@@ -0,0 +1,16 @@
+---
+'@objectstack/scenarios': patch
+---
+
+feat(scenarios): `@objectstack/scenarios` is published, with an `objectstack-scenarios` command line: `npx @objectstack/scenarios run` runs the open scenario cards with no checkout of the platform
+
+Clause-②: yes
+Metadata-protocol: none
+
+The package was private. It is now released with the `@objectstack/*` packages, at their version, and it carries:
+
+- **A `bin`, `objectstack-scenarios`.** `objectstack-scenarios run [flags]` is the scenario runner (`run-scenarios` in this repository) with the same flags, defaults and refusals: it drives your own local Claude Code login and refuses to start when `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN` is set or the CLI is logged in with an API key. `help` and `version` are the other two commands. The bin runs the built JavaScript in `dist/`.
+- **The open card library as package data** (`dist/library/`): the cards of `docs/qa/scenarios/` and the capability areas they are checked against, copied at build time. `run` reads them unless `--cards DIR` names another directory, which is loaded as the overlay. Run records go to `./scenario-runs` unless `--out` says otherwise.
+- **The library entries it already had**: the card schema and loader (`@objectstack/scenarios`), the scorer (`./score`, `./score/full`), the runner (`./runner`) and the gallery exporter (`./export`).
+
+It is not an `objectstack` (`os`) subcommand, and nothing in `@objectstack/cli` changes.
@@ -83,6 +83,7 @@
       "create-objectstack",
       "@objectstack/connector-openapi",
       "@objectstack/verify",
+      "@objectstack/scenarios",
       "@object-ui/auth",
       "@object-ui/cli",
       "@object-ui/collaboration",
 
@@ -1,6 +1,7 @@
 # @objectstack/scenarios
 
-Private, unpublished. The schema (zod) and loader for the open scenario library under
+Published, with a command line: `npx @objectstack/scenarios run` (below, "Running from npm").
+The schema (zod) and loader for the open scenario library under
 [`docs/qa/scenarios/`](../../../docs/qa/scenarios/README.md) — that README is the format's
 reference.
 
@@ -27,10 +28,11 @@ The private overlay's owner migrates its cards to each new card shape (today: `o
 - `src/score/` — the deterministic scorer, entries `@objectstack/scenarios/score` and
   `@objectstack/scenarios/score/full` (below).
 
-Not published. `pnpm --filter @objectstack/scenarios build` (tsup) writes `dist/` as ESM, CJS and
-`.d.ts`, and every `exports` subpath points there, so a consumer that links the framework tree
-and bundles its own entry can load the scorer under plain Node. The suites and `run-scenarios`
-read `src/` directly. Nothing here calls a model or the network.
+`pnpm --filter @objectstack/scenarios build` (tsup) writes `dist/` as ESM, CJS and `.d.ts`, and
+every `exports` subpath points there, so plain Node loads the package with no TypeScript resolver.
+The build then copies the open library into `dist/library/` (`scripts/pack-library.mjs`), which
+the published command line runs. The suites and `run-scenarios` read `src/` directly. The schema,
+loader and scorer call no model and no network; the runner drives a local Claude Code session.
 
 ## Scoring a run against a card — `@objectstack/scenarios/score`
 
@@ -147,6 +149,31 @@ pnpm --filter @objectstack/scenarios run-scenarios --packages workspace      # o
 Per card and mode the runner writes `docs/qa/platform-checklist/runs/<date>-scenario-<card>.json`
 (git-ignored) and prints the scorecard.
 
