@orkestrel/scaffold 0.0.49 → 0.0.50

package/dist/src/core/index.cjs

@@ -4,7 +4,7 @@ let _orkestrel_template = require("@orkestrel/template");
 let _orkestrel_emitter = require("@orkestrel/emitter");
 var package_default = {
 	name: "@orkestrel/scaffold",
-	version: "0.0.49",
+	version: "0.0.50",
 	description: "Scaffold workspaces with five commands: new, audit, repair, catalog, and overwrite.",
 	keywords: [
 		"audit",
@@ -89,19 +89,19 @@ var package_default = {
 		"prepublishOnly": "npm run format:check && npm run lint:check && npm run check && npm run build && npm test && npm run test:distribution -- --mode release"
 	},
 	dependencies: {
-		"@orkestrel/console": "^0.0.9",
+		"@orkestrel/console": "^0.0.10",
 		"@orkestrel/contract": "^0.0.13",
-		"@orkestrel/emitter": "^0.0.7",
-		"@orkestrel/markdown": "^0.0.9",
+		"@orkestrel/emitter": "^0.0.8",
+		"@orkestrel/markdown": "^0.0.10",
 		"@orkestrel/process": "^0.0.6",
-		"@orkestrel/template": "^0.0.4"
+		"@orkestrel/template": "^0.0.5"
 	},
 	devDependencies: {
 		"@microsoft/api-extractor": "^7.59.0",
-		"@orkestrel/guide": "^0.0.12",
-		"@orkestrel/html": "^0.0.4",
-		"@orkestrel/probe": "^0.0.2",
-		"@orkestrel/test": "^0.0.10",
+		"@orkestrel/guide": "^0.0.13",
+		"@orkestrel/html": "^0.0.5",
+		"@orkestrel/probe": "^0.0.3",
+		"@orkestrel/test": "^0.0.11",
 		"@types/node": "^26.2.0",
 		"@vitest/browser-playwright": "^4.1.11",
 		"oxfmt": "^0.64.0",
@@ -325,10 +325,21 @@ var SERVICE_SCRIPT_PATH = "scripts/service.sh";
 var GLOBAL_SETUP_PATH = "tests/setupGlobal.ts";
 /** The guide-parity proof whose presence selects the planned `guides` project. */
 var GUIDES_TEST_PATH = "tests/guides.test.ts";
-/** The packed-package proof whose presence makes a workspace `distribution`. */
+/** The generated packed-package proof every publishing workspace is planned at. */
 var DISTRIBUTION_TEST_PATH = "tests/distribution.test.ts";
+/**
+* The `prepublishOnly` row that runs the packed-package proof against a real registry.
+*
+* @remarks
+* The proof reads `import.meta.env.MODE`, so without `--mode release` it passes
+* on an unreachable registry instead of failing. The row therefore has one home
+* and both the script compiler and the manifest region writer read it from here.
+*/
+var RELEASE_PROOF_COMMAND = "npm run test:distribution -- --mode release";
 /** The cross-environment composition proof whose presence makes a workspace `integration`. */
 var INTEGRATION_TEST_PATH = "tests/integration.test.ts";
+/** The manifest path every compiler plan emits with birth ownership. */
+var MANIFEST_PATH = "package.json";
 /** The official-tooling drift proof whose presence makes a workspace `conformance`. */
 var CONFORMANCE_TEST_PATH = "tests/conformance.test.ts";
 /** The live-service readiness module whose presence makes a workspace `service`. */
@@ -403,6 +414,8 @@ var MAX_NAME_LENGTH = 203;
 var MAX_DEPENDENCY_NAME_LENGTH = 214;
 /** Maximum length of one declared package range. */
 var MAX_RANGE_LENGTH = 2048;
+/** Maximum length of one manifest script name or command. */
+var MAX_SCRIPT_LENGTH = 4096;
 /** Maximum length of one path, matching the longest a supported filesystem accepts. */
 var MAX_PATH_LENGTH = 32767;
 /** Maximum items accepted in one public collection. */
@@ -772,8 +785,8 @@ const resolve = {
 	}
 }
 
-export function appBrowser(): UserConfig {
-	return applicationBrowser(false)
+export function appBrowser(options?: UserConfig): UserConfig {
+	return mergeConfig(applicationBrowser(false), options ?? {})
 }
 {{showcaseFactory}}`,
 			server: `export const appServer = (options?: UserConfig): UserConfig =>
@@ -1591,6 +1604,865 @@ describe('bin entry', () => {
 	})
 })
 `,
+		distribution: Object.freeze({
+			proof: `// The artifact a consumer installs, measured rather than described. This workspace
+// is packed and installed into a throwaway consumer, and every following claim is read
+// off that installed tree: the exports map it publishes, the declarations it ships,
+// and the module objects a real runtime hands a consumer. Nothing here names this
+// package, one of its exports, or how many there are, so the proof stays true as
+// the published surface moves.
+{{types}}import type { SpawnSyncReturns } from 'node:child_process'
+import type { TestContext } from 'vitest'
+import { spawnSync } from 'node:child_process'
+import {
+	existsSync,
+	mkdirSync,
+	mkdtempSync,
+	readdirSync,
+	readFileSync,
+	rmSync,
+	statSync,
+	writeFileSync,
+} from 'node:fs'
+{{transport}}import { tmpdir } from 'node:os'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+{{launcher}}import ts from 'typescript'
+import { afterAll, describe, expect, it } from 'vitest'
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const NPM = process.platform === 'win32' ? 'npm.cmd' : 'npm'
+// Windows needs a shell to launch a \`.cmd\`: Node refuses one directly since the
+// batch-argument hardening, and \`spawnSync\` returns \`EINVAL\` with a null status
+// rather than an exit code a caller can read. Every following argument is a literal or
+// a path this file built, so the shell has nothing to escape.
+const SHELL = process.platform === 'win32'
+// \`prepublishOnly\` runs this proof as \`npm run test:distribution -- --mode release\`.
+// Release is the publish gate, so evidence it cannot obtain fails there and skips
+// everywhere else: a gate that passes on missing evidence proves nothing.
+const RELEASE = import.meta.env.MODE === 'release'
+// The built output directory a browser face is published from. Every selection here
+// reads this prefix off the export TARGET and never off the subpath name. A
+// workspace whose only published face is the browser one publishes that face at the
+// root subpath, so a rule keyed on the subpath name drives a browser bundle through
+// Node and the miss is silent.
+const BROWSER_OUTPUT = './dist/src/browser/'
+const ABSENT_SUBPATH = '/no-subpath-is-published-under-this-name'
+const PING = ['ping', '--fetch-retries=0', '--fetch-timeout=5000', '--loglevel=silent']
+const ESM_DRIVER = 'drive.mjs'
+const CJS_DRIVER = 'drive.cjs'
+const CONSUMER_MANIFEST = \`{ "name": "distribution-consumer", "private": true, "type": "module" }\\n\`
+const ESM_DRIVER_SOURCE = \`const entry = await import(process.argv[2])
+process.stdout.write(JSON.stringify(Object.keys(entry).sort()))
+\`
+const CJS_DRIVER_SOURCE = \`const entry = require(process.argv[2])
+process.stdout.write(JSON.stringify(Object.keys(entry).sort()))
+\`
+
+// The extensions a JavaScript handler loads as modules. Node loads a native addon
+// through its addon handler instead, so that extension is named separately.
+const MODULE_EXTENSIONS = ['.js', '.mjs', '.cjs']
+const ADDON_EXTENSION = '.node'
+// The extensions a declaration file carries. A \`require\` condition declares
+// \`.d.cts\` and an ESM-only one \`.d.mts\`, so the \`.d.ts\` spelling alone does not
+// name them.
+const DECLARATION_EXTENSIONS = ['.d.ts', '.d.cts', '.d.mts']
+type Format = 'module' | 'commonjs'
+
+// The Node import target is resolved with the conditions that driver supplies. The
+// CommonJS compile probe is selected from its declaration's format, and its runtime
+// drive loads the same subpath through Node's require resolver. Vite's production
+// client build enables its module and browser conditions.
+const RUNTIME_CONDITIONS = Object.freeze({
+	module: Object.freeze(['node-addons', 'node', 'import', 'module-sync']),
+	commonjs: Object.freeze(['node-addons', 'node', 'require', 'module-sync']),
+	browser: Object.freeze(['module', 'browser', 'production', 'import']),
+})
+// TypeScript's Node resolutions add \`node\` to the format condition. Its bundler
+// resolution does not, so a browser drive compares against the declaration a bundler
+// consumer reads rather than borrowing the Node declaration.
+const BUNDLER_CONDITIONS = Object.freeze({
+	module: ['types', 'import'],
+	commonjs: ['types', 'require'],
+})
+const DECLARATION_CONDITIONS = Object.freeze({
+	module: ['types', 'node', 'import'],
+	commonjs: ['types', 'node', 'require'],
+	browser: BUNDLER_CONDITIONS.module,
+})
+
+interface Resolution {
+	readonly label: string
+	readonly resolution: ts.ModuleResolutionKind
+	readonly module: ts.ModuleKind
+	readonly conditions: Readonly<Record<Format, readonly string[]>>
+}
+
+interface TargetResolution {
+	readonly target: string
+}
+
+// Each compile driver carries the conditions TypeScript applies for its resolution
+// and importing format. A \`require\`-only subpath therefore stays in each CommonJS
+// probe that can resolve it.
