fix(reference-implementation): unblock the Move-B CI seam (typecheck 34->0, tests 268->7 fail)

apps/console/next.config.mjs

@@ -86,7 +86,13 @@ const nextConfig = {
   // consume its TypeScript sources directly once shim pairs (.js + .d.ts)
   // collapse into single .ts exports. Without this, Next's bundler would
   // reject .ts entries from a node_modules-resolved workspace package.
-  transpilePackages: ["pdpp-reference-implementation", "@pdpp/brand", "@pdpp/brand-react", "@pdpp/operator-ui"],
+  transpilePackages: [
+    "pdpp-reference-implementation",
+    "@pdpp/brand",
+    "@pdpp/brand-react",
+    "@pdpp/operator-ui",
+    "@pdpp/polyfill-connectors",
+  ],
   webpack(config) {
     config.resolve.alias = {
       ...config.resolve.alias,

apps/console/src/app/(console)/lib/connection-catalog.test.ts

@@ -459,9 +459,12 @@ test("requested-connector reachability: Steam/Jellyfin/Apple Contacts/GroupMe ne
   // available" verdict.
   const manifests = await loadCommittedManifests();
   const catalog = buildConnectorCatalog(manifests);
-  const { STATIC_SECRET_CONNECTOR_REGISTRY } = await import(
-    "../../../../../../packages/polyfill-connectors/src/static-secret-injection.ts"
-  );
+  // Import via the real package specifier, not a physical path into
+  // packages/polyfill-connectors/src/ -- that directory is a narrow,
+  // deliberately curated subset (see its own package.json) vendored for
+  // @pdpp/local-collector's build only, not a general-purpose mirror of the
+  // full @pdpp/polyfill-connectors package, and does not carry this file.
+  const { STATIC_SECRET_CONNECTOR_REGISTRY } = await import("@pdpp/polyfill-connectors/static-secret-injection");
   for (const key of ["steam", "jellyfin", "apple_contacts", "groupme"]) {
     const entry = catalog.find((e) => e.connectorKey === key);
     assert.ok(entry, `${key} must be in the catalog`);

reference-implementation/package.json

@@ -54,7 +54,7 @@
     "test:seam:pr89": "node --import tsx ../scripts/test-scratch/run-command.ts -- node --import tsx scripts/run-pr89-seam.ts",
     "test:seam:pr89:receipt": "node --import tsx ../scripts/test-scratch/run-command.ts -- node --test --import tsx scripts/check-pr89-seam-receipt.test.ts",
     "test:semantic-multilingual-smoke": "PDPP_MULTILINGUAL_MINILM_SMOKE=1 node --import tsx ../scripts/test-scratch/run-command.ts -- node --test --test-timeout=240000 --test-name-pattern \"multilingual-minilm profile\" test/semantic-retrieval.test.ts",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p test/tsconfig.dom.json",
     "verify": "pnpm typecheck && pnpm check"
   },
   "dependencies": {

reference-implementation/runtime/controller.ts

@@ -29,6 +29,10 @@ import {
   projectBrowserSurfaceLease,
   // biome-ignore lint/correctness/noUnresolvedImports: Biome cannot resolve this installed package export; Node and TypeScript resolve it.
 } from "@opendatalabs/remote-surface/leases";
+import {
+  ConnectorImplementationNotFoundError,
+  resolveConnectorImplementation,
+} from "@pdpp/polyfill-connectors/resolve";
 import { getOne, referenceQueries } from "../lib/db.ts";
 import { createTraceContext, emitSpineEvent, getRunTerminalStatus, type SpineTraceContext } from "../lib/spine.ts";
 import {
@@ -112,14 +116,14 @@ const REFERENCE_MANIFESTS_DIR = join(REFERENCE_IMPL_DIR, "fixtures", "seed-manif
 const SEED_CONNECTOR_PATH = join(REFERENCE_IMPL_DIR, "connectors", "seed", "index.ts");
 // Resolved from the installed `@pdpp/polyfill-connectors` package (never a
 // hardcoded relative repo path) so this reference never drifts from that
-// package's own on-disk layout.
+// package's own on-disk layout. Manifest enumeration still reads this
+// directory directly (the `manifests` export's on-disk layout is unaffected
+// by the connector-tree-scope fix); only per-connector entry-point
+// resolution moved to resolveConnectorImplementation — see that function's
+// own comment.
 const POLYFILL_PACKAGE_SRC_DIR = dirname(fileURLToPath(import.meta.resolve("@pdpp/polyfill-connectors/manifests")));
 const POLYFILL_ROOT = join(POLYFILL_PACKAGE_SRC_DIR, "..");
 const POLYFILL_MANIFESTS_DIR = join(POLYFILL_ROOT, "manifests");
-const POLYFILL_CONNECTORS_DIR = join(POLYFILL_ROOT, "connectors");
-
-// Hoisted so the regex compiles once per process, not once per manifest.
-const JSON_EXTENSION_RE = /\.json$/;
 
