fix: correct packag updates

.github/workflows/release.yml

@@ -125,6 +125,7 @@ jobs:
           "
 
       - name: Create Release PR or Publish
+        id: changesets
         uses: changesets/action@v1
         with:
           publish: pnpm release
@@ -133,3 +134,19 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GH_PAT }}
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Sync deployable apps to published package versions
+        if: steps.changesets.outputs.published == 'true'
+        run: |
+          node scripts/use-published-packages.mjs --source=workspace --wait
+          if git diff --quiet -- apps/provenancekit-app/package.json examples/chat/package.json examples/canvas/package.json; then
+            echo "Deployable app package.json files already match npm"
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add apps/provenancekit-app/package.json examples/chat/package.json examples/canvas/package.json
+          git commit -m "chore: sync apps to published packages"
+          git push
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_PAT }}

apps/provenancekit-app/package.json

@@ -12,9 +12,9 @@
     "@hookform/resolvers": "^3.10.0",
     "@privy-io/react-auth": "^2.20.0",
     "@privy-io/server-auth": "^1.28.8",
-    "@provenancekit/extensions": "^0.1.2",
-    "@provenancekit/sdk": "^0.1.2",
-    "@provenancekit/ui": "^0.1.2",
+    "@provenancekit/extensions": "^0.1.6",
+    "@provenancekit/sdk": "^0.1.15",
+    "@provenancekit/ui": "^0.1.17",
     "@radix-ui/react-avatar": "^1.1.10",
     "@radix-ui/react-checkbox": "^1.3.2",
     "@radix-ui/react-dialog": "^1.1.14",

examples/canvas/package.json

@@ -12,11 +12,11 @@
     "@hookform/resolvers": "^3.10.0",
     "@privy-io/react-auth": "^2.20.0",
     "@privy-io/server-auth": "^1.28.8",
-    "@provenancekit/extensions": "^0.1.2",
-    "@provenancekit/media": "^0.1.2",
-    "@provenancekit/payments": "^0.1.2",
-    "@provenancekit/sdk": "^0.1.2",
-    "@provenancekit/ui": "^0.1.2",
+    "@provenancekit/extensions": "^0.1.6",
+    "@provenancekit/media": "^0.1.6",
+    "@provenancekit/payments": "^0.1.6",
+    "@provenancekit/sdk": "^0.1.15",
+    "@provenancekit/ui": "^0.1.17",
     "@radix-ui/react-avatar": "^1.1.10",
     "@radix-ui/react-dialog": "^1.1.14",
     "@radix-ui/react-dropdown-menu": "^2.1.15",

examples/chat/package.json

@@ -15,9 +15,9 @@
     "@hookform/resolvers": "^3.10.0",
     "@privy-io/react-auth": "^2.20.0",
     "@privy-io/server-auth": "^1.28.8",
-    "@provenancekit/extensions": "^0.1.2",
-    "@provenancekit/sdk": "^0.1.2",
-    "@provenancekit/ui": "^0.1.2",
+    "@provenancekit/extensions": "^0.1.6",
+    "@provenancekit/sdk": "^0.1.15",
+    "@provenancekit/ui": "^0.1.17",
     "@radix-ui/react-dialog": "^1.1.14",
     "@radix-ui/react-dropdown-menu": "^2.1.15",
     "@radix-ui/react-scroll-area": "^1.2.9",

packages/eaa-types/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@provenancekit/eaa-types",
-  "version": "0.0.2",
+  "version": "0.1.4",
   "description": "Pure provenance primitives for Human-AI collaborative works. Entity • Action • Attribution (EAA) type definitions with extensible architecture.",
   "license": "MIT",
   "keywords": [

packages/provenancekit-contracts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@provenancekit/contracts",
-  "version": "0.0.1",
+  "version": "0.0.4",
   "description": "Solidity smart contracts for on-chain provenance recording. Base implementations following OpenZeppelin patterns.",
   "license": "MIT",
   "files": [

