[pegahcarter]

What

Adds contracts/evm/npm/, which builds @crossecute/protocol: Solidity sources and ABIs that integrators can install with npm instead of adding this repo as a submodule.

npm/pack.mjs runs after forge build. It ships every file under src/ (and the guard's src/ once that merges) whose imports stay within the protocol, OpenZeppelin and the guard. It rewrites those imports to relative paths. It also writes each shipped contract's ABI as JSON, plus abi/index.js and abi/index.d.ts with literal types for viem. OpenZeppelin 5.4.0 is a peer dependency. The provider bindings under src/protocols/<p>/ import vendored provider code, so they are left out.

No file under src/ changes. Rewriting the bare src/... imports at pack time keeps this out of the way of #117, #135 and #116.

Why

A submodule brings the whole dependency tree (forge-std, both OpenZeppelin repos, and their nested submodules) into every project that depends on an SDK built on the protocol. It also pins a second copy of OpenZeppelin there. The package ships only the sources an integrator compiles.

Derived addresses

The package README tells consumers not to predict conduit addresses with ProxyInitCode.hash() or ProxyDeployer.predict compiled in their own project. Both hash type(Proxy).creationCode with the consumer's compiler settings. Consumers should call predictReceiver / predictTransmitter on the deployed transceiver instead.

Checked

• Built from main: 51 sources and 63 ABIs.
• Built from a copy of the feat(dispatch): Safe-signed dispatch in the transmitter and receiver #135 tree: 70 sources (signed types and ICrossecuteGuard included) and 81 ABIs.
• Both tarballs install into a fresh Foundry project with OpenZeppelin 5.4.0 from npm, and every shipped source compiles there under solc 0.8.30.
• npm/check-consumer.sh repeats that check under solc 0.8.28, the oldest compiler the package README promises. The new npm-package CI job runs it. With the rewrite deliberately broken for one file, the check fails.

Publishing

.github/workflows/publish.yml publishes from a tag npm-v<version> through npm trusted publishing. No npm token exists, and npm attaches provenance tying the tarball to the run. The job waits for a reviewer on the npm environment, refuses a tag that does not match package.json's version or a package with install scripts, and reruns the consumer check before publishing.

Before the first release:

• Configure the trusted publisher on npmjs.com for @crossecute/protocol: repository crossecute/protocol, workflow publish.yml, environment npm. npm only allows this once the package exists, so a 0.0.0 placeholder reserves the name.
• Create the npm environment in this repository's settings with required reviewers.

Not in this PR

• Shipping deployment addresses from deploy/.