refactor(liveshare-protocol): publish the mock identity provider on its own entry

A package that promises authentication-adjacent types must not hand production
callers a provider that fabricates principals from its public `./identity`
entry. The mock keeps its own `./identity/mock` export, the console face drops
it, and the entrypoint tests pin both halves.

packages/experimental/liveshare-protocol/package.json

@@ -19,6 +19,10 @@
       "types": "./lib/types/identity/index.d.ts",
       "default": "./lib/identity/index.js"
     },
+    "./identity/mock": {
+      "types": "./lib/types/identity/mock.d.ts",
+      "default": "./lib/identity/mock.js"
+    },
     "./protocol": {
       "types": "./lib/types/tunnel-protocol.d.ts",
       "default": "./lib/tunnel-protocol.js"
@@ -29,6 +33,7 @@
   "files": [
     "lib/index.js",
     "lib/identity/index.js",
+    "lib/identity/mock.js",
     "lib/tunnel-protocol.js",
     "lib/types/**/*.d.ts"
   ],

packages/experimental/liveshare-protocol/src/identity/index.ts

@@ -1,3 +1,2 @@
 export * from './types.ts'
-export * from './mock.ts'
 export * from './keys.ts'

packages/experimental/liveshare-protocol/tests/entrypoints.spec.ts

@@ -5,11 +5,17 @@ import * as identity from '@deepseek-ai/dsh-experimental-liveshare-protocol/iden
 import * as protocol from '@deepseek-ai/dsh-experimental-liveshare-protocol/protocol'
 import * as root from '@deepseek-ai/dsh-experimental-liveshare-protocol'
 
+it('publishes the mock identity provider only on its test-scoped entry', async () => {
+  const mock = await import('@deepseek-ai/dsh-experimental-liveshare-protocol/identity/mock')
+  expect(mock.MockIdentityProvider).toBeTypeOf('function')
+  expect('MockIdentityProvider' in root).toBe(false)
+})
+
 it('re-exports the protocol and identity contracts from the package root', () => {
   expect(root.LIVESHARE_PROTOCOL_VERSION).toBe(protocol.LIVESHARE_PROTOCOL_VERSION)
   expect(root.parseShareAccessState).toBe(protocol.parseShareAccessState)
   expect(root.identityKeyOf).toBe(identity.identityKeyOf)
-  expect(root.MockIdentityProvider).toBe(identity.MockIdentityProvider)
+  expect('MockIdentityProvider' in identity).toBe(false)
   expect(root.viewerCarrierScript).toBeTypeOf('function')
 })
 

packages/experimental/liveshare-protocol/tests/identity-mock.spec.ts

@@ -4,7 +4,7 @@ import { describe, expect, it } from 'vitest'
 import {
   MockIdentityProvider,
   type MockIdentityPersona,
-} from '@deepseek-ai/dsh-experimental-liveshare-protocol/identity'
+} from '@deepseek-ai/dsh-experimental-liveshare-protocol/identity/mock'
 
 /** The personas one provider is built from; the array stays writable so a test can empty it. */
 function personas(): MockIdentityPersona[] {

packages/experimental/liveshare-protocol/tsdown.config.ts

@@ -13,6 +13,7 @@ export default defineConfig(({ env }) => {
     entry: [
       'lib/types/index.js',
       'lib/types/identity/index.js',
+      'lib/types/identity/mock.js',
       'lib/types/tunnel-protocol.js',
     ],
     outDir: 'lib',

tsconfig.base.json

@@ -376,6 +376,7 @@
       "@deepseek-ai/dsh-experimental-inspector/client": ["./packages/experimental/inspector/src/client/index.ts"],
       "@deepseek-ai/dsh-experimental-liveshare-protocol": ["./packages/experimental/liveshare-protocol/src"],
       "@deepseek-ai/dsh-experimental-liveshare-protocol/identity": ["./packages/experimental/liveshare-protocol/src/identity/index.ts"],
+      "@deepseek-ai/dsh-experimental-liveshare-protocol/identity/mock": ["./packages/experimental/liveshare-protocol/src/identity/mock.ts"],
       "@deepseek-ai/dsh-experimental-liveshare-protocol/protocol": ["./packages/experimental/liveshare-protocol/src/tunnel-protocol.ts"],
       "@deepseek-ai/dsh-experimental-ptc-runtime-python": ["./packages/experimental/ptc-runtime-python/src"],
       "@deepseek-ai/dsh-util-crypto": ["./packages/util/crypto/src"],