Own the app. Pin the Arcane contract.

Authority and result

The external repository may use private or proprietary source, but it cannot borrow authority from the Arcane checkout. Its development declaration follows the current SDK channel while its lockfile records the exact selected package; its descriptor declares permissions, Core requirements, and target intent; and its application release owns the complete packaged content.

1. Create or enroll the repository

Use new for a standalone browser scaffold at the repository root, consuming the installed npm runtime through managed imports. Use init when source already exists and only the missing Arcane files should be added. Native targets use the separate provider-paired guide.

npx arcane-os@latest new my-app --path ./my-app --target browser --git
cd my-app
npm install

npm pkg set dependencies.arcane-os=latest
npm install
npm exec -- arcane init my-app --target browser

2. Use the focused app loop

The generated scripts select one app and acknowledge before blocking work. Configure the workspace HTTPS certificate pair, start the source server, and refresh after saving. Explicit --http selects HTTP source development. Tests and checks are separate explicit operations.

npm exec -- arcane dev

Expected: the development server prints its selected application URL and keeps serving saved source until cancelled.

3. Package the selected browser output

package creates the selected browser release and verify checks the published inventory. Use --dry-run to inspect the planned source set without creating output.

npm exec -- arcane package --dry-run
npm exec -- arcane package
npm exec -- arcane verify

4. Create the deterministic exchange bundle

The bundle contains the schema-2 descriptor and one already packaged release, including its packaged HTML, CSS, and JavaScript. It omits repository-only source, tests, and development files, and it does not execute an adapter while Arcane admits it.

npm exec -- arcane package --app my-app
npm exec -- arcane bundle --app my-app
npm exec -- arcane verify-bundle dist/my-app-0.1.0.arcane-app.tar.gz

Expected: one deterministic .arcane-app.tar.gz containing the descriptor, release manifest, and complete ordered inventory.

5. Keep CI exact and narrow

Dependency installation uses the application’s committed lock. Run tests or checks only when explicitly selected. The reusable application release workflow is not a supported path until its implementation matches the current publishing contract; see the maintained publishing guide. After an SDK publication, follow the consumer update guide to advance the declaration, lockfile, and managed projections together.

Licensing boundary

The synchronized Arcane runtime and packager are currently AGPL-3.0-only. The existing commercial notice is not, by itself, permission to distribute a closed-source application that bundles that runtime; obtain the separate agreement required for that use.