test(exports): close two holes in the exports-pairing guard

[sroussey]

Targets claude/wonderful-turing-rjtcnx-ai-types (#717), not main.

Two review findings, both the same shape: a guard test that does not guard what it claims. All changes are in packages/test/src/test/util/ExportTypesPairing.test.ts.

1. A browser block with types but no implementation defeated every check

collectBranches records a branch only when a string-valued implementation key is present, so a block like

"browser": { "types": "./dist/ai.browser.d.ts" }

produces no branch at all — it is invisible to all six rules, including the source-entry rule, which can only check targets a branch declared. Meanwhile Vite/webpack enter the browser condition, recognize no key in it, fall through to the outer "import", and bundle the node build, while tsc under customConditions: ["browser"] matches browser > types and type-checks against the browser declarations. That is the browser-typed-as-node inversion this file exists to prevent, reached by omission instead of by a wrong target.

browserSplitViolations now evaluates the empty-implementation case before the browser-source-entry guard, and the violation names the node target bundlers fall through to. Hoisting past if (!browserEntry.some(hasSourceEntry)) continue; is deliberate: the packages/* layout (stem node, no src/node.browser.ts) never reaches the guarded code, so an empty browser block there would carry the same bug unreported for every package in the repo.

Three fixtures: the openai manifest with its browser "import" deleted, the packages/storage layout with the never probe, and a healthy block that must stay silent. The first two assert findViolations and orderViolations are [] first — the go-red proof this file already uses.

2. "Source entry exists" proved only the .d.ts half

build-types runs tsgo over the package's whole src tree, so the existence of a source file is exactly what makes its declaration appear. The .js half comes from the hand-written entry lists in each package's build-code / build-browser / build-* scripts, which nothing read. Add providers/foo/src/ai.browser.ts and a browser block, forget to append ./src/ai.browser.ts to build-browser, and every check passed while dist/ai.browser.js was never emitted — the package publishes a browser condition pointing at a missing file.

New rule buildEntryViolations(manifest, exportsMap, scripts):

• collects every .js/.cjs/.mjs implementation target,
• derives its source entry from the dist stem, and
• requires a whole-token match (^|\s)\.?/?src/<stem>\.tsx?(\s|$) in the joined text of every build* script.

Whole-token matching is load-bearing in both directions: bun build --outdir ./dist/storage ./src/storage/browser.ts must satisfy the nested stem storage/browser (duckdb, sqlite), and ./src/ai.browser.ts must not satisfy the stem ai — a substring test would pass a package that builds only its browser bundle while publishing the node one. Unrecognized layouts are reported, not skipped.

Verified over every workspace manifest before committing: zero violations, exactly one exemption. That exemption (packages/workglow, whose build-js is bun run build.ts) is pinned in GLOB_BUILT_PACKAGES and guarded by a test asserting the exempted package really does hand its build to a repo-local *.ts program — matched as the token right after bun/bun run, so a .ts handed to bun build as an entry does not satisfy it. The exemption therefore dies with the custom build rather than quietly exempting a hand-written list.

This is a rule in this test file rather than a prepack assertion in publish-workspaces.ts, on purpose: the defect is that a guard test does not guard what it claims, so it must be able to fail the PR that introduces it. A prepack assertion fires after review and after merge.

3. Comment correction

The comment above it("declares only targets a source entry file can emit") claimed the source entry is "the cheapest evidence that the build produces the target at all". It now says a source entry is necessary for either half and sufficient for only the declaration, and points at the rule that covers the other half.

Verification

• bun scripts/test.ts util vitest — 54 files, 797 passed, 10 skipped.
• ExportTypesPairing.test.ts alone: 40 passed (was 25).
• Go-red: reverting only the browserSplitViolations hoist fails both new browser-split fixtures and nothing else.
• Dry-ran the build-entry rule over all 38 manifests with exports: zero violations.
• eslint clean, prettier --check clean on the changed file.

---

🤖 Generated with Claude Code

---

Generated by Claude Code

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	59.84%	37210 / 62176
🔵	Statements	59.35%	39044 / 65782
🔵	Functions	60.86%	7209 / 11844
🔵	Branches	48.06%	18902 / 39326

File Coverage

No changed files found.

Generated in workflow #3080 for commit e0a0b25 by the Vitest Coverage Report Action