Module Catalog

Module Catalog

Every first-party Tamp module currently shipping. The contract for each is the same: import the namespace, call a static method that returns a CommandPlan, hand it to the executor.

1.2.0 surface note — every wrapper in the table below ships both fluent s => s.Set*() configurers and object-init new() { ... } overloads. See Module shape below for the comparison.

1.6.0 surface note — Secret.Reveal() is now public, gated by the TAMP004 analyzer instead of per-satellite [InternalsVisibleTo] entries. Net-new satellites no longer require a Tamp.Core bump just to handle a service-principal secret or cert password.

1.9.0 surface note — TAMP005 + TAMP006 analyzers added; the full analyzer family is now TAMP001–TAMP006. See Analyzers.

Framework + global tool

Package	Wraps	Reference
Tamp.Core	The framework itself — target executor, parameter injection, path API, host detection, secret handling, dry-run, Polling.Until async helper, ADR-0018 diagnostics contract. Ships the analyzer family (TAMP001–TAMP006) bundled at analyzers/dotnet/cs/. Current: 1.13.0.	analyzers
Tamp.Cli	The global tool, bare-command flavor (tamp <target>)	—
dotnet-tamp	The global tool, dotnet-verb flavor (dotnet tamp <target>)	—

.NET toolchain

Package	Wraps	Reference
Tamp.NetCli.V8	.NET 8 SDK CLI (dotnet build / test / pack / publish / restore / clean / format)	reference
Tamp.NetCli.V9	.NET 9 SDK CLI	reference
Tamp.NetCli.V10	.NET 10 SDK CLI	reference
Tamp.DotNetCoverage.V18	dotnet-coverage collector and merge	inside tamp core repo
Tamp.Coverlet.V6	Coverlet 6 config-builder — type-safe Format / Include / Exclude / UseSourceLink for dotnet test --collect "XPlat Code Coverage"	tamp-coverlet
Tamp.ReportGenerator.V5	ReportGenerator — coverage HTML / badge / markdown	tamp-reportgenerator
Tamp.EFCore.V8 / V9 / V10	EF Core dotnet ef migrations per major. V10 includes MigrationFanout for multi-tenant rollouts (strict serial ordering at Concurrency=1 since 0.4.0).	tamp-ef
Tamp.GitVersion.V6	GitVersion 6 — SemVer from git history	tamp-gitversion

Containers + build

Package	Wraps	Reference
Tamp.Docker.V27	Docker 27.x CLI. 0.3.0: Docker.Build routes to BuildKit (docker buildx build); pre-BuildKit builder available as Docker.LegacyBuild. tag, push, pull, full compose + buildx sub-facades.	reference
Tamp.Testcontainers.V4	Diagnostic library for testcontainers-dotnet pipelines. Probes Docker capability + sibling-container restrictions for CI gating.	tamp-testcontainers
Tamp.AdjacentContainer / .Local / .Provisioning	Fixture-side dual-mode container acquisition (adjacent sidecar via env var, local Testcontainers spawn as fallback) plus the CI-side companion that generates the docker-compose.yml for sidecars. .Local is the split-out adjacent-namespace package. Postgres / Azurite / Service Bus emulator.	tamp-adjacent-container · tamp-adjacent-container-provisioning
Tamp.Helm.V3	Helm v3 CLI — Upgrade, Template, Lint, Package, Push	tamp-helm
Tamp.Sccache	mozilla/sccache shared compile cache — transparent RUSTC_WRAPPER. Backends: local, S3, Azure Blob, GCS, Redis, memcached, GitHub Actions cache.	tamp-sccache

JavaScript / TypeScript toolchain

Package	Wraps	Reference
Tamp.Yarn.V4	Yarn Berry 4 (install, run, workspaces, npm publish)	reference
Tamp.Npm.V10	npm 10+ CLI — sibling to Tamp.Yarn.V4	tamp-npm
Tamp.Turbo.V2	Turborepo 2 (run, prune --docker, ls, info, daemon)	reference
Tamp.Vite.V5	Vite 5 (dev, build, preview, optimize) and Vitest 1 (run, watch, related, bench, typecheck)	reference
Tamp.GraphQLCodegen.V5	graphql-code-generator 5 (generate, init, --watch, --require)	reference
Tamp.Playwright.V1	Playwright 1 (test, install, codegen, show-report, merge-reports, sharding)	reference
Tamp.Eslint.V9	ESLint v9 CLI — TS/JS style + best-practice linting with SARIF output for the security pipeline. Smart binary resolution: project-local node_modules/.bin/eslint → pnpm exec → npm exec → global PATH → pre-flight skip via EslintBinaryResolver.IsAvailable.	tamp-eslint

Rust + desktop ship chain (Microsoft Store)

End-to-end: Rust core → Tauri bundle → MSIX package → signed → Partner Center submission. Each step a typed Tamp target.

