pick the install command.
+ * @returns The message, ending in a newline.
+ * @throws Error when a missing package is not one of the declared peers, which is a packaging mistake rather than the user's.
+ */
+export const missingPeersMessage = (
+  missing: readonly string[],
+  versions: ReadonlyMap<string, string>,
+  userAgent: string | undefined,
+): string => {
+  const specifiers = missing.map((name) => {
+    const version = versions.get(name);
+    if (version === undefined) {
+      throw new Error(`process-graph declares no peer dependency on ${name}`);
+    }
+
+    return `${name}@${version}`;
+  });
+
+  return [
+    `process-graph: the command line needs these optional peer dependencies, which are not installed: ${missing.join(", ")}.`,
+    `Install them beside process-graph: ${installCommand(userAgent, specifiers)}`,
+    "",
+  ].join("\n");
+};
diff --git a/packages/targets/process-graph/src/missing-peers.unit.test.ts b/packages/targets/process-graph/src/missing-peers.unit.test.ts
new file mode 100644
index 0000000..919d98b
--- /dev/null
+++ b/packages/targets/process-graph/src/missing-peers.unit.test.ts
@@ -0,0 +1,81 @@
+import { readFileSync } from "node:fs";
+import { describe, expect, test } from "vitest";
+import {
+  commandLinePeers,
+  installCommand,
+  missingPeers,
+  missingPeersMessage,
+} from "./missing-peers.ts";
+
+describe("missingPeers", () => {
+  test("keeps the names that do not resolve, in the order given", () => {
+    const installed = new Set(["commander"]);
+
+    expect(
+      missingPeers(["drizzle-orm", "commander", "@orpc/server"], (name) =>
+        installed.has(name),
+      ),
+    ).toEqual(["drizzle-orm", "@orpc/server"]);
+  });
+});
+
+describe("installCommand", () => {
+  test.each([
+    ["pnpm/12.4.1 npm/? node/v26.8.1 darwin arm64", "pnpm add a@1"],
+    ["yarn/4.9.0 npm/? node/v26.8.1 linux x64", "yarn add a@1"],
+    ["bun/1.3.0 npm/? node/v26.8.1 linux x64", "bun add a@1"],
+    [
+      "npm/11.19.1 node/v26.8.1 darwin arm64 workspaces/false",
+      "npm install a@1",
+    ],
+    ["deno/2.5.0 npm/? deno/2.5.0 linux x64", "npm install a@1"],
+    [undefined, "npm install a@1"],
+  ])("from the user agent %s it is %s", (userAgent, expected) => {
+    expect(installCommand(userAgent, ["a@1"])).toBe(expected);
+  });
+});
+
+describe("missingPeersMessage", () => {
+  const versions = new Map([
+    ["commander", "15.0.0"],
+    ["drizzle-orm", "1.0.0-rc.4"],
+  ]);
+
+  test("names the missing packages and the command that installs them at their declared versions", () => {
+    expect(
+      missingPeersMessage(
+        ["commander", "drizzle-orm"],
+        versions,
+        "pnpm/12.4.1 npm/? node/v26.8.1 darwin arm64",
+      ),
+    ).toBe(
+      [
+        "process-graph: the command line needs these optional peer dependencies, which are not installed: commander, drizzle-orm.",
+        "Install them beside process-graph: pnpm add commander@15.0.0 drizzle-orm@1.0.0-rc.4",
+        "",
+      ].join("\n"),
+    );
+  });
+
+  test("refuses a package that is not a declared peer", () => {
+    expect(() => missingPeersMessage(["elkjs"], versions, undefined)).toThrow(
+      "process-graph declares no peer dependency on elkjs",
+    );
+  });
+});
+
+test("every peer the command line checks for is an optional peer dependency of the package", () => {
+  const manifest: unknown = JSON.parse(
+    readFileSync(new URL("../package.json", import.meta.url), "utf8"),
+  );
+  const optional =
+    typeof manifest === "object" &&
+    manifest !== null &&
+    "peerDependenciesMeta" in manifest &&
+    typeof manifest.peerDependenciesMeta === "object" &&
+    manifest.peerDependenciesMeta !== null
+      ? Object.keys(manifest.peerDependenciesMeta)
+      : [];
+
+  expect(optional).toEqual(expect.arrayContaining([...commandLinePeers]));
+});
diff --git a/packages/targets/process-graph/test/consumer.global-setup.ts b/packages/targets/process-graph/test/consumer.global-setup.ts
index a6ecbac..eb86412 100644
--- a/packages/targets/process-graph/test/consumer.global-setup.ts
+++ b/packages/targets/process-graph/test/consumer.global-setup.ts
@@ -13,8 +13,10 @@ import type { TestProject } from "vitest/node";
 
 declare module "vitest" {
   export interface ProvidedContext {
-    /** The throwaway project the packed package is installed into. */
+    /** The throwaway project the packed package is installed into, beside every peer dependency. */
     readonly consumer: string;
+    /** A throwaway project the packed package is installed into alone, without its optional peers. */
+    readonly bareConsumer: string;
   }
 }
 
@@ -45,34 +47,50 @@ const peerSpecifiers = (): string[] => {
 };
 
 /**
- * Packs the built package with `pnpm pack`, as it would be published, and installs the tarball with pnpm into a new directory outside the repository, beside its peer dependencies, so the smoke tests import it exactly as a consumer would: through its exports map, with no workspace package reachable.
- * @param project - The smoke project, given the consumer's directory.
- * @returns Removes the consumer's directory.
+ * Makes a throwaway project outside the repository and installs a tarball into it with pnpm.
+ * @param tarball - The packed package.
+ * @param specifiers - Further packages to install beside it.
+ * @returns The project's directory.
  */
-export default function setup(project: TestProject): () => void {
+const consumerOf = (tarball: string, specifiers: readonly string[]): string => {
   const consumer = mkdtempSync(join(tmpdir(), "process-graph-consumer-"));
-  execFileSync("pnpm", ["pack", "--pack-destination", consumer], {
-    cwd: packageDirectory,
-    encoding: "utf8",
-  });
-  const tarball = readdirSync(consumer).find((name) => name.endsWith(".tgz"));
-  if (tarball === undefined) {
-    throw new Error(`pnpm pack wrote no tarball to ${consumer}`);
-  }
   writeFileSync(
     join(consumer, "package.json"),
     JSON.stringify({ name: "consumer", private: true, type: "module" }),
   );
   // pnpm rather than npm: npm 11.19.0, the npm the pinned Node ships, cannot resolve drizzle-orm 1.0.0-rc.4's optional `effect` peer range at all (ERESOLVE, with or without this package), which npm 11.19.1 fixes.
-  execFileSync(
-    "pnpm",
-    ["add", "--ignore-scripts", `./${tarball}`, ...peerSpecifiers()],
+  execFileSync("pnpm", ["add", "--ignore-scripts", tarball, ...specifiers], {
+    cwd: consumer,
     // Output is captured rather than shown, and a failure's error carries pnpm's own report of why.
-    { cwd: consumer, encoding: "utf8" },
-  );
+    encoding: "utf8",
+  });
+
+  return consumer;
+};
+
+/**
+ * Packs the built package with `pnpm pack`, as it would be published, and installs the tarball with pnpm into two new projects outside the repository, one beside every peer dependency and one alone, so the smoke tests use it exactly as a consumer would: through its exports map, with no workspace package reachable.
+ * @param project - The smoke project, given both consumers' directories.
+ * @returns Removes the tarball and both consumers.
+ */
+export default function setup(project: TestProject): () => void {
+  const packed = mkdtempSync(join(tmpdir(), "process-graph-packed-"));
+  execFileSync("pnpm", ["pack", "--pack-destination", packed], {
+    cwd: packageDirectory,
+    encoding: "utf8",
+  });
+  const tarball = readdirSync(packed).find((name) => name.endsWith(".tgz"));
+  if (tarball === undefined) {
+    throw new Error(`pnpm pack wrote no tarball to ${packed}`);
+  }
+  const consumer = consumerOf(join(packed, tarball), peerSpecifiers());
+  const bareConsumer = consumerOf(join(packed, tarball), []);
   project.provide("consumer", consumer);
+  project.provide("bareConsumer", bareConsumer);
 
   return () => {
-    rmSync(consumer, { recursive: true, force: true });
+    for (const directory of [packed, consumer, bareConsumer]) {
+      rmSync(directory, { recursive: true, force: true });
+    }
   };
 }
diff --git a/packages/targets/process-graph/test/package.smoke.test.ts b/packages/targets/process-graph/test/package.smoke.test.ts
index 2bfa8f1..0783a58 100644
--- a/packages/targets/process-graph/test/package.smoke.test.ts
+++ b/packages/targets/process-graph/test/package.smoke.test.ts
@@ -1,6 +1,7 @@
 import { spawnSync } from "node:child_process";
 import { readFileSync, readdirSync } from "node:fs";
 import { join } from "node:path";
+import { exitCodes } from "@exadev/process-graph-cli/exit-codes";
 import { describe, expect, inject, test } from "vitest";
 
 // Every test here runs against the packed tarball installed into a throwaway project by `consumer.global-setup.ts`, never against src/ or the workspace: this is the check that catches a wrong exports map, a declaration or import that still names a private workspace package, or a manifest that ships a specifier no consumer can install.
@@ -256,3 +257,72 @@ describe("the installed bin", () => {
     ).toMatchObject({ status: 0, stdout: `${String(version)}\n` });
   });
 });
+
+describe("the installed bin without its optional peers", () => {
+  const bareConsumer = inject("bareConsumer");
+  const bin = join(bareConsumer, "node_modules", ".bin", "process-graph");
+  const installedManifest: unknown = JSON.parse(
+    readFileSync(
+      join(bareConsumer, "node_modules", "process-graph", "package.json"),
+      "utf8",
+    ),
+  );
+  if (
+    typeof installedManifest !== "object" ||
+    installedManifest === null ||
+    !("peerDependencies" in installedManifest) ||
+    typeof installedManifest.peerDependencies !== "object" ||
+    installedManifest.peerDependencies === null
+  ) {
+    throw new Error("the installed manifest declares no peerDependencies");
+  }
+  const peers = new Map(Object.entries(installedManifest.peerDependencies));
+  const commandLinePeers = [
+    "@orpc/client",
+    "@orpc/contract",
+    "@orpc/server",
+    "commander",
+    "drizzle-orm",
+  ];
+  const specifiers = commandLinePeers
+    .map((name) => `${name}@${String(peers.get(name))}`)
+    .join(" ");
+  const named = `process-graph: the command line needs these optional peer dependencies, which are not installed: ${commandLinePeers.join(", ")}.`;
+
+  test.each([
+    {
+      manager: "no package manager",
+      userAgent: undefined,
+      command: "npm install",
+    },
+    {
+      manager: "pnpm",
+      userAgent: "pnpm/12.4.1 npm/? node/v26.8.1 linux x64",
+      command: "pnpm add",
+    },
+  ])(
+    "run by $manager, names every missing peer and the $command that installs them, and exits with the missing-peers status and no stack trace",
+    ({ userAgent, command }) => {
+      // The inherited user agent is dropped, since the test runner itself runs under pnpm.
+      const environment = Object.fromEntries(
+        Object.entries(process.env).filter(
+          ([name]) => name !== "npm_config_user_agent",
+        ),
+      );
+      const result = spawnSync(bin, ["--help"], {
+        cwd: bareConsumer,
+        encoding: "utf8",
+        env:
+          userAgent === undefined
+            ? environment
+            : { ...environment, npm_config_user_agent: userAgent },
+      });
+
+      expect(result).toMatchObject({
+        status: exitCodes.missingPeers,
+        stdout: "",
+        stderr: `${named}\nInstall them beside process-graph: ${command} ${specifiers}\n`,
+      });
+    },
+  );
+});

From 698f86c5017302ce8becaa4fc3fc238f84b7c9c2 Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 06:06:57 +0100
Subject: [PATCH 24/31] docs: list the web app apart from the packages
 process-graph bundles

