fix(cli): write registry config in scaffolds

STANDALONE-AUDIT.md

@@ -88,24 +88,19 @@ repo surface.
 Run from the repository root:
 
 ```bash
-pnpm prove:cli-uat
+pnpm prove:cli
+pnpm prove:fresh-samples
 pnpm prove
 ```
 
 Expected:
 
-- `prove:cli-uat` reports `ok: true`.
-- `legacyMonorepoPathReferences` is `false`.
-- `managedHostProof` is skipped unless `MATRIX_SDK_RUNTIME_HOST_BIN` is supplied.
+- `prove:cli` builds/tests the SDK CLI and runs the standalone greeter demo.
+- `prove:fresh-samples` proves the fresh server and browser demos.
 - `prove` builds, tests, type-checks, and packs all workspace packages.
 
 Demo checks:
 
 ```bash
 pnpm demo:standalone
-pnpm demo:hivecast-login -- --check
 ```
-
-`demo:hivecast-login -- --check` proves the demo wiring without requiring a
-secret. A real HiveCast proof requires `MATRIX_API_KEY`, `MATRIX_CLOUD`, and
-`MATRIX_SPACE` from the user.

packages/browser-host/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-matrix/browser-host",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Browser host shell for Matrix custom elements (extracted from @open-matrix/core during core-decontamination).",
   "type": "module",
   "main": "./dist/index.js",

packages/browser-kit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-matrix/browser-kit",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Shared browser infrastructure for Matrix webapps — shims, theme tokens, vite config factory, app shell",
   "type": "module",
   "main": "./dist/index.js",

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-matrix/cli",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Matrix package-author CLI.",
   "type": "module",
   "bin": {

packages/cli/src/commands/actor.ts

@@ -7,7 +7,15 @@
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { toKebabCase, toPascalCase, validateMatrixManifest, writeJsonFile, generatePackageJson, generateTsconfig } from '../utils/scaffold.js';
+import {
+  generatePackageJson,
+  generateTsconfig,
+  toKebabCase,
+  toPascalCase,
+  validateMatrixManifest,
+  writeJsonFile,
+  writeScaffoldNpmrc,
+} from '../utils/scaffold.js';
 
 export interface IActorCommandOptions {
   readonly cwd?: string;
@@ -205,6 +213,7 @@ export async function actorCommand(name: string, options: IActorCommandOptions =
   }
 
   writeJsonFile(path.join(rootDir, 'matrix.json'), manifest);
+  writeScaffoldNpmrc(rootDir);
   writeJsonFile(path.join(rootDir, 'package.json'), generatePackageJson(normalizedName, { service: true }));
   writeJsonFile(path.join(rootDir, 'tsconfig.json'), generateTsconfig({ service: true }));
   fs.writeFileSync(

packages/cli/src/commands/webapp.ts

@@ -13,8 +13,13 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import {
-  toKebabCase, toPascalCase, validateMatrixManifest, writeJsonFile,
-  generatePackageJson, generateTsconfig,
+  generatePackageJson,
+  generateTsconfig,
+  toKebabCase,
+  toPascalCase,
+  validateMatrixManifest,
+  writeJsonFile,
+  writeScaffoldNpmrc,
 } from '../utils/scaffold.js';
 
 export interface IWebappCommandOptions {
@@ -517,6 +522,7 @@ export async function webappCommand(
   }
 
   writeJsonFile(path.join(rootDir, 'matrix.json'), manifest);
+  writeScaffoldNpmrc(rootDir);
   writeJsonFile(path.join(rootDir, 'package.json'), generatePackageJson(normalizedName, { webapp: true }));
   writeJsonFile(path.join(rootDir, 'tsconfig.json'), generateTsconfig({ webapp: true }));
 

packages/cli/src/index.ts

@@ -48,7 +48,7 @@ export function createProgram(): Command {
   program
     .name('matrix')
     .description('Matrix SDK CLI for package authors')
-    .version('0.1.5');
+    .version('0.1.6');
 
   const broker = program
     .command('broker')

packages/cli/src/utils/scaffold.ts

@@ -6,6 +6,7 @@
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { MATRIX_NPM_REGISTRY_SCOPES } from './npm-registry-client.js';
 import { validateManifestForMxCli } from './manifestValidator.js';
 
 export interface ScaffoldOptions {
@@ -70,6 +71,22 @@ export function writeJsonFile(filePath: string, value: unknown): void {
   fs.writeFileSync(filePath, JSON.stringify(value, null, 2) + '\n', 'utf8');
 }
 
