[finding] `@objectstack/plugin-auth`'s `typecheck` cannot pass unless the package's OWN `dist/` is built, and no task dependency says so

[os-sam]

Found while verifying #11579 (PR #11619) in a fresh worktree. Filed unassigned, not fixed there — out of that card's scope.

What happens

On a tree where @objectstack/plugin-auth's dependency closure is built but the package itself is not, pnpm --filter @objectstack/plugin-auth typecheck fails:

examples/basic-usage.ts(13,28): error TS2307: Cannot find module '@objectstack/plugin-auth' or its corresponding type declarations.
 ERR_PNPM_RECURSIVE_RUN_FIRST_FAIL @objectstack/plugin-auth@17.2.0 typecheck: `tsc --noEmit && tsc --noEmit -p tsconfig.examples.json`
Exit status 2

The first tsc --noEmit (the package's own sources) passes — the && chain reaches the second command. The failure is entirely the examples program.

Why

packages/plugins/plugin-auth/package.json:

"typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.examples.json"

examples/basic-usage.ts imports the package by its own package name, which resolves through exports to ./dist/index.d.ts. So this program's inputs include an artifact the package itself produces.

Nothing declares that. turbo.json:

"typecheck": { "dependsOn": ["^build"], "inputs": ["$TURBO_DEFAULT$", "!dist/**", ...] }

^build is dependencies' build, never the package's own — and inputs explicitly excludes dist/**, so turbo does not even consider it. turbo run typecheck --filter=@objectstack/plugin-auth on such a tree fails the same way.

Scope: exactly one package today

tsconfig.examples.json exists in one package repo-wide (find packages -name tsconfig.examples.json → packages/plugins/plugin-auth/tsconfig.examples.json), and it is the only typecheck script with a second -p program. So this is one package's shape, not a class — which is part of why it stays quiet.

Why it is finding and not a bug

CI does not hit it: the lint job builds the workspace before type-checking, so dist/ is always present there. The cost is local, and it is a misleading cost rather than a slow one — TS2307: Cannot find module '@objectstack/plugin-auth' reads as a broken import or a bad workspace link, not as "build this package first". It cost one round on #11579 before the && chain made the real cause legible.

Possible repairs (not chosen here)

• give the examples program its own task with dependsOn: ["build"] (self), leaving typecheck alone;
• point the examples program at src/ via a path mapping in tsconfig.examples.json, so it stops depending on an artifact;
• leave it and say so in the script name (e.g. typecheck:examples), so the ordering requirement is visible at the call site.

Which one is right depends on whether the examples are meant to type-check against the published surface (today's behaviour, and arguably the point of an examples program) or against the sources. That is the decision this card is recording, not making.

---

Generated by Claude Code

[claude]

Concentrated triage batch: finding → pm:queue + domain:devx, Task. The package's typecheck chain reaches tsconfig.examples.json, whose inputs include the package's own dist/ (examples import by package name through exports), and no task dependency declares it. Fix: declare the dependency in the task graph (or split the examples typecheck into a task that dependsOn the package's own build) — whichever the repo's turbo convention already uses for self-dist dependencies. Cross-ref: #11907 (turbo cache served a DTS-less plugin-auth build) is the same package's build-graph neighbourhood — read it before choosing the fix.

---

Generated by Claude Code

[yinlianghui]

Claim: PM loop round R1
Session: session_01UjM2ia8Av1v5NqfqQEQmC6
Branch: claude/issue-11620-plugin-auth-examples-typecheck-dep
Worktree: objectstack-issue-11620
Domain: domain:devx
File surface: turbo.json, packages/plugins/plugin-auth/package.json, packages/plugins/plugin-auth/tsconfig.examples.json (stop on breach; explain in the report)
Container & model: S/M, mode:subagent, model: opus — derived live: node scripts/pm/dispatch-gates.mjs --tier turbo.json packages/plugins/plugin-auth/package.json → "no path-derived mandate", so sonnet is the floor. Opus is a deliberate call: the card explicitly declines to choose between three repairs, and picking the one the repo's turbo convention already uses is the judgment this dispatch is buying.
Clause-②: no — the task graph is build orchestration; it changes no contract accept/reject behaviour and widens no public surface.
Serial constraints cleared: ⚠️ #11907 is the binding one — it is NOT dispatched, and this card must not collide with it. Both sit in @objectstack/plugin-auth's build-graph neighbourhood and both can land in turbo.json. This lane is dispatching only #11620 this round; #11907 goes into the hot-file serial queue behind it. Other live work: #11525 / PR #12030 (scripts/, lint.yml, root package.json — no overlap with turbo.json); #11942 (content/docs/** — no overlap). The eight remaining pm:dispatched cards are governed-surface drafts parked for human merge, none touching the build graph.

fold-or-serial — ANSWERED: serial, do not fold with #11907

Triage cross-referenced them ("#11907 … is the same package's build-graph neighbourhood — read it before choosing the fix"), which makes the folding question mandatory rather than optional. It fails gate ① of the five:

• [finding] @objectstack/plugin-auth's typecheck cannot pass unless the package's OWN dist/ is built, and no task dependency says so #11620 is a task-graph declaration defect: the examples program's inputs include the package's own dist/, and nothing declares it.
• Local turbo cache served a DTS-less @objectstack/plugin-auth build in a fresh worktree with OS_SKIP_DTS unset — its own typecheck then reds on a diff that never touched it #11907 is a cache-correctness defect: turbo served a DTS-less build from cache with OS_SKIP_DTS unset.

Same package, same neighbourhood, different defects with different repairs ⇒ ① (same defect shape, same fix) fails, so folding is closed before gates ②–⑤ are reached. Serialised, #11620 first.

⭐ Note this cuts the other way too: triage's instruction to read #11907 before choosing stands. Reading a sibling card is required; fixing it here is not.

---

Generated by Claude Code