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 81d8cde..e89b627 100644
--- a/README.md
+++ b/README.md
@@ -71,7 +71,7 @@ The internal packages, private and bundled into `process-graph`:
 | [`graph-react-flow`](packages/ui/graph/react-flow/README.md)                           | React Flow views of the model: flowchart, swimlane with lanes as group nodes, and state machine, laid out by `graph-layout`, showing each status and the critical path; sequence projections drawn by `graph-ui`.                                 |
 | [`graph-cli`](packages/targets/graph-cli/README.md)                                    | The command line and its library entry: sync GitHub issues into the SQLite store, ready, blocked, impact, critical path, cycles, hand-offs and status explanations, and every view drawn in Mermaid or Graphviz DOT.                              |
 
-The web app, private and deployed rather than published:
+The web app, private and not bundled into `process-graph`:
 
 | Package                                             | What it is                                                                                                                                                                                            |
 | --------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

From 1afd16a4545d79ba83296bfcf3d68d34dd6db845 Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 06:15:55 +0100
Subject: [PATCH 25/31] build(deps): point process-graph's browser test tooling
 at the vite snapshot that exists

The lockfile resolved @vitest/browser-playwright for process-graph against a
vite peer variant with no snapshot entry, so a clean install on Linux left the
package unlinked.
---
 pnpm-lock.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 5120884..0d51596 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1249,7 +1249,7 @@ importers:
         version: 0.5.7(@vanilla-extract/css@1.21.2)
       '@vitest/browser-playwright':
         specifier: 5.0.3
-        version: 5.0.3(playwright@1.63.0)(vite@8.3.2(@types/node@26.6.4)(jiti@2.7.0)(yaml@2.9.1))(vitest@5.0.3)
+        version: 5.0.3(playwright@1.63.0)(vite@8.3.2(@types/node@26.6.4)(esbuild@0.28.2)(jiti@2.7.0)(terser@5.51.2)(yaml@2.9.1))(vitest@5.0.3)
       '@vitest/coverage-v8':
         specifier: 5.0.3
         version: 5.0.3(@vitest/browser@5.0.3)(vitest@5.0.3)

From 8d240651ce4930214836b4f3f12f28b436bcf0ef Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 06:33:20 +0100
Subject: [PATCH 26/31] fix(cli): escape terminal control characters in
 everything the command line writes

Synced titles, labels and identifiers reached the terminal verbatim, so an ESC
sequence in an issue title could clear the screen or set the clipboard (OSC
52), and a bidirectional override could reorder what is shown. Every write now
crosses one boundary that writes C0 controls other than line feed and tab, DEL,
C1 controls and the Unicode bidirectional and invisible format controls as
visible escapes of their code points (\u{1b}). The Mermaid and DOT emitters
escape inside their own label escaping, so diagrams stay well-formed, and
--json writes the same characters as JSON escapes, leaving parsed values
unchanged.
---
 packages/targets/graph-cli/README.md          |   2 +
 packages/targets/graph-cli/src/emit/text.ts   |  24 ++-
 packages/targets/graph-cli/src/program.ts     |  18 +-
 .../targets/graph-cli/src/terminal-text.ts    |  59 ++++++
 .../graph-cli/src/terminal-text.unit.test.ts  | 179 ++++++++++++++++++
 5 files changed, 265 insertions(+), 17 deletions(-)
 create mode 100644 packages/targets/graph-cli/src/terminal-text.ts
 create mode 100644 packages/targets/graph-cli/src/terminal-text.unit.test.ts

diff --git a/packages/targets/graph-cli/README.md b/packages/targets/graph-cli/README.md
index 4c0639a..a229db1 100644
--- a/packages/targets/graph-cli/README.md
+++ b/packages/targets/graph-cli/README.md
@@ -54,6 +54,8 @@ Without `--data` or `PROCESS_GRAPH_DATA`, the store is `process-graph/graph.sqli
 
 Text output is stable and made for scripts: a list is one item per line with tab-separated fields (an element is its identifier and label), and an empty list prints nothing. `--json` writes the same result as one JSON document; for `show` it is the projection when the format is `json`, and otherwise the view, the format and the diagram text. Errors go to standard error as one message, with no stack trace.
 
+Text from a source can carry characters that act on a terminal: escape sequences that clear the screen or set the clipboard, other control characters, and the Unicode controls that reorder or hide text. Everything the command line writes, results, diagrams, help and errors alike, writes each of them as a visible escape of its code point, `\u{1b}` for ESC or `\u{202e}` for a right-to-left override, and keeps line breaks, tabs and every other character, accented, CJK and emoji included, as they are. In Mermaid and DOT the escape sits inside the label's own escaping, so the diagram stays valid. `--json` writes the same characters as JSON `\u` escapes, so the parsed values are exactly the source's.
+
 The Mermaid emitters name nodes by their position in the view, since Mermaid does not accept identifiers such as `github:org/repo#12`, and write every character Mermaid reads as syntax in a label as its entity code. The DOT emitters keep the model identifiers as node names. Hand-offs are drawn as thick (Mermaid) or bold (DOT) edges, and an empty swimlane lane is still drawn. DOT has no sequence notation, so a sequence diagram in DOT is a grid of lifelines with one row per message, each message numbered and prefixed with the fragments around it.
 
 ## Exit status
diff --git a/packages/targets/graph-cli/src/emit/text.ts b/packages/targets/graph-cli/src/emit/text.ts
index 4482750..9df2a91 100644
--- a/packages/targets/graph-cli/src/emit/text.ts
+++ b/packages/targets/graph-cli/src/emit/text.ts
@@ -1,5 +1,7 @@
+import { terminalText } from "../terminal-text.ts";
+
 /**
- * The Mermaid entity code for a character that would end or change the meaning of a label: quotes, statement and edge-label delimiters, the entity marker itself and HTML. A line break becomes a space, since every label is one line.
+ * The Mermaid entity code for a character that would end or change the meaning of a label: quotes, statement and edge-label delimiters, the entity marker itself and HTML.
  */
 const mermaidEntity = (character: string): string => {
   switch (character) {
@@ -19,29 +21,31 @@ const mermaidEntity = (character: string): string => {
       return "#124;";
     case ":":
       return "#58;";
-    case "\r":
-    case "\n":
-      return " ";
     default:
       return character;
   }
 };
 
 /**
- * Text made safe to place inside any Mermaid label: every character that Mermaid reads as syntax is written as its entity code, so a label from a source (an issue title, a repository name) can never break the diagram.
+ * Text made safe to place inside any Mermaid label: a line break becomes a space, every control and invisible format character is written as its visible `\u{<hex>}` escape (see `terminalText`), and every character that Mermaid reads as syntax is written as its entity code, so a label from a source (an issue title, a repository name) can never break the diagram or act on the terminal it is printed to.
  * @param text - The label as written.
  * @returns The label as Mermaid source.
  */
 export const mermaidText = (text: string): string =>
-  text.replaceAll(/[#"<>&;|:\r\n]/gu, mermaidEntity);
+  terminalText(text.replaceAll(/[\r\n]/gu, " ")).replaceAll(
+    /[#"<>&;|:]/gu,
+    mermaidEntity,
+  );
 
 /**
- * A Graphviz DOT double-quoted string: backslashes and quotes escaped, line breaks written as DOT's own centred line break. Any identifier or label is valid DOT once quoted this way.
+ * A Graphviz DOT double-quoted string: line breaks written as DOT's own centred line break, every control and invisible format character as its visible `\u{<hex>}` escape (see `terminalText`), then backslashes, the escapes' included, and quotes escaped. Any identifier or label is valid DOT once quoted this way, and reads back as the escaped text.
  * @param text - The text as written.
  * @returns The quoted DOT string, quotes included.
  */
 export const dotString = (text: string): string =>
   `"${text
-    .replaceAll("\\", "\\\\")
-    .replaceAll('"', '\\"')
-    .replaceAll(/\r?\n/gu, "\\n")}"`;
+    .split(/\r?\n/u)
+    .map((line) =>
+      terminalText(line).replaceAll("\\", "\\\\").replaceAll('"', '\\"'),
+    )
+    .join("\\n")}"`;
diff --git a/packages/targets/graph-cli/src/program.ts b/packages/targets/graph-cli/src/program.ts
index 8455289..7b89d99 100644
--- a/packages/targets/graph-cli/src/program.ts
+++ b/packages/targets/graph-cli/src/program.ts
@@ -40,6 +40,7 @@ import {
   type ViewName,
 } from "./show.ts";
 import { sync } from "./sync.ts";
+import { terminalJson, terminalText } from "./terminal-text.ts";
 import { validateDocument, validateStored } from "./validate.ts";
 
 /** How the program presents itself. */
@@ -120,6 +121,13 @@ export const runCli = async (
   identity: ProgramIdentity,
 ): Promise<ExitCode> => {
   let exitCode: ExitCode = exitCodes.success;
+  // The one boundary every byte the command line writes crosses: results, diagrams, help, usage errors and failures all carry text from sources (titles, labels, actor names), which must never act on the terminal they are written to.
+  const writeOut = (text: string): void => {
+    ports.stdout(terminalText(text));
+  };
+  const writeErr = (text: string): void => {
+    ports.stderr(terminalText(text));
+  };
 
   const program = new Command(identity.name);
   program
@@ -127,7 +135,7 @@ export const runCli = async (
       "Sync work from its sources into a process model, and ask what is ready, blocked, on the critical path or handed off, why, and what it looks like as a diagram.",
     )
     .version(identity.version)
-    .configureOutput({ writeOut: ports.stdout, writeErr: ports.stderr })
+    .configureOutput({ writeOut, writeErr })
     .configureHelp({ showGlobalOptions: true })
     .exitOverride()
     .option(
@@ -142,11 +150,7 @@ export const runCli = async (
 
   /** Writes a command's result, as JSON or text, and records its exit status. */
   const respond = (globals: GlobalOptions, outcome: Outcome): void => {
-    ports.stdout(
-      globals.json
-        ? `${JSON.stringify(outcome.json, null, 2)}\n`
-        : outcome.text,
-    );
+    writeOut(globals.json ? terminalJson(outcome.json) : outcome.text);
     exitCode = outcome.exitCode ?? exitCodes.success;
   };
 
@@ -623,7 +627,7 @@ export const runCli = async (
   } catch (error) {
     const failure = failureOf(error);
     if (failure.message !== "") {
-      ports.stderr(`${failure.message}\n`);
+      writeErr(`${failure.message}\n`);
     }
 
