[vvillait88]

Summary

Release 2.9.3. This publishes the 2026-10-22 maintenance sweep (#110):

• knip 6.42.1
• typescript-eslint 8.72.0
• packageManager bun@1.4.4

The source and runtime dependencies are unchanged. The release exists so this sweep's consumers (pay, node-commerce) can take one consistent SDK version.

Worked with Varun.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

Unchanged.

Test plan

• The lockfile is unchanged by the bump (bun install: no changes).
• Sweep: knip 6.42.1, typescript-eslint 8.72.0, bun 1.4.4 #110's gates ran on the same tree: lint, typecheck, knip, test (154 passed), build and osv-scanner all pass.

Checklist

• Tests cover the new behavior, and the suite passes locally (no new behavior)
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (the public surface did not change)
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Review: no blocking findings

Read at head 561cf0b, which is one commit on top of main e00531d (#110).

The diff is only the version. One file changed: package.json version 2.9.2 to 2.9.3. bun.lock doesn't change, and that's correct here. The root workspace entry in bun.lock carries only name and the dependency ranges, not the package's own version, so a version bump has nothing to rewrite there.

2.9.3 is not taken yet.

• The tags matching v2.9 are v2.9.0, v2.9.1 and v2.9.2.
• npm view @agent-score/sdk versions ends at 2.9.2.
• npm view @agent-score/sdk@2.9.3 returns E404.

Publish workflow. publish.yml triggers on push: tags: ["v*"]. It sets the version from the tag with npm version "${GITHUB_REF_NAME#v}" --no-git-tag-version --allow-same-version, then runs bun install --frozen-lockfile, builds, and publishes with npm publish --access public --provenance. So a v2.9.3 tag on the squash commit publishes 2.9.3, and --allow-same-version makes the tag and package.json agree without error. setup-bun@v2 has no version input, so it reads packageManager and gets bun 1.4.4, the same as #110's CI.

CI. gh pr checks 111 shows 9 rows, all pass, exit 0. The required ci and Dependency Scan checks are present and green.

Non-blocking.

• The branch commit is titled "relock past this sweep's tool updates and bun 1.4.4", but nothing was relocked. The squash will take the PR title, so check the squash message reads as a version bump.
• The source, the runtime dependencies (there are none) and the build toolchain are the same as 2.9.2. The 2.9.3 tarball will match 2.9.2 except for the version field. That is the intent of a release cut to give this sweep one version across its consumers. No consumer needs it to pick up a fix.