@kujolang/paperclip 0.1.1 → 0.1.3

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.3 - 2026-09-02
+
+- Resolve the installed `@kujolang/kujo-runtime` package at worker runtime instead of inlining its package resolver into the ESM worker bundle.
+- Add a package verification regression gate for the external runtime boundary.
+
+## 0.1.2 - 2026-09-02
+
+- Publish through npm trusted publishing with short-lived GitHub Actions identity tokens instead of a stored npm token.
+- Verify the published package through a clean public-registry installation before creating the GitHub release.
+
 ## 0.1.1 - 2026-09-02
 
 - Work around Paperclip `2026.831.1` reporting host version `0.0.0` to the plugin loader while retaining the documented `2026.824.1` support floor.
@@ -11,13 +21,3 @@
 - Bundle and verify ChangeBucket, PatchBrief, CaseFile, and Scent component snapshots.
 - Enforce company-scoped state, feature policy, stale-context rejection, workspace bounds, hostile Git configuration suppression, and process-tree cleanup.
 - Add cross-platform compatibility, dependency review, CodeQL, SBOM, provenance, signed-tag, and exact-tarball release controls.
-
-## 0.1.0
-
-- Initial Paperclip-native Review Pack, Failure Evidence, and Context Pack.
-- Lifecycle-script-free Kujo runtime resolution and deterministic component bundle.
-- Strict workspace, process, output, redaction, schema, provenance, and stale-state boundaries.
-- Monochrome project badges and install-first ecosystem documentation.
-- Root agent, contribution, security, and version contracts.
-- Reproducible lockfile-based CI and npm release gates.
-- Exact Kujo `1.2.2` runtime dependency with the restored Windows package build.

package/README.md

@@ -1,6 +1,6 @@
 # Kujo for Paperclip
 
-[![Version](https://img.shields.io/badge/version-0.1.1-black)](https://github.com/kujolang/paperclip/releases/tag/v0.1.1)
+[![Version](https://img.shields.io/badge/version-0.1.3-black)](https://github.com/kujolang/paperclip/releases/tag/v0.1.3)
 [![License](https://img.shields.io/badge/license-MIT-lightgrey)](LICENSE)
 [![built with Kujo](https://img.shields.io/badge/built%20with-Kujo-white.svg)](https://github.com/kujolang/kujo)
 

package/VERSION

@@ -1 +1 @@
-0.1.1
+0.1.3

package/dist/manifest.js

@@ -14527,7 +14527,7 @@ var DEFAULT_LIMITS = {
   maxInputLogBytes: 2e5,
   maxContextFileBytes: 2e3
 };
-var PLUGIN_VERSION = "0.1.1";
+var PLUGIN_VERSION = "0.1.3";
 var MINIMUM_HOST_VERSION = "0.0.0";
 
