@@ -807,6 +807,22 @@ async function ensureEsmPackageType(cwd: string, result: InitResult): Promise<vo
         "installed. Run your package manager's install before `meta gen`.",
     );
   }
+  // Never degrade in silence. The first version of this returned `{}` on any failure to
+  // read runtime-ts's peer ranges and skipped the three packages that come from them —
+  // which is exactly what happened against the published package, and the run looked
+  // successful while leaving the project with the six TS2307s this code exists to
+  // prevent. A fallback that cannot be observed is indistinguishable from a bug.
+  const undeclarable = SCAFFOLD_OUTPUT_PEERS.filter(
+    (name) => !declaredDependencyNames(pkg as PackageManifest).has(name),
+  );
+  if (undeclarable.length > 0) {
+    result.warnings.push(
+      `could NOT declare ${undeclarable.join(" + ")} — the version ranges are read from ` +
+        "@metaobjectsdev/runtime-ts's own peerDependencies and that manifest could not be " +
+        "read. Generated code imports them, so add them to dependencies by hand or " +
+        "`npx tsc` will report TS2307 on files `meta gen` writes.",
+    );
+  }
 }
 
 /**
@@ -904,13 +920,39 @@ function scaffoldRuntimeDependencies(): Record<string, string> {
   return wanted;
 }
 
-/** `@metaobjectsdev/runtime-ts`'s declared peer ranges, or `{}` if it cannot be read. */
+/**
+ * `@metaobjectsdev/runtime-ts`'s declared peer ranges, or `{}` if they cannot be read.
+ *
+ * Resolves the package's ENTRY and walks up to the nearest package.json, rather than
+ * asking for `"@metaobjectsdev/runtime-ts/package.json"` directly. That direct form is
+ * the obvious one and it is WRONG: a package's `exports` map gates every subpath, and
+ * runtime-ts's exports are `.` / `./drivers` / `./fastify` / `./drizzle-fastify` /
+ * `./hono` — no `./package.json`. Under real Node it throws
+ * ERR_PACKAGE_PATH_NOT_EXPORTED. It appeared to work here only because the workspace
+ * runs this under bun against a symlinked source tree; against the published package it
+ * failed on the first try, silently, and `meta init` declared one package instead of
+ * four. Resolving the entry is never gated — `.` is the one subpath every package
+ * exports — so this form works under npm, pnpm, bun and a linked checkout alike.
+ */
 function runtimeTsPeerRanges(): Record<string, string> {
   try {
     const req = createRequire(import.meta.url);
-    const manifestPath = req.resolve("@metaobjectsdev/runtime-ts/package.json");
-    const manifest = JSON.parse(readFileSyncWrap(manifestPath, "utf8")) as PackageManifest;
-    return (manifest.peerDependencies ?? {}) as Record<string, string>;
+    let dir = dirname(req.resolve("@metaobjectsdev/runtime-ts"));
+    // The entry sits under dist/; the manifest is at the package root above it.
+    for (let hops = 0; hops < 8; hops++) {
+      const candidate = join(dir, "package.json");
+      if (existsSyncWrap(candidate)) {
+        const manifest = JSON.parse(readFileSyncWrap(candidate, "utf8")) as PackageManifest & { name?: string };
+        // Guard against stopping at a nested manifest that is not the package itself.
+        if (manifest.name === "@metaobjectsdev/runtime-ts") {
+          return (manifest.peerDependencies ?? {}) as Record<string, string>;
+        }
+      }
+      const up = dirname(dir);
+      if (up === dir) break;
+      dir = up;
+    }
+    return {};
   } catch {
     return {};
   }
 
