# Publishing WRNexusJS 0.7.0 privately

Run the production gates before staging packages:

```sh
bun install
bun run validate:0.7
bun run security:framework
bun run sbom
bun run benchmark:framework
bun run validate:staging
bun run check
```

Prepare, commit, and publish only from a clean branch:

```sh
bun run release:prepare
git add --all
git commit -m "release: WRNexusJS 0.7.0 security and performance foundation"
git push origin main
bun run release:private
```

The release workflow validates the 0.7 migration, framework security audit, deterministic CycloneDX SBOM, benchmark budgets, full type/lint/test/format checks, deterministic UI references, restricted package staging, package SHA-256 manifests, clean Git state, and private-registry policy.

The staging verifier rejects secrets, private keys, source maps, TypeScript source files other than declarations, and unexpected environment files before publication.