@orkestrel/scaffold 0.0.59 → 0.0.61

package/dist/src/server/index.cjs

@@ -9,7 +9,7 @@ let node_url = require("node:url");
 let _orkestrel_emitter = require("@orkestrel/emitter");
 //#region src/server/constants.ts
 /**
-* The drive prefix a Windows host path may open with.
+* Matches the drive prefix a Windows host path may open with.
 *
 * @remarks
 * The one segment allowed to carry a colon. Every other segment is measured by
@@ -18,7 +18,7 @@ let _orkestrel_emitter = require("@orkestrel/emitter");
 */
 var DRIVE_PATTERN = /^[A-Za-z]:$/;
 /**
-* Visible characters no host path segment may carry.
+* Matches the visible characters no host path segment may carry.
 *
 * @remarks
 * Narrower than the core path law by exactly one character: a backslash is a
@@ -27,7 +27,7 @@ var DRIVE_PATTERN = /^[A-Za-z]:$/;
 */
 var INVALID_SEGMENT_CHARACTER_PATTERN = /[<>:"|?*]/;
 /**
-* The Windows device names that stay reserved even when an extension follows.
+* Matches the Windows device names that stay reserved even when an extension follows.
 *
 * @remarks
 * Refused on every host rather than only on Windows. A generated workspace is
@@ -36,7 +36,7 @@ var INVALID_SEGMENT_CHARACTER_PATTERN = /[<>:"|?*]/;
 */
 var RESERVED_SEGMENT_PATTERN = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9]|conin\$|conout\$)(?:\..*)?$/i;
 /**
-* The exact SHA-256 syntax a digest is stated in: sixty-four lowercase hexadecimal digits.
+* Matches the exact SHA-256 syntax a digest is stated in: sixty-four lowercase hexadecimal digits.
 *
 * @remarks
 * Fixed length, unlike the core byte encoding, because a digest is one value of
@@ -45,7 +45,7 @@ var RESERVED_SEGMENT_PATTERN = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9]|conin\$|co
 */
 var DIGEST_PATTERN = /^[0-9a-f]{64}$/;
 /**
-* The Git branch syntax the repository endpoint accepts.
+* Matches the Git branch syntax the repository endpoint accepts.
 *
 * @remarks
 * A branch is caller-supplied and reaches a URL path, so it is closed to
@@ -55,7 +55,7 @@ var DIGEST_PATTERN = /^[0-9a-f]{64}$/;
 */
 var BRANCH_PATTERN = /^(?!.*\.\.)[A-Za-z0-9][A-Za-z0-9._/-]*$/;
 /**
-* Maximum UTF-8 bytes one host path segment may encode to.
+* Caps the UTF-8 bytes one host path segment may encode to.
 *
 * @remarks
 * The limit every supported filesystem shares for a single name. It is a byte
@@ -64,7 +64,7 @@ var BRANCH_PATTERN = /^(?!.*\.\.)[A-Za-z0-9][A-Za-z0-9._/-]*$/;
 */
 var MAX_PATH_SEGMENT_BYTES = 255;
 /**
-* Maximum segments one host path may carry.
+* Caps the segments one host path may carry.
 *
 * @remarks
 * Bounds the work a path decision costs before any filesystem call is made. With
@@ -73,7 +73,7 @@ var MAX_PATH_SEGMENT_BYTES = 255;
 */
 var MAX_PATH_DEPTH = 64;
 /**
-* Maximum paths one target's working-tree inventory may report.
+* Caps the paths one target's working-tree inventory may report.
 *
 * @remarks
 * Far above the core collection ceiling, and deliberately so. A tracked or dirty
@@ -83,24 +83,24 @@ var MAX_PATH_DEPTH = 64;
 * verb on it.
 */
 var MAX_INVENTORY_PATHS = 1e5;
-/** Maximum characters one caller-supplied upstream endpoint may carry. */
+/** Caps the characters one caller-supplied upstream endpoint may carry. */
 var MAX_ENDPOINT_LENGTH = 2048;
-/** Maximum characters one repository branch may carry. */
+/** Caps the characters one repository branch may carry. */
 var MAX_BRANCH_LENGTH = 255;
 /**
-* Maximum simultaneous upstream requests.
+* Caps the simultaneous upstream requests.
 *
 * @remarks
 * A ceiling rather than a default: the reader picks what it opens by, and this
 * is only what a caller may raise it to.
 */
 var MAX_UPSTREAM_CONCURRENCY = 64;
-/** Maximum retries one upstream request may be given after a transport fault. */
+/** Caps the retries one upstream request may be given after a transport fault. */
 var MAX_UPSTREAM_RETRIES = 5;
-/** Maximum timeout one upstream request may be given, in milliseconds. */
+/** Caps the timeout one upstream request may be given, in milliseconds. */
 var MAX_UPSTREAM_TIMEOUT = 3e5;
 /**
-* The reserved metadata name a staged vendored host writes at its own root.
+* Reserves the metadata name a staged vendored host writes at its own root.
 *
 * @remarks
 * The one name a vendored file may never claim, because the staged root holds
@@ -109,14 +109,65 @@ var MAX_UPSTREAM_TIMEOUT = 3e5;
 * than repeating a literal that only agrees by inspection.
 */
 var MANIFEST_NAME = "manifest.json";
+/** Holds the raw content host a repository read addresses when a caller names none. */
+var DEFAULT_REPOSITORY_BASE = "https://raw.githubusercontent.com";
+/** Holds the registry a version read addresses when a caller names none. */
+var DEFAULT_REGISTRY_BASE = "https://registry.npmjs.org";
+/** Holds the repository branch a raw content read addresses when a caller names none. */
+var DEFAULT_BRANCH = "main";
+/**
+* Sets the timeout one upstream request is given when a caller names none, in milliseconds.
+*
+* @remarks
+* Both endpoints open at this value; a caller raises either one on its own up to
+* {@link MAX_UPSTREAM_TIMEOUT}.
+*/
+var DEFAULT_UPSTREAM_TIMEOUT = 1e4;
+/**
+* Sets the simultaneous upstream requests a reader opens with, under
+* {@link MAX_UPSTREAM_CONCURRENCY}.
+*/
+var DEFAULT_UPSTREAM_CONCURRENCY = 6;
+/**
+* Sets the retries one upstream request is given when a caller names none.
+*
+* @remarks
+* A read is attempted once by default. Retrying is the caller's decision because
+* a repeated request costs the upstream host, not this package.
+*/
+var DEFAULT_UPSTREAM_RETRIES = 0;
+/**
+* Names the npm scope and repository owner the fleet's packages and sources are
+* published under.
+*/
+var ORKESTREL_SCOPE = "orkestrel";
+/**
+* Names the repository this package's own vendored files are served from.
+*
+* @remarks
+* This package's bare name, stated rather than derived, because the reader has no
+* manifest to read it out of and one raw content host serves both the fleet's
+* guides and these files.
+*/
+var SCAFFOLD_REPOSITORY = "scaffold";
+/** Holds the note a release carries when its packument names no readable latest version. */
+var UNREADABLE_VERSION_NOTE = "the answer carries no readable latest version";
+/**
+* Names the media type that selects the registry's abbreviated packument.
