Every workspace manifest omitted a license field, so a scanner reading
the published repository would resolve all 90 of them as unknown. Both
Python services went further and declared plain Apache-2.0, which is
looser than the LICENSE they actually ship under.
Package bytes feed the example package locks, so adding the field
invalidated all three; refreshed them. Only closureDigest and artifacts
move — same 31 selected packages, nothing added or removed.
Also record what the READMEs never said: ffmpeg is a real prerequisite
for a Build and had zero mentions, and the media Lambda layer is a GPL
FFmpeg build. That build is deliberate — libx264 is GPL-only and the
encode path requires it — and it stays lawful only because the operator
builds and deploys it into their own account. Publishing a prebuilt
layer would break that, so the boundary is now written down.
Narratage (narration + montage) is the project, framework, npm scope
(@narratage/*) and CLI command. SVML remains the name of its markup
language, so file suffixes (.svml/.svs/.svrun), source Headers and
svml.* wire format ids are intentionally unchanged. Example locks are
regenerated because package manifests participate in artifact digests.
kashorin