check: does this README describe the SDK npm actually serves?

[DealAppSeo]

The gap

This README advertises @hyperdag/trustshell and shows call sites for it — "Drop-in npm client: shell.evaluate(...) for HAL". Nothing tied that prose to the package. shell.evaluate did not exist on the client at all, so a reader following this README got TypeError: shell.evaluate is not a function — and the README stayed green forever, because nothing could disagree with it.

Why it compares against the published package, not source

The method was added in DealAppSeo/trustshell#101, which is merged. The claim is still false.

npm serves 1.3.0, and 1.3.0 has no evaluate. A fix merged to the SDK's main does not make this README true: the README says "npm install", so what npm serves is what a reader gets. A method can be real in git and absent for every user, and that gap is invisible from either repo alone.

Running it right now:

check:sdk-claims — FAILED
  README.md advertises 1 method(s) that @hyperdag/trustshell@1.3.0 does not expose:
    ✗ shell.evaluate(...)

  A reader following this README with `npm install @hyperdag/trustshell` gets a TypeError.
  If the method exists on the SDK's main branch, it is NOT published yet —
  merging is not shipping, and this README points at npm.

Three outcomes

0 VERIFIED · 2 NOT_CHECKED · 1 FAILED.

A registry it could not reach is NOT_CHECKED — never a pass, and never a failure either. This check's whole job is to know what npm serves, so not knowing is not a verdict. Verified by pointing npm at a dead registry: exit 2, with the reason.

It also refuses to report a pass off a parse that clearly didn't work — fewer than five methods recovered from the .d.ts means the shape moved, not that the README is clean.

Deliberately not wired into CI

It would go red on main immediately, and that red would be true — the README is wrong for anyone installing today.

Turning this repo's CI red is a decision for its owner, not a side effect of adding a check. Wiring it is one step in .github/workflows/ci.yml whenever the fix is published; publishing is an irreversible, human-only action.

Exposed as npm run check:sdk-claims so it's runnable and discoverable rather than a script nobody knows exists.

Risk

One new script, one new npm entry. No CI change, no behaviour change, no dependency.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BV8K8JderLwSzxqf9PbJak

---

Generated by Claude Code

[strix-security]

Strix Security Review

No security issues found.

_{Updated for bb76b68.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}