fix!: retire Iris dual-publish + deprecate transitional CTA workflow

.github/workflows/deprecate-transitional-npm.yml

@@ -0,0 +1,38 @@
+name: Deprecate transitional npm id
+
+on:
+  workflow_dispatch:
+    inputs:
+      confirm:
+        description: Type DEPRECATE_IMAGE_READER_MCP
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  deprecate:
+    if: ${{ inputs.confirm == 'DEPRECATE_IMAGE_READER_MCP' }}
+    runs-on: sylphx-linux-standard
+    steps:
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          registry-url: 'https://registry.npmjs.org'
+          always-auth: true
+      - name: npm deprecate transitional package
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          set -euo pipefail
+          TOKEN="${NODE_AUTH_TOKEN:-$NPM_TOKEN}"
+          test -n "$TOKEN"
+          printf '//registry.npmjs.org/:_authToken=%s\nalways-auth=true\n' "$TOKEN" > "$HOME/.npmrc"
+          export NPM_CONFIG_USERCONFIG="$HOME/.npmrc"
+          npm whoami
+          MSG='Retired install CTA. Use brand-sole @sylphx/iris (bin: iris).'
+          npm deprecate "@sylphx/image-reader-mcp" "$MSG"
+          npm view @sylphx/image-reader-mcp version deprecated || true
+          npm view @sylphx/iris version bin

.github/workflows/publish-brand-alias.yml

@@ -1,94 +1,26 @@
 name: Publish brand alias
 
+# RETIRED (brand-sole hard cut): @sylphx/iris is the sole public MCP package id.
+# Dual-publish from @sylphx/image-reader-mcp is no longer valid.
+
 on:
   workflow_dispatch:
     inputs:
       confirm:
-        description: 'Type PUBLISH'
+        description: 'Type RETIRED (workflow intentionally fails closed)'
         required: true
         type: string
-      version:
-        description: 'Version to dual-publish (default: read from npm latest of transitional)'
-        required: false
-        type: string
 
 permissions:
   contents: read
 
 jobs:
-  publish-brand:
-    if: ${{ inputs.confirm == 'PUBLISH' }}
+  retired:
     runs-on: sylphx-linux-standard
     steps:
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-          registry-url: 'https://registry.npmjs.org'
-          always-auth: true
-      - name: Dual-publish @sylphx/iris from @sylphx/image-reader-mcp
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-          BRAND: '@sylphx/iris'
-          TRANSITIONAL: '@sylphx/image-reader-mcp'
-          VERSION_INPUT: ${{ inputs.version }}
+      - name: Brand-sole — dual alias path retired
         run: |
           set -euo pipefail
-          TOKEN="${NODE_AUTH_TOKEN:-$NPM_TOKEN}"
-          test -n "$TOKEN"
-          printf '//registry.npmjs.org/:_authToken=%s\nalways-auth=true\n' "$TOKEN" > "$HOME/.npmrc"
-          export NPM_CONFIG_USERCONFIG="$HOME/.npmrc"
-          npm whoami
-          VER="${VERSION_INPUT:-}"
-          if [ -z "$VER" ]; then
-            VER=$(npm view "$TRANSITIONAL" version)
-          fi
-          echo "Alias $BRAND@$VER <= $TRANSITIONAL@$VER"
-          if npm view "$BRAND@$VER" version >/dev/null 2>&1; then
-            echo already "$BRAND@$VER"
-            npm view "$BRAND" version dist-tags
-            exit 0
-          fi
-          if ! npm view "$TRANSITIONAL@$VER" version >/dev/null 2>&1; then
-            echo "Transitional $TRANSITIONAL@$VER missing on registry" >&2
-            exit 1
-          fi
-          WORK=$(mktemp -d)
-          cd "$WORK"
-          npm pack "$TRANSITIONAL@$VER"
-          TGZ=$(ls -1 *.tgz | head -1)
-          tar -xzf "$TGZ"
-          cd package
-          node -e '
-            const fs=require("fs");
-            const pkg=JSON.parse(fs.readFileSync("package.json","utf8"));
-            pkg.name=process.env.BRAND;
-            pkg.private=false;
-            pkg.publishConfig=Object.assign({}, pkg.publishConfig||{}, {access:"public"});
-            // annotate alias provenance
-            pkg.description=(pkg.description||"") + " (brand alias of " + process.env.TRANSITIONAL + ")";
-            if (pkg.scripts) {
-              delete pkg.scripts.prepublishOnly;
-              delete pkg.scripts.prepare;
-              delete pkg.scripts.prepack;
-              delete pkg.scripts.postinstall;
-            }
-            fs.writeFileSync("package.json", JSON.stringify(pkg,null,2));
-            console.log("publishing", pkg.name, pkg.version, "unpacked from", process.env.TRANSITIONAL);
-          '
-          npm publish --access public --ignore-scripts
-          for i in $(seq 1 12); do
-            if OUT=$(npm view "$BRAND@$VER" version 2>/dev/null); then
-              echo "readback $OUT"
-              npm view "$BRAND" version dist-tags
-              # size sanity: brand should roughly match transitional package
-              exit 0
-            fi
-            sleep 5
-          done
-          # treat publish log success + delayed CDN as ok if npm publish exited 0
-          echo "view delayed; verifying via registry API"
-          code=$(curl -s -o /tmp/b.json -w '%{http_code}' "https://registry.npmjs.org/$(node -p 'encodeURIComponent(process.env.BRAND)')")
-          echo "http $code"
-          head -c 200 /tmp/b.json; echo
-          test "$code" = "200"
+          echo "::error::publish-brand-alias is retired. Canonical package is @sylphx/iris."
+          echo "Transitional @sylphx/image-reader-mcp is not a publish source."
+          exit 1