@openlup/core 0.16.0 → 0.18.0

package/CHANGELOG.md

@@ -8,6 +8,29 @@ SemVer promise.
 
 ## [Unreleased]
 
+## [0.18.0]
+
+- Publishable on the npm `latest` dist-tag as `0.18.0`, from tag
+  `openlup-core-v0.18.0`.
+
+- Republish unchanged APIs, runtime behavior and shipped SQL from `0.17.0` as
+  part of the complete `0.18.0` package set.
+
+Migration: upgrade the complete set together; core introduces no API or schema
+migration in this release.
+
+## [0.17.0]
+
+- Publishable on the npm `latest` dist-tag as `0.17.0`, from tag
+  `openlup-core-v0.17.0`.
+
+- Republish unchanged APIs, runtime behavior and shipped SQL as part of the
+  complete `0.17.0` package set.
+
+Baseline evidence (2026-10-20): published `0.16.0` tarball 161,232 packed bytes,
+SHA256 `48abf4ea8ddc446b8d6e2c610801e2cfcbe5575743bd5a61fbb8b8b50a2b36a3`.
+The initial `0.16.0` release-gates baseline is retained under S1 option B.
+
 ## [0.16.0]
 
 - Publishable on the npm `latest` dist-tag as `0.16.0`, from tag

package/CONTRIBUTING.md

@@ -27,7 +27,9 @@ database orchestration, schedulers, credentials, provider SDKs, and
 product-specific policy remain outside the package.
 
 Treat exported declarations as internal candidate surfaces. When a declaration
-change is intentional, update tests, record the reason in [CHANGELOG.md](CHANGELOG.md),
+change is intentional, update tests, record the reason in a `changes/<programme>-<slice>.md` fragment in the source
+repository (ordinary bullets, optional `###` headings and useful `Migration:`
+steps; no `#`/`##`, empty files or conflict markers),
 run `npm run api:update`, and review the snapshot diff. Do not infer a stable
 API, SemVer promise, independent release, or external adoption from that proof.
 

package/README.md

@@ -196,9 +196,8 @@ The repository checker also calls the UI neutrality counting process with
 `--counts-json` to count its existing patterns over the supplied sources. Running that checker without
 arguments still scans the UI source directory and refuses any forbidden hit.
 Published Tree CI runs the repository ratchet in required `self-check` and its
-CLI refusal tests separately in required `test`; unrestricted root diagnostics
-do not replace either gate. The independent core CI step retains this package's
-complete verification when root diagnostics are red.
+CLI refusal tests in required root `test`. This package's independent proof
+belongs to `install-proof`; see [repository testing](https://github.com/openlup/openlup/blob/main/CONTRIBUTING.md#test-scope-and-diagnostics).
 
 Together these interfaces let the repository measure existing findings without
 making one package import another package's internals. They provide source
@@ -219,3 +218,18 @@ Dependencies use the same or an earlier layer:
 See [CHANGELOG migration guidance](CHANGELOG.md#0160) for selection,
 bindings, refusals and diagnostics, and the source checkout's
 `api/readiness.api.md` snapshot for declarations; the host owns inventory.
+
+## Package artifact limits
+
+The monorepo's package artifact checker enforces this package's
+`release-gates.json` caps and packed content allowlist. Only
+`--release-set <version>` checks compressed growth against the last released
+baseline, with explanations in the new set's changelog section and release body. See the
+[package artifact policy](https://github.com/openlup/openlup/blob/main/.github/VERSIONING_AND_EOL.md#package-artifact-limits)
+for measured sizes, current caps, the S1 baseline refresh and refusal remedies.
+Artifact checks require a clean package directory; `--manifest-only` supplies no
+artifact evidence.
+
+Source contributors record notable changes in package changelog fragments;
+release preparation assembles the shipped CHANGELOG. Follow the
+[public contribution guide](https://github.com/openlup/openlup/blob/main/CONTRIBUTING.md#development-preview-checks).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openlup/core",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "Neutral D2C subscription and bundle commerce kernels; a development preview with no stable API.",
   "license": "Apache-2.0",
   "repository": {

package/release-gates.json

@@ -262,18 +262,17 @@
     }
   },
   "pack": {
-    "$budgetReason": "2026-10-18 M03 bounded decision: base code 129991 packed, aggregate 158715 packed/667249 unpacked bytes; B0 before trimming 132250, 162482/681852; final 132250, 161344/678531. B0 is core's only growth for programme module M03; identity ships in @openlup/platform. Code 132KiB, aggregates 162KiB/672KiB; docs class, file ceilings, required files and other controls unchanged. Set bumps grow only the changelog; docs stays the first binding limit for set notes. Later growth still requires a measured budget decision. Grants no release authority.",
     "code": {
-      "maxPackedBytes": 135168,
-      "maxFiles": 198
+      "maxPackedBytes": 276480,
+      "maxFiles": 400
     },
     "docs": {
-      "maxPackedBytes": 24576,
-      "maxFiles": 12
+      "maxPackedBytes": 49152,
+      "maxFiles": 20
     },
-    "maxPackedBytes": 165888,
-    "maxUnpackedBytes": 688128,
-    "maxFiles": 211,
+    "maxPackedBytes": 327680,
+    "maxUnpackedBytes": 1392640,
+    "maxFiles": 420,
     "requiredFiles": [
       "AGENTS.md",
       "CHANGELOG.md",
@@ -285,7 +284,12 @@
       "SECURITY.md",
       "package.json",
       "release-gates.json"
-    ]
+    ],
+    "baseline": {
+      "version": "0.17.0",
+      "packedBytes": 161357
+    },
+    "browserEntries": {}
   },
   "publish": {
     "prepublishOnly": "node --experimental-strip-types ./scripts/refuse-publish.ts",