refactor: simplify validation tooling (#16)

Author: aallam

.changeset/package-validation.md

@@ -0,0 +1,13 @@
+---
+"@execbox/core": patch
+"@execbox/isolated-vm": patch
+"@execbox/process": patch
+"@execbox/protocol": patch
+"@execbox/quickjs": patch
+"@execbox/remote": patch
+"@execbox/worker": patch
+---
+
+Fix published export metadata so CommonJS entrypoints resolve their `.d.cts`
+declaration files correctly, and add package validation with `publint` and
+Are the Types Wrong in CI.

.github/workflows/ci.yml

@@ -37,8 +37,11 @@ jobs:
       - name: Run tests
         run: npm test
 
-      - name: Build
-        run: npm run build
+      - name: Package validation
+        run: npm run package:check
+
+      - name: Check API reports
+        run: npm run api:check
 
   security:
     runs-on: ubuntu-latest

.gitignore

@@ -1,9 +1,11 @@
 .worktrees/
 node_modules/
+.npm-cache/
 dist/
 docs/.vitepress/cache/
 docs/.vitepress/dist/
 packages/*/dist/
+packages/*/temp/
 coverage/
 *.tsbuildinfo
 .env

.prettierignore

@@ -4,3 +4,4 @@ docs/.vitepress/dist
 node_modules
 package-lock.json
 packages/**/dist
+packages/**/etc/*.api.md

AGENTS.md

@@ -14,6 +14,7 @@
 - Type-check: `npm run typecheck`
 - Test default workspace lanes: `npm test`
 - Build published packages: `npm run build`
+- Validate published package metadata and type resolution: `npm run package:check`
 - Build docs site: `npm run docs:build`
 - Run security-focused suites: `npm run test:security`
 - Run isolated-vm tests only when needed: `npm run test:isolated-vm`
@@ -30,6 +31,8 @@
 ## Testing Instructions
 
 - For most code changes, run `npm run format:check`, `npm run lint`, `npm run typecheck`, `npm test`, and `npm run build`.
+- If you change package exports, manifest fields, or published type-resolution behavior, also run `npm run package:check`.
+- If you change the public API of `@execbox/core`, `@execbox/core/mcp`, `@execbox/protocol`, `@execbox/quickjs`, `@execbox/quickjs/runner`, `@execbox/quickjs/runner/protocol-endpoint`, `@execbox/remote`, `@execbox/process`, `@execbox/worker`, `@execbox/isolated-vm`, or `@execbox/isolated-vm/runner`, also run `npm run api:check`.
 - If you change docs site content, navigation, or VitePress config, also run `npm run docs:build`.
 - If you touch execution boundaries, timeout handling, abort propagation, schema validation, or log/memory controls, also run `npm run test:security`.
 - If you touch `@execbox/isolated-vm` or codepaths guarded by `VITEST_INCLUDE_ISOLATED_VM`, run `npm run test:isolated-vm` or `npm run verify:isolated-vm`.
@@ -45,6 +48,7 @@
 - Use Conventional Commits for git commit messages, for example `docs: add agent and contributor guides` or `fix(worker): handle timeout classification`.
 - Published package releases are managed with Changesets and GitHub Actions.
 - Add a `.changeset/*.md` entry when a change affects published package behavior, public APIs, or release notes for one or more `@execbox/*` packages.
+- If you intentionally change a checked-in API report for `@execbox/core`, `@execbox/core/mcp`, `@execbox/protocol`, `@execbox/quickjs`, `@execbox/quickjs/runner`, `@execbox/quickjs/runner/protocol-endpoint`, `@execbox/remote`, `@execbox/process`, `@execbox/worker`, `@execbox/isolated-vm`, or `@execbox/isolated-vm/runner`, update it with `npm run api:update` in the same change as the code and changeset.
 - Skip a changeset for docs-only, examples-only, CI-only, or internal maintenance changes that do not affect published package behavior.
 
 ## Useful References

CONTRIBUTING.md

@@ -20,17 +20,21 @@ This guide is for both humans and coding agents. Agent-specific operating instru
 ## Verification
 
 - General code changes: `npm run format:check`, `npm run lint`, `npm run typecheck`, `npm test`, and `npm run build`
+- Package export, manifest, or published type-resolution changes: `npm run package:check`
 - Docs site changes: `npm run docs:build`
 - Security or execution-boundary changes: `npm run test:security`
 - `@execbox/isolated-vm` changes: `npm run test:isolated-vm` or `npm run verify:isolated-vm`
 
 Choose the smallest verification set that covers your change, and include the commands you ran in your PR or handoff notes when the context would help reviewers.
 
+- Public API changes to `@execbox/core`, `@execbox/core/mcp`, `@execbox/protocol`, `@execbox/quickjs`, `@execbox/quickjs/runner`, `@execbox/quickjs/runner/protocol-endpoint`, `@execbox/remote`, `@execbox/process`, `@execbox/worker`, `@execbox/isolated-vm`, or `@execbox/isolated-vm/runner`: run `npm run api:check`
+
 ## Changesets
 
 - Add a `.changeset/*.md` file for user-facing changes to published `@execbox/*` packages.
 - Skip changesets for docs-only, examples-only, CI-only, or internal refactors that do not change published package behavior.
 - Keep the changeset summary focused on the externally visible change.
+- If you intentionally change a checked-in API report, update the report baseline with `npm run api:update` and add the corresponding changeset in the same change.
 
 ## Commits