packages: 73 published root packages carry inconsistent publishing metadata — 18 without README, about 13 without LICENSE, about 33 with main on the ESM file and one types entry for both formats, 19 without publishConfig, sideEffects only in spec

Filing gate ③: a maintainer-directed task. Maintainer, 2026-10-26, verbatim: 「完整的评估本项目，还有哪些可以优化的地方。包括 ci 和文档」 then 「使用 pm-dispatch 技能创建 issue，需要决策的立为决策卡。」 and 「低优先级的先不考虑」. Batch-of: 19 (repository evaluation 2026-10-26, session_019a9XCWsbMFp75REzthE6cs; 9 decision cards + 10 execution cards). ⛔ Filed bare: grading, domain:* and area:* are triage's. ⛔ Not a claim. Reader: the domain:server or domain:devx execution seat (the files are per-package manifests; triage decides) — one os-dev, one or two PRs. Dedupe: REST list (439 issues), grep sideEffects|publint|attw|LICENSE|README → #25913 (open, pm:queue, domain:ui: "30 of 39 published packages declare no sideEffects" — the ui tree). This card is the root tree's 73 non-private manifests; same sideEffects mechanism, different tree, plus the README / LICENSE / exports items #25913 does not cover. New for the root tree.

谁付代价（业务筛）: a consumer who installs @objectstack/<pkg> and opens it on npm sees no README for 18 of them; a CJS consumer resolves main to an ESM file; TypeScript under moduleResolution: node16 sees one .d.ts for both module formats (arethetypeswrong's "masquerading as ESM/CJS"); bundlers cannot tree-shake 60 packages that never said sideEffects.

Measured (HEAD `0d83ee8`; manifest census over `packages/**/package.json`, `private !== true` → 73)

sideEffects: set only in @objectstack/spec; about 60 other published packages lack it (grep -l sideEffects packages/*/package.json packages/*/*/package.json → 1).
No README: apps/account, apps/setup, apps/studio, connector-mcp, connector-openapi, connector-rest, connector-slack, platform-objects, plugin-approvals, plugin-email, plugin-pinyin-search, plugin-sharing, plugin-webhooks, sdui-parser, service-cluster, service-messaging, service-sms, trigger-api (18).
No LICENSE file: about 13 published packages, e.g. lint, metadata-protocol, verify, service-datasource, the trigger-* packages (the dev lists them; files may or may not include a root LICENSE copy at publish time — read scripts/ release tooling first).
About 33 packages: "main": "dist/index.js" (ESM) while exports.require is ./dist/index.cjs; one types entry for both conditions. spec: types: dist/index.d.ts while its exports use .d.mts.
19 published packages have no publishConfig.
Packages with no tests at all: apps/account, apps/setup, apps/studio, qa/refd-timer-testkit (console and skills have no source) — listed, not actioned here.

Wanted

Run publint and @arethetypeswrong/cli once over the 73 built packages (a one-time reading, ⛔ no new gate on this card — if the maintainer wants one it is a decision); paste the summary in the PR.
Fix what they report: main/exports/types per format (.d.ts + .d.cts or the types condition inside exports), consistent publishConfig, a README for each of the 18 (one paragraph: what it is, the one import, a link to the docs page), LICENSE where the release tooling does not already inject it.
sideEffects: declare per package after reading each entry — false for pure libraries, an array for packages that register on import (the same reading packages: 30 of 39 published packages declare no sideEffects, so consumers cannot tree-shake them; declare per package now, make registration explicit later so the 1,380-line array gate can go #25913 prescribes for ui). ⛔ Not a blanket false.
⛔ Nothing here changes a metadata contract or a public API; a package whose exports map has to change shape to satisfy attw gets its own card.

Acceptance

publint and attw clean (or every remaining warning explained in the PR body) on the 73; check:readme-exports and the publish-smoke lane green; the next pack-smoke-optin run passes.

Size: M. Clause-②: no. Metadata-protocol: none.

Triage: first grade — `tech-debt` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-26T12:14Z

⛔ Not a claim, ⛔ not a dispatch. On the maintainer's 「完整的评估本项目…」 / 「低优先级的先不考虑」 (repository evaluation, Batch-of 19). Low priorities were excluded at filing, so the execution cards grade p2.

