@mannyc1/ts-release 0.0.7 → 0.2.2

package/apps/ts-release-agents/skills/release/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: release
+description: Operate ts-release through its automatic inspect, prepare, publish, release, and correction APIs.
+---
+
+# ts-release release skill
+
+Use the installed package and repository evidence as the authority. Read the
+workspace package manifest and release configuration before suggesting edits.
+
+## Lifecycle
+
+- `inspect` reports authored configuration or an existing prepared bundle.
+- `prepare` observes a clean source tree, runs only declared native
+  preparations, and stores exact `prepared-release/v1` bytes plus blobs.
+- `publish` accepts only that prepared bundle and observes each destination
+  before and after provider mutation.
+- `release` is the normal automatic path: it composes preparation and
+  publication in one process.
+- `correct` consumes a prepared bundle and one canonical provider-specific
+  correction intent.
+
+The derived graph is ephemeral. Exact prepared bytes are the cross-process
+boundary. Never invent a second authority format, generic rollback, provider
+hook, or host review protocol.
+
+## Safety
+
+Read the local schema before writing configuration. Keep paths relative and
+contained. Credentials are environment names or Action inputs, never secret
+values. Treat conflicts and inconclusive destination observations as blocked;
+do not retry an unknown remote mutation blindly. Report typed errors and the
+exact prepared bundle path.
+
+## CLI
+
+```sh
+ts-release inspect --config release.config.json
+ts-release prepare --config release.config.json
+ts-release publish .release/ts-release/prepared/<manifest-digest>
+ts-release release --config release.config.json
+ts-release correct <prepared-bundle> <correction-intent.json>
+```
+
+Read `references/configuration.md`, `references/recovery.md`, and
+`references/verification.md` when the task needs those details. A release
+host may add review or environment protection outside the engine; do not place
+that policy into configuration or prepared bytes.

package/apps/ts-release-agents/skills/release/references/configuration.md

@@ -0,0 +1,18 @@
+# Configuration
+
+The authored JSON shape is validated strictly. Unknown keys, absolute paths,
+parent traversal, non-JSON values, and raw secret values are rejected.
+
+Minimal configuration:
+
+```json
+{
+  "project": { "name": "my-tool", "version": "1.2.3", "tag": "v1.2.3" },
+  "artifacts": [{ "id": "cli", "path": "dist/cli", "format": "executable" }]
+}
+```
+
+Use `builds` for Bun or configured native builders, `preparations` for typed
+native command artifacts, `archives` and `checksum` for local outputs, and
+`publish.npm` or `publish.github` for provider subjects. A preparation declares
+every output and its argv; it is trusted local code, not a sandbox.

package/apps/ts-release-agents/skills/release/references/recovery.md

@@ -0,0 +1,10 @@
+# Recovery
+
+The prepared bundle is the recovery boundary. Re-run `publish` with the same
+bundle; it does not rebuild or reinterpret authored configuration. A lost
+provider response is resolved only by observing the destination again.
+
+Conflicts and inconclusive observations remain blocked. If a provider-specific
+correction is needed, create a canonical correction intent bound to the bundle
+digest and run `correct`. Corrections move forward through provider semantics;
+they are not generic rollback.

package/apps/ts-release-agents/skills/release/references/staged-workflow.md

@@ -0,0 +1,12 @@
+# Prepared workflow
+
+The normal workflow is:
+
+```text
+inspect → prepare → publish
+```
+
+`release` composes the last two steps automatically. Use `prepare` followed by
+`publish` when a host deliberately transfers exact prepared bytes between
+processes. The host may insert its own review or environment gate between those
+steps without changing the bundle or adding a second lifecycle protocol.

package/apps/ts-release-agents/skills/release/references/target-selection.md

@@ -0,0 +1,13 @@
+# Target selection
+
+Choose only configuration supported by the installed schema:
+
+- Bun-compiled executables use `builds[]` with `builder: "bun"`.
+- Imported files use `artifacts[]`; archives and checksums are local
+  preparations.
+- npm and GitHub Releases use their typed publication sections.
+- Homebrew, Scoop, and generic catalog files are rendered as managed local
+  bytes; repository delivery requires its typed transport.
+- Unsupported provider correction is reported as an explicit typed outcome.
+
+Do not invent profiles, custom providers, hooks, or marketplace submissions.

