3.13.2

public-npm-distribution-docs

Align README, website, action docs, llms guidance, and release workflow docs with public npm distribution for non-private @lssm-tech packages.

restore-private-github-packages

Restore private GitHub Packages publishing and authenticated consumption for the @lssm-tech packages included in the July 7 public npm rollout.

Public @lssm-tech packages should resolve through the default npm registry.

When: A consumer workspace has .npmrc or Bun install.scopes entries for @lssm-tech.

1. Remove @lssm-tech:registry=https://npm.pkg.github.com from local npm config.
2. Remove the @lssm-tech Bun install.scopes entry that points at npm.pkg.github.com.
3. Keep @contractspec GitHub Packages config only for separately authorized legacy/private packages.

Code and metadata changes do not change npm-side visibility by themselves.

When: Preparing a real publish/access operation for migrated @lssm-tech packages.

1. Run the inventory/npm-state audit and classify packages as public, missing, restricted, blocked, or unknown.
2. Use npm publish --access public for first publishes.
3. Use npm access public <package> or npm UI maintainer action for existing restricted packages.
4. Run tarball file-list and secret/content audits before publishing.

Route @lssm-tech installs through GitHub Packages with an authorized token.

When: Installing an affected @lssm-tech package or using an action that installs one.

1. Add @lssm-tech:registry=https://npm.pkg.github.com to local npm configuration.
2. Add the matching @lssm-tech entry to Bun install.scopes when Bun is used.
3. Provide a token with packages: read and repository/package access.
4. Pass github-packages-token to ContractSpec actions that install affected private packages.

Repository automation must publish the affected package set only to GitHub Packages.

When: Preparing stable or canary releases.

1. Use CONTRACTSPEC_NPM_REGISTRY_URL=https://npm.pkg.github.com.
2. Publish with restricted access and GitHub Packages write credentials.
3. Preserve pre-July-7 public/npmjs exceptions through the provenance allowlist.
4. Treat already-published npmjs visibility as a separately authorized external operation.

External CI should not pass github-packages-token for ordinary public @lssm-tech installs.

Packages: @lssm-tech/bundle.library, @lssm-tech/bundle.marketing, @lssm-tech/app.web-landing, @lssm-tech/app.action-pr, @lssm-tech/action.validation, @lssm-tech/app.action-drift, @lssm-tech/action.version

1. Remove github-packages-token from action usage unless a legacy/private package still requires GitHub Packages.
2. Remove `packages: read` when it was present only for ContractSpec package installs.
3. Keep normal GitHub permissions needed for PR comments, checks, or version-management writes.

Affected consumers must restore GitHub Packages permissions and token routing.

Packages: @lssm-tech/bundle.library, @lssm-tech/bundle.marketing, @lssm-tech/app.web-landing, @lssm-tech/app.action-pr, @lssm-tech/action.validation, @lssm-tech/app.action-drift, @lssm-tech/action.version

1. Add packages: read where affected private packages are installed.
2. Store an authorized package token as a secret; never commit it to repository configuration.
3. Pass the token through github-packages-token for affected ContractSpec actions.