ci(typecheck): the ratchet judges the test layer too — 27 "covered" packages were hiding their tests (#4311)

#4324 counted a package covered the moment it declared a `typecheck` script.
But `tsc --noEmit` reads the package's own tsconfig.json, and 27 of the 48
packages that gate waved through `exclude` `**/*.test.ts` from exactly that
file — so COVERED and REAL both passed while nothing read the test layer, which
is the source #4311 is actually about. Measured by lifting each exclusion and
re-running the package's own config: 568 test files, 1451 errors, behind a
green check. `spec` alone hid 902 across 272 files; `plugin-approvals` hid 467,
more than driver-sql's 241, with a clean src.

What changed:

1. New TESTS_COVERED invariant + TEST_DEBT ledger in
   scripts/check-type-check-coverage.mjs. A package that excludes its own tests
   must carry a measured entry; RECONCILED runs both ways, so dropping the
   exclusion without deleting the entry fails, and so does the reverse. Test
   files are counted under the tsconfig's `include` roots — `exclude` only
   subtracts from what `include` selected, and several packages keep a sibling
   `test/` tree that `include` never mentions. Six new self-test cases (18
   total). The summary line now prints both layers: reporting only the src
   figure is how 48/77 read as green over 568 unchecked files.

2. Nine packages that were already clean with tests included had the exclusion
   deleted outright: sdui-parser, plugin-audit, plugin-email, plugin-hono-server,
   plugin-pinyin-search, plugin-reports, trigger-api, trigger-schedule,
   connector-slack.

3. 44 relative imports repaired to carry the `.js` extension NodeNext requires.
   This was filed as config-tier noise and is not: an unresolved import degrades
   every symbol it names to `any`, and the callbacks over those symbols then
   report TS7006 "implicitly any". The 44 fixes closed 110 errors across eight
   packages — and exposed 12 real defects in service-settings (manifest action
   handlers called without `namespace`/`actionId`) that the broken imports had
   been masking. Its ledger entry said "no code-tier finding"; it was wrong in
   both directions, and now says so.

4. Nine packages graduate out of DEBT (types, create-objectstack, service-cache,
   service-i18n, service-job, service-messaging, service-queue, service-realtime,
   plugin-approvals). Three tsconfig repairs: `types:["node"]` for types (107
   errors, one line), `exclude: src/templates` for create-objectstack (scaffolding
   copied verbatim by tsup, whose imports resolve in the generated project, not
   this one), `lib: ES2021` for plugin-approvals (String.replaceAll).
   plugin-approvals graduates on src only and carries a TEST_DEBT entry — its 13
   test files are still excluded.

Coverage: 48/77 -> 57/77 src-covered; DEBT 29 -> 20 entries (679 raw errors);
TEST_DEBT 21 entries (652 files, 2243 raw errors) newly visible.
No non-test source file changes. Verified: self-test 18/18, coverage gate,
`turbo run typecheck` 119/119, `pnpm test` 132/132, eslint, check:published-files.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011m13wbaZziPveBdtQthrXd

Author: claude

.changeset/typecheck-covers-the-test-layer.md

@@ -0,0 +1,4 @@
+---
+---
+
+ci(dx): the type-check coverage ratchet now judges the test layer too (#4311). #4324 counted a package covered the moment it declared a `typecheck` script — but 27 of the 48 it waved through `exclude` `**/*.test.ts` from the very `tsconfig.json` that `tsc --noEmit` reads, hiding 568 test files and 1451 errors behind a green check (`@objectstack/spec` alone: 272 files, 902 errors). A new `TESTS_COVERED` invariant fails any package that excludes its own tests without a measured `TEST_DEBT` entry, and the gate now prints both layers so the src figure can never again stand in for the whole. Nine packages that were already clean with tests included had the exclusion dropped outright; nine more graduate out of DEBT after repairing 44 NodeNext imports missing their `.js` extension — a repair that closed 110 errors (most of the "noise" tier was one unresolved import degrading symbols to `any`) and exposed 12 real defects in `service-settings` that those broken imports had been masking. Dev scripts, tests and CI only; releases nothing.

AGENTS.md

@@ -29,6 +29,19 @@ workspace package declares a `typecheck` script or carries a measured DEBT/EXEMP
 in `scripts/check-type-check-coverage.mjs`. New packages must arrive covered; a package
 that graduates deletes its ledger entry in the same PR.
 
+**Do not `exclude` `*.test.ts` / `*.spec.ts` from a package's `tsconfig.json`.** `tsc
+--noEmit` reads that config, so an exclusion there hides the tests from the check the
+`typecheck` script advertises — a green gate over source nothing read, which is the
+#4311 defect itself. The ratchet's `TESTS_COVERED` invariant fails on any new exclusion;
+the packages that already had one carry a measured `TEST_DEBT` entry and graduate by
+dropping the exclusion.
+
+One trap worth knowing before you read any of these counts: under `moduleResolution:
+NodeNext` a relative import missing its `.js` extension does not resolve, every symbol it
+names becomes `any`, and the callbacks over those symbols then report TS7006 "implicitly
+any". A pile of TS7006 is usually one broken import upstream, not a package that needs
+type annotations — fix the extension first and re-measure.
+
 ### Running the dev server
 
 | Scenario | Command | Notes |

packages/connectors/connector-slack/tsconfig.json

@@ -6,5 +6,5 @@
     "types": ["node"]
   },
   "include": ["src/**/*"],
-  "exclude": ["dist", "node_modules", "**/*.test.ts"]
+  "exclude": ["dist", "node_modules"]
 }

packages/create-objectstack/package.json

@@ -7,6 +7,7 @@
   },
   "scripts": {
     "build": "tsup",
+    "typecheck": "tsc --noEmit",
     "dev": "tsup --watch",
     "test": "vitest run"
   },

packages/create-objectstack/tsconfig.json

@@ -19,5 +19,8 @@
   },
   "include": [
     "src"
+  ],
+  "exclude": [
+    "src/templates"
   ]
 }

packages/plugins/plugin-approvals/package.json

@@ -14,6 +14,7 @@
   },
   "scripts": {
     "build": "tsup --config ../../../tsup.config.ts",
+    "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests"
   },
   "dependencies": {

packages/plugins/plugin-approvals/tsconfig.json

@@ -3,7 +3,8 @@
   "compilerOptions": {
     "outDir": "./dist",
     "rootDir": "./src",
-    "types": ["node"]
+    "types": ["node"],
+    "lib": ["ES2021"]
   },
   "include": ["src/**/*"],
   "exclude": ["dist", "node_modules", "**/*.test.ts"]

packages/plugins/plugin-audit/tsconfig.json

@@ -12,7 +12,6 @@
   ],
   "exclude": [
     "dist",
-    "node_modules",
-    "**/*.test.ts"
+    "node_modules"
   ]
 }

packages/plugins/plugin-email/tsconfig.json

@@ -6,5 +6,5 @@
     "types": ["node"]
   },
   "include": ["src/**/*"],
-  "exclude": ["dist", "node_modules", "**/*.test.ts"]
+  "exclude": ["dist", "node_modules"]
 }

packages/plugins/plugin-hono-server/tsconfig.json

@@ -18,7 +18,6 @@
   ],
   "exclude": [
     "node_modules",
-    "dist",
-    "**/*.test.ts"
+    "dist"
   ]
 }