chore: build the registry on install instead of vendoring the Daml deps

ARCHITECTURE.md

@@ -12,7 +12,7 @@
 | Language | Daml | LF target 2.1 (`build-options: --target=2.1`) |
 | SDK | Daml SDK 3.4.11 | installed and driven via `dpm` |
 | Build tool | `dpm` (Digital Asset Package Manager) | not the legacy `daml` assistant (removed as of SDK 3.5) |
-| Task runner | `npm` scripts | thin wrappers over `dpm`; set `LANG=C.UTF-8` |
+| Task runner | `npm` scripts | the Daml ones wrap `dpm` with `LANG=C.UTF-8`; `prepare` builds `registry/` |
 | Standard | CIP-0056 (CN Token Standard) | interface-faithful, clean-room (no economics) |
 | Dependencies | `splice-api-token-*` interface DARs | vendored from `canton-network/splice`; NOT `splice-amulet` |
 | Testing | `daml-script` (`dpm test`) | lives in the separate `canton-token-forge-test` package |
@@ -363,14 +363,14 @@ overrides from `SEED_*`/`LEDGER_*` ([`RUNBOOK.md`](RUNBOOK.md)).
 
 | Command | Purpose |
 |---------|---------|
-| `npm install` / `npm run setup` | Vendor Splice into `deps/` and create the stable-name symlinks (`scripts/fetch-dep.sh`). |
+| `npm run setup` | Vendor Splice into `deps/` and create the stable-name symlinks (`scripts/fetch-dep.sh`). |
 | `npm run build` | Build both packages (production, then test). |
 | `npm run build:canton-token-forge` | Build only the production package. |
 | `npm test` | Build the production DAR, then run the `canton-token-forge-test` suite. |
 | `npm run test:coverage` | Same as `npm test` with a template-focused coverage report. |
 | `npm run smoke` | Compile a package that data-depends on nothing but the built DAR (`scripts/consumer-smoke.sh`); proves the release artifact is consumable on its own. |
 | `bash scripts/release-notes.sh <tag>` | Emit the release body, with the consumer snippet extracted from `consumer-smoke/consumer/daml.yaml`. Refuses if `<tag>` does not name the checked-out commit, if the working tree is dirty, or if `deps/` carries no commit stamp (`npm run setup` writes it); `ALLOW_UNTAGGED=1` previews a body before the tag exists ([`RUNBOOK.md`](RUNBOOK.md#cutting-a-release)). |
-| `npm run clean` | Remove both `.daml` build dirs and the consumer smoke test's output. |
+| `npm run clean` | Remove both `.daml` build dirs, the consumer smoke test's output, and `registry/dist`. |
 | `npm run sandbox` | Build the DAR and run a local Canton sandbox with the JSON Ledger API. |
 | `npm run seed` | Seed a running sandbox with an admin, demo users, and one `InstrumentConfig`. |
 | `bash scripts/build-harness.sh` | Build the Amulet test harness (unused by default; conformance only). |

CLAUDE.md

@@ -7,9 +7,11 @@ Claude Code reads this file natively. Other agents (Cursor, Windsurf, etc.) read
 [`AGENTS.md`](AGENTS.md), which points here.
 
 This is a **Daml** project built with **`dpm`**, not a JavaScript project - the
-`npm` scripts just wrap `dpm` and vendor dependencies. Generic JS/`npm`
-assumptions do not apply here, and this file overrides any parent-directory or
-global config that describes generic JS/`npm` workflows.
+`npm` scripts mostly wrap `dpm` and vendor dependencies, and the one genuine
+JavaScript build among them (`prepare`, which compiles `registry/`) never
+touches the Daml side. Generic JS/`npm` assumptions do not apply here, and this
+file overrides any parent-directory or global config that describes generic
+JS/`npm` workflows.
 
 ## What this repo is
 
@@ -33,7 +35,7 @@ Two packages:
 | Language | Daml | LF target **2.1** (`build-options: --target=2.1`) |
 | SDK | 3.4.11 | pinned in all three `daml.yaml` files; CI asserts them |
 | Build tool | `dpm` (Digital Asset Package Manager) | NOT the legacy `daml` assistant (removed as of SDK 3.5) |
-| Task runner | `npm` scripts | thin wrappers over `dpm`; they set `LANG=C.UTF-8` |
+| Task runner | `npm` scripts | the Daml ones wrap `dpm` with `LANG=C.UTF-8`; `prepare` builds `registry/` |
 | Dependencies | Splice interface DARs | vendored into `deps/` by `scripts/fetch-dep.sh` (gitignored) |
 | Runtime | JDK 17+ | required on `PATH` for `dpm` |
 | Choice naming | `TemplateName_ChoiceName` | matches the CN Token Standard convention |
@@ -88,12 +90,18 @@ Use the `package.json` npm scripts - they set `LANG=C.UTF-8` and handle the
 per-package layout. (damlc regenerates data-dependency interface source and
 throws "lexical error (UTF-8 decoding error)" under a POSIX/`C` locale.)
 