+export const DEFAULT_SCAFFOLD_MATRIX_REGISTRY = 'https://registry.hivecast.ai/api/packages/open-matrix/npm/';
+
+export function scaffoldNpmrcLines(
+  registry = DEFAULT_SCAFFOLD_MATRIX_REGISTRY,
+): readonly string[] {
+  return [
+    'registry=https://registry.npmjs.org/',
+    ...MATRIX_NPM_REGISTRY_SCOPES.map((scope) => `${scope}:registry=${registry}`),
+  ];
+}
+
+export function writeScaffoldNpmrc(rootDir: string, registry?: string): void {
+  fs.mkdirSync(rootDir, { recursive: true });
+  fs.writeFileSync(path.join(rootDir, '.npmrc'), `${scaffoldNpmrcLines(registry).join('\n')}\n`, 'utf8');
+}
+
 export function validateMatrixManifest(manifest: unknown): { valid: boolean; errors: string[] } {
   const result = validateManifestForMxCli(manifest);
   return { valid: result.valid, errors: result.errors };

packages/cli/tests/unit/lifecycle-scaffold.spec.ts

@@ -60,6 +60,7 @@ describe('developer lifecycle: scaffold + validate + install', () => {
 
       // All expected files
       const expectedFiles = [
+        '.npmrc',
         'matrix.json',
         'package.json',
         'tsconfig.json',
@@ -95,6 +96,12 @@ describe('developer lifecycle: scaffold + validate + install', () => {
       assert.ok(pkg.dependencies?.['@open-matrix/core']);
       assert.equal(pkg.devDependencies?.['@open-matrix/core'], undefined);
 
+      const npmrc = fs.readFileSync(path.join(actorDir, '.npmrc'), 'utf8');
+      assert.ok(npmrc.includes('registry=https://registry.npmjs.org/'));
+      assert.ok(npmrc.includes('@open-matrix:registry=https://registry.hivecast.ai/api/packages/open-matrix/npm/'));
+      assert.ok(npmrc.includes('@matrix:registry=https://registry.hivecast.ai/api/packages/open-matrix/npm/'));
+      assert.ok(npmrc.includes('@omega:registry=https://registry.hivecast.ai/api/packages/open-matrix/npm/'));
+
       // tsconfig.json
       const tsconfig = JSON.parse(fs.readFileSync(path.join(actorDir, 'tsconfig.json'), 'utf8'));
       assert.equal(tsconfig.compilerOptions.target, 'ES2022');
@@ -168,6 +175,7 @@ describe('developer lifecycle: scaffold + validate + install', () => {
 
       // All expected webapp files
       const expectedFiles = [
+        '.npmrc',
         'matrix.json',
         'package.json',
         'tsconfig.json',
@@ -202,6 +210,9 @@ describe('developer lifecycle: scaffold + validate + install', () => {
       assert.ok(pkg.devDependencies?.['@open-matrix/core']);
       assert.ok(pkg.devDependencies?.['@open-matrix/federation']);
 
+      const npmrc = fs.readFileSync(path.join(appDir, '.npmrc'), 'utf8');
+      assert.ok(npmrc.includes('@open-matrix:registry=https://registry.hivecast.ai/api/packages/open-matrix/npm/'));
+
       // tsconfig.json — DOM libs, noEmit
       const tsconfig = JSON.parse(fs.readFileSync(path.join(appDir, 'tsconfig.json'), 'utf8'));
       assert.ok(tsconfig.compilerOptions.lib?.includes('DOM'));

packages/contracts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-matrix/contracts",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Type contracts for Matrix substrate (placement, service registry, runtime presence). Almost zero runtime — one pure function (decideMatrixPlacementBind) plus pure types. Zero @open-matrix/core dependency. Extracted from @open-matrix/core during core-decontamination Phase 2 so schema evolution doesn't rebuild the actor kernel.",
   "type": "module",
   "sideEffects": false,

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-matrix/core",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Matrix runtime SDK \u2014 actors, Web Components, transports, serialization, and LISP-on-Protocol",
   "type": "module",
   "license": "MIT",
@@ -25,6 +25,7 @@
       "import": "./dist/src/index.js",
       "default": "./dist/src/index.js"
     },
+    "./package.json": "./package.json",
     "./_node-compat": {
       "types": "./dist/src/_node-compat.d.ts",
       "import": "./dist/src/_node-compat.js",

packages/federation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-matrix/federation",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Matrix federation layer: mailbox-based cross-realm messaging with legacy (matrix3) and modern (mxenv1) wire format support and security guardrails.",
   "license": "UNLICENSED",
   "type": "module",
@@ -16,6 +16,7 @@
       "require": "./dist/src/index.js",
       "default": "./dist/src/index.js"
     },
+    "./package.json": "./package.json",
     "./*": {
       "types": "./dist/src/*.d.ts",
       "import": "./dist/src/*.js",

packages/omega-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-matrix/omega-core",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "type": "module",
   "description": "Narrow Omega core/interpreter facade for Matrix membrane consumers",
   "main": "./dist/index.js",
@@ -13,7 +13,8 @@
       },
       "types": "./dist/packages/omega-core/src/index.d.ts",
       "import": "./dist/index.js"
-    }
+    },
+    "./package.json": "./package.json"
   },
   "files": [
     "dist",

packages/sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-matrix/sdk",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Public Matrix actor SDK facade for package authors.",
   "type": "module",
   "main": "./dist/index.js",