The publishing metadata on 73 root packages (README, LICENSE, main / types per format, publishConfig, sideEffects) is release hygiene, so it belongs to the devx lane. Measure with publint / attw first, and let the PR state the before and after counts.

Generated by Claude Code

Claim: PM loop round 3 · 2026-10-26T13:36Z
Session: session_01Q4MDXRbEJCNdPAP4SiXwp9 (devx seat 2) · card thread session_01UH1DPuU5rAKoNbDzEyoEw6
Account: os-steve
Branch: claude/project-thread-09e02s (the harness-pinned branch of the card thread; it names no issue, so this claim is the identity record; amended on spawn)
Worktree: objectstack-issue-26095
Domain: domain:devx
Seat: domain:devx#2 (seat post #20163)
File surface: the package.json (main/exports/types/publishConfig/sideEffects), README.md and LICENSE of the 73 published packages outside ui/, plus a root .changeset/ entry; ⛔ no export-map shape change (that is its own card), ⛔ no new gate, ⛔ nothing under ui/ (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default tier (TIER_DEFAULT, from dispatch-gates --tier: no path-derived mandate), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: 6415737852
Premise: holds (card measured at 0d83ee8f77; the dev re-reads publint/attw on a fresh origin/main build first)
Serial constraints cleared: no other Claim: names these manifests; #25913 is the ui tree (excluded here); release PRs bump version only, a different key; #26092 (this seat) touches tsconfig/vitest, disjoint

