build: verify the published tarball instead of grepping the bundle

.fallowrc.json

@@ -50,7 +50,11 @@
     "yaml",
     // @agent-device/provider-limrun owns the source import, while the published
     // root build externalizes @limrun/api and retains runtime imports in packed chunks.
-    "@limrun/api"
+    "@limrun/api",
+    // Packaging linters with no importable API surface here: scripts/check-package.ts runs their
+    // `node_modules/.bin` shims as subprocesses, which dependency analysis cannot follow to an import.
+    "publint",
+    "@arethetypeswrong/cli"
   ],
   "ignoreExports": [
     {

.github/workflows/ci.yml

@@ -170,29 +170,26 @@ jobs:
       - name: Setup build toolchain
         uses: ./.github/actions/setup-node-pnpm
 
-      - name: Build and pack CLI
+      - name: Build CLI
         run: |
           pnpm build
           pnpm check:bundle-owner-files
-          mkdir -p .tmp/node-compat
-          npm pack --ignore-scripts --pack-destination .tmp/node-compat
 
+      # The build runs on the default toolchain Node and the package is verified on the minimum
+      # supported Node, so this job covers what a user on `engines.node` floor actually installs.
       - name: Setup Node.js 22.12
         uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
           node-version: '22.12'
 
-      - name: Install and run global CLI on Node.js 22.12
-        run: |
-          set -euo pipefail
-          prefix="$RUNNER_TEMP/agent-device-node-22-12"
-          tarball="$(find "$GITHUB_WORKSPACE/.tmp/node-compat" -name 'agent-device-*.tgz' -print -quit)"
-          test -n "$tarball"
-          npm install --global --prefix "$prefix" --ignore-scripts "$tarball"
-          "$prefix/bin/agent-device" --version
-          "$prefix/bin/agent-device" help
-          "$prefix/bin/agent-device" devices --json
-          "$prefix/bin/agent-device" doctor --remote --json
+      # Packs, lints the tarball with publint/attw, installs it outside the workspace, and imports
+      # every published entry point before running the CLI. See scripts/check-package.ts.
+      #
+      # Runs the script directly rather than through `pnpm check:package`: the repo's pinned pnpm
+      # requires Node >= 22.13 and refuses to start on the 22.12 floor this job exists to cover. The
+      # gate itself only needs `node` and `npm`, so it is the package.json script minus the launcher.
+      - name: Verify the published package on Node.js 22.12
+        run: node --experimental-strip-types scripts/check-package.ts
 
   fallow:
     name: Fallow Code Quality

.github/workflows/package-smoke.yml

@@ -8,6 +8,7 @@ on:
       - 'pnpm-workspace.yaml'
       - 'packages/**'
       - 'tsdown.config.ts'
+      - 'scripts/check-package.ts'
       - 'scripts/build-android-helper.sh'
       - 'scripts/build-xcuitest-apple.sh'
       - 'scripts/package-android-helper.sh'
@@ -30,6 +31,7 @@ on:
       - 'pnpm-workspace.yaml'
       - 'packages/**'
       - 'tsdown.config.ts'
+      - 'scripts/check-package.ts'
       - 'scripts/build-android-helper.sh'
       - 'scripts/build-xcuitest-apple.sh'
       - 'scripts/package-android-helper.sh'