+*
+* @remarks
+* Sent on exactly the reads that want a version, so the registry answers with the
+* smaller document instead of the whole packument.
+*/
+var PACKUMENT_MEDIA_TYPE = "application/vnd.npm.install-v1+json";
 //#endregion
 //#region src/server/validators.ts
 /**
-* Narrow a value to a path naming a location on this host.
+* Narrows a value to a path naming a location on this host.
 *
 * @param value - The candidate host path.
-* @returns `true` for a bounded absolute or relative path whose every segment is
-* portable across the supported filesystems.
+* @returns True if the value is a bounded absolute or relative path whose every segment
+* is portable across the supported filesystems; false otherwise.
 *
 * @remarks
 * The counterpart to the core path law, not a copy of it. A target directory and
@@ -173,7 +224,7 @@ function isFilesystemPath(value) {
 	});
 }
 /**
-* Narrow a value to one exact SHA-256 digest.
+* Narrows a value to one exact SHA-256 digest.
 *
 * @remarks
 * The identity a vendored host manifest and a write precondition are both stated
@@ -190,10 +241,11 @@ function isFilesystemPath(value) {
 */
 var isDigest = (0, _orkestrel_contract.stringOf)({ pattern: DIGEST_PATTERN });
 /**
-* Narrow a value to a working-tree inventory within the limit one target may report.
+* Narrows a value to a working-tree inventory within the limit one target may report.
 *
 * @param value - The candidate inventory.
-* @returns `true` for an array of no more than `MAX_INVENTORY_PATHS` items.
+* @returns True if the value is an array of no more than
+* `MAX_INVENTORY_PATHS` items; false otherwise.
 *
 * @remarks
 * Compose this ahead of an element guard exactly as the core collection guard is
@@ -215,7 +267,7 @@ function isInventory(value) {
 	return (0, _orkestrel_contract.holds)(() => (0, _orkestrel_contract.isArray)(value) && value.length <= 1e5);
 }
 /**
-* Narrow a value to a bounded upstream endpoint.
+* Narrows a value to a bounded upstream endpoint.
 *
 * @remarks
 * Length only. Which schemes and hosts an endpoint may name is the reader's law,
@@ -227,7 +279,7 @@ var isEndpoint = (0, _orkestrel_contract.stringOf)({
 	max: MAX_ENDPOINT_LENGTH
 });
 /**
-* Narrow a value to a Git branch the repository endpoint accepts.
+* Narrows a value to a Git branch the repository endpoint accepts.
 *
 * @remarks
 * A branch reaches the repository URL's path, so the syntax is closed rather than
@@ -247,7 +299,7 @@ var isBranch = (0, _orkestrel_contract.stringOf)({
 	pattern: BRANCH_PATTERN
 });
 /**
-* Narrow a value to a per-request timeout in milliseconds.
+* Narrows a value to a per-request timeout in milliseconds.
 *
 * @remarks
 * A whole number of milliseconds, at least one and no more than
@@ -256,7 +308,7 @@ var isBranch = (0, _orkestrel_contract.stringOf)({
 */
 var isTimeout = (0, _orkestrel_contract.andOf)(_orkestrel_contract.isInteger, (0, _orkestrel_contract.boundsOf)(1, MAX_UPSTREAM_TIMEOUT));
 /**
-* Narrow a value to a bounded list of `@orkestrel` package names.
+* Narrows a value to a bounded list of `@orkestrel` package names.
 *
 * @remarks
 * Composed from the core collection and dependency-name guards rather than
@@ -273,7 +325,7 @@ var isTimeout = (0, _orkestrel_contract.andOf)(_orkestrel_contract.isInteger, (0
 */
 var isDependencyNames = (0, _orkestrel_contract.andOf)(_src_core.isCollection, (0, _orkestrel_contract.arrayOf)(_src_core.isDependencyName));
 /**
-* Narrow a value to a bounded list of target-relative paths.
+* Narrows a value to a bounded list of target-relative paths.
 *
 * @remarks
 * Composed from the core collection and path guards rather than restated, so
@@ -290,10 +342,10 @@ var isDependencyNames = (0, _orkestrel_contract.andOf)(_src_core.isCollection, (
 * ```
 */
 var isPaths = (0, _orkestrel_contract.andOf)(_src_core.isCollection, (0, _orkestrel_contract.arrayOf)(_src_core.isPath));
-/** Narrow a value to a bounded list of declared runtime dependencies. */
+/** Narrows a value to a bounded list of declared runtime dependencies. */
 var isDependencies = (0, _orkestrel_contract.andOf)(_src_core.isCollection, (0, _orkestrel_contract.arrayOf)(_src_core.isDependency));
 /**
-* Narrow a value to one {@link ManifestRegionSet}.
+* Narrows a value to one {@link ManifestRegionSet}.
 *
 * @remarks
 * The whole closed record a manifest-writing method accepts, so a caller
@@ -315,12 +367,12 @@ var isManifestRegionSet = (0, _orkestrel_contract.recordOf)({
 	}),
 	scripts: (0, _orkestrel_contract.andOf)(_src_core.isCollection, (0, _orkestrel_contract.arrayOf)(_src_core.isManifestScript))
 });
-/** Narrow a value to a bounded list of fetched guide mirrors. */
+/** Narrows a value to a bounded list of fetched guide mirrors. */
 var isMirrors = (0, _orkestrel_contract.andOf)(_src_core.isCollection, (0, _orkestrel_contract.arrayOf)(_src_core.isMirror));
-/** Narrow a value to a bounded list of fleet catalog rows. */
+/** Narrows a value to a bounded list of fleet catalog rows. */
 var isCatalogEntries = (0, _orkestrel_contract.andOf)(_src_core.isCollection, (0, _orkestrel_contract.arrayOf)(_src_core.isCatalogEntry));
 /**
-* Narrow a value to one {@link ManifestEntry}.
+* Narrows a value to one {@link ManifestEntry}.
 *
 * @remarks
 * Both paths are measured by the core path law, because a vendored host's
@@ -347,7 +399,7 @@ var isManifestEntry = (0, _orkestrel_contract.recordOf)({
 	digest: isDigest
 });
 /**
-* Narrow a value to one {@link HostManifest}.
+* Narrows a value to one {@link HostManifest}.
 *
 * @remarks
 * The manifest is read from a directory a caller named, so it is the least
@@ -360,7 +412,7 @@ var isHostManifest = (0, _orkestrel_contract.recordOf)({
 	digest: isDigest
 });
 /**
-* Narrow a value to one {@link Host}.
+* Narrows a value to one {@link Host}.
 *
 * @remarks
 * A whole vendored host handed in as a value is as untrusted as one read from a
@@ -386,7 +438,7 @@ var isHost = (0, _orkestrel_contract.recordOf)({
 	bytes: _src_core.isSnapshot
 });
 /**
-* Narrow a value to a {@link Worktree}.
+* Narrows a value to a {@link Worktree}.