     return failure.exitCode;
diff --git a/packages/targets/graph-cli/src/terminal-text.ts b/packages/targets/graph-cli/src/terminal-text.ts
new file mode 100644
index 0000000..e35ae78
--- /dev/null
+++ b/packages/targets/graph-cli/src/terminal-text.ts
@@ -0,0 +1,59 @@
+/**
+ * The characters, as inclusive ranges, that must never reach a terminal as they are: the C0 controls except line feed and tab (ESC starts the sequences that clear the screen, move the cursor or, through OSC 52, set the clipboard), DEL, the C1 controls (which some terminals read as the same sequences), and the Unicode bidirectional and invisible format controls, which reorder or hide text so that what is shown differs from what is there. Text from a source (an issue title, a label, an actor's name) can carry any of them.
+ */
+const unsafeRanges: readonly (readonly [string, string])[] = [
+  ["\u0000", "\u0008"],
+  ["\u000B", "\u001F"],
+  ["\u007F", "\u009F"],
+  ["\u200B", "\u200F"],
+  ["\u202A", "\u202E"],
+  ["\u2060", "\u2064"],
+  ["\u2066", "\u2069"],
+  ["\uFEFF", "\uFEFF"],
+];
+
+/**
+ * Whether a character is one of the unsafe ones (see `unsafeRanges`). Every range lies in the Basic Multilingual Plane, where comparing one-character strings compares their code points, and a character outside it is never unsafe.
+ * @param character - One character.
+ * @returns Whether it must be escaped.
+ */
+export const isUnsafeCharacter = (character: string): boolean =>
+  unsafeRanges.some(([from, to]) => character >= from && character <= to);
+
+/** Code points are written in hexadecimal. */
+const hexadecimal = 16;
+
+/** A JSON `\u` escape always has four hexadecimal digits. */
+const jsonEscapeDigits = 4;
+
+/**
+ * The text with each unsafe character replaced by an escape of its code point.
+ * @param text - The text as written.
+ * @param escape - The escape for a code point given in lower-case hexadecimal.
+ * @returns The escaped text.
+ */
+const escapeUnsafe = (text: string, escape: (hex: string) => string): string =>
+  Array.from(text, (character) =>
+    isUnsafeCharacter(character)
+      ? escape(character.charCodeAt(0).toString(hexadecimal))
+      : character,
+  ).join("");
+
+/**
+ * Text made safe to write to a terminal. Each unsafe character (see `unsafeRanges`) is written as the visible escape `\u{<hex>}`, such as `\u{1b}` for ESC or `\u{202e}` for a right-to-left override, so nothing is lost and nothing acts on the terminal. Line feed and tab pass through, as does every other character, accented letters, CJK and emoji included. A literal `\u{...}` already in the text is left as it is, so the escaped form is for reading, not for reversing.
+ * @param text - The text as written.
+ * @returns The text with every unsafe character escaped.
+ */
+export const terminalText = (text: string): string =>
+  escapeUnsafe(text, (hex) => `\\u{${hex}}`);
+
+/**
+ * A value as JSON that is also safe to write to a terminal. `JSON.stringify` escapes the C0 controls but writes DEL, the C1 controls and the format controls as they are; this writes those as `\u` escapes too, which leaves the JSON, and every value parsed from it, exactly the same.
+ * @param value - The value to write.
+ * @returns The JSON text, indented by two spaces and ending in a line break.
+ */
+export const terminalJson = (value: unknown): string =>
+  `${escapeUnsafe(
+    JSON.stringify(value, null, 2),
+    (hex) => `\\u${hex.padStart(jsonEscapeDigits, "0")}`,
+  )}\n`;
diff --git a/packages/targets/graph-cli/src/terminal-text.unit.test.ts b/packages/targets/graph-cli/src/terminal-text.unit.test.ts
new file mode 100644
index 0000000..781fdcd
--- /dev/null
+++ b/packages/targets/graph-cli/src/terminal-text.unit.test.ts
@@ -0,0 +1,179 @@
+import { afterEach, beforeEach, describe, expect, test } from "vitest";
+import { exitCodes } from "./exit-codes.ts";
+import {
+  isUnsafeCharacter,
+  terminalJson,
+  terminalText,
+} from "./terminal-text.ts";
+import {
+  createHarness,
+  runInOrder,
+  type Harness,
+} from "./test-support/harness.ts";
+
+/** A title as a hostile source could write it: clear the screen (CSI 2J), set the clipboard (OSC 52, ended by BEL), reverse the rest of the line (a right-to-left override), and a NUL. */
+const hostile =
+  "Fix\u001b[2J\u001b]52;c;aGVsbG8=\u0007 \u202Egnp.exe\u0000 now";
+/** The same title as the command line writes it. */
+const escaped =
+  "Fix\\u{1b}[2J\\u{1b}]52;c;aGVsbG8=\\u{7} \\u{202e}gnp.exe\\u{0} now";
+/** Ordinary text from anywhere: accents, CJK and an emoji, none of which is changed. */
+const ordinary = "Café 日本語 🚀";
+
+/** The characters of an output that should never be written raw; empty for safe output. */
+const unsafeIn = (output: string): string[] =>
+  Array.from(output).filter((character) => isUnsafeCharacter(character));
+
+describe("terminalText", () => {
+  test("escapes every control and format character class it guards, visibly and by code point", () => {
+    expect(
+      terminalText(
+        "\u0000\u0008\u000B\u001F\u007F\u0080\u009F\u200B\u200F\u202A\u202E\u2060\u2064\u2066\u2069\uFEFF",
+      ),
+    ).toBe(
+      "\\u{0}\\u{8}\\u{b}\\u{1f}\\u{7f}\\u{80}\\u{9f}\\u{200b}\\u{200f}\\u{202a}\\u{202e}\\u{2060}\\u{2064}\\u{2066}\\u{2069}\\u{feff}",
+    );
+  });
+
+  test("leaves line feed, tab and ordinary non-ASCII text exactly as written", () => {
+    const text = `a\tb\n${ordinary}\u2065\u2070`;
+
+    expect(terminalText(text)).toBe(text);
+  });
+
+  test("escapes a hostile title", () => {
+    expect(terminalText(hostile)).toBe(escaped);
+  });
+});
+
+describe("terminalJson", () => {
+  test("writes no unsafe character raw, and parses back to the same value", () => {
+    const value = { title: hostile, c1: "\u009B2J", del: "\u007F", ordinary };
+    const json = terminalJson(value);
+
+    expect(unsafeIn(json)).toEqual([]);
+    expect(JSON.parse(json)).toEqual(value);
+  });
+});
+
+describe("every human-readable and diagram output of the command line", () => {
+  let harness: Harness;
+
+  beforeEach(async () => {
+    harness = createHarness();
+    await runInOrder(harness, [
+      ["add", "participant", `team${hostile}`, hostile],
+      ["add", "participant", "shop", ordinary, "--kind", "system"],
+      ["add", "participant", "order", "Order", "--kind", "entity"],
+      ["add", "activity", "prepare", ordinary, "--actor", "shop"],
+      [
+        "add",
+        "activity",
+        `submit${hostile}`,
+        hostile,
+        "--actor",
+        `team${hostile}`,
+      ],
+      ["add", "decision", "stock", ordinary, "--actor", "shop"],
+      ["add", "activity", "pack", ordinary, "--actor", "shop"],
+      ["add", "transition", "prepare", `submit${hostile}`, "--id", "t0"],
+      ["add", "transition", `submit${hostile}`, "stock", "--id", "t1"],
+      ["add", "transition", "stock", "pack", "--id", "t2", "--guard", hostile],
+    ]);
+  });
+
+  afterEach(() => {
+    harness.remove();
+  });
+
+  test.each([
+    [["ready"]],
+    [["blocked", "pack"]],
+    [["impact", "prepare"]],
+    [["why", "pack"]],
+    [["handoffs"]],
+    [["path"]],
+  ])("%j writes the hostile text escaped", async (args) => {
+    // With the first step done, the hostile-titled step is the ready one and the end of every blocked-by chain.
+    await harness.run("set", "prepare", "done");
+    const result = await harness.run(...args);
+
+    expect(result.code).toBe(exitCodes.success);
+    expect(unsafeIn(result.stdout)).toEqual([]);
+    expect(result.stdout).toMatch(/\\u\{1b\}\[2J|\\u\{1b\}/u);
+  });
+
+  test("ready, why and path keep ordinary text unchanged", async () => {
+    expect((await harness.run("ready")).stdout).toBe(`prepare\t${ordinary}\n`);
+    expect((await harness.run("path")).stdout).toContain(`pack\t${ordinary}`);
+  });
+
+  /** The arguments each view needs: the state view follows an entity, the sequence view a scenario. */
+  const viewArgs: Readonly<Record<string, readonly string[]>> = {
+    flowchart: [],
+    swimlane: [],
+    state: ["--subject", "order"],
+    sequence: ["--scenario", "t1", "t2"],
+  };
+
+  test.each(
+    Object.keys(viewArgs).flatMap((view) =>
+      ["mermaid", "dot"].map((format) => ({ view, format })),
+    ),
+  )(
+    "show --view $view --format $format writes the hostile text escaped inside well-formed labels, and ordinary text unchanged",
+    async ({ view, format }) => {
+      const { code, stdout } = await harness.run(
+        "show",
+        "--view",
+        view,
+        "--format",
+        format,
+        ...(viewArgs[view] ?? []),
+      );
+
+      expect(code).toBe(exitCodes.success);
+      expect(unsafeIn(stdout)).toEqual([]);
+      // DOT doubles the escape's backslash inside its quoted string; Mermaid leaves it, since a backslash is not Mermaid syntax.
+      expect(stdout).toContain(
+        format === "dot" ? escaped.replaceAll("\\", "\\\\") : "\\u{1b}[2J",
+      );
+      expect(stdout).toContain(view === "state" ? "\\u{202e}" : ordinary);
+    },
+  );
+
+  test("--json writes nothing unsafe raw and carries the text unchanged once parsed", async () => {
+    await harness.run("set", "prepare", "done");
+    const { stdout } = await harness.run("ready", "--json");
+
+    expect(unsafeIn(stdout)).toEqual([]);
+    expect(JSON.parse(stdout)).toMatchObject({
+      elements: [{ id: `submit${hostile}`, label: hostile }],
+    });
+  });
+
+  test("an error that echoes the text writes it escaped on standard error", async () => {
+    const result = await harness.run("why", `missing${hostile}`);
+
+    expect(result.code).toBe(exitCodes.notFound);
+    expect(unsafeIn(result.stderr)).toEqual([]);
+    expect(result.stderr).toContain(`missing${escaped}`);
+  });
+
+  test.each([["cycles"], ["validate"]])(
+    "%s writes the hostile identifiers of an illegal cycle escaped",
+    async (command) => {
+      await runInOrder(harness, [
+        ["add", "activity", `loop${hostile}`, "Loop", "--model", "loop"],
+        ["add", "activity", "back", "Back", "--model", "loop"],
+        ["add", "transition", `loop${hostile}`, "back", "--model", "loop"],
+        ["add", "transition", "back", `loop${hostile}`, "--model", "loop"],
+      ]);
+      const result = await harness.run(command, "--model", "loop");
+
+      expect(result.code).toBe(exitCodes.invalidModel);
+      expect(unsafeIn(result.stdout)).toEqual([]);
+      expect(result.stdout).toContain(`loop${escaped}`);
+    },
+  );
+});

From 176c3ea4bb43dbab36a4334668fec51b72cf2ad1 Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 06:45:11 +0100
Subject: [PATCH 27/31] fix(cli): keep the store's files private to their owner

The default data directory, the database and the -wal and -shm files took the
process umask, so under the usual umask other users on the host could read
synced titles and relationships from a predictable path. On Unix the command
line now creates its default directory, and the directories it creates above
it, as 0700, and creates the database as 0600 before SQLite opens it, which
gives the sidecars the same mode. An existing default store readable by others
is narrowed, and the port returns a warning the command line prints once on
standard error. At a user-named path only a database the command line creates
is made private; the user's directory and files are left alone.
---
 packages/targets/graph-cli/README.md          |   2 +
 packages/targets/graph-cli/src/data-file.ts   | 103 ++++++++++++
 .../graph-cli/src/data-file.unit.test.ts      | 149 ++++++++++++++++++
 packages/targets/graph-cli/src/node.ts        |  46 ++++--
 packages/targets/graph-cli/src/ports.ts       |   2 +
 packages/targets/graph-cli/src/program.ts     |   3 +
 .../graph-cli/src/test-support/harness.ts     |   1 +
 7 files changed, 294 insertions(+), 12 deletions(-)
 create mode 100644 packages/targets/graph-cli/src/data-file.ts
 create mode 100644 packages/targets/graph-cli/src/data-file.unit.test.ts

diff --git a/packages/targets/graph-cli/README.md b/packages/targets/graph-cli/README.md
index a229db1..46ce2f9 100644
--- a/packages/targets/graph-cli/README.md
+++ b/packages/targets/graph-cli/README.md
@@ -50,6 +50,8 @@ Every command takes the global options:
 
 Without `--data` or `PROCESS_GRAPH_DATA`, the store is `process-graph/graph.sqlite3` under `XDG_DATA_HOME`, or under `~/.local/share` when that is not set.
 
