Packaging and Release
Contract package
@anuva/bento-contract version 1.1.0 is an ESM package with declarations,
source maps, runtime validation, compatibility evaluation, pure
transformations, JSON Schema, compatibility metadata, LICENSE, and
THIRD_PARTY_NOTICES.md.
The package compiles with the ES2022 library only. It has no DOM library,
runtime dependency, editor import, or browser global requirement. private:
true prevents accidental public publication.
Static player
npm run package:player produces:
The ignored handoff directory contains only the player HTML/CSS/JavaScript,
schema, compatibility metadata, license, notices, and manifest.json. The
packager rejects editor and public update/collaboration markers.
The manifest records exact contract, protocol, player, runtime, and Bento versions plus byte count and SHA-256 for every distributed file. It does not contain a timestamp, so identical inputs produce an identical manifest.
Static editor
npm run package:editor produces:
Its deterministic manifest contains editor, editor-protocol, template-family,
template-catalog, contract-package, presentation-contract, shared-renderer, and
Bento-base versions plus file digests. Its catalog descriptor records the
local path, catalog format/version, SHA-256, and ordered family IDs. The editor
and player manifests must carry identical rendererVersion values. The
packager also retains the presentation/editor schemas, catalog, license, and
notices and rejects unresolved production flags or dynamic-code markers.
Release boundary
ANU-11 verifies local private package and player artifacts but does not publish to a registry, GitHub Release, canonical docs host, or production service. A later approved release flow must:
- rebuild from the reviewed commit;
- rerun all checks;
- compare manifest and package integrity;
- retain licenses and notices;
- publish only to approved private destinations; and
- provide exact immutable artifact references to consumers.