The bundle is built reproducibly (members dated with the commit, in UTC) into build/davsync.nzip, smoke-tested by name, and released on a version tag: uploaded as a release file, attested as published, and listed as davsync. The lockfile is committed so CI installs with npm ci.