[notme-18450e] feat(dpop): publish @agentic-research/dpop to GitHub Packages

[jamestexas]

Makes the extracted SDK actually consumable — the step that lets cloister and canonical-hours delete their vendored byte-copies (cloister-195e47).

Registry choice

GitHub Packages requires the npm scope to match the org, so this is @agentic-research/dpop, not @notme/dpop.

One thing worth knowing before anyone external tries to use it: unlike npmjs.org, GitHub Packages requires authentication to install even public packages. GITHUB_TOKEN covers same-org Actions; everyone else needs a read:packages PAT. Moving to npmjs.org later is a rename plus a registry swap — the tradeoff is recorded in the workflow header rather than left to be rediscovered.

Packaging fix

The package pointed main/exports at raw src/index.ts. That's fine for workspace:* and wrong for a published artifact — consumers would have to transpile a dependency, and there were no type declarations at all.

It now builds to dist/ (JS + .d.ts + sourcemaps) via tsc, and publishConfig rewrites the entry points at pack time:

• workspace consumers keep resolving to src — no build needed for dev or test
• the tarball ships dist

Verified by unpacking the actual tarball rather than assuming:

name:     @agentic-research/dpop
main:     ./dist/index.js
types:    ./dist/index.d.ts
exports:  {".":{"types":"./dist/index.d.ts","default":"./dist/index.js"}}

Three as BufferSource casts

TS 5.9 types Uint8Array generic over its buffer, and ArrayBufferLike admits SharedArrayBuffer, so strict declaration emit rejected all three crypto.subtle.verify() signature args. Type-only, no behavior change.

Notable because canonical-hours had already made exactly these three edits downstream to get its vendored copy to compile. Fixing it upstream means that local modification disappears and its copy becomes byte-identical to source.

The workflow

Triggered by a dpop-v* tag. It builds and runs the suite before publishing — an npm version is immutable once it lands — and fails on a tag/package.json version mismatch rather than shipping something whose tag lies about its contents. Actions SHA-pinned per the ci.yml structural guard.

Verification

• packages/dpop — 67 pass
• worker — 339 pass (parity)
• worker tsc --noEmit — clean
• package build — 0 errors
• dist/ gitignored, not committed

To release after merge

git tag dpop-v0.1.0 && git push origin dpop-v0.1.0

🤖 Generated with Claude Code

https://claude.ai/code/session_01UNahXs8dda3vttpWrVwVaA