chore(quickstart): move the demo onto the published 0.4.0 packages

[TheBlackBit]

In plain terms

Version 0.4.0 of both packages is now live on npm. The runnable demo in this repository was still asking for the previous version, 0.3.1. This points it at 0.4.0.

It is also the real test that the release worked. Everything else in this repository tests the code sitting on disk. The demo is the only thing that downloads the actual published packages the way a new developer would, so it is the only thing that can catch a packaging mistake — a file left out of the download, or a version that quietly pulls in the wrong companion package. A release is not really confirmed until this passes.

What you're approving

• Two files in the demo folder. The demo's list of required packages moves from 0.3.1 to 0.4.0, and its lock file is regenerated to match. No source code, no library changes, nothing published.
• Worst case if it's wrong: the demo fails to start, which the automated check catches before merge. The published packages are unaffected either way — this cannot change what is on npm.
• One deliberate omission: the demo still sets up its database connection by reading environment variables by hand, rather than using the newer one-line helper. That helper has not been merged or released yet, so calling it here would crash the demo on startup. Left alone on purpose.

How to test

cd examples/quickstart
rm -rf node_modules
npm install
npm run smoke

The install should pull 0.4.0 for both packages straight from npm, and the smoke test should end with smoke green — contract holds.

I ran exactly this before opening the pull request. All 14 checks passed:

  ✓ boot refuses without GATE_SECRET (deployed mode)
  ✓ (a) MCP initialize handshake
  ✓ (g) widget ui:// resource loads (HTML bundle present)
  ✓ (b) whiskey checkout requires age 21+ (required, payment last)
  ✓ (c) headphones checkout has no age requirement
  ✓ (d) unverified place-order of gated order → 403
  ✓ (d′) gated order stays incomplete
  ✓ (f) payment-only verify of age-gated order → refused (reason: age)
  ✓ (e) tampered cart mandate → verify refused, order NOT completed
  ✓ (e′) untampered mandate completes on the payment rail (stateless)
  ✓ (h) age_over_18 proof refused at the 21+ gate
  ✓ (h′) age_over_21 proof accepted at the 21+ gate
  ✓ (i) A's age verification lets A complete on the payment rail
  ✓ (i′) A's age verification does NOT bleed to B (refused: age)

smoke green — contract holds

Worth noting what those last several checks mean in plain terms, because they are the point: someone cannot buy age-restricted goods without proving their age; proving they are 18 does not get them past a 21 gate; editing the price on the way to checkout is refused; and one shopper proving their age never unlocks checkout for a different shopper. All of that holds in the published packages, not just in the source.

---

For reviewers — the detail

Why this is the post-publish check

docs/PUBLISHING.md step 3 names this pull request as the real verification: the workspace test suites resolve @openmobilehub/credentagent-gate through the npm workspace symlink, so they cannot detect a packaging fault. The quickstart is not a workspace and installs from the registry, so quickstart-smoke exercises the published tarballs. deployed-smoke then re-runs the same assertions against the live demo once this merges and deploys.

Two failure classes only this catches, both live risks in this particular release:

1. A missing runtime asset. The storefront reads dist/ui/mcp-app.html from disk at request time rather than importing it, so if the files allowlist missed it the packages would still install and typecheck, and fail only when a widget is requested. Assertion (g) covers it — and it is present, 556,843 bytes.
2. A wrong dependency range. npm version does not rewrite a sibling workspace dependency range, so the storefront's dependency on the gate had to be corrected by hand from ^0.3.1 to ^0.4.0 during the release. Left uncorrected, ^0.3.1 resolves to >=0.3.1 <0.4.0 and a published 0.4.0 storefront would have pulled a 0.3.x gate. Confirmed correct on the registry: npm view @openmobilehub/credentagent-storefront@0.4.0 dependencies reports ^0.4.0, and the regenerated lockfile here resolves both to the 0.4.0 tarballs.

Verified before opening

• rm -rf node_modules && npm install — exit 0; node -p on both installed manifests reports 0.4.0 / 0.4.0, resolved from registry.npmjs.org.
• npm run smoke — exit 0, 14/14, output above.
• Separately, a clean install of the published packages into a scratch project exercised the new public surface: credentagent.doctor() returns { ok: true, findings: [] }, and defineHost, createStorefront, and the policy builders are all present and callable.

The redisStorage.fromEnv() deferral

examples/quickstart/server.mjs continues to hand-assemble the Redis credentials from KV_REST_API_* / UPSTASH_REDIS_REST_*. #128 — the pull request adding redisStorage.fromEnv() to collapse that into one line — is still open and therefore absent from 0.4.0. The author of #128 verified that swapping the example ahead of a release fails with TypeError: redisStorage.fromEnv is not a function and the server never comes up. The swap belongs in a follow-up after #128 merges and ships in a release.

Release context

0.4.0 published from tag v0.4.0 (commit 12c32ce) via run 30502804107, green in 48s, gate then storefront. npm serves 0.4.0 for both. The breaking change in this release — the DelegatedVerifier verify/settle split — is documented in #161 and affects only integrators who implemented that interface against 0.3.1; it does not touch the quickstart, which uses the built-in flows.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
credentagent-demo	Ready	Preview	Jul 30, 2026 12:35am