chore: keep SDK packages private until release policy

README.md

@@ -4,8 +4,8 @@ Matrix SDK is the package-author layer for building Matrix actors, browser
 surfaces, and broker-connected applications without depending on a managed
 platform repo.
 
-This repository contains the SDK packages renamed to their publishable
+This repository contains the SDK packages under their target `@open-matrix/*`
-`@open-matrix/*` package names. The workspace is
+package names. The workspace is
 proven as a standalone workspace: a fresh clone can install, build, test,
 type-check, pack every package, and compile an external consumer against the
 packed tarballs.
@@ -191,7 +191,11 @@ Still planned:
   `matrix configure`.
 - Direct broker mode with explicit broker URL/JWT/seed credentials.
 - Managed-provider mode where an overlay issues scoped broker credentials.
-- Publishing the packages to npm after the provider-login contract is complete.
+
+Publishing is intentionally not part of this repository's normal developer
+workflow yet. The repo proves source, package, and consumer behavior with
+`pnpm pack`; public package release is an owner-controlled release decision and
+must be added as an explicit release policy before any npm publication.
 
 ## Relationship To Provider Overlays
 

packages/cli/package.json

@@ -3,7 +3,7 @@
   "version": "0.1.0",
   "description": "Package-author Matrix CLI for SDK projects.",
   "type": "module",
-  "private": false,
+  "private": true,
   "bin": {
     "matrix": "./dist/bin/matrix.js"
   },

packages/sdk/package.json

@@ -3,7 +3,7 @@
   "version": "0.1.0",
   "description": "Public Matrix actor SDK facade for package authors.",
   "type": "module",
-  "private": false,
+  "private": true,
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {