feat(cli): ratify ./console as a public subpath export — the out-of-repo consumer #13123 predicted

[hotlong]

What

One deliberate door in the CLI's exports map: "./console" → dist/utils/console.{js,d.ts} — the self-contained static-serve util (resolveConsolePath / hasConsoleDist / createConsoleStaticPlugin + drift-guard helpers; fs/path only, no oclif).

Why

#13123 sealed the CLI behind an exports map and its own body names this exact remedy for an out-of-repo consumer: ratify the subpath as public surface rather than read dist/ paths. That consumer exists — cloud's objectos-runtime node server mounts the Console SPA through this util, formerly via @objectstack/cli/dist/utils/console.js. Under the sealed map that specifier now fails at both layers:

• types: tsup DTS refuses with TS2307 (measured on cloud's pin-bump build);
• runtime: ERR_PACKAGE_PATH_NOT_EXPORTED, which the consumer's defensive catch turns into a silent API-only boot — a working deployment loses its console with nothing but a warn line.

Duplicating the util in cloud was rejected: it is 654 lines carrying the objectui-pin drift guards (#7752) and the mount-decision policy — a fork would drift by construction.

Scope

The surface grows by ONE named door, not back to "everything under dist/". check:published-files' GATED invariant stays green (the map names real entries); census floor untouched. Changeset: @objectstack/cli minor.

Gates at this head

Full 71-package build, full-repo lint, check:published-files, check-empty-changeset — all exit 0. Cloud-side consumer verified against a locally patched checkout of this exact map: runtime resolution returns all three functions, objectos-runtime DTS builds green, and cloud's five harness suites pass.

🤖 Generated with Claude Code

[github-actions]

📓 Docs Drift Check

⚠️ 1 changed file(s) yielded no anchor (packages/cli/package.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/cli/package.json) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 23 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c45d8e6b4ef915004f091e03134a9314587df13d → packageMentionDocs.