@amalgm/tools 0.1.6 → 0.1.7-main.34175698435

package/PURPOSE.md

@@ -39,6 +39,26 @@ and parity evidence only.
 
 ## Axioms
 
+Consumer assembly derives exact same-branch dependency pins from the declared
+package manifests and registry candidate records. One pending composition per
+branch preserves human edits; complete consumer checks for the exact merge tree govern its
+merge, and publication never implies installed adoption.
+
+Managed package delivery starts from a clean, exact main or preview source
+commit. The workflow occurrence supplies only its generated version and source
+record; tests run against those candidate inputs before packing. Every native
+gate and publication use that same tarball and integrity. A candidate tag makes
+bytes available to release assembly; it never promotes an installed runtime.
+Release tooling remains available inside each owner repository so a developer
+or CI job never needs access to another private product repository.
+Registry credentials are available only to the final protected publication job,
+after every native examination proves the exact candidate bytes.
+Native consumers install the archive as a dependency, so SDK development
+dependencies never become an end-user installation requirement.
+The repository token creates only its own dependency proposals and explicitly
+dispatches checks and delivery; every admitted gate proves the actual checkout,
+including the exact two-parent merge commit that becomes managed source.
+
 Managed releases bind to one exact published Core version and build from the
 locked dependency graph on the supported Node toolchain.
 

package/README.md

@@ -110,3 +110,30 @@ contain opaque references resolved through `CallOptions.resolveSecret`.
 See [PURPOSE.md](./PURPOSE.md) for the complete contract and
 [SHELL_INTEGRATION.md](./docs/SHELL_INTEGRATION.md) for active composition.
 The [Engine integration](./docs/ENGINE_INTEGRATION.md) page is historical only.
+
+## Managed package delivery
+
+Managed npm delivery uses `.github/workflows/publish-package.yml` after the
+exact main/preview owner checks pass. The occurrence generates a unique
+prerelease version and records its source SHA; it reruns the owner suite, packs
+once, and installs that tarball on Linux, macOS and Windows before publication.
+The `candidate-main`/`candidate-preview` tags are release-assembly inputs and
+never select installed runtimes. `package.json` declares this owner's gates,
+CLI probes, peer-only exports and lifecycle permissions. The standalone runner
+under `scripts/release/` is intentionally copied across owners to preserve
+private repository access boundaries. The final publish step uses the `NPM_TOKEN`
+secret in the `npm-release` environment. Where npm trusted publishing is
+configured for this repository's `publish-package.yml` and that environment,
+the token can be omitted. Authentication does not replace native certification,
+exact source records or artifact integrity; private source repositories do not
+receive npm's public-source provenance.
+
+Managed dependency reconciliation reads this owner’s declared manifests and
+updates exact same-branch registry candidates in one pending composition PR per
+branch. The repository token explicitly dispatches the owner checks. Every declared gate must
+pass for the exact merge tree; an atomic expected-base update prevents merging
+with untested concurrent source. Human additions or amendments are preserved.
+The half-hour CI reconciliation recovers missed dispatch hints. Assembly runs
+no dependency code or lifecycle hooks, and repeated owner checks do not publish
+another candidate for unchanged source. Repository policy must allow GitHub Actions to create pull requests; no
+cross-repository credential or paid auto-merge feature is required.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/tools",
-  "version": "0.1.6",
+  "version": "0.1.7-main.34175698435",
   "description": "Local-first tool definitions, Toolbox registry, and agent execution surfaces.",
   "license": "UNLICENSED",
   "private": false,
@@ -44,13 +44,19 @@
     "check": "tsx scripts/check-tree.ts && tsc -p tsconfig.json && tsc -p tsconfig.test.json",
     "test": "tsx --test --test-concurrency=1 --test-timeout=30000 test/*.test.ts",
     "verify": "npm run check && npm run build && npm test",
-    "prepack": "npm run build"
+    "prepack": "npm run build",
+    "release:admit": "node scripts/release/package.mjs admit",
+    "release:prepare": "node scripts/release/package.mjs prepare",
+    "release:examine": "node scripts/release/package.mjs examine",
+    "release:publish": "node scripts/release/package.mjs publish",
+    "release:compose": "node scripts/release/compose.mjs",
+    "test:release": "node --test scripts/release/*.test.mjs"
   },
   "engines": {
     "node": ">=24"
   },
   "dependencies": {
-    "@amalgm/core": "0.4.7",
+    "@amalgm/core": "0.4.8-main.34168902443",
     "better-sqlite3": "^12.6.2"
   },
   "devDependencies": {
@@ -58,5 +64,34 @@
     "@types/node": "^20.19.43",
     "tsx": "^4.23.1",
     "typescript": "^5.9.3"
+  },
+  "amalgmRelease": {
+    "schema": 1,
+    "workflow": "verify.yml",
+    "jobs": [
+      "verify"
+    ],
+    "verify": "verify",
+    "cli": [
+      "amalgm-tools"
+    ]
+  },
+  "allowScripts": {
+    "better-sqlite3@12.11.1": true,
+    "esbuild@0.28.1": true,
+    "fsevents@2.3.3": false
+  },
+  "amalgmComposition": {
+    "schema": 1,
+    "manifests": [
+      "package.json"
+    ]
+  },
+  "gitHead": "ab131c0ae46724efb84318568125193a8432d233",
+  "amalgmSource": {
+    "repository": "amalgm-inc/amalgm-tools",
+    "branch": "main",
+    "commit": "ab131c0ae46724efb84318568125193a8432d233",
+    "occurrence": "34175698435"
   }
 }