[xiaoland]

Intent

External contributors cannot install the private GitHub Package without package access. Prepare public GitHub Release assets containing the original, already-published UI tarball, without rebuilding the same version.

pnpm release:public <exact-version> is read-only by default; --publish explicitly uploads. Validate SHA-512, package identity, version, and an existing non-draft Release. Append an absent asset, compare an existing asset anonymously byte for byte, fail on conflicts without overwriting, and verify uploads through anonymous download.

Integrate mirroring into the existing main publication workflow, including retries/backfill without a new Changeset. Correct the Changesets publish command, document consumer migration, and add a patch Changeset for the packaged README correction.

Primary scope: release. Release project: @inkcre/ui-web.
Tracking issue: InKCre/.github#39.

Evidence

• Full pnpm check passed after integrating current main, including upload boundary tests, release/Logo contracts, type checks, packaged-consumer checks, and 23 Stories / 131 variants.
• Public-package tests and root type checking passed again before submission.
• Read-only preparation of both 2.3.0 and 2.5.0 retrieved the original tarballs and matched Registry/consumer-lockfile SHA-512. Local execution used the pinned Node 22 runtime with an isolated temporary npm authentication file.
• Following explicit maintainer authorization, both originals were attached to their existing Releases and downloaded anonymously byte for byte. The original Registry/consumer-lockfile SHA-512 values are preserved.
• An isolated copy of current impl-ts consumed both original locked versions (2.3.0 and 2.5.0) through loopback HTTP. Empty-store, no-token frozen install, Core SDK, Web, browser-extension, and all Extension builds passed. Unrelated package resolutions were unchanged, and the native Module Federation manifest passed inspection. This does not verify the final GitHub asset URLs or fork CI.

Next action

Merged after explicit maintainer authorization. UI 2.3.0 and 2.5.0 originals are publicly downloadable and anonymously verified. Consumer migration and actual fork validation continue in impl-ts#171.

Current head integrates main's version guard and SwiftPM/Logo release attachment without dropping either path. GitHub ui-web checks and Cloudflare Pages passed on this head. The existing consumers require exactly 2.3.0 and 2.5.0; public backfill should preserve those versions rather than upgrade them during the access change.

The merged main release workflow completed successfully. Future eligible versions are mirrored by that workflow; the newly prepared UI version PR remains a separate review and publication decision. No new npm version was published by the two-version backfill.

Risk and rollback

Downloaded public copies cannot reliably be recalled. Conflicting existing assets cause failure and require investigation. Revert before publication to remove the workflow change; after publication, disabling future mirroring does not remove existing assets.

Delivery effects

Use the existing workflow's package-read and Release-write permissions. Original assets for 2.3.0 and 2.5.0 are now public; consumers must adopt the exact-version overrides and lockfile in impl-ts#171 to remove their installation prerequisite. No npmjs identity or second Registry is added.

Related work

No stacked parent or child PR.
.github#36, docs#40, impl-py#153, impl-ts#171.

[cloudflare-workers-and-pages]

Deploying inkcre-web-design with    Cloudflare Pages

Latest commit:	aebbd17
Status:	✅  Deploy successful!
Preview URL:	https://9e64e8a2.design-dd4.pages.dev
Branch Preview URL:	https://pr-64.design-dd4.pages.dev

View logs