 // src/config/schema.ts

package/dist/worker.js

@@ -1,224 +1,8 @@
-var __create = Object.create;
 var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
-var __commonJS = (cb, mod) => function __require2() {
-  try {
-    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-  } catch (e) {
-    throw mod = 0, e;
-  }
-};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-
-// node_modules/@kujolang/kujo-runtime/package.json
-var require_package = __commonJS({
-  "node_modules/@kujolang/kujo-runtime/package.json"(exports, module) {
-    module.exports = {
-      name: "@kujolang/kujo-runtime",
-      version: "1.2.2",
-      description: "Kujo programming language runtime",
-      license: "MIT",
-      repository: {
-        type: "git",
-        url: "git+https://github.com/kujolang/kujo.git",
-        directory: "npm/runtime"
-      },
-      homepage: "https://github.com/kujolang/kujo",
-      engines: {
-        node: ">=18"
-      },
-      bin: {
-        kujo: "bin/kujo.js"
-      },
-      main: "index.js",
-      types: "index.d.ts",
-      exports: {
-        ".": {
-          types: "./index.d.ts",
-          require: "./index.js",
-          default: "./index.js"
-        },
-        "./package.json": "./package.json"
-      },
-      files: [
-        "bin/kujo.js",
-        "index.js",
-        "index.d.ts",
-        "README.md"
-      ],
-      optionalDependencies: {
-        "@kujolang/kujo-darwin-arm64": "1.2.2",
-        "@kujolang/kujo-darwin-x64": "1.2.2",
-        "@kujolang/kujo-linux-arm64": "1.2.2",
-        "@kujolang/kujo-linux-x64": "1.2.2",
-        "@kujolang/kujo-win32-x64": "1.2.2"
-      }
-    };
-  }
-});
-
-// node_modules/@kujolang/kujo-runtime/index.js
-var require_kujo_runtime = __commonJS({
-  "node_modules/@kujolang/kujo-runtime/index.js"(exports, module) {
-    "use strict";
-    var fs2 = __require("node:fs");
-    var path2 = __require("node:path");
-    var RUNTIME_PACKAGE_VERSION = require_package().version;
-    var TARGETS = Object.freeze({
-      "darwin-arm64": Object.freeze({
-        packageName: "@kujolang/kujo-darwin-arm64",
-        binaryName: "kujo"
-      }),
-      "darwin-x64": Object.freeze({
-        packageName: "@kujolang/kujo-darwin-x64",
-        binaryName: "kujo"
-      }),
-      "linux-x64": Object.freeze({
-        packageName: "@kujolang/kujo-linux-x64",
-        binaryName: "kujo"
-      }),
-      "linux-arm64": Object.freeze({
-        packageName: "@kujolang/kujo-linux-arm64",
-        binaryName: "kujo"
-      }),
-      "win32-x64": Object.freeze({
-        packageName: "@kujolang/kujo-win32-x64",
-        binaryName: "kujo.exe"
-      })
-    });
-    function targetFor(platform = process.platform, arch = process.arch) {
-      return TARGETS[`${platform}-${arch}`] || null;
-    }
-    var KujoRuntimeError = class extends Error {
-      constructor(message, code, platform, arch, options = {}) {
-        super(message, options);
-        this.name = this.constructor.name;
-        this.code = code;
-        this.platform = platform;
-        this.arch = arch;
-      }
-    };
-    var UnsupportedPlatformError = class extends KujoRuntimeError {
-      constructor(platform, arch) {
-        const supported = Object.keys(TARGETS).sort().join(", ");
-        super(
-          `Kujo does not provide an npm runtime for ${platform}-${arch}. Supported targets: ${supported}.`,
-          "KUJO_UNSUPPORTED_PLATFORM",
-          platform,
-          arch
-        );
-      }
-    };
-    var MissingPlatformPackageError = class extends KujoRuntimeError {
-      constructor(platform, arch, target, cause) {
-        super(
-          [
-            `Kujo's platform package ${target.packageName} is not installed.`,
-            "Reinstall @kujolang/kujo-runtime without --omit=optional or --no-optional,",
-            "and ensure your package manager is allowed to install optional dependencies."
-          ].join(" "),
-          "KUJO_PLATFORM_PACKAGE_MISSING",
-          platform,
-          arch,
-          { cause }
-        );
-        this.packageName = target.packageName;
-      }
-    };
-    var BinaryNotFoundError = class extends KujoRuntimeError {
-      constructor(platform, arch, packageName, binaryPath) {
-        super(
-          `Kujo's platform package ${packageName} does not contain the expected binary at ${binaryPath}. Reinstall the package and verify your npm cache.`,
-          "KUJO_BINARY_MISSING",
-          platform,
-          arch
-        );
-        this.packageName = packageName;
-        this.binaryPath = binaryPath;
-      }
-    };
-    function selectedTarget(options = {}) {
-      const platform = options.platform || process.platform;
-      const arch = options.arch || process.arch;
-      const target = targetFor(platform, arch);
-      if (!target) {
-        throw new UnsupportedPlatformError(platform, arch);
-      }
-      return { platform, arch, ...target };
-    }
-    function resolveRuntime(options = {}) {
-      const { platform, arch, packageName, binaryName } = selectedTarget(options);
-      const resolvePackage = options.resolvePackage || __require.resolve;
-      const fileExists = options.fileExists || fs2.existsSync;
-      const readManifest = options.readManifest || ((manifestPath2) => JSON.parse(fs2.readFileSync(manifestPath2, "utf8")));
-      let manifestPath;
-      try {
-        manifestPath = resolvePackage(`${packageName}/package.json`);
-      } catch (error51) {
-        throw new MissingPlatformPackageError(platform, arch, { packageName }, error51);
-      }
-      const binaryPath = path2.join(path2.dirname(manifestPath), "bin", binaryName);
-      if (!fileExists(binaryPath)) {
-        throw new BinaryNotFoundError(platform, arch, packageName, binaryPath);
-      }
-      const platformManifest = readManifest(manifestPath);
-      return Object.freeze({
-        platform,
-        arch,
-        packageName,
-        packageVersion: RUNTIME_PACKAGE_VERSION,
-        runtimeVersion: platformManifest.version,
-        binaryName,
-        binaryPath,
-        source: "bundled"
-      });
-    }
-    function getKujoRuntimeInfo(options = {}) {
-      return resolveRuntime(options);
-    }
-    function resolveKujoBinary(options = {}) {
-      return resolveRuntime(options).binaryPath;
-    }
-    module.exports = {
-      BinaryNotFoundError,
-      KujoRuntimeError,
-      MissingPlatformPackageError,
-      TARGETS,
-      UnsupportedPlatformError,
-      getKujoRuntimeInfo,
-      resolveKujoBinary,
-      targetFor
-    };
-  }
-});
 