 // ─── Shared domain types ────────────────────────────────────────────────────
 
@@ -1329,8 +1333,34 @@ function loadReferenceFixtureFingerprints(): Map<string, ManifestFingerprint> {
   return entries;
 }
 
+// Resolve a shipped polyfill connector's runnable (spawnable) entry-point
+// path, given its manifest's connector_id. Returns null when
+// @pdpp/polyfill-connectors has no built implementation for this ID.
+//
+// Backed by @pdpp/polyfill-connectors/resolve's resolveConnectorImplementation
+// (data-connectors#75, connector-index.json covers all 45 manifest-listed
+// connectors — no more directory-walking POLYFILL_CONNECTORS_DIR, which only
+// worked for whatever subset this repo's vendored tarball happened to ship
+// compiled at the time). The resolver returns a file:// URL string, safe for
+// `import()` directly; converted to a filesystem path here because this
+// file's own downstream consumer (runtime/index.ts's connector spawn) takes
+// a path, not a URL. Unknown IDs throw ConnectorImplementationNotFoundError
+// rather than returning falsy — caught and treated the same as the old
+// "no on-disk implementation" case, since both mean the same thing to this
+// function's callers: no shipped polyfill connector for this ID.
+function resolvePolyfillConnectorEntryPoint(connectorId: string): string | null {
+  try {
+    return fileURLToPath(resolveConnectorImplementation(connectorId).entry);
+  } catch (err) {
+    if (err instanceof ConnectorImplementationNotFoundError) {
+      return null;
+    }
+    throw err;
+  }
+}
+
 // Index one polyfill manifest file into the connector-path and fingerprint
-// maps. No-op for non-JSON files, connectors without an on-disk implementation,
+// maps. No-op for non-JSON files, connectors without a shipped implementation,
 // malformed manifests, or manifests missing a usable connector_id.
 function indexPolyfillManifestFile(
   file: string,
@@ -1340,14 +1370,6 @@ function indexPolyfillManifestFile(
   if (!file.endsWith(".json")) {
     return;
   }
-  const connectorName = file.replace(JSON_EXTENSION_RE, "");
-  const connectorPath = [
-    join(POLYFILL_CONNECTORS_DIR, connectorName, "index.ts"),
-    join(POLYFILL_CONNECTORS_DIR, connectorName, "index.js"),
-  ].find((candidatePath) => existsSync(candidatePath));
-  if (!connectorPath) {
-    return;
-  }
   try {
     const manifest = JSON.parse(readFileSync(join(POLYFILL_MANIFESTS_DIR, file), "utf8")) as ConnectorManifest | null;
     if (!manifest || typeof manifest !== "object") {
@@ -1358,6 +1380,10 @@ function indexPolyfillManifestFile(
       return;
     }
     const trimmedId = connectorId.trim();
+    const connectorPath = resolvePolyfillConnectorEntryPoint(trimmedId);
+    if (!connectorPath) {
+      return;
+    }
     setManifestLookupAliases(paths, trimmedId, manifest, connectorPath);
     const fp = fingerprintManifest(manifest);
     if (fp) {
@@ -3297,9 +3323,17 @@ export function createController(opts: ControllerOptions = {}): Controller {
       activeRunWatchdogTimers.delete(input.runId);
     }
     // A normal completion that beats the watchdog deadline means the timer
-    // above is cleared and will never fire, so its settlement will never
-    // resolve on its own — drop the entry so it doesn't leak. Any `awaitRun`
-    // race is already won by the (now-settled) `activeRunPromises` entry.
+    // above is cleared and will never fire on its own. Any `awaitRun` race is
+    // already won by the (now-settled) `activeRunPromises` entry regardless
+    // of whether this settlement ever resolves, so resolving it here changes
+    // no caller-observable behavior — but leaving it permanently unresolved
+    // after dropping the map entry below leaks a dangling promise with no
+    // remaining reference to it, which Node's test runner (correctly) flags
+    // as a resource the process never finished ("Promise resolution is still
+    // pending but the event loop has already resolved") in any test that
+    // exercises a normal (non-watchdog-timeout) run completion. Resolve
+    // before dropping the entry.
+    runWatchdogSettlements.get(input.runId)?.resolve();
     runWatchdogSettlements.delete(input.runId);
     // Mark settled BEFORE deleting from activeRuns so the 409 guard's
     // reconciliation window is as short as possible.

