feat(tooling): onboard packages/plugins/** into check:test-typecheck (#14062)

[claude]

Fixes #14062

All fourteen packages/plugins/** packages now have a tsconfig.test.json that
the shared check:test-typecheck gate compiles, and each package's typecheck
script names it. The four that measure non-zero carry a generated, EXACT,
shrink-only starting ledger; the ten that measure zero deliberately carry none.

The ruling this implements

Director seat, comment 5494659007, 2026-09-01, maintainer verbatim 「同意」 —
quoted in full because item 2 is the #5286 authority any ledger-expansion gate
or reviewer needs to see:

1. 收编:14 个插件包全部进入 check:test-typecheck 仪器族 —— 每包 tsconfig.test.json + 起始台账条目按各包实测数入册(shrink-only,plugin-approvals 从 345 起);
2. @ts-expect-error 退役 pin 在 packages/spec 里是幽灵检查:tsconfig 把 **/*.test.ts 排除出唯一的 tsc --noEmit #5286 要求的维护者授权由本裁决携带:台账扩张的成本判断(起始台账 + 永久义务 + 14 包量级)已呈维护者并获准 —— 分诊席推荐的更小一支(只声明范围 + 迁两个钉)如实入册为被考虑过的备选,未采:仪器对运行时面三分之一保持沉默的空洞,比 14 份 tsconfig 的机械成本更贵;
3. 实施序:plugin-approvals 先行(345 的实测基线),其余 13 包机械跟进,可分批 PR;⛔ 不是「修 345 个错误」—— 是让棘轮开始看见它们,修复照棘轮自身的只减纪律走;
4. 既有编译期钉(exec-context-annotation.pin.ts、manager-org-screen-parity.contract.test.ts)随收编自动变真,⛔ 不迁址;
5. 相邻不合卡维持:[finding] packages/objectql's tsc program excludes **/*.test.ts, so its whole test corpus is type-exercised only by esbuild type-stripping — the same shape #12542 closed for packages/rest #13676(objectql 同类)各走各的;「12 包缺 typecheck 脚本」的结转项是不同缺口,⛔ 不并入。

One PR rather than two: the whole change is config plus generated ledgers, and
no test file is edited. Item 5 is honoured — #13676, #14173 and #14181 are not
touched here.

The table

Measured at e80889095 with the workspace closure built first, re-verified on
the merged tree. "BUILD semantics" is the package's own tsconfig.json options
with only the test exclusion lifted; "THIS config" adds vitest's module
semantics. --listFiles counts are the program's own, not a grep.

package	test files in program	program files	errors, BUILD semantics	errors, this config	ledger
plugin-approvals	35	540	345	324	8 files / 27 signatures
plugin-auth	87	1177	94	94	10 files / 23 signatures
plugin-sharing	30	488	3	3	2 files / 3 signatures
knowledge-ragflow	1	388	4	3	1 file / 1 signature
plugin-security	94	598	2	0	none (already at zero, #13176)
plugin-audit	22	496	0	0	none
plugin-email	28	469	0	0	none
plugin-hono-server	20	438	0	0	none
plugin-webhooks	11	433	0	0	none
plugin-dev	6	914	0	0	none
plugin-reports	5	424	0	0	none
plugin-pinyin-search	2	424	0	0	none
embedder-openai	1	371	0	0	none
knowledge-memory	1	388	0	0	none

The card's 345 reproduces exactly by the card's own recipe (the package
tsconfig with exclude reduced to ["dist","node_modules"]) at today's HEAD.
The ledger reads 324 because tsconfig.test.json matches vitest's module
semantics, which subtracts 21 diagnostics about the CHECK and not one line of
test code: 20 x TS2550 (lib: ES2021 older than es2022) + 1 x TS1470
(import.meta in a CommonJS program). Fixing the config first and reading the
residue afterwards is the #4311 discipline, and both numbers are recorded in
the config header and the ledger _note so neither can be mistaken for the
other later.

No ledger for a zero package, on purpose. Verified reading:
check:test-typecheck treats a missing ledger as { entries: {} } and prints
0 file(s) / 0 error(s) / 0 pinned signature(s), under which any error in any
file is red immediately with no entry to be added to. That is strictly stronger
than a ledger holding nothing, and it is the call plugin-security had already
recorded for itself. gen:test-typecheck-debt is wired only where a ledger
exists, so no package carries a generator whose only possible output is an empty
file.

Two corrections to the finding, both measured

Recorded rather than smoothed over, because the ruling's item 4 rests on the
second one.

