v0.5.1-preview.1

• @assetlib/cli 0.3.0. @assetlib/sdk-core and @assetlib/sdk-expo change only their version.

• @assetlib/cli: assetlib init sets up an Expo app that has no catalog yet. It adopts bundled images as adopt does but starts from no catalog and creates it, copies a checked public configuration to assetlib.public.json, and writes a GitHub Actions workflow that runs assetlib sync from the installed package with the token from a repository secret. It is a dry run unless --apply, refuses an existing catalog, writes nothing when no image can be adopted (exit 3), and never calls Git or the network. --image limits it to chosen images. The workflow gives the token to the sync step only: actions are pinned to commits, checkout keeps no credentials, dependency install scripts are off, values reach scripts as environment variables, literals are validated and single-quoted, and a non-HTTPS console is never written into CI. init never writes through a symlink. The adopt command's behavior and output are unchanged. See the CLI README.

Install the CLI from this release and run its entry file; it is not on npm, and the unscoped assetlib npm name is not ours:

npm install --save-dev https://github.com/AssetLib/sdk-js/releases/download/v0.5.1-preview.1/assetlib-cli-0.3.0.tgz
node ./node_modules/@assetlib/cli/bin/assetlib.mjs init --help

Attached: @assetlib/sdk-core and @assetlib/sdk-expo 0.5.1-preview.1, @assetlib/cli 0.3.0, and SHA256SUMS covering those three. The SDK and CLI packages are not on the npm registry. @assetlib/audit is not attached this time: its source has changed since @assetlib/audit 0.1.0 on npm, and it will ship under a new version. (The "0.1.0" audit tarball attached to v0.5.0-preview.1 was packed from that changed source, so it differs from the npm 0.1.0.)

Checks: npm run verify (core 521, Expo 81, audit 10 and CLI 84 tests, typecheck) and npm run pack:release locally, and CI run 38095916190 on 35e9f76.