+const RESOLUTIONS: readonly Resolution[] = [
+	{
+		label: 'node16',
+		resolution: ts.ModuleResolutionKind.Node16,
+		module: ts.ModuleKind.Node16,
+		conditions: DECLARATION_CONDITIONS,
+	},
+	{
+		label: 'nodenext',
+		resolution: ts.ModuleResolutionKind.NodeNext,
+		module: ts.ModuleKind.NodeNext,
+		conditions: DECLARATION_CONDITIONS,
+	},
+	{
+		label: 'bundler',
+		resolution: ts.ModuleResolutionKind.Bundler,
+		module: ts.ModuleKind.ESNext,
+		conditions: BUNDLER_CONDITIONS,
+	},
+]
+
+const FORMATS: ReadonlyArray<readonly [extension: string, format: Format]> = [
+	['ts', 'module'],
+	['cts', 'commonjs'],
+]
+
+// One published subpath, resolved to what this proof can drive: the specifier a
+// consumer writes, the declarations its consumer formats name, whether its target
+// is a browser bundle, and whether it answers \`import\` and \`require\` at all.
+interface Entry {
+	readonly subpath: string
+	readonly specifier: string
+	readonly mapping: unknown
+	readonly declaration: {
+		readonly module: string | undefined
+		readonly commonjs: string | undefined
+		readonly browser: string | undefined
+	}
+	readonly browser: boolean
+	readonly module: boolean
+	readonly commonjs: boolean
+	readonly required: boolean
+}
+
+// The installed tree every claim is read from. Every subpath the exports map names
+// lands in exactly one of \`entries\`, \`undeclared\`, and \`excluded\`, so a subpath this
+// proof cannot drive is reported rather than dropped.
+interface Stage {
+	readonly consumer: string
+	readonly installed: string
+	readonly archives: readonly string[]
+	readonly entries: readonly Entry[]
+	readonly subpaths: readonly string[]
+	readonly undeclared: readonly string[]
+	readonly excluded: readonly string[]
+	readonly targets: readonly string[]
+}
+
+function isRecord(value: unknown): value is Readonly<Record<string, unknown>> {
+	return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function isNames(value: unknown): value is readonly string[] {
+	return Array.isArray(value) && value.every((name) => typeof name === 'string')
+}
+
+// A fallback list, which is what Node reads an array in an exports entry as. The
+// narrowing is what the following walkers need: \`Array.isArray\` widens an \`unknown\`
+// member to \`any\`, and an entry read that way is not read at all.
+function isList(value: unknown): value is readonly unknown[] {
+	return Array.isArray(value)
+}
+
+// Whether a string is a valid package target. Node rejects a target outside the
+// package and a target containing a dot, parent, or node_modules segment during
+// package-target resolution. A later module-resolution failure is not the same
+// thing: an array falls through the former and keeps the latter.
+function isPackageTarget(target: string): boolean {
+	if (!target.startsWith('./')) return false
+	for (const segment of target.slice(2).split(/[\\\\/]/u)) {
+		let decoded = segment
+		try {
+			decoded = decodeURIComponent(segment)
+		} catch {}
+		const normalized = decoded.toLowerCase()
+		if (normalized === '.' || normalized === '..' || normalized === 'node_modules') return false
+	}
+	return true
+}
+
+function readJson(path: string): unknown {
+	const parsed: unknown = JSON.parse(readFileSync(path, 'utf8'))
+	return parsed
+}
+
+function readManifestName(path: string): string {
+	const manifest = readJson(path)
+	if (!isRecord(manifest) || typeof manifest.name !== 'string') {
+		throw new Error(\`The manifest at \${path} declares no package name\`)
+	}
+	return manifest.name
+}
+
+function writeFile(path: string, content: string): void {
+	mkdirSync(dirname(path), { recursive: true })
+	writeFileSync(path, content)
+}
+
+function readOutput(result: SpawnSyncReturns<string>): string {
+	return \`\${result.stdout ?? ''}\${result.stderr ?? ''}\`.trim()
+}
+
+function runNpm(args: readonly string[], cwd: string): SpawnSyncReturns<string> {
+	return spawnSync(NPM, [...args], {
+		cwd,
+		encoding: 'utf8',
+		env: { ...process.env, npm_config_cache: CACHE },
+		shell: SHELL,
+		windowsHide: true,
+	})
+}
+
+function runNode(args: readonly string[], cwd: string): SpawnSyncReturns<string> {
+	return spawnSync(process.execPath, [...args], { cwd, encoding: 'utf8', windowsHide: true })
+}
+
+// Node's own condition matching, read in declaration order.
+function resolvePackageTarget(
+	entry: unknown,
+	conditions: readonly string[],
+): TargetResolution | undefined {
+	if (typeof entry === 'string') return { target: entry }
+	if (isList(entry)) {
+		for (const member of entry) {
+			const resolved = resolvePackageTarget(member, conditions)
+			if (resolved !== undefined && isPackageTarget(resolved.target)) return resolved
+		}
+		return undefined
+	}
+	if (!isRecord(entry)) return undefined
+	for (const [condition, nested] of Object.entries(entry)) {
+		if (condition !== 'default' && !conditions.includes(condition)) continue
+		const resolved = resolvePackageTarget(nested, conditions)
+		if (resolved !== undefined) return resolved
+	}
+	return undefined
+}
+
+// A flat entry, a condition-nested entry, and a fallback list all resolve through
+// one walker. An entry may declare \`types\` beside \`default\` at its top level
+// rather than inside \`import\`, so a fixed \`entry.import.types\` lookup is not
+// equivalent to condition resolution.
+function resolveTarget(entry: unknown, conditions: readonly string[]): string | undefined {
+	return resolvePackageTarget(entry, conditions)?.target
+}
+
+// Whether a path is a physical file. TypeScript's file-existence check refuses a
+// directory at the same spelling and continues to the outer package scope.
+function matchesFile(path: string): boolean {
+	try {
+		return statSync(path).isFile()
+	} catch {
+		return false
+	}
+}
+
+// TypeScript resolves a declaration target by accepting an existing declaration
+// directly or by substituting beside a JavaScript target. A missing target leaves
+// the containing condition or fallback list unresolved, so the walk continues.
+function targetToDeclaration(target: string, installed: string): string | undefined {
+	if (!isPackageTarget(target)) return undefined
+	let declaration = target
+	if (target.endsWith('.cjs')) declaration = \`\${target.slice(0, -4)}.d.cts\`
+	else if (target.endsWith('.mjs')) declaration = \`\${target.slice(0, -4)}.d.mts\`
+	else if (target.endsWith('.js')) declaration = \`\${target.slice(0, -3)}.d.ts\`
+	else if (!isDeclaration(target)) return undefined
+	return matchesFile(join(installed, declaration)) ? declaration : undefined
+}
+
+// The declaration TypeScript resolves through one importing format's conditions.
+// Condition objects keep manifest order, and arrays keep fallback order.
+function resolveDeclaration(
+	entry: unknown,
+	conditions: readonly string[],
+	installed: string,
+): string | undefined {
+	if (typeof entry === 'string') return targetToDeclaration(entry, installed)
+	if (isList(entry)) {
+		for (const member of entry) {
+			const resolved = resolveDeclaration(member, conditions, installed)
+			if (resolved !== undefined) return resolved
+		}
+		return undefined
+	}
+	if (!isRecord(entry)) return undefined
+	for (const [condition, nested] of Object.entries(entry)) {
+		if (condition !== 'default' && !conditions.includes(condition)) continue
+		const resolved = resolveDeclaration(nested, conditions, installed)
+		if (resolved !== undefined) return resolved
+	}
+	return undefined
+}
+
+// The nearest package scope that decides a \`.d.ts\` declaration's module format. A
+// physical nested manifest starts a scope even when it omits \`type\` or cannot be
+// parsed. A directory at that spelling is not a manifest, so the walk continues.
+function readPackageType(installed: string, target: string): unknown {
+	let directory = dirname(join(installed, target))
+	while (true) {
+		const path = join(directory, 'package.json')
+		if (matchesFile(path)) {
+			try {
+				const manifest = readJson(path)
+				return isRecord(manifest) ? manifest.type : undefined
+			} catch {
+				return undefined
+			}
+		}
+		if (directory === installed) return undefined
+		const parent = dirname(directory)
+		if (parent === directory) return undefined
+		directory = parent
+	}
+}
+
+// Whether the declaration selected by a typed CommonJS consumer admits that entry
+// to its compile probe. A \`.d.cts\` declaration admits and a \`.d.mts\`
+// declaration refuses. A \`.d.ts\` declaration takes its own nearest package scope.
+// Runtime target format remains the runtime drive's separate question.
+function resolvesCommonJS(entry: unknown, installed: string): boolean {
+	const declaration = resolveDeclaration(entry, DECLARATION_CONDITIONS.commonjs, installed)
+	if (declaration === undefined) return false
+	if (declaration.endsWith('.d.cts')) return true
+	if (declaration.endsWith('.d.mts')) return false
+	return declaration.endsWith('.d.ts') && readPackageType(installed, declaration) !== 'module'
+}
+
+// Every target an entry names under any condition. A fallback list omits members
+// Node rejects during package-target validation, because no reader can take them.