+The store holds synced work that other users on the host must not read. On Unix, the command line creates its default directory, and any missing directories above it, readable by its owner only (`0700`), and creates the database file the same way (`0600`) before SQLite opens it, so the `-wal` and `-shm` files SQLite derives from it are private too. A default store that already exists readable by others is narrowed to those modes, with one warning on standard error naming what changed. At a path given with `--data` or `PROCESS_GRAPH_DATA`, only a database file the command line creates is made private; the directory and an existing file are left as the user made them. Windows has no such modes, and nothing is set there.
+
 ## Output
 
 Text output is stable and made for scripts: a list is one item per line with tab-separated fields (an element is its identifier and label), and an empty list prints nothing. `--json` writes the same result as one JSON document; for `show` it is the projection when the format is `json`, and otherwise the view, the format and the diagram text. Errors go to standard error as one message, with no stack trace.
diff --git a/packages/targets/graph-cli/src/data-file.ts b/packages/targets/graph-cli/src/data-file.ts
new file mode 100644
index 0000000..30dc8b8
--- /dev/null
+++ b/packages/targets/graph-cli/src/data-file.ts
@@ -0,0 +1,103 @@
+import { chmodSync, closeSync, mkdirSync, openSync, statSync } from "node:fs";
+import { dirname } from "node:path";
+
+/** The data directory's mode: only its owner may list or enter it, since the store holds synced work (titles, relationships) that other users on the host must not read. */
+export const privateDirectoryMode = 0o700;
+
+/** The data file's mode: only its owner may read or write it. SQLite creates the `-wal` and `-shm` files beside it with the same mode on Unix. */
+export const privateFileMode = 0o600;
+
+/** The permission bits of a file mode, without its type. */
+const permissionBits = 0o777;
+
+/** The bits that give the file's group or anyone else any access. */
+const groupAndOtherBits = 0o077;
+
+/** Where a store's data file lives, and how much of its path the command line owns. */
+export interface DataFileOptions {
+  /**
+   * Whether the directory is the command line's own default, which it creates private and keeps private. A directory the user named (`--data` or `PROCESS_GRAPH_DATA`) is created when missing but never has its mode changed.
+   */
+  readonly ownsDirectory: boolean;
+  /** The platform; on Windows, file modes mean nothing and nothing is set. */
+  readonly platform: NodeJS.Platform;
+}
+
+/** The SQLite files a store at `path` uses: the database and its write-ahead log and shared-memory index. */
+const storeFiles = (path: string): readonly string[] => [
+  path,
+  `${path}-wal`,
+  `${path}-shm`,
+];
+
+/** Whether an error is the file system's report that a path does not exist, or already does. */
+const hasCode = (error: unknown, code: string): boolean =>
+  error instanceof Error && "code" in error && error.code === code;
+
+/**
+ * Narrows a path's mode to `mode` when its group or others have any access.
+ * @param path - The path.
+ * @param mode - The private mode it should have.
+ * @returns Whether the mode was changed; `false` too when the path does not exist.
+ */
+const tighten = (path: string, mode: number): boolean => {
+  let current: number;
+  try {
+    current = statSync(path).mode & permissionBits;
+  } catch (error: unknown) {
+    if (hasCode(error, "ENOENT")) {
+      return false;
+    }
+    throw error;
+  }
+  if ((current & groupAndOtherBits) === 0) {
+    return false;
+  }
+  chmodSync(path, mode);
+
+  return true;
+};
+
+/**
+ * Makes a data file ready for SQLite to open. The directory is created when missing, private when it is the command line's own. The database file is created private when missing, before SQLite opens it, so the file and the sidecars SQLite derives from it are never readable by others, whatever the umask; a file that already exists is left alone unless the directory is the command line's own. In its own directory, an existing directory or store file that group or others can read is narrowed to the private mode.
+ * @param path - The database file.
+ * @param options - How much of the path the command line owns, and the platform.
+ * @returns One warning line naming what was narrowed, or nothing.
+ */
+export const prepareDataFile = (
+  path: string,
+  options: DataFileOptions,
+): readonly string[] => {
+  const directory = dirname(path);
+  if (options.platform === "win32") {
+    mkdirSync(directory, { recursive: true });
+
+    return [];
+  }
+  mkdirSync(
+    directory,
+    options.ownsDirectory
+      ? { recursive: true, mode: privateDirectoryMode }
+      : { recursive: true },
+  );
+  try {
+    closeSync(openSync(path, "wx", privateFileMode));
+  } catch (error: unknown) {
+    if (!hasCode(error, "EEXIST")) {
+      throw error;
+    }
+  }
+  if (!options.ownsDirectory) {
+    return [];
+  }
+  const narrowed = [
+    ...(tighten(directory, privateDirectoryMode) ? [directory] : []),
+    ...storeFiles(path).filter((file) => tighten(file, privateFileMode)),
+  ];
+
+  return narrowed.length === 0
+    ? []
+    : [
+        `made ${narrowed.join(", ")} readable by its owner only, since other users could read the synced work in it`,
+      ];
+};
diff --git a/packages/targets/graph-cli/src/data-file.unit.test.ts b/packages/targets/graph-cli/src/data-file.unit.test.ts
new file mode 100644
index 0000000..e7eeaca
--- /dev/null
+++ b/packages/targets/graph-cli/src/data-file.unit.test.ts
@@ -0,0 +1,149 @@
+import {
+  chmodSync,
+  mkdirSync,
+  mkdtempSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { emptyModel } from "@exadev/process-graph-store-contract";
+import { afterEach, beforeEach, describe, expect, test } from "vitest";
+import {
+  prepareDataFile,
+  privateDirectoryMode,
+  privateFileMode,
+} from "./data-file.ts";
+import { exitCodes } from "./exit-codes.ts";
+import { nodePorts } from "./node.ts";
+import { runCli } from "./program.ts";
+
+/** A umask that leaves new files readable by group and others, the usual default, so a test fails if the code relies on the umask for privacy. */
+const permissiveUmask = 0o022;
+/** The modes such a umask gives a new directory and file. */
+const looseDirectoryMode = 0o755;
+const looseFileMode = 0o644;
+/** The permission bits of a mode. */
+const permissionBits = 0o777;
+
+const modeOf = (path: string): number => statSync(path).mode & permissionBits;
+
+let previousUmask: number;
+let directory: string;
+
+beforeEach(() => {
+  previousUmask = process.umask(permissiveUmask);
+  directory = mkdtempSync(join(tmpdir(), "process-graph-data-"));
+});
+
+afterEach(() => {
+  process.umask(previousUmask);
+  rmSync(directory, { recursive: true, force: true });
+});
+
+/** The Node ports with the XDG data directory inside the test's directory, so the default store is the command line's own. */
+const portsIn = (stderr: (text: string) => void = () => undefined) =>
+  nodePorts({
+    env: { XDG_DATA_HOME: join(directory, "xdg") },
+    home: directory,
+    stderr,
+  });
+
+describe("the command line's own default store", () => {
+  test("is created private, with the directories it creates, the database and the -wal and -shm files SQLite derives from it", async () => {
+    const ports = portsIn();
+    const path = ports.defaultDataPath;
+    const opened = await ports.openStore(path);
+    try {
+      await opened.client.v1.models.save({
+        modelId: "default",
+        model: emptyModel,
+      });
+
+      expect(opened.warnings).toEqual([]);
+      expect({
+        xdg: modeOf(join(directory, "xdg")),
+        app: modeOf(dirname(path)),
+        database: modeOf(path),
+        wal: modeOf(`${path}-wal`),
+        shm: modeOf(`${path}-shm`),
+      }).toEqual({
+        xdg: privateDirectoryMode,
+        app: privateDirectoryMode,
+        database: privateFileMode,
+        wal: privateFileMode,
+        shm: privateFileMode,
+      });
+    } finally {
+      await opened.close();
+    }
+  });
+
+  test("is narrowed when it already exists readable by others, and the command line says so on standard error", async () => {
+    let stderr = "";
+    const ports = portsIn((text) => {
+      stderr += text;
+    });
+    const path = ports.defaultDataPath;
+    mkdirSync(dirname(path), { recursive: true, mode: looseDirectoryMode });
+    writeFileSync(path, "", { mode: looseFileMode });
+    chmodSync(dirname(path), looseDirectoryMode);
+    chmodSync(path, looseFileMode);
+
+    await expect(
+      runCli(["add", "participant", "team", "Team"], ports, {
+        name: "process-graph",
+        version: "0.0.0",
+      }),
+    ).resolves.toBe(exitCodes.success);
+
+    expect([modeOf(dirname(path)), modeOf(path)]).toEqual([
+      privateDirectoryMode,
+      privateFileMode,
+    ]);
+    expect(stderr).toBe(
+      `warning: made ${dirname(path)}, ${path} readable by its owner only, since other users could read the synced work in it\n`,
+    );
+  });
+});
+
+describe("a store at a path the user names", () => {
+  test("creates its database private but never changes the directory the user supplied", async () => {
+    const supplied = join(directory, "mine");
+    mkdirSync(supplied, { mode: looseDirectoryMode });
+    chmodSync(supplied, looseDirectoryMode);
+    const path = join(supplied, "graph.sqlite3");
+    const opened = await portsIn().openStore(path);
+    await opened.close();
+
+    expect(opened.warnings).toEqual([]);
+    expect([modeOf(supplied), modeOf(path)]).toEqual([
+      looseDirectoryMode,
+      privateFileMode,
+    ]);
+  });
+
+  test("leaves a database file that already exists as it is", async () => {
+    const path = join(directory, "existing.sqlite3");
+    writeFileSync(path, "", { mode: looseFileMode });
+    chmodSync(path, looseFileMode);
+    const opened = await portsIn().openStore(path);
+    await opened.close();
+
+    expect(opened.warnings).toEqual([]);
+    expect(modeOf(path)).toBe(looseFileMode);
+  });
+});
+
+test("on Windows, where file modes mean nothing, no mode is set or changed", () => {
+  const path = join(directory, "xdg", "process-graph", "graph.sqlite3");
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, "", { mode: looseFileMode });
+  chmodSync(path, looseFileMode);
+
+  expect(
+    prepareDataFile(path, { ownsDirectory: true, platform: "win32" }),
+  ).toEqual([]);
+  expect(modeOf(path)).toBe(looseFileMode);
+});
diff --git a/packages/targets/graph-cli/src/node.ts b/packages/targets/graph-cli/src/node.ts
index ce3fa4b..03d5590 100644
--- a/packages/targets/graph-cli/src/node.ts
+++ b/packages/targets/graph-cli/src/node.ts
@@ -1,7 +1,7 @@
-import { mkdirSync, readFileSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { join } from "node:path";
 import type { Facts } from "@exadev/process-graph-domain";
 import { createGraphSourceRouter } from "@exadev/process-graph-source-contract";
 import {
@@ -14,6 +14,7 @@ import { githubTokenFromEnvironment } from "@exadev/process-graph-source-github-
 import { openNodeGraphStore } from "@exadev/process-graph-sqlite-node";
 import { createGraphStoreRouter } from "@exadev/process-graph-store-contract";
 import { createRouterClient } from "@orpc/server";
+import { prepareDataFile } from "./data-file.ts";
 import type { CliPorts } from "./ports.ts";
 import type { ExitCode } from "./exit-codes.ts";
 import { runCli, type ProgramIdentity } from "./program.ts";
@@ -38,6 +39,8 @@ export interface NodePortsOptions {
   readonly stdout?: (text: string) => void;
   /** Standard error; the process's when absent. */
   readonly stderr?: (text: string) => void;
+  /** The platform, which decides whether file modes are set; the process's when absent. */
+  readonly platform?: NodeJS.Platform;
 }
 
 /** The variable that names the data file outright. */
@@ -50,19 +53,15 @@ const dataFile = join("process-graph", "graph.sqlite3");
 const inMemory = ":memory:";
 
 /**
- * The data file used when `--data` is not given: `PROCESS_GRAPH_DATA` when it is set and not empty, otherwise `process-graph/graph.sqlite3` under the XDG data directory (`XDG_DATA_HOME`, or `.local/share` in the home directory).
+ * The command line's own data file: `process-graph/graph.sqlite3` under the XDG data directory (`XDG_DATA_HOME`, or `.local/share` in the home directory).
  * @param env - The environment.
  * @param home - The home directory.
  * @returns The path.
  */
-export const defaultDataPath = (
+const xdgDataPath = (
   env: Readonly<Record<string, string | undefined>>,
   home: string,
 ): string => {
-  const named = env[dataVariable];
-  if (named !== undefined && named !== "") {
-    return named;
-  }
   const xdg = env.XDG_DATA_HOME;
 
   return join(
@@ -71,6 +70,21 @@ export const defaultDataPath = (
   );
 };
 
+/**
+ * The data file used when `--data` is not given: `PROCESS_GRAPH_DATA` when it is set and not empty, otherwise `process-graph/graph.sqlite3` under the XDG data directory (`XDG_DATA_HOME`, or `.local/share` in the home directory).
+ * @param env - The environment.
+ * @param home - The home directory.
+ * @returns The path.
+ */
+export const defaultDataPath = (
+  env: Readonly<Record<string, string | undefined>>,
+  home: string,
+): string => {
+  const named = env[dataVariable];
+
+  return named !== undefined && named !== "" ? named : xdgDataPath(env, home);
+};
+
 /** A fact port that knows nothing: every condition is indeterminate and no input artefact is provided. */
 const noFacts: Facts = () => ({ found: false });
 