 *
 * @remarks
 * Both path lists are target-relative, so both are measured by the core path
@@ -407,7 +459,7 @@ var isWorktree = (0, _orkestrel_contract.recordOf)({
 	dirty: (0, _orkestrel_contract.andOf)(isInventory, (0, _orkestrel_contract.arrayOf)(_src_core.isPath))
 });
 /**
-* Narrow a value to the materializer's initial listener record.
+* Narrows a value to the materializer's initial listener record.
 *
 * @remarks
 * Every event is optional and every declared value is a function. A key outside
@@ -422,7 +474,7 @@ var isMaterializerHooks = (0, _orkestrel_contract.recordOf)({
 	destroy: _orkestrel_contract.isFunction
 }, true);
 /**
-* Narrow a value to {@link MaterializerOptions}.
+* Narrows a value to {@link MaterializerOptions}.
 *
 * @remarks
 * `host` admits both representations of one vendored root: a directory path and
@@ -444,7 +496,7 @@ var isMaterializerOptions = (0, _orkestrel_contract.recordOf)({
 	error: _orkestrel_contract.isFunction
 }, true);
 /**
-* Narrow a value to the upstream reader's initial listener record.
+* Narrows a value to the upstream reader's initial listener record.
 *
 * @remarks
 * Closed to the reader's own events for the same reason the materializer's
@@ -458,7 +510,7 @@ var isUpstreamHooks = (0, _orkestrel_contract.recordOf)({
 	destroy: _orkestrel_contract.isFunction
 }, true);
 /**
-* Narrow a value to {@link UpstreamOptions}.
+* Narrows a value to {@link UpstreamOptions}.
 *
 * @remarks
 * Each grouped endpoint is closed to its own leaves, so a setting written under
@@ -497,10 +549,10 @@ var isUpstreamOptions = (0, _orkestrel_contract.recordOf)({
 //#endregion
 //#region src/server/helpers.ts
 /**
-* Test whether a caught filesystem error reports an absent path.
+* Tests whether a caught filesystem error reports an absent path.
 *
 * @param error - The caught value.
-* @returns `true` only for an `Error` whose `code` is exactly `ENOENT`.
+* @returns True if `error` is an `Error` whose `code` is exactly `ENOENT`; false otherwise.
 *
 * @remarks
 * The one place absence is told apart from failure. Every read here answers
@@ -520,10 +572,10 @@ function matchesMissingPath(error) {
 	return (0, _orkestrel_contract.holds)(() => (0, _orkestrel_contract.isError)(error) && Reflect.get(error, "code") === "ENOENT");
 }
 /**
-* Test whether a path addresses a target's own repository metadata.
+* Tests whether a path addresses a target's own repository metadata.
 *
 * @param path - The path to classify; either separator is read.
-* @returns `true` for `.git` and for anything beneath it.
+* @returns True if the path is `.git` or sits beneath it; false otherwise.
 *
 * @remarks
 * The one home of the `.git` membership rule, read in either direction. A target
@@ -545,10 +597,10 @@ function matchesGitPath(path) {
 	return /(?:^|\/)\.git(?:\/|$)/i.test(path.replaceAll("\\", "/"));
 }
 /**
-* Test whether a target-relative path is one no verb may delete.
+* Tests whether a target-relative path is one no verb may delete.
 *
 * @param path - The target-relative path to classify.
-* @returns `true` when the path must survive every verb this package runs.
+* @returns True if the path must survive every verb this package runs; false otherwise.
 *
 * @remarks
 * The deletion deny-list, stated as a rule over paths rather than as a list of
@@ -577,10 +629,10 @@ function matchesProtectedPath(path) {
 	return normalized.startsWith("src/") || normalized.startsWith("app/");
 }
 /**
-* Test whether a path names local configuration or a credential.
+* Tests whether a path names local configuration or a credential.
 *
 * @param path - The path to classify; either separator is read.
-* @returns `true` when the path must never be copied into a vendored host.
+* @returns True if the path must never be copied into a vendored host; false otherwise.
 *
 * @remarks
 * The vendoring deny-list. A host root is staged from a real checkout, so the
@@ -605,10 +657,10 @@ function matchesSensitivePath(path) {
 	return /(?:^|\/)(?:(?:\.ssh|\.aws|\.azure|\.docker|\.kube|\.gnupg|\.env(?:\.[^/]*)?)(?:\/|$)|(?:\.npmrc|\.pypirc|\.netrc|\.git-credentials|settings\.local\.json|auth\.json|credentials(?:\.json)?|application_default_credentials\.json|id_rsa|id_ed25519|kubeconfig)$|\.config\/(?:gh|gcloud)(?:\/|$)|\.local\/share\/keyrings(?:\/|$)|[^/]*service-account[^/]*\.json$|[^/]*\.(?:jks|key|p12|pem|pfx|pkcs12)$)/i.test(normalized);
 }
 /**
-* Test whether a vendored path is one a target receives executable.
+* Tests whether a vendored path is one a target receives executable.
 *
 * @param path - The target-relative path to classify; either separator is read.
-* @returns `true` when the path is declared in {@link EXECUTABLE_PATHS}.
+* @returns True if the path is declared in {@link EXECUTABLE_PATHS}; false otherwise.
 *
 * @remarks
 * The declaration is the whole answer, and deliberately so. Reading the staging
@@ -631,7 +683,7 @@ function matchesExecutablePath(path) {
 	return _src_core.EXECUTABLE_PATHS.includes(path.replaceAll("\\", "/"));
 }
 /**
-* Project a target-relative path to the storage name a vendored host holds it under.
+* Projects a target-relative path to the storage name a vendored host holds it under.
 *
 * @param path - The target-relative path the file is written to.
 * @returns The storage name beneath the host root.
@@ -659,7 +711,7 @@ function pathToStorage(path) {
 	return segments.map((segment) => segment.startsWith(".") ? segment.slice(1) : segment).join("/");
 }
 /**
-* Compute the SHA-256 digest of text.
+* Computes the SHA-256 digest of text.
 *
 * @param content - The text to digest.
 * @returns Sixty-four lowercase hexadecimal digits.
@@ -702,7 +754,7 @@ function hexToDigest(hex) {
 	return (0, node_crypto.createHash)("sha256").update(Buffer.from(hex, "hex")).digest("hex");
 }
 /**
-* Compute the digest of a vendored host's declared membership.
+* Computes the digest of a vendored host's declared membership.
 *
 * @param entries - The ordered file membership declarations.
 * @param roots - The ordered directory membership declarations.
@@ -735,11 +787,11 @@ function computeManifestDigest(entries, roots) {
 	}));
 }
 /**
-* Test whether a path is a physical file this package will read or replace.
+* Tests whether a path is a physical file this package will read or replace.
 *
 * @param path - The resolved host path to inspect, without following links.
-* @returns `true` only for a regular file that is neither a link nor hard-linked
-* elsewhere.
+* @returns True if the path is a regular file that is neither a link nor hard-linked
+* elsewhere; false otherwise.