+function collectTargets(entry: unknown): readonly string[] {
+	if (typeof entry === 'string') return [entry]
+	if (isList(entry)) return entry.flatMap(collectTargets).filter(isPackageTarget)
+	if (!isRecord(entry)) return []
+	return Object.values(entry).flatMap((nested) => collectTargets(nested))
+}
+
+// Whether a target is a file a runtime loads for its names, which is what a
+// declaration is owed for. The extension on the target's own file name decides it,
+// and a name carrying no extension is code: \`require\` reads such a file through its
+// JavaScript handler, so an extensionless target loads and publishes names. Node
+// loads \`.node\` through its native-addon handler. Every other extension is an asset
+// a consumer reads rather than imports — a stylesheet, a WebAssembly binary, the
+// \`"./package.json"\` manifest pointer, and a declaration alike.
+// The cost is an extensionless file published for a reader, such as a \`LICENSE\`:
+// that target reports undeclared until it is given an extension or a declaration.
+function isModule(target: string): boolean {
+	const name = target.slice(target.lastIndexOf('/') + 1)
+	const dot = name.lastIndexOf('.')
+	if (name.endsWith(ADDON_EXTENSION)) return true
+	return dot === -1 || MODULE_EXTENSIONS.includes(name.slice(dot))
+}
+
+// Whether a resolved target is a declaration rather than the JavaScript a
+// \`default\` branch answers with when the entry declares no \`types\` condition.
+function isDeclaration(target: string): boolean {
+	return DECLARATION_EXTENSIONS.some((extension) => target.endsWith(extension))
+}
+
+// The declarations the Node module, Node CommonJS, and browser drives compare
+// against. Each field uses the conditions of the TypeScript consumer paired with
+// that runtime. A JavaScript target resolves through TypeScript's adjacent
+// declaration substitution rather than standing in for the declaration itself.
+function readDeclaration(entry: unknown, installed: string): Entry['declaration'] {
+	return {
+		module: resolveDeclaration(entry, DECLARATION_CONDITIONS.module, installed),
+		commonjs: resolveDeclaration(entry, DECLARATION_CONDITIONS.commonjs, installed),
+		browser: resolveDeclaration(entry, DECLARATION_CONDITIONS.browser, installed),
+	}
+}
+
+// The entries one compile driver can resolve under its own conditions.
+function selectEntries(entries: readonly Entry[], conditions: readonly string[]): readonly Entry[] {
+	return entries.filter(
+		(entry) =>
+			resolveTarget(entry.mapping, conditions) !== undefined &&
+			(!conditions.includes('require') || entry.commonjs),
+	)
+}
+
+// Require-loadable entries that declare CommonJS support but a typed CommonJS
+// consumer cannot compile against. A default branch resolving under the require
+// condition set makes no CommonJS claim.
+function selectUntypable(entries: readonly Entry[]): readonly Entry[] {
+	return entries.filter(
+		(entry) =>
+			entry.required &&
+			isRecord(entry.mapping) &&
+			Object.hasOwn(entry.mapping, 'require') &&
+			!entry.commonjs,
+	)
+}
+
+// The value exports a declaration publishes, read through the compiler's checker
+// over the module symbol rather than off the declaration text. An alias resolves to
+// what it names, so a re-export counts as the thing it re-exports, and a type-only
+// symbol is dropped because no runtime publishes one.
+function readDeclaredExports(declaration: string): readonly string[] {
+	const program = ts.createProgram([declaration], {
+		module: ts.ModuleKind.ESNext,
+		moduleResolution: ts.ModuleResolutionKind.Bundler,
+		noEmit: true,
+		skipLibCheck: true,
+		target: ts.ScriptTarget.ESNext,
+	})
+	const source = program.getSourceFile(declaration)
+	if (source === undefined) throw new Error(\`The declaration \${declaration} was not read\`)
+	const checker = program.getTypeChecker()
+	const symbol = checker.getSymbolAtLocation(source)
+	if (symbol === undefined) throw new Error(\`\${declaration} declares no module symbol\`)
+	const values: string[] = []
+	for (const exported of checker.getExportsOfModule(symbol)) {
+		const direct = (exported.flags & ts.SymbolFlags.Alias) === 0
+		const resolved = direct ? exported : checker.getAliasedSymbol(exported)
+		if ((resolved.flags & ts.SymbolFlags.Value) !== 0) values.push(exported.getName())
+	}
+	return [...values].sort()
+}
+
+// The diagnostics a consumer compiling against the installed declarations reports,
+// flattened to their messages so a failure names what the consumer could not do.
+function compileConsumer(
+	entry: string,
+	resolution: ts.ModuleResolutionKind,
+	module: ts.ModuleKind,
+): readonly string[] {
+	const program = ts.createProgram([entry], {
+		module,
+		moduleResolution: resolution,
+		noEmit: true,
+		skipLibCheck: true,
+		strict: true,
+		target: ts.ScriptTarget.ESNext,
+	})
+	return ts
+		.getPreEmitDiagnostics(program)
+		.map((diagnostic) => ts.flattenDiagnosticMessageText(diagnostic.messageText, ' '))
+}
+
+// One consumer module importing every installed entry, written where its own
+// resolution finds the installed package.
+function writeConsumerProbe(stage: Stage, path: string, specifiers: readonly string[]): string {
+	const names: string[] = []
+	const bindings: string[] = []
+	for (const [index, specifier] of specifiers.entries()) {
+		const binding = \`entry\${String(index)}\`
+		names.push(binding)
+		bindings.push(\`import * as \${binding} from \${JSON.stringify(specifier)}\`)
+	}
+	const target = join(stage.consumer, path)
+	writeFile(target, \`\${bindings.join('\\n')}\\nexport const surface = [\${names.join(', ')}]\\n\`)
+	return target
+}
+
+// The runtime key set a real process reads off one installed entry under one
+// condition. The driver is a file rather than an \`--eval\` string, so the specifier
+// travels as an argument and nothing needs escaping.
+function driveRuntime(stage: Stage, specifier: string, driver: string): readonly string[] {
+	const result = runNode([join(stage.consumer, driver), specifier], stage.consumer)
+	if (result.status !== 0) {
+		throw new Error(\`Loading \${specifier} from the consumer failed: \${readOutput(result)}\`)
+	}
+	const published: unknown = JSON.parse(result.stdout)
+	if (!isNames(published)) throw new Error(\`The driver printed no name list for \${specifier}\`)
+	return published
+}
+{{helpers}}
+// Pack this workspace, install the archive into an isolated consumer, and read the
+// published surface back off the installed tree. Every later claim reads this
+// result, so a failure here is raised where it happens rather than once per entry.
+function buildStage(): Stage {
+	const packed = join(SCRATCH, 'packed')
+	const consumer = join(SCRATCH, 'consumer')
+	mkdirSync(packed, { recursive: true })
+	const pack = runNpm(['pack', '--ignore-scripts', '--pack-destination', packed], ROOT)
+	if (pack.status !== 0) throw new Error(\`npm pack refused this workspace: \${readOutput(pack)}\`)
+	const archives = readdirSync(packed).filter((name) => name.endsWith('.tgz'))
+	const archive = archives[0]
+	if (archives.length !== 1 || archive === undefined) {
+		throw new Error(\`npm pack wrote no single archive: \${archives.join(', ')}\`)
+	}
+	writeFile(join(consumer, 'package.json'), CONSUMER_MANIFEST)
+	writeFile(join(consumer, ESM_DRIVER), ESM_DRIVER_SOURCE)
+	writeFile(join(consumer, CJS_DRIVER), CJS_DRIVER_SOURCE)
+	const install = runNpm(
+		['install', '--ignore-scripts', '--no-audit', '--no-fund', join(packed, archive)],
+		consumer,
+	)
+	if (install.status !== 0) {
+		throw new Error(\`Installing the packed archive failed: \${readOutput(install)}\`)
+	}
+	const name = readManifestName(join(ROOT, 'package.json'))
+	const installed = join(consumer, 'node_modules', ...name.split('/'))
+	const manifest = readJson(join(installed, 'package.json'))
+	if (!isRecord(manifest) || !isRecord(manifest.exports)) {
+		throw new Error('The installed manifest publishes no exports map')
+	}
+	const entries: Entry[] = []
+	const targets: string[] = []
+	const subpaths: string[] = []
+	const undeclared: string[] = []
+	const excluded: string[] = []
+	for (const [subpath, entry] of Object.entries(manifest.exports)) {
+		const files = collectTargets(entry)
+		targets.push(...files)
+		subpaths.push(subpath)
+		const declaration = readDeclaration(entry, installed)
+		// A subpath resolving no declaration is partitioned rather than dropped. It is a
+		// defect when a runtime loads one of its targets for names, because a consumer
+		// importing it compiles against nothing under \`node16\`. It is an excluded
+		// publication otherwise: the \`"./package.json"\` manifest pointer and a stylesheet
+		// are published for a reader rather than an importer.
