fix(tooling): put three more package-root plugin manifests inside a tsc program

[claude]

Fixes #14386

What

check:type-check-coverage's isUncheckedSourceCandidate skipped depth === 0
(the package root) unconditionally, so any package-root .ts file was invisible
to SOURCES_COVERED regardless of content — not reported, not tracked. This is
exactly why #13284's driver-memory / plugin-hono-server manifests went
unchecked for as long as they did: pnpm --filter <pkg> typecheck exited 0
over a file no tsc program read, while check:type-check-coverage called the
package COVERED at the same time.

Per the triage (comment 5504408509 on #14386), this queues the narrow repair
only — admitting a declared set of root filenames that are authored source,
not every package-root .ts file:

1. ROOT_SOURCE_FILES (currently {'objectstack.config.ts'}) — the depth-0
   exception to isUncheckedSourceCandidate, with a docblock stating the
   104-file question (every un-programmed vitest.config.ts / tsup.config.ts
   at a package root) is deliberately not answered here.
2. The uncheckedByDir aggregation now keys a root-level unread file at '.'
   — which posix.join(dir, top) collapses to the package's own directory —
   instead of the rel.slice(0, -1) garbage key the old indexOf('/') === -1
   arithmetic produced.
3. A --self-test case for a root-level source file (predicate rows for
   objectstack.config.ts / tsup.config.ts / a hypothetical root .d.ts,
   plus an evaluate()-level fixture pinning that the . root key renders as
   the package's own directory) — the existing source-layer cases were all
   subdirectory cases (packages/a/scripts), which is exactly why this hole
   survived.
4. The three sites the widened predicate then surfaces are put into a program:
   • plugin-auth: widened the existing sibling tsconfig.examples.json
     (rootDir: ".") include to also name objectstack.config.ts — already
     invoked by typecheck, so no package.json change needed.
   • plugin-security: widened the existing sibling tsconfig.scripts.json
include the same way — its rootDir: "../.." (inherited from
     tsconfig.json, Walled postures must not elevate the first self-registrant: platform admin comes ONLY from an env-declared owner email; self-signups never join the Default Organization — ruled fix for cloud#1509 #11184) already covers the package root, so no rootDir
     change either.
   • service-i18n: had no sibling noEmit program (typecheck was a bare
     tsc --noEmit), so this adds tsconfig.typecheck.json following the
     driver-memory shape The two in-repo manifest authoring sites (driver-memory / plugin-hono-server objectstack.config.ts) sit outside every tsc program and import ObjectStackManifest from an entry that does not export it #13284 established, and widens typecheck to run
     it.

All three type-check clean at zero errors — no UNCHECKED_SOURCE_DEBT entry
is added.

Not this card

Per the triage, the 104-file question (whether every un-programmed
vitest.config.ts / tsup.config.ts at a package root owes a program or a
ledger entry) is explicitly not decided here. ROOT_SOURCE_FILES is a
closed, exact-name allowlist rather than a pattern, precisely so growing it
stays a decision made on its own card.

#13284 is not addressed here beyond what already landed — its fence (driver-memory,
plugin-hono-server) holds; this touches neither.

Verified: no other package-root objectstack.config.ts outside the three named

find packages apps examples -name objectstack.config.ts (filtered to
directories that are themselves a package.json root) turns up 8 hits: the 3
examples/app-* (already inside their own tsc programs, pre-existing),
driver-memory + plugin-hono-server (#13284, already covered), the 3 named
here, and packages/create-objectstack/src/templates/blank/. That last one
is a scaffold template with its own nested pnpm-workspace.yaml — not a member
of this repo's own workspace (workspacePackageDirs() does not walk into it),
so the widened predicate correctly does not surface it. Left untouched, per the
triage's instruction not to add programs or ledger entries beyond the three
named sites — noted here for the record, not acted on.

Before / after

Baseline (origin/main bd8795ea1, before any edit):

check-type-check-coverage: OK — 68/78 workspace packages type-checked (plus the root), 10 in the DEBT ledger (305 frozen raw errors, https://github.com/objectstack-ai/objectstack/issues/4311), 1 exempt.
  test layer: 13 package(s) still hide their own tests from tsc (554 files hidden as counted by this run, 466 frozen raw errors in TEST_DEBT).
  source layer: 1 directory(ies) of non-test source in 1 ledgered entr(y/ies) sit outside every tsc program their package's own `typecheck` runs (1 files as counted by this run).
  ...

Predicate-only (before the three tsconfig edits — proves the widened predicate
now sees the sites):

check-type-check-coverage: 3 problem(s)
  • packages/plugins/plugin-auth: 1 non-test source file(s) here sit outside every tsc program that `@objectstack/plugin-auth`'s `typecheck` script runs, ...
  • packages/plugins/plugin-security: 1 non-test source file(s) here sit outside every tsc program that `@objectstack/plugin-security`'s `typecheck` script runs, ...
  • packages/services/service-i18n: 1 non-test source file(s) here sit outside every tsc program that `@objectstack/service-i18n`'s `typecheck` script runs, ...