 *
 * @remarks
 * The link tests are the point. A symbolic link is a path pointing somewhere
@@ -759,11 +811,11 @@ function isPhysicalFile(path) {
 	return status.success && status.value.isFile() && !status.value.isSymbolicLink() && status.value.nlink === 1;
 }
 /**
-* Test whether a path is a physical file with exact on-disk casing.
+* Tests whether a path is a physical file with exact on-disk casing.
 *
 * @param path - The host path to inspect segment by segment.
-* @returns `true` only for a physical file whose requested segments exactly
-* match the names each parent directory stores.
+* @returns True if the path is a physical file whose requested segments exactly match
+* the names each parent directory stores; false otherwise.
 *
 * @remarks
 * A direct file lookup follows the host's case-folding rules on Windows and
@@ -797,10 +849,10 @@ function isExactCaseFile(path) {
 	return true;
 }
 /**
-* Test whether a path is a physical directory this package will read or write into.
+* Tests whether a path is a physical directory this package will read or write into.
 *
 * @param path - The resolved host path to inspect, without following links.
-* @returns `true` only for a directory that is not a link.
+* @returns True if the path is a directory that is not a link; false otherwise.
 *
 * @remarks
 * A junction and a directory symbolic link both report as directories after
@@ -820,7 +872,7 @@ function isPhysicalDirectory(path) {
 	return status.success && status.value.isDirectory() && !status.value.isSymbolicLink();
 }
 /**
-* Compute the SHA-256 digest of one file's exact bytes.
+* Computes the SHA-256 digest of one file's exact bytes.
 *
 * @param path - The resolved host path to digest.
 * @returns The digest, or `undefined` when the path is not a physical file, is
@@ -866,7 +918,7 @@ function computeFileDigest(path) {
 	return read.success ? read.value : void 0;
 }
 /**
-* Resolve a path through the real filesystem, keeping the part that does not exist yet.
+* Resolves a path through the real filesystem, keeping the part that does not exist yet.
 *
 * @param path - The absolute or relative host path to resolve.
 * @returns The lexical resolution of `path`, with its existing prefix then
@@ -942,7 +994,7 @@ function resolveRealPath(path) {
 	}
 }
 /**
-* Resolve a root-relative path and refuse one that leaves its root.
+* Resolves a root-relative path and refuses one that leaves its root.
 *
 * @param root - The containing host directory.
 * @param path - The portable root-relative path.
@@ -990,11 +1042,11 @@ function resolveContainedPath(root, path) {
 	return destination;
 }
 /**
-* Test whether a target is safe to write a fresh workspace into.
+* Tests whether a target is safe to write a fresh workspace into.
 *
 * @param target - The candidate target directory.
-* @returns `true` when the target is absent, empty, or holds nothing but its own
-* `.git` directory.
+* @returns True if the target is absent, empty, or holds nothing but its own `.git`
+* directory; false otherwise.
 *
 * @remarks
 * The green-field law. A checkout of an empty repository is where a new
@@ -1028,7 +1080,7 @@ function isVacant(target) {
 	return read.success && read.value;
 }
 /**
-* List a directory's files as sorted root-relative paths.
+* Lists a directory's files as sorted root-relative paths.
 *
 * @param root - The directory to inventory.
 * @returns Every descendant file as a `/`-separated root-relative path, in
@@ -1120,7 +1172,7 @@ function listFiles(root) {
 	return files.sort();
 }
 /**
-* List a directory's descendant directories as sorted root-relative paths.
+* Lists a directory's descendant directories as sorted root-relative paths.
 *
 * @param root - The directory to inventory.
 * @returns Every descendant directory as a `/`-separated root-relative path, in
@@ -1302,7 +1354,7 @@ function pruneEmptiedDirectories(target, removed) {
 	return pruned;
 }
 /**
-* Read one contained file as its exact bytes in lowercase hexadecimal.
+* Reads one contained file as its exact bytes in lowercase hexadecimal.
 *
 * @param root - The containing host directory.
 * @param path - The portable root-relative file path.
@@ -1362,7 +1414,7 @@ function readFileHex(root, path, limit = _src_core.MAX_ARTIFACT_BYTES) {
 	return read.success ? read.value : void 0;
 }
 /**
-* Read one contained file as bounded UTF-8 text.
+* Reads one contained file as bounded UTF-8 text.
 *
 * @param root - The containing host directory.
 * @param path - The portable root-relative file path.
@@ -1392,7 +1444,7 @@ function readFileText(root, path, limit = _src_core.MAX_ARTIFACT_BYTES) {
 	return decoded.success ? decoded.value : void 0;
 }
 /**
-* Read a target's current bytes at the paths a plan claims.
+* Reads a target's current bytes at the paths a plan claims.
 *
 * @param target - The target directory to read.
 * @param paths - The plan-relative paths to probe.
@@ -1407,7 +1459,7 @@ function readFileText(root, path, limit = _src_core.MAX_ARTIFACT_BYTES) {
 * @remarks
 * The one door from a real directory into the vocabulary an audit compares in.
 * Absence is omission rather than an empty value, because core reads a missing
-* key as a missing destination and an empty string as a present directory; the
+* key as a missing destination and an empty string as a present directory;
 * they are different verdicts. A path that is there but unreadable throws instead
 * of being omitted, because omission would report it as missing and a repair
 * would then overwrite whatever is actually sitting there.
@@ -1459,7 +1511,7 @@ function readSnapshot(target, paths) {
 	return snapshot;
 }
 /**
-* Read a vendored host's manifest, when it carries one.
+* Reads a vendored host's manifest, when it carries one.
 *
 * @param host - The vendored host root to read.
 * @param name - The root-relative manifest path. Default: `manifest.json`.
@@ -1513,7 +1565,7 @@ function readHostManifest(host, name = MANIFEST_NAME) {
 * @param root - The vendored host root. Default: the installed package's
 * vendored root, resolved from this module's location.
 * @returns The verified manifest and the exact bytes of every declared entry.
-* @throws `ScaffoldError('TARGET', …)` when the root is not a readable physical
+* @throws `ScaffoldError('TARGET', …)` when the root is not a readable physical
 * directory, its manifest is absent or unreadable, the manifest does not verify,
 * or a declared file is unreadable or misses its digest.
 *
@@ -1557,7 +1609,7 @@ function readHostFloor(root) {
 	};
 }
 /**
-* Derive one vendored-host manifest entry from a file in a checkout.
+* Derives one vendored-host manifest entry from a file in a checkout.
 *
 * @param destination - The target-relative path the file is written to.
 * @param source - The resolved host path the bytes are read from.
@@ -1594,7 +1646,7 @@ function readManifestEntry(destination, source) {
 	};
 }
 /**
-* Assemble a whole vendored host from live files and the installed floor.
+* Assembles a whole vendored host from live files and the installed floor.
 *
 * @param files - The host-owned vendored files read from the repository, one
 * row per path.
