[yia-mw-agent]

What changes

The SDK packages this application uses are now on the public npm registry, so this repository installs them the ordinary way.

• Adds package-lock.json, generated from the unchanged package.json. It resolves @saga-a2ui/core, components, mcp, react and react-mcp-stack to exactly 0.11.0-rc.1 from registry.npmjs.org, with integrity hashes.
• CI runs npm ci instead of the step that packed the pinned SDK revision locally.
• Removes scripts/qualify-sdk-packages.mjs, its qualify:sdk script and the .qualify/ ignore entry. Nothing else used them, and keeping an optional second install path would only invite drift.
• Updates the README: "Release constraint" becomes "Installing dependencies", and the paragraph about artwork that "has not been deployed, packaged or checked on a host" now records what was observed.

Not changed: no package version, API or application code; no deployment; the pinned canonical game-source archive (sdk-source.json) is untouched. Packages come from the registry through the lockfile; the game's own source stays the pinned SDK archive. They have separate owners.

Validation

• Registry state, checked anonymously: all seven 0.11.0-rc.1 versions are public under next; latest is unchanged and is not used here.
• The lockfile has 242 packages, every one resolved from registry.npmjs.org with an integrity value, and no file:, link or workspace resolutions. The five SDK entries' integrity values equal npm view @saga-a2ui/<name>@0.11.0-rc.1 dist.integrity.
• npm ci with npm 10 (the version bundled with the pinned Node 22) installs from that lockfile, with no --legacy-peer-deps and no local tarballs.
• npm run check run once on the final registry-installed tree: icon digests (4 match), typecheck, 16 Workers-runtime tests, 13 rendered-card tests in Chromium, and the Worker build dry run all pass. scripts/check-lfs.py validates the 4 LFS pointers.

Limits

• npm 10 fails with an internal error when it creates a lockfile for this dependency tree from nothing; npm 11 and 12 produce identical lockfiles. The lockfile was generated with npm 12, and the README says so. Installing from it with npm 10 works.
• The README records the second-edition artwork as deployed (Worker version e89a6cb8-ee7b-4d6d-812d-3d9f84f6b8f6 from 9403b8f) and seen in the cards of both web hosts, each after one supported Retry. It does not claim reliable first load or reload, a changed Claude connector row (still a placeholder letter), or a changed icon on the existing ChatGPT plugin, which keeps the dragon uploaded earlier.
• Nothing is deployed by this change. The latest tag is not promoted.

[timeleft--]

Reviewed the full patch and committed lockfile at this exact head. All package resolutions are public registry URLs with integrity; all five SDK identities/integrities match the independently published release. An isolated anonymous npm ci and the owning npm run check pass: four icon digests, types, 16 real Worker tests, 13 Chromium rendered-card tests, and Worker dry-run build; all four LFS pointers validate. Canonical game source and application runtime remain unchanged. README accurately preserves host-icon and first-load limitations. Current-head CI is green, branch rules and review threads were checked.