Publishing — NOT done; owner decides the scope

Nothing here has been published. The packages are named @rain/* as a placeholder. If @rain is not yours on npm, pick a scope (e.g. @rain-risk-markets, @rainrng) and do a search-and-replace of @rain/ across packages/*/package.json, packages/*/src/**, packages/*/test/**, examples/**, docs/**, README.md before step 2.

0. Preconditions

npm whoami                       # logged in to the right account/org
npm access ls-packages <org>     # scope exists / you have publish rights
npm test && npm run test:live    # green
node scripts/vendor-sync.mjs --check
git status --porcelain           # clean

1. Version (all five move together — they pin each other by exact version)

npm version 2.0.0 --workspaces --no-git-tag-version
git commit -am "sdk-v2: release 2.0.0" && git tag sdk-v2.0.0

2. Dry run, then publish in dependency order

for p in rng-core rng-session games channels markets; do (cd packages/$p && npm publish --dry-run --access public); done

cd packages/rng-core    && npm publish --access public && cd ../..
cd packages/rng-session && npm publish --access public && cd ../..
cd packages/games       && npm publish --access public && cd ../..
cd packages/channels    && npm publish --access public && cd ../..
cd packages/markets     && npm publish --access public && cd ../..

files in each package.json ships only dist/ (+ vendor/, contracts/, abi/, docs where relevant). @rain/games ships ~450 KB of vendored engines; that is intentional (byte-identity is the feature).

3. Provenance / verification (recommended)

npm publish --access public --provenance     # from GitHub Actions with id-token: write

Then publish the tag + packages/games/vendor/MANIFEST.json sha256s alongside the Sourcify links in deployments.ts so integrators can tie the npm tarball to the on-chain engineHash.

4. After publishing

• Replace "@rain/rng-core": "2.0.0" etc. in examples/agent-dice/package.json with the published scope if renamed.
• Announce the attribution term plainly in the npm README (it is in each package README already).
• Do not publish sdk/ (v0.1, private) — superseded.

5. Pre-publication checklist — state on 2026-09-14 (review round 1, item 7a)

Not published. One command away; the owner decides scope and timing.

Exact commands (after npm login to the chosen org and the version bump in §1):

# 0. choose scope: if @rain is not yours →  grep -rl '@rain/' packages examples docs README.md | xargs sed -i 's#@rain/#@rain-risk-markets/#g'
for p in rng-core rng-session rng-node; do (cd packages/$p && npm pack --dry-run); done
cd packages/rng-core    && npm publish --access public --provenance && cd ../..
cd packages/rng-session && npm publish --access public --provenance && cd ../..
cd packages/rng-node    && npm publish --access public --provenance && cd ../..
npm view @rain/rng-core dist.integrity      # record in the release notes and hand to the lab with lab/FINGERPRINTS.json

Python: packages/rng-py → python -m build && twine upload dist/* under the name rain-rng (PyPI availability not checked; verify with pip index versions rain-rng).