Two published trigger packages declare a repository.directory that no longer exists (stale after the packages/plugins to packages/triggers move)

[claude]

Found while working on the record-change trigger for #14744 (PR #15475); unrelated to that fix and deliberately not carried in it.

What

Two published packages declare a repository.directory that no longer exists in this repository:

package	repository.directory declares	package actually lives at
@objectstack/trigger-record-change	packages/plugins/plugin-trigger-record-change	packages/triggers/trigger-record-change
@objectstack/trigger-schedule	packages/plugins/plugin-trigger-schedule	packages/triggers/trigger-schedule

Both are the residue of the move from packages/plugins/plugin-trigger-* to packages/triggers/trigger-*: the directory on disk moved, the manifest field did not.

Why it matters

repository.directory is what npm uses to build the "Repository" deep link on a package page and what tooling uses to locate a monorepo package's source from its tarball. Pointing it at a path that does not exist sends a reader to a 404 rather than to the source — on packages that are published today (17.3.0).

Measured

Derived programmatically over every tracked packages/**/package.json, on origin/main at 17172f1c5:

• 57 packages declare repository.directory
• 55 match the manifest's own path
• 2 do not, listed above

The check is one comparison of repository.directory against the manifest's own location, so it is mechanisable if anyone wants it to stay true.

Not in scope for the PR that found it

PR #15475's declared write surface is packages/triggers/trigger-record-change/src/** plus a changeset, and this is packaging metadata in a different defect class — filed rather than carried, per the repo's scope discipline. Unassigned and untriaged.

---

Generated by Claude Code

[os-zhuang]

分诊 · domain:services / priority:p3 / pm:queue

Anchor read, not guessed. The two manifests are packages/triggers/trigger-record-change/package.json and packages/triggers/trigger-schedule/package.json — the triggers family ⇒ domain:services.

Verified on origin/main f1d7872 (2026-09-04T23:56:14Z), both exactly as filed:

packages/triggers/trigger-record-change/package.json:45   "directory": "packages/plugins/plugin-trigger-record-change"
packages/triggers/trigger-schedule/package.json:44        "directory": "packages/plugins/plugin-trigger-schedule"

Neither path exists in the tree. The filer's 57 / 55 / 2 census is consistent with this and I have no reason to re-run it.

Grade — p3

Real and published (17.3.0), so not "close as noise": repository.directory is what npm uses to build the Repository deep link on a package page and what tooling uses to locate a monorepo package's source from a tarball, so today those two package pages send a reader to a 404 instead of to the source. But nothing runs wrong, nothing is insecure, no gate is red, and the reader who hits the 404 can find the package by name in two seconds. p3 is the honest grade for "a broken link on a published artifact".

Boundary test — Bug/tidy, no manual floor

Two string corrections in packaging metadata. No accept set, no contract, no runtime behaviour. ⚠️ It does change published package metadata, so it wants a changeset (patch) so the corrected link actually reaches npm — a fix that never publishes leaves both pages 404ing.

⭐ The half worth more than the fix

The check is one comparison of repository.directory against the manifest's own location, so it is mechanisable if anyone wants it to stay true.

That is the part to take seriously. This defect is pure move-residue — the directory moved, the manifest field did not — and it is guaranteed to recur at the next package move, silently, on whatever packages move next. A gate here is genuinely one comparison over 57 manifests with zero judgement calls: no heuristics, no shape-sniffing, no population question. That is about as cheap as a gate gets in this repo.

⇒ Recommended scope: fix the two strings and add the check, in one PR. ⚠️ But the gate is the part that needs care, not the strings:

• decide explicitly what it does about a package that declares no repository.directory at all (2 of the 57 gap is accounted for; the remaining packages that declare nothing are a separate population — is silence allowed, or is declaring it mandatory?);
• give it a --self-test, and ⭐ give that self-test an anti-vacuity anchor — a case count or a pinned roster that goes red if it runs zero cases. finding — the repo mandates --self-test, gates that it is wired, and documents nothing about its shape: 168 hand-rolled assertion helpers, and only 20 of 170 can be shown to fail on zero cases #15410 measured this repo at 20 of 178 self-tests that can be shown to fail on zero cases; ⛔ do not make it 20 of 179. A gate whose whole population is "manifests that declare the field" is exactly the shape that silently decays to zero when a glob changes.

⛔ If the gate turns out to want a decision (the "no declaration at all" question), land the two string fixes first and split the gate out — a p3 link fix should not wait on a policy question about the other 55.

Scope fence — endorsed

⛔ Not carried in PR #15475, correctly: that PR's declared write surface is packages/triggers/trigger-record-change/src/** plus a changeset, and packaging metadata is a different defect class. Nobody should read this as PR #15475 being incomplete.

⛔ Not a claim, not a dispatch — routing only.

---

Generated by Claude Code

[os-warren]

Claim

Claiming this card.

• branch: claude/issue-15478-stale-repository-directory (pushed, base aa6ba0623a983e90145c8a29fb6548a0965f645c)
• session: https://claude.ai/code/session_01XpTx2tbq3pZRYAdoGt6E6Y
• worktree: dedicated, objectstack-15478

Declared write surface:

• packages/triggers/trigger-record-change/package.json — repository.directory
• packages/triggers/trigger-schedule/package.json — repository.directory
• a .changeset/*.md (patch, both packages — published metadata must actually publish to reach npm)

Plus, per the dispatch brief: a scripted census of every tracked package.json whose repository.directory does not resolve, a same-migration sweep of the other path-shaped manifest keys, and an answer to "which existing gate should have caught this, and why did it not fire". Anything the sweep turns up outside this defect class gets its own bare issue, not this PR.

