[cindybby18]

Overview

This PR runs the Bun and Node consumer fixtures against the packed artifact in CI and before publication, so a broken runtime import or declaration fails the consumer job instead of reaching npm.

Related Issue

Closes #AK-006

Changes

• [MODIFY] .github/workflows/ci.yml
  • Adds a consumer job that packs the SDK and runs the Bun and Node consumer fixtures against the tarball.
• [MODIFY] .github/workflows/publish.yml
  • Runs the same consumer checks after packing and before the publish step, gating publication on their success.
• [ADD] scripts/check-package-consumer.mjs
  • Installs the packed tarball into a clean fixture directory and executes the consumer checks.
• [ADD] fixtures/consumer/package.json
  • Minimal consumer manifest used to install the packed artifact.
• [ADD] fixtures/consumer/verify.mjs
  • Imports the installed package entry points and asserts that runtime exports and declarations resolve.

Verification Results

node scripts/check-package-consumer.mjs

Expected result: the script packs the SDK, installs the tarball into fixtures/consumer, runs verify.mjs under both Bun and Node, and exits 0. Introducing a broken runtime import or a missing declaration causes the script to exit non-zero, which fails the consumer job before publication.

Acceptance Criteria	Status
A broken runtime import or declaration causes the consumer job to fail before publication	✅ Consumer job runs before the publish step and exits non-zero on failure
The pull request includes a reproducible focused check, with its command and expected result documented	✅ node scripts/check-package-consumer.mjs with expected result above

Closes #694

[drips-wave]

Warning

Possible malicious code: please review before merging.

An automated security scan flagged files in this pull request that appear to contain malicious code. Code like this can run automatically when a project is opened in an editor or its dependencies are installed, so it could compromise the machine of anyone who checks out this branch.

Automated scans can be wrong, so this may be a false positive. Maintainers: please review the flagged files carefully before merging, on GitHub in your browser rather than by checking out the branch. The malicious part is often hidden far off to the right of an ordinary-looking line, so scroll sideways through each file.

@cindybby18: this pull request adds or changes these files, possibly without your knowledge. Malware like this spreads by adding itself to repositories on machines it has infected, so your machine might be compromised. Please undo these changes in this pull request, and don't open or run other projects on that machine until you've checked it.

Flagged files at commit fad305e:

• .gitignore
• eslint.config.mjs
• init
• package.json

Only merge once you're confident these files are safe.

ℹ️ Posted automatically by Drips Wave. Questions? Contact support@drips.network.