Packaged-release conformance

npm run conformance proves the complete Clank golden path using a clean temporary installation of the package produced by npm pack.

The runner does not import framework source from the repository. It:

1. packs Clank and installs the tarball into a clean tool consumer;
2. statically parses the packaged Todoist-style AI blueprint and generates an authenticated application using that installed CLI;
3. installs the same tarball into the generated application and builds it;
4. starts the packaged deployment platform;
5. creates a browser account and completes the real CLI device-authorization flow;
6. deploys the generated application through the packaged CLI;
7. creates two independent authenticated sessions and proves live SSE synchronization;
8. discovers deployed MCP, dynamically registers a client, completes OAuth PKCE with user consent, and performs a create/list/remove action round trip;
9. proves a separate account cannot read the first account's owned rows;
10. deploys an immutable second migration and verifies the resulting SQLite history;
11. forces a failed health activation and proves the prior application and data remain available;
12. rolls back code and restores the pre-migration snapshot; and
13. verifies both application rows and migration schema returned to the expected state.

The test uses loopback HTTP, temporary owner-only directories, isolated CLI credentials, a one-port application range, and no registry downloads beyond the local tarball.

MCP Apps checks must reuse authenticated OAuth credentials. A protected server intentionally returns HTTP 401 before JSON-RPC dispatch, so running protocol or UI-resource checks without a token produces downstream “could not run” results. Use MCPJam's OAuth conformance command with --credentials-out, then pass that file to server doctor or apps conformance. See Interactive MCP Apps for the commands and expected resource contract.

npm run check runs this suite after the build, zero-dependency check, coverage-enforced unit/integration tests, and documentation/declaration audit, then finishes with the security audit. A release is not acceptable if any stage fails.