fix(service-storage): put the test layer in front of tsc, and repair what it was hiding (#15157)

* fix(service-storage): put the test layer in front of tsc, and repair what it was hiding (#15050)

`packages/services/service-storage` had no `typecheck` script at all, so no
tsc program anywhere read its test layer; its 51 errors were carried as a
DEBT entry. Gives it the #14062/#14181 checked-test-zone shape: a sibling
`tsconfig.test.json` plus `tsconfig.scripts.json` (the ninth `i18n-extract`
instance of #11351), both named by a new `typecheck` script. Fixes the
config-tier pile (missing `.js` extensions, `Array.prototype.at` lib gap)
and the genuine code-tier defects it was hiding (a test helper's spread
losing its index signature; a fake `ctx: any`'s generic calls). Both
readings now agree at 0/0. DEBT entry deleted, not lowered; no
test-typecheck-debt.json needed. `check:type-source-resolution` repaired via
the documented onboarding-limb registry entry, not `paths` (measured both
ways: `paths` -> 306 errors, all in other packages' source).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

* tooling(gates): re-measure the #15050 entry's provenance table over the two landed siblings

The merge of origin/main @ 460134a brought in the service-knowledge
(#15049) and service-automation (#15048) onboardings, which moved every
ABSOLUTE this entry's doc-block states and none of its DELTAS. Re-measured
all four provenance rows on the merged tree by varying only what the
`typecheck` script NAMES, restoring package.json from HEAD between rows
(restore proven byte-identical: hash-object == HEAD blob 40773ae,
`git diff HEAD` empty):

  no `typecheck` script (origin/main)  absent   121 programs / 302 pairs
  names `tsconfig.json` only           absent   121 programs / 302 pairs
  names `tsconfig.test.json` only      PRESENT  122 programs / 309 pairs
  names all three (this card)          PRESENT  123 programs / 309 pairs

origin/main itself measures 60 of 78 / 121 / 302 / 18 clean in a detached
worktree at 460134a, matching rows 1-2. Deltas unchanged: +1 package,
+2 programs, +7 pairs.

`check-type-check-coverage.mjs` needed no equivalent edit: its ledger
summary is computed at runtime from DEBT/TEST_DEBT and now prints
75/79 covered, 4 in DEBT, 53 frozen raw errors.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XpTx2tbq3pZRYAdoGt6E6Y

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-sales

.changeset/service-storage-test-tsc-program.md

@@ -0,0 +1,50 @@
+---
+"@objectstack/service-storage": patch
+---
+
+fix(service-storage): put the test layer in front of tsc, and repair what it was hiding (#15050)
+
+`packages/services/service-storage` had **no `typecheck` script at all** — its
+scripts were `build` and `test` — so no tsc program anywhere read this
+package's test layer, and its errors were carried instead as a 51-error DEBT
+entry in `scripts/check-type-check-coverage.mjs`. Gives it the #14062 /
+#14181 "checked test zone" shape: a sibling `tsconfig.test.json` (module
+semantics only — `esnext` / `bundler` / `lib: ES2022` — matching how vitest
+actually executes these files; strictness inherited and untouched) plus a
+`tsconfig.scripts.json` for `scripts/i18n-extract.config.ts` (the ninth
+instance of #11351, previously excluded from that ledger only because this
+package had no `typecheck` script to hang it on), both named by a new
+`typecheck` script.
+
+Measured before repair: 51 errors under BUILD semantics (`tsc --noEmit -p
+tsconfig.json`, which already includes the tests — matching the DEBT entry's
+recorded number exactly), 10 under the split. Unlike `service-cluster`
+(#14181), this package's BUILD reading was *not* already clean, so both
+programs needed genuine repair, not just the test-only split: 23 `TS2835`
+(relative imports missing their `.js` extension, required under BUILD's
+NodeNext resolution) were fixed by *adding* the extension — which resolves
+correctly under both NodeNext and the split's bundler mode — and clearing
+that also cleared all 15 `TS7006` "implicitly any" as a downstream cascade
+from the same unresolved imports (the shape `@objectstack/core` reported at
+98 → 4). The remaining 3 `TS2550` (`Array.prototype.at` needing `lib`
+es2022) are rewritten to indexed access rather than widening the shared
+BUILD `tsconfig.json`. The 8 code-tier errors (`TS2339` × 4 — a test
+helper's object-spread dropped its `Record<string, unknown>` index
+signature, fixed with an explicit return-shape annotation; `TS2347` × 4 — a
+fake `ctx: any`'s `getService<T>(...)` calls converted to `getService(...)
+as T`, the pattern one call site in the same file had already adopted for
+exactly this reason) are genuine test-file fixes. Both readings now agree at
+0/0 — the same result `service-cluster` reported, reached by a longer road.
+
+The package's DEBT entry (51 errors) is **deleted**, not lowered — the
+graduation this ratchet's invariant requires. No `test-typecheck-debt.json`
+is added: residue is 0, so none is owed (#5286, maintainer-only to open).
+`check:type-source-resolution` went red from onboarding the two new
+programs (the documented onboarding-limb case): a registry entry is added
+rather than `paths`, measured both ways — `paths` takes this package's test
+layer from 0 errors to 306, all in other packages' source.
+
+No runtime code changes: `src/**` excluding tests is byte-identical, so no
+shipped behaviour moves. The `patch` level reflects the published
+`package.json` gaining `typecheck` / `check:test-typecheck` scripts and a
+`tsx` devDependency.