package.json

@@ -19,52 +19,52 @@
   "types": "dist/src/index.d.ts",
   "exports": {
     ".": {
-      "import": "./dist/src/index.js",
-      "types": "./dist/src/index.d.ts"
+      "types": "./dist/src/index.d.ts",
+      "import": "./dist/src/index.js"
     },
     "./io": {
-      "import": "./dist/src/io.js",
-      "types": "./dist/src/io.d.ts"
+      "types": "./dist/src/io.d.ts",
+      "import": "./dist/src/io.js"
     },
     "./artifacts": {
-      "import": "./dist/src/artifacts.js",
-      "types": "./dist/src/artifacts.d.ts"
+      "types": "./dist/src/artifacts.d.ts",
+      "import": "./dist/src/artifacts.js"
     },
     "./metro": {
-      "import": "./dist/src/metro.js",
-      "types": "./dist/src/metro.d.ts"
+      "types": "./dist/src/metro.d.ts",
+      "import": "./dist/src/metro.js"
     },
     "./batch": {
-      "import": "./dist/src/batch.js",
-      "types": "./dist/src/batch.d.ts"
+      "types": "./dist/src/batch.d.ts",
+      "import": "./dist/src/batch.js"
     },
     "./remote-config": {
-      "import": "./dist/src/remote-config.js",
-      "types": "./dist/src/remote-config.d.ts"
+      "types": "./dist/src/remote-config.d.ts",
+      "import": "./dist/src/remote-config.js"
     },
     "./install-source": {
-      "import": "./dist/src/install-source.js",
-      "types": "./dist/src/install-source.d.ts"
+      "types": "./dist/src/install-source.d.ts",
+      "import": "./dist/src/install-source.js"
     },
     "./android-adb": {
-      "import": "./dist/src/android-adb.js",
-      "types": "./dist/src/android-adb.d.ts"
+      "types": "./dist/src/android-adb.d.ts",
+      "import": "./dist/src/android-adb.js"
     },
     "./limrun": {
-      "import": "./dist/src/limrun.js",
-      "types": "./dist/src/limrun.d.ts"
+      "types": "./dist/src/limrun.d.ts",
+      "import": "./dist/src/limrun.js"
     },
     "./contracts": {
-      "import": "./dist/src/contracts.js",
-      "types": "./dist/src/contracts.d.ts"
+      "types": "./dist/src/contracts.d.ts",
+      "import": "./dist/src/contracts.js"
     },
     "./selectors": {
-      "import": "./dist/src/selectors.js",
-      "types": "./dist/src/selectors.d.ts"
+      "types": "./dist/src/selectors.d.ts",
+      "import": "./dist/src/selectors.js"
     },
     "./finders": {
-      "import": "./dist/src/finders.js",
-      "types": "./dist/src/finders.d.ts"
+      "types": "./dist/src/finders.d.ts",
+      "import": "./dist/src/finders.js"
     }
   },
   "engines": {
@@ -103,7 +103,7 @@
     "package:android-ime-helper:npm": "rm -rf android/ime-helper/dist && AGENT_DEVICE_ANDROID_HELPER=ime sh ./scripts/package-android-helper.sh $(node -p \"require('./package.json').version\") android/ime-helper/dist",
     "build:macos-helper": "swift build -c release --package-path apple/macos-helper",
     "build:macos-helper:clean": "swift package --package-path apple/macos-helper clean && pnpm build:macos-helper",
-    "package:npm": "pnpm build && pnpm check:bundle-dependencies && pnpm build:xcuitest:ios && pnpm build:xcuitest:macos && pnpm build:xcuitest:tvos && pnpm build:xcuitest:visionos && pnpm build:macos-helper:clean && pnpm package:apple-runner:npm && pnpm build:android",
+    "package:npm": "pnpm build && pnpm build:xcuitest:ios && pnpm build:xcuitest:macos && pnpm build:xcuitest:tvos && pnpm build:xcuitest:visionos && pnpm build:macos-helper:clean && pnpm package:apple-runner:npm && pnpm build:android && pnpm check:package",
     "ad": "node bin/agent-device.mjs",
     "bench:help-conformance": "node scripts/help-conformance-bench.mjs",
     "maestro:conformance": "node --experimental-strip-types --test packages/maestro/test/conformance/verify.test.ts packages/maestro/test/conformance/differential/run.test.ts packages/maestro/test/conformance/differential/invariants.test.ts",
@@ -134,15 +134,15 @@
     "depgraph:test": "node --experimental-strip-types --test scripts/depgraph/model.test.ts scripts/depgraph/affected.test.ts",
     "check:production-exports": "fallow dead-code --config fallow-production-exports.json --production --unused-exports --fail-on-issues",
     "check:bundle-owner-files": "node --experimental-strip-types scripts/check-bundle-owner-files.ts",
-    "check:bundle-dependencies": "node --experimental-strip-types scripts/check-bundle-dependencies.ts",
+    "check:package": "node --experimental-strip-types scripts/check-package.ts",
     "check:command-docs": "vitest run --project unit-core src/__tests__/command-doc-coverage.test.ts",
     "check:replay-compat": "node --experimental-strip-types scripts/check-replay-compat-provenance.ts",
     "check:freerange": "fr",
     "check:quick": "pnpm lint && pnpm typecheck",
     "sync:mcp-metadata": "node scripts/sync-mcp-metadata.mjs",
     "check:mcp-metadata": "node scripts/sync-mcp-metadata.mjs --check",
     "version": "pnpm sync:mcp-metadata && git add server.json",
-    "check:tooling": "pnpm format:check && pnpm lint && pnpm typecheck && pnpm check:layering && pnpm depgraph:test && pnpm check:production-exports && pnpm check:mcp-metadata && pnpm build && pnpm check:bundle-owner-files && pnpm check:bundle-dependencies",
+    "check:tooling": "pnpm format:check && pnpm lint && pnpm typecheck && pnpm check:layering && pnpm depgraph:test && pnpm check:production-exports && pnpm check:mcp-metadata && pnpm build && pnpm check:bundle-owner-files && pnpm check:package",
     "check:unit": "pnpm check:contention-retry && pnpm test:unit && pnpm test:smoke",
     "check": "pnpm check:tooling && pnpm check:fallow && pnpm check:unit",
     "prepack": "pnpm check:mcp-metadata && pnpm package:npm",
@@ -242,7 +242,6 @@
   ],
   "dependencies": {
     "@limrun/api": "^0.24.5",
-    "pngjs": "^7.0.0",
     "yaml": "^2.9.0"
   },
   "devDependencies": {
@@ -255,6 +254,7 @@
     "@agent-device/provider-webdriver": "workspace:*",
     "@agent-device/replay-test": "workspace:*",
     "@agent-device/xml": "workspace:*",
+    "@arethetypeswrong/cli": "^0.18.5",
     "@chenglou/freerange": "^0.0.1",
     "@stryker-mutator/core": "9.6.1",
     "@stryker-mutator/vitest-runner": "9.6.1",
@@ -266,6 +266,8 @@
     "oxc-parser": "^0.138.0",
     "oxfmt": "^0.42.0",
     "oxlint": "^1.69.0",
+    "pngjs": "^7.0.0",
+    "publint": "^0.3.22",
     "tsdown": "^0.22.4",
     "typescript": "^7.0.2",
     "vite": "^8.0.16",