@@ -1608,13 +1660,10 @@ function readManifestEntry(destination, source) {
 * restates it. The host surface contributes one baseline: a fill carries live
 * bytes for every path that surface writes, or it is nothing. A row that failed,
 * went missing, names an undeclared path, or leaves a host-owned path absent
-* answers `undefined`. Deferred paths are presence-only and retain the installed
-* floor bytes that their catalog or mirror surface owns; repair never writes
-* those floor bytes. A canon path is read the same way for a different reason:
-* the canon is staged for reading rather than for a target, so every canon
-* destination keeps its floor bytes here, claimed or not, and a fill that carries
-* no row for one is complete rather than spoiled. One `Host` can therefore carry
-* live host bytes beside floor bytes without mixing baselines within a surface.
+* answers `undefined`. Every {@link isFloorPath} destination keeps the installed
+* floor's bytes instead, claimed or not, so a fill carrying no row for one is
+* complete rather than spoiled. One `Host` can therefore carry live host bytes
+* beside floor bytes without mixing baselines within a surface.
 *
 * The emitted entries keep the release's own order and its storage and
 * executable declarations, and carry digests recomputed over the bytes the fill
@@ -1639,12 +1688,12 @@ function filesToHost(files, floor) {
 	const held = /* @__PURE__ */ new Map();
 	for (const file of files) {
 		if (file.lookup !== "found" || !declared.has(file.path)) return void 0;
-		if (!(0, _src_core.isDeferredPath)(file.path) && !(0, _src_core.isCanonPath)(file.path)) held.set(file.path, file.hex);
+		if (!(0, _src_core.isFloorPath)(file.path)) held.set(file.path, file.hex);
 	}
 	const entries = [];
 	const bytes = {};
 	for (const entry of floor.manifest.entries) {
-		const hex = (0, _src_core.isDeferredPath)(entry.destination) || (0, _src_core.isCanonPath)(entry.destination) ? floor.bytes[entry.destination] : held.get(entry.destination);
+		const hex = (0, _src_core.isFloorPath)(entry.destination) ? floor.bytes[entry.destination] : held.get(entry.destination);
 		if (hex === void 0) return void 0;
 		entries.push({
 			storage: entry.storage,
@@ -1664,7 +1713,7 @@ function filesToHost(files, floor) {
 	};
 }
 /**
-* Stage the named destinations of a value host into a private root.
+* Stages the named destinations of a value host into a private root.
 *
 * @param host - The host whose bytes are written, keyed by destination.
 * @param root - The private directory to fill; it must already be a directory
@@ -1736,7 +1785,7 @@ function stageBytes(host, root, destinations) {
 	return staged;
 }
 /**
-* Stage a vendored host root from a real checkout.
+* Stages a vendored host root from a real checkout.
 *
 * @param checkout - The checkout the vendored paths are read from.
 * @param host - The vendored host root to fill; it must be absent or empty.
@@ -1971,7 +2020,7 @@ function stageInventory(checkout, path) {
 	return staged.value;
 }
 /**
-* Capture one directory's physical identity.
+* Captures one directory's physical identity.
 *
 * @param path - The resolved directory path to capture.
 * @returns The anchor, or `undefined` when the path is not a physical directory.
@@ -1999,11 +2048,11 @@ function readAnchor(path) {
 	};
 }
 /**
-* Test whether a captured directory is still the same directory.
+* Tests whether a captured directory is still the same directory.
 *
 * @param anchor - The identity captured earlier.
-* @returns `true` when the path still holds a physical directory of that exact
-* device and inode.
+* @returns True if the path still holds a physical directory of that exact device and
+* inode; false otherwise.
 *
 * @remarks
 * This binds location rather than history. `true` means the path still resolves
@@ -2027,7 +2076,7 @@ function matchesAnchor(anchor) {
 	return current !== void 0 && current.device === anchor.device && current.inode === anchor.inode;
 }
 /**
-* Capture what one destination holds before a write.
+* Captures what one destination holds before a write.
 *
 * @param path - The resolved destination path to capture.
 * @returns The expectation, or `undefined` when the destination is a link or a
@@ -2076,10 +2125,10 @@ function readExpectation(path) {
 	};
 }
 /**
-* Test whether a destination still holds what was captured of it.
+* Tests whether a destination still holds what was captured of it.
 *
 * @param expectation - The state captured earlier.
-* @returns `true` when re-reading the destination produces that same state.
+* @returns True if re-reading the destination produces that same state; false otherwise.
 *
 * @remarks
 * Compared field for field against a fresh {@link readExpectation}, so an
@@ -2101,11 +2150,11 @@ function matchesExpectation(expectation) {
 	return current.shape === expectation.shape && current.device === expectation.device && current.inode === expectation.inode && current.modified === expectation.modified && current.size === expectation.size && current.digest === expectation.digest;
 }
 /**
-* Test whether a destination still matches the narrower state a caller observed.
+* Tests whether a destination still matches the narrower state a caller observed.
 *
 * @param precondition - The caller-observed state the write is held to.
-* @returns `true` when the destination is absent as stated, or holds a physical
-* file whose bytes digest to the stated value.
+* @returns True if the destination is absent as stated, or holds a physical file whose
+* bytes digest to the stated value; false otherwise.
 *
 * @remarks
 * Narrower than {@link matchesExpectation} on purpose. A caller observed bytes,
@@ -2131,7 +2180,7 @@ function matchesPrecondition(precondition) {
 //#endregion
 //#region src/server/WriteTransaction.ts
 /**
-* One staged, reversible mutation of one target directory.
+* Represents one staged, reversible mutation of one target directory.
 *
 * @remarks
 * The transaction owns a private root beside the target — a sibling directory on
@@ -2207,7 +2256,7 @@ var WriteTransaction = class {
 	#taken = [];
 	#open = true;
 	/**
-	* Open a transaction over one target directory.
+	* Opens a transaction over one target directory.
 	*
 	* @param target - The directory every path is written beneath.
 	* @param paths - Every target-relative path this transaction may touch.
@@ -2281,20 +2330,20 @@ var WriteTransaction = class {
 			});
 		}
 	}
-	/** The resolved directory every path is written beneath. */
+	/** Names the resolved directory every path is written beneath. */
 	get target() {
 		return this.#target;
 	}
-	/** What each destination held when the transaction opened, in path order. */
+	/** Reports what each destination held when the transaction opened, in path order. */
 	get expectations() {
 		return [...this.#expectations.values()];
 	}
-	/** Whether the transaction can still be committed or discarded. */
+	/** Reports whether the transaction can still be committed or discarded. */
 	get open() {
 		return this.#open;
 	}
 	/**
-	* Stage one text file.
+	* Stages one text file.
 	*
 	* @param path - The target-relative path to write.
 	* @param content - The exact UTF-8 text the destination must hold.
@@ -2325,7 +2374,7 @@ var WriteTransaction = class {
 		this.#staged.push(path);
 	}
 	/**
-	* Stage one byte-for-byte copy of a file that already exists on this host.
+	* Stages one byte-for-byte copy of a file that already exists on this host.
 	*
 	* @param path - The target-relative path to write.
 	* @param source - The resolved absolute path to copy the bytes from.
@@ -2364,7 +2413,7 @@ var WriteTransaction = class {
 		this.#staged.push(path);
 	}
 	/**
-	* Establish one directory inside the target, one segment at a time.
+	* Establishes one directory inside the target, one segment at a time.