+### Running from npm
+
+No checkout needed: the package's `objectstack-scenarios` command is the same runner, with the same flags.
+
+```bash
+npx @objectstack/scenarios run --only service_desk --modes scratch   # one card, scratch mode
+npx @objectstack/scenarios run                                       # every card, both modes
+npx @objectstack/scenarios run --cards ./my-cards                    # a directory of your own, loaded as the overlay
+npx @objectstack/scenarios help                                      # the commands; `version` prints the package version
+```
+
+- **Prerequisites**: Node 22 or later, and Claude Code installed and logged in with your own subscription
+  (`claude auth login`). The runner refuses to start when `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN` is set, or the
+  CLI is logged in with an API key. Each card scaffolds a project with `create-objectstack` (`--create-version` picks
+  its version).
+- **The cards**: the package carries the open library of this repository (`docs/qa/scenarios/*.json` and the
+  capability areas, copied into `dist/library/` at build time) and nothing else. `--cards DIR` runs another directory
+  as the overlay, where a `generic` card is refused.
+- **The records**: one `scenario-runs/<date>-scenario-<card>.json` per card, under the directory you run it from,
+  unless `--out DIR` says otherwise; the scorecard is printed as in a checkout. `--work DIR` keeps the scaffolded
+  projects (default: a temp directory).
+- **The packages**: always the published ones (`--packages published`, the default). `--packages workspace` builds
+  and packs a checkout's packages, so the published CLI refuses it; run it from a checkout.
+- It is not an `objectstack` (`os`) command: scenario scoring stays out of the customer CLI.
+
 | Mode | Steps |
 |:---|:---|
 | `scratch` | `create-objectstack` → the agent builds from the card prompt and the runner's data contract (`prompts.ts`) → `objectstack validate` / `build` / `verify` (proofs chosen from the tags) → score → `objectstack dev --fresh` → seed, one user + permission-set grant + API key per persona → every question as every persona it names and every operation as its persona, over the app's MCP → the iterate change → rebuild, re-score, re-run |
 
