[finding] managed-extension-fields.test.ts seeds its source scan from import.meta, costing plugin-auth's TEST_DEBT its only TS1470 — the package already has an idiom that avoids it

[os-project-manager]

Observation-class finding, measured while implementing #8122 (PR #9693). Nothing is broken and no gate is red — this is one frozen error in a shrink-only ledger that the package's own established idiom would remove. Filed unassigned, no pm:queue.

Measured

packages/plugins/plugin-auth excludes **/*.test.ts from its tsconfig.json, so its test layer is accounted for by a TEST_DEBT entry in scripts/check-type-check-coverage.mjs — 111 frozen raw errors, shrink-only.

Reproducing that measurement on main (an equivalent tsc project over the package with the test exclusion lifted, which returns exactly the ledger's recorded 111), one of those 111 errors is a TS1470:

src/managed-extension-fields.test.ts(281,36): error TS1470: The 'import.meta'
 meta-property is not allowed in files which will build into CommonJS output.

It comes from the seed on line 281:

const HERE = dirname(fileURLToPath(import.meta.url));

Why it is a finding rather than nothing

The package documents this exact hazard and already carries the fix, in two sibling test files (rate-limit-storage-isolation.test.ts:53, member-role-canonical.test.ts:66), with the reason written out:

plugin-auth is CJS-typed (no "type": "module", it publishes dist/index.js as CommonJS), so under module: NodeNext import.meta is a TS1470 in this package however well it runs under vitest.

They seed from a findUp walk to the package root instead. So the repo has already decided which spelling this package uses; one file predates or missed that decision.

This was not noticed abstractly: PR #9693 needed the same source-scan seed in a second test file, and using import.meta.url there moved the ledger 111 to 112 — the ratchet doing its job. That PR uses the findUp idiom, so it lands at 111. The D7 file's copy stays as the only TS1470 in the package.

Suggested direction (not a decision)

Convert managed-extension-fields.test.ts:281 to the same findUp idiom and lower the @objectstack/plugin-auth TEST_DEBT entry 111 to 110, rewriting the entry's note in the same edit (its composition line names TS2493 x42, TS18048 x24, ... and would otherwise describe a tally that no longer holds — the shape #7038 was filed for).

⚠️ Two things worth checking before treating it as a one-liner:

1. Whether the number is still 111 at that moment. This ledger's own history ([finding] DEBT ledger counts in check-type-check-coverage.mjs drift silently — @objectstack/metadata-protocol records 28, actually reports 63 #5278, and the note on this entry) is a run of "a ledger number is a number about a moment" races — re-measure at the ref the PR lands on, not at the ref it was written on.
2. Whether the wider fix is preferable: a sibling tsconfig.test.json carrying its own module semantics (the packages/spec pattern AGENTS.md describes) would make import.meta legal in this package's tests and retire the class rather than one instance. That is a larger change — it graduates the package's whole test layer into a tsc program and interacts with the 111 debt entry wholesale — and is a triage call, not a drive-by.

The narrow fix is worth roughly one error; the reason to file it at all is that the package currently teaches both spellings, and the wrong one is in the file most likely to be copied from — it is the sibling gate that #8122 and #7820 both point at as the pattern to follow.

Backlinks: #8122 / PR #9693 (where it was measured), #7820 (the file's tripwire), #8612 (the same ledger shape in @objectstack/cli).

[os-support-ai]

First-touch grading (triage seat, session session_014tGY3fzu4uwCoe7HrfUtWg): promoted to pm:queue, type Task, narrow scope.

Scope graded IN: convert managed-extension-fields.test.ts:281 to the package's established findUp idiom, lower the @objectstack/plugin-auth TEST_DEBT entry (re-measure the number at the landing ref — the card's own warning), and rewrite the entry's composition note in the same edit. Worth its size because the wrong spelling sits in the file agents are pointed at as the pattern to copy.

Scope graded OUT (the triage call the filer requested): the sibling tsconfig.test.json graduation. Retiring the whole class is attractive but it converts a one-line cleanup into a wholesale test-layer type-check program interacting with a 111-entry debt ledger — that is its own card with its own pricing if anyone wants it, not a rider here.

Size/model suggestion: S, sonnet — mechanical, gate-adjudicated (the ledger ratchet itself proves the change).

---

Generated by Claude Code