packages/provenancekit-extensions/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@provenancekit/extensions",
-  "version": "0.1.0",
+  "version": "0.1.6",
   "description": "Type-safe extension schemas and helpers for ProvenanceKit EAA types",
   "license": "MIT",
   "keywords": [

packages/provenancekit-git/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@provenancekit/git",
-  "version": "0.1.0",
+  "version": "0.1.6",
   "description": "Git integration for ProvenanceKit - Track commits, blame analysis, AI detection, and GitHub integration",
   "license": "MIT",
   "keywords": [

packages/provenancekit-indexer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@provenancekit/indexer",
-  "version": "0.0.1",
+  "version": "0.1.11",
   "description": "Blockchain event indexer for ProvenanceKit - syncs on-chain provenance to storage",
   "type": "module",
   "main": "./dist/index.js",

packages/provenancekit-media/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@provenancekit/media",
-  "version": "0.1.0",
+  "version": "0.1.6",
   "description": "C2PA media provenance integration for ProvenanceKit - Read and write content credentials for images and videos",
   "license": "MIT",
   "keywords": [

packages/provenancekit-payments/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@provenancekit/payments",
-  "version": "0.1.0",
+  "version": "0.1.6",
   "description": "Payment distribution adapters for ProvenanceKit - Direct transfers, 0xSplits, Superfluid streaming",
   "license": "MIT",
   "keywords": [

packages/provenancekit-privacy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@provenancekit/privacy",
-  "version": "0.1.0",
+  "version": "0.1.11",
   "description": "Privacy-preserving utilities for ProvenanceKit - encryption, commitments, and access control",
   "license": "MIT",
   "keywords": [

packages/provenancekit-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@provenancekit/sdk",
-  "version": "0.1.0",
+  "version": "0.1.15",
   "description": "Framework-agnostic SDK for capturing, persisting, and querying provenance of AI actions and resources.",
   "main": "dist/index.cjs",
   "module": "dist/index.mjs",

packages/provenancekit-storage/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@provenancekit/storage",
-  "version": "0.0.1",
+  "version": "0.1.9",
   "description": "Unified storage abstraction for ProvenanceKit - database and file storage",
   "type": "module",
   "main": "./dist/index.js",

packages/provenancekit-ui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@provenancekit/ui",
-  "version": "0.0.1",
+  "version": "0.1.17",
   "type": "module",
   "description": "Standard UI components for displaying provenance information",
   "main": "dist/index.js",

scripts/use-published-packages.mjs

@@ -1,15 +1,14 @@
 /**
- * Run this script ONCE after the first successful npm publish to switch
- * all app/example package.json files from `workspace:*` to the actual
- * published npm version ranges.
+ * Sync deployable app/example package.json files to published @provenancekit/*
+ * package versions.
  *
- * Usage: node scripts/use-published-packages.mjs
+ * Usage:
+ *   node scripts/use-published-packages.mjs
+ *   node scripts/use-published-packages.mjs --source=workspace --wait
  *
- * After running, commit the changes and simplify each vercel.json to:
- *   {
- *     "installCommand": "npm install -g pnpm@10.12.1 && pnpm install --no-frozen-lockfile",
- *     "buildCommand": "pnpm run build"
- *   }
+ * This is intentionally idempotent and safe to run after every successful
+ * package release. Vercel deploys these apps with npm from their subfolders,
+ * so the apps cannot rely on workspace:* dependencies at deploy time.
  */
 
 import fs from 'fs';
@@ -19,17 +18,75 @@ import { createRequire } from 'module';
 
 const require = createRequire(import.meta.url);
 const root = path.resolve(import.meta.dirname, '..');
+const args = new Set(process.argv.slice(2));
+const source = [...args].find((arg) => arg.startsWith('--source='))?.split('=')[1] ?? 'npm';
+const waitForNpm = args.has('--wait');
 