@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+// `bin.objectstack-scenarios` in package.json: npm packs this file because it
+// is the `bin` target. It runs the BUILT CLI (`dist/bin.js`, from
+// `src/bin.ts`), never a `.ts` source; a refusal or failure prints its message
+// and exits 1, as `run-scenarios` does.
+import { runCli } from '../dist/bin.js';
+
+runCli(process.argv.slice(2)).then(
+  (code) => process.exit(code),
+  (e) => {
+    console.error(e instanceof Error ? e.message : e);
+    process.exit(1);
+  },
+);
@@ -1,12 +1,14 @@
 {
   "name": "@objectstack/scenarios",
   "version": "0.1.0",
-  "private": true,
   "license": "Apache-2.0",
-  "description": "Scenario-card schema and loader for the open scenario library under docs/qa/scenarios/. A card states an authoring prompt, the structural expectation a generated app must meet, seed rows, data questions whose truth the loader COMPUTES from a declarative spec over those rows, personas, write operations with their guardrail checks, and one iteration request \u2014 plus the deterministic scorer that judges a built artifact, an observed write or an agent's answer against a loaded card (`@objectstack/scenarios/score`). Not published (a minimal tsup build to `dist/` so a linked consumer's bundled entry can load it under plain Node; `./score` is the narrow scorer, `./score/full` adds the capability-tag checks), no model calls: a devx instrument, not a protocol (packages/spec carries no obligation for this format).",
+  "description": "Run the open ObjectStack scenario cards end to end from npm: `npx @objectstack/scenarios run` builds an app from each card's prompt with your local Claude Code login, scores it and writes one run record per card. Also the scenario-card schema and loader (computed truths over seed rows) and the deterministic scorer (`@objectstack/scenarios/score`, `./score/full`). Ships the open card library (docs/qa/scenarios) as package data, never a private overlay; refuses an API-billed login. A devx instrument, not a protocol: packages/spec carries no obligation for this format.",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "bin": {
+    "objectstack-scenarios": "./bin/objectstack-scenarios.js"
+  },
   "exports": {
     ".": {
       "import": {
@@ -60,7 +62,7 @@
     }
   },
   "scripts": {
-    "build": "tsup && node ../../../scripts/check-dts-emitted.mjs",
+    "build": "tsup && node scripts/pack-library.mjs && node ../../../scripts/check-dts-emitted.mjs",
     "test": "vitest run",
     "typecheck": "tsc --noEmit",
     "run-scenarios": "tsx src/runner/cli.ts",
@@ -93,5 +95,16 @@
     "directory": "packages/qa/scenarios"
   },
   "homepage": "https://objectstack.ai/docs",
-  "bugs": "https://github.com/objectstack-ai/objectstack/issues"
+  "bugs": "https://github.com/objectstack-ai/objectstack/issues",
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "engines": {
+    "node": ">=22.0.0"
+  }
 }
@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+// The package build's last step: copy the OPEN card library into
+// `dist/library/`, keeping the repository's layout, so the published CLI runs
+// the cards with no checkout (`src/runner/library.ts` reads it back):
+//
+//   docs/qa/scenarios/*.json                  → dist/library/docs/qa/scenarios/
+//   docs/qa/platform-checklist/areas/*.json   → dist/library/docs/qa/platform-checklist/areas/
+//
+// ⛔ Only these two directories of THIS repository, one level deep, regular
+// `.json` files only. The private overlay (held-out and customer-derived
+// cards, objectstack-ai/cloud#3603) lives outside this repository and has no
+// path in here; `test/build/packed-tarball.test.ts` packs the package and
+// fails on any card in the tarball that is not byte for byte a card of
+// `docs/qa/scenarios/`.
+//
+// turbo re-runs the build when either directory changes: the package's
+// `turbo.json` adds them to the build's inputs.
+
+import { copyFileSync, lstatSync, mkdirSync, readdirSync, rmSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const PKG = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const REPO = resolve(PKG, '../../..');
+const OUT = join(PKG, 'dist/library');
+const DIRS = ['docs/qa/scenarios', 'docs/qa/platform-checklist/areas'];
+
+rmSync(OUT, { recursive: true, force: true });
+const counts = [];
+for (const dir of DIRS) {
+  const from = join(REPO, dir);
+  const to = join(OUT, dir);
+  mkdirSync(to, { recursive: true });
+  let copied = 0;
+  for (const name of readdirSync(from).sort()) {
+    if (!name.endsWith('.json') || !lstatSync(join(from, name)).isFile()) continue;
+    copyFileSync(join(from, name), join(to, name));
+    copied++;
+  }
+  if (copied === 0) {
+    console.error(`pack-library: no .json file under ${dir}: the published CLI would have nothing to run`);
+    process.exit(1);
+  }
+  counts.push(`${copied} from ${dir}`);
+}
+console.log(`pack-library: ${counts.join(', ')} → ${OUT}`);
@@ -0,0 +1,66 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * `objectstack-scenarios` — the published command line (`npx @objectstack/scenarios run …`).
+ *
+ * A thin dispatcher over the runner's own CLI (`runner/cli.ts`): `run` hands
+ * every argument after it to the same `main` that
+ * `pnpm --filter @objectstack/scenarios run-scenarios` runs, so the flags, the
+ * defaults and the refusals are that CLI's (no API-billed login, the published
+ * packages by default). Not an `os` subcommand, and it carries no scoring of
+ * a customer's own app: the cards it runs are the open library the package
+ * ships (`runner/library.ts`), or a `--cards` directory loaded as the overlay.
+ *
+ * `bin/objectstack-scenarios.js` imports the BUILT form of this file
+ * (`dist/bin.js`), so npm runs JavaScript, never a `.ts` source.
+ *
+ * The runner is imported only for `run`, and the build keeps it out of this
+ * file (`tsup.config.ts` turns the import into one of the built `dist/cli.js`):
+ * its graph (the scorer's objectql and plugin-sharing among it) takes about a
+ * second warm and several cold, which `help` and `version` must not pay.
+ */
+
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const USAGE = `Usage: objectstack-scenarios <command> [flags]
+
+Commands:
+  run [flags]   run the scenario cards end to end and write one run record per card
+                (the flags of run-scenarios: --only, --modes, --driver, --cards, --out, …;
+                see the package README, "Running from npm")
+  help          print this text
+  version       print the package version
+
+Runs on your own Claude Code login: it refuses to start when an API key is configured.`;
+
+export interface CliIo {
+  out: (line: string) => void;
+  err: (line: string) => void;
+}
+
+const consoleIo: CliIo = { out: (l) => console.log(l), err: (l) => console.error(l) };
+
+function packageVersion(): string {
+  // `src/bin.ts` and `dist/bin.js` both sit one directory below the package root.
+  const manifest = join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json');
+  return (JSON.parse(readFileSync(manifest, 'utf8')) as { version: string }).version;
+}
+
+/** Run one command line; answers the process exit code. */
+export async function runCli(argv: readonly string[], io: CliIo = consoleIo): Promise<number> {
+  const [command, ...rest] = argv;
+  if (command === 'run') return (await import('./runner/cli.js')).main(rest);
+  if (command === 'help' || command === '--help' || command === '-h') {
+    io.out(USAGE);
+    return 0;
+  }
+  if (command === 'version' || command === '--version' || command === '-v') {
+    io.out(packageVersion());
+    return 0;
+  }
+  io.err(command === undefined ? 'objectstack-scenarios: name a command' : `objectstack-scenarios: unknown command \`${command}\``);
+  io.err(USAGE);
+  return 2;
+}
@@ -4,7 +4,8 @@
  * `pnpm --filter @objectstack/scenarios run-scenarios [flags]` — run every card
  * under `docs/qa/scenarios/` end to end and write one run record per card.
  *
- *   --cards DIR          the card directory (default: the repo's docs/qa/scenarios);
+ *   --cards DIR          the card directory (default: the repo's docs/qa/scenarios,
+ *                        or the copy the published package carries, `library.ts`);
  *                        any other directory is loaded as the private overlay,
  *                        where a `generic` card is refused (`libraryOf`)
  *   --only ID[,ID]       run only these cards
@@ -32,27 +33,30 @@
  *                        model each turn was served, and mark a mismatch
  *   --template F         a verified build (dist/objectstack.json) for template mode
  *   --no-iterate-run     skip the Run half after the iterate (scratch mode)
- *   --out DIR            where records go (default docs/qa/platform-checklist/runs, git-ignored)
+ *   --out DIR            where records go (default docs/qa/platform-checklist/runs, git-ignored;
+ *                        ./scenario-runs when run from the published package)
  *   --work DIR           where projects are scaffolded (default: a temp dir)
  *   --create-version V   the create-objectstack version (default latest)
  *   --packages P         where the @objectstack/* packages come from (`packages.ts`):
  *                        `published` (default) — npm, what a customer gets;
  *                        `workspace` — this checkout, built and packed as the
- *                        release would publish it (unreleased; never exported)
+ *                        release would publish it (unreleased; never exported;
+ *                        refused when run from the published package, which has no checkout)
  *
  * ⛔ No API-billed model: the live driver refuses to start when an API key is
  * configured (the cost ruling on cloud#3600).
  */
 