Generated by Claude Code

os-dev-report

{
  "issue": 26095,
  "status": "rework",
  "branch": "claude/project-thread-09e02s",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/26198",
  "session": "session_01UH1DPuU5rAKoNbDzEyoEw6",
  "premise_still_valid": true,
  "summary": "Part 1 of 2, by the seat's ruling: the card's reading plus the manifest repairs and the 18 missing READMEs ship as PR #26198 (Part of #26095, 92 files, +998/-251 = 1249 lines); the 14 LICENSE copies are 2828 lines of byte-identical text and would put the pair over the 3000-line threshold, so they land as a second PR off this branch after #26198 merges (kept locally on wip/license-26095). publint 0.3.25 and attw 0.18.5 were run over all 73 published packages outside ui/, each staged as npm pack would ship it, on a fresh origin/main (d1ea2363f) build: 73 of 73 packages carried a publint message and 48 an attw problem before; 3 and 16 after. Repaired: per-format types inside exports on 38 manifests (all 38 FalseCJS), sideEffects on 72 read per package (service-cluster-redis and create-objectstack declare arrays; no blanket false), publishConfig on 17, type on 39, engines on 22, repository.url on 71, and a README for 18. status is rework only because the card's LICENSE half is deliberately deferred to PR 2.",
  "tests": "No test file is touched; the diff is manifests and new READMEs. The behavioural risk is `type`, which tsup reads to pick output extensions, so the proof is a forced rebuild of every affected package plus a file-name comparison: `turbo run build --force` over the 73 published packages under os-verify-lock — VERDICT command-exit 0, `Tasks: 72 successful, 72 total` — and the dist JS/declaration file set is identical before and after (1103 files, `diff` clean). One real regression was found and fixed this way, not by reading: with per-format types on @objectstack/core, `pnpm --filter @objectstack/plugin-dev build` fails TS2345 at src/dev-plugin.ts:523 ('Types have separate declarations of a private property plugins') because plugin-dev reaches core through both resolution modes; core was reverted to one types entry and that build exits 0. No ablation: no tested behaviour changes.",
  "gates": "dispatch-gates --commands derived 95 families; `--ran` (without --commands) reconciles 95 accounted / 94 run / 0 unrun / 1 NOT-MEASURED. Each exit code was captured before any pipe. All 94 exit 0, including check:published-files, check:published-readme-exports, check-published-readme-links.mjs, check:manifest-repository-directory, check:dts-closure, check:lean-entry-closure, check:dual-build-cjs-loads, check:sdui-manifest, check:lockstep-package-count, check-changeset-fixed.mjs, check-empty-changeset.mjs --base origin/main, check:i18n, check:i18n-coverage, check:undeclared-dep-imports. NOT MEASURED: check-plugin-teardown-shape.mjs --self-test, reason: exit 3 PREREQUISITE NOT MET — its positive control is pinned to commit 621a487607 which this shallow checkout cannot reach; its real scan exits 0. check-engine-split-ratio.mjs --days 90 refuses the same way (exit 2, shallow window) and its --self-test passes. Note check:dts-closure and check:lean-entry-closure first read exit 1 while the forced rebuild was still clearing packages/spec/dist, and exit 0 once it finished — the 0 is the reading on the complete tree. CI's own families (the 49 artifact rosters, the 11 wide-population families, the type-check lanes, Test Core / Build Core) are the PR's check-runs, not re-run here; PR #26198 was opened minutes ago and carries no conclusions yet, so they are in_progress.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "0 — no GitHub MCP tool was called",
  "api_writes": "4 — 1 git push (not REST), and via the fleet-write relay: POST /repos/objectstack-ai/objectstack/dispatches, POST /repos/objectstack-ai/objectstack/pulls, POST /repos/objectstack-ai/objectstack/issues/26198/assignees. No labels leg: the diff ships a changeset, so skip-changeset does not apply and the dispatch word named no other label.",
  "open_questions": [],
  "out_of_scope_findings": [
    "class: b · reach: named producer — @objectstack/core's own dual build. core's dist/index.d.ts and dist/index.d.cts are two separate declarations of the same classes (ObjectKernel's private `plugins`), so declaring types per condition hands a consumer that reaches core through both resolution modes two incompatible types. Measured: with the split, `pnpm --filter @objectstack/plugin-dev build` fails TS2345 at src/dev-plugin.ts:523; without it, exit 0. core therefore keeps one types entry and its 2 attw FalseESM stay open, which is the contract violation: the published types claim one module format for both conditions. Fix is core's dts build (one declaration shared by both formats), not its export map. dedupe words: core d.cts, FalseESM, separate declarations private, plugin-dev dev-plugin.ts 523, attw",
    "class: b · reach: named producer — 4 ESM-only subpaths answer a CJS require with ESM (attw CJSResolvesToESM@node16-cjs): @objectstack/cli `.` / ./console / ./hook-body, create-objectstack/created-summary, @objectstack/metadata-core/testing, @objectstack/service-cluster/testing. Each needs a dual build or a declared CJS entry, i.e. an export-map shape change, which #26095 excludes. dedupe words: CJSResolvesToESM, ESM-only subpath, metadata-core testing, service-cluster testing, dual build",
    "class: b · reach: named producer — @objectstack/driver-memory publishes `export default` from src/index.ts; its CJS build lands that as a `default` property, so a `require('@objectstack/driver-memory')` does not get the default (attw FalseExportDefault). The repair is the package's export surface. dedupe words: FalseExportDefault, driver-memory export default, module.exports default, attw",
    "class: c · reach: public door — attw NoResolution@node10 on 15 packages with subpath exports (spec, cli, connector-imap, core, create-objectstack, lint, metadata, metadata-core, objectql, platform-objects, plugin-auth, plugin-webhooks, service-cluster, service-datasource, types): a consumer on TypeScript's legacy `node` resolution resolves no subpath at all. Deliberately not mirrored into typesVersions here (a second declaration of the same surface drifts from exports), but it is a decision worth a card: declare node10 unsupported in writing, or add the mirror. dedupe words: NoResolution node10, typesVersions, subpath exports, moduleResolution node, attw",
    "carrier: PR #26198 — noted, not filed: @objectstack/console and @objectstack/skills declare no `type` because they ship no JavaScript, so publint's suggestion stays on both. Nothing to repair."
  ]
}

devx seat 2 · review: ACCEPT → PR #26198 (PR ① of 2, Part of) comments 6419816152 + 6420626371 on head 1ec660e247. Landing: ready + merge queue. Every check is green or skipped except the non-required Scaffold with repo dist, red from #26097 and filed as #26204. PR ② (LICENSE copies, Fixes #26095) follows after the merge.

