* feat: v0.1.3 — dual ESM/CJS output, typesVersions, gateway-parity core exports, Sandbox-owned scripts

Prepares @truefoundry/utils for the tfy-llm-gateway migration off its in-tree
src/agent/public copy:

- package.json: dual-format exports (import/require per subpath), typesVersions
  for legacy moduleResolution=node consumers, version 0.1.3
- tsup: emit esm+cjs; drop sourcemaps from the published tarball
- tsc dts build: drop declaration maps (pointed into unshipped src/)
- Sandbox now owns its Python helper scripts: a build-time generator inlines
  mcp_client.py / skill_downloader.py into a gitignored sandboxScripts.gen.ts;
  the SandboxOptions.scripts injection point and dist/sandbox-scripts loose
  files are removed, and consumers (sandboxFactory.ts) no longer plumb them
- core barrel: export the 48 symbols plus llm/LLMTypes and llm/openaiSchemas
  modules the gateway consumes (TODO(oss): re-curate before public release)

Co-authored-by: Cursor <cursoragent@cursor.com>

* nit

* Remove generic utils (withTimeout, PromiseTimeoutError, onSignalAbort) from public barrel

These are general-purpose helpers unrelated to the agent domain; consumers
(the gateway) own their own copies instead of importing them from the
harness. Keeps the package surface scoped to agent concerns.

Co-authored-by: Cursor <cursoragent@cursor.com>

* docs: classify gateway-compatibility exports into three tiers

Tier 1: genuine host API (event wire contract, thread interaction types,
observability, config surface) — to be merged into the curated sections.
Tier 2: needs per-symbol review (sandbox constants/guards, LLMContextMessage,
openaiSchemas) — likely belongs behind harness APIs.
Tier 3: internals the gateway must stop using (LLMTypes internals,
contextUtils, Internal* thread events) — to be deleted once a thread-state
serialization/hydration API replaces the gateway's direct manipulation.

Co-authored-by: Cursor <cursoragent@cursor.com>

* nit

* nit

* nit

* Rename the agentSession directory to agent-session.

Deep-import paths will mirror the published file tree once dist/ becomes
the package root, so the directory name must literally match the public
subpath ./agent-session (legacy moduleResolution cannot follow aliases).

Co-authored-by: Cursor <cursoragent@cursor.com>

* nit

* Adopt openai-style package manifest for deep imports.

Switch to type commonjs (.js = CJS, .mjs = ESM), add wildcard subpath
exports into dist, and drop the typesVersions shim; bump to 0.2.0 and
add the esbuild extension-rewriting plugin for the per-file build.

Co-authored-by: Cursor <cursoragent@cursor.com>

* update tsup

* Stage dist/ as the publish root with its own package.json.

build:pkg generates dist/package.json (dist-relative paths, no scripts
or devDependencies, README guard) and build:check smoke-tests that the
staged output loads via require() and import() including deep paths.

Co-authored-by: Cursor <cursoragent@cursor.com>

* update release

* nit

* nit

* test: lint canaries in core, agent-session and server — REVERT ME

Deliberate no-explicit-any violations in all three modules to verify
the CI lint step fails. Revert after checking the CI run.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Revert "test: lint canaries in core, agent-session and server — REVERT ME"

This reverts commit 561ffc436a24e34499307dd637f6a5685f232d22.

* nit

---------

Co-authored-by: Cursor <cursoragent@cursor.com>