tooling(verify,cli): resolve the new cross-package imports to SOURCE (#15229)

Both halves are what `check:test-source-alias` and `check:type-source-resolution`
prescribe for a dep a change newly reaches; neither registry is widened (both are
shrink-only, and widening is never the fix):

- `packages/verify/vitest.config.ts` gains its first `resolve.alias` — one
  ANCHORED entry for `@objectstack/core`, which `artifact-collections.ts` now
  imports and every test in the package reaches through `derive.ts` / `rls.ts`.
  Without it those tests resolve core through its `exports` map to `dist/`, i.e.
  they become verdicts about build state, and the dangerous half of that is a
  suite that passes GREEN over a stale artifact.
- `packages/verify/tsconfig.json` gains the matching `paths` rule, and the
  `rootDir` widening that pulling core's source into the program requires
  (`packages/core/tsconfig.json`'s own precedent; emit is unaffected, this
  package builds with tsup).
- `packages/cli/tsconfig.test.json` gains a FOURTH bare-name rule beside the
  three #15004 added, for the `@objectstack/verify` the probe rows now import.

Bare names, no stars: `@objectstack/core` publishes a `./logger` subpath that
keeps resolving through its own `exports` map, and a starred rule would swallow
it and resolve it THROUGH a file (ENOTDIR).

Measured after: `pnpm check:test-source-alias` OK (72 packages scanned),
`pnpm check:type-source-resolution` OK (121 programs / 78 packages),
`pnpm --filter @objectstack/verify typecheck` and
`pnpm --filter @objectstack/cli typecheck` both clean, and the two suites the
alias re-resolves stay green: verify 58/58, the option-B pin 6/6.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UHvF5hyiZjnCyExFnfQB8m

Author: claude

packages/cli/tsconfig.test.json

@@ -126,9 +126,10 @@
     "moduleResolution": "bundler",
     "lib": ["ES2022", "DOM", "DOM.Iterable"],
     "types": ["node"],
-    // [#15004] THREE bare-name rules, no star, for the three workspace deps the
-    // option-B acceptance pin reaches (`test/option-b-reader-acceptance.pin.test.ts`
-    // and its two fixtures). Without them tsc resolves those specifiers through
+    // [#15004, #15229] FOUR bare-name rules, no star, for the four workspace
+    // deps the option-B acceptance pin reaches
+    // (`test/option-b-reader-acceptance.pin.test.ts` and its two fixtures;
+    // `@objectstack/verify` joined them with card 5/4's probe rows). Without them tsc resolves those specifiers through
     // each package's `exports` map to `dist/index.d.ts` — A BUILD ARTIFACT — so
     // this suite's type verdict about the readers the reader program is about to
     // CHANGE would be a verdict about the last `pnpm build` instead, which is
@@ -142,8 +143,8 @@
     // the specifier EXACTLY, which is load-bearing here rather than incidental:
     // `@objectstack/objectql` publishes a second subpath (`./core`), and that
     // specifier deliberately keeps resolving through the package's own
-    // `exports` map, untouched by this table. `plugin-security` and `runtime`
-    // each publish only `"."`. And a target matching nothing on disk is worse
+    // `exports` map, untouched by this table. `plugin-security`, `runtime` and
+    // `verify` each publish only `"."`. And a target matching nothing on disk is worse
     // than absent, because tsc then falls back to node resolution — i.e. to
     // `dist` — silently.
     //
@@ -152,7 +153,8 @@
     "paths": {
       "@objectstack/objectql": ["../objectql/src/index.ts"],
       "@objectstack/plugin-security": ["../plugins/plugin-security/src/index.ts"],
-      "@objectstack/runtime": ["../runtime/src/index.ts"]
+      "@objectstack/runtime": ["../runtime/src/index.ts"],
+      "@objectstack/verify": ["../verify/src/index.ts"]
     }
   },
   "include": ["test/**/*", "vitest.config.ts", "vitest-tiers.ts", "vitest-tiers.fixtures.ts"],

packages/verify/tsconfig.json

@@ -2,8 +2,30 @@
   "extends": "../../tsconfig.json",
   "compilerOptions": {
     "outDir": "./dist",
-    "rootDir": "./src",
-    "types": ["node"]
+    // [#15229] Widened from `./src` as a CONSEQUENCE of the `paths` rule below,
+    // exactly as `packages/core/tsconfig.json` documents: redirecting
+    // `@objectstack/core` to its source puts `packages/core/src/**` into this
+    // program, and `rootDir` is enforced over every program file even under
+    // `--noEmit`. `..` (= `packages/`) is the directory that contains every
+    // file in the program. Emit is unaffected: this package builds with tsup.
+    "rootDir": "..",
+    "types": ["node"],
+    // [#15229] `@objectstack/core` is imported as a VALUE by
+    // `src/artifact-collections.ts` (`resolveArtifactPackageOrder`, the
+    // ADR-0130 D4+D5 package ordering every reader in this package now resolves
+    // its collections through). Without this rule its types resolve through the
+    // workspace link to `dist/*.d.ts` — a build artifact — so this package's
+    // type verdict would be a function of build state rather than of the source
+    // in the checkout, which `check:type-source-resolution` refuses (its
+    // registry is shrink-only; widening it is not the fix).
+    //
+    // Bare name, no star: core publishes a second subpath (`./logger`) that
+    // deliberately keeps resolving through its own `exports` map, and a star
+    // would swallow it and resolve it THROUGH a file
+    // (`…/core/src/index.ts/logger`, ENOTDIR). Nothing here imports it.
+    "paths": {
+      "@objectstack/core": ["../core/src/index.ts"]
+    }
   },
   "include": ["src/**/*"],
   "exclude": ["node_modules", "dist", "**/*.spec.ts", "**/*.test.ts"]

packages/verify/vitest.config.ts

@@ -29,9 +29,36 @@
 // runner would make every log reading in tests a reading of something other
 // than production. The request lives HERE, in the harness, where the test
 // author can see it.
+// ── Why there is now a `resolve.alias` (#15229) ────────────────────────────
+//
+// `artifact-collections.ts` reads the app's collections through
+// `resolveArtifactPackageOrder` — `@objectstack/core`'s ADR-0130 D4+D5 package
+// ordering — and `derive.ts` / `rls.ts` reach it from every test in this
+// package. Without an anchored alias that specifier resolves through core's
+// `exports` to its **dist**, which makes each of those tests a verdict about
+// build state rather than about the source in this checkout, and the dangerous
+// half of that is not a loud error but a suite that passes GREEN over a stale
+// artifact with nothing in the output saying so.
+// `scripts/check-test-source-alias.mjs` names it; that script's registry is
+// SHRINK-ONLY, so widening `KNOWN_UNALIASED_TEST_IMPORTS['@objectstack/verify']`
+// was never the fix. ANCHORED (`/^…$/`, array form) so the entry cannot swallow
+// core's published subpaths and resolve `@objectstack/core/logger` to
+// `…/core/src/index.ts/logger` — the ENOTDIR shape that gate's rule 5 exists
+// for. The 14 other entries in this package's ledger are real and untouched:
+// this adds nothing to it and removes nothing from it.
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
 import { defineConfig } from 'vitest/config';
 
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+
 export default defineConfig({
+  resolve: {
+    alias: [
+      { find: /^@objectstack\/core$/, replacement: path.resolve(HERE, '../core/src/index.ts') },
+    ],
+  },
   test: {
     // A late console.* must not redden a green suite (#10374): vitest's worker
     // forwards console output over RPC and discards the promise, and a write