package/apps/ts-release-agents/skills/release/references/verification.md

@@ -0,0 +1,14 @@
+# Verification
+
+Inside the ts-release repository run:
+
+```sh
+bun run check
+bun test
+bun run check:portable
+bun run check:agents
+```
+
+For a prepared boundary, inspect the bundle and verify that publication uses
+the exact directory returned by `prepare`. Do not claim a provider write unless
+the destination observation proves it.

package/apps/ts-release-agents/src/build.ts

@@ -0,0 +1,105 @@
+import { mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"
+import { dirname, join, resolve } from "node:path"
+import { fileURLToPath } from "node:url"
+
+type ArchiveEntry = { readonly path: string, readonly data: Uint8Array, readonly mode: number }
+const encoder = new TextEncoder()
+const text = (value: string): Uint8Array => encoder.encode(value)
+const concat = (parts: ReadonlyArray<Uint8Array>): Uint8Array => {
+  const result = new Uint8Array(parts.reduce((size, part) => size + part.length, 0))
+  let offset = 0
+  for (const part of parts) { result.set(part, offset); offset += part.length }
+  return result
+}
+const integer = (bytes: number, value: number): Uint8Array => {
+  const result = new Uint8Array(bytes)
+  const view = new DataView(result.buffer)
+  if (bytes === 2) view.setUint16(0, value, true)
+  else view.setUint32(0, value, true)
+  return result
+}
+const crcTable = Array.from({ length: 256 }, (_, value) => {
+  let crc = value
+  for (let bit = 0; bit < 8; bit += 1) crc = (crc & 1) === 1 ? 0xedb88320 ^ (crc >>> 1) : crc >>> 1
+  return crc >>> 0
+})
+const crc32 = (data: Uint8Array): number => {
+  let crc = 0xffffffff
+  for (const byte of data) crc = (crc >>> 8) ^ crcTable[(crc ^ byte) & 0xff]!
+  return (crc ^ 0xffffffff) >>> 0
+}
+const zip = (entries: ReadonlyArray<ArchiveEntry>): Uint8Array => {
+  const bodies: Uint8Array[] = [], central: Uint8Array[] = []
+  let offset = 0
+  for (const entry of [...entries].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0)) {
+    const name = text(entry.path), crc = crc32(entry.data)
+    const local = concat([integer(4, 0x04034b50), integer(2, 20), integer(2, 0x0800), integer(2, 0), integer(2, 0), integer(2, 0), integer(4, crc), integer(4, entry.data.length), integer(4, entry.data.length), integer(2, name.length), integer(2, 0), name])
+    bodies.push(local, entry.data)
+    central.push(concat([integer(4, 0x02014b50), integer(2, 0x0314), integer(2, 20), integer(2, 0x0800), integer(2, 0), integer(2, 0), integer(2, 0), integer(4, crc), integer(4, entry.data.length), integer(4, entry.data.length), integer(2, name.length), integer(2, 0), integer(2, 0), integer(2, 0), integer(2, 0), integer(4, entry.mode << 16), integer(4, offset), name]))
+    offset += local.length + entry.data.length
+  }
+  const directory = concat(central)
+  return concat([...bodies, directory, integer(4, 0x06054b50), integer(2, 0), integer(2, 0), integer(2, entries.length), integer(2, entries.length), integer(4, directory.length), integer(4, offset), integer(2, 0)])
+}
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "../../..")
+const app = join(root, "apps", "ts-release-agents")
+const output = join(root, ".release", "agents")
+const version = (): string => {
+  const value = JSON.parse(readFileSync(join(root, "package.json"), "utf8")) as { version?: unknown }
+  if (typeof value.version !== "string" || value.version.length === 0) throw new Error("Root package version is missing.")
+  return value.version
+}
+const write = (path: string, contents: string | Uint8Array): void => {
+  mkdirSync(dirname(path), { recursive: true, mode: 0o755 })
+  writeFileSync(path, contents, { mode: 0o644 })
+}
+const copyTree = (source: string, target: string, entries: ReadonlyArray<string>): void => {
+  for (const entry of entries) write(join(target, entry), readFileSync(join(source, entry)))
+}
+const filesUnder = (directory: string): string[] => readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+  const path = join(directory, entry.name)
+  return entry.isDirectory() ? filesUnder(path).map((child) => join(entry.name, child)) : [entry.name]
+})
+const generatedManifest = (provider: "codex" | "claude", packageVersion: string): Record<string, unknown> => {
+  const authored = JSON.parse(readFileSync(join(app, "manifests", `${provider}.json`), "utf8")) as Record<string, unknown>
+  return provider === "codex"
+    ? { ...authored, version: packageVersion }
+    : { ...authored, version: packageVersion, author: { name: "mannyc2", url: "https://github.com/mannyc2/ts-release" }, repository: "https://github.com/mannyc2/ts-release" }
+}
+const packageFiles = (provider: "codex" | "claude", packageRoot: string, packageVersion: string): void => {
+  const native = provider === "codex" ? ".codex-plugin" : ".claude-plugin"
+  write(join(packageRoot, native, "plugin.json"), `${JSON.stringify(generatedManifest(provider, packageVersion), null, 2)}\n`)
+  write(join(packageRoot, "README.md"), readFileSync(join(app, "README.md")))
+  write(join(packageRoot, "LICENSE"), readFileSync(join(app, "LICENSE")))
+  write(join(packageRoot, "evals", "cases.json"), readFileSync(join(app, "evals", "cases.json")))
+  copyTree(join(app, "skills"), join(packageRoot, "skills"), filesUnder(join(app, "skills")))
+}
+
+export interface BuildAgentsOptions {
+  /** Release preparation captures archives only; standalone checks retain installable layouts. */
+  readonly archivesOnly?: true
+}
+
+export const buildAgents = (options: BuildAgentsOptions = {}): ReadonlyArray<string> => {
+  const packageVersion = version()
+  rmSync(output, { recursive: true, force: true })
+  const created: string[] = []
+  for (const provider of ["codex", "claude"] as const) {
+    const packageRoot = join(output, provider, "ts-release")
+    packageFiles(provider, packageRoot, packageVersion)
+    const entries = filesUnder(packageRoot).map((path): ArchiveEntry => ({
+      path: join("ts-release", path).replaceAll("\\", "/"), data: new Uint8Array(readFileSync(join(packageRoot, path))), mode: 0o100644
+    }))
+    const archive = join(output, "archives", `ts-release-${provider}.zip`)
+    write(archive, zip(entries))
+    created.push(archive)
+    if (options.archivesOnly === true) rmSync(join(output, provider), { recursive: true, force: true })
+  }
+  return created
+}
+
+if (import.meta.main) {
+  const archivesOnly = process.argv.slice(2).includes("--archives-only")
+  for (const path of buildAgents(archivesOnly ? { archivesOnly: true } : {})) console.log(path.slice(root.length + 1))
+}