1. The exclusion was narrower than "no plugin package has a tsc program that
compiles its tests." Measured per package with tsc --listFiles -p tsconfig.json: nine of the fourteen (embedder-openai, knowledge-memory,
plugin-audit, plugin-dev, plugin-email, plugin-hono-server,
plugin-pinyin-search, plugin-reports, plugin-webhooks) never excluded their
tests, so tsc --noEmit already compiled them — at zero errors. The finding's
own table is accurate as written (14 packages, 1 tsconfig.test.json, 0
check:test-typecheck scripts) and the 345 is exact; the generalisation in the
headline is not. Three packages hid their tests behind **/*.test.ts
(approvals 35, auth 87, sharing 30) and knowledge-ragflow was silent the other
way round — its tests were in the build program, but the package declared no
typecheck script at all, and turbo run typecheck cannot run a script that
does not exist. 153 test files newly come under a type check that actually
runs.

2. exec-context-annotation.pin.ts was never a phantom pin. It is a
.pin.ts, and **/*.test.ts does not match it, so it was in the build program
all along. Control measurement in the ablation below: deleting one of its
directives reddens the build config too. The pin this change genuinely makes
real is plugin-approvals/src/manager-org-screen-parity.contract.test.ts — a
.test.ts that no tsc program had ever read. Ruling item 4 holds for that one;
for the other it was already true. Repo-wide sweep for the general case: no
@ts-expect-error directive anywhere in packages/plugins/** was actually
phantom before this PR (the eight files carrying directives are all either
.pin.ts, or in a package whose build config includes tests, or in
plugin-security which was wired in #13176).

Ablations — the gate really reds, and the restore really restored

Both run from a committed implementation, so the restore leg has a real
reference; both prove the mutation reached disk before reading anything, and
prove the restore by content hash against the HEAD blob rather than by an exit
code.

A. An unledgered file in the newly compiled zone (the load-bearing one:
this file is in NO tsc program on main).

target  packages/plugins/plugin-approvals/src/manager-org-screen-parity.contract.test.ts
HEAD blob            a010631b3d220db32d6eaa36a1ea5d23c266650c
pre-mutation hash    a010631b3d220db32d6eaa36a1ea5d23c266650c
injected marker occurrences: 1        post-mutation hash d6470da16c16cb3111954d23295874471b9b781b
MUTATED EXIT=1
  • src/manager-org-screen-parity.contract.test.ts: 2 type error(s) in a file the ledger does not
    cover. Fix them — this file is inside the checked zone, which is the point of tsconfig.test.json.
    (A deleted `@ts-expect-error` shows up exactly here, as TS2578/TS2694.) … ⛔ MAINTAINER-ONLY …
restored hash        a010631b3d220db32d6eaa36a1ea5d23c266650c   (== HEAD blob)
git diff HEAD -- TARGET: empty      marker occurrences after restore: 0
RESTORED EXIT=0 — 8 file(s) / 324 error(s) / 27 pinned signature(s)

B. Deleting a compile-time pin directive, with the control that says what
this PR did and did not change.

target  packages/plugins/plugin-approvals/src/exec-context-annotation.pin.ts
HEAD blob 502cebae33222e7b3f7d451c9e9217ebc80b4d95   directive occurrences before: 1, after: 0
post hash 0f45c8617a91937fbaa8479efb1d1aabc337714c
MUTATED EXIT=1
  • src/exec-context-annotation.pin.ts: 1 type error(s) in a file the ledger does not cover. …
CONTROL — the same deletion against the BUILD config (tsconfig.json), i.e. what `main` already ran:
  BUILD-CONFIG EXIT=2
  src/exec-context-annotation.pin.ts(135,39): error TS2322: Type '"SUPERUSER"' is not assignable to …
restored hash 502cebae33222e7b3f7d451c9e9217ebc80b4d95   (== HEAD blob)   directives after restore: 1
git diff HEAD -- TARGET: empty

The control is the point: this directive was live before the PR, and correction
2 above is that reading rather than a claim.

What else moved, and why

scripts/check-type-check-coverage.mjs — four ledger entries graduated.
plugin-approvals (345), plugin-auth (94) and plugin-sharing (3) leave
TEST_DEBT; knowledge-ragflow (4) leaves DEBT. ⛔ None was paid down. The
gate itself named all four as graduated once the programs existed, and the same
errors are now held one level finer — per file and per signature — in each
package's own test-typecheck-debt.json. A block above TEST_DEBT records
that, because a deleted debt entry normally means the errors are gone and here
it does not.

scripts/check-type-source-resolution.mjs — a re-baseline on the registry's
documented onboarding limb (#11490). Thirteen new tsconfig.test.json move
the program set, which #11490 made a package's prerogative. All three of that
doc-block's conditions are met and stated in place: every dep admitted is
annotated via tsconfig.test.json by the gate's own failure text (condition 1 —
none is newly reached through a program that was already counted); the numbers
are stated (condition 2) —

before (merge base 79b6a22a5)   98 programs / 77 packages, 54 entries, 242 package-dep pairs
after                          111 programs / 77 packages, 55 entries, 269 package-dep pairs

— so +13 programs, +1 entry (plugin-dev, which had none) and +27 pairs; and it
is reviewed as a re-baseline, not an escape from red (condition 3). ⛔ paths
is deliberately not the tool here, by that doc-block's own measurement on PR
#12570. Nine of the onboarded packages add zero pairs.