Package	Wraps	Reference
Tamp.Cargo	cargo CLI — build, test, check, clippy, fmt, run, bench, doc, update	tamp-cargo
Tamp.Tauri.V2	Tauri 2.x CLI + the load-bearing Tauri.ExternalBinPath helper for the sidecar binaries/<name>-<target-triple>[.exe] contract	tamp-tauri
Tamp.Msix	Windows MSIX toolchain (makeappx + signtool) plus Msix.SetAppxManifestVersion for 3-part-SemVer-to-4-part-MSIX normalization	tamp-msix
Tamp.MicrosoftStoreCli	Microsoft Store Developer CLI (msstore-cli) — Partner Center auth + Publish + Submission lifecycle + Flights + Rollout. Replaces the manual Partner Center web-UI submission.	tamp-msstore-cli

Azure + ADO ops

Package	Wraps	Reference
Tamp.AzureCli.V2	az 2.x — full subscription/resource/identity surface; access tokens typed as Secret	tamp-azure-cli
Tamp.Bicep	Bicep CLI (build, lint, format, version) plus az deployment group create via the unified facade	tamp-bicep
Tamp.AzureAppService	App Service slot orchestration + lifecycle (webapp deployment slot swap / list / create / delete)	tamp-azure-app-service
Tamp.Kudu	Azure App Service Kudu REST + adjacent Management API endpoints (vfs, command, config references)	tamp-kudu
Tamp.PostgresFlex	Azure Database for PostgreSQL Flexible Server admin — lifecycle, firewall, parameters	tamp-postgres-flex
Tamp.AzureFunctionsCoreTools.V4	Azure Functions Core Tools (func) 4.x — publish, log streaming, settings sync; access token typed as Secret via stdin	tamp-azure-functions-core-tools
Tamp.AzureStaticWebApps.V2	@azure/static-web-apps-cli (swa) — Azure SWA deploy CLI	tamp-azure-static-web-apps
Tamp.ServiceBus.V7 / V8	Azure Service Bus admin CRUD + topology convergence helper	tamp-servicebus
Tamp.AdoGit	PAT-injected git for Azure DevOps — bakes -c http.extraHeader=… into every fetch/push/clone	tamp-ado-git
Tamp.AdoRest.V7	Azure DevOps REST API 7.1 — typed surface for PRs, builds, service endpoints, environments, agent pools, branch policies; PAT typed as Secret	tamp-ado-rest
Tamp.AdoServiceConnection.V1	End-to-end ADO WIF (Workload Identity Federation) service connection creation — orchestrates az + ADO REST	tamp-ado-service-connection
Tamp.YouTrack	Typed YouTrack REST client. Issues create / update / search / set-state. Bearer auth via Secret-typed permanent token. Built on Tamp.Http.	tamp-youtrack

Classic Windows deploy chain (Wave 4)

Database publishing + on-prem IIS deploy chain for hybrid / modernized .NET stacks. Tamp.SqlPackage and Tamp.SqlCmd are cross-platform; Tamp.MSBuildClassic and Tamp.MsDeploy wrap Windows-only msbuild.exe / msdeploy.exe.

Package	Wraps	Reference
Tamp.SqlPackage	sqlpackage (Microsoft.SqlPackage dotnet tool) — .dacpac Publish / Extract / Script for SQL Server + Azure SQL. Cross-platform. Connection strings + AAD access tokens tracked as Secret.	tamp-sqlpackage
Tamp.SqlCmd	Cross-platform sqlcmd (go-sqlcmd) — RunScript (one or more .sql files) and RunInline (-Q "..."). Three mutually-exclusive auth modes enforced (SQL / Windows integrated / Azure AD). TLS knobs, SqlCmd variables, exit-on-error default true.	tamp-sqlcmd
Tamp.MSBuildClassic	Windows msbuild.exe for .NET Framework / legacy MSBuild projects. Separate from Tamp.DotNet — different CLI semantics (/p:Foo=Bar vs --property Foo=Bar), Windows-only runtime. Verbs: Build, Restore, Clean. URL-encodes ; and , in /p: values (per TAM-270).	tamp-msbuild-classic
Tamp.MsDeploy	Windows msdeploy.exe (Web Deploy) — Sync + Dump verbs with typed MsDeployProvider records (ContentPath, IisApp, Package, ArchiveDir, Custom) and typed MsDeploySkipRules. Payload sync only; site lifecycle is a separate future concern.	tamp-msdeploy

Supply-chain security

The Wave 1+2+3 security chain: SBOM + SAST + SCA + secrets producers, plus the typed contract packages and the one-import meta-package that wires them together.