 import { execSync } from 'node:child_process';
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { formatRefusal, libraryOf, loadScenarios, readCapabilityAreas } from '../loader.js';
 import { HttpApp } from './app.js';
 import { ClaudeCodeDriver, RecordedDriver, RecordingDriver, type AgentDriver } from './driver.js';
+import { CAPABILITY_AREAS_DIR, locateLibraryRoot } from './library.js';
 import { minutesText, runCard, type ProjectOps } from './orchestrate.js';
 import { installedSpecVersion, PACKAGES_MODES, prepareWorkspacePackages, settleWorkspaceProject, workspaceScaffolder, type PackageSource, type PackagesMode } from './packages.js';
 import { bootDev, os, readArtifact, readNamespace, scaffold } from './project.js';
@@ -191,15 +195,19 @@ export function makeDriver(spec: string, opts: DriverLimits & DriverModels = {})
 export async function main(argv: readonly string[]): Promise<number> {
   const args = parseArgs(argv);
   const here = dirname(fileURLToPath(import.meta.url));
-  const repo = findUp(here, (d) => existsSync(join(d, 'pnpm-workspace.yaml')));
+  // The checkout, or the library root the published package carries (`library.ts`).
+  const { root: repo, checkout } = locateLibraryRoot(here);
+  if (args.packages === 'workspace' && !checkout) {
+    throw new Error('--packages workspace builds and packs the packages of an objectstack checkout; the published CLI has none. Run it from a checkout (`pnpm --filter @objectstack/scenarios run-scenarios --packages workspace`), or use --packages published');
+  }
   const cardsDir = resolve(args.cards ?? join(repo, 'docs/qa/scenarios'));
-  const outDir = resolve(args.out ?? join(repo, 'docs/qa/platform-checklist/runs'));
+  const outDir = resolve(args.out ?? (checkout ? join(repo, 'docs/qa/platform-checklist/runs') : 'scenario-runs'));
   const work = resolve(args.work ?? mkdtempSync(join(tmpdir(), 'scenario-run-')));
   mkdirSync(work, { recursive: true });
   mkdirSync(outDir, { recursive: true });
 
   const { cards, refusals } = loadScenarios(cardsDir, {
-    areas: readCapabilityAreas(join(repo, 'docs/qa/platform-checklist/areas')),
+    areas: readCapabilityAreas(join(repo, CAPABILITY_AREAS_DIR)),
     library: libraryOf(cardsDir, repo),
   });
   for (const r of refusals) console.error(formatRefusal(r));
@@ -250,7 +258,8 @@ export async function main(argv: readonly string[]): Promise<number> {
   const template = args.template ? JSON.parse(readFileSync(args.template, 'utf8')) : undefined;
   let framework: string | undefined;
   try {
-    framework = execSync('git rev-parse --short HEAD', { cwd: repo, encoding: 'utf8' }).trim();
+    // Only a checkout has a framework commit: an installed package may sit in someone else's repository.
+    if (checkout) framework = execSync('git rev-parse --short HEAD', { cwd: repo, encoding: 'utf8' }).trim();
   } catch {
     /* not a checkout */
   }