+		if (
+			declaration.module === undefined &&
+			declaration.commonjs === undefined &&
+			declaration.browser === undefined
+		) {
+			if (files.some(isModule)) undeclared.push(subpath)
+			else excluded.push(subpath)
+			continue
+		}
+		const imported = resolveTarget(entry, RUNTIME_CONDITIONS.module)
+		const commonjs = resolvesCommonJS(entry, installed)
+		const required = resolveTarget(entry, RUNTIME_CONDITIONS.commonjs) !== undefined
+		const module = resolveTarget(entry, RUNTIME_CONDITIONS.browser)
+		entries.push({
+			subpath,
+			specifier: subpath === '.' ? name : \`\${name}\${subpath.slice(1)}\`,
+			mapping: entry,
+			declaration: {
+				module: declaration.module === undefined ? undefined : join(installed, declaration.module),
+				commonjs:
+					declaration.commonjs === undefined ? undefined : join(installed, declaration.commonjs),
+				browser:
+					declaration.browser === undefined ? undefined : join(installed, declaration.browser),
+			},
+			browser: module !== undefined && module.startsWith(BROWSER_OUTPUT),
+			module: imported !== undefined,
+			commonjs,
+			required,
+		})
+	}
+	return { consumer, installed, archives, entries, subpaths, undeclared, excluded, targets }
+}
+
+const SCRATCH = mkdtempSync(join(tmpdir(), 'distribution-'))
+const CACHE = join(SCRATCH, 'cache')
+mkdirSync(CACHE, { recursive: true })
+// The scratch tree holds the npm cache, the packed archive, and the installed
+// consumer, so its removal is registered before the first thing that can throw.
+afterAll(() => {
+	rmSync(SCRATCH, { force: true, recursive: true })
+})
+
+// Installing the packed archive resolves its own runtime dependencies, so an
+// unreachable registry leaves nothing to measure. Under release that is the gate
+// failing; anywhere else the suite skips and names the mechanism it wanted.
+//
+// A module that throws while loading never reaches the \`afterAll\` it registered,
+// so every throw here removes the scratch tree on its way out.
+function openStage(): Stage | undefined {
+	try {
+		if (runNpm(PING, ROOT).status !== 0) {
+			if (!RELEASE) return undefined
+			throw new Error(
+				'The release gate requires a reachable npm registry, and npm ping did not answer',
+			)
+		}
+		return buildStage()
+	} catch (error) {
+		rmSync(SCRATCH, { force: true, recursive: true })
+		throw error
+	}
+}
+
+const STAGE = openStage()
+const STAGED = STAGE !== undefined
+
+// The staged consumer, or a skip naming what the run could not reach. \`it.skipIf\`
+// carries no reason, so the gate sits here where the test context can state one.
+function requireStage(context: TestContext): Stage {
+	if (!STAGED) {
+		return context.skip('\`npm ping\` did not answer, so nothing was packed or installed')
+	}
+	return STAGE
+}
+
+describe('installed package consumer', () => {
+	it('packs one archive and installs it in isolation [requires the registry]', (context) => {
+		const stage = requireStage(context)
+		expect(stage.archives).toHaveLength(1)
+		expect(existsSync(join(stage.installed, 'package.json'))).toBe(true)
+		expect(stage.entries.length).toBeGreaterThan(0)
+	})
+
+	it('ships every relative target its exports map names [requires the registry]', (context) => {
+		const stage = requireStage(context)
+		const relative = stage.targets.filter((target) => target.startsWith('./'))
+		expect(relative).not.toStrictEqual([])
+		expect(relative.filter((target) => !existsSync(join(stage.installed, target)))).toStrictEqual(
+			[],
+		)
+	})
+
+	// Every published subpath is driven, excluded by name, or reported here. A dropped
+	// one leaves no trace: no runtime test, no declaration comparison, and no place in
+	// the resolution compile, so the run reports success for a subpath it never
+	// measured.
+	it('declares types for every module it publishes [requires the registry]', (context) => {
+		const stage = requireStage(context)
+		const partitioned = [
+			...stage.entries.map((entry) => entry.subpath),
+			...stage.undeclared,
+			...stage.excluded,
+		]
+		expect(stage.undeclared).toStrictEqual([])
+		expect(partitioned.sort()).toStrictEqual([...stage.subpaths].sort())
+		// A driven subpath answers a runtime condition. One resolving a declaration and
+		// no Node or browser target compiles for a consumer and throws when that consumer
+		// loads it. Each later drive retires itself for that entry, so this assertion names
+		// the subpath rather than counting it as driven.
+		const unreachable = stage.entries.filter(
+			(entry) => !entry.module && !entry.required && !entry.browser,
+		)
+		expect(unreachable.map((entry) => entry.subpath)).toStrictEqual([])
+		const untypable = selectUntypable(stage.entries)
+		expect(untypable.map((entry) => entry.subpath)).toStrictEqual([])
+	})
+
+	it('refuses a subpath its exports map does not name [requires the registry]', (context) => {
+		const stage = requireStage(context)
+		const name = readManifestName(join(stage.installed, 'package.json'))
+		const driver = join(stage.consumer, ESM_DRIVER)
+		const result = runNode([driver, \`\${name}\${ABSENT_SUBPATH}\`], stage.consumer)
+		expect(result.status).not.toBe(0)
+		expect(readOutput(result)).toContain('ERR_PACKAGE_PATH_NOT_EXPORTED')
+	})
+
+	// The absent subpath is the firing control: a resolution that reports nothing
+	// for every published entry has not been shown to resolve anything at all. Each
+	// module format carries its own control, because a format that resolves nothing
+	// is silent for the same reason a resolution that resolves nothing is.
+	it('compiles a consumer under every module resolution [requires the registry]', (context) => {
+		const stage = requireStage(context)
+		const name = readManifestName(join(stage.installed, 'package.json'))
+		const reported: string[] = []
+		const silent: string[] = []
+		for (const driver of RESOLUTIONS) {
+			for (const [extension, format] of FORMATS) {
+				const written = selectEntries(stage.entries, driver.conditions[format])
+				if (written.length === 0) continue
+				const specifiers = written.map((entry) => entry.specifier)
+				const probe = writeConsumerProbe(stage, \`probe.\${driver.label}.\${extension}\`, specifiers)
+				for (const message of compileConsumer(probe, driver.resolution, driver.module)) {
+					reported.push(\`\${driver.label}.\${extension}: \${message}\`)
+				}
+				const absent = [\`\${name}\${ABSENT_SUBPATH}\`]
+				const control = writeConsumerProbe(stage, \`control.\${driver.label}.\${extension}\`, absent)
+				if (compileConsumer(control, driver.resolution, driver.module).length === 0) {
+					silent.push(\`\${driver.label}.\${extension}\`)
+				}
+			}
+		}
+		expect(reported).toStrictEqual([])
+		expect(silent).toStrictEqual([])
+	})
+{{guard}}})
+
+for (const entry of STAGE?.entries ?? []) {
+	describe(\`installed entry \${entry.subpath}\`, () => {
+		it.runIf(entry.module && !entry.browser)(
+			'publishes what it declares to a Node import, and no more',
+			(context) => {
+				const declaration = entry.declaration.module
+				if (declaration === undefined) {
+					throw new Error(\`\${entry.subpath} publishes no import declaration\`)
+				}
+				const published = driveRuntime(requireStage(context), entry.specifier, ESM_DRIVER)
+				expect(published).toStrictEqual(readDeclaredExports(declaration))
+			},
+		)
+
+		it.runIf(!entry.browser && entry.required)(
+			'publishes what it declares to a Node require, and no more',
+			(context) => {
+				const declaration = entry.declaration.commonjs
+				if (declaration === undefined) {
+					throw new Error(\`\${entry.subpath} publishes no require declaration\`)
+				}
+				const published = driveRuntime(requireStage(context), entry.specifier, CJS_DRIVER)
+				expect(published).toStrictEqual(readDeclaredExports(declaration))
+			},
+		)
+{{drive}}	})
+}
+`,
+			transport: `import { createServer } from 'node:http'
+`,
+			types: `import type { PlaywrightProviderOptions } from '@vitest/browser-playwright'
+import type { Browser } from 'playwright'
+`,
+			launcher: `import { chromium } from 'playwright'
+import { build } from 'vite'
+import { resolveBrowser, resolvePinnedBrowser } from '../configs/browsers.js'
+`,
+			helpers: `
+const BROWSER_PAGE = \`<!doctype html>
+<html lang="en">
+	<head>
+		<meta charset="UTF-8" />
+		<title>Distribution</title>
+	</head>
+	<body>
+		<script type="module" src="./main.js"><\/script>
+	</body>
+</html>
+\`
+
+function readContentType(path: string): string {
+	if (path.endsWith('.html')) return 'text/html'
+	if (path.endsWith('.js')) return 'text/javascript'
+	if (path.endsWith('.css')) return 'text/css'
+	if (path.endsWith('.json') || path.endsWith('.map')) return 'application/json'
+	return 'application/octet-stream'
+}
+
+// \`resolveBrowser\` answers with provider options and never reports absence: its
+// last resort is a channel nothing verified. So the launch is attempted and its
+// rejection classified, rather than probed for and ruled on.
+function describeBrowser(options: PlaywrightProviderOptions): string {
+	const endpoint = options.connectOptions?.wsEndpoint
+	if (endpoint !== undefined) return \`the browser server at \${endpoint}\`
+	const executable = options.launchOptions?.executablePath
+	if (executable !== undefined) return \`the executable at \${executable}\`
+	const channel = options.launchOptions?.channel
+	if (channel !== undefined) return \`the \${channel} channel\`
+	return 'the Chromium Playwright installed for itself'
+}
+
+async function launchBrowser(options: PlaywrightProviderOptions): Promise<Browser> {
+	const endpoint = options.connectOptions?.wsEndpoint
+	if (endpoint !== undefined) return chromium.connect(endpoint)
+	return chromium.launch({ ...options.launchOptions, headless: true })
+}
+
+// A consumer of one installed browser entry, bundled by the Vite toolchain this
+// workspace already declares. Nothing is stubbed: the bundle resolves the installed
+// package and its whole transitive graph as an application consuming it would.