Since 1.12.0 the wrapper packages below (Tamp.CycloneDx.V6, Tamp.OpenGrep, Tamp.OsvScanner.V2, Tamp.Trivy, Tamp.DependencyTrack.V1, Tamp.DefectDojo.V2) ship from their own tamp-build/tamp-* satellite repos on their own release cadence — they are no longer in the core monorepo, and their version line has diverged from Tamp.Core's. Only the contract packages (Tamp.Sarif, Tamp.Sbom) and Tamp.Security.Pipeline still ship from the core repo.

Contract packages (foundation)

Package	Role
Tamp.Sarif	Typed SARIF 2.1.0 record + SarifLog.LoadFromFile / SarifReader / SarifMerge.CombineDistinct + IFindingSource interface. The canonical wire format every producer emits and every sink (Tamp.DefectDojo.V2, tamp.findings) consumes.
Tamp.Sbom	Typed CycloneDX 1.6 / 1.7 record with first-class VEX support + ISbomSource / ISbomSink interfaces.

SBOM producers

Package	Wraps	Scope
Tamp.CycloneDx.V6	dotnet-CycloneDX 6.x	.NET projects — narrow signal but exact for managed dependency graphs
Tamp.Syft	Anchore syft 1.x (ScanDirectory / ScanImage / ScanArchive)	Universal — 20+ ecosystems (npm / PyPI / Cargo / Go / Maven / NuGet / Gem / Composer / Pub / Conan / …) plus file-level cataloging. The right SBOM producer for non-.NET source trees and container images.

Vulnerability + risk scanners

Package	Wraps	Concern
Tamp.TruffleHog.V3	TruffleHog 3 (git, github, filesystem, docker; PAT typed as Secret)	leaked secrets in source / git history
Tamp.CodeQL.V2	CodeQL 2 (database, github upload-results, resolve, pack, query; PAT via stdin)	code-pattern vulns (SQLi, XSS, taint)
Tamp.OpenGrep	OpenGrep 1.x — multi-vendor fork of Semgrep with stable licensing. SARIF default.	pattern-based SAST (multi-language)
Tamp.OsvScanner.V2	Google osv-scanner 2.x — reads the CycloneDX BOM and queries OSV.dev	cross-ecosystem CVE matching (npm / PyPI / Cargo / Go / Maven / NuGet / Packagist / Pub)
Tamp.Trivy	Aqua trivy — ScanImage / ScanConfig / ScanFs	container / IaC / filesystem misconfig + vulnerability + secret detection
Tamp.Grype	Anchore grype — reads Syft SBOMs. EPSS + KEV + CVSS composite 0-10 risk scoring. --fail-on severity for CI gating.	dep CVEs / vuln matching
Tamp.SonarScanner.V10 / Tamp.SonarScannerCli.V6	SonarScanner for .NET 10 + the standalone CLI	code quality + coverage gating
Tamp.Eslint.V9 (listed under JS/TS)	ESLint v9 — SARIF emit via @microsoft/eslint-formatter-sarif	TS/JS style + best-practice

Triage sinks + meta-package

Package	Role
Tamp.DependencyTrack.V1	REST client for OWASP Dependency-Track v4.x — upload CycloneDX BOM, poll async analysis to completion (uses Tamp.Polling.Until), export FPF findings for downstream passthrough to DefectDojo.
Tamp.DefectDojo.V2	REST client for DefectDojo v2 — import/reimport SARIF or FPF. First-push idempotency via product_name + auto_create_context.
Tamp.Security.Pipeline	One-import meta-package. Abstract SecurityPipelineBuild : TampBuild — adopters inherit, override SecurityProductName + SecuritySolutionPath, and get the full Sbom / SecurityScan* / SecurityPush / Security target chain for free. Wave 3.