-### Setup (`npm install`)
+### Setup (`npm run setup`)
 
-`postinstall` runs `npm run setup` (= `scripts/fetch-dep.sh`): vendors Splice into
-`deps/` and creates the stable-name symlinks for the token interface DARs.
-Preconditions: `dpm` + JDK 17+ on `PATH`, `git` + network. First run takes a few
-minutes. For deps only, run `bash scripts/fetch-dep.sh`.
+`npm run setup` (= `scripts/fetch-dep.sh`) vendors Splice into `deps/` and
+creates the stable-name symlinks for the token interface DARs. It needs `git`
+and network, and invokes neither `dpm` nor a JVM: the DARs are pre-built
+upstream. Run `bash scripts/fetch-dep.sh` directly and it does the same work
+without Node. First run writes over 100 MB into `deps/` and took 6 seconds on a
+cold CI runner; a slow link will take longer.
+
+A root `npm install` vendors nothing. It installs the registry service's runtime
+dependencies and compiles `registry/src` to `registry/dist` through `prepare`, so
+installing this repository needs no `dpm`, no JDK and no clone of Splice.
 
 | Command | Does |
 | --- | --- |
@@ -102,7 +110,7 @@ minutes. For deps only, run `bash scripts/fetch-dep.sh`.
 | `npm test` | Build the `canton-token-forge` DAR, then run the `canton-token-forge-test` suite. |
 | `npm run test:coverage` | Same, with a coverage report focused on your templates. |
 | `npm run smoke` | Build the DAR, then compile a package that data-depends on nothing but it, proving the artifact is consumable on its own. |
-| `npm run clean` | Remove both `.daml` build dirs and the consumer smoke test's output. |
+| `npm run clean` | Remove both `.daml` build dirs, the consumer smoke test's output, and `registry/dist`. |
 | `npm run setup` | Re-vendor deps + re-create the stable symlinks. |
 | `npm run sandbox` | Build the DAR and run a local Canton sandbox with the JSON Ledger API. |
 | `npm run seed` | Seed a running sandbox with an admin, demo users, and one `InstrumentConfig`. |
@@ -266,7 +274,7 @@ The `/sdlc:issue` skill applies these labels automatically when creating issues
 
 Run before declaring work done:
 
-- `npm install` (or `npm run setup`) once, so `deps/` are vendored
+- `npm run setup` once, so `deps/` are vendored
 - `npm run build` - both packages compile
 - `npm test` - the integration suite passes
 - `npm run test:coverage` - when you touched or added templates

README.md

@@ -15,7 +15,7 @@ and every holding, and is the same party the registry API reports as its
 
 ```bash
 # 1. Vendor the Splice interface DARs into deps/ (clones canton-network/splice)
-npm install
+npm run setup
 
 # 2. Build the production DAR and run the Daml test suite
 npm test
@@ -30,7 +30,8 @@ allocations, the faucet and burn-mint. The scripts run in-process, so no ledger
 or sandbox is needed.
 
 `registry/` is a separate npm package with its own dependencies: the root
-`npm install` vendors the Daml deps and does not populate `registry/node_modules`.
+`npm install` does not populate `registry/node_modules`, and vendoring the Daml
+deps is a separate `npm run setup`.
 Its suite runs against an in-process server with a stubbed ledger, so it needs no
 sandbox either.
 
@@ -67,7 +68,7 @@ and the service look the way they do.
   contexts a client needs to submit a transfer or an allocation. It submits
   nothing to the ledger itself.
 - `scripts/fetch-dep.sh` - vendor Splice into `deps/`, derive versions,
-  stable-symlink DARs. Run by `npm install`.
+  stable-symlink DARs. Run by `npm run setup`.
 - `scripts/sandbox.sh` - build the DAR and run a local Canton sandbox with the
   JSON Ledger API (`npm run sandbox`).
 - `scripts/seed.mjs` - seed a running sandbox with an admin, demo users, and one

RUNBOOK.md

@@ -17,7 +17,7 @@ been re-probed since.
 ## Prerequisites
 
 - `dpm` and a JDK 17+ on `PATH` (see `CLAUDE.md`)
-- `deps/` vendored: `npm install`, or `bash scripts/fetch-dep.sh` for deps only
+- `deps/` vendored: `npm run setup`, or `bash scripts/fetch-dep.sh` directly
 - Node 18+ for the seed script and the registry service
 
 ## 1. Start the sandbox
@@ -81,7 +81,8 @@ npm start
 ```
 
 `registry/` is a separate package with its own dependencies: the root
-`npm install` vendors the Daml deps and does not populate `registry/node_modules`.
+`npm install` does not populate `registry/node_modules`, and vendoring the Daml
+deps is a separate `npm run setup`.
 
 `GET /healthz` and `GET /readyz` answer, `GET /registry/metadata/v1/info` returns
 the admin party as `adminId` with the six supported APIs, and

SPEC.md

@@ -457,7 +457,7 @@ instrument, then prints a ready-to-paste service configuration.
 ## 8. Running it
 
 ```bash
-npm install                       # vendors the Splice interface DARs into deps/
+npm run setup                     # vendors the Splice interface DARs into deps/
 npm test                          # builds the production DAR, runs 80 Daml scenarios
 cd registry && npm install && npm test   # 205 unit tests, no ledger needed