-// Targets: apps and examples (not packages themselves)
+// Targets: deployable apps/examples (not internal packages themselves).
+// Keep provenancekit-api on workspace deps for monorepo builds; it is not one
+// of the npm-installed Vercel frontend projects that hit ETARGET.
 const targets = [
   'apps/provenancekit-app/package.json',
-  'apps/provenancekit-api/package.json',
   'examples/chat/package.json',
   'examples/canvas/package.json',
 ];
 
+const packageDirs = [
+  'packages/eaa-types',
+  'packages/provenancekit-sdk',
+  'packages/provenancekit-storage',
+  'packages/provenancekit-extensions',
+  'packages/provenancekit-privacy',
+  'packages/provenancekit-payments',
+  'packages/provenancekit-git',
+  'packages/provenancekit-media',
+  'packages/provenancekit-indexer',
+  'packages/provenancekit-ui',
+  'packages/provenancekit-contracts',
+];
+
+const workspaceVersions = new Map();
+for (const dir of packageDirs) {
+  const pkgPath = path.join(root, dir, 'package.json');
+  if (!fs.existsSync(pkgPath)) continue;
+  const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+  workspaceVersions.set(pkg.name, pkg.version);
+}
+
+function sleep(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+function assertPublished(packageName, version) {
+  const spec = `${packageName}@${version}`;
+  const attempts = waitForNpm ? 24 : 1;
+  for (let attempt = 1; attempt <= attempts; attempt++) {
+    try {
+      const result = execSync(`npm view ${spec} version`, { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+      if (result === version) return;
+    } catch {
+      // retry below
+    }
+    if (attempt < attempts) {
+      console.log(`  waiting for ${spec} to be visible on npm (${attempt}/${attempts})`);
+      sleep(5000);
+    }
+  }
+  throw new Error(`${spec} is not visible on npm yet`);
+}
+
 // Resolve published version for each workspace package
 function getPublishedVersion(packageName) {
+  if (source === 'workspace') {
+    const version = workspaceVersions.get(packageName);
+    if (!version) {
+      console.warn(`  ⚠ No workspace package found for ${packageName} — skipping`);
+      return null;
+    }
+    assertPublished(packageName, version);
+    return `^${version}`;
+  }
+
   try {
     const result = execSync(`npm view ${packageName} version`, { encoding: 'utf-8' }).trim();
     return `^${result}`;
@@ -51,10 +108,11 @@ for (const target of targets) {
     if (!deps) continue;
 
     for (const [name, version] of Object.entries(deps)) {
-      if (!version.startsWith('workspace:')) continue;
+      if (!name.startsWith('@provenancekit/')) continue;
 
       const published = getPublishedVersion(name);
       if (!published) continue;
+      if (version === published) continue;
 
       console.log(`  ${target}: ${name}  ${version} → ${published}`);
       deps[name] = published;
@@ -66,9 +124,8 @@ for (const target of targets) {
     fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
     console.log(`✓ Updated ${target}`);
   } else {
-    console.log(`– ${target}: no workspace:* deps found`);
+    console.log(`– ${target}: already up to date`);
   }
 }
 
-console.log('\nDone. Now run: pnpm install');
-console.log('Then simplify each vercel.json installCommand/buildCommand (see script header).');
+console.log('\nDone. Now run: pnpm install --lockfile-only');

scripts/vercel-ignore.sh

@@ -6,7 +6,7 @@
 # been published to npm yet at this point, so pnpm install would fail.
 # The real deploy happens on the next push once npm has the new versions.
 
-if [ "$VERCEL_GIT_COMMIT_MESSAGE" = "chore: version packages" ]; then
+if echo "$VERCEL_GIT_COMMIT_MESSAGE" | grep -q "chore: version packages"; then
   echo "Skipping deploy: version-bump commit (packages not published yet)"
   exit 0
 fi