[TheGreatAxios]

Summary

CL-8157 (child of CL-8151, follows CL-8152/#755 which already cut
Workbench-internal imports): every workflows/<name> package and every
packages/*-tools package that can be published cleanly now is —
private: true dropped, exports/files/license/repository/
publishConfig.access: "public" filled in, and a real dependency-version
story instead of workspace:*.

Decision: ship TS source, not a build

The sidecar's @intx/workflow-host loadWorkflowDefinitionFromClosure
(vendor/intx/workflow-host/src/workflow-definition-loader.ts) reads a
materialized package's package.json.interchange.workflow field and
does a plain import(fileUrl) on it — no build step, no dist/. The
sidecar itself runs as bun src/index.ts (apps/sidecar/package.json),
so it can import() a .ts file directly. Every workflow package
already shipped "exports": {".": "./src/index.ts"} pointing at raw
source; this PR keeps that and adds the matching
"interchange": {"workflow": "./src/index.ts"} field the registry-source
loader actually reads, plus "files": ["src", "LICENSE", "README.md"]
so the tarball carries only what's needed.

Dependency story

• @intx/* moved from dependencies to peerDependencies, pinned at
  the exact version in each package's own vendor/intx/*/package.json
  (0.3.0 across the board, matching the root overrides). Caveat
  worth flagging: per VENDORED.md, several vendored @intx/* trees
  (agent, types, workflow, …) are ahead of what npm's 0.3.0
  actually published — a real installer pinning 0.3.0 today gets a
  slightly older API surface than this repo runs against locally. That's
  an existing vendoring-ledger fact, not something this PR can fix; it
  resolves as those packages get re-published.
• @corbits/* runtime dependencies are pinned to that package's own
  literal version (never workspace:*, which bun's packer would rewrite
  silently at pack time but which the checked-in manifest must not rely
  on — verified below).
• devDependencies keep workspace:*/catalog: — never installed by a
  consumer of the published tarball, so there's nothing to fix there.
• arktype, @modelcontextprotocol/sdk, etc. stay catalog: per the
  existing catalog-pins check; bun pm pack rewrites catalog: to the
  real range at pack time (verified below), same as it rewrites
  workspace:*.

Verified, don't assume: bun pm pack rewrites both workspace:* and catalog:

$ bun pm pack   # in workflows/echo, before this PR's edits
"dependencies": { "@intx/agent": "0.3.0", "@intx/workflow": "0.3.0" }
$ bun pm pack   # in packages/catalog-tools, before this PR's edits
"dependencies": { "@intx/agent": "0.3.0", "@intx/types": "0.3.0", "arktype": "^2.2.0" }

So the tarball itself was already fine; the checked-in manifest was not
— hence check:publishable-workflows (new), which fails a checked-in
workspace:* runtime range or a runtime dependency on a still-private
package, independent of what the packer would have rewritten.

Proof: pack → extract → install → import, for workflows/assistant and workflows/echo

workflows/assistant (has a real @corbits/catalog-tools runtime dep):

$ cd workflows/assistant && bun pm pack
packed 1.24KB package.json / 26.0KB LICENSE / 0.79KB README.md / 17.96KB src/index.ts
corbits-assistant-workflow-0.0.2.tgz

# extracted into a scratch dir outside the repo, alongside catalog-tools's
# own tarball (packed the same way) and a package.json depending only on:
#   "@corbits/assistant-workflow": "file:./corbits-assistant-workflow-0.0.2.tgz"
#   "@corbits/catalog-tools":      "file:./corbits-catalog-tools-0.0.6.tgz"
#   "@intx/agent": "0.3.0", "@intx/types": "0.3.0", "@intx/workflow": "0.3.0"
$ bun install
+ @corbits/assistant-workflow@./corbits-assistant-workflow-0.0.2.tgz
+ @corbits/catalog-tools@./corbits-catalog-tools-0.0.6.tgz
+ @intx/agent@0.3.0
+ @intx/types@0.3.0
+ @intx/workflow@0.3.0
17 packages installed

$ bun -e 'const m = await import("@corbits/assistant-workflow"); console.log(Object.keys(m))'
exports: [ "ASSISTANT_STEP_ID", "ASSISTANT_SYSTEM_PROMPT", "ASSISTANT_TOOL_PACKAGE_PINS",
  "ASSISTANT_WORKFLOW_ID", "buildAssistantWorkflow", "serializeAssistantWorkflow" ]

workflows/echo (peer deps only, no @corbits/* runtime dep at all):

$ bun install
+ @corbits/echo-workflow@./corbits-echo-workflow-0.0.1.tgz
+ @intx/agent@0.3.0
+ @intx/workflow@0.3.0
16 packages installed

$ bun -e '...'
exports: [ "ECHO_STEP_ID", "ECHO_SYSTEM_PROMPT", "ECHO_WORKFLOW_ID",
  "buildEchoWorkflow", "serializeEchoWorkflow" ]

The real npm registry served @intx/agent/@intx/types/@intx/workflow
at 0.3.0 for both; the @corbits/* runtime dep resolved through a
local tarball only because nothing in this repo publishes to npm yet —
same shape a real install would take once it does.

Left private (blockers, listed rather than worked around)

Per-package runtime dependency on a still-private, out-of-scope package:

• packages/access-tools → @corbits/error-sink (runtime dependencies)
• packages/connections-tools → @corbits/connections (runtime dependencies)
• packages/interaction-tools → @corbits/error-sink (runtime dependencies)

granola-tools and linear-tools only reference @corbits/credential-providers
in devDependencies (test-only), so both are clean and are published in
this PR.

New structural check

scripts/checks/publishable-workflows.ts: fails any non-private
workflows/* or packages/*-tools/tools-* package missing exports/
files/license, or carrying a workspace:* (or private-package)
runtime dependency. bun run check:structural (full suite), bun run lint, and package-scoped bun run typecheck all pass; the two
whole-repo typecheck/lint failures pre-exist on main
(packages/chat-ui missing-module/unused-var errors unrelated to this
change — confirmed via git status showing no changes under
packages/chat-ui).

Test plan

• bun install at repo root resolves cleanly
• bun run check:structural green (including new
  check:publishable-workflows)
• bun test for touched packages/workflows green
• Package-scoped bun run typecheck green for touched packages
• bun pm pack → extract → install → import() proof above for
  workflows/assistant and workflows/echo

https://claude.ai/code/session_01RweuMUskU2nvcFhdckc7EG

[linear-code]

CL-8157