fix(platform-api-docs): prefer source over build output when deduplicating

[cryptodev-2s]

Explanation

A capability declared in a package's source is also visible in the dist built from it, and a cross-package import resolves to that dist rather than to the sibling's source. Whichever was reached first won, so 83 of 1164 source links pointed at .d.cts build output instead of code you can read and edit.

Deduplication now scores source above build output, so the outcome no longer depends on traversal order. All 1164 links point at source, and namespace, action and event counts are unchanged.

Both clients generate byte-identical docs, since they only ever see published packages and score every candidate the same way.

References

• Follow up to refactor(platform-api-docs): use ts-morph globbing for file discovery #9990, as promised in refactor(platform-api-docs): use ts-morph globbing for file discovery #9990 (comment)

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Low Risk
Documentation generation and link selection only; no runtime API or security behavior changes.

Overview
Generated platform API docs were linking many capabilities to dist declaration files (.d.cts) instead of editable .ts source, because monorepo scans see the same action/event twice and cross-package imports often resolve through node_modules to build output first—whichever duplicate was processed first won.

Deduplication scoring now adds a sourceScore that favors paths outside /dist/, so when both source and build declarations exist, docs keep the source file for links and metadata. Published-package-only consumers are unchanged (every candidate still looks like dist).

Tests cover scanning with node_modules under a broad scan dir and a monorepo-style a-controller / b-controller layout asserting actions.md points at packages/b-controller/src/... and not /dist/. The changelog records the fix under Fixed.

^{Reviewed by Cursor Bugbot for commit 38afbc9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cryptodev-2s]

@mcmire In case you have missed to look at this ?

[mcmire]

@cryptodev-2s Ah sorry I did miss this, I haven't reviewed this yet. I will review this shortly.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0b32e92. Configure here.}

[mcmire]

Two more suggestions. Everything else looks good.

[mcmire]

Is this comment in the right place? Maybe it needs to be moved to above the generate call? On the other hand, to me, not knowing this fact doesn't seem to impact readability of this test, so I would also be fine with removing this:

Suggested change

	// Scanning `.` makes the project root a scan directory, so its
	// `node_modules` exclusion covers the published declaration files too.
	// Each location has to be collected in its own call for them to survive,
	// since exclusions apply to every pattern in the call they belong to.

[cryptodev-2s]

Yes finally did drop it here 38afbc9

[mcmire]

I think this could be written in a clearer way:

Suggested change

	// One call per location, not one call carrying every pattern. Exclusions
	// apply to a whole call, so combining them lets the source-tree
	// `node_modules` and `dist` exclusions match the published declaration files
	// and drop them.
	// NOTE: We are calling `addSourceFiles` for each kind of source instead of
	// calling it at the very end so that at each step we can make sure to exclude
	// `node_modules` and `dist`.

[cryptodev-2s]

Make sense applied here 38afbc9

[mcmire]

LGTM!