fix(coding-agent): reduce npm dependency downloads

docs/release/artifact-acceptance.md

@@ -7,7 +7,11 @@ npm and Bun start with an empty registry cache shared only among consumers in th
 pnpm consumers use isolated stores, homes, configuration and global executable directories; no user store or credentials are inherited.
 Installed file identities are rechecked in every consumer even when downloaded dependencies are cached.
 Lifecycle scripts are disabled and the Diffex registry scope points to an unavailable loopback endpoint, so a missing local override fails instead of fetching an older Diffex package.
-External npm dependencies still resolve from the public registry.
+External npm dependencies still resolve from the public registry, except for the reviewed Mistral provider bundle.
+Only that provider implementation absorbs its required pure-JavaScript SDK code; other implementation paths, declarations, lazy loading, extensions, native bindings and WASM remain unchanged.
+Bundling checks exact approved npm versions/licenses, records input hashes and registry integrity, preserves complete license/NOTICE text, and rehashes the final staged runtime inventory.
+New unresolved dependency references, location-sensitive inputs, unreviewed dynamic imports, missing legal documents or unexpected bundle output fail packaging.
+A mock-fetch regression exercises Mistral streaming, request options, errors and cancellation without live provider credentials.
 
 Declared runtime exports, wildcard exports, declarations, main files, and executable targets must exist inside the installed package.
 Runtime imports and representative operations execute in fresh Node processes.

docs/release/distribution-policy.json

@@ -36,8 +36,17 @@
     "runtime theme and model JSON",
     "SQLite migration SQL",
     "user-facing documentation explicitly listed in scripts/distribution-docs.json",
-    "Diffex-owned TUI native prebuilds using system APIs"
+    "Diffex-owned TUI native prebuilds using system APIs",
+    "reviewed external pure JavaScript bundled only into the Mistral provider implementation, with exact npm input identities and complete license/NOTICE attribution"
   ],
+  "bundledNpmDependencies": {
+    "@mistralai/mistralai": {
+      "@mistralai/mistralai": { "version": "3.2.0", "license": "Apache-2.0" },
+      "zod": { "version": "4.6.6", "license": "MIT" },
+      "zod-to-json-schema": { "version": "3.25.2", "license": "ISC" },
+      "@opentelemetry/semantic-conventions": { "version": "1.41.1", "license": "Apache-2.0" }
+    }
+  },
   "publicHosting": "npmjs",
   "publicRegistry": "https://registry.npmjs.org",
   "immutableTarballUrl": "https://registry.npmjs.org/<PACKAGE>/-/<UNSCOPED_NAME>-<VERSION>.tgz",

packages/coding-agent/CHANGELOG.md

@@ -6,6 +6,8 @@
 
 - Added a compact terminal activity display for npm and pnpm self-updates, while preserving package-manager warnings, failure diagnostics, and redirected logs.
 - Added pnpm installation, upgrade, integrity, and removal coverage to release acceptance alongside npm and Bun.
+- Bundle the Mistral provider's required JavaScript into npm releases, reducing the external lockfile from 228 to 140 package entries while preserving provider behavior, optional tracing integrations, and complete dependency license attribution.
+- Expanded the published npm README with requirements, npm/pnpm commands, verification, login, and update instructions.
 
 ### Fixed