Slidesfly integrations v0.3.1

npm distribution trust materials

• Mirrors the verified registry tarballs for @slidesfly/cli@0.1.3 and @slidesfly/mcp@0.1.0.
• Includes SHA256SUMS and SHA512SUMS; npm integrity and SHA-1 values remain recorded in releases/npm-packages.json.
• Upgrades the public GitHub Action to website CLI 0.1.3 and fails closed unless the downloaded CLI matches the pinned SHA-256.
• Documents exact fixed-version npm installs and validates live registry tarballs in CI.

Evidence

• Validate integrations CI passed on PR #19.
• Node 22 clean-host CLI and MCP stdio checks passed.
• Anonymous publish, reader/R2 byte identity, delete/404 recovery, uninstall, and exact reinstall passed.

Known limits

• Both npm packages currently expose only one version, so historical downgrade rollback is unavailable and is not claimed.
• npm Trusted Publisher OIDC is configured but has not executed a tag publish yet; validate it on the next genuine package release.