@@ -102,6 +116,9 @@ export const packageVersion = (manifest: URL): string => {
 export const nodePorts = (options: NodePortsOptions = {}): CliPorts => {
   const env = options.env ?? process.env;
   const token = options.token ?? githubTokenFromEnvironment({ env });
+  const home = options.home ?? homedir();
+  // The command line's own data file, in the XDG data directory, whose directory it creates and keeps private; a path the user names is theirs.
+  const ownDataPath = xdgDataPath(env, home);
 
   return {
     stdout:
@@ -114,16 +131,21 @@ export const nodePorts = (options: NodePortsOptions = {}): CliPorts => {
       ((text) => {
         process.stderr.write(text);
       }),
-    defaultDataPath: defaultDataPath(env, options.home ?? homedir()),
+    defaultDataPath: defaultDataPath(env, home),
     openStore: (path) => {
-      if (path !== inMemory) {
-        mkdirSync(dirname(path), { recursive: true });
-      }
+      const warnings =
+        path === inMemory
+          ? []
+          : prepareDataFile(path, {
+              ownsDirectory: path === ownDataPath,
+              platform: options.platform ?? process.platform,
+            });
       const { store, close } = openNodeGraphStore(path);
 
       return {
         client: createRouterClient(createGraphStoreRouter(store)),
         close,
+        warnings,
       };
     },
     source: (prefix) =>
diff --git a/packages/targets/graph-cli/src/ports.ts b/packages/targets/graph-cli/src/ports.ts
index 1364188..45e61da 100644
--- a/packages/targets/graph-cli/src/ports.ts
+++ b/packages/targets/graph-cli/src/ports.ts
@@ -8,6 +8,8 @@ export interface OpenedStore {
   readonly client: GraphStoreClient;
   /** Releases the store. Called once, after the command, whether it succeeded or not. */
   readonly close: () => void | Promise<void>;
+  /** Lines the command line writes to standard error before the command runs, such as permissions it narrowed on the store's files; empty when there is nothing to say. */
+  readonly warnings: readonly string[];
 }
 
 /**
diff --git a/packages/targets/graph-cli/src/program.ts b/packages/targets/graph-cli/src/program.ts
index 7b89d99..ead6400 100644
--- a/packages/targets/graph-cli/src/program.ts
+++ b/packages/targets/graph-cli/src/program.ts
@@ -162,6 +162,9 @@ export const runCli = async (
     async (command: Command, ...values: Args): Promise<void> => {
       const globals = readGlobals(command, ports);
       const opened = await ports.openStore(globals.data);
+      for (const warning of opened.warnings) {
+        writeErr(`warning: ${warning}\n`);
+      }
       try {
         const outcome = await handler(
           {
diff --git a/packages/targets/graph-cli/src/test-support/harness.ts b/packages/targets/graph-cli/src/test-support/harness.ts
index 973c7fc..e9b818c 100644
--- a/packages/targets/graph-cli/src/test-support/harness.ts
+++ b/packages/targets/graph-cli/src/test-support/harness.ts
@@ -67,6 +67,7 @@ export const createHarness = (
           return {
             client: createRouterClient(createGraphStoreRouter(store)),
             close,
+            warnings: [],
           };
         },
         source: (prefix) => {

From 0825f18ff4dfbd571ee828a6f9c56ba7e6896bc6 Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 06:59:39 +0100
Subject: [PATCH 28/31] fix(cli): escape terminal-unsafe characters by Unicode
 general category

Enumerated ranges missed bidirectional controls such as U+061C, the Arabic
letter mark, which reached human and --json output raw. Everything in Cc, Cf,
Zl, Zp, Cn and Co is now escaped, by code point, apart from line feed, tab and
the zero-width non-joiner and joiner, which emoji sequences and several scripts
need. Escapes beyond the Basic Multilingual Plane are written whole in text and
as surrogate pairs in JSON.
---
 packages/targets/graph-cli/README.md          |  2 +-
 .../targets/graph-cli/src/terminal-text.ts    | 64 +++++++++--------
 .../graph-cli/src/terminal-text.unit.test.ts  | 69 ++++++++++++++++++-
 3 files changed, 102 insertions(+), 33 deletions(-)

diff --git a/packages/targets/graph-cli/README.md b/packages/targets/graph-cli/README.md
index 46ce2f9..383e457 100644
--- a/packages/targets/graph-cli/README.md
+++ b/packages/targets/graph-cli/README.md
@@ -56,7 +56,7 @@ The store holds synced work that other users on the host must not read. On Unix,
 
 Text output is stable and made for scripts: a list is one item per line with tab-separated fields (an element is its identifier and label), and an empty list prints nothing. `--json` writes the same result as one JSON document; for `show` it is the projection when the format is `json`, and otherwise the view, the format and the diagram text. Errors go to standard error as one message, with no stack trace.
 
-Text from a source can carry characters that act on a terminal: escape sequences that clear the screen or set the clipboard, other control characters, and the Unicode controls that reorder or hide text. Everything the command line writes, results, diagrams, help and errors alike, writes each of them as a visible escape of its code point, `\u{1b}` for ESC or `\u{202e}` for a right-to-left override, and keeps line breaks, tabs and every other character, accented, CJK and emoji included, as they are. In Mermaid and DOT the escape sits inside the label's own escaping, so the diagram stays valid. `--json` writes the same characters as JSON `\u` escapes, so the parsed values are exactly the source's.
+Text from a source can carry characters that act on a terminal or change what it shows: escape sequences that clear the screen or set the clipboard, and characters that reorder, hide or misdraw text. Everything the command line writes, results, diagrams, help and errors alike, writes every character in the Unicode general categories `Cc` (controls), `Cf` (format characters, every bidirectional control included), `Zl` and `Zp` (line and paragraph separators), `Cn` (unassigned) and `Co` (private use) as a visible escape of its code point, `\u{1b}` for ESC or `\u{202e}` for a right-to-left override. Line feed and tab are kept, and so are the zero-width non-joiner and joiner, which emoji sequences and scripts such as Persian need; every other character, accented, CJK, Arabic and emoji included, is written as it is. In Mermaid and DOT the escape sits inside the label's own escaping, so the diagram stays valid. `--json` writes the same characters as JSON `\u` escapes, so the parsed values are exactly the source's.
 
 The Mermaid emitters name nodes by their position in the view, since Mermaid does not accept identifiers such as `github:org/repo#12`, and write every character Mermaid reads as syntax in a label as its entity code. The DOT emitters keep the model identifiers as node names. Hand-offs are drawn as thick (Mermaid) or bold (DOT) edges, and an empty swimlane lane is still drawn. DOT has no sequence notation, so a sequence diagram in DOT is a grid of lifelines with one row per message, each message numbered and prefixed with the fragments around it.
 
diff --git a/packages/targets/graph-cli/src/terminal-text.ts b/packages/targets/graph-cli/src/terminal-text.ts
index e35ae78..cddc2c0 100644
--- a/packages/targets/graph-cli/src/terminal-text.ts
+++ b/packages/targets/graph-cli/src/terminal-text.ts
@@ -1,24 +1,18 @@
 /**
- * The characters, as inclusive ranges, that must never reach a terminal as they are: the C0 controls except line feed and tab (ESC starts the sequences that clear the screen, move the cursor or, through OSC 52, set the clipboard), DEL, the C1 controls (which some terminals read as the same sequences), and the Unicode bidirectional and invisible format controls, which reorder or hide text so that what is shown differs from what is there. Text from a source (an issue title, a label, an actor's name) can carry any of them.
+ * The characters that must never reach a terminal as they are, by Unicode general category: controls (`Cc`, where ESC starts the sequences that clear the screen, move the cursor or, through OSC 52, set the clipboard, and the C1 controls some terminals read as the same sequences), format characters (`Cf`, which holds every bidirectional control, the invisible operators, the soft hyphen, the interlinear annotation characters and the tag characters, all of which reorder, hide or change what is shown), the line and paragraph separators (`Zl`, `Zp`), and the unassigned and private-use code points (`Cn`, `Co`), which no font shows reliably. Text from a source (an issue title, a label, an actor's name) can carry any of them. A category, not a list of ranges, so a character Unicode adds to one of them is covered without a change here.
+ *
+ * Three are allowed: line feed and tab, which every text output uses, and the zero-width non-joiner and joiner (U+200C, U+200D), formats that emoji sequences (a family, a profession) and scripts such as Persian, Hindi and Malayalam need to be written correctly, and that cannot reorder or hide text on their own.
  */
-const unsafeRanges: readonly (readonly [string, string])[] = [
-  ["\u0000", "\u0008"],
-  ["\u000B", "\u001F"],
-  ["\u007F", "\u009F"],
-  ["\u200B", "\u200F"],
-  ["\u202A", "\u202E"],
-  ["\u2060", "\u2064"],
-  ["\u2066", "\u2069"],
-  ["\uFEFF", "\uFEFF"],
-];
+const unsafeCharacters =
+  /[[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\p{Cn}\p{Co}]--[\n\t\u200C\u200D]]/gv;
 
 /**
- * Whether a character is one of the unsafe ones (see `unsafeRanges`). Every range lies in the Basic Multilingual Plane, where comparing one-character strings compares their code points, and a character outside it is never unsafe.
- * @param character - One character.
+ * Whether a character is one of the unsafe ones (see `unsafeCharacters`).
+ * @param character - One character: one code point, which may be two UTF-16 code units.
  * @returns Whether it must be escaped.
  */
 export const isUnsafeCharacter = (character: string): boolean =>
-  unsafeRanges.some(([from, to]) => character >= from && character <= to);
+  character.replaceAll(unsafeCharacters, "") !== character;
 
 /** Code points are written in hexadecimal. */
 const hexadecimal = 16;
@@ -27,33 +21,43 @@ const hexadecimal = 16;
 const jsonEscapeDigits = 4;
 
 /**
- * The text with each unsafe character replaced by an escape of its code point.
- * @param text - The text as written.
- * @param escape - The escape for a code point given in lower-case hexadecimal.
- * @returns The escaped text.
+ * A character's code point.
+ * @param character - One character, as the unsafe-character pattern matches it.
+ * @returns Its code point.
+ * @throws Error when given an empty string, which the pattern never matches.
  */
-const escapeUnsafe = (text: string, escape: (hex: string) => string): string =>
-  Array.from(text, (character) =>
-    isUnsafeCharacter(character)
-      ? escape(character.charCodeAt(0).toString(hexadecimal))
-      : character,
-  ).join("");
+const codePointOf = (character: string): number => {
+  const point = character.codePointAt(0);
+  if (point === undefined) {
+    throw new Error("an unsafe character match was empty");
+  }
+
+  return point;
+};
 
 /**
- * Text made safe to write to a terminal. Each unsafe character (see `unsafeRanges`) is written as the visible escape `\u{<hex>}`, such as `\u{1b}` for ESC or `\u{202e}` for a right-to-left override, so nothing is lost and nothing acts on the terminal. Line feed and tab pass through, as does every other character, accented letters, CJK and emoji included. A literal `\u{...}` already in the text is left as it is, so the escaped form is for reading, not for reversing.
+ * Text made safe to write to a terminal. Each unsafe character (see `unsafeCharacters`) is written as the visible escape `\u{<hex>}` of its code point, such as `\u{1b}` for ESC, `\u{202e}` for a right-to-left override or `\u{e0041}` for a tag character, so nothing is lost and nothing acts on the terminal. Line feed, tab, the zero-width joiners and every other character, accented letters, CJK, Arabic and emoji included, pass through. A literal `\u{...}` already in the text is left as it is, so the escaped form is for reading, not for reversing.
  * @param text - The text as written.
  * @returns The text with every unsafe character escaped.
  */
 export const terminalText = (text: string): string =>
-  escapeUnsafe(text, (hex) => `\\u{${hex}}`);
+  text.replaceAll(
+    unsafeCharacters,
+    (character) => `\\u{${codePointOf(character).toString(hexadecimal)}}`,
+  );
 