Roslyn analyzer SARIF (SonarAnalyzer.CSharp + Roslynator.Analyzers + Microsoft.CodeAnalysis.NetAnalyzers) is activated via /p:IncludeSecurityAnalyzers=true and captured per-(project, TFM) via MSBuild's /p:ErrorLog. No separate satellite. See security-chain.md in the main repo for the assembled-chain narrative.

Accessibility

Package	Wraps	Reference
Tamp.AxeCore	@axe-core/cli for the scan + axe-sarif-converter for SARIF emission. Web accessibility findings land in the same SARIF pipeline as every other scanner, so they flow into DefectDojo / tamp-findings alongside SAST and SCA.	tamp-axe-core

Notifications

Package	Wraps	Reference
Tamp.Telegram	IBuildReporter implementation that posts build-outcome messages to a Telegram channel via the Bot API. FromEnvironment() factory reads TELEGRAM_BOT_TOKEN / TELEGRAM_CHAT_ID / TELEGRAM_BUILD_LABEL and returns null when missing (graceful skip).	tamp-telegram

Tamp.Slack (TAM-228) and Tamp.Discord (TAM-229) under the Tamp.Notify epic (TAM-227) are planned siblings; not yet shipped.

Source control / VCS

Package	Wraps	Reference
Tamp.GitHubCli.V2	gh CLI (release, pr, issue, api, repo, auth)	tamp-gh
Tamp.GitHubAttest	gh attestation subcommand — verify / sign / list GitHub Artifact Attestations (Sigstore-backed SLSA provenance for GitHub Actions builds).	tamp-gh-attest

Telemetry / observability backend

Package	Wraps	Reference
Tamp.Telemetry	OpenTelemetry emit-side bridge — wraps opentelemetry-dotnet SDK setup as a one-call adopter surface, so a build exports the ADR-0018 contract over OTLP without hand-wiring the SDK.	tamp-telemetry
Tamp.Ingest.V1	Typed C# client + DTOs for the tamp-ingest-v1 egress contract — sbom / findings / coverage / test-results / scan-runs / sbom-vulnerabilities. Implement against this if you're building your own sink.	tamp-ingest-v1
tamp-beacon (self-host server, not a NuGet package)	Self-hosted OpenTelemetry receiver + dashboard for Tamp builds. Ingests the ADR-0018 diagnostics contract (Tamp.Build / Tamp.Build.Targets / Tamp.Build.Commands sources + the Tamp.Build meter). Single Docker image bundling Postgres + Web Push.	tamp-beacon
tamp-findings (self-host server, not a NuGet package)	Security / quality dashboard with federal-readiness evidence. Ingests SARIF, CycloneDX SBOMs, coverage, test results, and SLSA / in-toto / DSSE provenance; scores each build against a risk policy; produces CISA SSDF attestations, VEX, POA&M, KEV exposure tracking, VDP metadata. Built on Tamp.Security.Pipeline, dogfooded on itself.	tamp-findings

Foundation libraries

Package	Role
Tamp.Http	Foundation TampApiClient base class for HTTP-API satellite wrappers — Secret-redacted auth, JSON serialization, error mapping. Plus HttpProbe.WaitForHealthy for post-deploy smoke. Shared substrate beneath Tamp.Kudu / Tamp.AdoRest.V7 / Tamp.MicrosoftStoreCli / Tamp.PostgresFlex / Tamp.YouTrack / Tamp.DependencyTrack.V1 / Tamp.DefectDojo.V2.
Tamp.Templates.AspNet	NuGet-distributed scaffold template loaded by tamp init --template aspnet. Preview; CLI 0.2.0+ resolves.

Editor integration

Tool	What it is	Install
Tamp for VS Code	VS Code extension: activity-bar targets tree (live from dotnet tamp --list --format=json), Run / Dry Run / View Plan via right-click or CodeLens above each Target Foo => _ => _.… declaration, plan-preview webview, hover docs, run history per workspace. Requires dotnet-tamp global tool 1.9.0+.	.vsix sideload from GitHub Releases — code --install-extension tamp-vscode.vsix. Not on the VS Code Marketplace yet (deferred).

A JetBrains Fleet sibling (tamp-fleet) is planned for v2 — see roadmap in the main README.

NuGet listing: https://www.nuget.org/profiles/tamp · the Tamp.* prefix is reserved to the project so every package on the listing carries the verified-publisher checkmark.