packages/services/service-storage/package.json

@@ -20,7 +20,9 @@
   },
   "scripts": {
     "build": "tsup --config ../../../tsup.config.ts && node ../../../scripts/check-dts-emitted.mjs",
-    "test": "vitest run"
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.scripts.json && pnpm check:test-typecheck",
+    "check:test-typecheck": "tsx ../../../scripts/check-test-typecheck.mts --self-test && tsx ../../../scripts/check-test-typecheck.mts --package packages/services/service-storage --project tsconfig.test.json"
   },
   "dependencies": {
     "@objectstack/core": "workspace:*",
@@ -45,6 +47,7 @@
     "@objectstack/objectql": "workspace:*",
     "@objectstack/driver-sql": "workspace:*",
     "@types/node": "^26.2.0",
+    "tsx": "^4.23.12",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10"
   },

packages/services/service-storage/src/error-envelope.conformance.test.ts

@@ -40,9 +40,9 @@ import { join } from 'node:path';
 import { tmpdir } from 'node:os';
 import { BaseResponseSchema, envelopeViolations } from '@objectstack/spec/api';
 import type { IHttpRequest, IHttpResponse, RouteHandler } from '@objectstack/spec/contracts';
-import { LocalStorageAdapter } from './local-storage-adapter';
-import { StorageMetadataStore } from './metadata-store';
-import { registerStorageRoutes } from './storage-routes';
+import { LocalStorageAdapter } from './local-storage-adapter.js';
+import { StorageMetadataStore } from './metadata-store.js';
+import { registerStorageRoutes } from './storage-routes.js';
 
 const BASE = '/api/v1/storage';
 

packages/services/service-storage/src/file-reference-lifecycle.test.ts

@@ -127,7 +127,13 @@ function recordDispatch(scope: Record<string, unknown> = {}) {
 async function driveInsert(engine: Engine, object: string, data: Record<string, unknown>, id: string) {
   const ctx: any = { object, event: 'beforeInsert', input: { data }, dispatch: recordDispatch() };
   await engine.trigger('beforeInsert', ctx);
-  const row = { ...(ctx.input.data as Record<string, unknown>), id };
+  // Explicitly typed rather than left to spread-inference: TS drops a spread
+  // source's index signature when it has no KNOWN properties, so an
+  // un-annotated `row` here infers as bare `{ id: string }` and every
+  // `row.<dataKey>` read below is an error — the shape IS
+  // `Record<string, unknown>` at runtime (the caller's `data` plus `id`), this
+  // just states it so the checker agrees.
+  const row: Record<string, unknown> & { id: string } = { ...(ctx.input.data as Record<string, unknown>), id };
   (engine.tables[object] ??= []).push(row);
   ctx.event = 'afterInsert';
   ctx.result = row;

packages/services/service-storage/src/local-storage-adapter.metrics.test.ts

@@ -5,7 +5,7 @@ import { mkdtemp, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { InMemoryMetricsRegistry, SEMCONV } from '@objectstack/observability';
-import { LocalStorageAdapter } from './local-storage-adapter';
+import { LocalStorageAdapter } from './local-storage-adapter.js';
 
 describe('LocalStorageAdapter instrumentation', () => {
     let rootDir: string;

packages/services/service-storage/src/local-storage-adapter.test.ts

@@ -4,7 +4,7 @@ import { describe, it, expect, afterEach } from 'vitest';
 import { promises as fs } from 'node:fs';
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
-import { LocalStorageAdapter } from './local-storage-adapter';
+import { LocalStorageAdapter } from './local-storage-adapter.js';
 import type { IStorageService } from '@objectstack/spec/contracts';
 
 describe('LocalStorageAdapter', () => {

packages/services/service-storage/src/storage-adapter-list-contract.test.ts

@@ -30,8 +30,8 @@
  */
 
 import { describe, it, expect } from 'vitest';
-import { LocalStorageAdapter } from './local-storage-adapter';
-import { S3StorageAdapter } from './s3-storage-adapter';
+import { LocalStorageAdapter } from './local-storage-adapter.js';
+import { S3StorageAdapter } from './s3-storage-adapter.js';
 
