@orkestrel/scaffold 0.0.21 → 0.0.22

package/dist/src/server/index.d.cts

@@ -139,9 +139,10 @@ export declare const DEFAULT_SYNC_TIMEOUT = 10000;
  * and the name satisfies `isWorkspaceName`; every other name is a coded
  * `TARGET` failure. `src` is derived from `src/<environment>/` and `app` from
  * `app/<environment>/`; a target with no environment on either axis is also a coded
- * `TARGET` failure. The `bin`, `integration`, and `service` facts probe physical
- * directories at `src/bin`, `tests/integration`, and `tests/service`, respectively,
- * while `global` probes the physical exact-case `tests/setupGlobal.ts` file and `showcase`
+ * `TARGET` failure. The `bin` and `integration` facts probe physical
+ * directories at `src/bin` and `tests/integration`. `services` is the sorted
+ * set of direct vendor directories under `tests/service` that contain a test
+ * at any depth, while `global` probes the physical exact-case `tests/setupGlobal.ts` file and `showcase`
  * probes the physical exact-case `configs/app/vite.showcase.config.ts` regular file; none is
  * inferred from the workspace name. `dependencies` /
  * `peers` are the `@orkestrel/`-prefixed entries of `manifest.dependencies` /
@@ -161,8 +162,8 @@ export declare const DEFAULT_SYNC_TIMEOUT = 10000;
  * @throws `ScaffoldError('TARGET', …)` when `target`'s manifest is unreadable
  *   (via `readManifest`), is not valid JSON, its name is unsafe for its
  *   publication mode, or `target` carries no source or application environment.
- * @throws `ScaffoldError('TARGET', …)` when `tests/service` exists without the
- *   physical companion files `tests/setupService.ts` and `scripts/service.sh`.
+ * @throws `ScaffoldError('INVALID', …)` when service tests use the retired flat
+ *   layout, a vendor directory has no test, or a service companion is missing.
  *
  * @example
  * ```ts
@@ -189,6 +190,15 @@ export declare function digestFile(path: string): string;
  */
 export declare function digestHex(hex: string): string;
 
+/**
+ * Digest the exact declared membership of a vendored host manifest.
+ *
+ * @param entries - The ordered file membership declarations.
+ * @param roots - The ordered directory membership declarations.
+ * @returns A SHA-256 digest independent of the manifest's stored digest field.
+ */
+export declare function digestHostManifest(entries: readonly ManifestEntry[], roots: readonly string[]): string;
+
 /**
  * Compute SHA-256 from UTF-8 text.
  *
@@ -264,6 +274,8 @@ export declare const HOST_MANIFEST_PATH = "manifest.json";
 export declare interface HostManifest {
     readonly entries: readonly ManifestEntry[];
     readonly roots: readonly string[];
+    /** SHA-256 of the exact declared entry/root membership. */
+    readonly digest: string;
 }
 
 /**
@@ -329,7 +341,7 @@ export declare function isFilesystemPath(value: unknown): value is string;
  * Narrow a value to one exact complete vendored-host manifest.
  *
  * @param value - The candidate manifest value.
- * @returns `true` only for an exact `{ entries, roots }` record with safe paths.
+ * @returns `true` only for an exact `{ entries, roots, digest }` record with safe paths.
  */
 export declare function isHostManifest(value: unknown): value is HostManifest;
 
@@ -460,6 +472,7 @@ export declare function listFiles(root: string): readonly string[];
  *   {
  *     entries: [{ storage: 'pkg.tmpl', destination: 'package.json', executable: false }],
  *     roots: [],
+ *     digest: '3b52f19450237ea4cfb39bc7a77b1e5094b52a8ff1fc9c02fd68b13ad088aa0f',
  *   },
  *   'package.json',
  *   './dist/host',
@@ -485,9 +498,10 @@ export declare interface ManifestEntry {
  * (`ScaffoldError('TARGET', …)`), then byte-copies each `host` artifact from
  * the `host` root and writes each `template` / `computed` artifact's rendered
  * `content`, failing fast on any write error (`ScaffoldError('WRITE', …)`).
- * `repair` is into-existing: it skips the vacancy check and writes ONLY the
- * `missing` / `stale` artifacts an `Audit` names, leaving `aligned` ones
- * untouched. Hydrated directory-shaped host entries are expanded into
+ * `repair` is into-existing: it skips the vacancy check and writes `missing`
+ * artifacts an `Audit` names. `stale` artifacts are report-only unless its
+ * `replace` switch is true, because byte replacement discards local changes.
