build(typecheck): graduate cloud-connection, observability and hono from the DEBT ledger (#20800) (#21038)

Fixes #20800
Clause-②: no

The last three packages of the #4311 type-check ledger,
`@objectstack/cloud-connection`, `@objectstack/observability` and
`@objectstack/hono`, now type-check their own test layer. Each gets a
sibling `tsconfig.test.json` named by a new `typecheck` script, every
code-tier error is repaired at its cause inside the test layer, and the
three `DEBT` entries are deleted rather than lowered. `DEBT` in
`scripts/check-type-check-coverage.mjs` now holds
`@objectstack/spec-monorepo` alone; `@objectstack/console` stays
`EXEMPT`, as the card says.

## What changed

| Path | Change |
|---|---|
|
`packages/{cloud-connection,observability,adapters/hono}/tsconfig.test.json`
| new: extends the package's build config, `noEmit`, `module: esnext` /
`moduleResolution: bundler`, `lib` ES2022 (hono keeps its `DOM` libs).
Strictness, `paths`, `rootDir` and `types` are inherited and not
re-declared. Each header carries its own measured readings. |
| `packages/{cloud-connection,observability,adapters/hono}/package.json`
| `typecheck` = `tsc --noEmit && tsc --noEmit -p tsconfig.test.json`,
the zero-residue shape `metadata-fs` and `trigger-record-change` use: no
per-package ledger, no new dependency, no lockfile change. |
| test files (listed below) | the code-tier repairs. No cast, no
`@ts-expect-error`, no `src` signature widened. |
| `scripts/check-type-check-coverage.mjs` | the three `DEBT` entries
deleted, plus one graduation paragraph in the same style as the ones
above it. No gate logic moved. |

## Both readings, before any fix

Taken at `f8178ffece` (origin/main) with the workspace closure built
first, once per config: `tsc --noEmit --pretty false --listFiles -p
tsconfig.json` (the build config) and the same with the new
`tsconfig.test.json`.

| package | files in the test program (own tests) | build config | test
config | config tier | code tier |
|---|---:|---|---|---:|---:|
| `@objectstack/cloud-connection` | 923 (30) | 13 = TS2493 x11 + TS2550
x2 | 11 = TS2493 x11 | 2 | 11 |
| `@objectstack/observability` | 401 (7) | 11 = TS2554 x10 + TS2552 x1 |
11 = same | 0 | 11 |
| `@objectstack/hono` | 858 (5) | 3 = TS2769 x2 + TS18046 x1 | 3 = same
| 0 | 3, and 4 more once those cleared (below) |

The build-config column reproduces the ledger exactly (13 / 11 / 3). All
three build configs already included the tests and never excluded them,
so the program that reads them always existed; no script ever ran it.
That is the `service-automation` shape, not an exclude-and-compensate
one.

After: every config of every package reads 0, and `typecheck` exits 0
for all three.

## Each error repaired at its cause

| Package / file | Errors | Cause | Repair |
|---|---|---|---|
| cloud-connection: `cloud-connection-plugin.test.ts` x3,
`connection-credential-store.test.ts` x4 (7 declarations) | TS2493 x11 |
`vi.fn(async () => new Response(...))` declared with no parameters, so
vitest types `mock.calls` as empty tuples, and the test indexes
`calls[0][0]` / `[1]` | the mock is typed to the call it stubs:
`vi.fn(async (_url: string, _init?: RequestInit) => ...)`, the shape
`fetch(url, init)` is always called with in the plugin |
| cloud-connection: `marketplace-install-local-bundle.test.ts` x2 |
TS2550 x2 (config tier) | `Array#at` under the build config's `lib`
ES2020 | rewritten to vitest's `mock.lastCall`, not a widening of the
shared build config (the `service-storage` call recorded in the ledger
prose). The test config also carries ES2022, but the first leg of
`typecheck` reads these files under ES2020 too, so the file itself had
to compile under both |
| observability: `error-exporters.test.ts`, `loggers.test.ts`,
`metrics-exporters.test.ts` | TS2554 x10 | the Noop classes declare
zero-parameter methods (legal narrowing), so calls on the concrete class
type have arity 0 while the contract consumers call through has the real
one | the instance is declared as the contract it is used through
(`ErrorReporter`, `Logger`, `MetricsRegistry`). The source signatures
were not widened |
| observability: `otlp-http.test.ts` | TS2552 | fake `fetch` parameter
named `RequestInfo`, a DOM-lib name this program does not have | typed
as the union of string, URL and Request, the call site it stubs |
| hono: `hono.test.ts` | TS2769 x2, TS18046 | a bare `new Hono()`
declares no `Variables`, so `c.get('objectStack')` takes `never` and
returns `unknown` | the two tests that read the variable back build
their app with a `KernelEnv` type argument declaring `objectStack` (the
middleware does `c.set('objectStack', kernel)`) |
| hono: `src/__mocks__/runtime.ts` | TS2883 x4, latent | see the next
section | the four `vi.fn()` fields are annotated `Mock` |

