fix: normalize the npm executable path

CHANGELOG.md

@@ -14,6 +14,7 @@
 - Recommendations expose ranked candidates, factor scores and evidence instead of only the winning ecosystem.
 - Project fixtures and policy documentation now exercise and explain candidate ranking.
 - The npm package ships runtime and brand essentials without bundling heavyweight promotional renders.
+- The npm executable path is normalized for current npm clients and verified against the built MCP entrypoint.
 
 ## [0.2.1] - 2026-08-22
 

docs/RELEASE_NOTES_0.3.0.md

@@ -11,6 +11,7 @@ OrchestrUI now explains not only which UI ecosystem wins, but how every admissib
 - Eight independently specified adversarial goldens run separately from the 50-case internal policy benchmark.
 - All three executable fixtures now include installed dependency versions and captured ranking evidence.
 - The npm archive excludes heavyweight promotional renders that are unnecessary at runtime.
+- The `orchestrui-mcp` executable is normalized for current npm clients and checked against its built entrypoint.
 
 ## Compatibility
 

package.json

@@ -26,7 +26,7 @@
   "main": "./dist/mcp/src/server.js",
   "types": "./dist/mcp/src/server.d.ts",
   "bin": {
-    "orchestrui-mcp": "./dist/mcp/src/server.js"
+    "orchestrui-mcp": "dist/mcp/src/server.js"
   },
   "files": [
     "dist/",

scripts/validate.mjs

@@ -255,6 +255,9 @@ if (serverManifest.packages?.[0]?.identifier !== packageManifest.name) fail("MCP
 if (!/^\^?2\./.test(packageManifest.dependencies?.["@modelcontextprotocol/server"] ?? "")) {
   fail("OrchestrUI must use the stable MCP TypeScript SDK v2 server package");
 }
+if (packageManifest.bin?.["orchestrui-mcp"] !== "dist/mcp/src/server.js") {
+  fail("The npm executable path must be normalized for npm 11 and point to the built MCP server");
+}
 
 for (const file of [
   "README.md", "README_RU.md", "LICENSE", "PRIVACY.md", "TERMS.md", "SECURITY.md", "CONTRIBUTING.md",

test/package-entrypoint.test.mjs

@@ -0,0 +1,11 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+
+const manifest = JSON.parse(fs.readFileSync("package.json", "utf8"));
+
+test("npm package exposes a portable MCP executable", () => {
+  assert.equal(manifest.bin?.["orchestrui-mcp"], "dist/mcp/src/server.js");
+  const executable = fs.readFileSync(manifest.bin["orchestrui-mcp"], "utf8");
+  assert.ok(executable.startsWith("#!/usr/bin/env node\n"));
+});