+ * Hydrated directory-shaped host entries are expanded into
  * file-shaped artifacts, so canonical skills and agent configuration are
  * audited and repaired file by file. `prune` deletes stale files under
  * `target/.claude/agents/`, `target/.codex/agents/`, and `target/scripts/`
@@ -518,9 +532,10 @@ export declare interface ManifestEntry {
  * source is always staged by `stageHost`, so a non-guide zero-match means a
  * corrupted or truncated `manifest.json`, not an intentionally-unvendored
  * artifact. For a guide pointer, a short stub file is written at the
- * destination and reported exactly like a successful copy, mirroring the
- * READ path (`hydratePlan` leaves such artifacts `content`-undefined, so
- * `diffPlan` audits them by PRESENCE only). For every OTHER zero-match, the
+ * destination and reported exactly like a successful copy. The READ path
+ * leaves that intentional pointer without canonical bytes, so `diffPlan`
+ * treats it as presence-owned rather than inventing a byte match.
+ * For every OTHER zero-match, the
  * fail-closed `ScaffoldError('TARGET', …)` is thrown — degrading an
  * unscoped zero-match would otherwise let a corrupted manifest silently stub
  * an unrecoverable artifact (e.g. `AGENTS.md` — `pull` only ever fetches
@@ -567,7 +582,7 @@ export declare class Materializer implements MaterializerInterface {
     constructor(options?: MaterializerOptions);
     get emitter(): EmitterInterface<MaterializerEventMap>;
     materialize(plan: Plan, target: string): MaterializeResult;
-    repair(plan: Plan, audit: Audit, target: string): MaterializeResult;
+    repair(plan: Plan, audit: Audit, target: string, replace?: boolean): MaterializeResult;
     prune(target: string, expected: Readonly<Record<string, string>>): MaterializeResult;
     destroy(): void;
 }
@@ -595,7 +610,7 @@ export declare type MaterializerEventMap = {
 export declare interface MaterializerInterface {
     readonly emitter: EmitterInterface<MaterializerEventMap>;
     materialize(plan: Plan, target: string): MaterializeResult;
-    repair(plan: Plan, audit: Audit, target: string): MaterializeResult;
+    repair(plan: Plan, audit: Audit, target: string, replace?: boolean): MaterializeResult;
     prune(target: string, expected: Snapshot): MaterializeResult;
     destroy(): void;
 }
@@ -804,8 +819,9 @@ export declare function readGuideReferences(target: string, names: readonly stri
  *   `manifest.json` — the raw-repo-root fallback (`Materializer` then maps
  *   an artifact's `source` to `host` 1:1, no vendored staging indirection).
  * @throws `ScaffoldError('TARGET', …)` when `manifest.json` exists but is
- *   unreadable, malformed, collision-prone, root-incomplete, or does not map
- *   bijectively and case-exactly onto real contained storage files.
+ *   unreadable, malformed, membership-corrupted, collision-prone,
+ *   root-incomplete, or does not map bijectively and case-exactly onto real
+ *   contained storage files.
  *
  * @example
  * ```ts

package/dist/src/server/index.d.ts

@@ -139,9 +139,10 @@ export declare const DEFAULT_SYNC_TIMEOUT = 10000;
  * and the name satisfies `isWorkspaceName`; every other name is a coded
  * `TARGET` failure. `src` is derived from `src/<environment>/` and `app` from
  * `app/<environment>/`; a target with no environment on either axis is also a coded
- * `TARGET` failure. The `bin`, `integration`, and `service` facts probe physical
- * directories at `src/bin`, `tests/integration`, and `tests/service`, respectively,
- * while `global` probes the physical exact-case `tests/setupGlobal.ts` file and `showcase`
+ * `TARGET` failure. The `bin` and `integration` facts probe physical
+ * directories at `src/bin` and `tests/integration`. `services` is the sorted
+ * set of direct vendor directories under `tests/service` that contain a test
+ * at any depth, while `global` probes the physical exact-case `tests/setupGlobal.ts` file and `showcase`
  * probes the physical exact-case `configs/app/vite.showcase.config.ts` regular file; none is
  * inferred from the workspace name. `dependencies` /
  * `peers` are the `@orkestrel/`-prefixed entries of `manifest.dependencies` /
@@ -161,8 +162,8 @@ export declare const DEFAULT_SYNC_TIMEOUT = 10000;
  * @throws `ScaffoldError('TARGET', …)` when `target`'s manifest is unreadable
  *   (via `readManifest`), is not valid JSON, its name is unsafe for its
  *   publication mode, or `target` carries no source or application environment.
- * @throws `ScaffoldError('TARGET', …)` when `tests/service` exists without the
- *   physical companion files `tests/setupService.ts` and `scripts/service.sh`.
+ * @throws `ScaffoldError('INVALID', …)` when service tests use the retired flat
+ *   layout, a vendor directory has no test, or a service companion is missing.
  *
  * @example
  * ```ts
@@ -189,6 +190,15 @@ export declare function digestFile(path: string): string;
  */
 export declare function digestHex(hex: string): string;
 
+/**
+ * Digest the exact declared membership of a vendored host manifest.
+ *
+ * @param entries - The ordered file membership declarations.
+ * @param roots - The ordered directory membership declarations.