+async function bundleEntry(stage: Stage, entry: Entry): Promise<string> {
+	const page = join(stage.consumer, 'pages', entry.subpath.replaceAll(/[^\\w]+/gu, '-'))
+	const specifier = JSON.stringify(entry.specifier)
+	writeFile(join(page, 'index.html'), BROWSER_PAGE)
+	writeFile(
+		join(page, 'main.js'),
+		\`import * as entry from \${specifier}\\nglobalThis.subject = Object.keys(entry).sort()\\n\`,
+	)
+	await build({
+		base: './',
+		build: { emptyOutDir: true, outDir: 'bundle' },
+		configFile: false,
+		logLevel: 'error',
+		root: page,
+	})
+	return join(page, 'bundle')
+}
+
+// The key set the bundled module publishes in a real browser, read off the page
+// once it has loaded over a loopback server. A module that never evaluated
+// publishes nothing, and a page error is raised rather than compared away.
+async function readBrowserExports(browser: Browser, bundle: string): Promise<readonly string[]> {
+	const server = createServer((request, response) => {
+		const asked = request.url === undefined || request.url === '/' ? '/index.html' : request.url
+		const path = join(bundle, decodeURIComponent(asked))
+		if (!path.startsWith(bundle) || !existsSync(path)) {
+			response.writeHead(404)
+			response.end()
+			return
+		}
+		response.writeHead(200, { 'content-type': readContentType(path) })
+		response.end(readFileSync(path))
+	})
+	try {
+		await new Promise<void>((settle) => {
+			server.listen(0, '127.0.0.1', settle)
+		})
+		const address = server.address()
+		if (address === null || typeof address === 'string') {
+			throw new Error('The bundle server bound no port')
+		}
+		const page = await browser.newPage()
+		const failures: string[] = []
+		page.on('pageerror', (error) => failures.push(String(error)))
+		await page.goto(\`http://127.0.0.1:\${String(address.port)}/\`, { waitUntil: 'load' })
+		const published: unknown = await page.evaluate('globalThis.subject')
+		if (failures.length > 0) throw new Error(\`The bundle raised \${failures.join(' | ')}\`)
+		if (!isNames(published)) throw new Error('The bundled module published no name list')
+		return published
+	} finally {
+		server.close()
+	}
+}
+`,
+			drive: `
+		it.runIf(entry.browser)(
+			'publishes what it declares to a real browser, and no more [requires a browser]',
+			async (context) => {
+				const stage = requireStage(context)
+				const declaration = entry.declaration.browser
+				if (declaration === undefined) {
+					throw new Error(\`\${entry.subpath} publishes no browser declaration\`)
+				}
+				const options = resolveBrowser(resolvePinnedBrowser(), process.platform, process.env)
+				const browser = await launchBrowser(options).catch((error: unknown) => {
+					const cause = \`\${describeBrowser(options)} was rejected: \${String(error)}\`
+					if (RELEASE) throw new Error(\`The release gate requires a browser, and \${cause}\`)
+					return context.skip(\`No browser launched. \${cause}\`)
+				})
+				try {
+					const bundle = await bundleEntry(stage, entry)
+					expect(await readBrowserExports(browser, bundle)).toStrictEqual(
+						readDeclaredExports(declaration),
+					)
+				} finally {
+					await browser.close()
+				}
+			},
+		)
+`,
+			guard: `
+	// This proof drives a Node import and a Node require and carries no browser
+	// branch: the workspace published no browser face when it was written, and the
+	// browser drive measures the packed artifact, so only a published face is owed
+	// one. A private browser application does not select this branch. It declares the
+	// browser launcher and its Vitest browser provider and gets the generated browser
+	// configuration module beside it, but installed browser tooling does not stand for
+	// a published browser face. \`vite\` selects nothing either, though the branch
+	// imports it: scaffold puts \`vite\` in every workspace's base development
+	// dependencies, whatever that workspace publishes. The later Node
+	// \`it.runIf\` predicates retire each matching Node drive for a face published
+	// later, which leaves nothing measuring it. So it reddens here and names the
+	// subpath a browser branch is owed for. A workspace that gains one deletes this
+	// file and runs the \`repair\` verb, which writes the variant carrying that branch.
+	it('publishes no browser face this proof cannot drive [requires the registry]', (context) => {
+		const stage = requireStage(context)
+		const faces = stage.entries.filter((entry) => entry.browser)
+		expect(faces.map((entry) => entry.subpath)).toStrictEqual([])
+	})
+`
+		}),
 		integration: `{{imports}}import { describe, expect, it } from 'vitest'
 
 describe('workspace integration', () => {
@@ -1870,6 +2742,37 @@ var isDependency = (0, _orkestrel_contract.recordOf)({
 	optional: _orkestrel_contract.isBoolean
 }, ["optional"]);
 /**
+* Narrow a value to a {@link ManifestScript}.
+*
+* @remarks
+* Structural and bounded, exactly as {@link isDependency} is: a script name
+* and a script command are free text a manifest may carry, and which values a
+* region writer is willing to overwrite is the caller's decision rather than
+* this guard's.
+*
+* @example
+* ```ts
+* import { isManifestScript } from '@orkestrel/scaffold'
+*
+* isManifestScript({ name: 'test', command: 'vitest run', accepted: [] }) // true
+* isManifestScript({ name: 'test', command: 'vitest run' }) // false
+* ```
+*/
+var isManifestScript = (0, _orkestrel_contract.recordOf)({
+	name: (0, _orkestrel_contract.stringOf)({
+		min: 1,
+		max: MAX_SCRIPT_LENGTH
+	}),
+	command: (0, _orkestrel_contract.stringOf)({
+		min: 1,
+		max: MAX_SCRIPT_LENGTH
+	}),
+	accepted: (0, _orkestrel_contract.andOf)(isCollection, (0, _orkestrel_contract.arrayOf)((0, _orkestrel_contract.stringOf)({
+		min: 1,
+		max: MAX_SCRIPT_LENGTH
+	})))
+});
+/**
 * Narrow a value to an {@link Override}.
 *
 * @remarks
@@ -1921,7 +2824,6 @@ var isBlueprint = (0, _orkestrel_contract.recordOf)({
 	bin: _orkestrel_contract.isBoolean,
 	setup: _orkestrel_contract.isBoolean,
 	guides: _orkestrel_contract.isBoolean,
-	distribution: _orkestrel_contract.isBoolean,
 	integration: _orkestrel_contract.isBoolean,
 	conformance: _orkestrel_contract.isBoolean,
 	service: _orkestrel_contract.isBoolean,
@@ -1975,14 +2877,16 @@ var isArtifact = (0, _orkestrel_contract.unionOf)((0, _orkestrel_contract.record
 * @remarks
 * A plan reaches the writer, and the writer has no question channel, so this
 * carries the whole law of the value: every artifact path, every claimed byte,
-* and the blueprint it was compiled from.
+* and the blueprint it was compiled from. An artifact at {@link MANIFEST_PATH}
+* must carry `birth` ownership. A plan claiming `content` or `presence` there
+* is refused because the compiler emits the manifest only as birth-owned.
 */
-var isPlan = (0, _orkestrel_contract.recordOf)({
+var isPlan = (0, _orkestrel_contract.andOf)((0, _orkestrel_contract.recordOf)({
 	blueprint: isBlueprint,
 	groups: isGroups,
 	artifacts: (0, _orkestrel_contract.andOf)(isCollection, (0, _orkestrel_contract.arrayOf)(isArtifact)),
 	hash: isHex
-}, ["hash"]);
+}, ["hash"]), (plan) => plan.artifacts.every((artifact) => artifact.path !== "package.json" || artifact.ownership === "birth"));
 /**
 * Narrow a value to a {@link Question}.
 *
@@ -3026,19 +3930,17 @@ function manifestToName(manifest) {
 	return name;
 }
 /**
-* Project a package manifest's text to the `@orkestrel/*` packages it declares.
+* Project a package manifest's text to the `@orkestrel/*` packages each dependency section declares.
 *
 * @param manifest - The `package.json` text.
-* @returns One dependency per declared `@orkestrel` package, in section order,
-* with the first declaration of a repeated name winning.
+* @returns The runtime, development, and peer declarations as separate lists.
 *
 * @remarks
-* Runtime, development, and peer sections are read in that order, because a
-* package the fleet publishes is upstream of this workspace wherever it is
-* declared. Every other name is skipped rather than refused: a workspace's
-* unrelated dependencies are not this package's to report on.
+* Every other name is skipped rather than refused: a workspace's unrelated
+* dependencies are not this package's to report on. Keeping the sections
+* separate prevents a caller from treating a peer as a writable floor.
 *
-* Never throws, and every row it returns satisfies `isDependency` while the
+* Never throws, and every row it returns satisfies `isDependency` while each
 * list satisfies `isCollection`, so the result crosses the compiler's own
 * boundary without a second cleaning.