 	*
 	* @param path - The target-relative directory to establish.
 	* @returns The directory's identity and every segment this call created.
@@ -2392,7 +2441,7 @@ var WriteTransaction = class {
 		return result;
 	}
 	/**
-	* Mark one file for deletion at commit.
+	* Marks one file for deletion at commit.
 	*
 	* @param path - The target-relative file to delete.
 	* @returns Nothing.
@@ -2409,7 +2458,7 @@ var WriteTransaction = class {
 		this.#taken.push(path);
 	}
 	/**
-	* Promote every staged file and take every marked file, or roll the whole call back.
+	* Promotes every staged file and takes every marked file, or rolls the whole call back.
 	*
 	* @returns Every target-relative path whose destination changed: the files
 	* promoted, then the directories established, then the files taken.
@@ -2462,7 +2511,7 @@ var WriteTransaction = class {
 		];
 	}
 	/**
-	* Abandon the transaction and remove everything it created.
+	* Abandons the transaction and removes everything it created.
 	*
 	* @returns Nothing.
 	* @throws {@link ScaffoldError} coded `WRITE` when residue could not be
@@ -2639,7 +2688,7 @@ var WriteTransaction = class {
 //#endregion
 //#region src/server/Materializer.ts
 /**
-* The mutation spine: read the vendored host, re-derive the target, stage, swap.
+* Represents the mutation spine: read the vendored host, re-derive the target, stage, swap.
 *
 * @remarks
 * Every verb runs the same steps. It snapshots each caller-supplied value
@@ -2683,9 +2732,7 @@ var WriteTransaction = class {
 * materializer.destroy()
 * ```
 */
-var Materializer = class Materializer {
-	static #opening = "<!-- orkestrel:catalog -->";
-	static #closing = "<!-- /orkestrel:catalog -->";
+var Materializer = class {
 	#emitter;
 	#root;
 	#value;
@@ -2693,7 +2740,7 @@ var Materializer = class Materializer {
 	#entries;
 	#destroyed = false;
 	/**
-	* Construct a materializer over one vendored host root.
+	* Constructs a materializer over one vendored host root.
 	*
 	* @param options - The vendored host, in either representation, the initial
 	* listeners, and the listener-error handler.
@@ -2747,12 +2794,12 @@ var Materializer = class Materializer {
 			if (read.value !== void 0) this.#reconcile(read.value, root);
 		}
 	}
-	/** The materializer's observation channel. */
+	/** Exposes the materializer's observation channel. */
 	get emitter() {
 		return this.#emitter;
 	}
 	/**
-	* Compare a plan with a target through the vendored host that will repair it.
+	* Compares a plan with a target through the vendored host that will repair it.
 	*
 	* @param plan - The compiled plan to compare.
 	* @param target - The directory to inspect.
@@ -2783,7 +2830,7 @@ var Materializer = class Materializer {
 		return this.#derive(accepted, directory);
 	}
 	/**
-	* Write a plan into a vacant target.
+	* Writes a plan into a vacant target.
 	*
 	* @param plan - The compiled plan to write.
 	* @param target - The directory to write into; it must hold nothing the plan would collide with.
@@ -2810,7 +2857,7 @@ var Materializer = class Materializer {
 		return this.#apply(directory, hydrated.artifacts, empty, [], []);
 	}
 	/**
-	* Write a plan into an existing target, guided by an audit of it.
+	* Writes a plan into an existing target, guided by an audit of it.
 	*
 	* @param plan - The compiled plan to write.
 	* @param audit - The preview returned by this materializer's `audit` method.
@@ -2856,7 +2903,7 @@ var Materializer = class Materializer {
 		return this.#apply(directory, writes, [], skipped, preconditions);
 	}
 	/**
-	* Write fetched dependency guides to their local mirrors.
+	* Writes fetched dependency guides to their local mirrors.
 	*
 	* @param mirrors - The fetched guides; each carries the local bytes its write is held to.
 	* @param target - The directory to write into.
@@ -2899,7 +2946,7 @@ var Materializer = class Materializer {
 		return this.#apply(directory, writes, [], skipped, preconditions);
 	}
 	/**
-	* Rewrite the marker-bounded package table in the target's catalog agent file.
+	* Rewrites the marker-bounded package table in the target's catalog agent file.
 	*
 	* @param entries - The published packages the table must list.
 	* @param target - The directory to write into.
@@ -2922,7 +2969,7 @@ var Materializer = class Materializer {
 		return this.#rewrite(directory, _src_core.CATALOG_AGENT_PATH, _src_core.MAX_ARTIFACT_BYTES, this.#recatalog(accepted));
 	}
 	/**
-	* Rewrite the manifest regions the caller names in the target's manifest.
+	* Rewrites the manifest regions the caller names in the target's manifest.
 	*
 	* @param regions - The dependency ranges and script values the manifest must declare.
 	* @param target - The directory to write into.
@@ -2952,7 +2999,7 @@ var Materializer = class Materializer {
 		return this.#rewrite(directory, "package.json", _src_core.MAX_MANIFEST_BYTES, this.#redeclare(accepted));
 	}
 	/**
-	* Re-derive and delete the tracked files the plan does not own.
+	* Re-derives and deletes the tracked files the plan does not own.
 	*
 	* @param plan - The compiled plan that decides which paths are foreign.
 	* @param audit - The preview returned by this materializer's `audit` method; it must agree with the candidate set this call re-derives.
@@ -3016,7 +3063,7 @@ var Materializer = class Materializer {
 		return this.#purge(directory, removals, skipped, preconditions);
 	}
 	/**
-	* Tear the materializer down. Every later call throws, and teardown is idempotent.
+	* Tears the materializer down. Every later call throws, and teardown is idempotent.
 	*
 	* @returns Nothing.