reference-implementation/scripts/stream-health-audit/authority.test.ts

@@ -388,7 +388,7 @@ function unsafeAuthorityInput(value: unknown): StreamHealthAuthorityInput {
   return value as StreamHealthAuthorityInput;
 }
 
-function response(body: unknown, status = 200, revision = REVISION) {
+function response(body: unknown, status = 200, revision: string | null | undefined = REVISION) {
   const text = typeof body === "string" ? body : JSON.stringify(body);
   return {
     headers: {
@@ -1425,7 +1425,7 @@ for (const accepted of ["deferred", "inventory_only"]) {
       connection_health: {
         state: "healthy",
         axes: { coverage: accepted, freshness: "fresh", attention: "none", outbox: "idle" },
-        conditions: healthyConnection().connection_health.conditions,
+        conditions: (healthyConnection().connection_health as Json).conditions,
       },
     });
     const result = evaluate(connection);
@@ -1447,7 +1447,7 @@ for (const accepted of ["unavailable", "unsupported"]) {
       connection_health: {
         state: "degraded",
         axes: { coverage: accepted, freshness: "fresh", attention: "none", outbox: "idle" },
-        conditions: healthyConnection().connection_health.conditions,
+        conditions: (healthyConnection().connection_health as Json).conditions,
       },
       rendered_verdict: { pill: { tone: "amber", label: "Some records stuck" } },
     });
@@ -1469,7 +1469,7 @@ test("a genuinely degrading coverage axis still disagrees with an entirely compl
     connection_health: {
       state: "degraded",
       axes: { coverage: "retryable_gap", freshness: "fresh", attention: "none", outbox: "idle" },
-      conditions: healthyConnection().connection_health.conditions,
+      conditions: (healthyConnection().connection_health as Json).conditions,
     },
     rendered_verdict: { pill: { tone: "amber", label: "Some records stuck" } },
   });

reference-implementation/scripts/stream-health-audit/live.ts

@@ -350,16 +350,34 @@ async function fetchOwnerSourcesDom({
         // The browser waits for the resolved semantic surface. No wall-clock sleep is used.
         // biome-ignore lint/performance/noAwaitInLoops: each next DOM page is discovered from the prior page's rendered pager link.
         navigation = await page.goto(absolute, { waitUntil: "domcontentloaded" });
-        await page.waitForFunction(
-          () =>
-            !document.querySelector(
+        // This closure is stringified by Playwright and evaluated inside the
+        // real browser page (`page.waitForFunction`), where `document` is a
+        // real ambient global at runtime. It is typed here via a local,
+        // in-closure cast rather than TypeScript's ambient `document` global
+        // because this repo's tsconfig deliberately withholds `lib: "DOM"`
+        // from the main program (see tsconfig.json's `exclude` comment and
+        // data-connect#45: that lib is a program-wide setting, and this same
+        // file is imported by `authority.test.ts`/`receipt.ts`, which stay in
+        // that program). The cast must stay entirely inside this closure's
+        // own source text -- Playwright sends only `fn.toString()` to the
+        // browser, so referencing any outer helper here would throw
+        // `ReferenceError` at runtime; every identifier the closure uses
+        // must be self-contained or a real browser global.
+        await page.waitForFunction(() => {
+          const ownerSourcesDomDocument = (
+            globalThis as unknown as { document: { querySelector: (selector: string) => unknown } }
+          ).document;
+          return (
+            !ownerSourcesDomDocument.querySelector(
               '[aria-busy="true"], [data-testid*="loading" i], [data-testid*="suspense" i], .animate-pulse'
             ) &&
             Boolean(
-              document.querySelector('[data-pdpp-source-row], [data-pdpp-stream-row], [data-testid="sources-empty"]')
-            ),
-          { timeout: OWNER_DOM_RESOLUTION_TIMEOUT_MS }
-        );
+              ownerSourcesDomDocument.querySelector(
+                '[data-pdpp-source-row], [data-pdpp-stream-row], [data-testid="sources-empty"]'
+              )
+            )
+          );
+        }, { timeout: OWNER_DOM_RESOLUTION_TIMEOUT_MS });
       } catch {
         const html = await page.content();
         const observed = parseOwnerSourcesDom(html);
@@ -630,10 +648,24 @@ export async function runLiveStreamHealthAuthority({
       headers: { accept: "application/json", ...auth.header },
       onRevision: (revision) => summaryRevisions.push(revision),
     });
+    // `auth.supported` (checked above) only holds for `mode: "cookie"` or a
+    // successful `mode: "password-session"` login, and both of those paths
+    // populate `header.cookie` (see resolveOwnerAuthForStreamHealth above) --
+    // but `header: Record<string, string>` can't encode that invariant in
+    // its type, and `noUncheckedIndexedAccess` correctly refuses to assume
+    // an index-signature read is present. Fail loud rather than silently
+    // passing `undefined` through as a cookie string if that invariant is
+    // ever violated by a future auth-mode change.
+    const { cookie } = auth.header;
+    if (!cookie) {
+      throw new Error(
+        `resolveOwnerAuthForStreamHealth reported supported auth (mode: ${auth.mode}) with no cookie in header — invariant violated`
+      );
+    }
     const domResult = await fetchOwnerSourcesDom({
       base,
       browserFactory,
-      cookie: auth.header.cookie,
+      cookie,
     });
     const authority = evaluateStreamHealthAuthority({
       auth: { authenticated: true, mode: auth.mode, resolved: true },

