feat(scripts): port 1-click deploy and npm trust tooling with lib/tools structure

.github/workflows/release.yml

@@ -60,9 +60,9 @@ jobs:
       - name: Resolve binary name from table
         shell: bash
         run: |
-          BINARY_NAME="$(jq -r --arg target "${{ matrix.target }}" '.[] | select(.target == $target) | .bin' scripts/release/targets.json)"
+          BINARY_NAME="$(jq -r --arg target "${{ matrix.target }}" '.[] | select(.target == $target) | .bin' scripts/lib/targets.json)"
           test -n "$BINARY_NAME" || {
-            echo "target ${{ matrix.target }} missing from scripts/release/targets.json" >&2
+            echo "target ${{ matrix.target }} missing from scripts/lib/targets.json" >&2
             exit 1
           }
           echo "BINARY_NAME=$BINARY_NAME" >> "$GITHUB_ENV"
@@ -116,8 +116,7 @@ jobs:
 
       - name: "Gate: check-matrix (table vs workflow agreement)"
         run: |
-          deno run --allow-read=scripts/release/targets.json,npm/packages/comment-checker/package.json,.github/workflows/release.yml scripts/release/check-matrix.ts
-
+          deno run --allow-read=scripts/lib/targets.json,npm/packages/comment-checker/package.json,.github/workflows/release.yml scripts/tools/check-matrix.ts
       - name: "Gate: binary exists"
         shell: bash
         run: |
@@ -152,14 +151,13 @@ jobs:
           cp "$BIN" "$STAGE/${BINARY_NAME}"
           SHA="$(sha256_of "$STAGE/${BINARY_NAME}")"
           deno run \
-            --allow-read=scripts/release/targets.json,npm/packages/comment-checker/package.json \
+            --allow-read=scripts/lib/targets.json,npm/packages/comment-checker/package.json \
             --allow-write="$STAGE" \
-            scripts/release/generate-platform-manifest.ts \
+            scripts/tools/generate-platform-manifest.ts \
             --suffix "${{ matrix.suffix }}" \
             --version "${GITHUB_REF#refs/tags/v}" \
             --binary-sha256 "$SHA" \
             --out "$STAGE"
-          echo "$SHA" > "$RUNNER_TEMP/binary-${{ matrix.suffix }}.sha256"
           echo "STAGE=$STAGE" >> "$GITHUB_ENV"
 
