@amalgm/channels 0.1.4 → 0.1.5-main.34175701070

package/PURPOSE.md

@@ -27,6 +27,26 @@ remain authoritative when multiple hosts share data.
 
 ## Axioms
 
+Consumer assembly derives exact same-branch dependency pins from the declared
+package manifests and registry candidate records. One pending composition per
+branch preserves human edits; complete consumer checks for the exact merge tree govern its
+merge, and publication never implies installed adoption.
+
+Managed package delivery starts from a clean, exact main or preview source
+commit. The workflow occurrence supplies only its generated version and source
+record; tests run against those candidate inputs before packing. Every native
+gate and publication use that same tarball and integrity. A candidate tag makes
+bytes available to release assembly; it never promotes an installed runtime.
+Release tooling remains available inside each owner repository so a developer
+or CI job never needs access to another private product repository.
+Registry credentials are available only to the final protected publication job,
+after every native examination proves the exact candidate bytes.
+Native consumers install the archive as a dependency, so SDK development
+dependencies never become an end-user installation requirement.
+The repository token creates only its own dependency proposals and explicitly
+dispatches checks and delivery; every admitted gate proves the actual checkout,
+including the exact two-parent merge commit that becomes managed source.
+
 Managed releases bind to one exact published Core version and build from the
 locked dependency graph on the supported Node toolchain.
 
@@ -96,3 +116,10 @@ host/                 Supabase, auth, provider, server, and Fly composition
 supabase/migrations/  durable schema and atomic RPCs
 skills/channels/      agent usage guidance
 ```
+
+Hosted delivery examines the final immutable image under both declared managed
+bindings before deploying that exact digest to its source branch's Fly app.
+The host's own pipeline owns replacement, health and provider verification;
+no hosted process updates its package tree in place. A local image examination
+proves image behavior, while Fly networking and durable product journeys retain
+their separate provider proof.

package/README.md

@@ -73,3 +73,37 @@ purpose and invariants.
 ```bash
 npm run verify
 ```
+
+## Managed package delivery
+
+Managed npm delivery uses `.github/workflows/publish-package.yml` after the
+exact main/preview owner checks pass. The occurrence generates a unique
+prerelease version and records its source SHA; it reruns the owner suite, packs
+once, and installs that tarball on Linux, macOS and Windows before publication.
+The `candidate-main`/`candidate-preview` tags are release-assembly inputs and
+never select installed runtimes. `package.json` declares this owner's gates,
+CLI probes, peer-only exports and lifecycle permissions. The standalone runner
+under `scripts/release/` is intentionally copied across owners to preserve
+private repository access boundaries. The final publish step uses the `NPM_TOKEN`
+secret in the `npm-release` environment. Where npm trusted publishing is
+configured for this repository's `publish-package.yml` and that environment,
+the token can be omitted. Authentication does not replace native certification,
+exact source records or artifact integrity; private source repositories do not
+receive npm's public-source provenance.
+
+Hosted delivery is separately wired in `release-hosted.yml`: it builds the exact
+source image, tests both declared bindings without network access, deploys the
+same digest to the selected Fly app, then verifies machine identity and public
+readiness. `package.json` owns the host declaration. The Python effect runner is
+an intentional standalone copy from UI; no other private repository is required.
+Live provider and durable product-flow proof remain separate release obligations.
+
+Managed dependency reconciliation reads this owner’s declared manifests and
+updates exact same-branch registry candidates in one pending composition PR per
+branch. The repository token explicitly dispatches the owner checks. Every declared gate must
+pass for the exact merge tree; an atomic expected-base update prevents merging
+with untested concurrent source. Human additions or amendments are preserved.
+The half-hour CI reconciliation recovers missed dispatch hints. Assembly runs
+no dependency code or lifecycle hooks, and repeated owner checks do not publish
+another candidate for unchanged source. Repository policy must allow GitHub Actions to create pull requests; no
+cross-repository credential or paid auto-merge feature is required.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/channels",
-  "version": "0.1.4",
+  "version": "0.1.5-main.34175701070",
   "description": "Amalgm's SDK and hosted service for durable bidirectional user channels.",
   "type": "module",
   "license": "UNLICENSED",
@@ -46,13 +46,19 @@
     "test": "tsx --test test/*.test.ts",
     "verify": "npm run check && npm test && npm run build && tsx scripts/check-cli-artifact.ts",
     "prepack": "npm run build",
-    "start": "node dist/host/main.js"
+    "start": "node dist/host/main.js",
+    "release:admit": "node scripts/release/package.mjs admit",
+    "release:prepare": "node scripts/release/package.mjs prepare",
+    "release:examine": "node scripts/release/package.mjs examine",
+    "release:publish": "node scripts/release/package.mjs publish",
+    "release:compose": "node scripts/release/compose.mjs",
+    "test:release": "node --test scripts/release/*.test.mjs"
   },
   "engines": {
     "node": ">=24"
   },
   "dependencies": {
-    "@amalgm/core": "0.4.7",
+    "@amalgm/core": "0.4.8-main.34168902443",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@supabase/supabase-js": "2.57.4",
     "jose": "^6.1.0",
@@ -62,5 +68,40 @@
     "@types/node": "^26.1.2",
     "tsx": "^4.23.1",
     "typescript": "5.9.3"
+  },
+  "amalgmRelease": {
+    "schema": 1,
+    "workflow": "verify.yml",
+    "jobs": [
+      "verify"
+    ],
+    "verify": "verify",
+    "cli": [
+      "amalgm-channels"
+    ]
+  },
+  "allowScripts": {
+    "esbuild@0.28.2": true,
+    "fsevents@2.3.3": false
+  },
+  "amalgmHosts": {
+    "channels": {
+      "directory": ".",
+      "context": ".",
+      "dockerfile": "Dockerfile"
+    }
+  },
+  "amalgmComposition": {
+    "schema": 1,
+    "manifests": [
+      "package.json"
+    ]
+  },
+  "gitHead": "5d92512a097e56a91ead84f4fd0ffccce478b5f5",
+  "amalgmSource": {
+    "repository": "amalgm-inc/amalgm-channels",
+    "branch": "main",
+    "commit": "5d92512a097e56a91ead84f4fd0ffccce478b5f5",
+    "occurrence": "34175701070"
   }
 }