[dinakarjs]

Problem and change

The packed npm smoke test checks declaration existence but does not compile a TypeScript consumer. Replacing dist/index.d.ts with export {}; still passes all four existing runtime checks.

Compile an isolated strict NodeNext consumer against the installed tarball, including public value/type exports, factory construction, validator narrowing, and expected errors for invalid input/output types. The compiler comes from the existing npm-ci lockfile installation; SDK resolution stays in the temporary consumer, with skipLibCheck disabled and no ambient types from the checkout. Existing CI and release calls to smoke_npm.mjs both gain this check.

Add three CI regression controls that preserve JavaScript and prove declaration compilation rejects empty exports, a missing transitive declaration, and runId widened to any. Each control first verifies all four runtime checks passed. Use explicit TAP output so those assertions work across supported Node versions.

Validation

• Current packed artifact: four runtime checks and strict consumer compilation passed on Node 24.22.1.
• All three damaged-artifact regression controls passed.
• TypeScript build passed; all 44 SDK tests passed with node --import tsx --test test/*.test.ts; npm pack --dry-run passed. The standard npm run check hit this sandbox's EPERM restriction on the tsx CLI IPC socket, so its test phase was rerun through Node directly.
• Three release safeguard tests, workflow OIDC check, and git diff --check passed.

No SDK runtime, schema, dependency lock, or release permission changes. Extends the npm smoke coverage from #79; independent of the Python artifact work in #121. No package published.

DCO

Signed-off-by: Srinivasa Dinakar Jainti dinakarjs@gmail.com

Prepared with OpenAI Codex. Independent maintainer review and hosted CI remain required.

Contract impact

• No wire-contract change.

Privacy and security

• Consumer controls use synthetic identifiers and values; no production data, prompts, source content, or credentials are added.
• Release permissions, dependency locks, SDK behavior, and schemas are unchanged.
• Independent maintainer review remains pending; this self-review is not approval.

Self-review evidence (2026-10-28)

Reviewed head fc2c765ea6510771b292627027b474cf9d87be68 against repository ownership/contribution rules and accumulated AgentTrust guidance on isolated validation, positive/refusal controls, guard-removal tests, DCO, scope and acceptance boundaries.

A fresh detached worktree at this exact head was installed with npm ci, built, and packed. The valid tarball passed four runtime checks and strict consumer compilation; all three damaged-artifact controls passed. Temporarily removing only the compiler invocation made all three controls fail because the damaged packages exited successfully (0 instead of 1). Restored the original source and reran the positive and negative controls; the worktree remains unchanged. Three release safeguard tests, OIDC checks, JavaScript syntax checks and whitespace checks passed.

Hosted checks for this head passed: TypeScript (Node 20.20.2, 44 SDK tests, four artifact runtime checks, consumer compilation and three regression controls), Python 3.10–3.13, CodeQL and actionlint. TypeScript job evidence. The single PR commit carries the contributor's DCO sign-off. No blocking code finding identified.

Limits

This is a sampled ESM/NodeNext consumer check with the lockfile-installed TypeScript compiler, not exhaustive public-API, compiler-version, CommonJS, browser/bundler, or operating-system compatibility certification. The regression harness uses tar on the existing Ubuntu CI runner. Runtime consumer dependencies resolve using their supported ranges, as in the existing smoke test. No release was dispatched, package published, acceptance tracker closed, or maintainer approval asserted.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[dinakarjs]

Closure review request to @rajnisht7 / @carloshvp: #123 (fc2c765) and the related Python installed-distribution #121 (a3ce038) retain successful hosted evidence on their published heads and still need independent maintainer review. Their descriptions record the positive/negative artifact controls and limits; I am not claiming independent approval of my own tests. The separate Collector delivery experiment #100 and delivery-fault draft #99 retain their original evidence boundaries and need their own disposition. No package release or merge is requested as an automatic consequence of these test results. Prepared with OpenAI Codex.