test(cli): the subpath pin asserts the ts-morph borrow before making it

The pin symlinks `ts-morph` in from the workspace so the packed extractor can
be EXECUTED and not merely resolved. That borrow was unconditional: had the
entry left `dependencies` (it is `^28.0.0` there today), an installed copy of
the tarball would fail the free-identifiers path with ERR_MODULE_NOT_FOUND
while this pin — handing itself a copy no consumer receives — stayed green.
A pin asserting a public surface works when it does not.

`beforeAll` now asserts `MANIFEST.dependencies['ts-morph']` before symlinking,
with a failure message naming what the borrow hides and what a real consumer
would hit instead.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D47qPfEWVPmhguWgBZCi5N

Author: claude

packages/cli/test/published-subpath-hook-body.pin.test.ts

@@ -41,6 +41,9 @@
  * card measured. The one thing borrowed from the workspace is the tarball's own
  * runtime dependency `ts-morph`, symlinked in so the extractor can be EXECUTED
  * from the packed copy and not merely resolved; resolution never consults it.
+ * That borrow is guarded rather than assumed: `beforeAll` asserts the manifest
+ * still declares `ts-morph` under `dependencies` before symlinking, because the
+ * copy this file hands over is a copy a real consumer would never receive.
  *
  * ## What this file deliberately does NOT do
  *
@@ -86,6 +89,12 @@ interface Manifest {
   name: string;
   version: string;
   exports: ExportsMap;
+  /**
+   * Optional on purpose: a manifest that no longer declares `ts-morph` has to be
+   * REPRESENTABLE here, so the borrow guard in `beforeAll` is what fails — not
+   * a type assertion quietly promising a key the file on disk may not carry.
+   */
+  dependencies?: Record<string, string>;
 }
 
 const MANIFEST = JSON.parse(readFileSync(join(PACKAGE_ROOT, 'package.json'), 'utf8')) as Manifest;
@@ -281,6 +290,18 @@ beforeAll(() => {
   // The extractor's one runtime dependency, so `import()` can EXECUTE it from
   // the packed copy. A real-path symlink: pnpm's store keeps ts-morph's own
   // dependencies beside the real directory, and Node resolves from there.
+  //
+  // ⛔ Never borrow it unconditionally. A consumer receives `ts-morph` only
+  // because the PUBLISHED manifest declares it a runtime dependency; this file
+  // hands itself a copy the consumer would not have, so the premise is asserted
+  // BEFORE the symlink can paper over its absence.
+  expect(
+    MANIFEST.dependencies?.['ts-morph'],
+    `${PACKAGE_NAME} must declare ts-morph in "dependencies" — the symlink below borrows it from this workspace, ` +
+      'but an installed copy of the tarball receives it only from that manifest entry. Moved to devDependencies or ' +
+      'dropped, the free-identifiers path would fail with ERR_MODULE_NOT_FOUND for every real consumer while this ' +
+      'pin, supplying its own copy, stayed green.',
+  ).toBeTypeOf('string');
   symlinkSync(realpathSync(join(PACKAGE_ROOT, 'node_modules', 'ts-morph')), join(consumer, 'node_modules', 'ts-morph'), 'dir');
 
   const probePath = join(consumer, 'probe.mjs');