 *
@@ -3047,34 +3949,55 @@ function manifestToName(manifest) {
 * import { manifestToDependencies } from '@orkestrel/scaffold'
 *
 * manifestToDependencies('{"dependencies":{"@orkestrel/emitter":"^0.0.5","vite":"~8.2.0"}}')
-* // [{ name: '@orkestrel/emitter', range: '^0.0.5' }]
+* // { runtime: [{ name: '@orkestrel/emitter', range: '^0.0.5' }], development: [], peer: [] }
 * ```
 */
 function manifestToDependencies(manifest) {
-	if (computeBytes(manifest) > 1048576) return [];
+	if (computeBytes(manifest) > 1048576) return {
+		runtime: [],
+		development: [],
+		peer: []
+	};
 	const parsed = (0, _orkestrel_contract.parseJSON)(manifest);
-	if (!(0, _orkestrel_contract.isRecord)(parsed)) return [];
-	const dependencies = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const section of [
-		"dependencies",
-		"devDependencies",
-		"peerDependencies"
-	]) {
-		const entries = parsed[section];
+	if (!(0, _orkestrel_contract.isRecord)(parsed)) return {
+		runtime: [],
+		development: [],
+		peer: []
+	};
+	const runtime = [];
+	const development = [];
+	const peer = [];
+	const sections = [
+		{
+			name: "dependencies",
+			dependencies: runtime
+		},
+		{
+			name: "devDependencies",
+			dependencies: development
+		},
+		{
+			name: "peerDependencies",
+			dependencies: peer
+		}
+	];
+	for (const section of sections) {
+		const entries = parsed[section.name];
 		if (!(0, _orkestrel_contract.isRecord)(entries)) continue;
 		for (const [name, range] of Object.entries(entries)) {
-			if (seen.has(name)) continue;
 			if (!DEPENDENCY_NAME_PATTERN.test(name) || name.length > 214) continue;
 			if (!(0, _orkestrel_contract.isString)(range) || range.length === 0 || range.length > 2048) continue;
-			seen.add(name);
-			dependencies.push({
+			section.dependencies.push({
 				name,
 				range
 			});
 		}
 	}
-	return (0, _orkestrel_contract.limitEntries)(dependencies, MAX_COLLECTION_ITEMS);
+	return {
+		runtime: (0, _orkestrel_contract.limitEntries)(runtime, MAX_COLLECTION_ITEMS),
+		development: (0, _orkestrel_contract.limitEntries)(development, MAX_COLLECTION_ITEMS),
+		peer: (0, _orkestrel_contract.limitEntries)(peer, MAX_COLLECTION_ITEMS)
+	};
 }
 //#endregion
 //#region src/core/compilers.ts
@@ -3280,13 +4203,15 @@ function blueprintToDevDependencies(blueprint) {
 * proofs every workspace can pass before it has a public API, and one build per
 * target that actually builds.
 *
-* A publishing workspace isolates distribution and live-service proofs from
-* `test` and runs them from `prepublishOnly` instead. A private workspace has
-* no publish lifecycle, so it omits distribution and runs a live-service proof
-* from `test`. Integration and conformance stay in `test` because they neither
-* pack nor install the workspace and drive no external service. A conformance
-* run may start a server, but it starts its own and reaches it over loopback,
-* so the run stays hermetic.
+* A publishing workspace isolates its distribution and live-service proofs from
+* `test` and runs them from `prepublishOnly` instead. Publishing is what selects
+* the distribution proof: what that proof measures is the packed tarball, so a
+* workspace that packs no published source has nothing for it to read. A private
+* workspace therefore omits it and runs a live-service proof from `test`.
+* Integration and conformance stay in `test` because they neither pack nor
+* install the workspace and drive no external service. A conformance run may
+* start a server, but it starts its own and reaches it over loopback, so the run
+* stays hermetic.
 *
 * The configuration paths interpolated here are the same ones `SRC_MATRIX` and
 * `APP_MATRIX` list as each environment's configuration files, so a rename in
@@ -3303,7 +4228,6 @@ function blueprintToDevDependencies(blueprint) {
 */
 function blueprintToScripts(blueprint) {
 	const publishes = blueprint.src.length > 0;
-	const distributes = blueprint.distribution && publishes;
 	const integrates = blueprint.integration;
 	const compiles = publishes || blueprint.bin;
 	const runtime = blueprint.app.filter((environment) => environment !== "core");
@@ -3361,7 +4285,7 @@ function blueprintToScripts(blueprint) {
 	if (blueprint.conformance) scripts["test:conformance"] = `${vitest} --project conformance`;
 	scripts["test:probe"] = "vitest run --config vite.config.ts --no-cache --reporter=verbose --project probe";
 	scripts["test:bench"] = "vitest bench --config vite.config.ts --no-cache --project probe";
-	if (distributes) scripts["test:distribution"] = `${vitest} --project distribution`;
+	if (publishes) scripts["test:distribution"] = `${vitest} --project distribution`;
 	if (integrates) scripts["test:integration"] = `${vitest} --project integration`;
 	if (blueprint.service) scripts["test:service"] = `${vitest} --project service`;
 	scripts.build = [
@@ -3397,13 +4321,55 @@ function blueprintToScripts(blueprint) {
 		scripts.prepack = scripts.build;
 		scripts.prepublishOnly = [
 			"npm run format:check && npm run lint:check && npm run check && npm run build && npm test",
-			...distributes ? ["npm run test:distribution -- --mode release"] : [],
+			RELEASE_PROOF_COMMAND,
 			...blueprint.service ? ["npm run test:service"] : []
 		].join(" && ");
 	}
 	return scripts;
 }
 /**
+* Project a blueprint into the manifest scripts a region write may replace.
+*
+* @param blueprint - The workspace specification.
+* @returns One entry per writable script, or none when the workspace publishes
+* nothing and therefore declares neither script.
+*
+* @remarks
+* Publishing is what selects these scripts, so a private workspace answers an
+* empty region and the write leaves its manifest alone.
+*
+* `accepted` carries the predecessor a target can hold before this package
+* generated the packed-package proof: the same gate chain without
+* {@link RELEASE_PROOF_COMMAND}. The value being written is always writable, so
+* it is not repeated there. Any other value is a chain the workspace author
+* customized, and {@link replaceManifestScripts} refuses the whole region
+* rather than taking it.
+*
+* @example
+* ```ts
+* import { blueprintToWritableScripts, createBlueprint } from '@orkestrel/scaffold'
+*
+* const blueprint = createBlueprint('router', { src: ['core'] })
+*
+* blueprintToWritableScripts(blueprint)[0]?.name // 'test:distribution'
+* ```
+*/
+function blueprintToWritableScripts(blueprint) {
+	const scripts = blueprintToScripts(blueprint);
+	const distribution = scripts["test:distribution"];
+	const prepublish = scripts.prepublishOnly;
+	if (distribution === void 0 || prepublish === void 0) return [];
+	return [{
+		name: "test:distribution",
+		command: distribution,
+		accepted: []
+	}, {
+		name: "prepublishOnly",
+		command: prepublish,
+		accepted: [prepublish.replace(` && ${RELEASE_PROOF_COMMAND}`, "")]
+	}];
+}
+/**
 * Compile a blueprint into its `package.json` content.
 *
 * @param blueprint - The workspace specification.
@@ -3570,7 +4536,6 @@ function blueprintToRootTsconfig(blueprint) {
 function blueprintToRootVite(blueprint) {
 	const machinery = blueprintToMachinery(blueprint);
 	const publishes = blueprint.src.length > 0;
-	const distributes = blueprint.distribution && publishes;
 	const imports = [];
 	if (machinery.browser) imports.push("import { playwright } from '@vitest/browser-playwright'");
 	if (machinery.vue) imports.push("import vue from '@vitejs/plugin-vue'");
@@ -3683,7 +4648,7 @@ export function appShowcase(): UserConfig {
 			showcaseBuild,
 			showcaseFactory
 		}));
-		projects.push("appBrowser()");
+		projects.push("appBrowser");
 	}
 	if (blueprint.app.includes("server")) {
 		factories.push(CONFIG_TEMPLATES.factories.app.server);
@@ -3709,7 +4674,7 @@ export function appShowcase(): UserConfig {
 		factories.push(CONFIG_TEMPLATES.factories.service);
 		projects.push("service");
 	}
-	if (distributes) {
+	if (publishes) {
 		factories.push(CONFIG_TEMPLATES.factories.distribution);
 		projects.push("distribution");
 	}
@@ -3943,6 +4908,13 @@ function blueprintToSourceArtifacts(blueprint) {
 * readiness setup alone, because the root configuration names that module by
 * path.
 *
+* The distribution proof is emitted, and the same test separates it from those
+* two: its subject is the packed tarball rather than anything only the package
+* knows, so every assertion derives from the installed tree at run time and
+* nothing has to be named. It follows the published source it packs, and it is
+* the one artifact here claimed by presence: a target lacking it reports as
+* drift, and a package that replaced it with a better proof keeps that proof.
