fix(platform-api-docs): prefer source over build output when deduplicating

[cryptodev-2s]

Explanation

A capability declared in a package's source is also visible in the dist built from it, and a cross-package import resolves to that dist rather than to the sibling's source. Whichever was reached first won, so 83 of 1164 source links pointed at .d.cts build output instead of code you can read and edit.

Deduplication now scores source above build output, so the outcome no longer depends on traversal order. All 1164 links point at source, and namespace, action and event counts are unchanged.

Both clients generate byte-identical docs, since they only ever see published packages and score every candidate the same way.

References

• Follow up to refactor(platform-api-docs): use ts-morph globbing for file discovery #9990, as promised in refactor(platform-api-docs): use ts-morph globbing for file discovery #9990 (comment)

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Low Risk
Changes only affect generated documentation links and dedup tie-breaking in the docs generator, with no runtime product or security impact.

Overview
Generated platform API docs were often linking messenger capabilities to node_modules/.../dist/*.d.cts instead of the editable packages/*/src declaration, because cross-package imports resolve to build output and whichever duplicate was seen first won during deduplication.

Deduplication scoring now adds a sourceScore that favors paths outside /dist/, so when the same typeString appears in both source and compiled declarations, the source file wins regardless of scan order. JSDoc and “home package” preferences are unchanged.

scanSources collects all scan globs into one pattern list before a single addSourceFiles call (same bulk-load behavior, slightly cleaner structure). A regression test reproduces the monorepo a-controller → @metamask/b-controller dist ordering case; the changelog records the fix under Fixed.

^{Reviewed by Cursor Bugbot for commit 0b32e92. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cryptodev-2s]

@mcmire In case you have missed to look at this ?

[mcmire]

@cryptodev-2s Ah sorry I did miss this, I haven't reviewed this yet. I will review this shortly.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0b32e92. Configure here.}

[cursor]

Merged globs drop declaration files

Medium Severity

Collecting scan-dir, package, and node_modules globs into one addSourceFiles call lets source-tree dist and node_modules exclusions apply to published .d.cts files. A scan directory that is an ancestor of those declaration files drops them, so capabilities from published packages vanish from the docs.

 

^{Reviewed by Cursor Bugbot for commit 0b32e92. Configure here.}

[mcmire]

This seems like a fair point, but is this an intentional change?

Are the changes to the way that source files are collected necessary to fix the bug with deduplicationScore mentioned in the PR description?