+ * @returns A SHA-256 digest independent of the manifest's stored digest field.
+ */
+export declare function digestHostManifest(entries: readonly ManifestEntry[], roots: readonly string[]): string;
+
 /**
  * Compute SHA-256 from UTF-8 text.
  *
@@ -264,6 +274,8 @@ export declare const HOST_MANIFEST_PATH = "manifest.json";
 export declare interface HostManifest {
     readonly entries: readonly ManifestEntry[];
     readonly roots: readonly string[];
+    /** SHA-256 of the exact declared entry/root membership. */
+    readonly digest: string;
 }
 
 /**
@@ -329,7 +341,7 @@ export declare function isFilesystemPath(value: unknown): value is string;
  * Narrow a value to one exact complete vendored-host manifest.
  *
  * @param value - The candidate manifest value.
- * @returns `true` only for an exact `{ entries, roots }` record with safe paths.
+ * @returns `true` only for an exact `{ entries, roots, digest }` record with safe paths.
  */
 export declare function isHostManifest(value: unknown): value is HostManifest;
 
@@ -460,6 +472,7 @@ export declare function listFiles(root: string): readonly string[];
  *   {
  *     entries: [{ storage: 'pkg.tmpl', destination: 'package.json', executable: false }],
  *     roots: [],
+ *     digest: '3b52f19450237ea4cfb39bc7a77b1e5094b52a8ff1fc9c02fd68b13ad088aa0f',
  *   },
  *   'package.json',
  *   './dist/host',
@@ -485,9 +498,10 @@ export declare interface ManifestEntry {
  * (`ScaffoldError('TARGET', …)`), then byte-copies each `host` artifact from
  * the `host` root and writes each `template` / `computed` artifact's rendered
  * `content`, failing fast on any write error (`ScaffoldError('WRITE', …)`).
- * `repair` is into-existing: it skips the vacancy check and writes ONLY the
- * `missing` / `stale` artifacts an `Audit` names, leaving `aligned` ones
- * untouched. Hydrated directory-shaped host entries are expanded into
+ * `repair` is into-existing: it skips the vacancy check and writes `missing`
+ * artifacts an `Audit` names. `stale` artifacts are report-only unless its
+ * `replace` switch is true, because byte replacement discards local changes.
+ * Hydrated directory-shaped host entries are expanded into
  * file-shaped artifacts, so canonical skills and agent configuration are
  * audited and repaired file by file. `prune` deletes stale files under
  * `target/.claude/agents/`, `target/.codex/agents/`, and `target/scripts/`
@@ -518,9 +532,10 @@ export declare interface ManifestEntry {
  * source is always staged by `stageHost`, so a non-guide zero-match means a
  * corrupted or truncated `manifest.json`, not an intentionally-unvendored
  * artifact. For a guide pointer, a short stub file is written at the
- * destination and reported exactly like a successful copy, mirroring the
- * READ path (`hydratePlan` leaves such artifacts `content`-undefined, so
- * `diffPlan` audits them by PRESENCE only). For every OTHER zero-match, the
+ * destination and reported exactly like a successful copy. The READ path
+ * leaves that intentional pointer without canonical bytes, so `diffPlan`
+ * treats it as presence-owned rather than inventing a byte match.
+ * For every OTHER zero-match, the
  * fail-closed `ScaffoldError('TARGET', …)` is thrown — degrading an
  * unscoped zero-match would otherwise let a corrupted manifest silently stub
  * an unrecoverable artifact (e.g. `AGENTS.md` — `pull` only ever fetches
@@ -567,7 +582,7 @@ export declare class Materializer implements MaterializerInterface {
     constructor(options?: MaterializerOptions);
     get emitter(): EmitterInterface<MaterializerEventMap>;
     materialize(plan: Plan, target: string): MaterializeResult;
-    repair(plan: Plan, audit: Audit, target: string): MaterializeResult;
+    repair(plan: Plan, audit: Audit, target: string, replace?: boolean): MaterializeResult;
     prune(target: string, expected: Readonly<Record<string, string>>): MaterializeResult;
     destroy(): void;
 }
@@ -595,7 +610,7 @@ export declare type MaterializerEventMap = {
 export declare interface MaterializerInterface {
     readonly emitter: EmitterInterface<MaterializerEventMap>;
     materialize(plan: Plan, target: string): MaterializeResult;
-    repair(plan: Plan, audit: Audit, target: string): MaterializeResult;
+    repair(plan: Plan, audit: Audit, target: string, replace?: boolean): MaterializeResult;
     prune(target: string, expected: Snapshot): MaterializeResult;
     destroy(): void;
 }
@@ -804,8 +819,9 @@ export declare function readGuideReferences(target: string, names: readonly stri
  *   `manifest.json` — the raw-repo-root fallback (`Materializer` then maps
  *   an artifact's `source` to `host` 1:1, no vendored staging indirection).