+*
 * @example
 * ```ts
 * import { blueprintToTestArtifacts, createBlueprint } from '@orkestrel/scaffold'
@@ -4024,6 +4996,24 @@ function blueprintToTestArtifacts(blueprint) {
 			label: serializeTypeScriptString(`app ${environment} entry`)
 		})
 	});
+	if (blueprint.src.length > 0) {
+		const browser = blueprint.src.includes("browser");
+		const distribution = ARTIFACT_TEMPLATES.tests.distribution;
+		artifacts.push({
+			path: DISTRIBUTION_TEST_PATH,
+			group: "tests",
+			ownership: "presence",
+			origin: "template",
+			content: (0, _orkestrel_template.fillTemplate)(distribution.proof, {
+				types: browser ? distribution.types : "",
+				transport: browser ? distribution.transport : "",
+				launcher: browser ? distribution.launcher : "",
+				helpers: browser ? distribution.helpers : "",
+				drive: browser ? distribution.drive : "",
+				guard: browser ? "" : distribution.guard
+			})
+		});
+	}
 	if (blueprint.integration) {
 		const imports = [];
 		const entries = [];
@@ -4210,34 +5200,33 @@ function applyOverrides(artifacts, overrides) {
 * Replace declared dependency ranges in package manifest text.
 *
 * @param manifest - The manifest text to compile.
-* @param dependencies - The declared names and replacement ranges.
-* @returns The manifest with every matching dependency-section value replaced,
-* or `undefined` when any name has no quoted declaration in those sections.
+* @param pins - The runtime and development names and replacement ranges.
+* @returns The manifest with every matching writable value replaced, or
+* `undefined` when a name has no quoted declaration in its named section.
 *
 * @remarks
 * The compiler replaces values in place instead of serializing the manifest,
 * so description, keywords, scripts, key order, indentation, and every byte
-* outside the named ranges survive. Every occurrence in `dependencies`,
-* `devDependencies`, and `peerDependencies` moves, which keeps duplicate
-* declarations aligned until the manifest's own validation reports the
-* duplicate. An override or resolution with the same name stays untouched.
+* outside the named ranges survive. Runtime pins apply only to `dependencies`,
+* and development pins apply only to `devDependencies`. The compiler never
+* reads or writes `peerDependencies` or `peerDependenciesMeta`. An override or
+* resolution with the same name stays untouched.
 *
 * @example
 * ```ts
 * import { replaceManifestRanges } from '@orkestrel/scaffold'
 *
 * const manifest = '{"devDependencies":{"typescript":"^6"}}\n'
-* replaceManifestRanges(manifest, [{ name: 'typescript', range: '^7' }])
+* replaceManifestRanges(manifest, {
+*   runtime: [],
+*   development: [{ name: 'typescript', range: '^7' }],
+* })
 * // the manifest with the declared range replaced
 * ```
 */
-function replaceManifestRanges(manifest, dependencies) {
-	if (dependencies.length === 0) return manifest;
-	const sectionNames = /* @__PURE__ */ new Set([
-		"dependencies",
-		"devDependencies",
-		"peerDependencies"
-	]);
+function replaceManifestRanges(manifest, pins) {
+	if (pins.runtime.length === 0 && pins.development.length === 0) return manifest;
+	const sectionNames = /* @__PURE__ */ new Set(["dependencies", "devDependencies"]);
 	const sections = [];
 	let depth = 0;
 	let cursor = 0;
@@ -4297,6 +5286,7 @@ function replaceManifestRanges(manifest, dependencies) {
 							sectionDepth -= 1;
 							if (sectionDepth === 0) {
 								sections.push({
+									name: key,
 									start: value,
 									end: sectionCursor + 1
 								});
@@ -4310,10 +5300,13 @@ function replaceManifestRanges(manifest, dependencies) {
 		}
 		cursor = end;
 	}
-	const replacements = new Map(dependencies.map(({ name, range }) => [name, range]));
-	const declared = /* @__PURE__ */ new Set();
+	const runtime = /* @__PURE__ */ new Set();
+	const development = /* @__PURE__ */ new Set();
 	let compiled = manifest;
 	for (const bounds of sections.reverse()) {
+		const dependencies = bounds.name === "dependencies" ? pins.runtime : pins.development;
+		const replacements = new Map(dependencies.map(({ name, range }) => [name, range]));
+		const declared = bounds.name === "dependencies" ? runtime : development;
 		let section = compiled.slice(bounds.start, bounds.end);
 		let sectionDepth = 0;
 		let sectionCursor = 0;
@@ -4380,13 +5373,225 @@ function replaceManifestRanges(manifest, dependencies) {
 		}
 		compiled = compiled.slice(0, bounds.start) + section + compiled.slice(bounds.end);
 	}
-	return dependencies.every(({ name }) => declared.has(name)) ? compiled : void 0;
+	const declaredRuntime = pins.runtime.every(({ name }) => runtime.has(name));
+	const declaredDevelopment = pins.development.every(({ name }) => development.has(name));
+	return declaredRuntime && declaredDevelopment ? compiled : void 0;
+}
+/**
+* Replace named script values in package manifest text.
+*
+* @param manifest - The manifest text to compile.
+* @param scripts - The scripts to write, each with the predecessors it accepts.
+* @returns The manifest carrying every named script, or `undefined` when a
+* named script holds a value outside what it accepts, or when the text carries
+* no readable `scripts` object to write into.
+*
+* @remarks
+* The compiler replaces values in place instead of serializing the manifest, so
+* description, keywords, dependencies, key order, indentation, and every byte
+* outside the replaced ranges survive. A named script the manifest already
+* declares is overwritten only when its value is the one being written or one
+* of its {@link ManifestScript.accepted} predecessors; anything else is a chain
+* the workspace author customized, and the whole region is refused without a
+* byte moving. A named script the manifest does not declare is appended after
+* the last declared script, copying that section's indentation. A region
+* declaring nothing takes every named script as its first entries, indented
+* from the line its own opening brace sits on.
+*
+* The refusal is whole rather than per script, so a manifest never ends up
+* holding one written script beside one refused one.
+*
+* @example
+* ```ts
+* import { replaceManifestScripts } from '@orkestrel/scaffold'
+*
+* const manifest = '{\n\t"scripts": {\n\t\t"test": "vitest run"\n\t}\n}\n'
+* replaceManifestScripts(manifest, [
+*   { name: 'test', command: 'vitest run --no-cache', accepted: ['vitest run'] },
+* ])
+* // the manifest with the declared script replaced
+* ```
+*/
+function replaceManifestScripts(manifest, scripts) {
+	if (scripts.length === 0) return manifest;
+	const parsed = (0, _orkestrel_contract.parseJSON)(manifest);
+	if (!(0, _orkestrel_contract.isRecord)(parsed) || !(0, _orkestrel_contract.isRecord)(parsed.scripts)) return void 0;
+	const declared = parsed.scripts;
+	for (const script of scripts) {
+		if (!Object.hasOwn(declared, script.name)) continue;
+		const value = declared[script.name];
+		if (!(0, _orkestrel_contract.isString)(value)) return void 0;
+		if (value !== script.command && !script.accepted.includes(value)) return void 0;
+	}
+	let depth = 0;
+	let cursor = 0;
+	let start = -1;
+	let end = -1;
+	while (cursor < manifest.length && end < 0) {
+		const character = manifest.charAt(cursor);
+		if (character === "{") {
+			depth += 1;
+			cursor += 1;
+			continue;
+		}
+		if (character === "}") {
+			depth -= 1;
+			cursor += 1;
+			continue;
+		}
+		if (character !== "\"") {
+			cursor += 1;
+			continue;
+		}
+		const keyStart = cursor;
+		cursor += 1;
+		while (cursor < manifest.length) {
+			if (manifest.charAt(cursor) === "\\") {
+				cursor += 2;
+				continue;
+			}
+			if (manifest.charAt(cursor) === "\"") break;
+			cursor += 1;
+		}
+		if (cursor >= manifest.length) return void 0;
+		const keyEnd = cursor + 1;
+		cursor = keyEnd;
+		if (depth !== 1) continue;
+		if ((0, _orkestrel_contract.parseJSON)(manifest.slice(keyStart, keyEnd)) !== "scripts") continue;
+		let opening = keyEnd;
+		while (opening < manifest.length && /\s/u.test(manifest.charAt(opening))) opening += 1;
+		if (manifest.charAt(opening) !== ":") continue;
+		opening += 1;
+		while (opening < manifest.length && /\s/u.test(manifest.charAt(opening))) opening += 1;
+		if (manifest.charAt(opening) !== "{") continue;
+		start = opening;
+		let nested = 0;
+		let scan = opening;
