@amalgm/browser 0.1.1 → 0.1.2-preview.34176754339

package/PURPOSE.md

@@ -50,6 +50,26 @@ public Browser ports. It does not own a second browser implementation.
 
 ## Axioms
 
+Consumer assembly derives exact same-branch dependency pins from the declared
+package manifests and registry candidate records. One pending composition per
+branch preserves human edits; complete consumer checks for the exact merge tree govern its
+merge, and publication never implies installed adoption.
+
+Managed package delivery starts from a clean, exact main or preview source
+commit. The workflow occurrence supplies only its generated version and source
+record; tests run against those candidate inputs before packing. Every native
+gate and publication use that same tarball and integrity. A candidate tag makes
+bytes available to release assembly; it never promotes an installed runtime.
+Release tooling remains available inside each owner repository so a developer
+or CI job never needs access to another private product repository.
+Registry credentials are available only to the final protected publication job,
+after every native examination proves the exact candidate bytes.
+Native consumers install the archive as a dependency, so SDK development
+dependencies never become an end-user installation requirement.
+The repository token creates only its own dependency proposals and explicitly
+dispatches checks and delivery; every admitted gate proves the actual checkout,
+including the exact two-parent merge commit that becomes managed source.
+
 Managed releases bind to one exact published Core version and build from the
 locked dependency graph on the supported Node toolchain.
 

package/README.md

@@ -118,3 +118,30 @@ adapter contracts, migration fixtures, package installation, and tarball
 hygiene. The opt-in suites use real bundled Chromium and real Electron.
 
 The complete documentation index is [docs/README.md](./docs/README.md).
+
+## Managed package delivery
+
+Managed npm delivery uses `.github/workflows/publish-package.yml` after the
+exact main/preview owner checks pass. The occurrence generates a unique
+prerelease version and records its source SHA; it reruns the owner suite, packs
+once, and installs that tarball on Linux, macOS and Windows before publication.
+The `candidate-main`/`candidate-preview` tags are release-assembly inputs and
+never select installed runtimes. `package.json` declares this owner's gates,
+CLI probes, peer-only exports and lifecycle permissions. The standalone runner
+under `scripts/release/` is intentionally copied across owners to preserve
+private repository access boundaries. The final publish step uses the `NPM_TOKEN`
+secret in the `npm-release` environment. Where npm trusted publishing is
+configured for this repository's `publish-package.yml` and that environment,
+the token can be omitted. Authentication does not replace native certification,
+exact source records or artifact integrity; private source repositories do not
+receive npm's public-source provenance.
+
+Managed dependency reconciliation reads this owner’s declared manifests and
+updates exact same-branch registry candidates in one pending composition PR per
+branch. The repository token explicitly dispatches the owner checks. Every declared gate must
+pass for the exact merge tree; an atomic expected-base update prevents merging
+with untested concurrent source. Human additions or amendments are preserved.
+The half-hour CI reconciliation recovers missed dispatch hints. Assembly runs
+no dependency code or lifecycle hooks, and repeated owner checks do not publish
+another candidate for unchanged source. Repository policy must allow GitHub Actions to create pull requests; no
+cross-repository credential or paid auto-merge feature is required.

package/dist/src/electron.cjs

@@ -6,7 +6,11 @@ var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -847,6 +851,8 @@ var BrowserError = class extends Error {
     this.code = code;
     this.details = details;
   }
+  code;
+  details;
   name = "BrowserError";
 };
 
