build(auth): resolve @objectstack/service-messaging from source in tsc and vitest

`check:type-source-resolution` and `check:test-source-alias` both refused the
new value import: without wiring, plugin-auth's typecheck and its unit tests
would render a verdict about the producer's last `pnpm build` rather than about
its source in this checkout.

- `tsconfig.json` gains one anchored `paths` rule for the bare name, and
  `rootDir` widens to `packages/` as its consequence -- the same shape
  `plugin-security` (#11184) and `packages/rest` (#9960) each record. Emit is
  unaffected: this package builds with tsup and typechecks with `--noEmit`.
- `tsconfig.examples.json` widens its own `rootDir` for the same reason.
- `vitest.config.ts` gains the matching anchored alias.

Neither shrink-only registry is widened.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Author: claude

packages/plugins/plugin-auth/tsconfig.examples.json

@@ -42,10 +42,14 @@
   "extends": "./tsconfig.json",
   "compilerOptions": {
     "noEmit": true,
-    // `.` rather than the inherited `src`, because the files this program
-    // checks (`examples/**/*`, `objectstack.config.ts`) sit outside `src`.
-    // Safe precisely because nothing is emitted from here -- see the header.
-    "rootDir": "."
+    // `../..` (= `packages/`) rather than the inherited value, because the
+    // files this program checks (`examples/**/*`, `objectstack.config.ts`) sit
+    // outside `src`, and #14762's `paths` rule on the parent config pulls
+    // `packages/services/service-messaging/src/**` into the program too --
+    // `rootDir` is enforced over every program file even under `--noEmit`, so
+    // it has to be the directory containing both. Safe precisely because
+    // nothing is emitted from here -- see the header.
+    "rootDir": "../.."
   },
   "include": ["examples/**/*", "objectstack.config.ts"]
 }

packages/plugins/plugin-auth/tsconfig.json

@@ -2,10 +2,33 @@
   "extends": "../../../tsconfig.json",
   "compilerOptions": {
     "outDir": "./dist",
-    "rootDir": "./src",
+    // [#14762] Widened from `./src` as a CONSEQUENCE of the `paths` rule below,
+    // the same consequence `packages/plugins/plugin-security/tsconfig.json`
+    // (#11184) and `packages/rest/tsconfig.json` (#9960) each record:
+    // redirecting a workspace specifier to its source puts that package's
+    // `src/**` into this program, and `rootDir` is enforced over every program
+    // file even under `--noEmit`. `../..` (= `packages/`) is the directory that
+    // contains every file in the program. Emit is unaffected: this package
+    // builds with tsup, and `typecheck` passes `--noEmit`.
+    "rootDir": "../..",
     "types": [
       "node"
-    ]
+    ],
+    // [#14762] `@objectstack/service-messaging` is imported as a VALUE by
+    // `src/auth-manager.ts` (`normalizeRecipientLocale`, the platform's one
+    // reader of a `sys_user.locale` at rest — reused rather than copied).
+    // Without this rule tsc resolves the specifier through the dependency's
+    // `exports` map — `dist/index.d.ts`, a BUILD ARTIFACT — so this package's
+    // typecheck would render a verdict about the last `pnpm build` rather than
+    // about the producer's source in the checkout, which
+    // `check:type-source-resolution` refuses (its header states why the
+    // dangerous case is a typecheck that PASSES). ONE rule for the bare name
+    // only: this package imports no `@objectstack/service-messaging/*` subpath
+    // — that package declares none — and a `paths` target matching nothing on
+    // disk would silently fall back to node resolution.
+    "paths": {
+      "@objectstack/service-messaging": ["../../services/service-messaging/src/index.ts"]
+    }
   },
   "include": [
     "src/**/*"

packages/plugins/plugin-auth/vitest.config.ts

@@ -28,6 +28,15 @@ export default defineConfig({
         find: /^@objectstack\/plugin-security$/,
         replacement: path.resolve(here, '../plugin-security/src/index.ts'),
       },
+      // [#14762] `auth-manager.ts` takes a VALUE import on
+      // `@objectstack/service-messaging` (`normalizeRecipientLocale`). Same
+      // reason as the entry above, and the same anchoring: a unit test is a
+      // verdict about the SOURCE in this checkout, so the specifier must not
+      // resolve to a `dist/` that may predate the edit under test.
+      {
+        find: /^@objectstack\/service-messaging$/,
+        replacement: path.resolve(here, '../../services/service-messaging/src/index.ts'),
+      },
     ],
   },
 });