fix(build): emit package declarations with a blocking tsc pass

[FSM1]

Problem

The Desktop E2E (windows) job intermittently fails at the Build API step with:

Could not find a declaration file for module '@cipherbox/core'.   dist/index.js implicitly has an 'any' type.
Could not find a declaration file for module '@cipherbox/sdk-core'. dist/index.js implicitly has an 'any' type.

A plain rerun usually goes green, so it reads as flaky — but it is a silent build bug, not test timing.

Root cause

The workspace packages build with tsup using dts: true, which runs declaration emit as a separate pass concurrent with the JS emit. With clean: true, dist is wiped first, then index.js (fast esbuild pass) and index.d.ts (slow rollup-dts worker) race into the same dir. On Windows CI the dts worker intermittently fails to write index.d.ts (file locking / AV scan / timing) — yet tsup still exits 0.

The smoking gun in the failing run: Build desktop frontend ✓ passed (it runs the tsup package builds) while Build API ✗ failed on the missing declarations. So tsup left an incomplete dist (index.js, no index.d.ts) and exited 0; the downstream nest build (tsc) then couldn't find the types. Both core and sdk-core show up because sdk-core's dts pass depends on core's emitted types.

Fix

Stop relying on tsup's fragile concurrent dts. In each tsup-built package:

• tsup.config.ts: dts: false
• package.json: "build": "tsup && tsc -p tsconfig.build.json"
• new tsconfig.build.json: emitDeclarationOnly: true (test files excluded)

tsc runs after tsup and exits non-zero on any emit failure, so a JS-only dist can no longer slip through with exit 0 — the flake becomes impossible rather than rare.

Applied to all five tsup-built packages (crypto, core, api-client, sdk-core, sdk) since they share the identical failure mode; fixing only the two that failed today would leave the same latent flake in the rest.

Verification (local)

• All five packages emit dist/index.d.ts.
• @cipherbox/sdk build (consumes the other four) — clean.
• @cipherbox/api nest build (the exact failing CI step) — clean.
• @cipherbox/web tsc -b — clean.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated build configuration across multiple packages for improved TypeScript type declaration generation.
  • Adjusted version targets for package releases.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 7bdc8386-2f10-4137-8e0c-232e5fcb930a

📥 Commits

Reviewing files that changed from the base of the PR and between 9309412 and 025bdef.

⛔ Files ignored due to path filters (3)

• packages/api-client/package.json is excluded by !packages/api-client/**
• packages/api-client/tsconfig.build.json is excluded by !packages/api-client/**
• packages/api-client/tsup.config.ts is excluded by !packages/api-client/**

📒 Files selected for processing (13)

• packages/core/package.json
• packages/core/tsconfig.build.json
• packages/core/tsup.config.ts
• packages/crypto/package.json
• packages/crypto/tsconfig.build.json
• packages/crypto/tsup.config.ts
• packages/sdk-core/package.json
• packages/sdk-core/tsconfig.build.json
• packages/sdk-core/tsup.config.ts
• packages/sdk/package.json
• packages/sdk/tsconfig.build.json
• packages/sdk/tsup.config.ts
• release-please-config.json

---

Walkthrough

Across four monorepo packages (core, crypto, sdk-core, sdk), tsup's built-in dts generation is disabled and replaced with a sequential blocking tsc -p tsconfig.build.json step. Each package gains a new tsconfig.build.json that emits declarations only and excludes test/spec files. Version targets in release-please-config.json are also bumped for five packages/apps.

Changes

Declaration Build Pipeline Refactor

Layer / File(s)

Summary

Disable tsup dts and add per-package tsconfig.build.json packages/core/tsconfig.build.json, packages/core/tsup.config.ts, packages/core/package.json, packages/crypto/tsconfig.build.json, packages/crypto/tsup.config.ts, packages/crypto/package.json, packages/sdk-core/tsconfig.build.json, packages/sdk-core/tsup.config.ts, packages/sdk-core/package.json, packages/sdk/tsconfig.build.json, packages/sdk/tsup.config.ts, packages/sdk/package.json

Each package sets dts: false in its tsup config, introduces a tsconfig.build.json with emitDeclarationOnly: true and test/spec exclusions, and updates its build script to run tsup && tsc -p tsconfig.build.json.

Release Version Bumps

Layer / File(s)	Summary
release-please version targets release-please-config.json	release-as values incremented for apps/api (0.39.1), apps/web (0.44.0), packages/crypto (0.32.1), packages/api-client (0.39.1), and packages/sdk (0.35.1).

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Possibly related PRs

• FSM1/cipher-box#134: Adds a CI typecheck job that runs @cipherbox/crypto's build before executing tsc -b on apps/web, making it directly dependent on the declaration emission behavior changed in this PR.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: migrating from concurrent tsup-based declaration emission to a sequential blocking tsc pass to fix Windows CI build failures.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/tsup-dts-windows-flake

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install failed: dependency version conflict. Check your lock file or package.json.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Release Preview

Package	Bump	Label	Source
api	patch	release:api:fix	Direct (fix commit)
cipherbox-fuse	patch	release:cipherbox-fuse:fix	Cascade (api patch)
cipherbox-sdk	patch	release:cipherbox-sdk:fix	Cascade (api patch)
core	patch	release:core:fix	Direct (fix commit)
crypto	patch	release:crypto:fix	Direct (fix commit)
desktop	minor	release:desktop:fix	Cascade (crypto patch)
sdk	patch	release:sdk:fix	Direct (fix commit)
sdk-core	patch	release:sdk-core:fix	Direct (fix commit)
tee-worker	patch	release:tee-worker:fix	Cascade (core patch)
web	minor	release:web:fix	Cascade (api patch)

Cascade Details

• api patch -> web patch (direct dependency)
• core patch -> tee-worker patch (direct dependency)
• crypto patch -> desktop patch (direct dependency)
• api patch -> cipherbox-fuse patch (direct dependency)
• api patch -> cipherbox-sdk patch (direct dependency)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 63.90%. Comparing base (2657740) to head (025bdef).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #503      +/-   ##
==========================================
+ Coverage   63.80%   63.90%   +0.10%     
==========================================
  Files         140      141       +1     
  Lines       10633    10863     +230     
  Branches     1175     1205      +30     
==========================================
+ Hits         6784     6942     +158     
- Misses       3610     3678      +68     
- Partials      239      243       +4     

Flag	Coverage Δ
api	84.71% <ø> (-0.58%)	⬇️
api-client	84.71% <ø> (-0.58%)	⬇️
core	84.71% <ø> (-0.58%)	⬇️
crypto	84.71% <ø> (-0.58%)	⬇️
sdk	84.71% <ø> (-0.58%)	⬇️
sdk-core	84.71% <ø> (-0.58%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.