  * @throws `ScaffoldError('TARGET', …)` when `manifest.json` exists but is
- *   unreadable, malformed, collision-prone, root-incomplete, or does not map
- *   bijectively and case-exactly onto real contained storage files.
+ *   unreadable, malformed, membership-corrupted, collision-prone,
+ *   root-incomplete, or does not map bijectively and case-exactly onto real
+ *   contained storage files.
  *
  * @example
  * ```ts

package/dist/src/server/index.js

@@ -1,4 +1,4 @@
-import { CONTROL_CHARACTER_PATTERN, DEFAULT_ENGINES, DEFAULT_VERSION, DEPENDENCY_NAME_PATTERN, ENVIRONMENTS, EXTRA_NAME_PATTERN, GLOBAL_SETUP_PATH, HEX_PATTERN, HOST_PATHS, INVALID_PATH_CHARACTER_PATTERN, MAX_ARTIFACT_BYTES, MAX_ARTIFACT_HEX_LENGTH, MAX_COLLECTION_ITEMS, MAX_DEPENDENCY_NAME_LENGTH, MAX_MANIFEST_BYTES, MAX_PATH_LENGTH, MAX_TOTAL_ARTIFACT_BYTES, SERVICE_SCRIPT_PATH, SHOWCASE_CONFIG_PATH, SYNC_BASELINE_PATTERN, ScaffoldError, VERSION_PATTERN, blueprint, bytesToHex, contentByteLength, devDependenciesFor, diffPlan, findFileConflict, findPathConflict, hasOnlyDataProperties, hasValidAuditBytes, hasValidSnapshotBytes, isDenseDataArray, isDependency, isEmitterErrorHandler, isPlan, isSyncReport, isWorkspaceName, manifestToDependencies, manifestToName, ownDataValue, parsePlan, parseSyncReport, rangeToFreshness, snapshotPlan, validateDependencyArray, validatePlan } from "../core/index.js";
+import { CONTROL_CHARACTER_PATTERN, DEFAULT_ENGINES, DEFAULT_VERSION, DEPENDENCY_NAME_PATTERN, ENVIRONMENTS, EXTRA_NAME_PATTERN, GLOBAL_SETUP_PATH, HEX_PATTERN, HOST_PATHS, INVALID_PATH_CHARACTER_PATTERN, MAX_ARTIFACT_BYTES, MAX_ARTIFACT_HEX_LENGTH, MAX_COLLECTION_ITEMS, MAX_DEPENDENCY_NAME_LENGTH, MAX_MANIFEST_BYTES, MAX_PATH_LENGTH, MAX_TOTAL_ARTIFACT_BYTES, SHOWCASE_CONFIG_PATH, SYNC_BASELINE_PATTERN, ScaffoldError, VERSION_PATTERN, blueprint, bytesToHex, contentByteLength, devDependenciesFor, diffPlan, findFileConflict, findPathConflict, hasOnlyDataProperties, hasValidAuditBytes, hasValidSnapshotBytes, isDenseDataArray, isDependency, isEmitterErrorHandler, isPlan, isSyncReport, isWorkspaceName, manifestToDependencies, manifestToName, ownDataValue, parsePlan, parseSyncReport, rangeToFreshness, snapshotPlan, stableStringify, validateDependencyArray, validatePlan } from "../core/index.js";
 import { attempt, booleanShape, createContract, integerShape, isError, isFunction, isRecord, isString, objectShape, optionalShape, parseJSON, parseJSONAs, stringShape } from "@orkestrel/contract";
 import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, constants, copyFileSync, existsSync, fstatSync, linkSync, lstatSync, mkdirSync, openSync, opendirSync, readSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, writeFileSync } from "node:fs";
@@ -255,7 +255,7 @@ function isManifestEntry(value) {
 * Narrow a value to one exact complete vendored-host manifest.
 *
 * @param value - The candidate manifest value.
-* @returns `true` only for an exact `{ entries, roots }` record with safe paths.
+* @returns `true` only for an exact `{ entries, roots, digest }` record with safe paths.
 */
 function isHostManifest(value) {
 	const result = attempt(() => {
@@ -263,7 +263,8 @@ function isHostManifest(value) {
 		const keys = Reflect.ownKeys(value);
 		const entries = Reflect.getOwnPropertyDescriptor(value, "entries");
 		const roots = Reflect.getOwnPropertyDescriptor(value, "roots");
-		return keys.length === 2 && keys.every((key) => key === "entries" || key === "roots") && entries !== void 0 && Reflect.has(entries, "value") && roots !== void 0 && Reflect.has(roots, "value") && isDenseDataArray(entries.value, 4096, isManifestEntry) && isDenseDataArray(roots.value, 4096, isPortablePath);
+		const digest = Reflect.getOwnPropertyDescriptor(value, "digest");
+		return keys.length === 3 && keys.every((key) => key === "entries" || key === "roots" || key === "digest") && entries !== void 0 && Reflect.has(entries, "value") && roots !== void 0 && Reflect.has(roots, "value") && digest !== void 0 && Reflect.has(digest, "value") && isDenseDataArray(entries.value, 4096, isManifestEntry) && isDenseDataArray(roots.value, 4096, isPortablePath) && typeof digest.value === "string" && WRITE_DIGEST_PATTERN.test(digest.value);
 	});
 	return result.success && result.value;
 }
@@ -938,6 +939,19 @@ function digestText(value) {
 	return createHash("sha256").update(value, "utf8").digest("hex");
 }
 /**
+* Digest the exact declared membership of a vendored host manifest.