## A finding for the reviewer: hono's "3" was not its whole pile

With the three semantic errors repaired, the hono test config reported
four more: TS2883 on the four `vi.fn()` class fields of
`src/__mocks__/runtime.ts` (the inferred type cannot be named without a
reference to `Procedure` inside the pnpm store). tsc withholds
declaration-emit diagnostics while any semantic error stands, so the
first reading could not show them, and the build config never shows them
at all (it exits 0 on that file; only the `bundler` resolution reports
it). Observed in two states: state A (original files) reads 3 errors and
no TS2883; state B (`hono.test.ts` repaired, mock not yet) reads exactly
4 TS2883 and nothing else. The repair is a test-support annotation; the
file is a vitest alias target (`vitest.config.ts`), never built or
published.

Nothing was hiding behind the other two: for cloud-connection and
observability both configs read 0 once the listed errors were repaired.

## Acceptance, measured

All at head `5f4aa15801` unless stated (the branch is two commits plus a
merge of `origin/main` at `9b0de7de73`, taken so the derived gate list
was not read from a stale tree; closure rebuilt after the merge).

- `pnpm --filter PKG run typecheck` exits **0** for all three; each run
echoes the `typecheck` script name.
- `pnpm check:type-check-coverage`: OK, "79/80 workspace packages
type-checked (plus the root), 1 in the DEBT ledger (26 frozen raw
errors), 1 exempt". `pnpm check:type-check-debt`: OK, "1 ledger
entr(ies) re-measured ... none above its recorded number", surplus none.
- The three suites do not regress: cloud-connection 30 files / 397
tests, observability 7 / 85, hono 5 / 122, all passing; the diff touches
no `it(`, `test(` or `describe(` line.
- **The new scripts can fail.** Planted through
`scripts/ablation-replace.mjs` (anchor must hit once, blob change
proven, restore proven) in one test file per package that this PR does
not otherwise edit: the copyright line of
`marketplace-public-url.test.ts`, `perf-timing.test.ts` and
`hono-wildcard-fallthrough.test.ts` replaced by a line assigning a
string to a `number`. Each `typecheck` exited **2**, naming that file
(TS2322 and TS6133), and each restore left the blob equal to HEAD with
`git diff HEAD` empty. Direction observed: turns red, as expected.
- `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack
--commands` derived 82 families; all 82 were run one by one with the
exit code captured before any pipe, and `--ran` reconciles "82 derived,
82 run, 0 NOT-MEASURED, 0 UNRUN". `check:pm-dispatch-gates` needed the
detached form its own header prescribes (about 17 minutes on this shared
box; its first two foreground attempts were cut by my own timeout and
are not counted).
- `pnpm lint` exits **0** over the whole repo at `5f4aa15801`.

## Changeset

None written. The diff changes no file the three packages ship:
`files[]` is `dist`, `README.md` and `CHANGELOG.md`; the `dist` build is
from `src/index.ts` and reaches no test file or `__mocks__`; and after
building the three packages, a grep of their `dist` for every symbol
this PR introduced (`KernelEnv`, `lastCall`, the `_init` parameter,
`type Mock`) found nothing, while a positive control
(`CloudConnectionPlugin`, `InMemoryErrorReporter`, `createHonoApp`) hit
in each. The only shipped-manifest change is the `scripts` block of each
`package.json`. The seat applies `skip-changeset`.