Generated by Claude Code

os-dev-report

{
  "issue": 26095,
  "status": "done",
  "branch": "claude/project-thread-09e02s",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/26260",
  "session": "session_01UH1DPuU5rAKoNbDzEyoEw6",
  "premise_still_valid": true,
  "summary": "Part 2 of 2, by the seat's ruling: after #26198 merged, the branch was reset to origin/main f2e70836 and carries only the card's LICENSE half, as PR #26260 (Fixes #26095, head 03dee064, 15 files, +2851 lines). 14 published packages declared Apache-2.0 and shipped no licence text: npm packs a package's own LICENSE whatever `files` says, and no release script copies the root one in. Each new LICENSE is a byte copy of the root LICENSE. Census: 59 of 73 published packages outside ui/ carried a LICENSE before, 73 of 73 after, and 73 of 73 carry a README. `npm pack --dry-run` on packages/console lists LICENSE. One patch changeset names the 14.",
  "tests": "No test or source file is touched; the diff is 14 copies of the root LICENSE and one changeset. `turbo run build` over the 73 published packages under os-verify-lock: VERDICT command-exit 0, `Tasks: 72 successful, 72 total`. No ablation: no behaviour changes.",
  "gates": "dispatch-gates --commands derived 61 families. `--ran` reconciles 61 accounted: 60 run, 0 unrun, 1 NOT-MEASURED. Each exit code was captured before any pipe, and all 60 exit 0, including check:published-files, check-empty-changeset.mjs --base origin/main, check-changeset-no-major.mjs --base origin/main and check:changeset-gate-self-tests. NOT MEASURED: check-plugin-teardown-shape.mjs --self-test, reason: exit 3 PREREQUISITE NOT MET. This checkout is shallow, and the test's positive control is pinned to a commit it cannot reach. Its real scan exits 0. CI's own families are the PR's check-runs and were not re-run here.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "1 read, 0 writes — get_job_logs on #26198's Test Core 6/8 earlier in this card (the proxy refused the log blob through gh); no MCP call for this PR",
  "api_writes": "4 — 1 git push (not REST). Via the fleet-write relay: POST /repos/objectstack-ai/objectstack/dispatches, POST /repos/objectstack-ai/objectstack/pulls and POST /repos/objectstack-ai/objectstack/issues/26260/assignees. No labels leg: the diff ships a changeset, so skip-changeset does not apply.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: PR #26198's os-dev-report — the four attw classes (core dual build FalseESM, 4 ESM-only subpaths CJSResolvesToESM, driver-memory FalseExportDefault, NoResolution@node10 on 15 packages) were reported there and handed to the seat to file. Nothing new on this PR."
  ]
}

devx seat 2 · review: ACCEPT → PR #26260 (PR ② of 2, Fixes #26095) comment 6423052760 on head 03dee064e7. Every check is green or skipped. Not governed. Landing: ready + auto-merge. PR ① #26198 merged at 16:58Z.

Generated by Claude Code

Navigation Menu

Repository navigation

packages: 73 published root packages carry inconsistent publishing metadata — 18 without README, about 13 without LICENSE, about 33 with main on the ESM file and one types entry for both formats, 19 without publishConfig, sideEffects only in spec #26095

Measured (HEAD `0d83ee8`; manifest census over `packages/**/package.json`, `private !== true` → 73)

Wanted

Acceptance

Related

Triage: first grade — `tech-debt` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-26T12:14Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

packages: 73 published root packages carry inconsistent publishing metadata — 18 without README, about 13 without LICENSE, about 33 with main on the ESM file and one types entry for both formats, 19 without publishConfig, sideEffects only in spec #26095

Description

Measured (HEAD 0d83ee8; manifest census over packages/**/package.json, private !== true → 73)

Wanted

Acceptance

Related

Activity

objectstack-fleet commented on Oct 26, 2026

Triage: first grade — tech-debt · priority:p2 · domain:devx · area:devpath · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-26T12:14Z

objectstack-fleet commented on Oct 26, 2026

objectstack-fleet commented on Oct 26, 2026

objectstack-fleet commented on Oct 26, 2026

objectstack-fleet commented on Oct 26, 2026

objectstack-fleet commented on Oct 26, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Measured (HEAD `0d83ee8`; manifest census over `packages/**/package.json`, `private !== true` → 73)

Triage: first grade — `tech-debt` · `priority:p2` · `domain:devx` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-26T12:14Z