+*
+* @param entries - The ordered file membership declarations.
+* @param roots - The ordered directory membership declarations.
+* @returns A SHA-256 digest independent of the manifest's stored digest field.
+*/
+function digestHostManifest(entries, roots) {
+	return digestText(stableStringify({
+		entries,
+		roots
+	}));
+}
+/**
 * Render the local pointer written when an upstream dependency guide is not vendored yet.
 *
 * @param source - The canonical `guides/src/<name>.md` source path.
@@ -1771,9 +1785,10 @@ function selectOrkestrelEntries(value) {
 * and the name satisfies `isWorkspaceName`; every other name is a coded
 * `TARGET` failure. `src` is derived from `src/<environment>/` and `app` from
 * `app/<environment>/`; a target with no environment on either axis is also a coded
-* `TARGET` failure. The `bin`, `integration`, and `service` facts probe physical
-* directories at `src/bin`, `tests/integration`, and `tests/service`, respectively,
-* while `global` probes the physical exact-case `tests/setupGlobal.ts` file and `showcase`
+* `TARGET` failure. The `bin` and `integration` facts probe physical
+* directories at `src/bin` and `tests/integration`. `services` is the sorted
+* set of direct vendor directories under `tests/service` that contain a test
+* at any depth, while `global` probes the physical exact-case `tests/setupGlobal.ts` file and `showcase`
 * probes the physical exact-case `configs/app/vite.showcase.config.ts` regular file; none is
 * inferred from the workspace name. `dependencies` /
 * `peers` are the `@orkestrel/`-prefixed entries of `manifest.dependencies` /
@@ -1793,8 +1808,8 @@ function selectOrkestrelEntries(value) {
 * @throws `ScaffoldError('TARGET', …)` when `target`'s manifest is unreadable
 *   (via `readManifest`), is not valid JSON, its name is unsafe for its
 *   publication mode, or `target` carries no source or application environment.
-* @throws `ScaffoldError('TARGET', …)` when `tests/service` exists without the
-*   physical companion files `tests/setupService.ts` and `scripts/service.sh`.
+* @throws `ScaffoldError('INVALID', …)` when service tests use the retired flat
+*   layout, a vendor directory has no test, or a service companion is missing.
 *
 * @example
 * ```ts
@@ -1834,22 +1849,46 @@ function deriveBlueprint(target) {
 	const engines = typeof rawNode === "string" ? rawNode : DEFAULT_ENGINES;
 	const bin = isRealDirectory(join(target, "src", "bin"));
 	const integration = isRealDirectory(join(target, "tests", "integration"));
-	const service = isRealDirectory(join(target, "tests", "service"));
+	const serviceRoot = join(target, "tests", "service");
+	const services = [];
+	if (existsSync(serviceRoot)) {
+		if (!isRealDirectory(serviceRoot)) throw new ScaffoldError("INVALID", `Service root at ${serviceRoot} must be a physical directory`, {
+			target,
+			path: "tests/service"
+		});
+		const serviceEntries = readdirSync(serviceRoot, { withFileTypes: true });
+		const flat = serviceEntries.filter((entry) => entry.name.endsWith(".test.ts") && !entry.isDirectory()).map((entry) => entry.name).sort();
+		if (flat.length > 0) throw new ScaffoldError("INVALID", `Flat service tests are not supported; move ${flat.join(", ")} into tests/service/<vendor>/`, {
+			target,
+			paths: flat.map((path) => `tests/service/${path}`)
+		});
+		for (const entry of serviceEntries) {
+			const vendor = join(serviceRoot, entry.name);
+			if (!isRealDirectory(vendor)) continue;
+			if (!isWorkspaceName(entry.name)) throw new ScaffoldError("INVALID", `Service vendor directory "${entry.name}" must use a bounded lowercase name`, {
+				target,
+				path: `tests/service/${entry.name}`
+			});
+			if (listFiles(vendor).filter((path) => path.endsWith(".test.ts")).length === 0) throw new ScaffoldError("INVALID", `Service vendor "${entry.name}" contains no test; add tests/service/${entry.name}/**/*.test.ts or remove the directory`, {
+				target,
+				service: entry.name
+			});
+			const setup = `tests/service/${entry.name}/setup.ts`;
+			if (!isRealFile(join(target, setup))) throw new ScaffoldError("INVALID", `Service vendor "${entry.name}" is missing ${setup}; add a readiness module that probes and warms the vendor and throws when unavailable`, {
+				target,