 	*
@@ -3062,7 +3109,7 @@ var Materializer = class Materializer {
 			host: root,
 			error: walked.error
 		});
-		const declared = [...manifest.entries.map((entry) => entry.storage), "manifest.json"].sort();
+		const declared = [...manifest.entries.map((entry) => entry.storage), MANIFEST_NAME].sort();
 		const stored = walked.value;
 		if (stored.length !== declared.length || stored.some((name, index) => name !== declared[index])) throw this.#error("TARGET", "The vendored host does not store what its manifest declares.", {
 			host: root,
@@ -3140,11 +3187,7 @@ var Materializer = class Materializer {
 		let budget = remaining;
 		for (const entry of matched) {
 			const path = this.#remap(artifact, entry.destination);
-			if (_src_core.WORKSPACE_OWNED_PATHS.includes(path)) {
-				expanded.push(this.#presence(artifact, path, entry.destination));
-				continue;
-			}
-			if ((0, _src_core.isDeferredPath)(path)) {
+			if ((0, _src_core.isRetainedPath)(path)) {
 				expanded.push(this.#presence(artifact, path, entry.destination));
 				continue;
 			}
@@ -3162,8 +3205,7 @@ var Materializer = class Materializer {
 			source
 		});
 		if (isPhysicalFile(full)) {
-			if (_src_core.WORKSPACE_OWNED_PATHS.includes(artifact.path)) return [this.#presence(artifact, artifact.path, source)];
-			if ((0, _src_core.isDeferredPath)(artifact.path)) return [this.#presence(artifact, artifact.path, source)];
+			if ((0, _src_core.isRetainedPath)(artifact.path)) return [this.#presence(artifact, artifact.path, source)];
 			return [this.#hydrated(artifact, artifact.path, source, this.#readRoot(source, remaining))];
 		}
 		if (!isPhysicalDirectory(full)) throw this.#error("TARGET", `The host source at ${source} is not a readable file.`, {
@@ -3175,11 +3217,7 @@ var Materializer = class Materializer {
 		for (const name of listFiles(full)) {
 			const path = `${artifact.path}/${name}`;
 			const destination = `${source}/${name}`;
-			if (_src_core.WORKSPACE_OWNED_PATHS.includes(path)) {
-				expanded.push(this.#presence(artifact, path, destination));
-				continue;
-			}
-			if ((0, _src_core.isDeferredPath)(path)) {
+			if ((0, _src_core.isRetainedPath)(path)) {
 				expanded.push(this.#presence(artifact, path, destination));
 				continue;
 			}
@@ -3488,10 +3526,10 @@ var Materializer = class Materializer {
 			...rows
 		].map((row) => `| ${row.map((cell, column) => cell.padEnd(widths[column] ?? cell.length)).join(" | ")} |`).join("\n");
 		return (text) => {
-			const opening = text.indexOf(Materializer.#opening);
-			const closing = text.indexOf(Materializer.#closing, opening + Materializer.#opening.length);
+			const opening = text.indexOf(_src_core.CATALOG_OPENING_MARKER);
+			const closing = text.indexOf(_src_core.CATALOG_CLOSING_MARKER, opening + _src_core.CATALOG_OPENING_MARKER.length);
 			if (opening < 0 || closing < 0) throw this.#error("TARGET", "The catalog agent file carries no marked region.", { path: _src_core.CATALOG_AGENT_PATH });
-			return `${text.slice(0, opening + Materializer.#opening.length)}\n\n${table}\n\n${text.slice(closing)}`;
+			return `${text.slice(0, opening + _src_core.CATALOG_OPENING_MARKER.length)}\n\n${table}\n\n${text.slice(closing)}`;
 		};
 	}
 	#cell(note) {
@@ -3528,7 +3566,7 @@ var Materializer = class Materializer {
 //#endregion
 //#region src/server/Upstream.ts
 /**
-* The reading spine: one bounded, unauthenticated, redirect-free request per answer.
+* Represents the reading spine: one bounded, unauthenticated, redirect-free request per answer.
 *
 * @remarks
 * This is the package's only network reader, and it never writes. Every call
@@ -3557,7 +3595,7 @@ var Materializer = class Materializer {
 * flight instead of waiting for it.
 *
 * The allowance is threaded through the private reads as a mutable
-* `{ remaining: number }` carrier rather than held on the instance, because
+* {@link ReadAllowance} carrier rather than held on the instance, because
 * concurrent calls each own their own budget and must not spend each other's.
 *
 * @example
@@ -3569,17 +3607,7 @@ var Materializer = class Materializer {
 * upstream.destroy()
 * ```
 */
-var Upstream = class Upstream {
-	static #defaultRepository = "https://raw.githubusercontent.com";
-	static #defaultRegistry = "https://registry.npmjs.org";
-	static #defaultBranch = "main";
-	static #defaultTimeout = 1e4;
-	static #defaultConcurrency = 6;
-	static #defaultRetries = 0;
-	static #scope = "orkestrel";
-	static #vendor = "scaffold";
-	static #unreadable = "the answer carries no readable latest version";
-	static #packument = "application/vnd.npm.install-v1+json";
+var Upstream = class {
 	#emitter;
 	#repositoryBase;
 	#repositoryBranch;
@@ -3593,7 +3621,7 @@ var Upstream = class Upstream {
 	#controller = new AbortController();
 	#destroyed = false;
 	/**
-	* Construct a reader over one raw content host and one registry.
+	* Constructs a reader over one raw content host and one registry.
 	*
 	* @param options - The endpoints, the request bounds, the initial
 	* listeners, and the listener-error handler.
@@ -3617,22 +3645,22 @@ var Upstream = class Upstream {
 			...options?.on === void 0 ? {} : { on: options.on },
 			...options?.error === void 0 ? {} : { error: options.error }
 		});
-		this.#repositoryBase = this.#endpoint(options?.repository?.base ?? Upstream.#defaultRepository, "repository");
-		this.#repositoryBranch = options?.repository?.branch ?? Upstream.#defaultBranch;
-		this.#repositoryTimeout = options?.repository?.timeout ?? Upstream.#defaultTimeout;
-		this.#registryBase = this.#endpoint(options?.registry?.base ?? Upstream.#defaultRegistry, "registry");
-		this.#registryTimeout = options?.registry?.timeout ?? Upstream.#defaultTimeout;
-		this.#concurrency = options?.concurrency ?? Upstream.#defaultConcurrency;
-		this.#retries = options?.retries ?? Upstream.#defaultRetries;
+		this.#repositoryBase = this.#endpoint(options?.repository?.base ?? "https://raw.githubusercontent.com", "repository");
+		this.#repositoryBranch = options?.repository?.branch ?? "main";
+		this.#repositoryTimeout = options?.repository?.timeout ?? 1e4;
+		this.#registryBase = this.#endpoint(options?.registry?.base ?? "https://registry.npmjs.org", "registry");
+		this.#registryTimeout = options?.registry?.timeout ?? 1e4;
+		this.#concurrency = options?.concurrency ?? 6;
+		this.#retries = options?.retries ?? 0;
 		this.#limit = options?.limit ?? _src_core.MAX_REGISTRY_BYTES;
 		this.#budget = options?.budget ?? _src_core.MAX_TOTAL_REGISTRY_BYTES;
 	}
-	/** The upstream reader's observation channel. */
+	/** Exposes the upstream reader's observation channel. */
 	get emitter() {
 		return this.#emitter;
 	}
 	/**
-	* Look up the newest release each declared range admits.
+	* Looks up the newest release each declared range admits.
 	*
 	* @param dependencies - The declared dependencies to look up.
 	* @returns One release verdict per dependency, in input order.
@@ -3663,7 +3691,7 @@ var Upstream = class Upstream {
 		return this.#gather(accepted, (dependency) => this.#release(dependency, allowance));
 	}
 	/**
-	* Fetch each named package's guide, beside the local mirror it answers for.
+	* Fetches each named package's guide, beside the local mirror it answers for.
 	*
 	* @param names - The packages to fetch: the target's declared set, or the whole organization.
 	* @param current - The target's local mirrors as exact bytes, keyed by mirror path.
@@ -3697,7 +3725,7 @@ var Upstream = class Upstream {
 		return this.#gather(accepted, (name) => this.#mirror(name, observed, allowance));
 	}
 	/**
-	* Read each named vendored file from the repository, beside the target bytes it answers for.
+	* Reads each named vendored file from the repository, beside the target bytes it answers for.