+		while (scan < manifest.length) {
+			const inner = manifest.charAt(scan);
+			if (inner === "\"") {
+				scan += 1;
+				while (scan < manifest.length) {
+					if (manifest.charAt(scan) === "\\") {
+						scan += 2;
+						continue;
+					}
+					if (manifest.charAt(scan) === "\"") break;
+					scan += 1;
+				}
+				if (scan >= manifest.length) return void 0;
+			} else if (inner === "{") nested += 1;
+			else if (inner === "}") {
+				nested -= 1;
+				if (nested === 0) {
+					end = scan + 1;
+					break;
+				}
+			}
+			scan += 1;
+		}
+	}
+	if (start < 0 || end < 0) return void 0;
+	const edits = [];
+	const written = /* @__PURE__ */ new Set();
+	let first = -1;
+	let nested = 0;
+	let scan = start;
+	while (scan < end) {
+		const character = manifest.charAt(scan);
+		if (character === "{") {
+			nested += 1;
+			scan += 1;
+			continue;
+		}
+		if (character === "}") {
+			nested -= 1;
+			scan += 1;
+			continue;
+		}
+		if (character !== "\"") {
+			scan += 1;
+			continue;
+		}
+		const keyStart = scan;
+		scan += 1;
+		while (scan < end) {
+			if (manifest.charAt(scan) === "\\") {
+				scan += 2;
+				continue;
+			}
+			if (manifest.charAt(scan) === "\"") break;
+			scan += 1;
+		}
+		if (scan >= end) return void 0;
+		const keyEnd = scan + 1;
+		scan = keyEnd;
+		if (nested !== 1) continue;
+		let valueStart = keyEnd;
+		while (valueStart < end && /\s/u.test(manifest.charAt(valueStart))) valueStart += 1;
+		if (manifest.charAt(valueStart) !== ":") continue;
+		valueStart += 1;
+		while (valueStart < end && /\s/u.test(manifest.charAt(valueStart))) valueStart += 1;
+		if (first < 0) first = keyStart;
+		if (manifest.charAt(valueStart) !== "\"") continue;
+		let valueEnd = valueStart + 1;
+		while (valueEnd < end) {
+			if (manifest.charAt(valueEnd) === "\\") {
+				valueEnd += 2;
+				continue;
+			}
+			if (manifest.charAt(valueEnd) === "\"") break;
+			valueEnd += 1;
+		}
+		if (valueEnd >= end) return void 0;
+		scan = valueEnd + 1;
+		const key = (0, _orkestrel_contract.parseJSON)(manifest.slice(keyStart, keyEnd));
+		const script = scripts.find((entry) => entry.name === key);
+		if (script === void 0) continue;
+		written.add(script.name);
+		edits.push({
+			start: valueStart,
+			end: valueEnd + 1,
+			text: JSON.stringify(script.command)
+		});
+	}
+	const missing = scripts.filter((script) => !written.has(script.name));
+	if (missing.length > 0) {
+		if (first < 0) {
+			const opening = manifest.lastIndexOf("\n", start);
+			let column = opening + 1;
+			while (column < start && /\s/u.test(manifest.charAt(column))) column += 1;
+			const level = opening < 0 ? "" : manifest.slice(opening + 1, column);
+			const separator = opening < 0 ? "" : `\n${level}${level}`;
+			const closing = opening < 0 ? "" : `\n${level}`;
+			const entries = missing.map((script) => `${separator}${JSON.stringify(script.name)}: ${JSON.stringify(script.command)}`);
+			edits.push({
+				start: start + 1,
+				end: end - 1,
+				text: `${entries.join(",")}${closing}`
+			});
+		} else {
+			let anchor = end - 1;
+			while (anchor > start && /\s/u.test(manifest.charAt(anchor - 1))) anchor -= 1;
+			const newline = manifest.lastIndexOf("\n", first);
+			const indent = newline < 0 ? "" : manifest.slice(newline + 1, first);
+			const separator = newline < 0 || /\S/u.test(indent) ? "" : `\n${indent}`;
+			edits.push({
+				start: anchor,
+				end: anchor,
+				text: missing.map((script) => `,${separator}${JSON.stringify(script.name)}: ${JSON.stringify(script.command)}`).join("")
+			});
+		}
+	}
+	let compiled = manifest;
+	for (const edit of edits.sort((left, right) => right.start - left.start)) compiled = compiled.slice(0, edit.start) + edit.text + compiled.slice(edit.end);
+	return compiled;
 }
 /**
 * Replace dependency ranges in a plan's manifest and recompute its identity.
 *
 * @param plan - The plan carrying the manifest artifact to compile.
-* @param dependencies - The declared names and replacement ranges.
+* @param pins - The runtime and development names and replacement ranges.
 * @returns A plan with replaced manifest ranges and a matching hash, or
 * `undefined` when the manifest or its identity cannot be compiled.
 *
@@ -4400,15 +5605,15 @@ function replaceManifestRanges(manifest, dependencies) {
 * ```ts
 * import { replacePlanRanges } from '@orkestrel/scaffold'
 *
-* replacePlanRanges(plan, releases) // the plan carrying the resolved manifest ranges
+* replacePlanRanges(plan, pins) // the plan carrying the resolved writable ranges
 * ```
 */
-function replacePlanRanges(plan, dependencies) {
+function replacePlanRanges(plan, pins) {
 	let replaced = false;
 	let refused = false;
 	const artifacts = plan.artifacts.map((artifact) => {
 		if (artifact.path !== "package.json" || artifact.origin === "host") return artifact;
-		const content = replaceManifestRanges(artifact.content, dependencies);
+		const content = replaceManifestRanges(artifact.content, pins);
 		if (content === void 0) {
 			refused = true;
 			return artifact;
@@ -4735,11 +5940,6 @@ function blueprintToQuestions(blueprint) {
 		});
 		vendors.add(vendor);
 	}
-	if (blueprint.distribution && blueprint.src.length === 0) questions.push({
-		field: "distribution",
-		message: "distribution packs the published source, and this workspace declares none, so it emits nothing.",
-		blocking: false
-	});
 	if (blueprint.showcase && !blueprint.app.includes("browser")) questions.push({
 		field: "showcase",
 		message: "showcase projects a browser app, and this workspace declares none, so it emits nothing.",
@@ -4948,7 +6148,6 @@ function createBlueprint(name, input) {
 		bin: input?.bin ?? false,
 		setup: input?.setup ?? false,
 		guides: input?.guides ?? false,
-		distribution: input?.distribution ?? false,
 		integration: input?.integration ?? false,
 		conformance: input?.conformance ?? false,
 		service: input?.service ?? false,
@@ -5293,6 +6492,7 @@ exports.HOST_INVENTORY_PATH = HOST_INVENTORY_PATH;
 exports.HOST_PATHS = HOST_PATHS;
 exports.INTEGRATION_TEST_PATH = INTEGRATION_TEST_PATH;
 exports.INVALID_PATH_CHARACTER_PATTERN = INVALID_PATH_CHARACTER_PATTERN;
+exports.MANIFEST_PATH = MANIFEST_PATH;
 exports.MAX_ARTIFACT_BYTES = MAX_ARTIFACT_BYTES;
 exports.MAX_ARTIFACT_HEX_LENGTH = MAX_ARTIFACT_HEX_LENGTH;
 exports.MAX_AUDIT_FINDINGS = MAX_AUDIT_FINDINGS;
@@ -5303,6 +6503,7 @@ exports.MAX_NAME_LENGTH = MAX_NAME_LENGTH;
 exports.MAX_PATH_LENGTH = MAX_PATH_LENGTH;
 exports.MAX_RANGE_LENGTH = MAX_RANGE_LENGTH;
 exports.MAX_REGISTRY_BYTES = MAX_REGISTRY_BYTES;
+exports.MAX_SCRIPT_LENGTH = MAX_SCRIPT_LENGTH;
 exports.MAX_TOTAL_ARTIFACT_BYTES = MAX_TOTAL_ARTIFACT_BYTES;
 exports.MAX_TOTAL_REGISTRY_BYTES = MAX_TOTAL_REGISTRY_BYTES;
 exports.MINIMUM_NODE_VERSION = MINIMUM_NODE_VERSION;
@@ -5311,6 +6512,7 @@ exports.ORCHESTRATION_PATH_NAMES = ORCHESTRATION_PATH_NAMES;
 exports.ORCHESTRATION_PATH_PREFIXES = ORCHESTRATION_PATH_PREFIXES;
 exports.ORKESTREL_RANGE_PATTERN = ORKESTREL_RANGE_PATTERN;
 exports.PRINT_WIDTH = PRINT_WIDTH;
+exports.RELEASE_PROOF_COMMAND = RELEASE_PROOF_COMMAND;
 exports.SERVICE_SCRIPT_PATH = SERVICE_SCRIPT_PATH;
 exports.SERVICE_SETUP_PATH = SERVICE_SETUP_PATH;
 exports.SERVICE_TEST_INCLUDE = SERVICE_TEST_INCLUDE;
@@ -5339,6 +6541,7 @@ exports.blueprintToRootVite = blueprintToRootVite;
 exports.blueprintToScripts = blueprintToScripts;
 exports.blueprintToSourceArtifacts = blueprintToSourceArtifacts;
 exports.blueprintToTestArtifacts = blueprintToTestArtifacts;
+exports.blueprintToWritableScripts = blueprintToWritableScripts;
 exports.bytesToHex = bytesToHex;
 exports.catalogToLayers = catalogToLayers;
 exports.cloneValue = cloneValue;
@@ -5368,6 +6571,7 @@ exports.isFinding = isFinding;
 exports.isGroup = isGroup;
 exports.isGroups = isGroups;
 exports.isHex = isHex;
+exports.isManifestScript = isManifestScript;
 exports.isMirror = isMirror;
 exports.isOverride = isOverride;
 exports.isPath = isPath;
@@ -5395,6 +6599,7 @@ exports.planToFindings = planToFindings;
 exports.planToHash = planToHash;
 exports.planToSummary = planToSummary;
 exports.replaceManifestRanges = replaceManifestRanges;
+exports.replaceManifestScripts = replaceManifestScripts;
 exports.replacePlanRanges = replacePlanRanges;
 exports.selectGroups = selectGroups;
 exports.selectHostPaths = selectHostPaths;