+				service: entry.name,
+				missing: setup
+			});
+			services.push(entry.name);
+		}
+		services.sort();
+	}
 	const showcaseRoot = join(target, dirname(SHOWCASE_CONFIG_PATH));
 	const showcaseEntries = attempt(() => readdirSync(showcaseRoot));
 	const showcase = showcaseEntries.success && showcaseEntries.value.includes(basename(SHOWCASE_CONFIG_PATH)) && isRealFile(join(target, SHOWCASE_CONFIG_PATH));
 	const tests = join(target, dirname(GLOBAL_SETUP_PATH));
 	const entries = attempt(() => readdirSync(tests));
 	const global = entries.success && entries.value.includes(basename(GLOBAL_SETUP_PATH)) && isRealFile(join(target, GLOBAL_SETUP_PATH));
-	if (service) {
-		const missing = [];
-		if (!isRealFile(join(target, "tests", "setupService.ts"))) missing.push("tests/setupService.ts");
-		if (!isRealFile(join(target, SERVICE_SCRIPT_PATH))) missing.push(SERVICE_SCRIPT_PATH);
-		if (missing.length > 0) throw new ScaffoldError("TARGET", `Service tests under ${target} are missing ${missing.join(" and ")}`, {
-			target,
-			missing
-		});
-	}
 	const rawDependencies = ownDataValue(parsed, "dependencies");
 	const rawPeerDependencies = ownDataValue(parsed, "peerDependencies");
 	const dependencies = selectOrkestrelEntries(rawDependencies).map(([depName, range]) => ({
@@ -1878,7 +1917,7 @@ function deriveBlueprint(target) {
 		extras: [],
 		bin,
 		integration,
-		service,
+		services,
 		global,
 		showcase
 	}))));
@@ -1901,7 +1940,7 @@ function deriveBlueprint(target) {
 		overrides: [],
 		bin,
 		integration,
-		service,
+		services,
 		global,
 		showcase
 	});
@@ -2025,8 +2064,9 @@ function readManifest(target) {
 *   `manifest.json` — the raw-repo-root fallback (`Materializer` then maps
 *   an artifact's `source` to `host` 1:1, no vendored staging indirection).
 * @throws `ScaffoldError('TARGET', …)` when `manifest.json` exists but is
-*   unreadable, malformed, collision-prone, root-incomplete, or does not map
-*   bijectively and case-exactly onto real contained storage files.
+*   unreadable, malformed, membership-corrupted, collision-prone,
+*   root-incomplete, or does not map bijectively and case-exactly onto real
+*   contained storage files.
 *
 * @example
 * ```ts
@@ -2050,6 +2090,10 @@ function readHostManifest(host) {
 		host,
 		full
 	});
+	if (manifest.digest !== digestHostManifest(manifest.entries, manifest.roots)) throw new ScaffoldError("TARGET", `Host manifest membership at ${full} is corrupted`, {
+		host,
+		full
+	});
 	const destinationConflict = findFileConflict(manifest.entries.map((entry) => entry.destination));
 	if (destinationConflict !== void 0) throw new ScaffoldError("TARGET", `Host manifest destination collision between "${destinationConflict[0]}" and "${destinationConflict[1]}"`, {
 		host,
@@ -2526,7 +2570,8 @@ function stageHost(root, out, paths = HOST_PATHS) {
 	if (rootConflict !== void 0) throw new ScaffoldError("TARGET", `Directory collision between "${rootConflict[0]}" and "${rootConflict[1]}"`, { paths: rootConflict });
 	const manifest = {
 		entries,
-		roots: uniqueRoots
+		roots: uniqueRoots,
+		digest: digestHostManifest(entries, uniqueRoots)
 	};
 	const parent = dirname(resolve(out));
 	const name = basename(resolve(out));
@@ -2625,6 +2670,7 @@ function stageHost(root, out, paths = HOST_PATHS) {
 *   {
 *     entries: [{ storage: 'pkg.tmpl', destination: 'package.json', executable: false }],
 *     roots: [],
+*     digest: '3b52f19450237ea4cfb39bc7a77b1e5094b52a8ff1fc9c02fd68b13ad088aa0f',
 *   },
 *   'package.json',
 *   './dist/host',
@@ -2737,7 +2783,8 @@ function hydratePlan(plan, host) {
 			});
 			if (entries.length === 0) {
 				if (source.startsWith("guides/src/") && source.endsWith(".md")) {
-					artifacts.push(artifact);
+					const { hex: _hex, ...presenceOwned } = artifact;
+					artifacts.push(presenceOwned);
 					continue;
 				}
 				throw new ScaffoldError("TARGET", `Host manifest does not declare ${source}`, {
@@ -3080,9 +3127,10 @@ function catalogPackages(roots, limit = MAX_HOST_ENTRIES) {
 * (`ScaffoldError('TARGET', …)`), then byte-copies each `host` artifact from
 * the `host` root and writes each `template` / `computed` artifact's rendered
 * `content`, failing fast on any write error (`ScaffoldError('WRITE', …)`).
