chore(release): version packages

docs/jsr-publishing.md

@@ -56,4 +56,4 @@ Manual single-package publish: push a `@bounded-systems/<pkg>@<version>` tag, or
 
 | Package | Version | Auto-publish | Intra-scope deps |
 | --- | --- | --- | --- |
-| `@bounded-systems/prx-config` | 0.3.0 | ✅ ready | — |
+| `@bounded-systems/prx-config` | 0.4.0 | ✅ ready | — |

packages/prx-config/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @bounded-systems/prx-config
 
+## 0.4.0
+
+### Minor Changes
+
+- 06a401d: Remove Warp TUI support (`tui_l2_warp.ts` and all `*Warp` exports). Package now only manages the L1 Claude TUI slice.
+
+### Patch Changes
+
+- 585be9c: Add explicit `z.ZodType<T>` annotations to exported Zod schemas for JSR fast-check compliance. Add `| undefined` to optional TypeScript type fields to match `exactOptionalPropertyTypes: true` + Zod optional output.
+- 747b13f: Replace `z.infer<>` with explicit TypeScript types and add JSDoc to all exported symbols for JSR score 100.
+
 ## 0.2.1
 
 ### Patch Changes

packages/prx-config/jsr.json

@@ -1,6 +1,6 @@
 {
   "name": "@bounded-systems/prx-config",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "exports": "./src/index.ts",
   "imports": {
     "zod": "npm:zod@^4.4.3"

packages/prx-config/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bounded-systems/prx-config",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "TUI configuration schema parser/emitter for L1 Claude and L2 Warp tools",
   "bounded": {
     "tagline": "TUI configuration schema parser/emitter for L1 Claude and L2 Warp tools",

packages/prx/CHANGELOG.md

@@ -1,5 +1,50 @@
 # @bounded-systems/prx
 
+## 0.12.0
+
+### Minor Changes
+
+- cff799e: Add `prx pod up` verb: launches the per-repo pod (claude-room + beadsd-room + keeperd-room) via `launchPod`, attests the launch (best-effort L2), and returns `{ pod, containers, l2LaunchDigest }`. Rootless `doorDir` (`$XDG_RUNTIME_DIR/prx/doors` or `~/.local/run/prx/doors`) so no sudo is required on macOS/Linux. Injected into the verb registry and routed via `cli.ts`.
+
+### Patch Changes
+
+- 513c2bd: Pin beadsd-box OCI image digest in `beadsd-room` (prx-634). Image is built via
+  `nix dockerTools.streamLayeredImage` (prx, bd, dolt, git, cacert) and pushed to
+  `ghcr.io/bounded-systems/prx/beadsd-box`; the digest reference replaces the
+  placeholder `"beadsd-box"` string. Adds `publish-oci-boxes.yml` CI workflow that
+  rebuilds and pushes on every `v*` tag.
+- b2b86da: Pass `--socket` and `--key` CMD args to keeperd container so it binds to the shared fabric.
+
+  The keeperd image entrypoint hardcodes `--socket /run/doors/keeperd.sock --key /keys/keeper.key`
+  before `"$@"`. door-kit's `parseArgs` uses last-wins semantics, so CMD args (after the OCI image
+  ref in `podman run`) override the baked-in defaults.
+
+  - **spec.ts** — `RoomSpec` gains `extraArgs: string[]` (default `[]`): room-specific CMD args
+    appended after the image ref for entrypoint override
+  - **podman.ts** — `renderPodmanRun` appends `--socket ${doorDir}/<basename>` CMD args for each
+    exposed door (overrides hardcoded entrypoint socket path), then `room.extraArgs`
+  - **keeperd-room.ts** — sets `extraArgs: ["--key", "/run/secrets/keeper-key"]` to override the
+    entrypoint's baked-in key path with our secret mount target
+  - all existing room definitions gain `extraArgs: []` to satisfy the TS output type
+
+- aacba94: Wire keeper socket readiness poll so `prx pod up` returns a non-null `l2LaunchDigest`.
+
+  Three-part fix closing the gap from prx-9yv3/#749:
+
+  1. **podman.ts** — `renderPodmanRun` injects `KEEPERD_SOCK=${doorDir}/<basename>` for
+     each exposed door, so the keeper daemon writes its socket onto the shared fabric
+     (not the in-box default `/run/keeperd.sock`).
+
+  2. **pod.ts** — `doorEnv` rebases consumer socket paths to `${doorDir}/<basename>`,
+     ensuring the client-side `KEEPERD_SOCK` and `PRX_BEADS_SOCKET` point to the
+     shared fabric regardless of the door spec's nominal path.
+
+  3. **podman-runtime.ts** — `launchPod` polls for the keeper socket via `waitForSocket`
+     (injectable, 500ms interval / 30s timeout), then sets `KEEPERD_SOCK` in the host
+     environment before calling `attestLaunchForPod`, and restores or deletes it after.
+     Best-effort: a poll timeout or attest failure surfaces as `l2LaunchDigest: null`
+     without tearing down the pod.
+
 ## 0.11.3
 
 ### Patch Changes

packages/prx/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bounded-systems/prx",
-  "version": "0.11.3",
+  "version": "0.12.0",
   "private": true,
   "type": "module",
   "license": "PolyForm-Noncommercial-1.0.0",