- .npmrc routes the @insignia scope to https://git.lynkedup.cloud/api/packages/insignia/npm/
(auth via ${GITEA_TOKEN} env — no secret committed).
- The 9 frontend SDK packages (contracts, kernel-client, adapter-sdk, *-web) are now
publishable: private dropped, version 0.1.0, publishConfig pinned to Gitea. iios-service
and iios-testkit stay private (pnpm publish skips them).
- Root `release` / `release:dry` scripts; a Gitea Actions workflow publishes on a v* tag.
- PUBLISHING.md documents publish + consumer (.npmrc) setup.
Verified: dry-run packs cleanly and workspace:* deps resolve to 0.1.0 in the tarball.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
apps/message-demo: Alice creates a thread, Bob joins; live two-way chat, typing,
read receipts (useMessages now exposes reads[]). Dev-only /v1/dev/token endpoint
(gated by IIOS_DEV_TOKENS) so the browser can auth. .env autoloaded (dotenv).
Realtime smoke script passes end-to-end (message + unread + receipt).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
MessageProvider/useThread/useMessages over the kernel-client socket (live append,
typing, dedupe). Reconnect test (re-opens active thread). Rewrote import-boundary
as an allowlist so SDK<->service sibling imports are forbidden both ways. 28 tests.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
maaz519