## Acceptance notes

- `@objectstack/spec-monorepo` (root entry, 26) is untouched, as the
card says. Its `compositionAt` staleness notice is the same one `main`
prints.
- Not run locally: the repository-wide CI jobs (`pnpm test` for the
whole repo, the full dogfood set); they are CI's.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01VvcEokUG1tvVxkceYfR5XB)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

packages/adapters/hono/package.json

@@ -14,7 +14,8 @@
   "scripts": {
     "build": "tsup --config ../../../tsup.config.ts && node ../../../scripts/check-dts-emitted.mjs",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json"
   },
   "dependencies": {
     "@objectstack/plugin-hono-server": "workspace:*",

packages/adapters/hono/src/__mocks__/runtime.ts

@@ -9,13 +9,13 @@
 // in `packages/**`. Declaring MORE than this adapter calls is fine (it calls
 // only `getDiscoveryInfo`, `handleAuth` and `dispatch`); declaring something the
 // dispatcher does not implement is not.
-import { vi } from 'vitest';
+import { vi, type Mock } from 'vitest';
 
 export class HttpDispatcher {
-  getDiscoveryInfo = vi.fn().mockReturnValue({ version: '1.0', routes: {} });
-  handleAuth = vi.fn().mockResolvedValue({ handled: true, response: { status: 200, body: { ok: true } } });
-  handleMetadata = vi.fn().mockResolvedValue({ handled: true, response: { status: 200, body: { objects: [] } } });
-  handleData = vi.fn().mockResolvedValue({ handled: true, response: { status: 200, body: { records: [] } } });
+  getDiscoveryInfo: Mock = vi.fn().mockReturnValue({ version: '1.0', routes: {} });
+  handleAuth: Mock = vi.fn().mockResolvedValue({ handled: true, response: { status: 200, body: { ok: true } } });
+  handleMetadata: Mock = vi.fn().mockResolvedValue({ handled: true, response: { status: 200, body: { objects: [] } } });
+  handleData: Mock = vi.fn().mockResolvedValue({ handled: true, response: { status: 200, body: { records: [] } } });
 
   constructor(_kernel: any) {}
 }

packages/adapters/hono/src/hono.test.ts

@@ -22,13 +22,18 @@ import { objectStackMiddleware, createHonoApp } from './index';
 
 const mockKernel = { name: 'test-kernel' } as any;
 
+// What `objectStackMiddleware` puts on the context (`c.set('objectStack', kernel)`).
+// An app a test reads it back from must declare that variable: a bare `new Hono()`
+// has no `Variables`, so Hono types `c.get` as taking `never`.
+type KernelEnv = { Variables: { objectStack: { name: string } } };
+
 describe('objectStackMiddleware', () => {
   beforeEach(() => {
     vi.clearAllMocks();
   });
 
   it('sets kernel on context via c.set', async () => {
-    const app = new Hono();
+    const app = new Hono<KernelEnv>();
     const middleware = objectStackMiddleware(mockKernel);
 
     app.use('*', middleware);
@@ -61,7 +66,7 @@ describe('objectStackMiddleware', () => {
   });
 
   it('provides the correct kernel instance', async () => {
-    const app = new Hono();
+    const app = new Hono<KernelEnv>();
     const middleware = objectStackMiddleware(mockKernel);
 
     app.use('*', middleware);