 /** Every method name reachable on an instance, own + prototype chain. */
 function reachableMethodNames(instance: object): string[] {

packages/services/service-storage/src/storage-adapter-list.conformance.test.ts

@@ -155,8 +155,8 @@ vi.mock('@aws-sdk/client-s3', () => {
 // `vi.mock` is hoisted above every import in this file, so the lazy
 // `await import('@aws-sdk/client-s3')` inside `S3StorageAdapter` resolves to the
 // fake above no matter where these two sit.
-import { LocalStorageAdapter } from './local-storage-adapter';
-import { S3StorageAdapter } from './s3-storage-adapter';
+import { LocalStorageAdapter } from './local-storage-adapter.js';
+import { S3StorageAdapter } from './s3-storage-adapter.js';
 
 // ---------------------------------------------------------------------------
 // Backend harness
@@ -365,8 +365,8 @@ describe.each(BACKENDS)('$name adapter — list() conformance', ({ make }) => {
       expect(page.keys).toHaveLength(400);
       expect(page.nextCursor).toBeDefined();
     }
-    expect(pages.at(-1)!.keys).toHaveLength(BULK_SET.length % 400);
-    expect(pages.at(-1)!.nextCursor).toBeUndefined();
+    expect(pages[pages.length - 1]!.keys).toHaveLength(BULK_SET.length % 400);
+    expect(pages[pages.length - 1]!.nextCursor).toBeUndefined();
   }, 60_000);
 
   it('fills one page past the backend\'s own page size (>1000 in a single call)', async () => {
@@ -434,7 +434,7 @@ describe.each(BACKENDS)('$name adapter — list() conformance', ({ make }) => {
   it('issues a cursor the contract codec can read back', async () => {
     const page = await backend.adapter.list!('bulk/', { limit: 10 });
 
-    expect(page.nextCursor).toBe(encodeStorageListCursor(page.items.at(-1)!.key));
+    expect(page.nextCursor).toBe(encodeStorageListCursor(page.items[page.items.length - 1]!.key));
   });
 });
 

packages/services/service-storage/src/storage-route-ledger.conformance.test.ts

@@ -25,8 +25,8 @@
  */
 
 import { describe, it, expect, vi } from 'vitest';
-import { registerStorageRoutes } from './storage-routes';
-import { STORAGE_ROUTE_LEDGER } from './storage-route-ledger';
+import { registerStorageRoutes } from './storage-routes.js';
+import { STORAGE_ROUTE_LEDGER } from './storage-route-ledger.js';
 
 /** Minimal IHttpServer mock that records registrations. */
 function createMockServer() {

packages/services/service-storage/src/storage-routes.test.ts

@@ -2,9 +2,9 @@
 
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import type { IHttpRequest, IHttpResponse, RouteHandler } from '@objectstack/spec/contracts';
-import { LocalStorageAdapter } from './local-storage-adapter';
-import { StorageMetadataStore } from './metadata-store';
-import { registerStorageRoutes } from './storage-routes';
+import { LocalStorageAdapter } from './local-storage-adapter.js';
+import { StorageMetadataStore } from './metadata-store.js';
+import { registerStorageRoutes } from './storage-routes.js';
 import { promises as fs } from 'node:fs';
 import { join } from 'node:path';
 import { tmpdir } from 'node:os';
@@ -409,7 +409,7 @@ describe('Storage REST Routes', () => {
   });
 
   describe('attachments download gate (#2970 item 2)', () => {
-    const commit = async (s: StorageMetadataStore, rec: Partial<import('./metadata-store').FileRecord>) =>
+    const commit = async (s: StorageMetadataStore, rec: Partial<import('./metadata-store.js').FileRecord>) =>
       s.createFile({
         id: rec.id ?? 'f-dl',
         key: rec.key ?? `attachments/${rec.id ?? 'f-dl'}.bin`,
@@ -421,7 +421,7 @@ describe('Storage REST Routes', () => {
         ...rec,
       } as any);
 
-    function serverWith(verdict: import('./storage-routes').FileReadVerdict | 'skip', extra: any = {}) {
+    function serverWith(verdict: import('./storage-routes.js').FileReadVerdict | 'skip', extra: any = {}) {
       const server = createMockHttpServer();
       const s = new StorageMetadataStore(null);
       const authorizeFileRead =