feat(devx): extend AMPLIFIERS to the packages a sibling checkout links (#18749)

Part of #16529 — this lands the objectstack half of the maintainer's
ruling (batch #151 item 1, letter **C**). It is deliberately NOT a
closing reference: the ruling's scope is "cloud's 184-specifier closure
(`plugin-auth`, `core`, `organizations` **and the rest**)", and "the
rest" is not derivable inside this container (see *Declared gap* below).
The card should be closed by hand once that gap is judged, and the cloud
half (the sibling preflight reading the stamp) is a separate cloud card
`Blocked-by:` this one, per the ruling's Execution section.

## What this changes

`scripts/check-dev-prereqs.mjs`'s `AMPLIFIERS` list gains three
packages, and each of their build scripts gains `--stamp` as the last
`&&`-joined step:

| package | path | build script now ends |
|---|---|---|
| `@objectstack/core` | `packages/core` | `tsup && node
../../scripts/check-dts-emitted.mjs && node
../../scripts/check-dev-prereqs.mjs --stamp` |
| `@objectstack/plugin-auth` | `packages/plugins/plugin-auth` | `tsup &&
node ../../../scripts/check-dts-emitted.mjs && node
../../../scripts/check-dev-prereqs.mjs --stamp` |
| `@objectstack/organizations` | `packages/plugins/organizations` |
`tsup --config ../../../tsup.config.ts && node
../../../scripts/check-dts-emitted.mjs && node
../../../scripts/check-dev-prereqs.mjs --stamp` |

Each package was located by the `name` field in its manifest, not by
assuming the ruling's word was a path — `organizations` lives one
directory deeper than the other two, under `packages/plugins/`.

The header gains the second admission criterion (a sibling checkout
links it), the ruling's explicit refusal to make the stamp a cross-repo
contract, and the declared shortfall. No version number, no
stable-location promise, no docs page — the format stays internal dev
tooling shared by sibling checkouts, and when it changes the sibling's
preflight reds once and is fixed in the same breath.

## Why the stamp and not a source SHA

Carried forward from triage at the triage seat's explicit request, so
the next reader does not re-propose it: "stamp the source SHA into the
build output" sounds more precise and answers **where HEAD is** — which
is exactly the half the consumer already does, and exactly the half its
own docblock records as insufficient. A sibling sitting *exactly on the
pin* whose `dist/` was built from an older commit produces the identical
type error, and a HEAD comparison is silent all the way through it. A
more precise answer to the wrong question.

## Where `--stamp` goes, and the proof it is right

`--stamp` goes **after** `check-dts-emitted.mjs`, matching the existing
`packages/spec` entry. The authority is the file's own
`isStampReachableOnlyFromCompleteBuild` work — `stampStepOrderProblem` —
which rejects three lying spellings. This is machine-checked rather than
argued: the coverage gate was driven to **fire on five broken placements
and pass on the shipped one**, on the real manifests, with the mutation
proven on disk each time and restored from `HEAD` under a trap.

Firing leg, mutating `packages/core/package.json` in place (gate exit
**1** on every row, each naming `packages/core` — a package this gate
could not judge at all before this diff):

| injected spelling | gate's diagnosis |
|---|---|
| `tsup ; node …--stamp` | the step before it is joined by `;`, not `&&`
— so the stamp is written even when that step failed |
| `tsup \|\| node …--stamp` | the step before it is joined by `\|\|`,
not `&&` — so the stamp is written even when that step failed |
| `node …--stamp && tsup` | `check-dev-prereqs.mjs --stamp` is not its
LAST step |
| `tsup && node …--stamp && node …check-dts-emitted.mjs` |
`check-dev-prereqs.mjs --stamp` is not its LAST step |
| `tsup && node …check-dts-emitted.mjs` (stamp dropped) |
`check-dev-prereqs.mjs --stamp` does not appear in it at all |

Green leg, on the shipped spelling over a fully built tree (`pnpm
build`, 73/73 tasks successful):

```
✓ 68 package build artifacts present (existence, not freshness).
✓ @objectstack/spec, @objectstack/core, @objectstack/plugin-auth, @objectstack/organizations built from
  the sources on disk — the only freshness claim this line makes; everything else above is existence only.
```

The three stamps were written by the real builds, not by hand — from the
build log:

```
@objectstack/core:build:         ✓ packages/core/dist/.build-input-hash ← 134aa01ce7f7368e…
@objectstack/plugin-auth:build:  ✓ packages/plugins/plugin-auth/dist/.build-input-hash ← 90bd5c9bb3ac8a7d…
@objectstack/organizations:build: ✓ packages/plugins/organizations/dist/.build-input-hash ← e8c1627e65820b37…
```

Every mutation leg restored from `HEAD` under a trap with absolute
paths, verified by blob hash equality and an empty `git diff HEAD`; the
working tree read 0 changed files afterwards.

