fix(social): stop the import barrel re-exporting Node-only code

[crs48]

What

packages/social/src/import/index.ts did export * from './node'. Since the package root barrel (packages/social/src/index.ts) does export * from './import', the Node-only archive-reader.ts — which imports node:fs, node:zlib, node:stream, node:crypto — was reachable from every browser bundle that touches @xnetjs/social.

One line changed:

-export * from './node'
+export * from './core'

Why

This already broke apps/web once (July 2026), failing Build packages and with it the production deploy-site run:

archive-reader.ts (15:27): "promises" is not exported by "__vite-browser-external"

It stopped reproducing when the editor swap changed what apps/web pulls in — but the hazard was one import away from returning.

The package already declares the split it wants via its exports map: ./import/core (browser-safe), ./import/browser, ./import/node. The barrel simply named the wrong one. This also aligns with the sub-barrel policy in CLAUDE.md.

node.ts is export * from './core' plus the zip helpers, so core is a strict subset — nothing else is lost.

Verification

Probed the package root with a browser-platform bundle:

barrel target	node:* builtins reaching the browser graph
'./node' (before)	6 — crypto, fs, path, stream, stream/promises, zlib
'./core' (after)	0

apps/web's own build isn't a sensitive test any more (it no longer imports that path), which is why the direct probe matters.

Also green, on node v23.11.1:

• pnpm --filter "xnet-web..." build — passes (baseline established first, then re-run with the change)
• npx vitest run src/__tests__/archive-reader.test.ts from packages/social — 4/4 pass (not in the root vitest project list)
• turbo typecheck --filter @xnetjs/social and --filter xnet-desktop — clean

Consumers

Three reach the Node-only symbols (createZipJsonEntryReader, createZipTextEntryReader, readZipArchiveManifest):

• packages/social/src/__tests__/archive-reader.test.ts — went through the barrel, repointed to ../import/node
• apps/electron/src/main/social-import-ipc.ts — already on @xnetjs/social/import/node, unchanged
• scripts/benchmark-social-import-fixtures.ts — already on ../packages/social/src/import/node.ts, unchanged

Notes

@xnetjs/social is private, so no changeset. No user-visible behaviour change, so skip-changelog.

🤖 Generated with Claude Code

[github-actions]

🖼️ UI changes in this PR

No visual differences detected in the changed UI.

_{CI run}

[github-actions]

Preview removed for PR #595.

[crs48]

Closing as already landed. The change is byte-identical to main today:

$ git diff origin/main pr595 -- packages/social/src/import/index.ts \
    packages/social/src/__tests__/archive-reader.test.ts
# (empty)

main's barrel is already export * from './core', landed by fbc2965a2 feat(social): add browser-safe import staging. The branch is 864 files behind, so merging would be a no-op. Triage: docs/explorations/0410_[_]_OPEN_PR_TRIAGE_AND_THE_STRANDED_BRANCH_PROBLEM.md.