[TS-03] Publish signed prerelease and stable packages with sandbox conformance

[jaavid]

Background

CoreLink is one product across multiple implementation repositories. This work is owned by sdk-typescript under EPIC-05.

Goal

Publish reproducible, signed TypeScript prerelease/stable packages with retained sandbox/conformance evidence and immutable contract provenance.

Parent

• Primary Product Epic: EPIC-05
• Backlog ID: TS-03

Scope

• Package and version the accepted TS-02 SDK surface.
• Sign/publish packages through the organization release/provenance path.
• Verify compatibility against MOCK-03 or an equivalent accepted sandbox.
• Distinguish prerelease, Beta/RC, and stable support claims.
• Retain package, dependency, contract and conformance evidence.

Out of Scope

• Treating successful publication as product-runtime acceptance.
• Stable claims for contract or SDK behavior not accepted by TS-02/conformance gates.
• Bypassing organization release/provenance policy.

Acceptance Criteria

• Package is reproducible from immutable source and contract revisions.
• Package signing/provenance satisfies the accepted [TS-02] Add authentication, pagination, retries, errors, and webhook ergonomics #4 release path.
• Positive, denied, malformed, retry and recovery behavior passes against MOCK-03 or equivalent accepted sandbox.
• Published metadata identifies SDK, contract and mock/sandbox versions.
• Prerelease versus stable maturity is explicit.
• Documentation and migration/release notes are reconciled.
• Retained evidence advances EPIC-05 release/conformance criteria.

Dependencies and acceptance state

• Execution prerequisite: TS-02 accepted SDK ergonomics/behavior.
• Conformance prerequisite: MOCK-03 or equivalent accepted sandbox/package revision.
• Release-governance prerequisite: GH-04 accepted reusable CI/release/provenance path before supported publication claims.
• Blocks: DOCS-04 TypeScript release guidance, WEB-03 supported-tool claims, and EPIC-05 TypeScript release acceptance.
• Current dependency state: See the CoreLink Product organization Project.

Planning Metadata

• Type: Technical Task
• Priority snapshot: P0
• Product milestone snapshot: Beta
• Domain snapshots: sdk, deployment
• Area snapshot: package
• Complexity: M
• Created in status: Triage
• Current status and DRI: See the CoreLink Product organization Project.
• Intended repository labels: type:technical-task

Definition of Done

• Acceptance criteria demonstrated.
• Artifact provenance/signing and reproducibility are verified.
• Required conformance checks pass on version-identifiable dependencies.
• Contract compatibility and security/tenant implications are reconciled.
• Documentation/release notes are updated.
• Pull request(s), package revision and retained evidence are linked.