package: ship declarations (dist/types, the "types" condition) and a Node JS entry for 'storebound'; Bun keeps the .ts source. 0.8.5 exported only cli/lib/config.ts, so tsc (next build, vue-tsc, tsc --noEmit) failed on a scaffolded storebound.config.ts and broke a Next app's build; a test type-checks the template against the packed entry under bundler / node16 / nodenext without @types/node. check fails on the template's own placeholders (Example Studio, bare example.com URLs and addresses)

tools/build-node.ts

@@ -5,7 +5,7 @@
 //   bun tools/build-node.ts            write dist/storebound.mjs (npm pack / publish run it: prepack)
 //   bun tools/build-node.ts --out <f>  write elsewhere (tests)
 // The bundle is checked for this machine's home and checkout paths (like the sidecar): nothing private may ship.
-import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { chmodSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join, relative, resolve } from 'node:path';
 import { privateStrings, ROOT } from './build-sidecars';
@@ -35,9 +35,51 @@ export function buildNode(out = NODE_BUNDLE): { path: string; bytes: number } {
   } finally { rmSync(dir, { recursive: true, force: true }); }
 }
 
+/** The package's import entry ('storebound', the ShipConfig types of storebound.config.ts): declarations in
+ *  dist/types for tsc (next build, vue-tsc, ts-loader: TypeScript never takes a package's .ts source as its types) and
+ *  dist/config.js for runtimes other than Bun (Bun keeps importing cli/lib/config.ts). */
+export function buildEntry(dir = join(ROOT, 'dist')): void {
+  const types = join(dir, 'types');
+  rmSync(types, { recursive: true, force: true });
+  const tsc = Bun.spawnSync([join(ROOT, 'node_modules', '.bin', 'tsc'), '-p', 'tsconfig.types.json', '--outDir', types], { cwd: ROOT, stdout: 'pipe', stderr: 'pipe' });
+  if (tsc.exitCode !== 0) throw new Error(`tsc (declarations) failed\n${tsc.stdout.toString()}${tsc.stderr.toString()}`);
+  if (!statSync(join(types, 'lib', 'config.d.ts'), { throwIfNoEntry: false })) throw new Error('no dist/types/lib/config.d.ts');
+  pruneDeclarations(types, 'lib/config.d.ts');
+  const js = Bun.spawnSync(['bun', 'build', 'cli/lib/config.ts', '--target=node', '--format=esm', ...NODE_EXTERNALS.flatMap(e => ['--external', e]), '--outfile', join(dir, 'config.js')], { cwd: ROOT, stdout: 'pipe', stderr: 'pipe' });
+  if (js.exitCode !== 0) throw new Error(`bun build (config entry) failed\n${js.stderr.toString()}`);
+  const leaked = privateStrings().filter(s => readFileSync(join(dir, 'config.js'), 'utf8').includes(s));
+  if (leaked.length) throw new Error(`dist/config.js contains private paths (${leaked.length})`);
+}
+
+/** Keeps the declarations reachable from `entry` (tsc emits one per file of the program) and makes them stand alone
+ *  in any project: relative imports get `.js` (node16 / nodenext need it), and `Buffer` becomes a local alias of
+ *  Uint8Array where the project may not have @types/node. Pure on the folder; returns the files kept. */
+export function pruneDeclarations(dir: string, entry: string): string[] {
+  const keep = new Set<string>();
+  const todo = [entry];
+  const spec = /(from\s+|import\()(['"])(\.{1,2}\/[^'"]+?)(?:\.js)?\2/g;
+  while (todo.length) {
+    const f = todo.pop()!;
+    if (keep.has(f)) continue;
+    keep.add(f);
+    for (const m of readFileSync(join(dir, f), 'utf8').matchAll(spec)) todo.push(join(dirname(f), `${m[3]}.d.ts`));
+  }
+  const walk = (d: string): string[] => readdirSync(join(dir, d), { withFileTypes: true }).flatMap(e => e.isDirectory() ? walk(join(d, e.name)) : [join(d, e.name)]);
+  for (const f of walk('.')) {
+    if (!keep.has(f)) { rmSync(join(dir, f)); continue; }
+    let t = readFileSync(join(dir, f), 'utf8').replace(spec, (_m, kw: string, q: string, p: string) => `${kw}${q}${p}.js${q}`);
+    if (/\bBuffer\b/.test(t)) t = `type Buffer = Uint8Array;\n${t}`;
+    if (/['"]node:|\bBun\./.test(t.replace(/\/\*[\s\S]*?\*\/|\/\/.*$/gm, ''))) throw new Error(`${f}: the package's declarations need Node or Bun types`);
+    writeFileSync(join(dir, f), t);
+  }
+  for (const d of walk('.').map(f => dirname(f))) if (!readdirSync(join(dir, d)).length) rmSync(join(dir, d), { recursive: true });
+  return [...keep].sort();
+}
+
 if (import.meta.main) {
   const i = process.argv.indexOf('--out');
   const t = Date.now();
   const r = buildNode(i >= 0 ? resolve(process.argv[i + 1]!) : NODE_BUNDLE);
   console.log(`node bundle -> ${relative(process.cwd(), r.path) || r.path} (${(r.bytes / 1e6).toFixed(2)} MB, ${((Date.now() - t) / 1000).toFixed(1)}s)`);
+  if (i < 0) { buildEntry(); console.log('package entry -> dist/types (declarations), dist/config.js'); }
 }

tools/scrub.ts

@@ -11,7 +11,7 @@ export interface Rule { id: string; re: RegExp; files?: RegExp; allow?: (m: stri
 const at = '@';
 export const RULES: Rule[] = [
   { id: 'email', re: new RegExp(`[A-Za-z0-9._%+-]+${at}[A-Za-z0-9.-]+\\.[A-Za-z]{2,}`, 'g'),
-    allow: m => /@example\.(com|org|net)$/i.test(m) || /@users\.noreply\./.test(m) || /@[0-9]x\.(png|jpe?g|webp)$/.test(m) },
+    allow: m => /@([a-z0-9-]+\.)*example\.(com|org|net)$/i.test(m) || /@users\.noreply\./.test(m) || /@[0-9]x\.(png|jpe?g|webp)$/.test(m) },
   { id: 'private-key', re: new RegExp('-----BEGIN [A-Z ]*PRIVATE ' + 'KEY-----\\s*[A-Za-z0-9+/=]{20,}', 'g'), wholeFile: true },
   { id: 'private_key-json', re: new RegExp('"private' + '_key"\\s*:\\s*"-----BEGIN', 'g') },
   { id: 'asc-key-file', re: new RegExp('AuthKey' + '_[A-Z0-9]{10}\\.p8', 'g') },