reference-implementation/scripts/test-accounting/inventory.test.ts

@@ -1006,7 +1006,12 @@ test("the dedicated scratch lifecycle leaf removes every inherited capability va
   const missingBoundary = structuredClone(localManifest);
   const [missingSuite] = missingBoundary.suites;
   assert.ok(missingSuite);
-  missingSuite.environment_unset = undefined;
+  // `environment_unset` is declared `?: string[]` (optional key, not
+  // `string[] | undefined`); under `exactOptionalPropertyTypes`, assigning
+  // the literal value `undefined` is a distinct, disallowed operation from
+  // the key being absent. `delete` is what this test actually means to
+  // simulate: the manifest field is missing entirely.
+  delete missingSuite.environment_unset;
   await writeFile(join(root, "test-accounting.manifest.json"), `${JSON.stringify(missingBoundary)}\n`);
   await assert.rejects(
     readManifest(join(root, "test-accounting.manifest.json"), { root }),

reference-implementation/server/generated/connector-registry.generated.ts

@@ -32,11 +32,10 @@ export const LEGACY_LOCAL_ALIASES: Readonly<Record<string, string>> = Object.fre
   "google_messages": "google-messages",
   "google_takeout": "google-takeout",
   "imessage": "imessage",
-  "signal": "signal",
 });
 
 /** Manifests declaring capabilities.proven.local_collector === true. */
-export const LOCAL_COLLECTOR_PROVEN_KEYS: readonly string[] = Object.freeze(["claude-code", "codex", "google-takeout", "imessage", "apple-photos", "google-messages", "signal"]);
+export const LOCAL_COLLECTOR_PROVEN_KEYS: readonly string[] = Object.freeze(["claude-code", "codex", "google-takeout", "imessage", "apple-photos", "google-messages"]);
 
 /** Manifests declaring a runtime_requirements.bindings.browser binding. */
 export const BROWSER_BOUND_KEYS: readonly string[] = Object.freeze(["amazon", "anthropic", "chase", "chatgpt", "doordash", "heb", "linkedin", "loom", "meta", "reddit", "shopify", "uber", "usaa", "venmo", "wholefoods", "whoop"]);

reference-implementation/server/streaming/cdp-method-allowlist.test.ts

@@ -159,7 +159,12 @@ test("streaming code only sends allowlisted CDP methods", () => {
     "cdp-adapter.ts",
     "cdp-companion.ts",
     "run-target-registry.ts",
-    join(__dirname, "../../node_modules/@opendatalabs/remote-surface/dist/backends/cdp/backend.js"),
+    // __dirname is server/streaming/; three levels up reaches this repo's
+    // root node_modules/, where npm hoists this package (data-connect's
+    // workspace layout differs by one directory level from wherever this
+    // path was written against originally -- verified: node_modules/@opendatalabs
+    // does not exist two levels up, only three).
+    join(__dirname, "../../../node_modules/@opendatalabs/remote-surface/dist/backends/cdp/backend.js"),
   ];
 
   const { allMethods, violations } = inspectStreamingFiles(files);