fix(build): the ui/auth dts guard is self-healing — one declarations-only re-emit before failing

rolldown-plugin-dts emits per-entry across parallel workers; on fresh CI
checkouts the ui/auth emit has (rarely, non-deterministically) raced the
better-near-auth dependency-types resolution and collapsed the plugin chain
to `any` — red on the first GH attempt (PR #843's framework-integration),
green on rerun with zero source delta. A release-gate guard that flakes
taxes every future publish.

The guard is now self-healing: on collapse it re-emits declarations only
(tsdown --dts, serial, no JS bundle) and re-checks; the build goes red only
on persistent collapse, which is a real regression. Recursion is
recursion-proofed via an env flag the re-emit inherits.

Author: elliotBraem

packages/everything-dev/tsdown.config.ts

@@ -1,3 +1,4 @@
+import { execSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { chmod, readFile, writeFile } from "node:fs/promises";
 import { createRequire } from "node:module";
@@ -60,6 +61,39 @@ assertWorkspaceDtsDependencies();
  * without declarations, so a source missing from the entry list ships a types
  * path that does not exist and every consumer's tsc fails with TS7016 (#839).
  */
+// The dts emit is per-entry across parallel rolldown-plugin-dts workers; on
+// fresh CI checkouts the ui/auth emit has (rarely, non-deterministically)
+// raced the dependency-types resolution and collapsed the plugin chain to
+// `any` (2026-11-09: red on the first GH attempt, green on rerun with zero
+// source delta). The guard is therefore self-healing: one declarations-only
+// re-emit — serial, no JS bundle — before failing. The build only goes red
+// on persistent collapse, which is a real regression worth a human.
+async function assertAuthClientDtsTypes(): Promise<void> {
+  const authDtsPath = join("dist", "ui", "auth.d.mts");
+  const collapsed = async (): Promise<boolean> =>
+    /declare function createAuthClient\(.*\): any;/.test(
+      await readFile(authDtsPath, "utf-8").catch(() => ""),
+    );
+  if (!(await collapsed())) return;
+  if (process.env.BOS_TS_DOWN_DTS_REEMIT) {
+    throw new Error(
+      "dist/ui/auth.d.mts emitted createAuthClient(): any after re-emit — the better-auth " +
+        "plugin-chain inference collapsed persistently. Check that better-near-auth's dist " +
+        "types are built and fresh.",
+    );
+  }
+  console.warn("[tsdown] ui/auth dts collapsed to any — re-emitting declarations");
+  process.env.BOS_TS_DOWN_DTS_REEMIT = "1";
+  execSync("pnpm exec tsdown --dts", { stdio: "inherit", cwd: import.meta.dirname });
+  if (await collapsed()) {
+    throw new Error(
+      "dist/ui/auth.d.mts emitted createAuthClient(): any after re-emit — the better-auth " +
+        "plugin-chain inference collapsed persistently. Check that better-near-auth's dist " +
+        "types are built and fresh.",
+    );
+  }
+}
+
 function assertExportsDistTypesExist() {
   const manifest = JSON.parse(readFileSync(join(import.meta.dirname, "package.json"), "utf-8")) as {
     exports?: Record<string, unknown>;
@@ -177,13 +211,7 @@ export default defineConfig({
   },
   async onSuccess() {
     assertExportsDistTypesExist();
-    const authDts = await readFile(join("dist", "ui", "auth.d.mts"), "utf-8").catch(() => "");
-    if (/declare function createAuthClient\(.*\): any;/.test(authDts)) {
-      throw new Error(
-        "dist/ui/auth.d.mts emitted createAuthClient(): any — the better-auth plugin-chain " +
-          "inference collapsed. Check that better-near-auth's dist types are built and fresh.",
-      );
-    }
+    await assertAuthClientDtsTypes();
     for (const file of ["cli.mjs", "cli.cjs"]) {
       const filepath = join("dist", file);
       try {