 // node_modules/@paperclipai/plugin-sdk/dist/define-plugin.js
 function definePlugin(definition) {
@@ -28926,7 +28710,7 @@ var CONTEXT_BUDGETS = {
   focused: 16e3,
   broad: 4e4
 };
-var PLUGIN_VERSION = "0.1.1";
+var PLUGIN_VERSION = "0.1.3";
 var PAPERCLIP_API_VERSION = 1;
 
 // src/config/schema.ts
@@ -29309,7 +29093,7 @@ async function resolveKujo(config2, cwd) {
     return await assertCompatible(executable, cwd, "configured");
   }
   try {
-    const runtime = await Promise.resolve().then(() => __toESM(require_kujo_runtime(), 1));
+    const runtime = await import("@kujolang/kujo-runtime");
     const info = runtime.getKujoRuntimeInfo();
     const executable = await validateExecutable(info.binaryPath);
     return await assertCompatible(executable, cwd, "bundled");

package/docs/OPERATIONS.md

@@ -36,6 +36,10 @@ Component updates must start from clean, reviewed source repositories at exact c
 
 Never hand-edit a bundled file without updating its canonical source. Runtime checks reject any file that differs from the component lock.
 
+## Release credentials
+
+GitHub Actions publishes through the npm trusted publisher bound to `kujolang/paperclip`, `.github/workflows/release.yml`, and the `npm` environment. Keep `id-token: write`; do not add an npm access token or `NODE_AUTH_TOKEN`. The npm package requires two-factor authentication and disallows traditional token publishing, while trusted OIDC publishing remains available.
+
 ## Recover from corrupt state
 
 If a detail view shows no artifact after an upgrade, inspect worker logs for schema or state errors. Clear the entity's Kujo data, then regenerate the artifact. Do not edit Paperclip's plugin-state tables directly.

package/docs/RELEASE_READINESS.md

@@ -27,7 +27,7 @@ The release order is platform runtime packages, neutral `@kujolang/kujo-runtime`
 
 The runtime release workflows build and smoke macOS arm64/x64, Linux arm64/x64, and Windows x64. Paperclip CI tests those five targets. A separate compatibility matrix tests Node.js 24.11 and current Node.js 24 against the minimum, locked, and latest compatible Paperclip SDK versions. Local plugin feature execution is verified on the developer host; every supported target is exercised during a tagged release.
 
-The tag workflow accepts only an annotated PGP-signed tag whose name matches `package.json`. It verifies the repository, packs once, attests that tarball, publishes that exact file with npm provenance, and attaches its checksum, CycloneDX SBOM, component lock, and JSON schemas to the GitHub release.
+The tag workflow accepts only an annotated tag with a GitHub-verified SSH or PGP signature whose name matches `package.json`. It verifies the repository, packs once, attests that tarball, publishes that exact file through npm trusted publishing with short-lived OIDC credentials, and attaches its checksum, CycloneDX SBOM, component lock, and JSON schemas to the GitHub release. Package settings require two-factor authentication and disallow traditional token publishing.
 
 ## Performance bounds
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kujolang/paperclip",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Make Paperclip agent work easier to scope, review, reproduce, and verify.",
   "license": "MIT",
   "homepage": "https://github.com/kujolang/paperclip#readme",