Area: sdk · infra — gap · found via codebase/CI sweep (pm-triage)
Expected: CI proves the artifacts we publish actually load. @wavehouse/sdk ships three entry points — dist/index.cjs (main + exports["."].require), dist/index.js (ESM), and dist/index.global.js (the IIFE served by unpkg/jsdelivr) — so a change that breaks any of them should redden a run.
Actual: nothing anywhere loads a built artifact. Every test in clients/ts and tests/e2e/sdk runs the ESM source through Vitest; no workflow, Makefile target, or script references dist/index.cjs or dist/index.global.js (the only repo-wide mention of dist/index.cjs is a comment in .github/dependabot.yml:80). tsup.config.ts builds all three; pnpm install only proves they build, never that they import.
Impact: a packaging break ships green. #491 proposed eventsource-parser@4 — ESM-only, no require condition — which would have made require("@wavehouse/sdk") throw ERR_REQUIRE_ESM on Node 22.0–22.11, inside our own advertised engines.node: ">=22" range. CI went fully green; the break was caught by a human reading the diff (see #492). .nvmrc is 22, which floats to the newest 22.x (above the 22.12 require(esm) line), so even a Node-version matrix as configured today would not have caught it.
Scope: a post-build smoke step is the smallest useful form — load each artifact and assert the export surface — ideally pinned at the oldest Node in the supported range rather than .nvmrc's floating 22.x.
Related: #492 (the eventsource-parser v3 hold this gap allowed; explicitly suggests splitting this out), #487 (the TS 6 hold — same prepare-time build path), #268 (npm publishing follow-ups), #441.
From a codebase/CI sweep (pm-triage all routine); validated by code-read against 2a0dbe64 on 2026-08-19.
Area: sdk · infra — gap · found via codebase/CI sweep (pm-triage)
Expected: CI proves the artifacts we publish actually load.
@wavehouse/sdkships three entry points —dist/index.cjs(main+exports["."].require),dist/index.js(ESM), anddist/index.global.js(the IIFE served by unpkg/jsdelivr) — so a change that breaks any of them should redden a run.Actual: nothing anywhere loads a built artifact. Every test in
clients/tsandtests/e2e/sdkruns the ESM source through Vitest; no workflow,Makefiletarget, or script referencesdist/index.cjsordist/index.global.js(the only repo-wide mention ofdist/index.cjsis a comment in.github/dependabot.yml:80).tsup.config.tsbuilds all three;pnpm installonly proves they build, never that they import.Impact: a packaging break ships green. #491 proposed
eventsource-parser@4— ESM-only, norequirecondition — which would have maderequire("@wavehouse/sdk")throwERR_REQUIRE_ESMon Node 22.0–22.11, inside our own advertisedengines.node: ">=22"range. CI went fully green; the break was caught by a human reading the diff (see #492)..nvmrcis22, which floats to the newest 22.x (above the 22.12require(esm)line), so even a Node-version matrix as configured today would not have caught it.Scope: a post-build smoke step is the smallest useful form — load each artifact and assert the export surface — ideally pinned at the oldest Node in the supported range rather than
.nvmrc's floating 22.x.Related: #492 (the
eventsource-parserv3 hold this gap allowed; explicitly suggests splitting this out), #487 (the TS 6 hold — sameprepare-time build path), #268 (npm publishing follow-ups), #441.From a codebase/CI sweep (pm-triage
allroutine); validated by code-read against2a0dbe64on 2026-08-19.