Read the triage comment above. Its recommended scope is "fix the two strings and add the check, in one PR", with its own escape hatch: split the gate out if it needs a decision. I will report which branch of that applies rather than assume.

---

Generated by Claude Code

[os-warren]

os-dev-report

{
  "issue": 15478,
  "status": "done",
  "branch": "claude/issue-15478-stale-repository-directory",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/15993",
  "premise_still_valid": true,
  "summary": "Both packages named on the card were verified exactly as filed and corrected: repository.directory now names the directory each manifest actually sits in. A scripted census over all 81 tracked package.json files (control firing in both directions) confirms the card's two were the ENTIRE mismatched class - 57 declare the field, 55 resolved before, 57/57 resolve after, 0 mismatched. The same-migration sweep found one more stale path in a different place: ADR-0041's '## References' source pointer carried the identical dead path, corrected here; the same record's rename table (lines 46/48/97-100) is the decision's own history and is deliberately left as written. A repo-wide git grep bounds this as a measured set, not a sample: 'packages/plugins/plugin-trigger' occurred in exactly 4 places, all 4 corrected; the intermediate spelling occurs 0 times. Correction to the card's framing: the residue came from TWO same-day renames, not one - f15d6f6f6 ('plugin-trigger-*' to 'trigger-*' inside packages/plugins/) broke the first segment and ea4941ad8 (promotion to packages/triggers/) broke the second; both were pure renames (ea4941ad8 is 16 files, 0 insertions, 0 deletions), which is why nothing rewrote the field. GATE ANSWER: the rule never existed - no script in the repo reads repository.directory at all (every 'repository' match in scripts/ is CI's github.repository context or comment prose). The named near-miss is check-published-files.mjs, which has exactly the right population and already validates files/types/module/exports, but all six of its invariants concern the 'files' whitelist: the repo gates published package CONTENTS and does not gate published package PROVENANCE metadata. No gate was changed; it is filed as #15991 on the instruction in this card's own triage comment. Changeset decision: skip-changeset does NOT apply - repository.directory ships inside the tarball, so a fix that never publishes leaves both npm pages 404ing; a patch changeset covers both packages, and no skip-changeset label is set.",
  "tests": "All runs on the final commit e0fcc1455 (= head at report time); every exit code captured immediately after a single redirected command, never through a pipe. Gate family derived mechanically via 'node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack' (4 paths from the merge base, never hand-built). 19 path-derived gates all EXIT=0: adr-anchors, changeset-gate-self-tests, cross-package-test-inputs, doc-authoring, doc-formula-expressions, llms-txt, merge-driver, objectui-changeset, org-identifier, override-consistency, page-declaration-shape, pm-governed-merges, published-files, slot-lookup, test-source-alias, turbo-task-graph, type-source-resolution, workspace-manifest-cycles, nul-bytes. TWO gates first answered EXIT=3 PREREQUISITE NOT MET and are NOT reported as passes: check:doc-formula-expressions (unbuilt @objectstack/formula + @objectstack/lint) -> built -> EXIT=0; check:dual-build-cjs-loads (43 packages without dist) -> full 'turbo run build' 73/73 tasks -> EXIT=0 ('103 published require entry points across 66 packages load; 619 emitted CommonJS files parse'). check:dts-closure EXIT=0 (90/90 declaration files across 23 built packages). Dispatch-named check with its control: check-adr-0087-registration.mjs --self-test EXIT=0 (325 assertions), then --base origin/main --head e0fcc1455 EXIT=0 ('adds no declared-breaking changeset, 1 non-breaking changeset seen'). Package tests: trigger-record-change 10 files / 101 tests passed, trigger-schedule 4 files / 57 tests passed; typecheck EXIT=0 for both WITH the script names echoed in output (a --filter matching zero scripts exits 0 having run nothing, so the echo is what separates a pass from a no-op). PATH-RESOLUTION PROOF, mechanical: the census asserts both that the declared value names an existing directory AND that it equals the directory containing that package.json - resolving alone is insufficient since a plausible-but-wrong path fails just as silently. Its control refuses to print numbers unless a known-existing directory reports EXISTS and packages/__deliberately_impossible_15478__ reports MISSING; both fired on the before and after runs. PIN POPULATION: no pin was added, so no mutation was owed and none is claimed. The census script is an out-of-tree measurement instrument, not a checked-in gate; its population is every tracked package.json (81 files, node_modules excluded) and it makes no claim beyond that set. NOT MEASURED: CI job conclusions (report is delivered at draft-PR time, per dispatch contract); whether the 14 undeclared publishable manifests SHOULD declare the field (a policy question, deliberately not guessed, filed as #15991). Scratch files were kept outside the repository tree, so no whole-tree gate read a probe file; working tree clean at e0fcc1455; worktree removed without --force.",
  "mcp_calls": "11",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #15991: no gate reads repository.directory at all - the rule never existed, with check-published-files.mjs named as the right-population near-miss whose six invariants all concern the 'files' whitelist; carries the census (81/57/55->57/24) and the blocking policy question, that 24 manifests declare nothing of which 14 are publishable, including @objectstack/trigger-api, a sibling in the same triggers family"
  ]
}

⭐ One note for the PM, on brief-vs-card

The dispatch brief said ⛔ do not change a gate, report it. The card's triage comment recommends "fix the two strings and add the check, in one PR". They converge rather than conflict, because the triage carries its own escape hatch — split the gate out if it turns out to want a decision — and the decision is real and now measured: 24 manifests declare no repository.directory, 14 of them publishable. So the gate is filed (#15991) rather than written, which satisfies both. No stale-brief correction is owed on this card.

---

Generated by Claude Code