package/apps/ts-release-agents/src/check.ts

@@ -0,0 +1,117 @@
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync } from "node:fs"
+import { dirname, join, relative, resolve } from "node:path"
+import { tmpdir } from "node:os"
+import { fileURLToPath } from "node:url"
+import { spawnSync } from "node:child_process"
+import { buildAgents } from "./build.js"
+import { installAgentArchive } from "./install.js"
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "../../..")
+const output = join(root, ".release", "agents")
+const app = join(root, "apps", "ts-release-agents")
+const fail = (reason: string): never => { throw new Error(reason) }
+const bytes = (path: string): Uint8Array => new Uint8Array(readFileSync(path))
+const same = (left: Uint8Array, right: Uint8Array): boolean => left.length === right.length && left.every((byte, index) => byte === right[index])
+const json = (path: string): Record<string, unknown> => {
+  const value: unknown = JSON.parse(readFileSync(path, "utf8"))
+  if (typeof value !== "object" || value === null || Array.isArray(value)) fail(`${path} must be an object.`)
+  return value as Record<string, unknown>
+}
+const rootVersion = String((json(join(root, "package.json")).version ?? ""))
+const generatedFiles = (directory: string): string[] => readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+  const path = join(directory, entry.name)
+  return entry.isDirectory() ? generatedFiles(path) : [path]
+})
+const containsFiles = (directory: string): boolean => readdirSync(directory, { withFileTypes: true }).some((entry) => {
+  return entry.isDirectory() ? containsFiles(join(directory, entry.name)) : true
+})
+
+const firstPaths = buildAgents()
+const first = firstPaths.map((path) => bytes(path))
+const secondPaths = buildAgents()
+const second = secondPaths.map((path) => bytes(path))
+if (first.length !== second.length || first.some((value, index) => !same(value, second[index]!))) fail("Agent archives are not deterministic.")
+for (const provider of ["codex", "claude"] as const) {
+  const packageRoot = join(output, provider, "ts-release")
+  const manifestPath = join(packageRoot, provider === "codex" ? ".codex-plugin" : ".claude-plugin", "plugin.json")
+  if (!existsSync(manifestPath)) fail(`Generated ${provider} manifest is missing.`)
+  if (json(manifestPath).version !== rootVersion) fail(`Generated ${provider} manifest version diverges from the root package.`)
+  if (!existsSync(join(packageRoot, "skills", "release", "SKILL.md"))) fail(`Generated ${provider} skill is missing.`)
+}
+const codex = json(join(output, "codex", "ts-release", ".codex-plugin", "plugin.json"))
+if (codex.skills !== "./skills/") fail("Codex manifest must point to ./skills/.")
+const evals = json(join(app, "evals", "cases.json"))
+if (!Array.isArray(evals.cases) || evals.cases.length < 6) fail("Agent eval coverage is incomplete.")
+for (const path of generatedFiles(join(output, "codex", "ts-release"))) {
+  const text = readFileSync(path, "utf8")
+  if (/npm_[A-Z0-9_]{6,}/u.test(text)) fail(`Generated agent content resembles a raw secret: ${path}`)
+  if (text.includes("../")) fail(`Generated agent content contains parent traversal: ${path}`)
+}
+for (const forbidden of [".agents", ".claude-plugin", ".codex-plugin", "ts-release-plugin"]) {