Final, after the three tsconfig edits:

check-type-check-coverage: OK — 68/78 workspace packages type-checked (plus the root), 10 in the DEBT ledger (305 frozen raw errors, #4311), 1 exempt.
  source layer: 1 directory(ies) of non-test source in 1 ledgered entr(y/ies) sit outside every tsc program their package's own `typecheck` runs (1 files as counted by this run).

Same shape as baseline — the pre-existing 1-entry source-layer ledger is
unchanged, and the three new sites are NOT in it (they are fully covered, zero
debt).

Each package's own typecheck, run against a freshly built dependency closure
(pnpm --filter "<pkg>..." build), also passes clean:

@objectstack/plugin-auth typecheck     → tsc --noEmit && tsc --noEmit -p tsconfig.examples.json && check:test-typecheck   — all pass (test layer: pre-existing 94 errors / 10 files, ledgered in test-typecheck-debt.json, unchanged by this PR)
@objectstack/plugin-security typecheck → tsc --noEmit && tsc --noEmit -p tsconfig.scripts.json && check:test-typecheck    — all pass, 0 errors
@objectstack/service-i18n typecheck    → tsc --noEmit && tsc --noEmit -p tsconfig.typecheck.json                         — all pass

A second gate the new program onboarding tripped: check:type-source-resolution

Putting service-i18n's manifest into tsconfig.typecheck.json onboards that
package's first tsc program to reach the bare @objectstack/spec specifier —
src/ only ever imports subpaths (@objectstack/spec/contracts,
@objectstack/spec/system), never the bare package. check:type-source-resolution
correctly flagged this (a dep resolving through dist/ with no paths rule
pointing at source). Repaired via that gate's own documented onboarding-limb
registry re-baseline — the sanctioned tool for exactly this shape (a dep
reached only through a newly-onboarded program; paths is measured wrong for
this shape on PR #12570, since it would pull packages/spec/src — and
everything it imports — into a program whose rootDir is .). One entry added
to KNOWN_DIST_RESOLVED_TYPE_IMPORTS:

'@objectstack/service-i18n': ['@objectstack/spec'],

--list before/after (measured at bd8795ea1, the entry excluded from "after"
to isolate what onboarding the program added):

before   55 of 77 packages, 111 programs, 269 pairs, 22 clean
after    56 of 77 packages, 112 programs, 270 pairs, 21 clean

+1 program, +1 pair, +1 package — this entry and nothing else. Full reasoning
in the file's own comment beside the entry. This edit is outside the file
surface named in the dispatch, filed as a bounded in-place-fix exemption per
os-dev.md rule 3 (surface amendment posted on #14386 before this PR opened).

Tests

• node scripts/check-type-check-coverage.mjs --self-test — 48 semantic +
  68 observation (+1 / +3 over baseline) + 43 re-measure + 28 built-closure +
  19 auto-lowering + 18 exit-code cases hold.
• node scripts/check-type-check-coverage.mjs — before/predicate-only/final shown above.
• node scripts/check-type-source-resolution.mjs --self-test — OK.
• node scripts/check-type-source-resolution.mjs — OK, 56 registered (was 55 pre-onboarding, +1 this PR's entry), 0 unregistered exposure.
• pnpm --filter "@objectstack/plugin-auth..." --filter "@objectstack/plugin-security..." --filter "@objectstack/service-i18n..." build then each package's own pnpm --filter <pkg> typecheck — all pass, shown above (os-verify-lock VERDICT command-exit 0, held 368s).
• 31 of 34 additional gates dispatch-gates.mjs derives for this diff run green directly; the remaining 3 are legitimate NOT MEASURED (check-test-completeness needs a CI test log; check:type-check-debt --re-measure needs the full unfiltered workspace build closure, explicitly "not a pass and not a finding" per the gate's own refusal; check-half-states.mjs timed out against the network proxy under container contention — retried, not yet resolved by report time).
• check:i18n / check:i18n-stale-fill (convention-triggered by the plugin-security/tsconfig.scripts.json edit) — both green, all 9 packages' bundles in sync.
• pnpm check:pm-dispatch-gates (~11.5 min gate) — run in background under the shared verify lock; see report comment for its result.
• Derived gate family via node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands — 48 commands (44 by path + 4 by change kind); see report comment for the full list and results.

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️ 3 changed file(s) yielded no anchor (packages/plugins/plugin-auth/tsconfig.examples.json, packages/plugins/plugin-security/tsconfig.scripts.json, packages/services/service-i18n/tsconfig.typecheck.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 3 changed package(s)).

What this run could not see

• 3 changed file(s) yielded no anchor (packages/plugins/plugin-auth/tsconfig.examples.json, packages/plugins/plugin-security/tsconfig.scripts.json, packages/services/service-i18n/tsconfig.typecheck.json) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 21 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 1d8ad0ffe51caae6892ccece9f8abad9794ac545 → packageMentionDocs.