fix(wizard): resolve @cipherstash/auth via the node condition; gate typecheck

Closes the last open item from the #771 review — the 3 pre-existing
`AutoStrategy` tsc errors flagged as "would bite a future strict type gate".

**Root cause.** `@cipherstash/auth` uses conditional exports: `node` resolves
to `index.d.ts` (the full surface, including `AutoStrategy`), `default`
resolves to `wasm-types.d.ts` (which has no `AutoStrategy`). The wizard's
tsconfig sets `moduleResolution: "bundler"`, which does NOT include the `node`
condition, so tsc took the `default` branch and reported `AutoStrategy` as
missing on all three call sites — `agent/fetch-prompt.ts`, `agent/interface.ts`
and `lib/prerequisites.ts`.

Nothing was actually broken at runtime: the wizard is a Node CLI and always
loads the `node` branch. The types were simply resolved against the wrong
entry point.

**Fix.** Add `"customConditions": ["node"]`, matching what `packages/stack`,
`packages/prisma-next`, `packages/test-kit`, `packages/stack-drizzle` and
`packages/stack-supabase` already carry for the identical `protect-ffi`
conditional-export problem. `tsc --noEmit` now exits 0.

**Regression guard.** A type-level defect needs a type-level gate, or it comes
back silently — the wizard is built by tsup with `dts: false`, so the build
transpiles without ever typechecking, which is exactly why these three errors
sat in `main` unnoticed. Add a `typecheck` script and wire it into `tests.yml`
alongside the prisma-next gate (#684). Verified the gate fires: with
`customConditions` removed the step exits 2 on all three errors; restored, it
exits 0.

No changeset — `dts: false` means the published tarball is byte-identical.
Tooling only, no observable behaviour change.

Green: wizard 265 pass / 5 env-skipped, typecheck 0 errors; stash 770 pass /
53 files; `code:check` 0 errors.

Author: tobyhede

.github/workflows/tests.yml

@@ -146,6 +146,12 @@ jobs:
       - name: Typecheck (bench — guards the stack/stack-drizzle importers)
         run: pnpm exec turbo run build --filter @cipherstash/bench
 
+      # The wizard is built by tsup, which transpiles without typechecking, so
+      # nothing here caught the three `auth.AutoStrategy` resolution errors that
+      # sat in `main` until #771. Gate it so they cannot come back silently.
+      - name: Typecheck (wizard)
+        run: pnpm --filter @cipherstash/wizard run typecheck
+
       - name: Lint — no hardcoded package-manager runners
         run: pnpm run lint:runners
 

packages/wizard/package.json

@@ -26,6 +26,7 @@
 		"postbuild": "chmod +x ./dist/bin/wizard.js",
 		"dev": "tsup --watch",
 		"test": "vitest run",
+		"typecheck": "tsc --project tsconfig.json --noEmit",
 		"lint": "biome check ."
 	},
 	"dependencies": {

packages/wizard/tsconfig.json

@@ -7,6 +7,17 @@
     "allowJs": true,
     "esModuleInterop": true,
     "moduleResolution": "bundler",
+
+    // `@cipherstash/auth` uses conditional exports — `node` picks `index.d.ts`
+    // (the full surface, including `AutoStrategy`), `default` picks
+    // `wasm-types.d.ts` (which has no `AutoStrategy`). Bundler resolution does
+    // not include `node` by default, so without this the wizard's three
+    // `auth.AutoStrategy` call sites fail to typecheck even though they run
+    // fine — the wizard is a Node CLI and always loads the `node` branch.
+    // Matches `packages/stack`, `packages/prisma-next`, `packages/test-kit`,
+    // `packages/stack-drizzle` and `packages/stack-supabase`.
+    "customConditions": ["node"],
+
     "allowImportingTsExtensions": true,
     "verbatimModuleSyntax": true,
     "noEmit": true,