Common stacks (worked examples)

Several common adopter scenarios pair specific satellites together. Pick the family that matches your project shape:

• Polyglot Microsoft Store desktop app (Rust + Node + .NET → MSIX → Store): Tamp.Cargo → Tamp.Tauri.V2 → Tamp.Msix → Tamp.MicrosoftStoreCli, optionally + Tamp.Sccache for the Rust compile cache.
• Azure-deployed .NET service: Tamp.NetCli.V10 (build) + Tamp.EFCore.V10 (migrations) + Tamp.AzureCli.V2 (auth) + Tamp.Kudu (Kudu deploy) + Tamp.AzureAppService (slot swap).
• Helm-deployed cluster app: Tamp.Docker.V27 (image) + Tamp.Helm.V3 (chart) + Tamp.GitHubCli.V2 (release).
• Compliance-aware ship: any stack + Tamp.Security.Pipeline (one inheritance pulls in the full chain), with Tamp.DependencyTrack.V1 + Tamp.DefectDojo.V2 for triage sinks.
• Hybrid / modernized .NET on-prem deploy: Tamp.MSBuildClassic (legacy .sln) + Tamp.SqlPackage (.dacpac publish) + Tamp.SqlCmd (post-deploy seed scripts) + Tamp.MsDeploy (IIS payload sync).
• Integration tests with sidecars: Tamp.AdjacentContainer.Provisioning (CI-side generator) + Tamp.Docker.V27.Docker.Compose (lifecycle) + Tamp.AdjacentContainer (fixture-side) + Tamp.EFCore.V10 (migrations against the sidecar).

How satellites depend on Tamp.Core

Every satellite declares a Tamp.Core dependency in its .nuspec (driven by Directory.Packages.props). The dependency is a minimum, not a pin — NuGet's PackageReference semantics interpret Version="1.11.1" as >= 1.11.1, not == 1.11.1.

<!-- Inside a satellite's Directory.Packages.props: -->
<PackageVersion Include="Tamp.Core" Version="1.11.1" />

When an adopter has Tamp.Core 1.11.5 and pulls in a satellite that declared 1.11.1, NuGet resolves 1.11.5 — the satellite gets the newer Core transparently. No satellite re-publish is needed when Tamp.Core ships a minor or patch.

When does a satellite actually need to bump its Tamp.Core minimum?

Scenario	Bump?
Tamp.Core ships a patch (1.11.1 → 1.11.2)	No. Existing >= 1.11.1 dep is satisfied.
Tamp.Core ships a minor (1.11.x → 1.12.0)	No. Same reason.
Satellite wants to use new Core API (a new method, new analyzer)	Yes. Bump min to the version that introduced it.
Satellite gets tripped by a new analyzer rule	Yes, after fixing the violation.
Tamp.Core ships a major (1.x → 2.x)	Yes — breaking by SemVer. Sweep is expected.

Why this matters — and what changed in 1.6.0

Pre-1.6.0, a class of forced satellite-sweep DID exist: any satellite needing Secret.Reveal() had to be added to Tamp.Core/AssemblyInfo.cs's [InternalsVisibleTo] list, which forced a Tamp.Core minor bump and a satellite-side min-version bump. Across an onboarding wave that was a per-satellite sweep just to ship credential handling.

Tamp.Core 1.6.0 retired this via the TAMP004 analyzer. Secret.Reveal() is now public, gated by the analyzer instead of by IVT. Net-new satellites no longer require any Tamp.Core change to handle secrets — they just call Reveal() from inside their *Settings classes (the TAMP004-approved context). Satellite-sweep-per-Core-bump is the failure mode we eliminated.

NuGet range syntax (for reference)

If you want tighter intent than the default min-version semantics, NuGet supports the full SemVer range syntax:

Syntax	Means	npm equivalent
Version="1.11.1"	>= 1.11.1 (NuGet default)	^1.11.1 (close enough)
Version="[1.11.1]"	exactly 1.11.1	1.11.1
Version="[1.11.1,2.0.0)"	any 1.x >= 1.11.1	^1.11.1 precisely
Version="1.11.*"	floating — picks highest 1.11.x at restore	~1.11.0
Version="1.*"	floating — picks highest 1.x at restore	^1.0.0

Tamp's first-party satellites stay on the bare 1.11.1 form. It's already min-version semantics, and tighter pinning is an adopter choice (build script reproducibility) rather than something the satellite should impose.

Naming convention

Tamp.{ToolFamily}{.V{Major}}?

The .V{Major} suffix is present only when the wrapped tool's CLI surface breaks across majors. Recorded in ADR 0002 — Package naming convention.