+  if (existsSync(join(root, forbidden)) && containsFiles(join(root, forbidden))) fail(`Obsolete root agent owner remains: ${forbidden}`)
+}
+for (const path of ["SKILL.md", join("skills", "release", "SKILL.md")]) {
+  if (existsSync(join(root, path))) fail(`Root canonical agent owner remains: ${path}`)
+}
+const tracked = spawnSync("git", ["ls-files", "-z"], { cwd: root, encoding: "utf8", stdio: "pipe" })
+if (tracked.status !== 0) fail(`Could not inspect tracked agent owners: ${tracked.stderr.trim() || tracked.stdout.trim()}`)
+const trackedFiles = tracked.stdout.split("\0").filter((path) => path.length > 0)
+const canonicalRootOwners = trackedFiles.filter((path) =>
+  path === ".codex-plugin/plugin.json" ||
+  path === ".claude-plugin/plugin.json" ||
+  path === "skills/release/SKILL.md" ||
+  path === "SKILL.md" ||
+  path.startsWith("ts-release-plugin/"))
+if (canonicalRootOwners.length !== 0) fail(`Tracked root canonical agent owners remain: ${canonicalRootOwners.join(", ")}`)
+const skillOwners = trackedFiles.filter((path) => path.endsWith("/skills/release/SKILL.md"))
+if (skillOwners.length !== 1 || skillOwners[0] !== "apps/ts-release-agents/skills/release/SKILL.md") {
+  fail(`Agent skill source ownership diverged: ${skillOwners.join(", ") || "none"}`)
+}
+
+const disposableRoot = mkdtempSync(join(tmpdir(), "ts-release-agent-installs-"))
+let installed = 0
+const providerLayouts: string[] = []
+try {
+  for (const provider of ["codex", "claude"] as const) {
+    const archive = secondPaths.find((path) => path.endsWith(`ts-release-${provider}.zip`)) ??
+      fail(`Generated ${provider} archive is missing.`)
+    const installation = installAgentArchive(provider, archive, disposableRoot)
+    const native = provider === "codex" ? ".codex-plugin" : ".claude-plugin"
+    const manifest = join(installation.packageRoot, native, "plugin.json")
+    if (!existsSync(manifest)) fail(`Installed ${provider} native manifest is missing.`)
+    if (!existsSync(join(installation.packageRoot, "skills", "release", "SKILL.md"))) {
+      fail(`Installed ${provider} skill is missing.`)
+    }
+    if (provider === "codex" && json(manifest).skills !== "./skills/") {
+      fail("Installed Codex manifest must point to ./skills/.")
+    }
+    if (provider === "claude") {
+      const validated = spawnSync("claude", ["plugin", "validate", "--strict", installation.packageRoot], {
+        encoding: "utf8",
+        env: {
+          ...process.env,
+          CLAUDE_CONFIG_DIR: join(disposableRoot, ".claude")
+        },
+        stdio: "pipe"
+      })
+      if (validated.status !== 0) {
+        fail(`Installed Claude plugin validator failed: ${validated.stderr.trim() || validated.stdout.trim()}`)
+      }
+    }
+    providerLayouts.push(relative(disposableRoot, installation.packageRoot).replaceAll("\\", "/"))
+    installed += 1
+  }
+} finally {
+  rmSync(disposableRoot, { recursive: true, force: true })
+}
+
+console.log(JSON.stringify({
+  schemaVersion: "ts-release-agents-check/v2",
+  providers: 2,
+  archives: second.length,
+  disposableInstalls: installed,
+  providerLayouts,
+  claudeValidation: "strict",
+  rootCanonicalOwners: canonicalRootOwners.length,
+  status: "ready"
+}))