scripts/regen-artifacts.mjs — four NOT_DRIVER_MANAGED rows, one per new
ledger. reconcileGenerators keys on (owner, script), so each new
gen:test-typecheck-debt needs its own disposition; the ten zero packages define
no generator and therefore need no row.

packages/plugins/knowledge-ragflow/tsconfig.json — its build config now
excludes **/*.test.ts. This is not a package hiding its tests: it had no
typecheck script at all, check:type-check-coverage refuses a typecheck
that never invokes tsc, and with the tests still in the build program that first
limb would land red on debt this card is explicitly not chartered to repair. The
split is the family's shape — tsc --noEmit judges the shipped source, and
every test file is judged one command later against the EXACT ledger. ⛔ This is
not the repo-wide "packages missing a typecheck script" carry-over the ruling
holds separate in item 5; it is the single invocation path this card's own
instrument needs in order to run at all in that package.

packages/plugins/plugin-hono-server/tsconfig.test.json has no lib
override, unlike its thirteen siblings, and that is measured rather than
stylistic: this package's tsconfig.json does not extend the root config and
declares no lib, so tsc supplies the target: ES2022 default — which includes
DOM. Pinning lib: ["ES2022"] strips it and manufactures 34 errors, 26 of them
inside node_modules .d.ts files this package cannot reach to fix. Zero without
it.

Verification

Union run at b7413a964.

• pnpm --filter @objectstack/PKG check:test-typecheck — all 14 green on
  the merged tree, each printing its own check:test-typecheck: OK verdict line.
• Derived gate family (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, re-derived from the final diff), all green:
  check:agent-test-spelling, check:bash32-floor,
  check:changeset-gate-self-tests, check:cli-command-ids,
  check:cross-package-test-inputs, check:doc-authoring, check:entry-guard,
  check:merge-driver, check:nul-bytes, check:objectui-changeset,
  check:override-consistency, check:page-declaration-shape,
  check:parse-guard, check:pm-half-states, check:pnpm-filter-targets,
  check:published-files, check:ratchet-remedy-authority,
  check:service-providers, check:slot-lookup, check:test-source-alias,
  check:turbo-task-graph, check:type-check-coverage,
  check:type-source-resolution, check:watch-hint-literal,
  check:declared-population-live.
• Self-tests of the three edited scripts: check:type-check-coverage --self-test (47 + 65 + 43 + 28 + 19 + 18 cases), check:type-source-resolution --self-test, and check:merge-driver (which is git-merge-regen --self-test,
  the reconciliation that reads regen-artifacts.mjs). No vitest suite names any
  of the three (git grep over *.test.*: 0 hits that reference them as code).
• pnpm --filter the 14 plugin packages typecheck — green.
• Lint, narrowed and the narrowing measured: ESLint's own configuration puts
  35 of the 38 changed paths outside its population entirely (--format json,
  every one carrying File ignored because no matching configuration was supplied.); the 3 it does judge — the edited scripts/*.mjs — report
  errorCount: 0, warningCount: 0. The narrowing cannot have excluded anything:
  this repo runs one eslint.config.mjs which "never enables type-aware linting
  (no parserOptions.project, no typed @typescript-eslint rules) for ANY
  file", so no untouched file's verdict is a function of this diff.

check:dual-build-cjs-loads and check:type-check-debt (--re-measure) exit
3 = PREREQUISITE NOT MET in a worktree without the whole repo's dist/ —
NOT a pass and NOT a failure. Both were re-run after turbo run build --filter='./packages/*' --filter='./packages/*/*' and are green:
check-type-check-coverage --re-measure: OK — 23 ledger entr(ies) re-measured in 287.7s, 771 raw tsc error(s) total, none above its recorded number. with
surplus: none — every entry sits exactly at its measurement, so any new error is red. That is the reading that matters for the four entries this PR deletes.

Convention-triggered (check:i18n, check:i18n-stale-fill) and the
filter-scoped @objectstack/spec check:llms-txt: green. vitest for
@objectstack/knowledge-ragflow (the only package whose build tsconfig.json
this PR edits): 1 file / 9 tests passed. No runtime source is edited anywhere in
this PR, so no other suite is in the change's radius.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️ 5 changed file(s) yielded no anchor (packages/plugins/knowledge-ragflow/test-typecheck-debt.json, packages/plugins/knowledge-ragflow/tsconfig.json, packages/plugins/plugin-approvals/test-typecheck-debt.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 4 changed package(s)).

What this run could not see

• 5 changed file(s) yielded no anchor (packages/plugins/knowledge-ragflow/test-typecheck-debt.json, packages/plugins/knowledge-ragflow/tsconfig.json, packages/plugins/plugin-approvals/test-typecheck-debt.json, …) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 19 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json a69dfde8011fd5bb9dc0f89fc86551c839c92605 → packageMentionDocs.