Pattern	Example	Why
Pinned	Tamp.NetCli.V10	dotnet CLI breaks across majors; consumers on .NET 10 stay on V10 indefinitely
Pinned	Tamp.Docker.V27	Docker majors break wrapper code
Pinned	Tamp.Yarn.V4	Berry 4 broke from classic Yarn; future Berry 5 would be a sibling package
Pinned	Tamp.Vite.V5	Vite 6 reworked the build pipeline → new major → sibling package
Pinned	Tamp.Eslint.V9	ESLint v9 dropped legacy .eslintrc config in favor of flat config — breaking enough for a major-pinned wrapper
Unpinned	Tamp.OpenGrep	Single-major-line so far; will pin when a breaking V2 ships
Unpinned	Tamp.MSBuildClassic	Classic msbuild.exe is stable across .NET Framework versions

Decision rule: does the new tool major break wrapper code? If yes → new package. If no → keep the existing package and branch on the tool's reported version inside the wrapper.

1.11.1 naming reconcile

At Tamp.Core 1.11.1 (2026-05-17), two security-chain wrappers had their version pins reconciled:

• Tamp.OpenGrep.V1 → Tamp.OpenGrep (dropped the .V1 since OpenGrep was forked at 1.x and the project committed to surface stability — no prior 0.x to break compat with)
• Tamp.Syft.V1 → Tamp.Syft (same rationale; syft 1.x has held its CLI surface stable across minors)

The old .V1-suffixed packages remain on nuget.org at 1.11.0 but are superseded by the unsuffixed names at 1.11.1+. Adopters should migrate the package reference (same namespace and API) the next time they touch their Directory.Packages.props.

Module shape (what you'll see in every wrapper)

using Tamp.NetCli.V10;       // namespace = package name

// Single static class per module, named after the tool.
DotNet.Build(...)
DotNet.Pack(...)
Docker.Login(...)
Docker.Push(...)

Each verb takes an Action<TSettings> configurer or an already-populated settings instance, and returns a CommandPlan (1.2.0+ — object-init overloads fanned out across every first-party wrapper):

// fluent — chains read top-to-bottom
var plan = DotNet.Build(s => s
    .SetConfiguration(Configuration.Release)
    .SetNoRestore(true)
    .SetVerbosity(DotNetVerbosity.Minimal));

// object-init — flatter, integrates with target-typed new()
var plan = DotNet.Build(new()
{
    Configuration = Configuration.Release,
    NoRestore = true,
    Verbosity = DotNetVerbosity.Minimal,
});

// either way:
// plan.Executable == "dotnet"
// plan.Arguments  == ["build", "--configuration", "Release", "--no-restore", "--verbosity", "minimal"]

Both styles produce byte-identical CommandPlans. Settings classes are mutable while the configurer runs, then frozen into the returned CommandPlan. The runner takes care of dispatch.

When a wrapper takes a Secret

Wrappers handling sensitive values (passwords, tokens) accept the typed Secret parameter and emit the secret via stdin where the wrapped tool supports it:

Docker.Login(s => s
    .SetServer("registry.example.com")
    .SetUsername("ci")
    .SetPassword(RegistryPassword));   // Secret type, not string
// produces:
//   docker login --username ci --password-stdin registry.example.com
//   stdin: <password value>
//
// the password value is never on the command line, never in the
// process table, and is automatically registered with the executor's
// redaction table.

Building your own module

A first-party-shaped module is roughly:

1. New csproj Tamp.<Family>{.V<N>} referencing Tamp.Core.
2. Per-verb settings record (mutable, fluent setters).
3. Common base if the tool has shared knobs (verbosity, working directory).
4. Static class with one method per verb, returning CommandPlan.
5. Tests: argument shape, edge cases, secret handling.

Tamp.Docker.V27 is the worked example for a from-scratch module; Tamp.NetCli.V10 is the worked example with a shared base across multiple verbs. The most recent satellites (tamp-eslint, tamp-sqlpackage, tamp-sqlcmd, tamp-msdeploy) are good cribsheets for the current envelope (slnx + Directory.Build.props version pinning + dogfood Release workflow).

Schema-driven codegen for wrappers is on the roadmap (deferred ADR 0013) and will eliminate hand-authoring most of this; for now it's small enough to write by hand.

Where next

• Tamp.NetCli — full reference for the .NET SDK wrapper
• Tamp.Docker — full reference for the Docker wrapper
• Build Script Authoring — how to consume modules from a build script
• Tamp Analyzers — the compile-time analyzer family (TAMP001–TAMP006)