package/apps/ts-release-agents/src/install.ts

@@ -0,0 +1,121 @@
+import {
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  renameSync,
+  rmSync
+} from "node:fs"
+import { join, sep } from "node:path"
+import { spawnSync } from "node:child_process"
+
+export type AgentProvider = "codex" | "claude"
+
+export interface InstalledAgentArchive {
+  readonly provider: AgentProvider
+  /** Disposable stand-in for the user's home directory. */
+  readonly userRoot: string
+  /** Provider-native cache owner below the disposable user root. */
+  readonly providerRoot: string
+  readonly packageRoot: string
+  readonly version: string
+  readonly entries: ReadonlyArray<string>
+}
+
+const fail = (reason: string): never => { throw new Error(reason) }
+
+const archiveEntries = (archive: string): ReadonlyArray<string> => {
+  const listed = spawnSync("unzip", ["-Z1", archive], { encoding: "utf8", stdio: "pipe" })
+  if (listed.status !== 0) {
+    fail(`Could not inspect agent archive ${archive}: ${listed.stderr.trim() || listed.stdout.trim()}`)
+  }
+  const entries = listed.stdout.split("\n").filter((entry) => entry.length > 0)
+  if (entries.length === 0) fail(`Agent archive ${archive} is empty.`)
+  if (new Set(entries).size !== entries.length) fail(`Agent archive ${archive} contains duplicate paths.`)
+  for (const entry of entries) {
+    const segments = entry.split("/")
+    if (
+      !entry.startsWith("ts-release/") ||
+      entry.startsWith("/") ||
+      entry.includes("\\") ||
+      entry.includes("\0") ||
+      segments.some((segment) => segment === "" || segment === "." || segment === "..")
+    ) fail(`Agent archive ${archive} contains unsafe path ${JSON.stringify(entry)}.`)
+  }
+  return entries
+}
+
+const verifyContainedTree = (directory: string): void => {
+  const root = realpathSync(directory)
+  const prefix = `${root}${sep}`
+  const visit = (current: string): void => {
+    for (const entry of readdirSync(current)) {
+      const path = join(current, entry)
+      const status = lstatSync(path)
+      if (status.isSymbolicLink()) fail(`Installed agent package contains a symlink: ${path}`)
+      if (!status.isDirectory() && !status.isFile()) fail(`Installed agent package contains a special file: ${path}`)
+      const canonical = realpathSync(path)
+      if (canonical !== root && !canonical.startsWith(prefix)) fail(`Installed agent path escapes its package: ${path}`)
+      if (status.isDirectory()) visit(path)
+    }
+  }
+  visit(directory)
+}
+
+/**
+ * Installs one generated archive into a disposable provider-owned plugin
+ * directory. This performs local ZIP inspection and extraction only.
+ */
+export const installAgentArchive = (
+  provider: AgentProvider,
+  archive: string,
+  userRoot: string
+): InstalledAgentArchive => {
+  const entries = archiveEntries(archive)
+  mkdirSync(userRoot, { recursive: true, mode: 0o700 })
+  const stage = mkdtempSync(join(userRoot, `.ts-release-${provider}-stage-`))
+  try {
+    const extracted = spawnSync("unzip", ["-qq", archive, "-d", stage], {
+      encoding: "utf8",
+      stdio: "pipe"
+    })
+    if (extracted.status !== 0) {
+      fail(`Could not install ${provider} agent archive: ${extracted.stderr.trim() || extracted.stdout.trim()}`)
+    }
+    const stagedPackage = join(stage, "ts-release")
+    if (!existsSync(stagedPackage) || !lstatSync(stagedPackage).isDirectory()) {
+      fail(`Installed ${provider} package root is missing.`)
+    }
+    verifyContainedTree(stagedPackage)
+    const native = provider === "codex" ? ".codex-plugin" : ".claude-plugin"
+    const manifestPath = join(stagedPackage, native, "plugin.json")
+    if (!existsSync(manifestPath)) fail(`Installed ${provider} native manifest is missing.`)
+    const manifest: unknown = JSON.parse(readFileSync(manifestPath, "utf8"))
+    const version = typeof manifest === "object" && manifest !== null &&
+        "version" in manifest && typeof manifest.version === "string"
+      ? manifest.version
+      : fail(`Installed ${provider} native manifest version is missing.`)
+    if (!/^[0-9A-Za-z][0-9A-Za-z._+-]*$/u.test(version)) {
+      fail(`Installed ${provider} native manifest version is not a safe cache key.`)
+    }
+    const providerRoot = join(
+      userRoot,
+      provider === "codex" ? ".codex" : ".claude",
+      "plugins",
+      "cache",
+      "local-archive",
+      "ts-release"
+    )
+    const packageRoot = join(providerRoot, version)
+    if (existsSync(packageRoot)) fail(`Disposable ${provider} package root already exists: ${packageRoot}`)
+    mkdirSync(providerRoot, { recursive: true, mode: 0o700 })
+    renameSync(stagedPackage, packageRoot)
+    verifyContainedTree(packageRoot)
+    return { provider, userRoot, providerRoot, packageRoot, version, entries }
+  } finally {
+    rmSync(stage, { recursive: true, force: true })
+  }
+}

