From 6fc2b8951ba3b01b43526d7b45e479976ad1be6c Mon Sep 17 00:00:00 2001
From: Neil <neil@stably.ai>
Date: Fri, 13 Nov 2026 11:08:52 -0800
Subject: [PATCH] chore(premerge): typecheck each touched cloud/ package that
 is listed as clean

The root pnpm typecheck covers no cloud/ package and vitest strips types, so cloud
packages' own type errors went unseen (261 in sandbox-control). premerge-check.sh now
runs the own pnpm typecheck of every touched cloud/apps or cloud/packages package listed
in premerge-typecheck-packages.txt, after installing the cloud workspace and building its
packages. The list holds the 11 packages that are clean today; sandbox-control joins once
its errors are fixed.
---
 .../cloud-integration/premerge-check.sh        | 18 +++++++++++++++++-
 .../premerge-typecheck-packages.txt            | 16 ++++++++++++++++
 2 files changed, 33 insertions(+), 1 deletion(-)
 create mode 100644 config/scripts/cloud-integration/premerge-typecheck-packages.txt

diff --git a/config/scripts/cloud-integration/premerge-check.sh b/config/scripts/cloud-integration/premerge-check.sh
index 263e8f3d32d..cac1740953c 100755
--- a/config/scripts/cloud-integration/premerge-check.sh
+++ b/config/scripts/cloud-integration/premerge-check.sh
@@ -4,7 +4,8 @@
 # Merges the current private/cloud/integration into a throwaway worktree with your branch, then requires
 #   pnpm typecheck, the full pnpm lint suite (pre-commit hooks only lint staged files), and vitest for the tests your
 #   branch touched: changed *.test.ts(x), every test in the folder of each changed source, every test that imports a
-#   changed module, every test Vitest's module graph relates to the change (vitest --changed), and each touched cloud/apps/* package's own suite. PREMERGE_FULL=1 runs the whole vitest suite.
+#   changed module, every test Vitest's module graph relates to the change (vitest --changed), and each touched cloud/apps/* package's own suite, plus the own `pnpm typecheck` of each touched cloud/ package listed
+#   in premerge-typecheck-packages.txt. PREMERGE_FULL=1 runs the whole vitest suite.
 # The merged copy of this script is what runs, so the gate is always integration's current one.
 # Prints "premerge OK" only when everything passes. Nothing here reads /tmp state. On macOS (no flock) wrap heavy runs
 # as /tmp/vdrv/heavy.sh 'config/scripts/cloud-integration/premerge-check.sh'.
@@ -172,5 +173,20 @@ fi
 for app in $(git diff --name-only "$base"...HEAD -- cloud/apps | cut -d/ -f1-3 | sort -u); do
   if [[ -d "$app" ]]; then (cd "$app" && npx vitest run); fi
 done
+# The root `pnpm typecheck` above covers no cloud/ package, and vitest strips types, so cloud packages' own type errors
+# went unseen (261 in sandbox-control by 2026-11-13). Typecheck each touched cloud package that is listed as clean.
+# cloud/ is its own pnpm workspace (own lockfile): install it and build its packages first, as its own scripts expect.
+tc_list=config/scripts/cloud-integration/premerge-typecheck-packages.txt
+tc_pkgs=()
+for pkg in $(git diff --name-only "$base"...HEAD -- cloud/apps cloud/packages | cut -d/ -f1-3 | sort -u); do
+  if [[ -d "$pkg" ]] && grep -qx "$pkg" "$tc_list" 2>/dev/null; then tc_pkgs+=("$pkg"); fi
+done
+if ((${#tc_pkgs[@]})); then
+  (cd cloud && pnpm install --frozen-lockfile >/dev/null && pnpm -r --filter "./packages/**" build >/dev/null)
+  for pkg in "${tc_pkgs[@]}"; do
+    echo "premerge: typecheck $pkg"
+    (cd "$pkg" && pnpm typecheck)
+  done
+fi
 if [[ "${PREMERGE_FULL:-}" == 1 ]]; then scope="the full vitest suite"; else scope="${#tests[@]} targeted test file(s)"; fi
 echo "premerge OK: $branch merges cleanly into cloud/integration with typecheck, lint and $scope green."
diff --git a/config/scripts/cloud-integration/premerge-typecheck-packages.txt b/config/scripts/cloud-integration/premerge-typecheck-packages.txt
new file mode 100644
index 00000000000..8496ee8ffc5
--- /dev/null
+++ b/config/scripts/cloud-integration/premerge-typecheck-packages.txt
@@ -0,0 +1,16 @@
+# cloud/ workspace packages whose own `pnpm typecheck` is clean on cloud/integration. premerge-check.sh (and the
+# merge-gated recheck) typecheck each of these that a PR touches. A package joins this list only once it is at zero
+# errors, so the gate never blocks on pre-existing errors. One repo path per line, # comments allowed.
+# Baseline 2026-11-13 (clean checkout of 32b21bb on the Linux lane, cloud workspace installed and its packages built):
+# every package below 0 errors; cloud/apps/sandbox-control had 261 and is added once it is clean.
+cloud/apps/acceptance
+cloud/apps/billing
+cloud/apps/push
+cloud/apps/relay
+cloud/apps/relay-edge
+cloud/apps/relay-fence-broker
+cloud/packages/cloud-database
+cloud/packages/connector-contract
+cloud/packages/postgres-schema
+cloud/packages/push-contract
+cloud/packages/relay-contract