packages/adapters/hono/tsconfig.test.json

@@ -0,0 +1,75 @@
+// The TEST-layer type-check program (#20800 -- the last three packages of the
+// #4311 ledger, graduated by the #15048 / #15050 road: a sibling program named
+// by the `typecheck` script). `tsconfig.json` beside this one stays exactly as
+// it is: it is the BUILD config. `package.json`'s `typecheck` script NAMES this
+// sibling (`tsc --noEmit -p tsconfig.test.json`), because a config no script
+// invokes reads as coverage and delivers none.
+//
+// WHAT THE BUILD CONFIG ALREADY DID. `tsconfig.json` includes `src/**/*` with no
+// test exclusion, so the program that reads these tests always existed; the
+// package simply declared no `typecheck` script, so nothing ever ran it. That
+// is the `service-automation` / `service-cluster` shape, not the
+// exclude-and-compensate one, and AGENTS.md forbids ADDING such an exclusion.
+//
+// What differs from the build config, and what deliberately does NOT:
+//   - MODULE SEMANTICS and `lib`, nothing else. vitest runs these files as ESM
+//     through esbuild on a Node that has the ES2022 builtins. `lib` keeps the
+//     build config's `DOM` / `DOM.Iterable` (a child's `lib` REPLACES the
+//     parent's, it does not merge) and adds ES2022 for the Node the suite runs
+//     on. The build leg of the script (`tsc --noEmit`) keeps the NodeNext
+//     reading of the same files.
+//   - STRICTNESS IS UNTOUCHED. `strict`, `noUnusedLocals`, `noUnusedParameters`,
+//     `noImplicitReturns`, `noFallthroughCasesInSwitch`, `rootDir`, `paths` and
+//     `types` are all INHERITED and none is re-declared. ⚠️ A child that declared
+//     its own `paths` would REPLACE the parent map, so this file declares none.
+//     Nothing here may loosen a type rule; if a test does not compile, that is
+//     the finding.
+//
+// MEASURED at f8178ffece (origin/main), the workspace closure built first
+// (`turbo run build --filter='@objectstack/hono^...'`), BEFORE any fix, once per
+// config (`tsc --noEmit --pretty false [--listFiles] -p <config>`):
+//
+//   program under this config     858 files (7 of them this package's `src`),
+//                                 all 5 of its `src/**/*.test.ts` in it
+//   BUILD config (tsconfig.json)  3  = TS2769 x2 + TS18046 x1
+//   THIS config                   3  = TS2769 x2 + TS18046 x1
+//
+// The two readings AGREE, so no config-tier pile; the 3 were code tier. All in
+// `hono.test.ts` (36, 69, 70): a bare `new Hono()` has Hono's default `Env`, which
+// declares no `Variables`, so `c.get('objectStack')` is typed as taking `never`
+// (TS2769 x2) and the `kernel` it returns is `unknown` (TS18046). The middleware
+// under test does `c.set('objectStack', kernel)`, so the two tests that read the
+// variable back now build their app as `new Hono<KernelEnv>()` with the variable
+// declared (`{ objectStack: { name: string } }`, the one field the test reads).
+// `objectStackMiddleware`'s `(c: any, next: any)` source signature was NOT touched.
+//
+// THESE 3 WERE NOT THE WHOLE PILE. With them fixed, THIS config reported 4 more:
+// TS2883 ("The inferred type of 'getDiscoveryInfo' cannot be named without a
+// reference to 'Procedure' from '.pnpm/@vitest+spy@4.1.11/...'") on the four
+// `vi.fn()` class fields of `src/__mocks__/runtime.ts`. tsc withholds
+// declaration-emit diagnostics while any semantic error stands, so the first
+// reading could not show them, and the BUILD config never shows them at all
+// (observed: exit 0 on the same file under NodeNext resolution; only this
+// config's `bundler` resolution reports it). The `DEBT` ledger's "3" was a count
+// of what the first config could see, not of what this layer holds. Repaired
+// at the cause, the same way as the others: the four fields are annotated
+// `Mock` (vitest's own mock type) instead of leaving the inferred type to name an
+// unexported pnpm-store path. No cast, no `@ts-expect-error`, no `src` change:
+// `src/__mocks__/runtime.ts` is a vitest alias target (`vitest.config.ts`), never
+// built or published (`tsup` enters `src/index.ts` alone).
+//
+// AFTER: 0 and 0. There is NO `test-typecheck-debt.json` beside this config, and
+// its ABSENCE is the zero: any error in any file here is red immediately, with no
+// ledger to be added to -- the same call `metadata-fs` and
+// `trigger-record-change` recorded.
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"]
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist"]
+}

