test(service-settings): alias the remaining three workspace deps to source, emptying its check-test-source-alias entry (#8104)

[huangyiirene]

Closes #8104.

#8063 gave service-settings its first vitest.config.ts and aliased two workspace deps to source. The other three — @objectstack/spec, @objectstack/platform-objects, @objectstack/types — stayed on the package's KNOWN_UNALIASED_TEST_IMPORTS entry and kept resolving through exports to dist/. They are now aliased to source, and the registry entry is deleted.

How much was actually reading the artifact: 17 of 20 files

Measured, not inferred. With the three dist/ trees physically removed from the checkout:

config	result
pre-#8104 (two aliases)	17 of 20 files fail to load, 58 of 413 cases run — Cannot find package '@objectstack/spec/system'
this PR	413 passed / 20 files

So the artifact is off the resolution path, not merely shadowed by a fresh copy of it.

The subpath entry points were the job, and the obvious shape does not do it

This package imports no bare @objectstack/spec and no bare @objectstack/platform-objects at run time. Every specifier its tests can reach for those two is a subpath:

@objectstack/spec/api          @objectstack/spec/data      @objectstack/platform-objects/system
@objectstack/spec/contracts    @objectstack/spec/system

plus @objectstack/spec/security, reached transitively through @objectstack/types ([ADR-0105 D1] tenancy posture) once types itself resolves to source.

Both shapes that suggest themselves fail, in opposite directions:

• the object form matches by prefix → swallows the subpaths into …/index.ts/system, ENOTDIR at run time in a config that reads as correct (test(service-storage): resolve @objectstack/core from source so a stale dist can't decide a pin (#7668) #7778);
• the anchored bare form (/^@objectstack\/spec$/, what fix(service-settings): repoint sys_setting.value_enc on a secret rotation, and reap the retired ciphertext (#8030) #8063 left behind) does not swallow them, but does not cover them either → all six stay on dist and the registry entry cannot come off.

What covers them is a subpath rule, and the right rule differs per package because their export maps differ:

• spec is uniform (src/<ns>/index.ts throughout) → the one-rule-for-all-namespaces capture form /^@objectstack\/spec\/([a-z-]+)$/, which cannot go stale when a new namespace import arrives.
• platform-objects is not uniform — ./plugin is src/plugin.ts, a file → an explicit /system entry. A ([a-z-]+) rule would send platform-objects/plugin to src/plugin/index.ts, a path nobody wrote, failing on whoever next adds that import. plugin-audit writes its platform-objects/audit entry the same way for the same reason.

The two halves constrain each other

KNOWN_UNALIASED_TEST_IMPORTS is audited for set equality in both directions, so neither half is green alone:

state	check-test-source-alias
before (entry present, aliases missing)	OK — 72 scanned, 62 registered
aliases complete, entry still present	FAILED — "registry entry is no longer needed … Delete the entry"
entry deleted, one alias rule removed	FAILED — "tests import 1 workspace package(s) that resolve to dist/ with no source alias"
after (both halves)	OK — 72 scanned, 61 registered

--self-test OK.

Scope

• 413 passed / 20 files, unchanged from the fix(service-settings): repoint sys_setting.value_enc on a secret rotation, and reap the retired ciphertext (#8030) #8063 baseline. Nothing turned red — expected for a checkout whose dist was built from the same commit, which is exactly the condition under which the old setup looked fine.
• Zero changes under packages/services/service-settings/src/**.
• Three files touched: the package's vitest.config.ts, the registry entry in scripts/check-test-source-alias.mjs, and a changeset. content/docs/releases/**, docs/adr/**, .claude/skills/**, skills/** untouched.

One finding, not fixed here

When the gate names an unaliased dep it prints a remediation hint that is the anchored bare form:

alias: [{ find: /^@objectstack\/spec$/, replacement: path.resolve(__dirname, '<relative>/src/index.ts') }]

For a package whose only reachable specifiers are subpaths — this one — following that hint verbatim leaves the gate red with no further guidance, since the suggested alias covers nothing it just named. The hint is correct for bare importers and misleading for subpath-only ones. Fixing it means teaching the diagnostic to print the specifiers it measured rather than a generic template; that is a change to the gate's own surface and belongs in its own card, not riding on this one.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 12, 2026 7:23pm

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-settings.

5 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/kernel/runtime-services/audit-service.mdx (via packages/services/service-settings)
• content/docs/kernel/runtime-services/index.mdx (via packages/services/service-settings)
• content/docs/kernel/runtime-services/settings-service.mdx (via packages/services/service-settings)
• content/docs/plugins/packages.mdx (via @objectstack/service-settings)
• content/docs/protocol/kernel/config-resolution.mdx (via @objectstack/service-settings)

⛔ 2 release-owned page(s) also reference the affected code. These are read-only:

• content/docs/releases/implementation-status.mdx (via @objectstack/service-settings)
• content/docs/releases/v9.mdx (via @objectstack/service-settings)

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.