@amalgm/live 0.2.80 → 0.2.81-main.34176653973

package/PURPOSE.md

@@ -18,6 +18,12 @@ its cutover.
 
 ## Axioms
 
+Managed package delivery starts from a clean, exact main or preview source
+commit. Its workflow occurrence supplies only the generated version and source
+record, and native consumer gates use the same packed bytes as publication.
+Candidate publication is an assembly input; it does not change Shell's Live pin
+or certify a new wire contract, cloud migration or cross-machine rollout.
+
 1. **The SDK owns portable live contracts, not a machine.** Entity-record
    shapes, resource identifiers, content manifests, checksums, frame shapes,
    mutation envelopes, ordering rules, and portable Watch laws belong here;
@@ -483,3 +489,9 @@ The portable entity Apply/Verify subsystem exists here. Production filesystem,
 SQLite, immutable-cache, Git-process, and watcher composition remains a Shell
 release step; until that published-package adoption is complete, universal
 cross-machine materialization is not a shipped claim.
+
+Registry credentials are available only to the final protected publication job,
+after every native examination proves the exact candidate bytes.
+Native consumers install the archive as a dependency, so SDK development
+dependencies never become an end-user installation requirement.
+Each admitted owner gate proves its actual checkout equals the managed source.

package/README.md

@@ -45,3 +45,14 @@ npm install
 npm test              # build + unit tests
 npm run test:parity   # golden vectors vs the shipped engine runtime
 ```
+
+## Managed candidate delivery
+
+The owner workflows verify main/preview source and publish one immutable npm
+candidate after ESM/CommonJS tarball examinations on all three desktop OSes.
+The exact version, source commit and integrity travel in the release record.
+Candidate tags do not change installed Shell pins or certify the cloud protocol;
+see `AGENTS.md` for the delivery and adoption boundary. Every native examination must pass before the final publisher receives its
+`npm-release` environment's `NPM_TOKEN` secret. An already configured npm trusted
+publisher can operate without that token. Private source retains exact source
+and artifact evidence rather than npm public-source provenance.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/live",
-  "version": "0.2.80",
+  "version": "0.2.81-main.34176653973",
   "description": "Portable realtime SDK for Amalgm — wire contracts, mutation discipline, and delivery state machines behind host-injected adapters.",
   "type": "module",
   "main": "./dist-cjs/index.js",
@@ -95,9 +95,30 @@
     "certification:release": "node certification/src/release.mjs prepare --profile certification",
     "certification:preflight": "node certification/src/release.mjs preflight",
     "test": "npm run build && node --test",
-    "test:parity": "npm run build && node --test tests/parity/"
+    "test:parity": "npm run build && node --test tests/parity/",
+    "release:admit": "node scripts/release/package.mjs admit",
+    "release:prepare": "node scripts/release/package.mjs prepare",
+    "release:examine": "node scripts/release/package.mjs examine",
+    "release:publish": "node scripts/release/package.mjs publish",
+    "test:release": "node --test scripts/release/*.test.mjs"
   },
   "devDependencies": {
     "typescript": "^5.7.3"
+  },
+  "amalgmRelease": {
+    "schema": 1,
+    "workflow": "verify.yml",
+    "jobs": [
+      "verify"
+    ],
+    "verify": "test",
+    "cli": []
+  },
+  "gitHead": "31e4c3dcf5e82c98aad2cbe076205e8042afccc8",
+  "amalgmSource": {
+    "repository": "amalgm-inc/amalgm-live",
+    "branch": "main",
+    "commit": "31e4c3dcf5e82c98aad2cbe076205e8042afccc8",
+    "occurrence": "34176653973"
   }
 }