 /**
- * A value as JSON that is also safe to write to a terminal. `JSON.stringify` escapes the C0 controls but writes DEL, the C1 controls and the format controls as they are; this writes those as `\u` escapes too, which leaves the JSON, and every value parsed from it, exactly the same.
+ * A value as JSON that is also safe to write to a terminal. `JSON.stringify` escapes the C0 controls but writes every other unsafe character (see `unsafeCharacters`) as it is; this writes those as `\u` escapes too, a surrogate pair for a code point beyond the Basic Multilingual Plane, which leaves the JSON, and every value parsed from it, exactly the same.
  * @param value - The value to write.
  * @returns The JSON text, indented by two spaces and ending in a line break.
  */
 export const terminalJson = (value: unknown): string =>
-  `${escapeUnsafe(
-    JSON.stringify(value, null, 2),
-    (hex) => `\\u${hex.padStart(jsonEscapeDigits, "0")}`,
+  `${JSON.stringify(value, null, 2).replaceAll(unsafeCharacters, (character) =>
+    character
+      .split("")
+      .map(
+        (unit) =>
+          `\\u${unit.charCodeAt(0).toString(hexadecimal).padStart(jsonEscapeDigits, "0")}`,
+      )
+      .join(""),
   )}\n`;
diff --git a/packages/targets/graph-cli/src/terminal-text.unit.test.ts b/packages/targets/graph-cli/src/terminal-text.unit.test.ts
index 781fdcd..d5d349e 100644
--- a/packages/targets/graph-cli/src/terminal-text.unit.test.ts
+++ b/packages/targets/graph-cli/src/terminal-text.unit.test.ts
@@ -24,6 +24,29 @@ const ordinary = "Café 日本語 🚀";
 const unsafeIn = (output: string): string[] =>
   Array.from(output).filter((character) => isUnsafeCharacter(character));
 
+/** One example of each kind of character the general-category rule escapes beyond the C0 and C1 controls, with the escape it is written as. */
+const categoryExamples: readonly (readonly [string, string, string])[] = [
+  ["the Arabic letter mark (Cf)", "\u061C", "\\u{61c}"],
+  ["the left-to-right mark (Cf)", "\u200E", "\\u{200e}"],
+  ["the right-to-left mark (Cf)", "\u200F", "\\u{200f}"],
+  ["the line separator (Zl)", "\u2028", "\\u{2028}"],
+  ["the paragraph separator (Zp)", "\u2029", "\\u{2029}"],
+  ["the soft hyphen (Cf)", "\u00AD", "\\u{ad}"],
+  ["a tag character (Cf)", "\u{E0041}", "\\u{e0041}"],
+  ["the interlinear annotation anchor (Cf)", "\uFFF9", "\\u{fff9}"],
+  ["a private-use character (Co)", "\uE000", "\\u{e000}"],
+  ["an unassigned code point (Cn)", "\u2065", "\\u{2065}"],
+];
+
+/** Text that must pass through unchanged: a family emoji joined by zero-width joiners, CJK, accents, Arabic, and Persian with its zero-width non-joiner. */
+const scripts = [
+  "\u{1F468}\u200D\u{1F469}\u200D\u{1F467}",
+  "日本語の文",
+  "crème brûlée",
+  "مرحبا بالعالم",
+  "\u0645\u06CC\u200C\u062E\u0648\u0627\u0647\u0645",
+];
+
 describe("terminalText", () => {
   test("escapes every control and format character class it guards, visibly and by code point", () => {
     expect(
@@ -35,18 +58,42 @@ describe("terminalText", () => {
     );
   });
 
-  test("leaves line feed, tab and ordinary non-ASCII text exactly as written", () => {
-    const text = `a\tb\n${ordinary}\u2065\u2070`;
+  test("leaves line feed, tab and ordinary text in any script exactly as written, joiners included", () => {
+    const text = `a\tb\n${ordinary}${scripts.join(" ")}`;
 
     expect(terminalText(text)).toBe(text);
   });
 
+  test.each(categoryExamples)(
+    "escapes %s visibly by its code point",
+    (_name, character, escape) => {
+      expect(terminalText(`a${character}b`)).toBe(`a${escape}b`);
+    },
+  );
+
   test("escapes a hostile title", () => {
     expect(terminalText(hostile)).toBe(escaped);
   });
 });
 
 describe("terminalJson", () => {
+  test.each(categoryExamples)(
+    "writes %s as a JSON escape that parses back to it",
+    (_name, character) => {
+      const json = terminalJson({ title: `a${character}b` });
+
+      expect(unsafeIn(json)).toEqual([]);
+      expect(json).toMatch(/\\u[0-9a-f]{4}/u);
+      expect(JSON.parse(json)).toEqual({ title: `a${character}b` });
+    },
+  );
+
+  test("writes ordinary text in any script, joiners included, as it is", () => {
+    const value = { scripts };
+
+    expect(terminalJson(value)).toBe(`${JSON.stringify(value, null, 2)}\n`);
+  });
+
   test("writes no unsafe character raw, and parses back to the same value", () => {
     const value = { title: hostile, c1: "\u009B2J", del: "\u007F", ordinary };
     const json = terminalJson(value);
@@ -176,4 +223,22 @@ describe("every human-readable and diagram output of the command line", () => {
       expect(result.stdout).toContain(`loop${escaped}`);
     },
   );
+
+  test("every category example comes out escaped in human output and unchanged once --json is parsed", async () => {
+    const label = categoryExamples.map(([, character]) => character).join("|");
+    await runInOrder(harness, [
+      ["add", "activity", "marks", label, "--model", "marks"],
+    ]);
+    const text = await harness.run("ready", "--model", "marks");
+    const json = await harness.run("ready", "--model", "marks", "--json");
+
+    expect(unsafeIn(text.stdout)).toEqual([]);
+    expect(text.stdout).toBe(
+      `marks\t${categoryExamples.map(([, , escape]) => escape).join("|")}\n`,
+    );
+    expect(unsafeIn(json.stdout)).toEqual([]);
+    expect(JSON.parse(json.stdout)).toMatchObject({
+      elements: [{ id: "marks", label }],
+    });
+  });
 });

From 9094d41a889fd5d800a18332bd19e63772c76f8c Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 07:02:37 +0100
Subject: [PATCH 29/31] build(deps): upgrade @exadev/eslint-config to 3.1.0

It types the React and Next.js configs as the arrays they are, so the React
config is spread rather than nested. eslint-plugin-json-canonical, which it
now depends on, is ExaDev's own and joins the install age exclusions.
---
 eslint.shared.ts    |   3 +-
 pnpm-lock.yaml      | 123 ++++++--------------------------------------
 pnpm-workspace.yaml |   3 +-
 3 files changed, 18 insertions(+), 111 deletions(-)

diff --git a/eslint.shared.ts b/eslint.shared.ts
index 2b4e062..c4bf776 100644
--- a/eslint.shared.ts
+++ b/eslint.shared.ts
@@ -294,8 +294,7 @@ export function packageLintConfig(options: PackageLintOptions): Config[] {
     react === undefined
       ? []
       : [
-          // Nested rather than spread: at runtime this is an array of config blocks, which defineConfig flattens.
-          exadev.configs.react,
+          ...exadev.configs.react,
           { settings: { react: { version: react.version } } },
         ],
     dataFileLintConfig,
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 0d51596..9fa7c4c 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -186,8 +186,8 @@ catalogs:
       specifier: 8.0.3
       version: 8.0.3
     '@exadev/eslint-config':
-      specifier: 2.36.3
-      version: 2.36.3
+      specifier: 3.1.0
+      version: 3.1.0
     '@exadev/semantic-release-workspace':
       specifier: 3.1.29
       version: 3.1.29
@@ -402,7 +402,7 @@ importers:
         version: 8.0.3(supports-color@7.2.0)
       '@exadev/eslint-config':
         specifier: 'catalog:'
-        version: 2.36.3(@eslint/json@2.1.0)(@eslint/markdown@8.0.3(supports-color@7.2.0))(eslint-plugin-jsx-a11y@6.10.2(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0)))(eslint-plugin-react-hooks@7.1.1(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0))(eslint-plugin-react@7.37.5(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0)))(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript-eslint@8.71.0(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3))(typescript@6.0.3)
+        version: 3.1.0(@eslint/json@2.1.0)(@eslint/markdown@8.0.3(supports-color@7.2.0))(eslint-plugin-jsx-a11y@6.10.2(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0)))(eslint-plugin-react-hooks@7.1.1(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0))(eslint-plugin-react@7.37.5(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0)))(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript-eslint@8.71.0(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3))(typescript@6.0.3)
       '@exadev/semantic-release-workspace':
         specifier: 'catalog:'
         version: 3.1.29(@semantic-release/changelog@7.0.0(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3)))(@semantic-release/commit-analyzer@13.0.1(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0))(@semantic-release/git@11.0.1(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0))(@semantic-release/github@12.0.10(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0))(@semantic-release/npm@13.2.0(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3)))(@semantic-release/release-notes-generator@14.1.1(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0))(semantic-release@25.0.9(supports-color@7.2.0)(typescript@6.0.3))(supports-color@7.2.0)(typescript@6.0.3)
@@ -2732,8 +2732,8 @@ packages:
     resolution: {integrity: sha512-IkO+/KEUvwbVpiURZg+P7zF74z5Jxe0UgJxVni+RtoHQ6IZieXaO02kmadomap/q+l6bc/jdPGGqTjhuZnuz1Q==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
 
-  '@exadev/eslint-config@2.36.3':
-    resolution: {integrity: sha512-zdGnBJJ2BSS7pqsd/db/tOAPgCCAi+xa0p4RlxNpKNBJjhNPZQY8j4L1jVR1YD+i15IlE4/MpX2Zxw8KxdvLNg==}
+  '@exadev/eslint-config@3.1.0':
+    resolution: {integrity: sha512-LAIWx1zWEyirHxyHzYSX8JSLCp8qafz6id1g3+7QP4vO87KK1jAr0peOaGOQutrG1Lo+7QSCx6dWRMuo7f7J3g==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
     peerDependencies:
       '@eslint/json': ^2.1.0
@@ -2985,9 +2985,6 @@ packages:
   '@microsoft/tsdoc-config@0.18.3':
     resolution: {integrity: sha512-0I0rGXo1eJziw3EEErkDS9p/0RzBcyOiV+zbSDqOZTeURmhtut+WIvpih0LM5g+ZpZ9SyFxDfkhAcl/r8e2zGw==}
 
-  '@microsoft/tsdoc@0.17.0':
-    resolution: {integrity: sha512-p68VexhnH7ojf3U27RdryUDqnKJgKaWUbCL96vJR7N0mqDuhKG5OIECk3sCPPdynxjk+yoVhRkScqtv5KQjzsw==}
-
   '@microsoft/tsdoc@0.17.1':
     resolution: {integrity: sha512-VHyYyyoH63jFoO3shpw9Zfijk5v/9p/VrClW35z0/q6ooK7sSmxpzOkS4iZPxs3vO4XtBW4H38HRAKkAMIK7DA==}
 
@@ -4016,12 +4013,6 @@ packages:
     peerDependencies:
       typescript: '>=4.8.4 <6.0.0'
 
-  '@typescript-eslint/project-service@8.67.0':
-    resolution: {integrity: sha512-cvE8c7ulYeXN9fYuszhCeCsbzyVEXuhrRCybnBre7TUmqb5nRmBfQAwCj0O3WJFDeyAZt4VYv51vMCC9LHSdYw==}
-    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
-    peerDependencies:
-      typescript: '>=4.8.4 <6.1.0'
-
   '@typescript-eslint/project-service@8.71.0':
     resolution: {integrity: sha512-aABjw5rjBacYONVPaPiWOCjJu0vEF4a25iQuodlmQYL1trtLZ0X/y+2Vzl3BKI1odM4LnwLE1oUDXYp1wzx1TQ==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -4032,10 +4023,6 @@ packages:
     resolution: {integrity: sha512-YAi4VDKcIZp0O4tz/haYKhmIDZFEUPOreKbfdAN3SzUDMcPhJ8QI99xQXqX+HoUVq8cs85eRKnD+rne2UAnj2w==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@typescript-eslint/scope-manager@8.67.0':
-    resolution: {integrity: sha512-EgvsleTwS4E+WzzSvem8fAUubLwatMNF1B5hHSLQxcvs7q2dtRhGyujHwLJSYlG41niJ7GP24Aha2+0mb1b2kg==}
-    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
-
   '@typescript-eslint/scope-manager@8.71.0':
     resolution: {integrity: sha512-gWF0BhUcnjZxSpLE8ngS/59n2SB0J3YqRxvX1+2aoRJk9hNtHSLOV+TcarFiOr5ipXm3yc1QrI4c9YZc8zyCxw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -4046,12 +4033,6 @@ packages:
     peerDependencies:
       typescript: '>=4.8.4 <6.0.0'
 
