Archive release assets are not consumable by npm-shim or the pinned VS Code extension

[alpCaner]

Found while reviewing

PR #352 changes the release contract from raw executables to .zip/.tar.gz archives, but the consumers that construct release URLs still implement the raw-binary contract.

In this repository

npm-shim/postinstall.js still constructs:

const ext = process.platform === "win32" ? ".exe" : "";
const asset = `tan-${target}${ext}`;

and writes the downloaded bytes directly as the executable. The branch's own shim test fails:

win32/x64 -> tan-x86_64-pc-windows-msvc.exe is not in the published asset table

The release workflow disables npm publishing, but leaving the code/contract inconsistent means it cannot be re-enabled and the release gate remains red.

Cross-repository consumer

The current alp-sdk-vscode origin/dev still:

• builds raw names (tan-<triple> / .exe),
• downloads directly to cachedBinaryPath,
• chmods/spawns that file,
• has no archive extraction/layout handling.

That directly conflicts with this repository's docs/release-contract.md, which says asset names must change only in lockstep with the extension's releaseAssetForTarget.

Impact

An archive-based tan release cannot be installed by either managed consumer. The npm shim receives a 404; if only its filename were changed, it would save archive bytes as tan. The extension behaves the same way unless its acquisition/cache layout is updated concurrently.

Acceptance criteria

• npm shim selects the archive asset, verifies its checksum, extracts the one-top-level tan/ tree, and installs a launcher/cache layout atomically.
• alp-sdk-vscode lands equivalent archive-aware download/extraction before its tan pin moves to this release.
• Cross-repository contract tests cover exact asset names and archive layout.
• The tan release is not cut until both acquisition paths are compatible.

Related: #349, #356, PR #352. A matching alp-sdk-vscode issue should track that repository's half.

[alpCaner]

Fixed on dev in ac79d4c (PR #352). dev IS this repo's default branch, so Closes does fire here -- but this issue was filed AFTER the PR body's closing-keyword list was written, so it was never in it. Closed by hand; a merged PR body cannot close retroactively.

The npm shim selects the asset from checksums.txt by the same rule as install.sh/install.ps1, verifies the digest before extracting, and installs the onedir tree with its _internal/ sibling intact. Verified over the real network at the shim's own pinned tag: previously 404, now tan 0.5.0-rc4. Shim tests 11 -> 18.

The .zip path is now tested with a genuine PK-signed zip built in-tree; it had been passing only because bsdtar content-sniffs a renamed tarball. The extension half is alp-sdk-vscode#463.