[Pepps233]

Summary

Public npm tarballs exposed original TypeScript and omitted required notices.

Implements the npm distribution policy, checks final tarball bytes before publication, and keeps the source repository private.

Companion cloud handoff: diffexai/diffex-cloud#150.

Reasoning

Npm hosts every approved artifact, including the CLI's embedded manifest and install locks.
Readable JavaScript and declarations are approved, including evolution and harness-trace runtime bundles.
Standalone archives and secondary channels are deferred pending their separate redistribution reviews.

Changes

• Give all eleven public packages Apache-2.0 metadata, full Apache and Pi MIT terms, applicable bundled notices, and component/runtime inventories.
• Exclude prohibited source and maps, retain debug maps privately, and publish only the exact inspected npm tarballs.
• Embed release identity, npm asset URLs, channel decisions, and install locks in the CLI package.
• Remove GitHub release publication and block standalone build entrypoints.
• Regenerate all nine authorized project changelogs through /cl launched with diffex-test.sh.
• Align local acceptance with npm and Bun package installations.

Testing

• npm run check and the full isolated ./test.sh suite.
• Changelog/configuration/version tests: 94 passed; release-note extraction also passed.
• All eleven actual tarballs passed payload inspection and installed through npm and Bun outside the checkout, in a path containing spaces.
• Every package entrypoint loaded with outbound sockets blocked.
• Both installed CLIs passed help, version, model listing, fixture inference, interactive prompt/reply, account-menu inspection, and clean exit.
• A committed rebuild reproduced the inspected runtime bytes; the private source archive passed independent validation.
• Companion cloud quality gate and shared release contract check passed.

Artifact hashes and acceptance evidence identify candidate 196a385b4c24210522b50a6037355f1ef617545c.
Local execution covered Darwin arm64 with Node 22.19.0, npm 10.9.3, and Bun 1.3.11.
Provider inference and release discovery were controlled fixtures; other native platforms and public download acceptance are not claimed.
No npm publication, production release record, or deployment is included.

[Pepps233]

large diff from removing CHANGELOG.mds