-  '@typescript-eslint/tsconfig-utils@8.67.0':
-    resolution: {integrity: sha512-vV+LUSv5njUWsknE71fqKTlXUva+R76SaeORd6Zojcunk/6DvKFXONU3BrAs2H49mbygUXt6gbYunzwqNwlhdg==}
-    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
-    peerDependencies:
-      typescript: '>=4.8.4 <6.1.0'
-
   '@typescript-eslint/tsconfig-utils@8.71.0':
     resolution: {integrity: sha512-Z1UlWHADEK2Mlb9NpWfDeSjqoZ5EyrOv4R3eQpbkzqn/EwaIdOpXXupEA1+0ZIOSJSZZDBHG0BrQyN8zUG6Pwg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -4069,10 +4050,6 @@ packages:
     resolution: {integrity: sha512-dbMkdIUkIkchgGDIv7KLUpa0Mda4IYjo4IAMJUZ+3xNoUXxMsk9YtKpTHSChRS85o+H9ftm51gsK1dZReY9CVw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@typescript-eslint/types@8.67.0':
-    resolution: {integrity: sha512-sBtgslww8nsMYUjhdPBiSyUqSzT8uR6g93A2QXnQC8+cGdjz0CyaOdqHDRJb1AtORbZCNUJBBeFA/tNR2uQmww==}
-    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
-
   '@typescript-eslint/types@8.71.0':
     resolution: {integrity: sha512-cJ4OoxPGWvFnBTnSZyaU+qJzGTqPTGJY+gDchj6cRyLRdmIdt4rcsE4twj+zPfrNiWuVi38wijHzShL++Z9atQ==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -4083,12 +4060,6 @@ packages:
     peerDependencies:
       typescript: '>=4.8.4 <6.0.0'
 
-  '@typescript-eslint/typescript-estree@8.67.0':
-    resolution: {integrity: sha512-EKQBCE9yNlRJYm7jdTW5AhDacDUmSwQb0FAJAmK2EKYrNXIsa2vxcSZx6PvJ/dEdI6lS+Y9W+EXckLj0iPFGcw==}
-    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
-    peerDependencies:
-      typescript: '>=4.8.4 <6.1.0'
-
   '@typescript-eslint/typescript-estree@8.71.0':
     resolution: {integrity: sha512-PEEF4G5sLLWAS5BpPrUvms4ySZkiBQQZM4z+3ReI46axK5Vqr/vXBQatJQIZZOYdGyPUAKTtsrWzpqKuU+3DEw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -4102,13 +4073,6 @@ packages:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
       typescript: '>=4.8.4 <6.0.0'
 
-  '@typescript-eslint/utils@8.67.0':
-    resolution: {integrity: sha512-U9D1FdwEWBwok3hxxSdhclMb0twvt9QnjIQ0VfQ1AiX2epnpSgv2ubVDsayOFyY8K6FX+AQ7E0FKWVG3iKsj1A==}
-    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
-    peerDependencies:
-      eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
-      typescript: '>=4.8.4 <6.1.0'
-
   '@typescript-eslint/utils@8.71.0':
     resolution: {integrity: sha512-pKR/tEMVrXZG23UFKUn5BQf3zfmfk7KQceI2cGzywZ5nxM5Eu3hEJU1utjWzydtzBbcJAQhHN8iPCxobHpPcZQ==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -4120,10 +4084,6 @@ packages:
     resolution: {integrity: sha512-KiROIzYdEV85YygXw6BI/Dx4fnBlFQu6Mq4QE4MOH9fFnhohw6wX/OAvDY2/C+ut0I3RSPKenvZJIVYqJNkhEw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@typescript-eslint/visitor-keys@8.67.0':
-    resolution: {integrity: sha512-fkv8dHRDqfGtTHuJeebdrQ7cX6Ad4WAS00rgHh9UGvMycF1mjBfsxry1XsLIFhWZ6Judlh6UdzK+TYlbpCXgnA==}
-    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
-
   '@typescript-eslint/visitor-keys@8.71.0':
     resolution: {integrity: sha512-8eQ9R218XORK+KLosnf4bu/QsUXvUyVwTbArg7/0NMB1Pu87OJKvj4nhFblkYE8gQV73mW1dx1ptlPCkwRGa7A==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -5228,8 +5188,8 @@ packages:
     peerDependencies:
       eslint: ^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0
 
-  eslint-plugin-json-canonical@2.1.0:
-    resolution: {integrity: sha512-sjT8FdqSvpEiB0yzCOGBozbEJ64SLxDp8CYlV9wHEgL0HFLj3kJdfWl5UuzMe72OoOXbwzo418VeUlxX5iNfgg==}
+  eslint-plugin-json-canonical@2.1.3:
+    resolution: {integrity: sha512-qAcRVGkXGZvgduOIEBxHLOZhqUf0NdVY+bye/KXbd0oPH5VvoBBBETFEaJ1qa6efLSCH17C4sss7uvr80TfNTQ==}
     engines: {node: '>=20'}
     peerDependencies:
       '@eslint/json': ^2.1.0
@@ -9213,16 +9173,16 @@ snapshots:
       '@eslint/core': 1.2.1
       levn: 0.4.1
 
-  '@exadev/eslint-config@2.36.3(@eslint/json@2.1.0)(@eslint/markdown@8.0.3(supports-color@7.2.0))(eslint-plugin-jsx-a11y@6.10.2(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0)))(eslint-plugin-react-hooks@7.1.1(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0))(eslint-plugin-react@7.37.5(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0)))(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript-eslint@8.71.0(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3))(typescript@6.0.3)':
+  '@exadev/eslint-config@3.1.0(@eslint/json@2.1.0)(@eslint/markdown@8.0.3(supports-color@7.2.0))(eslint-plugin-jsx-a11y@6.10.2(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0)))(eslint-plugin-react-hooks@7.1.1(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0))(eslint-plugin-react@7.37.5(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0)))(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript-eslint@8.71.0(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3))(typescript@6.0.3)':
     dependencies:
       '@eslint/js': 10.0.1(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))
-      '@microsoft/tsdoc': 0.17.0
+      '@microsoft/tsdoc': 0.17.1
       '@stylistic/eslint-plugin': 6.0.0-beta.6(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))
-      '@typescript-eslint/typescript-estree': 8.67.0(supports-color@7.2.0)(typescript@6.0.3)
-      '@typescript-eslint/utils': 8.67.0(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)
+      '@typescript-eslint/typescript-estree': 8.71.0(supports-color@7.2.0)(typescript@6.0.3)
+      '@typescript-eslint/utils': 8.71.0(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)
       eslint: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
       eslint-plugin-jsdoc: 64.3.6(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)
-      eslint-plugin-json-canonical: 2.1.0(@eslint/json@2.1.0)(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))
+      eslint-plugin-json-canonical: 2.1.3(@eslint/json@2.1.0)(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))
       eslint-plugin-tsdoc: 0.5.4(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)
       minimatch: 10.2.6
       ts-api-utils: 2.5.0(typescript@6.0.3)
@@ -9460,8 +9420,6 @@ snapshots:
       jju: 1.4.0
       resolve: 1.22.12
 
-  '@microsoft/tsdoc@0.17.0': {}
-
   '@microsoft/tsdoc@0.17.1': {}
 
   '@napi-rs/lzma-linux-x64-gnu@1.5.1':
@@ -10335,17 +10293,8 @@ snapshots:
 
   '@typescript-eslint/project-service@8.56.1(supports-color@7.2.0)(typescript@6.0.3)':
     dependencies:
-      '@typescript-eslint/tsconfig-utils': 8.56.1(typescript@6.0.3)
-      '@typescript-eslint/types': 8.56.1
-      debug: 4.4.3(supports-color@7.2.0)
-      typescript: 6.0.3
-    transitivePeerDependencies:
-      - supports-color
-
-  '@typescript-eslint/project-service@8.67.0(supports-color@7.2.0)(typescript@6.0.3)':
-    dependencies:
-      '@typescript-eslint/tsconfig-utils': 8.67.0(typescript@6.0.3)
-      '@typescript-eslint/types': 8.67.0
+      '@typescript-eslint/tsconfig-utils': 8.71.0(typescript@6.0.3)
+      '@typescript-eslint/types': 8.71.0
       debug: 4.4.3(supports-color@7.2.0)
       typescript: 6.0.3
     transitivePeerDependencies:
@@ -10365,11 +10314,6 @@ snapshots:
       '@typescript-eslint/types': 8.56.1
       '@typescript-eslint/visitor-keys': 8.56.1
 
-  '@typescript-eslint/scope-manager@8.67.0':
-    dependencies:
-      '@typescript-eslint/types': 8.67.0
-      '@typescript-eslint/visitor-keys': 8.67.0
-
   '@typescript-eslint/scope-manager@8.71.0':
     dependencies:
       '@typescript-eslint/types': 8.71.0
@@ -10379,10 +10323,6 @@ snapshots:
     dependencies:
       typescript: 6.0.3
 
-  '@typescript-eslint/tsconfig-utils@8.67.0(typescript@6.0.3)':
-    dependencies:
-      typescript: 6.0.3
-
   '@typescript-eslint/tsconfig-utils@8.71.0(typescript@6.0.3)':
     dependencies:
       typescript: 6.0.3
@@ -10401,8 +10341,6 @@ snapshots:
 
   '@typescript-eslint/types@8.56.1': {}
 
-  '@typescript-eslint/types@8.67.0': {}
-
   '@typescript-eslint/types@8.71.0': {}
 
   '@typescript-eslint/typescript-estree@8.56.1(supports-color@7.2.0)(typescript@6.0.3)':
@@ -10420,21 +10358,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/typescript-estree@8.67.0(supports-color@7.2.0)(typescript@6.0.3)':
-    dependencies:
-      '@typescript-eslint/project-service': 8.67.0(supports-color@7.2.0)(typescript@6.0.3)
-      '@typescript-eslint/tsconfig-utils': 8.67.0(typescript@6.0.3)
-      '@typescript-eslint/types': 8.67.0
-      '@typescript-eslint/visitor-keys': 8.67.0
-      debug: 4.4.3(supports-color@7.2.0)
-      minimatch: 10.2.6
-      semver: 7.8.5
-      tinyglobby: 0.2.17
-      ts-api-utils: 2.5.0(typescript@6.0.3)
-      typescript: 6.0.3
-    transitivePeerDependencies:
-      - supports-color
-
   '@typescript-eslint/typescript-estree@8.71.0(supports-color@7.2.0)(typescript@6.0.3)':
     dependencies:
       '@typescript-eslint/project-service': 8.71.0(supports-color@7.2.0)(typescript@6.0.3)
@@ -10461,17 +10384,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/utils@8.67.0(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)':
-    dependencies:
-      '@eslint-community/eslint-utils': 4.10.1(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))
-      '@typescript-eslint/scope-manager': 8.67.0
-      '@typescript-eslint/types': 8.67.0
-      '@typescript-eslint/typescript-estree': 8.67.0(supports-color@7.2.0)(typescript@6.0.3)
-      eslint: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
-      typescript: 6.0.3
-    transitivePeerDependencies:
-      - supports-color
-
   '@typescript-eslint/utils@8.71.0(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))(supports-color@7.2.0)(typescript@6.0.3)':
     dependencies:
       '@eslint-community/eslint-utils': 4.10.1(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0))
@@ -10488,11 +10400,6 @@ snapshots:
       '@typescript-eslint/types': 8.56.1
       eslint-visitor-keys: 5.0.1
 
-  '@typescript-eslint/visitor-keys@8.67.0':
-    dependencies:
-      '@typescript-eslint/types': 8.67.0
-      eslint-visitor-keys: 5.0.1
-
   '@typescript-eslint/visitor-keys@8.71.0':
     dependencies:
       '@typescript-eslint/types': 8.71.0
@@ -11598,7 +11505,7 @@ snapshots:
       - supports-color
       - typescript
 