## The gate now catches the defect the card is about

A source edit in a newly listed package that no build has consumed — the
shape that surfaces in the sibling as a type error naming an import
nobody touched — now reads **stale** instead of passing unexamined:

```
✗ A built package's dist no longer matches its sources — 1 unmet precondition, not a list of problems.
    All 68 declared build artifacts are present. They are not all current:
      @objectstack/core  (packages/core/dist/.build-input-hash)
        built from sources hashing  134aa01ce7f7368e…
        the sources on disk hash    f274704eb5548273…
```

Before this diff that verdict was unreachable for `packages/core`:
freshness is only computed for listed packages.

## Declared gap — "and the rest" is not derivable here

The ruling starts from cloud's 184-specifier link closure. That closure
cannot be read in this container; attaching `objectstack-ai/cloud` to
the session was attempted and refused (no access for this session's
credential). So this PR delivers **exactly the three packages the ruling
names**, and the remainder is reported rather than invented.

⛔ "Every workspace package that emits a `dist/`" was explicitly **not**
substituted for that closure — it is a different set, and listing
packages nobody links buys a build step for no reader.

The shortfall is monotone-safe, and that is the reason it is acceptable
to land short: the coverage error fires only on **listed** packages, so
a shorter list checks less. It cannot false-red and it cannot turn
today's green red.

## Acceptance notes

- **Negative controls, both directions, unchanged.** `--stamp` from an
unlisted package still exits 1 with its own wording (`packages/metadata
is not a declared freshness amplifier…`); a listed package whose build
stops stamping still throws a coverage error (row 5 of the firing
table).
- **No mtime criterion is introduced anywhere** — the family's shared
criterion (content, not mtime) holds. The added entries are judged by
the same `buildInputHash` content digest the one existing entry is.
- **The first segment's protection extends to the new entries for
free.** With `packages/plugins/plugin-auth/dist/index.mjs` moved aside,
`--stamp` from that package exits 1 (`…is not on disk, so this run
emitted nothing for a stamp to vouch for`) instead of stamping over a
dist with no build in it. Restored byte-identical (sha256 equal before
and after).
- **The "two lines" promise re-measured, with one honest correction.**
The mechanism is still two lines per package — path in `AMPLIFIERS`,
`--stamp` at the end of the build — and nothing else is wired anywhere
(no CI step, no turbo entry, no ignore rule needed; `dist/**` is already
a turbo output so the stamp caches and cleans with the artifact it
describes). What the promise does not cover is the header's *stated
admission criterion*: it named exactly one dist, so admitting three more
needed the criterion itself written down. That is a documentation edit,
not a third wiring step.
- **Changeset: measured, not assumed.** `npm pack --dry-run --json` on
`@objectstack/core`: **18** tarball entries with the stamps present,
**16** with them moved out of the packed tree — the delta is exactly
`dist/.build-input-hash` and `dist/.build-input-hash-dts`, which the new
last build step writes, and `dist` is in this package's `files[]`.
Positive control: `dist/index.js` present in both listings. So something
published does move, and a `patch` changeset is owed for the three
packages rather than `skip-changeset`. Nothing is imported, executed or
resolved from the two files; no export moves.

## Not addressed here

`#16529` remains open for the closure gap above. The cloud-side half —
the sibling preflight reading this stamp — is not in this repository and
is not touched by this PR.

---
_Generated by [Claude
Code](https://claude.ai/code/session_017ef78bLdybu3AffehKkhfk)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-try-charles

.changeset/amplifiers-linked-packages.md

@@ -0,0 +1,20 @@
+---
+'@objectstack/core': patch
+'@objectstack/plugin-auth': patch
+'@objectstack/organizations': patch
+---
+
+Build freshness: these three packages now write the repo's build-input content
+stamp as the last step of their own build, and are checked for freshness (not
+merely existence) by `check:dev-prereqs`.
+
+What changes for a consumer: each tarball now carries two extra inert metadata
+files inside `dist/` — `.build-input-hash` and `.build-input-hash-dts`, the same
+pair `@objectstack/spec` has always shipped. Nothing is imported, executed or
+resolved from them, no export moves and no runtime behaviour changes.
+
+Why: a sibling checkout that links these packages by `link:` compiles against
+their `dist/`, so a dist built from an older tree surfaces as a type error
+naming an import nobody touched, with the symbol present in `src/` the whole
+time. A HEAD-versus-pin comparison is silent through that; a content stamp
+written by the build itself is not.

