Public release package

Status: open source (MIT); clean-room gates enforced in CI

Corrected (September 3, 2026). QueryLayer is publicly released under the MIT license. The installation path is now the self-contained single-site installer (scripts/install-site.mjs + install/) documented in install.md; no hosted Supabase project or Supabase CLI linkage is required. The clean-room rules below still govern what may enter a public archive: no pilot domains, IDs, credentials, or operator notes.

This document is the clean-room release contract for QueryLayer. It is kept separate from the pilot operator notes so a public checkout never needs the original hosted project, domains, content, credentials, or agent sessions.

#Clean-room installation

The supported installation is documented in install.md: clone the repository, run the single-site installer with your own site URL, local administrator credentials, and installation directory, then verify with the acceptance test. The installer applies the migrations locally and creates the first local owner — no external account or project linkage.

The legacy hosted-project flow below still works for contributors who prefer a managed Supabase project for development:

Prerequisites are Node.js 22.12 or newer, Docker, and Supabase CLI 2.115 or newer. Create a new Supabase project (or use a local one), then:

cp .env.example .env
npm ci
supabase link --project-ref <your-project-ref>
supabase db push
npm run check
npm run build

The publishable Supabase URL and key may be used by the browser. Service-role keys, deploy hooks, OAuth credentials, worker tokens, and provider keys belong only in the Supabase server-side secret store. The example file contains placeholders and is not a working pilot configuration.

After the first human signs in, call the authenticated bootstrap_first_site RPC with the included deployment-neutral helper:

set -a; . ./.env; set +a
read -r -s QUERYLAYER_BOOTSTRAP_ACCESS_TOKEN
export QUERYLAYER_BOOTSTRAP_ACCESS_TOKEN
npm run site:bootstrap -- \
  --organization-name "Example Organization" \
  --organization-slug example-organization \
  --site-name "Example Site" \
  --site-slug example-site \
  --domain example.com
unset QUERYLAYER_BOOTSTRAP_ACCESS_TOKEN

Press Enter after pasting the token at the silent prompt. The helper reads the token only from process memory and prints organization/site IDs only; the prompt avoids putting the token in shell history. The RPC creates the organization, owner membership, and first site atomically; retrying the same request returns the original IDs. It rejects an identity that already belongs to an organization and never requires direct table inserts or a service-role key.

#Package gate

Run npm run release:check before creating a release artifact. The check is read-only and verifies required documentation, placeholder configuration, tracked-file hygiene, migration presence, archive exclusions, and harness contract coverage. .gitattributes excludes pilot applications, fixtures, private operator notes, and pilot-only migrations from git archive without deleting them from the private checkout. To audit a staged clean-room export, pass its path with --root <directory>. Use --strict in CI or before publishing; private pilot identifiers, a missing license decision, or missing package documents fail that gate.

For tooling that needs a stable inventory without parsing the human-readable audit, run:

npm run --silent release:manifest > release-manifest.json

The output is deterministic JSON with format querylayer.release-manifest and version 1. It contains sorted included paths, sorted ignored paths with the matching .gitattributes rules, required package/migration coverage, and path-only security.findings for pilot identifiers or credential-shaped material. It never emits matched secret values, absolute checkout paths, or credentials, and it performs no archive, deployment, database, or network write.

For a deterministic archive audit, run:

npm run release:archive:check

This command resolves the selected Git ref (default HEAD), materializes only tracked files through git archive, audits that extracted tree in strict mode, and removes the temporary archive and extraction directory in all outcomes. It never deploys, publishes, applies migrations, or includes untracked local files.

#Decisions required before calling the recovery complete

• Select and add an OSI-approved license Done: MIT (LICENSE).
• Complete the OPS-001 restore and upgrade rehearsals against safe copies.
• Resolve provider activation separately from the core package: Resend, Google/Bing OAuth, deployment credentials, and optional challenge checks.
• Run the clean-room install and record the migration version, checks, and known limitations in the release notes.

Private pilot records under docs/pilots/, private operator procedures, local environment files, and production identifiers must not be copied into a public export. The checker reports these rather than deleting them from the private working repository.