amalgm 0.1.256 → 0.1.257

package/lib/shared-realtime-tunnel.js

@@ -20,7 +20,7 @@ const REAUTHORIZE_MS = 30_000;
 const REPO_OBJECT_REQUEST_TIMEOUT_MS = 15_000;
 const COOKIE_PRIVATE_CONTRACT = 'browser-cookie-jar@1';
 const USER_HOME_PRIVATE_CONTRACT = 'amalgm-user-home@1';
-const ENTITY_REGISTRY_PRIVATE_CONTRACT = 'amalgm-entity-registry@1';
+const ENTITY_REGISTRY_PRIVATE_CONTRACT = 'amalgm-entity-registry@2';
 
 function createSharedRealtimeTunnel({
   send,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "amalgm",
-  "version": "0.1.256",
+  "version": "0.1.257",
   "description": "Amalgm local computer runtime: login, MCP, chat, events, previews, and tunnels.",
   "license": "UNLICENSED",
   "private": false,

package/runtime/scripts/amalgm-mcp/registration/entity-cloud.js

@@ -11,7 +11,12 @@
 
 const crypto = require('crypto');
 
-const ENTITY_CLOUD_CONTRACT = 'amalgm-entity-registry@1';
+// `@1` was an unreleased bootstrap experiment which could project arbitrary
+// pre-cloud local registrations into the first private head. A resource
+// contract names immutable authority semantics, so it is quarantined rather
+// than interpreted or overwritten. `@2` begins with only the verified user
+// home; later user ground enters exclusively through `amalgm register`.
+const ENTITY_CLOUD_CONTRACT = 'amalgm-entity-registry@2';
 const ENTITY_CLOUD_SCHEMA_VERSION = 1;
 const BOOTSTRAP_RECONCILIATION_STATE = 'reconciling-bootstrap';
 const SNAPSHOT_REPLACE_OPERATION = 'entity.snapshot.replace';

package/runtime/scripts/amalgm-mcp/tests/entity-cloud.test.js

@@ -277,7 +277,7 @@ test('add accepts only a catalog installed by the active compacted snapshot, nev
       envelope: {
         resourceId,
         mutationId: 'ent_remote_change',
-        contract: 'amalgm-entity-registry@1',
+        contract: 'amalgm-entity-registry@2',
         schemaVersion: 1,
         operationKind: 'entity.upsert',
         operation: { kind: 'entity.upsert', record: changed },

package/runtime/scripts/amalgm-mcp/tests/entity-materialization.test.js

@@ -189,7 +189,7 @@ test('an added ordinary workspace stays live: a later cloud file head replaces l
       envelope: {
         resourceId: sourceCloud.identity().resourceId,
         mutationId: 'ent_remote_file_change',
-        contract: 'amalgm-entity-registry@1',
+        contract: 'amalgm-entity-registry@2',
         schemaVersion: 1,
         operationKind: 'entity.upsert',
         operation: { kind: 'entity.upsert', record: remoteRecord },
@@ -296,7 +296,7 @@ test('add preserves a symlink UUID and later retargets the same literal link wit
     const ingested = target.ingestCloudMutation({
       envelope: {
         resourceId: sourceCloud.identity().resourceId, mutationId: 'ent_remote_link_change',
-        contract: 'amalgm-entity-registry@1', schemaVersion: 1,
+        contract: 'amalgm-entity-registry@2', schemaVersion: 1,
         operationKind: 'entity.upsert', operation: { kind: 'entity.upsert', record: sourceRegistry.syncRecord(changed.uuid) },
       },
       version: 42, committedAt: '2026-08-05T00:00:00.000Z',
@@ -420,7 +420,7 @@ test('add recreates an actual Git repository from verified Repocard cargo, then
     const ingested = target.ingestCloudMutation({
       envelope: {
         resourceId: bootstrap.resourceId, mutationId: 'ent_remote_repo_change',
-        contract: 'amalgm-entity-registry@1', schemaVersion: 1,
+        contract: 'amalgm-entity-registry@2', schemaVersion: 1,
         operationKind: 'entity.upsert', operation: { kind: 'entity.upsert', record: remoteRecord },
       },
       version: 2, committedAt: '2026-08-05T00:00:00.000Z',