packages/core/package.json

@@ -19,7 +19,7 @@
     }
   },
   "scripts": {
-    "build": "tsup && node ../../scripts/check-dts-emitted.mjs",
+    "build": "tsup && node ../../scripts/check-dts-emitted.mjs && node ../../scripts/check-dev-prereqs.mjs --stamp",
     "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.examples.json && pnpm check:test-typecheck",
     "check:test-typecheck": "tsx ../../scripts/check-test-typecheck.mts --self-test && tsx ../../scripts/check-test-typecheck.mts --package packages/core --project tsconfig.test.json",
     "gen:test-typecheck-debt": "tsx ../../scripts/check-test-typecheck.mts --update --package packages/core --project tsconfig.test.json",

packages/plugins/organizations/package.json

@@ -14,7 +14,7 @@
     }
   },
   "scripts": {
-    "build": "tsup --config ../../../tsup.config.ts && node ../../../scripts/check-dts-emitted.mjs",
+    "build": "tsup --config ../../../tsup.config.ts && node ../../../scripts/check-dts-emitted.mjs && node ../../../scripts/check-dev-prereqs.mjs --stamp",
     "test": "vitest run",
     "typecheck": "tsc --noEmit && pnpm check:test-typecheck",
     "check:test-typecheck": "tsx ../../../scripts/check-test-typecheck.mts --self-test && tsx ../../../scripts/check-test-typecheck.mts --package packages/plugins/organizations --project tsconfig.test.json"

packages/plugins/plugin-auth/package.json

@@ -19,7 +19,7 @@
     }
   },
   "scripts": {
-    "build": "tsup && node ../../../scripts/check-dts-emitted.mjs",
+    "build": "tsup && node ../../../scripts/check-dts-emitted.mjs && node ../../../scripts/check-dev-prereqs.mjs --stamp",
     "test": "vitest run",
     "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.examples.json && pnpm check:test-typecheck",
     "check:test-typecheck": "tsx ../../../scripts/check-test-typecheck.mts --self-test && tsx ../../../scripts/check-test-typecheck.mts --package packages/plugins/plugin-auth --project tsconfig.test.json",

scripts/check-dev-prereqs.mjs

@@ -202,6 +202,31 @@
  *   how every package builds, for packages whose stale dist fails loudly instead
  *   of lying. AGENTS.md §9's stale-artefact table names exactly one dist that
  *   presents as *other people's* contract drift, and it is `packages/spec`.
+ *
+ *   A SECOND ADMISSION CRITERION, read from one repo further out (#16529). A
+ *   sibling checkout links `@objectstack/*` by `link:` — objectstack-ai/cloud
+ *   does it for 184 specifiers — and compiles against the linked package's
+ *   `dist/`. A stale dist there surfaces as `TS2305 … has no exported member
+ *   …` naming an import nobody touched, with the symbol present in `src/` the
+ *   whole time: row one's lie, read across a repository boundary. The consumer
+ *   cannot close it from its side — its preflight compares the sibling's HEAD
+ *   against its pin, and a sibling sitting EXACTLY on the pin whose dist was
+ *   built from an older commit is silent through that comparison. So a package a
+ *   sibling checkout actually links is admitted here too, and the stamp its build
+ *   already writes is what that preflight reads.
+ *   ⛔ That reading does NOT make this file's stamp a cross-repo contract. It is
+ *   internal dev tooling shared by sibling checkouts — both repositories are
+ *   ours, the format may change without notice, and when it does the sibling's
+ *   preflight reds once and is fixed in the same breath. No version number, no
+ *   stable-location promise, no docs page (maintainer ruling on #16529).
+ *   ⚠ THIS LIST IS SHORT OF THAT CLOSURE, declared rather than inherited: the
+ *   three entries under criterion 2 are the ones that ruling names; the remainder
+ *   of the 184-specifier closure is not derivable from inside this repository.
+ *   ⛔ "Every workspace package that emits a `dist/`" is a DIFFERENT set and not
+ *   a stand-in for it — it would add a build step for packages no reader links.
+ *   The shortfall is monotone-safe: the coverage error fires only on LISTED
+ *   packages, so a short list checks less and can never false-red.
+ *
  *   Adding the next amplifier is two lines: its path in AMPLIFIERS, and `--stamp`
  *   at the end of its build script — and NEITHER half can be forgotten, because
  *   a listed package whose build script does not stamp fails this gate as a
@@ -355,14 +380,23 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
 /**
  * Packages whose dist is checked for FRESHNESS and not merely existence, as
- * workspace-relative POSIX paths. See the header for the admission criterion
- * ("a stale dist that presents as somebody else's contract drift") and for why
- * this is a declared list rather than every package.
+ * workspace-relative POSIX paths. See the header for the TWO admission criteria
+ * ("a stale dist that presents as somebody else's contract drift", and "a
+ * sibling checkout links it") and for why this is a declared list rather than
+ * every package.
  *
  * Every entry MUST end its `build` script with STAMP_INVOCATION; a listed
  * package that does not is a coverage error, not a silent pass.
  */
-const AMPLIFIERS = ['packages/spec'];
+const AMPLIFIERS = [
+  // Criterion 1 — a stale dist here reads as somebody else's contract drift.
+  'packages/spec',
+  // Criterion 2 — linked by `link:` from a sibling checkout, where a stale dist
+  // is a TS2305 naming an import nobody touched. See the header.
+  'packages/core',
+  'packages/plugins/plugin-auth',
+  'packages/plugins/organizations',
+];
 
 /** What an amplifier's build script must END WITH for its stamp to be maintained. */
 const STAMP_INVOCATION = 'check-dev-prereqs.mjs --stamp';