feat(scripts): gate repository.directory against the manifest's own directory (#16446)

npm renders `repository.directory` as a package page's "source" deep link, so a
value naming a directory this repo does not have publishes a 404 on the one link
a consumer follows to read the code. Nothing in this repo read the field:
measured over the tracked tree, zero reads of `.directory` in any `.mjs`/`.mts`,
and `check-published-files.mjs` — which has exactly the right population and
already parses every manifest — mentions `repository` not once. The notch is a
category rather than an off-by-one: this repo gated published package CONTENTS
and did not gate published package PROVENANCE METADATA.

The new gate is a state check over every tracked manifest that DECLARES the
field: the value must be well-formed, must name a directory that is IN the
repository (read off `git ls-files`, because the deep link is served from the
repository and not from the author's working tree), and must be the manifest's
own directory. Stateless over the population on purpose — one of the three
commits behind the known residue moved nothing at all, it edited
`repository.url` in the same JSON object with the stale `directory` line as
visible hunk context, so a rule that fired only on directory MOVES would have
missed it exactly as the reviewers did.

⛔ It judges only manifests that declare the field. Whether declaring is
mandatory for a publishable package is an open policy question and a
maintainer's to answer, so silence is counted, listed and never a finding.

Anti-vacuity, because this population is `git ls-files` plus a field predicate
and empties silently from either side: two control probes drive the same
tracked-directory predicate the invariants use in BOTH directions (a directory
derived from the population must report EXISTS, an assembled impossible one must
report MISSING) and no verdict prints unless both fire; MEASURED pins the census
on a named commit with floors under it; and the `--self-test` carries a battery
roster whose names and per-battery case floors red when a battery stops
registering cases.


Claude-Session: https://claude.ai/code/session_01XpTx2tbq3pZRYAdoGt6E6Y

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-warren

.github/workflows/lint.yml

@@ -3597,6 +3597,29 @@ jobs:
       - name: Published-files whitelist guard
         run: pnpm check:published-files
 
+      # The PROVENANCE half of the same packaging hygiene (#15991). The guard
+      # above owns published package CONTENTS — what the tarball contains — and
+      # says nothing about where the tarball claims its source lives. npm renders
+      # `repository.directory` as the package page's "source" deep link, and
+      # until this gate NOTHING in this repo read the field: two
+      # `packages/triggers/*` manifests shipped a value naming
+      # `packages/plugins/plugin-trigger-*`, a path removed when the family was
+      # promoted, so both npm pages published a 404 on the one link a consumer
+      # follows to read the code. The history is why it is a state check over the
+      # whole population rather than a rule about moves: one of the three commits
+      # involved moved nothing at all — it edited `repository.url` in the same
+      # JSON object with the stale `directory` line as visible hunk context, and
+      # it shipped. Humans looked and missed it twice. ⛔ It judges only manifests
+      # that DECLARE the field; whether declaring is mandatory for a publishable
+      # package is an open policy question and a maintainer's to answer, so
+      # silence is counted and never a finding. Runs its own --self-test first:
+      # this population is `git ls-files` plus a field predicate, so a changed
+      # glob or a renamed field empties it silently and the production run would
+      # print exactly what a clean tree prints. Static read of tracked manifests;
+      # no build, no network, sub-second.
+      - name: Manifest repository.directory guard
+        run: pnpm check:manifest-repository-directory
+
       # Engine test-double contract gate (#4550, from #4434). A test double
       # LOOSER than the implementation it replaces turns a green suite into no
       # suite at all, silently, on exactly the paths a double was introduced

package.json

@@ -145,6 +145,7 @@
     "check:undeclared-dep-imports": "node scripts/check-undeclared-dep-imports.mjs --self-test && node scripts/check-undeclared-dep-imports.mjs",
     "check:keyed-text-bounds": "node scripts/check-keyed-text-bounds.mjs --self-test && node scripts/check-keyed-text-bounds.mjs",
     "check:published-files": "node scripts/check-published-files.mjs --self-test && node scripts/check-published-files.mjs",
+    "check:manifest-repository-directory": "node scripts/check-manifest-repository-directory.mjs --self-test && node scripts/check-manifest-repository-directory.mjs",
     "check:published-readme-exports": "node scripts/check-published-readme-exports.mjs --self-test && node scripts/check-published-readme-exports.mjs",
     "check:published-readme-links": "node scripts/check-published-readme-links.mjs --self-test && node scripts/check-published-readme-links.mjs",
     "check:dual-build-cjs-loads": "node scripts/check-dual-build-cjs-loads.mjs --self-test && node scripts/check-dual-build-cjs-loads.mjs",