package/apps/ts-release-agents/test/contract.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, test } from "bun:test"
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs"
+import { join } from "node:path"
+import { tmpdir } from "node:os"
+import { buildAgents } from "../src/build.js"
+import { installAgentArchive } from "../src/install.js"
+
+const root = process.cwd()
+const equal = (left: Uint8Array, right: Uint8Array): boolean => left.length === right.length && left.every((byte, index) => byte === right[index])
+
+describe("agent distribution contract", () => {
+  test("two identical projections are byte-identical", () => {
+    const first = buildAgents().map((path) => new Uint8Array(readFileSync(path)))
+    const second = buildAgents().map((path) => new Uint8Array(readFileSync(path)))
+    expect(first.length).toBe(2)
+    expect(first.every((value, index) => equal(value, second[index]!))).toBe(true)
+  })
+
+  test("provider-native generated layouts are contained and versioned", () => {
+    for (const provider of ["codex", "claude"]) {
+      const native = provider === "codex" ? ".codex-plugin" : ".claude-plugin"
+      const manifest = join(root, ".release", "agents", provider, "ts-release", native, "plugin.json")
+      expect(existsSync(manifest)).toBe(true)
+      expect(JSON.parse(readFileSync(manifest, "utf8")).version).toBe("0.2.2")
+    }
+  })
+
+  test("archives install into disposable provider-owned layouts", () => {
+    const archives = buildAgents({ archivesOnly: true })
+    expect(existsSync(join(root, ".release", "agents", "codex"))).toBe(false)
+    expect(existsSync(join(root, ".release", "agents", "claude"))).toBe(false)
+    const disposableRoot = mkdtempSync(join(tmpdir(), "ts-release-agent-contract-"))
+    try {
+      for (const provider of ["codex", "claude"] as const) {
+        const archive = archives.find((path) => path.endsWith(`ts-release-${provider}.zip`))
+        expect(archive).toBeDefined()
+        const installed = installAgentArchive(provider, archive!, disposableRoot)
+        expect(installed.providerRoot).toBe(join(
+          disposableRoot,
+          provider === "codex" ? ".codex" : ".claude",
+          "plugins",
+          "cache",
+          "local-archive",
+          "ts-release"
+        ))
+        expect(installed.version).toBe("0.2.2")
+        expect(installed.packageRoot).toBe(join(installed.providerRoot, installed.version))
+        expect(existsSync(join(installed.packageRoot, provider === "codex" ? ".codex-plugin" : ".claude-plugin", "plugin.json"))).toBe(true)
+        expect(existsSync(join(installed.packageRoot, "skills", "release", "SKILL.md"))).toBe(true)
+        expect(installed.entries.every((entry) => entry.startsWith("ts-release/"))).toBe(true)
+      }
+    } finally {
+      rmSync(disposableRoot, { recursive: true, force: true })
+    }
+  })
+})

