docs(auth): clarify Bazel package authority

BUILD.bazel

@@ -47,10 +47,16 @@ vitest_bin.vitest_test(
     data = (
         glob(["src/**/*.ts"]) +
         glob(["tests/**/*.ts"]) +
-        glob(["examples/**/*.ts"])
+        glob(["examples/**/*.ts"]) +
+        glob(["docs/**/*.md"])
     ) + [
+        ".github/workflows/ci.yml",
+        ".github/workflows/publish.yml",
+        "BUILD.bazel",
+        "README.md",
         ":node_modules",
         ":node_modules/vitest",
+        "package.json",
         "tsconfig.json",
         "vitest.config.ts",
     ],

CHANGELOG.md

@@ -1,5 +1,14 @@
 # @tummycrypt/tinyland-auth
 
+## Unreleased
+
+### Patch Changes
+
+- Clarify the package release authority: the TypeScript import API remains
+  `@tummycrypt/tinyland-auth`, npmjs publication is disabled, GitHub Packages
+  uses the `@tinyland-inc/tinyland-auth` mirror coordinate, and Bazel targets
+  provide the package proof lane.
+
 ## 0.3.3
 
 ### Patch Changes

README.md

@@ -2,11 +2,22 @@
 
 Production-grade authentication system with TOTP, RBAC, and pluggable storage.
 
-## Install
-
-```sh
-pnpm add @tummycrypt/tinyland-auth
-```
+## Consumption And Release Authority
+
+The TypeScript import API stays under `@tummycrypt/tinyland-auth`. Tinyland's
+current release authority for this repo is Bazel-first:
+
+- CI validates the package through a repo-owned GloriousFlywheel runner lane and
+  `//:pkg //:test //:typecheck`.
+- npmjs publication is disabled in package workflows.
+- GitHub Packages mirror publication uses `@tinyland-inc/tinyland-auth`, because
+  GitHub Packages npm scopes are owner-bound.
+- Bazel consumers should depend through the Tinyland Bazel registry / BCR module
+  path instead of relying on a workspace-local package copy.
+
+`pnpm add @tummycrypt/tinyland-auth` is valid only when the consumer is
+configured for a registry that intentionally serves the `@tummycrypt` package
+scope. It is not the current Tinyland publication authority for this repo.
 
 ## Exports
 

docs/tinyland-databaseless-auth-mvp.md

@@ -10,6 +10,20 @@ Executable proof lives in
 and is covered by
 [`tests/databaseless-mvp.test.ts`](../tests/databaseless-mvp.test.ts).
 
+## Bazel And Package Proof
+
+Package adoption is proved through the Bazel package lane, not by treating a
+local pnpm workspace copy as release truth. The CI and publish workflows run on
+the repo-owned GloriousFlywheel runner lane and validate
+`//:pkg //:test //:typecheck`; `//:test` includes the MVP example plus the
+databaseless auth tests.
+
+The runtime TypeScript package remains `@tummycrypt/tinyland-auth`. npmjs
+publication is disabled for this repo's workflows; the GitHub Packages mirror is
+`@tinyland-inc/tinyland-auth` because GitHub Packages scopes are owner-bound.
+Bazel consumers should use the Tinyland Bazel registry / BCR module path that
+corresponds to the released package artifact.
+
 ## Authority Planes
 
 | Plane | Package or repo | Responsibility |
@@ -94,8 +108,8 @@ The downstream app should add tests that prove:
 - changed fingerprints do not invalidate valid sessions
 - invite routes use package RBAC policy instead of route-hardcoded role lists
 - GitHub OAuth creates a package session only after app-local provider checks
-- `MODULE.bazel` proves released auth-adjacent modules, not only pnpm
-  workspace resolution
+- `MODULE.bazel` and Bazel package targets prove released auth-adjacent modules,
+  not only pnpm workspace resolution
 
 ## Related Linear Work
 

package.json

@@ -107,9 +107,5 @@
   },
   "engines": {
     "node": ">=22.0.0"
-  },
-  "publishConfig": {
-    "registry": "https://registry.npmjs.org/",
-    "access": "public"
   }
 }

tests/package-authority.test.ts

@@ -0,0 +1,46 @@
+import { readFile } from 'node:fs/promises';
+import { describe, expect, it } from 'vitest';
+
+const readText = (path: string) => readFile(path, 'utf8');
+const normalizeWhitespace = (value: string) => value.replace(/\s+/g, ' ');
+
+describe('package release authority', () => {
+  it('keeps the TypeScript import API under the @tummycrypt scope', async () => {
+    const packageJson = JSON.parse(await readText('package.json')) as {
+      name?: string;
+      publishConfig?: unknown;
+    };
+    const buildBazel = await readText('BUILD.bazel');
+
+    expect(packageJson.name).toBe('@tummycrypt/tinyland-auth');
+    expect(packageJson.publishConfig).toBeUndefined();
+    expect(buildBazel).toContain('package = "@tummycrypt/tinyland-auth"');
+  });
+
+  it('keeps npmjs publication disabled in package workflows', async () => {
+    const workflowPaths = ['.github/workflows/ci.yml', '.github/workflows/publish.yml'];
+
+    for (const workflowPath of workflowPaths) {
+      const workflow = await readText(workflowPath);
+
+      expect(workflow).toContain('runner_mode: repo_owned');
+      expect(workflow).toContain('runner_labels_json: ${{ vars.PRIMARY_LINUX_RUNNER_LABELS_JSON }}');
+      expect(workflow).toContain('bazel_targets: "//:pkg //:test //:typecheck"');
+      expect(workflow).toContain('npm_publish_mode: disabled');
+      expect(workflow).toContain('github_package_name: "@tinyland-inc/tinyland-auth"');
+    }
+  });
+
+  it('documents Bazel-first release authority for consumers', async () => {
+    const readme = await readText('README.md');
+    const mvpDoc = await readText('docs/tinyland-databaseless-auth-mvp.md');
+
+    expect(readme).toContain('npmjs publication is disabled');
+    expect(readme).toContain('GitHub Packages mirror');
+    expect(readme).toContain('Tinyland Bazel registry');
+    expect(readme).toContain('repo-owned GloriousFlywheel runner lane');
+    expect(mvpDoc).toContain('`//:pkg //:test //:typecheck`');
+    expect(mvpDoc).toContain('repo-owned GloriousFlywheel runner lane');
+    expect(normalizeWhitespace(mvpDoc)).toContain('npmjs publication is disabled');
+  });
+});