-  eslint-plugin-json-canonical@2.1.0(@eslint/json@2.1.0)(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0)):
+  eslint-plugin-json-canonical@2.1.3(@eslint/json@2.1.0)(eslint@10.12.0(jiti@2.7.0)(supports-color@7.2.0)):
     dependencies:
       '@eslint/json': 2.1.0
       eslint: 10.12.0(jiti@2.7.0)(supports-color@7.2.0)
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 4f88567..ac50645 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -28,6 +28,7 @@ minimumReleaseAgeExclude:
   - "@exadev/json-compose"
   - "@exadev/semantic-release-workspace"
   - cosmiconfig-extends
+  - eslint-plugin-json-canonical
   - trilean
   - trilean-regex
 
@@ -40,7 +41,7 @@ catalog:
   "@eslint/js": 10.0.1
   "@eslint/json": 2.1.0
   "@eslint/markdown": 8.0.3
-  "@exadev/eslint-config": 2.36.3
+  "@exadev/eslint-config": 3.1.0
   "@exadev/semantic-release-workspace": 3.1.29
   "@orpc/client": 2.0.0-beta.41
   "@orpc/contract": 2.0.0-beta.41

From f8cf684f06bf4f52a2ac137456fabfc0ea697cf9 Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 07:02:42 +0100
Subject: [PATCH 30/31] build(lint): declare process-graph's subpath modules as
 barrel entries

packageLintConfig takes the package's other entry files and passes them to
exadev/barrel-policy's entries option, so process-graph's subpath modules are
held to re-exports like src/index.ts instead of having the rule turned off.
---
 eslint.shared.ts                                | 13 ++++++++++++-
 packages/targets/process-graph/eslint.config.ts |  8 ++------
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/eslint.shared.ts b/eslint.shared.ts
index c4bf776..9b8b1ca 100644
--- a/eslint.shared.ts
+++ b/eslint.shared.ts
@@ -164,6 +164,9 @@ export interface PackageLintOptions {
   /** `@exadev/eslint-config`'s own `exadev/barrel-policy` rule defaults to `"banned"` in its recommended type-checked preset. Every published package here exposes exactly one barrel at `src/index.ts`, so this defaults to `"single"` instead. It explicitly overrides the base preset's own default, rather than merely relying on it. */
   readonly barrelPolicy?: "banned" | "single" | "siblings" | "off";
 
+  /** The package's other entry files, beside `src/index.ts`: the modules behind its subpath exports, as globs relative to the package. Each is held to the barrel rules (only re-exports) and may re-export another package's surface, as `src/index.ts` may. A package with a single entry point gives none. */
+  readonly barrelEntries?: readonly string[];
+
   /**
    * Set for a package that renders React components: `.tsx` files get `@exadev/eslint-config`'s React block (eslint-plugin-react with the automatic JSX runtime, the hooks rules and the jsx-a11y rules). `version` is the React version the rules assume; pass React's own `version` export, so it follows the package's dependency. eslint-plugin-react's `"detect"` cannot be used, because it reads the file name through a context method ESLint 10 removed.
    */
@@ -182,6 +185,7 @@ export function packageLintConfig(options: PackageLintOptions): Config[] {
     isomorphicExemptions = [],
     additionalRestrictedSyntax = [],
     barrelPolicy = "single",
+    barrelEntries = [],
     react,
   } = options;
 
@@ -239,7 +243,14 @@ export function packageLintConfig(options: PackageLintOptions): Config[] {
         ],
         "@typescript-eslint/no-non-null-assertion": nonNullAssertion,
         "exadev/barrel-policy":
-          barrelPolicy === "off" ? "off" : ["error", { mode: barrelPolicy }],
+          barrelPolicy === "off"
+            ? "off"
+            : [
+                "error",
+                barrelEntries.length === 0
+                  ? { mode: barrelPolicy }
+                  : { mode: barrelPolicy, entries: [...barrelEntries] },
+              ],
       },
     },
     {
diff --git a/packages/targets/process-graph/eslint.config.ts b/packages/targets/process-graph/eslint.config.ts
index 6bade62..9560b24 100644
--- a/packages/targets/process-graph/eslint.config.ts
+++ b/packages/targets/process-graph/eslint.config.ts
@@ -1,7 +1,7 @@
 import { defineConfig } from "eslint/config";
 import { packageLintConfig } from "../../../eslint.shared.ts";
 
-/** The modules behind the package's subpath exports other than the root, each a pure re-export of the private packages that subpath bundles. */
+/** The modules behind the package's subpath exports other than the root, each a pure re-export of the private packages that subpath bundles, declared as entry points so the barrel rules hold them to re-exports as they do `src/index.ts`. */
 const subpathEntries = [
   "src/layout.ts",
   "src/source/github.ts",
@@ -25,6 +25,7 @@ export default defineConfig(
       "./tsconfig.browser.json",
     ],
     isomorphic: true,
+    barrelEntries: subpathEntries,
     // The browser integration test starts workers on the bundled browser store.
     browserGlobals: true,
     // The bin is a Node launcher that is run, never imported, and these subpaths are the Node-only ones by design; the root entry and every other subpath stay isomorphic.
@@ -35,9 +36,4 @@ export default defineConfig(
       "src/source/github/node.ts",
     ],
   }),
-  {
-    // Every subpath of this package is an entry point whose whole content is a re-export, the same as `src/index.ts`. The policy's `single` mode recognises only `src/index.ts` as an entry point (https://github.com/ExaDev/eslint-config/issues/135), so the subpath modules are declared here instead; each still contains nothing but re-exports, and `entrypoints.unit.test.ts` and the smoke test check each one's surface against the packages it bundles.
-    files: subpathEntries,
-    rules: { "exadev/barrel-policy": "off" },
-  },
 );

From 966bb263e1dd3f440171f9bf7d524bbc9f9150aa Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Sun, 11 Oct 2026 08:17:51 +0100
Subject: [PATCH 31/31] test(cli): set the umask in a child process for the
 store mode checks

Only a main thread may set the umask, and Vitest runs tests in worker threads,
under Stryker always, so the dry run failed. A probe script opens the default
store in a process of its own under umask 022 and 000 and prints the modes it
made; the narrowing and user-path cases need no umask and stay in process.
---
 .../graph-cli/src/data-file.unit.test.ts      | 55 ++++++++++---------
 .../targets/graph-cli/test/umask-probe.ts     | 42 ++++++++++++++
 2 files changed, 71 insertions(+), 26 deletions(-)
 create mode 100644 packages/targets/graph-cli/test/umask-probe.ts

diff --git a/packages/targets/graph-cli/src/data-file.unit.test.ts b/packages/targets/graph-cli/src/data-file.unit.test.ts
index e7eeaca..fffceea 100644
--- a/packages/targets/graph-cli/src/data-file.unit.test.ts
+++ b/packages/targets/graph-cli/src/data-file.unit.test.ts
@@ -6,9 +6,10 @@ import {
   statSync,
   writeFileSync,
 } from "node:fs";
+import { spawnSync } from "node:child_process";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
-import { emptyModel } from "@exadev/process-graph-store-contract";
+import { fileURLToPath } from "node:url";
 import { afterEach, beforeEach, describe, expect, test } from "vitest";
 import {
   prepareDataFile,
@@ -21,6 +22,10 @@ import { runCli } from "./program.ts";
 
 /** A umask that leaves new files readable by group and others, the usual default, so a test fails if the code relies on the umask for privacy. */
 const permissiveUmask = 0o022;
+/** A umask that removes nothing, so every mode the code asks for is the mode it gets. */
+const openUmask = 0o000;
+/** The radix the probe reads its umask argument in. */
+const octal = 8;
 /** The modes such a umask gives a new directory and file. */
 const looseDirectoryMode = 0o755;
 const looseFileMode = 0o644;
@@ -29,19 +34,19 @@ const permissionBits = 0o777;
 
 const modeOf = (path: string): number => statSync(path).mode & permissionBits;
 
-let previousUmask: number;
 let directory: string;
 
 beforeEach(() => {
-  previousUmask = process.umask(permissiveUmask);
   directory = mkdtempSync(join(tmpdir(), "process-graph-data-"));
 });
 
 afterEach(() => {
-  process.umask(previousUmask);
   rmSync(directory, { recursive: true, force: true });
 });
 
+/** The probe that opens a default store under a given umask, in a process of its own, since only a main thread may set the umask and Vitest runs tests in worker threads. */
+const probe = fileURLToPath(new URL("../test/umask-probe.ts", import.meta.url));
+
 /** The Node ports with the XDG data directory inside the test's directory, so the default store is the command line's own. */
 const portsIn = (stderr: (text: string) => void = () => undefined) =>
   nodePorts({
@@ -51,34 +56,32 @@ const portsIn = (stderr: (text: string) => void = () => undefined) =>
   });
 
 describe("the command line's own default store", () => {
-  test("is created private, with the directories it creates, the database and the -wal and -shm files SQLite derives from it", async () => {
-    const ports = portsIn();
-    const path = ports.defaultDataPath;
-    const opened = await ports.openStore(path);
-    try {
-      await opened.client.v1.models.save({
-        modelId: "default",
-        model: emptyModel,
-      });
-
-      expect(opened.warnings).toEqual([]);
-      expect({
-        xdg: modeOf(join(directory, "xdg")),
-        app: modeOf(dirname(path)),
-        database: modeOf(path),
-        wal: modeOf(`${path}-wal`),
-        shm: modeOf(`${path}-shm`),
-      }).toEqual({
+  test.each([
+    { name: "the usual 022", umask: permissiveUmask },
+    { name: "000, which narrows nothing", umask: openUmask },
+  ])(
+    "under a umask of $name, is created private, with the directories it creates, the database and the -wal and -shm files SQLite derives from it",
+    ({ umask }) => {
+      const result = spawnSync(
+        process.execPath,
+        [probe, umask.toString(octal), directory],
+        { encoding: "utf8" },
+      );
+      if (result.status !== 0) {
+        throw new Error(result.stderr);
+      }
+      const modes: unknown = JSON.parse(result.stdout);
+
+      expect(modes).toEqual({
+        warnings: [],
         xdg: privateDirectoryMode,
         app: privateDirectoryMode,
         database: privateFileMode,
         wal: privateFileMode,
         shm: privateFileMode,
       });
-    } finally {
-      await opened.close();
-    }
-  });
+    },
+  );
 
   test("is narrowed when it already exists readable by others, and the command line says so on standard error", async () => {
     let stderr = "";
diff --git a/packages/targets/graph-cli/test/umask-probe.ts b/packages/targets/graph-cli/test/umask-probe.ts
new file mode 100644
index 0000000..ec0f61d
--- /dev/null
+++ b/packages/targets/graph-cli/test/umask-probe.ts
@@ -0,0 +1,42 @@
+import { statSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { emptyModel } from "@exadev/process-graph-store-contract";
+import { nodePorts } from "../src/node.ts";
+
+/**
+ * Run as its own process by `data-file.unit.test.ts`, because only a main thread may set the umask and Vitest (under Stryker especially) runs tests in worker threads. Arguments: the umask as an octal string, and a directory to use as the XDG data directory's parent. It sets the umask, opens the command line's own default store there, writes to it, and prints the permission bits of each directory and file it made, and the warnings the port returned, as one JSON object, while the store is still open so SQLite's `-wal` and `-shm` files exist.
+ */
+
+const [umask, directory] = process.argv.slice(2);
+if (umask === undefined || directory === undefined) {
+  throw new Error("usage: umask-probe.ts <octal umask> <directory>");
+}
+
+/** The radix of the umask argument. */
+const octal = 8;
+/** The permission bits of a mode. */
+const permissionBits = 0o777;
+
+process.umask(Number.parseInt(umask, octal));
+const ports = nodePorts({
+  env: { XDG_DATA_HOME: join(directory, "xdg") },
+  home: directory,
+});
+const path = ports.defaultDataPath;
+const opened = await ports.openStore(path);
+try {
+  await opened.client.v1.models.save({ modelId: "default", model: emptyModel });
+  const modeOf = (file: string): number => statSync(file).mode & permissionBits;
+  process.stdout.write(
+    JSON.stringify({
+      warnings: opened.warnings,
+      xdg: modeOf(join(directory, "xdg")),
+      app: modeOf(dirname(path)),
+      database: modeOf(path),
+      wal: modeOf(`${path}-wal`),
+      shm: modeOf(`${path}-shm`),
+    }),
+  );
+} finally {
+  await opened.close();
+}