packages/cloud-connection/package.json

@@ -20,7 +20,8 @@
   },
   "scripts": {
     "build": "tsup --config ../../tsup.config.ts && node ../../scripts/check-dts-emitted.mjs",
-    "test": "vitest run"
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json"
   },
   "dependencies": {
     "@objectstack/core": "workspace:*",

packages/cloud-connection/src/cloud-connection-plugin.test.ts

@@ -151,7 +151,7 @@ describe('multi-tenant mode (env-registry + per-env kernel auth)', () => {
     it('install forwards to the control plane install action for an authenticated session', async () => {
         const rawApp = makeRawApp();
         const { ctx, fireKernelReady } = makeCtx({ rawApp, services: mtServices('user-1') });
-        const fetchSpy = vi.fn(async () => new Response(JSON.stringify({ success: true, data: { installed: true } }), { status: 200 }));
+        const fetchSpy = vi.fn(async (_url: string, _init?: RequestInit) => new Response(JSON.stringify({ success: true, data: { installed: true } }), { status: 200 }));
         vi.stubGlobal('fetch', fetchSpy);
         await new CloudConnectionPlugin({ controlPlaneUrl: 'http://cloud.test', controlPlaneApiKey: 'svc-key' }).start(ctx as any);
         await fireKernelReady();
@@ -180,7 +180,7 @@ describe('multi-tenant mode (env-registry + per-env kernel auth)', () => {
         const rawApp = makeRawApp();
         const { ctx, fireKernelReady } = makeCtx({ rawApp, services: mtServices('user-1') });
         const items = [{ id: 'pkg_a', manifest_id: 'com.acme.crm' }];
-        const fetchSpy = vi.fn(async () => new Response(JSON.stringify({ success: true, data: { items } }), { status: 200 }));
+        const fetchSpy = vi.fn(async (_url: string, _init?: RequestInit) => new Response(JSON.stringify({ success: true, data: { items } }), { status: 200 }));
         vi.stubGlobal('fetch', fetchSpy);
         await new CloudConnectionPlugin({ controlPlaneUrl: 'http://cloud.test', controlPlaneApiKey: 'svc-key' }).start(ctx as any);
         await fireKernelReady();
@@ -206,7 +206,7 @@ describe('single-environment mode (host auth, fixed env id)', () => {
     it('uses the configured environment id + the host kernel auth session', async () => {
         const rawApp = makeRawApp();
         const { ctx, fireKernelReady } = makeCtx({ rawApp, services: { auth: sessionAuth('admin-1') } });
-        const fetchSpy = vi.fn(async () => new Response(JSON.stringify({ success: true, data: { packages: [{ id: 'p1' }] } }), { status: 200 }));
+        const fetchSpy = vi.fn(async (_url: string, _init?: RequestInit) => new Response(JSON.stringify({ success: true, data: { packages: [{ id: 'p1' }] } }), { status: 200 }));
         vi.stubGlobal('fetch', fetchSpy);
         await new CloudConnectionPlugin({
             singleEnvironment: true,

