feat(scripts): make repository.directory mandatory for a publishable manifest, and backfill the 14 (#16705)

* fix(manifests): declare `repository.directory` on the 14 publishable packages that declared none

npm renders `repository.directory` as the package page's "source" deep link,
concatenated onto the repository URL. These fourteen manifests carried no
`repository` block at all, so every one of those npm pages has no source link
rather than a broken one -- the half of the population that
`check:manifest-repository-directory` counted and deliberately did not judge.

Ruled mandatory for a publishable (non-private) workspace manifest, so this is
the backfill the ruling asks for. The block is the canonical one 57 of the 58
declaring manifests already carry (`type` + `url` + `directory`); `directory`
alone does not resolve on npm without the URL it is concatenated onto, which is
why this is a block rather than a line. Each file keeps its own indentation --
`connector-openapi` is four-space and stays four-space -- and the key sits where
the tree already puts it, immediately before `files`.

Private manifests are untouched: they publish nothing, so they have no npm page
for the link to be missing from.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37

* feat(scripts): make `repository.directory` mandatory for a publishable manifest

`check:manifest-repository-directory` shipped judging only the manifests that
DECLARED the field and counting the rest, because whether declaring is
mandatory was a policy question. It has been ruled: a publishable (non-private)
workspace manifest declares `repository.directory` naming its own directory. A
publishable manifest that declares nothing is now a finding rather than a skip,
and every prose passage that put the question to the reader -- in the script's
header, in its refusal text, in its verdict line and in the CI step's comment --
is replaced by what was ruled.

Silence stays exempt for a PRIVATE manifest, which publishes nothing and so has
no npm page for a link to be missing from; a private manifest that declares a
WRONG directory is still judged, because privacy exempts silence, not error.

The anti-vacuity design grows with the population it now reads. This gate had
one predicate and now has two, and the second empties in the direction that
makes no noise: a `isPublishable` stuck on false owes the new invariant to
nobody and passes every silent manifest. So `isPublishable` gets its own
two-direction control pair (a named non-private subject must read PUBLISHABLE,
a `private: true` one must read PRIVATE) alongside the tracked-directory pair,
all four must fire before any verdict prints, and `MIN_PUBLISHABLE` floors the
population itself -- the probes cannot catch a field renamed upstream and the
floor cannot catch a predicate stuck in place, so both instruments are kept and
neither is described as covering the other.

The census pins move rather than going stale: 82 manifests, 72 declaring, 70
publishable, 0 publishable declaring nothing, 530 tracked directories, all
re-measured on the post-backfill tree, with every floor re-derived from those
numbers rather than carried over. The self-test's battery roster gains the new
battery and its floors are re-derived too -- two of them had drifted below
their batteries (5 against 6 cases, 9 against 12), and slack in a floor is
exactly that many cases allowed to stop running unnoticed.

Changeset: the fourteen backfilled manifests are published files of released
packages, and the field is only read once it is published, so this takes a
`patch` per package rather than `skip-changeset`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37

* fix(scripts): name both predicates in the control-probe floor refusal

The control floor now covers four probes across two predicates, and its
refusal text still named only the tracked-directory one. Surfaced by the
ablation that sticks `isPublishable` on true: the run refused for the right
reason and explained it as the wrong one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-trump

.changeset/manifest-repository-directory-backfill.md

@@ -0,0 +1,24 @@
+---
+"@objectstack/connector-mcp": patch
+"@objectstack/connector-openapi": patch
+"@objectstack/connector-rest": patch
+"@objectstack/connector-slack": patch
+"@objectstack/embedder-openai": patch
+"@objectstack/knowledge-memory": patch
+"@objectstack/knowledge-ragflow": patch
+"@objectstack/plugin-approvals": patch
+"@objectstack/plugin-email": patch
+"@objectstack/plugin-pinyin-search": patch
+"@objectstack/plugin-reports": patch
+"@objectstack/plugin-sharing": patch
+"@objectstack/service-sms": patch
+"@objectstack/trigger-api": patch
+---
+
+These fourteen packages now declare `repository.directory`, so their npm pages carry a working "source" deep link to their own directory in the monorepo.
+
+npm renders that field by concatenating it onto `repository.url`. None of these fourteen manifests carried a `repository` block at all, so every one of their npm pages offered no route from the package back to its code — not a broken link, no link. That is what this publishes: the block those pages read, naming each package's own directory.
+
+Nothing else about these packages changes. No export, no runtime behaviour, no dependency and no file in the tarball other than the manifest's own `repository` key. The version bump exists because the fix is only real once it is published: the field lives in the manifest npm serves, so a corrected manifest sitting in the repository leaves the package page exactly as wrong as it was.
+
+The rule behind it is now mechanical rather than remembered — `check:manifest-repository-directory` makes a publishable (non-private) workspace manifest declare the field naming its own directory, so a package added or moved after this cannot quietly go back to having no source link.