-* `repair` is into-existing: it skips the vacancy check and writes ONLY the
-* `missing` / `stale` artifacts an `Audit` names, leaving `aligned` ones
-* untouched. Hydrated directory-shaped host entries are expanded into
+* `repair` is into-existing: it skips the vacancy check and writes `missing`
+* artifacts an `Audit` names. `stale` artifacts are report-only unless its
+* `replace` switch is true, because byte replacement discards local changes.
+* Hydrated directory-shaped host entries are expanded into
 * file-shaped artifacts, so canonical skills and agent configuration are
 * audited and repaired file by file. `prune` deletes stale files under
 * `target/.claude/agents/`, `target/.codex/agents/`, and `target/scripts/`
@@ -3113,9 +3161,10 @@ function catalogPackages(roots, limit = MAX_HOST_ENTRIES) {
 * source is always staged by `stageHost`, so a non-guide zero-match means a
 * corrupted or truncated `manifest.json`, not an intentionally-unvendored
 * artifact. For a guide pointer, a short stub file is written at the
-* destination and reported exactly like a successful copy, mirroring the
-* READ path (`hydratePlan` leaves such artifacts `content`-undefined, so
-* `diffPlan` audits them by PRESENCE only). For every OTHER zero-match, the
+* destination and reported exactly like a successful copy. The READ path
+* leaves that intentional pointer without canonical bytes, so `diffPlan`
+* treats it as presence-owned rather than inventing a byte match.
+* For every OTHER zero-match, the
 * fail-closed `ScaffoldError('TARGET', …)` is thrown — degrading an
 * unscoped zero-match would otherwise let a corrupted manifest silently stub
 * an unrecoverable artifact (e.g. `AGENTS.md` — `pull` only ever fetches
@@ -3189,16 +3238,16 @@ var Materializer = class {
 		this.#emitter.emit("done", result);
 		return result;
 	}
-	repair(plan, audit, target) {
+	repair(plan, audit, target, replace = false) {
 		this.#ensureAlive();
 		const context = this.#prepare(plan, target, plan, false);
 		if (!hasOnlyDataProperties(audit) || !hasValidAuditBytes(audit)) throw new ScaffoldError("INVALID", "repair requires a bounded audit snapshot");
 		const preview = attempt(() => structuredClone(audit));
 		if (!preview.success || !Array.isArray(preview.value.findings)) throw new ScaffoldError("INVALID", "repair requires a structurally valid audit", { ...preview.success ? {} : { error: preview.error } });
-		const drifted = new Set(preview.value.findings.filter((finding) => finding.drift === "missing" || finding.drift === "stale").map((finding) => finding.path));
+		const selectedPaths = new Set(preview.value.findings.filter((finding) => finding.drift === "missing" || replace === true && finding.drift === "stale").map((finding) => finding.path));
 		const selected = {
 			...context,
-			artifacts: context.artifacts.filter((artifact) => drifted.has(artifact.path))
+			artifacts: context.artifacts.filter((artifact) => selectedPaths.has(artifact.path))
 		};
 		const prepared = this.#prepare(selected, target, context);
 		const preparedByPath = new Map(prepared.artifacts.map((artifact) => [artifact.path, artifact]));
@@ -3222,7 +3271,7 @@ var Materializer = class {
 			throw new ScaffoldError("INVALID", `Repair precondition is missing at ${artifact.path}`, { path: artifact.path });
 		});
 		const skipped = [];
-		for (const artifact of context.artifacts) if (!drifted.has(artifact.path)) skipped.push(artifact.path);
+		for (const artifact of context.artifacts) if (!selectedPaths.has(artifact.path)) skipped.push(artifact.path);
 		const { written, copied } = this.#apply(prepared, target, preconditions);
 		const result = {
 			target,
@@ -4151,6 +4200,6 @@ function createSync(options) {
 	return new Sync(options);
 }
 //#endregion
