test: verify the installed SDK TypeScript contract

sdk/typescript/scripts/fixtures/package-consumer.ts

@@ -0,0 +1,33 @@
+import {
+  CodexSecurity,
+  DiffTarget,
+  estimateScanCost,
+  type ScanCost,
+  type ScanOptions,
+  type ScanResult,
+} from "@openai/codex-security";
+
+const options: ScanOptions = {
+  target: DiffTarget.refs({ base: "HEAD~1" }),
+  onProgress(progress) {
+    const completed: number = progress.filesCompleted;
+    void completed;
+  },
+};
+
+export async function scan(repository: string): Promise<ScanResult> {
+  const client = new CodexSecurity();
+  try {
+    return await client.run(repository, options);
+  } finally {
+    await client.close();
+  }
+}
+
+export const cost: ScanCost | null = estimateScanCost("gpt-5.6-sol", {
+  input_tokens: 10,
+  output_tokens: 2,
+});
+
+// @ts-expect-error Dependency injection is internal, not a public constructor overload.
+new CodexSecurity({}, undefined as never, { surface: "sdk" });

sdk/typescript/scripts/smoke-package.mjs

@@ -351,6 +351,36 @@ try {
     { cwd: consumer },
   );
 
+  await cp(
+    join(packageRoot, "scripts", "fixtures", "package-consumer.ts"),
+    join(consumer, "consumer.ts"),
+  );
+  await writeFile(
+    join(consumer, "tsconfig.json"),
+    JSON.stringify({
+      files: ["consumer.ts"],
+      compilerOptions: {
+        target: "ES2022",
+        lib: ["ESNext"],
+        module: "NodeNext",
+        moduleResolution: "NodeNext",
+        strict: true,
+        noEmit: true,
+        types: ["node"],
+        typeRoots: [join(packageRoot, "node_modules", "@types")],
+      },
+    }),
+  );
+  run(
+    process.execPath,
+    [
+      join(packageRoot, "node_modules", "typescript", "bin", "tsc"),
+      "--project",
+      join(consumer, "tsconfig.json"),
+    ],
+    { cwd: consumer },
+  );
+
   assert.equal(
     typeof installedManifest.bin?.["codex-security"],
     "string",
@@ -496,7 +526,7 @@ try {
   await smokeNestedDeepScanWorker(installedRoot, consumer);
 
   console.log(
-    `Validated installed ${packageManifest.name}@${packageManifest.version}: public import, CLI, ${expectedPluginFiles.length} bundled plugin files, bundled Codex version, and a nested worker without global codex.`,
+    `Validated installed ${packageManifest.name}@${packageManifest.version}: public import, NodeNext types, CLI, ${expectedPluginFiles.length} bundled plugin files, bundled Codex version, and a nested worker without global codex.`,
   );
 } finally {
   await rm(consumer, {