build: gate releases on attw + declaration-import check; manifest hygiene for agent-bundle, rsc-markdown-stream, create-agent-bundle (#566 §2)

.changeset/README.md

@@ -87,7 +87,12 @@ because they change no publishable package.
 
 - `agent-bundle` and `@agent-bundle/runtime` version **independently**
   (`fixed` and `linked` are empty). `agent-bundle` declares
-  `@agent-bundle/runtime` as an *optional* peer with range `*`, and
+  `@agent-bundle/runtime` as an *optional* peer with range `>=0.0.0 <1`: the
+  lower bound is the first runtime version that ships every subpath the
+  generated code imports (`mount`, `notices`, `notices/inbox-route`, `state`,
+  `state/sqlite`, `flight/server`, `lineage`), so a changeset that adds a
+  runtime subpath the compiler emits must also raise that bound; the upper
+  bound keeps a future `1.x` runtime from satisfying a `0.x` compiler.
   `@agent-bundle/runtime` does not depend on `agent-bundle`, so neither
   package needs to move when the other does. Preview tarballs pin the peer to
   the same commit (`docs/preview-packages.md`), which is a preview concern,

.changeset/pack-validation.md

@@ -0,0 +1,7 @@
+---
+"agent-bundle": patch
+"rsc-markdown-stream": patch
+"create-agent-bundle": minor
+---
+
+Expose `./package.json` in the `exports` of `agent-bundle`, `rsc-markdown-stream`, and `create-agent-bundle`. `create-agent-bundle` gains its first `exports` map, so `create-agent-bundle/dist/**` deep imports no longer resolve — the CLI is reachable only through its `bin`, which is the breaking change behind its minor bump. Bound `agent-bundle`'s optional `@agent-bundle/runtime` peer to `>=0.0.0 <1` instead of `*`; drop `@modelcontextprotocol/server` from `agent-bundle`'s devDependencies (it stays a dependency) and the dead `!dist/workbench/**/*.map` entry from its `files`; gate releases on `attw --profile esm-only` for all three packed tarballs plus `scripts/check-declaration-imports.mjs`, which fails `pnpm lint:release` when a shipped `.d.ts` a consumer can reach imports a devDependency, an undeclared package, an unexported subpath of the package itself, or a `#` import its `imports` map does not resolve. (#568)

package.json

@@ -48,7 +48,7 @@
     "release": "pnpm check:release && changeset publish",
     "preview:publish": "pkg-pr-new publish --previewVersion --peerDeps --no-compact --no-template './packages/agent-bundle' './packages/rsc-runtime' './packages/rsc-markdown-stream' './packages/create-agent-bundle'",
     "pack:dry-run": "pnpm build && npm pack ./packages/agent-bundle --dry-run --json",
-    "lint:release": "attw --pack --profile esm-only packages/agent-bundle",
+    "lint:release": "attw --pack --profile esm-only packages/agent-bundle && attw --pack --profile esm-only packages/rsc-markdown-stream && attw --pack --profile esm-only packages/create-agent-bundle && node scripts/check-declaration-imports.mjs packages/agent-bundle packages/rsc-markdown-stream packages/create-agent-bundle",
     "check:release": "pnpm pack:dry-run && pnpm lint:release && pnpm test:packed:release",
     "check:release:ci": "pnpm pack:dry-run && pnpm lint:release && pnpm test:packed",
     "example:hooks": "pnpm build && pnpm --filter @agent-bundle-example/hooks-and-scripts dev",

packages/agent-bundle/package.json

@@ -31,7 +31,6 @@
   "files": [
     "bin",
     "dist",
-    "!dist/workbench/**/*.map",
     "LICENSE",
     "NOTICE",
     "README.md"
@@ -91,7 +90,8 @@
     "./test/browser": {
       "types": "./dist/test/browser.d.ts",
       "import": "./dist/test/browser.js"
-    }
+    },
+    "./package.json": "./package.json"
   },
   "dependencies": {
     "@effect/platform-node-shared": "4.0.0-rc.112",
@@ -119,7 +119,6 @@
     "yaml": "2.9.0"
   },
   "devDependencies": {
-    "@modelcontextprotocol/server": "2.0.0",
     "@types/npm-package-arg": "6.1.4",
     "@types/react": "19.2.18",
     "@types/ws": "8.18.1",
@@ -129,7 +128,7 @@
     "zod": "4.5.4"
   },
   "peerDependencies": {
-    "@agent-bundle/runtime": "*",
+    "@agent-bundle/runtime": ">=0.0.0 <1",
     "@rstest/core": "^0.11.10",
     "react": "19.2.8"
   },

packages/agent-bundle/rslib.config.ts

@@ -47,6 +47,14 @@ export default defineConfig({
   lib: [
     {
       bundle: true,
+      // One `.d.ts` per source module. Bundling them per entry
+      // (`dts: { bundle: true }`, API Extractor) was measured and rejected:
+      // it fails inside a devDependency's `.d.cts` (zod), takes ~6x longer,
+      // emits ~30% more bytes by inlining shared types into every entry, and
+      // renames colliding public names (`AgentBundleConfig_2`). What keeps
+      // the shipped declarations honest instead is the release gate
+      // (scripts/check-declaration-imports.mjs via `pnpm lint:release`): no
+      // declaration a consumer can reach may import a devDependency.
       dts: true,
       format: 'esm',
       syntax: 'es2022',