packages/cloud-connection/src/connection-credential-store.test.ts

@@ -112,7 +112,7 @@ describe('CloudConnectionPlugin credential behavior', () => {
         new ConnectionCredentialStore(credPath).write({ runtimeToken: 'oscc_stored', environmentId: 'env_1' });
         const rawApp = makeRawApp();
         const { ctx, fire } = makeCtx(rawApp, { auth: sessionAuth('admin'), manifest: { register: vi.fn() } });
-        const fetchSpy = vi.fn(async () => new Response(JSON.stringify({ success: true, data: { items: [] } }), { status: 200 }));
+        const fetchSpy = vi.fn(async (_url: string, _init?: RequestInit) => new Response(JSON.stringify({ success: true, data: { items: [] } }), { status: 200 }));
         vi.stubGlobal('fetch', fetchSpy);
         await new CloudConnectionPlugin({
             singleEnvironment: true, controlPlaneUrl: 'http://cloud.test', controlPlaneApiKey: '', credentialPath: credPath,
@@ -134,7 +134,7 @@ describe('CloudConnectionPlugin credential behavior', () => {
         store.write({ runtimeToken: 'oscc_stored', environmentId: 'env_1' });
         const rawApp = makeRawApp();
         const { ctx, fire } = makeCtx(rawApp, { auth: sessionAuth('admin'), manifest: { register: vi.fn() } });
-        const fetchSpy = vi.fn(async () => new Response(JSON.stringify({ success: true }), { status: 200 }));
+        const fetchSpy = vi.fn(async (_url: string, _init?: RequestInit) => new Response(JSON.stringify({ success: true }), { status: 200 }));
         vi.stubGlobal('fetch', fetchSpy);
         await new CloudConnectionPlugin({
             singleEnvironment: true, controlPlaneUrl: 'http://cloud.test', controlPlaneApiKey: '', credentialPath: credPath,
@@ -221,7 +221,7 @@ describe('CloudConnectionPlugin credential behavior', () => {
         store.write({ runtimeToken: 'oscc_stored', runtimeId: 'rt-1' });
         const rawApp = makeRawApp();
         const { ctx, fire } = makeCtx(rawApp, { auth: sessionAuth('admin'), manifest: { register: vi.fn() } });
-        const fetchSpy = vi.fn(async () => new Response(JSON.stringify({ success: true }), { status: 200 }));
+        const fetchSpy = vi.fn(async (_url: string, _init?: RequestInit) => new Response(JSON.stringify({ success: true }), { status: 200 }));
         vi.stubGlobal('fetch', fetchSpy);
         await new CloudConnectionPlugin({
             singleEnvironment: true, controlPlaneUrl: 'http://cloud.test', controlPlaneApiKey: '', credentialPath: credPath,
@@ -267,7 +267,7 @@ describe('CloudConnectionPlugin credential behavior', () => {
         new ConnectionCredentialStore(credPath).write({ runtimeToken: 'oscc_stored', runtimeId: 'rt-1' });
         const rawApp = makeRawApp();
         const { ctx, fire } = makeCtx(rawApp, { auth: sessionAuth('admin'), manifest: { register: vi.fn() } });
-        const fetchSpy = vi.fn(async () => new Response(JSON.stringify({ success: true, data: { items: [{ id: 'p1' }] } }), { status: 200 }));
+        const fetchSpy = vi.fn(async (_url: string, _init?: RequestInit) => new Response(JSON.stringify({ success: true, data: { items: [{ id: 'p1' }] } }), { status: 200 }));
         vi.stubGlobal('fetch', fetchSpy);
         await new CloudConnectionPlugin({
             singleEnvironment: true, controlPlaneUrl: 'http://cloud.test', controlPlaneApiKey: '', credentialPath: credPath,

packages/cloud-connection/src/marketplace-install-local-bundle.test.ts

@@ -78,7 +78,7 @@ describe('install-local compiled-bundle normalization', () => {
 
         // The UI bundle registers at kernel:ready; the LAST register call is
         // the installed package — flattened: top-level id + sections.
-        const installed = register.mock.calls.at(-1)![0];
+        const installed = register.mock.lastCall![0];
         expect(installed.id).toBe('app.acme.crm');
         expect(installed.namespace).toBe('crm');
         expect(installed.version).toBe('2.0.0');
@@ -103,6 +103,6 @@ describe('install-local compiled-bundle normalization', () => {
             makeC({ manifest: flat }),
         );
         expect(res.payload?.success).toBe(true);
-        expect(register.mock.calls.at(-1)![0].id).toBe('com.acme.flat');
+        expect(register.mock.lastCall![0].id).toBe('com.acme.flat');
     });
 });

