fix: detect content drift in generated webiny package during validation

[adrians5j]

Problem

validate-webiny-package said "The `webiny` package is up to date" even when export code had been added directly into the generated webiny package, instead of following the source src/exports folder convention (e.g. packages/app-admin/src/exports/*.ts).

Root cause — the validation only ever checked two things:

1. An inputs hash computed from source export files (packages/*/src/exports/**/*.ts), @webiny/icons src, and src-static. Nothing from the generated webiny/src output feeds the hash, so hand-editing generated files can't move it.
2. File paths — the deep check asserted expected paths exist and no extra paths are present, but never compared file contents.

So a hand-edit that added exports into an already-expected generated file changed neither the hash nor any path. Validation passed. The next generate-webiny-package run then rebuilt from source and silently wiped those edits.

Fix

Add a content comparison of each expected file against its on-disk counterpart in the deep check.

Comparison is whitespace-normalized (\s+ → single space, trimmed): committed files are oxfmt-formatted (multi-line, wrapped at print width) while computeGenerationResult() returns raw, unformatted merge output. Normalizing absorbs that cosmetic difference while still catching any added / removed / renamed export or changed module path — exactly the hand-edit class that previously slipped through.

Verification

Case	Before	After
Clean repo	up to date	✅ up to date
Export hand-edited into webiny/src	up to date (bug)	✅ admin.ts (content drift) → exit 1

Known remaining blind spots (not addressed here)

• .tsx files in src/exports are silently skipped (ScanExportsFoldersService.ts .ts-only filter).
• Only packages/* are scanned — root extensions/ is never seen.

🤖 Generated with Claude Code

---

Confirmed against a real occurrence (2026-09-10)

This is no longer hypothetical. In #5673 I hand-wrote HttpRouteHandler / HttpRouteDefinition exports straight into the generated packages/webiny/src/api.ts, because event-handler-core had no src/exports/ folder. Validation reported "The webiny package is up to date", it merged, and the next generate-webiny-package run wiped the exports — caught only because a human noticed.

All three existing checks passed, for exactly the reasons above:

Check	Why it passed
Inputs hash	Only source src/exports/**, icons src and src-static feed it. Editing the output cannot move it.
File paths	api.ts was expected and present.
exports field	./api already existed from other packages, so the map was unchanged.

Re-verified on this branch after merging next:

• clean repo → The webiny package is up to date.
• the same hand-edit re-applied → api.ts (content drift), exit 1

The real fix in that case was to give event-handler-core a src/exports/api.ts, which is what the convention wants. This check is what makes that mistake fail loudly instead of silently.

[github-actions]

🚓 Slop Cop

✅ Nothing worth flagging. The diff looks consistent with the PR's stated intent and the code-style rules.

_{Automated, non-blocking heads-up from an LLM. It can be wrong — use your judgment. Regenerates on every push.}