@@ -0,0 +1,80 @@
+// A `require.resolve("<pkg>/package.json")` only works if that package EXPORTS the
+// subpath. Most of ours do not.
+//
+// `meta init` reads `@metaobjectsdev/runtime-ts`'s peerDependencies to learn the version
+// ranges it declares for the adopter, and asked for them with
+// `resolve("@metaobjectsdev/runtime-ts/package.json")`. runtime-ts's exports map is
+// `.` / `./drivers` / `./fastify` / `./drizzle-fastify` / `./hono` — no `./package.json` —
+// so under real Node that throws ERR_PACKAGE_PATH_NOT_EXPORTED. The call site caught the
+// throw and returned `{}`, so `meta init` declared ONE package instead of four and said
+// nothing, and the project it had just scaffolded failed `npx tsc` with six TS2307s.
+//
+// It passed every test in this package. The workspace runs the CLI under bun against a
+// symlinked source tree, where the subpath resolves; only a real external install has the
+// exports map in force. The release smoke test caught it — after publishing rc.4.
+//
+// This check needs no install and no runtime: for each `resolve("X/package.json")` in the
+// CLI's source, read X's own manifest and require that it either has no `exports` map
+// (all subpaths open) or explicitly exports `./package.json`. Resolving a package's ENTRY
+// is always allowed, so walking up from there is the portable form.
+import { describe, test, expect } from "bun:test";
+import { readFileSync, existsSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+const SRC = join(import.meta.dirname, "..", "src");
+
+function tsFiles(dir: string): string[] {
+  return readdirSync(dir).flatMap((e) => {
+    const full = join(dir, e);
+    if (statSync(full).isDirectory()) return tsFiles(full);
+    return full.endsWith(".ts") ? [full] : [];
+  });
+}
+
+/** The package this repo publishes under `name`, or undefined if it is not ours. */
+function workspaceManifest(name: string): Record<string, unknown> | undefined {
+  const short = name.replace("@metaobjectsdev/", "");
+  for (const root of ["server/typescript/packages", "client/web/packages"]) {
+    const p = join(import.meta.dirname, "..", "..", "..", "..", "..", root, short, "package.json");
+    if (existsSync(p)) return JSON.parse(readFileSync(p, "utf8")) as Record<string, unknown>;
+  }
+  return undefined;
+}
+
+describe("the CLI never resolves a package.json subpath a package does not export", () => {
+  test("every resolve(\"<pkg>/package.json\") names a package that exports it", () => {
+    const offenders: string[] = [];
+    for (const file of tsFiles(SRC)) {
+      const source = readFileSync(file, "utf8");
+      for (const m of source.matchAll(/resolve\(\s*["'`]([^"'`]+)\/package\.json["'`]/g)) {
+        const pkg = m[1];
+        if (pkg === undefined || pkg.startsWith(".")) continue;   // a path, not a specifier
+        const manifest = workspaceManifest(pkg);
+        // Not one of ours: we cannot read its exports map here, and asking for a
+        // third party's package.json is the same gamble. Flag it either way.
+        if (manifest === undefined) {
+          offenders.push(`${file.replace(SRC, "src")}: ${pkg} (not a workspace package — exports unknown)`);
+          continue;
+        }
+        const exportsMap = manifest.exports as Record<string, unknown> | undefined;
+        if (exportsMap !== undefined && !("./package.json" in exportsMap)) {
+          offenders.push(
+            `${file.replace(SRC, "src")}: ${pkg} has an exports map without "./package.json" — ` +
+            "this throws ERR_PACKAGE_PATH_NOT_EXPORTED on a real install",
+          );
+        }
+      }
+    }
+    expect(offenders).toEqual([]);
+  });
+
+  test("runtime-ts really does withhold ./package.json, so the rule above is not vacuous", () => {
+    // If runtime-ts ever exports it, this test says so rather than quietly becoming a
+    // check with nothing left to check.
+    const manifest = workspaceManifest("@metaobjectsdev/runtime-ts");
+    expect(manifest).toBeDefined();
+    const exportsMap = manifest?.exports as Record<string, unknown> | undefined;
+    expect(exportsMap).toBeDefined();
+    expect(Object.keys(exportsMap ?? {})).not.toContain("./package.json");
+  });
+});