chore(pq-algorithm-id/ts): phase 4 - release hardening and adoption validation (ENG-1917)

[eacet]

Summary

Package(s)

Languages

• TypeScript
• Rust

Checklist

• Tests pass for all modified packages
• Linting/formatting passes (biome check, cargo fmt)
• Both language implementations are consistent (or noted as follow-up)
• Package README updated if public API changed
• No unnecessary dependencies added

Related Issues

[eacet]

• chore(pq-algorithm-id/ts): phase 4 - release hardening and adoption validation (ENG-1917) #29 👈 (View in Graphite)
• feat(pq-oid/ts): phase 3 - add migration compatibility layer (ENG-1916) #28
• feat(pq-algorithm-id/ts): phase 2 - implement conversion and x509 mapping apis (ENG-1915) #27
• feat(pq-algorithm-id/ts): phase 1 - package foundation and canonical registry (ENG-1914) #26
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Greptile Summary

This PR completes Phase 4 release hardening for the pq-algorithm-id/ts package by adding a proper exports map to package.json, a new cross-package compatibility test suite (compat.test.ts), a publish policy section in the README, and a corresponding CHANGELOG.md entry.

Key changes:

• package.json: Added exports field with types, import, and default conditions — essential for correct ESM subpath resolution in modern bundlers and runtimes.
• compat.test.ts: New compatibility test file validating toJose/toCose/toOid parity with pq-oid public constants (OID.*), OID.fromName, OID.toJOSE, and OID.toCOSE across all 18 supported algorithms.
• README.md: New "Publish Policy" section documents dependency sequencing and exact-pin strategy for 0.x releases — but the inline description of the pin style references 0.x.y versioning while the actual pq-oid pin in package.json is 1.0.2 (a 1.x.y release), creating a factual inconsistency.
• CHANGELOG.md: Accurate [Unreleased] entries for the phase 4 additions.

Confidence Score: 4/5

• This PR is safe to merge with one minor documentation fix needed.
• The code changes (exports map and compatibility tests) are correct and well-structured. The only issue is a factual discrepancy in the README's publish policy section, which describes pq-oid as using 0.x.y style semver while the actual pinned version is 1.0.2. This is a documentation error with no runtime impact, but it could mislead downstream consumers and should be corrected before or shortly after merging.
• packages/pq-algorithm-id/ts/README.md — the 0.x.y style description in the Publish Policy section conflicts with the actual pq-oid pin of 1.0.2.

Important Files Changed

Filename	Overview
packages/pq-algorithm-id/ts/tests/compat.test.ts	New cross-package compatibility test; imports toJose, toCose, toOid from ../src and exercises parity with pq-oid public constants and OID.fromName/OID.toJOSE/OID.toCOSE. Logic and coverage look correct.
packages/pq-algorithm-id/ts/package.json	Added a well-formed exports map with types, import, and default conditions, enabling correct ESM subpath resolution for modern toolchains. No issues found.
packages/pq-algorithm-id/ts/README.md	New "Publish Policy" section documents the release sequencing for 0.x series, but the description "0.x.y style exact semver" for the pq-oid pin is factually wrong — the actual pinned version is 1.0.2 (a 1.x.y release).
CHANGELOG.md	Added [Unreleased] section with accurate entries for the Phase 4 hardening work. No issues.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Consumer imports pq-algorithm-id] --> B{Node / Bundler resolution}
    B -- ESM / import --> C["exports['.'].import\n./dist/index.js"]
    B -- TypeScript types --> D["exports['.'].types\n./dist/index.d.ts"]
    B -- Fallback / CJS --> E["exports['.'].default\n./dist/index.js"]
    C --> F[toOid / toJose / toCose / etc.]
    D --> F
    E --> F
    F --> G[pq-oid dependency\npinned at 1.0.2]
    G --> H[OID constants\nOID.fromName\nOID.toJOSE / OID.toCOSE]
    F -.->|compat.test.ts asserts parity| H

Loading

_{Last reviewed commit: 0a20ebf}

[claude]

LGTM — small release-hardening PR with standard exports map, compatibility tests, and doc updates.

Extended reasoning...

Overview

This PR touches four files in the pq-algorithm-id/ts package: a root CHANGELOG entry, a README publish-policy section, the package.json exports field, and a new compat.test.ts file. The scope is narrow and well-defined as "phase 4 release hardening."

Security risks

None. The changes are a package.json exports map (standard Node.js ESM pattern), documentation, and read-only compatibility tests. No auth, crypto logic, or permission-sensitive code is modified.

Level of scrutiny

Low scrutiny is appropriate. The only functional code change is adding an exports field to package.json, which follows established Node.js conventions. The new test file is additive and exercises existing public APIs from both pq-oid and pq-algorithm-id.

Other factors

The inline bug report (README says 0.x.y style pin but actual dependency is 1.0.2) is a valid documentation nit with zero runtime impact. It does not warrant blocking approval. The compatibility tests add meaningful cross-package validation coverage.

[eacet]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[eacet]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1d2516ee1a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[eacet]

Merge activity

• Mar 12, 12:35 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Mar 12, 12:40 PM UTC: Graphite rebased this pull request as part of a merge.
• Mar 12, 12:41 PM UTC: @eacet merged this pull request with Graphite.