package/apps/ts-release-agents/tsconfig.json

@@ -0,0 +1,5 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": { "noEmit": true },
+  "include": ["src/**/*.ts", "test/**/*.ts"]
+}

package/dist/api/api.d.ts

@@ -0,0 +1,15 @@
+import type { CompletePreparedReleaseRef } from "../release/prepared-ref.js";
+import { CorrectionReport, type CorrectInput, type InspectInput, type ObserveInput, type PrepareInput, type PublishInput, type ReleaseApi, type ReleaseApiLayer, type ReleaseApiOptions, type ReleaseInput } from "./types.js";
+export type { CorrectInput, InspectInput, ObserveInput, PrepareInput, PublishInput, ReleaseApi, ReleaseApiLayer, ReleaseApiOptions, ReleaseInput } from "./types.js";
+export { CorrectionReport } from "./types.js";
+export { ReleaseInputError } from "./errors.js";
+export { ReleaseRuntime } from "./runtime.js";
+export declare const makeReleaseApi: (layer: ReleaseApiLayer, options?: ReleaseApiOptions) => ReleaseApi;
+export declare const makeDefaultReleaseApi: (layer: ReleaseApiLayer) => ReleaseApi;
+export declare const inspect: (input: InspectInput) => Promise<import("./types.js").InspectOutput>;
+export declare const prepare: (input: PrepareInput) => Promise<CompletePreparedReleaseRef>;
+export declare const observe: (input: ObserveInput) => Promise<import("../publication/report.js").ObservationReport>;
+export declare const publish: (input: PublishInput) => Promise<import("../publication/report.js").ReleaseReport>;
+export declare const release: (input: ReleaseInput) => Promise<import("./types.js").ReleaseResult>;
+export declare const correct: (input: CorrectInput) => Promise<CorrectionReport>;
+//# sourceMappingURL=api.d.ts.map

package/dist/api/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/api/api.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AAsB5E,OAAO,EACL,gBAAgB,EAChB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,EAEtB,KAAK,YAAY,EAClB,MAAM,YAAY,CAAA;AAEnB,YAAY,EACV,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,YAAY,EACb,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAmO7C,eAAO,MAAM,cAAc,GAAI,OAAO,eAAe,EAAE,UAAS,iBAAsB,KAAG,UAwDxF,CAAA;AAED,eAAO,MAAM,qBAAqB,GAAI,OAAO,eAAe,KAAG,UACxC,CAAA;AAIvB,eAAO,MAAM,OAAO,sEAAqB,CAAA;AACzC,eAAO,MAAM,OAAO,8DAAqB,CAAA;AACzC,eAAO,MAAM,OAAO,wFAAqB,CAAA;AACzC,eAAO,MAAM,OAAO,oFAAqB,CAAA;AACzC,eAAO,MAAM,OAAO,sEAAqB,CAAA;AACzC,eAAO,MAAM,OAAO,oDAAqB,CAAA"}