 	*
 	* @param paths - The target-relative vendored paths to read.
 	* @param current - The target files as exact bytes, keyed by the same paths.
@@ -3745,7 +3773,7 @@ var Upstream = class Upstream {
 		return this.#gather(accepted, (path) => this.#file(path, inventory, observed, allowance));
 	}
 	/**
-	* Catalog the published fleet from the registry's organization package list.
+	* Catalogs the published fleet from the registry's organization package list.
 	*
 	* @returns One row per published package, sorted by name.
 	* @throws {@link ScaffoldError} coded `FETCH` when the organization package
@@ -3778,7 +3806,7 @@ var Upstream = class Upstream {
 		return this.#gather(names, (name) => this.#entry(name, allowance));
 	}
 	/**
-	* Tear the reader down, aborting every request in flight. Teardown is idempotent.
+	* Tears the reader down, aborting every request in flight. Teardown is idempotent.
 	*
 	* @returns Nothing.
 	*
@@ -3821,7 +3849,7 @@ var Upstream = class Upstream {
 		return parsed.href.replace(/\/+$/u, "");
 	}
 	async #release(dependency, allowance) {
-		const outcome = await this.#readWithRetries(this.#registryURL(dependency.name), this.#registryTimeout, allowance, Upstream.#packument);
+		const outcome = await this.#readWithRetries(this.#registryURL(dependency.name), this.#registryTimeout, allowance, PACKUMENT_MEDIA_TYPE);
 		const latest = outcome.lookup === "found" ? this.#releaseVersion(outcome.content, dependency.range) : void 0;
 		const tagged = outcome.lookup === "found" ? this.#latest(outcome.content) : void 0;
 		const major = tagged === void 0 ? void 0 : (0, _src_core.extractVersion)(tagged)?.[0];
@@ -3829,7 +3857,7 @@ var Upstream = class Upstream {
 			name: dependency.name,
 			range: dependency.range,
 			lookup: outcome.lookup === "found" ? "unmatched" : outcome.lookup,
-			note: outcome.lookup === "found" ? Upstream.#unreadable : outcome.note,
+			note: outcome.lookup === "found" ? UNREADABLE_VERSION_NOTE : outcome.note,
 			...major === void 0 ? {} : { major }
 		} : {
 			name: dependency.name,
@@ -3956,7 +3984,7 @@ var Upstream = class Upstream {
 		};
 	}
 	async #entry(name, allowance) {
-		const outcome = await this.#readWithRetries(this.#registryURL(name), this.#registryTimeout, allowance, Upstream.#packument);
+		const outcome = await this.#readWithRetries(this.#registryURL(name), this.#registryTimeout, allowance, PACKUMENT_MEDIA_TYPE);
 		const version = outcome.lookup === "found" ? this.#latest(outcome.content) : void 0;
 		if (version !== void 0) return {
 			name,
@@ -3967,7 +3995,7 @@ var Upstream = class Upstream {
 		return {
 			name,
 			lookup: outcome.lookup === "found" ? "unmatched" : outcome.lookup,
-			note: outcome.lookup === "found" ? Upstream.#unreadable : outcome.note
+			note: outcome.lookup === "found" ? UNREADABLE_VERSION_NOTE : outcome.note
 		};
 	}
 	#edges(content, version) {
@@ -3993,7 +4021,7 @@ var Upstream = class Upstream {
 		return edges;
 	}
 	async #packages(allowance) {
-		const url = `${this.#registryBase}/-/org/${Upstream.#scope}/package`;
+		const url = `${this.#registryBase}/-/org/${ORKESTREL_SCOPE}/package`;
 		const outcome = await this.#readWithRetries(url, this.#registryTimeout, allowance);
 		if (outcome.lookup !== "found") throw this.#error("FETCH", `The organization package list at ${url} produced no answer.`, {
 			url,
@@ -4042,11 +4070,11 @@ var Upstream = class Upstream {
 	#guideURL(name) {
 		const branch = this.#encode(this.#repositoryBranch);
 		const repository = encodeURIComponent(name.slice(name.lastIndexOf("/") + 1));
-		return `${this.#repositoryBase}/${Upstream.#scope}/${repository}/refs/heads/${branch}/${(0, _src_core.nameToGuide)(name)}`;
+		return `${this.#repositoryBase}/${ORKESTREL_SCOPE}/${repository}/refs/heads/${branch}/${(0, _src_core.nameToGuide)(name)}`;
 	}
 	#vendorURL(path) {
 		const branch = this.#encode(this.#repositoryBranch);
-		return `${this.#repositoryBase}/${Upstream.#scope}/${Upstream.#vendor}/refs/heads/${branch}/${this.#encode(path)}`;
+		return `${this.#repositoryBase}/${ORKESTREL_SCOPE}/${SCAFFOLD_REPOSITORY}/refs/heads/${branch}/${this.#encode(path)}`;
 	}
 	#encode(path) {
 		return path.split("/").map((segment) => encodeURIComponent(segment)).join("/");
@@ -4264,6 +4292,12 @@ var Upstream = class Upstream {
 };
 //#endregion
 exports.BRANCH_PATTERN = BRANCH_PATTERN;
+exports.DEFAULT_BRANCH = DEFAULT_BRANCH;
+exports.DEFAULT_REGISTRY_BASE = DEFAULT_REGISTRY_BASE;
+exports.DEFAULT_REPOSITORY_BASE = DEFAULT_REPOSITORY_BASE;
+exports.DEFAULT_UPSTREAM_CONCURRENCY = DEFAULT_UPSTREAM_CONCURRENCY;
+exports.DEFAULT_UPSTREAM_RETRIES = DEFAULT_UPSTREAM_RETRIES;
+exports.DEFAULT_UPSTREAM_TIMEOUT = DEFAULT_UPSTREAM_TIMEOUT;
 exports.DIGEST_PATTERN = DIGEST_PATTERN;
 exports.DRIVE_PATTERN = DRIVE_PATTERN;
 exports.INVALID_SEGMENT_CHARACTER_PATTERN = INVALID_SEGMENT_CHARACTER_PATTERN;
@@ -4277,7 +4311,11 @@ exports.MAX_UPSTREAM_CONCURRENCY = MAX_UPSTREAM_CONCURRENCY;
 exports.MAX_UPSTREAM_RETRIES = MAX_UPSTREAM_RETRIES;
 exports.MAX_UPSTREAM_TIMEOUT = MAX_UPSTREAM_TIMEOUT;
 exports.Materializer = Materializer;
+exports.ORKESTREL_SCOPE = ORKESTREL_SCOPE;
+exports.PACKUMENT_MEDIA_TYPE = PACKUMENT_MEDIA_TYPE;
 exports.RESERVED_SEGMENT_PATTERN = RESERVED_SEGMENT_PATTERN;
+exports.SCAFFOLD_REPOSITORY = SCAFFOLD_REPOSITORY;
+exports.UNREADABLE_VERSION_NOTE = UNREADABLE_VERSION_NOTE;
 exports.Upstream = Upstream;
 exports.WriteTransaction = WriteTransaction;
 exports.computeDigest = computeDigest;