-export { DEFAULT_SYNC_BUDGET, DEFAULT_SYNC_CONCURRENCY, DEFAULT_SYNC_ITEMS, DEFAULT_SYNC_LIMIT, DEFAULT_SYNC_TIMEOUT, HOST_MANIFEST_PATH, MAX_CATALOG_DESCRIPTION_LENGTH, MAX_FILESYSTEM_DEPTH, MAX_GUIDE_BYTES, MAX_HOST_DEPTH, MAX_HOST_ENTRIES, MAX_PATH_SEGMENT_BYTES, MAX_SYNC_BASE_LENGTH, MAX_SYNC_BRANCH_LENGTH, MAX_SYNC_BUDGET, MAX_SYNC_CONCURRENCY, MAX_SYNC_ITEMS, MAX_SYNC_LIMIT, MAX_SYNC_RETRIES, MAX_SYNC_TIMEOUT, Materializer, PRUNE_DIRECTORIES, RESERVED_PATH_SEGMENT_PATTERN, RESERVED_TARGET_PATH_PATTERN, SENSITIVE_HOST_PATH_PATTERN, SYNC_BRANCH_PATTERN, Sync, WRITE_DIGEST_PATTERN, WriteTransaction, catalogPackages, commitWriteTransaction, consumeCatalogAllowance, createMaterializer, createSync, createWriteDirectory, deriveBlueprint, digestFile, digestHex, digestText, discardWriteTransaction, discoverPackages, guideStub, guideToDescription, hostRoot, hydratePlan, isCatalogAllowance, isCatalogDescription, isDependencyData, isFilesystemPath, isHostManifest, isManifestEntry, isMaterializerEventHooks, isMissingPathError, isPortablePath, isRealDirectory, isRealFile, isReservedTargetPath, isSensitiveHostPath, isSyncEventHooks, isTerminalText, isVacant, isWritePrecondition, listDirectories, listFiles, locateHostSource, materializerOptionsContract, materializerOptionsShape, packageShortName, parseFilesystemPaths, parseMaterializerOptions, parsePortablePaths, parseSyncBase, parseSyncBranch, parseSyncCurrent, parseSyncDependencies, parseSyncNames, parseSyncOptions, parseWritePreconditions, pruneTargets, readFileHex, readFileText, readGuideReferences, readHostManifest, readManifest, readTarget, remapArtifactPath, replaceDirectory, resolveContainedPath, resolveGuideWrites, resolvePhysicalPath, resolveRealPath, restoreFiles, selectOrkestrelEntries, stageHost, storagePath, syncGuideOptionsShape, syncOptionsContract, syncOptionsShape, syncRegistryOptionsShape, syncReportOf, validateWriteAnchor, validateWriteDirectories, validateWriteTarget, vendoredPruneSet };
+export { DEFAULT_SYNC_BUDGET, DEFAULT_SYNC_CONCURRENCY, DEFAULT_SYNC_ITEMS, DEFAULT_SYNC_LIMIT, DEFAULT_SYNC_TIMEOUT, HOST_MANIFEST_PATH, MAX_CATALOG_DESCRIPTION_LENGTH, MAX_FILESYSTEM_DEPTH, MAX_GUIDE_BYTES, MAX_HOST_DEPTH, MAX_HOST_ENTRIES, MAX_PATH_SEGMENT_BYTES, MAX_SYNC_BASE_LENGTH, MAX_SYNC_BRANCH_LENGTH, MAX_SYNC_BUDGET, MAX_SYNC_CONCURRENCY, MAX_SYNC_ITEMS, MAX_SYNC_LIMIT, MAX_SYNC_RETRIES, MAX_SYNC_TIMEOUT, Materializer, PRUNE_DIRECTORIES, RESERVED_PATH_SEGMENT_PATTERN, RESERVED_TARGET_PATH_PATTERN, SENSITIVE_HOST_PATH_PATTERN, SYNC_BRANCH_PATTERN, Sync, WRITE_DIGEST_PATTERN, WriteTransaction, catalogPackages, commitWriteTransaction, consumeCatalogAllowance, createMaterializer, createSync, createWriteDirectory, deriveBlueprint, digestFile, digestHex, digestHostManifest, digestText, discardWriteTransaction, discoverPackages, guideStub, guideToDescription, hostRoot, hydratePlan, isCatalogAllowance, isCatalogDescription, isDependencyData, isFilesystemPath, isHostManifest, isManifestEntry, isMaterializerEventHooks, isMissingPathError, isPortablePath, isRealDirectory, isRealFile, isReservedTargetPath, isSensitiveHostPath, isSyncEventHooks, isTerminalText, isVacant, isWritePrecondition, listDirectories, listFiles, locateHostSource, materializerOptionsContract, materializerOptionsShape, packageShortName, parseFilesystemPaths, parseMaterializerOptions, parsePortablePaths, parseSyncBase, parseSyncBranch, parseSyncCurrent, parseSyncDependencies, parseSyncNames, parseSyncOptions, parseWritePreconditions, pruneTargets, readFileHex, readFileText, readGuideReferences, readHostManifest, readManifest, readTarget, remapArtifactPath, replaceDirectory, resolveContainedPath, resolveGuideWrites, resolvePhysicalPath, resolveRealPath, restoreFiles, selectOrkestrelEntries, stageHost, storagePath, syncGuideOptionsShape, syncOptionsContract, syncOptionsShape, syncRegistryOptionsShape, syncReportOf, validateWriteAnchor, validateWriteDirectories, validateWriteTarget, vendoredPruneSet };
 
 //# sourceMappingURL=index.js.map