.github/workflows/lint.yml

@@ -3673,13 +3673,16 @@ jobs:
       # whole population rather than a rule about moves: one of the three commits
       # involved moved nothing at all — it edited `repository.url` in the same
       # JSON object with the stale `directory` line as visible hunk context, and
-      # it shipped. Humans looked and missed it twice. ⛔ It judges only manifests
-      # that DECLARE the field; whether declaring is mandatory for a publishable
-      # package is an open policy question and a maintainer's to answer, so
-      # silence is counted and never a finding. Runs its own --self-test first:
-      # this population is `git ls-files` plus a field predicate, so a changed
-      # glob or a renamed field empties it silently and the production run would
-      # print exactly what a clean tree prints. Static read of tracked manifests;
+      # it shipped. Humans looked and missed it twice. Declaration is MANDATORY
+      # for a publishable (non-private) manifest — ruled, and the 14 that
+      # declared nothing were backfilled in the same change; a private manifest
+      # publishes nothing, so its silence is exempt while a wrong value in it is
+      # still judged. Runs its own --self-test first: this population is
+      # `git ls-files` plus TWO field predicates, so a changed glob, a renamed
+      # `repository.directory` or a `name`/`private` that stops reading as
+      # publishable each empty it silently and the production run would print
+      # exactly what a clean tree prints — hence pinned floors on all four counts
+      # and a control pair on each predicate. Static read of tracked manifests;
       # no build, no network, sub-second.
       - name: Manifest repository.directory guard
         run: pnpm check:manifest-repository-directory

packages/connectors/connector-mcp/package.json

@@ -39,6 +39,11 @@
     "ai",
     "tools"
   ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/objectstack-ai/objectstack.git",
+    "directory": "packages/connectors/connector-mcp"
+  },
   "files": [
     "dist",
     "README.md",

packages/connectors/connector-openapi/package.json

@@ -37,6 +37,11 @@
         "integration",
         "api"
     ],
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/objectstack-ai/objectstack.git",
+        "directory": "packages/connectors/connector-openapi"
+    },
     "files": [
         "dist",
         "README.md",

packages/connectors/connector-rest/package.json

@@ -36,6 +36,11 @@
     "integration",
     "http"
   ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/objectstack-ai/objectstack.git",
+    "directory": "packages/connectors/connector-rest"
+  },
   "files": [
     "dist",
     "README.md",

packages/connectors/connector-slack/package.json

@@ -34,6 +34,11 @@
     "integration",
     "messaging"
   ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/objectstack-ai/objectstack.git",
+    "directory": "packages/connectors/connector-slack"
+  },
   "files": [
     "dist",
     "README.md",

packages/plugins/embedder-openai/package.json

@@ -40,6 +40,11 @@
     "siliconflow",
     "ollama"
   ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/objectstack-ai/objectstack.git",
+    "directory": "packages/plugins/embedder-openai"
+  },
   "files": [
     "dist",
     "README.md",

packages/plugins/knowledge-memory/package.json

@@ -37,6 +37,11 @@
     "memory",
     "in-memory"
   ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/objectstack-ai/objectstack.git",
+    "directory": "packages/plugins/knowledge-memory"
+  },
   "files": [
     "dist",
     "README.md",

packages/plugins/knowledge-ragflow/package.json

@@ -37,6 +37,11 @@
     "rag",
     "ragflow"
   ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/objectstack-ai/objectstack.git",
+    "directory": "packages/plugins/knowledge-ragflow"
+  },
   "files": [
     "dist",
     "README.md",

packages/plugins/plugin-approvals/package.json

@@ -45,6 +45,11 @@
     "workflow",
     "process"
   ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/objectstack-ai/objectstack.git",
+    "directory": "packages/plugins/plugin-approvals"
+  },
   "files": [
     "dist",
     "README.md",