@@ -867,6 +873,7 @@ var ElectronBrowserDriver = class {
     this.host = host;
     this.capabilities = [...host.capabilities];
   }
+  host;
   kind = "electron";
   capabilities;
   identities = /* @__PURE__ */ new Map();
@@ -973,6 +980,7 @@ var ElectronCookieAdapter = class {
   constructor(cookies) {
     this.cookies = cookies;
   }
+  cookies;
   id = ELECTRON_COOKIE_ADAPTER_ID;
   supportsPartitionedCookies = false;
   async read() {
@@ -11917,6 +11925,7 @@ var AdBlockAllowlist = class {
     this.file = file;
     this.paused = read(file);
   }
+  file;
   paused;
   write = Promise.resolve();
   enabled(hostname) {
@@ -11967,6 +11976,7 @@ var NativeAdBlocker = class {
     this.loading = !this.disabled;
     this.allowlist = new AdBlockAllowlist(options.settingsPath);
   }
+  options;
   engine = null;
   loading;
   installed;
@@ -12605,6 +12615,8 @@ var BrowserAdBlockIpc = class {
     import_electron6.ipcMain.handle(BROWSER_IPC.adBlockGetStatus, this.getStatus);
     import_electron6.ipcMain.handle(BROWSER_IPC.adBlockSetEnabled, this.setEnabled);
   }
+  blocker;
+  sites;
   dispose() {
     import_electron6.ipcMain.removeHandler(BROWSER_IPC.adBlockGetStatus);
     import_electron6.ipcMain.removeHandler(BROWSER_IPC.adBlockSetEnabled);
@@ -12684,6 +12696,7 @@ var BrowserContextMenuController = class {
     this.isDev = isDev;
     import_electron7.ipcMain.handle(BROWSER_IPC.contextAction, this.handleAction);
   }
+  isDev;
   requests = /* @__PURE__ */ new Map();
   show(site, params) {
     if (site.contents.id !== site.rootGuestId) {
@@ -12817,6 +12830,8 @@ var BrowserDownloadController = class {
     browserSession2.on("will-download", this.started);
     import_electron8.ipcMain.handle(BROWSER_IPC.downloadAction, this.handleAction);
   }
+  browserSession;
+  sites;
   downloads = /* @__PURE__ */ new Map();
   dispose() {
     this.downloads.clear();
@@ -12916,6 +12931,9 @@ var BrowserPermissionController = class {
     browserSession2.setPermissionRequestHandler(this.request);
     import_electron9.ipcMain.on(BROWSER_IPC.permissionResponse, this.respond);
   }
+  browserSession;
+  sites;
+  isTrustedAppUrl;
   pending = /* @__PURE__ */ new Map();
   decisions = /* @__PURE__ */ new Map();
   dispose() {
@@ -13011,6 +13029,7 @@ var BrowserSiteManager = class {
   constructor(options) {
     this.options = options;
   }
+  options;
   sites = /* @__PURE__ */ new Map();
   automationEmbedders = /* @__PURE__ */ new Map();
   get(webContentsId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/browser",
-  "version": "0.1.1",
+  "version": "0.1.2-preview.34176754339",
   "description": "Safe persistent browser automation across headless Chromium and visible Electron surfaces.",
   "repository": {
     "type": "git",
@@ -88,13 +88,19 @@
     "test:electron": "tsx scripts/run-electron-test.ts",
     "verify": "npm run check && npm run build && npm test && npm run verify:pack",
     "verify:pack": "tsx scripts/verify-package.ts",
-    "prepack": "npm run build"
+    "prepack": "npm run build",
+    "release:admit": "node scripts/release/package.mjs admit",
+    "release:prepare": "node scripts/release/package.mjs prepare",
+    "release:examine": "node scripts/release/package.mjs examine",
+    "release:publish": "node scripts/release/package.mjs publish",
+    "release:compose": "node scripts/release/compose.mjs",
+    "test:release": "node --test scripts/release/*.test.mjs"
   },
   "engines": {
     "node": ">=24"
   },
   "dependencies": {
-    "@amalgm/core": "0.4.7",
+    "@amalgm/core": "0.4.8-preview.34168975242",
     "@ghostery/adblocker": "^2.18.1",
     "agent-browser": "0.26.0",
     "better-sqlite3": "^12.10.1",
@@ -116,9 +122,46 @@
     "@types/node": "^20.19.43",
     "@types/ws": "^8.18.1",
     "cross-env": "^7.0.3",
-    "electron": "41.7.1",
-    "esbuild": "0.27.4",
+    "electron": "41.10.7",
+    "esbuild": "0.28.2",
     "tsx": "^4.23.1",
     "typescript": "^5.9.3"
+  },
+  "amalgmRelease": {
+    "schema": 1,
+    "workflow": "ci.yml",
+    "jobs": [
+      "verify",
+      "real-headless",
+      "real-electron"
+    ],
+    "verify": "verify",
+    "cli": [
+      "amalgm-browser"
+    ],
+    "peerExports": [
+      "./electron"
+    ]
+  },
+  "allowScripts": {
+    "agent-browser@0.26.0": true,
+    "better-sqlite3@12.11.1": true,
+    "ffmpeg-static@5.3.0": true,
+    "fsevents@2.3.3": false,
+    "esbuild@0.28.2": true,
+    "electron@41.10.7": true
+  },
+  "amalgmComposition": {
+    "schema": 1,
+    "manifests": [
+      "package.json"
+    ]
+  },
+  "gitHead": "f5b42292f912fcdf55bdf121fd553ffb1657b9db",
+  "amalgmSource": {
+    "repository": "amalgm-inc/amalgm-browser",
+    "branch": "preview",
+    "commit": "f5b42292f912fcdf55bdf121fd553ffb1657b9db",
+    "occurrence": "34176754339"
   }
 }