       - name: Upload tar.gz + sha sidecar
@@ -244,16 +242,15 @@ jobs:
           # normalization (libc as array, absent when null) makes the deep
           # equality meaningful instead of always-true or always-false.
           libc_norm='{os, cpu} + (if (.libc // null) != null then {libc} else {} end)'
-          SUFFIXES="$(jq -r '.[].suffix' scripts/release/targets.json)"
+          SUFFIXES="$(jq -r '.[].suffix' scripts/lib/targets.json)"
           test -n "$SUFFIXES" || { echo "targets.json empty" >&2; exit 1; }
           for SUFFIX in $SUFFIXES; do
             PKG="@systemfsoftware/claude-code-comment-checker-${SUFFIX}"
             META="$(npm view "$PKG@$VERSION" version os cpu libc --json)" || {
               echo "platform package $PKG@$VERSION missing" >&2
               exit 1
             }
-            EXPECTED="$(jq -c --arg suffix "$SUFFIX" '.[] | select(.suffix == $suffix) | {os: [.os], cpu: [.cpu]} + (if (.libc // null) != null then {libc: [.libc]} else {} end)' scripts/release/targets.json)"
-            echo "$META" | jq -e -c --arg v "$VERSION" --argjson want "$EXPECTED" \
+            EXPECTED="$(jq -c --arg suffix "$SUFFIX" '.[] | select(.suffix == $suffix) | {os: [.os], cpu: [.cpu]} + (if (.libc // null) != null then {libc: [.libc]} else {} end)' scripts/lib/targets.json)"
               '.version == $v and ('"$libc_norm"') == $want' >/dev/null || {
               echo "$PKG@$VERSION mismatch: $(echo "$META" | jq -c '{version, os, cpu, libc}') want $EXPECTED" >&2
               exit 1
@@ -274,7 +271,7 @@ jobs:
               shasum -a 256 "$1" | cut -d' ' -f1
             fi
           }
-          SUFFIXES="$(jq -r '.[].suffix' scripts/release/targets.json)"
+          SUFFIXES="$(jq -r '.[].suffix' scripts/lib/targets.json)"
           test -n "$SUFFIXES" || { echo "targets.json empty" >&2; exit 1; }
           for SUFFIX in $SUFFIXES; do
             SHA_RECORDED="$(cat "sidecars/binary-${SUFFIX}.sha256")"
@@ -315,13 +312,11 @@ jobs:
         run: |
           # --allow-env required: VERSION arrives via the environment (KTD5:
           # the git tag is the single version source). The deno.jsonc
-          # manifest:sync-root task declares the identical permission set.
           VERSION="$VERSION" deno run \
-            --allow-env \
-            --allow-read=scripts/release/targets.json,npm/packages/comment-checker/package.json \
+            --allow-env=VERSION \
+            --allow-read=scripts/lib/targets.json,npm/packages/comment-checker/package.json \
             --allow-write=npm/packages/comment-checker/package.json \
-            scripts/release/sync-root-version.ts
-
+            scripts/tools/sync-root-version.ts
       - name: Publish root launcher (OIDC provenance)
         shell: bash
         run: |
@@ -336,8 +331,7 @@ jobs:
             echo "root version mismatch: $(echo "$ROOT_META" | jq -c '.version')" >&2
             exit 1
           }
-          SUFFIXES="$(jq -r '.[].suffix' scripts/release/targets.json)"
-          for SUFFIX in $SUFFIXES; do
+          SUFFIXES="$(jq -r '.[].suffix' scripts/lib/targets.json)"
             echo "$ROOT_META" | jq -e --arg k "@systemfsoftware/claude-code-comment-checker-${SUFFIX}" --arg v "$VERSION" \
               '.optionalDependencies[$k] == $v' >/dev/null || {
               echo "optional pin missing for $SUFFIX@$VERSION" >&2

CONCEPTS.md

@@ -52,7 +52,7 @@ bin.
 
 ### Platform package
 One per os-cpu pair (`-linux-x64`, `-darwin-arm64`, …), generated from
-`scripts/release/targets.json`: ships only the compiled binary and its
+`scripts/lib/targets.json`: ships only the compiled binary and its
 manifest (`os`/`cpu`/`libc` fields, no `bin`). The launcher's
 `optionalDependencies` pins all five to the release version.
 

CONTRIBUTING.md

@@ -0,0 +1,4 @@
+# Contributing
+
+See [AGENTS.md](AGENTS.md) for development rules, branch discipline, and verification gates.
+For one-time npm OIDC bootstrap and trust configuration, run `cd scripts && deno task publish:unpublished`.

README.md

@@ -53,10 +53,8 @@ Releases are tag-triggered: pushing a tag `vX.Y.Z` to `main` runs
 all five target binaries, publishes the five platform packages and then the
 root launcher — all with npm OIDC trusted publishing and provenance, no static
 tokens in CI. The exact step sequence and per-package trusted-publisher bindings are documented
-in the release plan
-(`docs/plans/2026-08-17-001-feat-npm-distribution-release-plan.md`) and the
-first-release checklist (`docs/publishing/first-release-checklist.md`).
-
+in the release plan (`docs/plans/2026-08-17-001-feat-npm-distribution-release-plan.md`)
+and automated via `cd scripts && deno task publish:unpublished`.
 To release:
 
 1. Create the six [npm trusted-publisher