packages/cloud-connection/tsconfig.test.json

@@ -0,0 +1,72 @@
+// The TEST-layer type-check program (#20800 -- the last three packages of the
+// #4311 ledger, graduated by the #15048 / #15050 road: a sibling program named
+// by the `typecheck` script). `tsconfig.json` beside this one stays exactly as
+// it is: it is the BUILD config. `package.json`'s `typecheck` script NAMES this
+// sibling (`tsc --noEmit -p tsconfig.test.json`), because a config no script
+// invokes reads as coverage and delivers none.
+//
+// WHAT THE BUILD CONFIG ALREADY DID. `tsconfig.json` includes `src` with no
+// test exclusion, so the program that reads these tests always existed; the
+// package simply declared no `typecheck` script, so nothing ever ran it. That
+// is the `service-automation` / `service-cluster` shape, not the
+// exclude-and-compensate one, and AGENTS.md forbids ADDING such an exclusion.
+//
+// What differs from the build config, and what deliberately does NOT:
+//   - MODULE SEMANTICS and `lib`, nothing else. vitest runs these files as ESM
+//     through esbuild on a Node that has the ES2022 builtins, and the root
+//     config's `lib` is ES2020. `module: esnext` / `moduleResolution: bundler`
+//     is the reading vitest really performs; the build leg of the script
+//     (`tsc --noEmit`) keeps the stricter NodeNext reading of the same files,
+//     so the two programs complement each other rather than overlap.
+//   - STRICTNESS IS UNTOUCHED. `strict`, `noUnusedLocals`, `noUnusedParameters`,
+//     `noImplicitReturns`, `noFallthroughCasesInSwitch`, `rootDir`, `paths` and
+//     `types` are all INHERITED and none is re-declared. ⚠️ A child that declared
+//     its own `paths` would REPLACE the parent map, so this file declares none.
+//     Nothing here may loosen a type rule; if a test does not compile, that is
+//     the finding.
+//
+// MEASURED at f8178ffece (origin/main), the workspace closure built first
+// (`turbo run build --filter='@objectstack/cloud-connection^...'`), BEFORE any
+// fix, once per config (`tsc --noEmit --pretty false [--listFiles] -p <config>`):
+//
+//   program under this config     923 files (44 of them this package's `src`),
+//                                 all 30 of its `src/**/*.test.ts` in it
+//   BUILD config (tsconfig.json)  13  = TS2493 x11 + TS2550 x2
+//   THIS config                   11  = TS2493 x11
+//
+// The two readings DISAGREE by exactly two, and those two are the config tier:
+// TS2550 ("Property 'at' does not exist ... change your target library"), both
+// `Array#at` in `marketplace-install-local-bundle.test.ts` (81, 106) -- the CHECK
+// reading ES2020 where the runtime is Node >= 22, which is what `lib` below
+// reconciles. The other 11 are code tier and agree under both configs: TS2493
+// ("Tuple type '[]' of length '0' has no element at index N"), every one an
+// index into `fetchSpy.mock.calls[0]` where `fetchSpy = vi.fn(async () => ...)`
+// was declared with NO parameters, so vitest types `.mock.calls` as an array of
+// EMPTY tuples. The call site it stubs is `fetch(url, init)`, which the plugin
+// always calls with a string URL and an init object; the fix types each of the 7
+// declarations (`cloud-connection-plugin.test.ts` x3,
+// `connection-credential-store.test.ts` x4) to that call --
+// `vi.fn(async (_url: string, _init?: RequestInit) => ...)`. No cast was added,
+// no `@ts-expect-error`, no `src` signature touched.
+//
+// The build leg reads these tests under ES2020 too, so the two `Array#at` reads
+// were not left to this file's `lib`: they now use vitest's own
+// `mock.lastCall` (the LAST register call, which is what both comments say),
+// which compiles under both programs. Without that the first leg of `typecheck`
+// would stay red on files this leg accepts.
+//
+// AFTER: 0 and 0. There is NO `test-typecheck-debt.json` beside this config, and
+// its ABSENCE is the zero: any error in any file here is red immediately, with no
+// ledger to be added to -- the same call `metadata-fs` and
+// `trigger-record-change` recorded.
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "lib": ["ES2022"]
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist"]
+}

packages/observability/package.json

@@ -20,7 +20,8 @@
   },
   "scripts": {
     "build": "tsup --config ../../tsup.config.ts && node ../../scripts/check-dts-emitted.mjs",
-    "test": "vitest run"
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json"
   },
   "dependencies": {
     "@objectstack/spec": "workspace:*"