test(mcp): gate CONNECT_AGENT_PAGE on canonical expression envelopes

packages/mcp/package.json

@@ -27,6 +27,7 @@
  "zod": "^4.4.3"
  },
  "devDependencies": {
+ "@objectstack/lint": "workspace:*",
  "@objectstack/metadata-core": "workspace:*",
  "@types/node": "^26.2.0",
  "typescript": "^6.0.3",

packages/mcp/vitest.config.ts

@@ -33,8 +33,21 @@ export default defineConfig({
  // any subpath and resolve it to `…/src/index.ts/<subpath>` (ENOTDIR) — a
  // config that looks right and fails at run time. Same shape as
  // `plugin-sharing`'s.
+ //
+ // The second entry is for `canonical-expression-envelopes.test.ts` (#12269)
+ // — the only suite here that imports `@objectstack/lint` as a VALUE. It
+ // runs the shared canonical-envelope detector
+ // (`auditPageExpressionEnvelopes`) over this package's own `Page` export.
+ // Unaliased, that specifier resolves through `exports` to `lint/dist`, and
+ // the failure mode is the same silent one the note above describes: a dist
+ // merely BEHIND lets this gate run GREEN against the detector's old
+ // behaviour, while the gate's whole purpose is to run the CURRENT detector
+ // over the CURRENT page. Anchored for a second reason here — `@objectstack/lint`
+ // exports a `./runtime` subpath, and the object form would swallow it and
+ // resolve it to `…/lint/src/index.ts/runtime` (ENOTDIR) at run time.
  alias: [
  { find: /^@objectstack\/metadata-core$/, replacement: path.resolve(__dirname, '../metadata-core/src/index.ts') },
+ { find: /^@objectstack\/lint$/, replacement: path.resolve(__dirname, '../lint/src/index.ts') },
  ],
  },
 });

scripts/cross-package-test-inputs.mjs

@@ -444,6 +444,21 @@ export const CROSS_PACKAGE_TEST_INPUTS = {
  'packages/cloud-connection/src/cloud-connection-ui.ts',
  ],
  },
+ '@objectstack/mcp': {
+ // src/canonical-expression-envelopes.test.ts (#12269) imports `maskComments`
+ // from `js-comment-mask.mjs` to decide which text in this package's `src/` is
+ // a comment and which is a `Page` declaration — the third package to carry
+ // this gate, and declared for the same two reasons the two entries above
+ // record. The import is a real coupling: that gate's POPULATION is a
+ // function of the module's masking behaviour, so a change to it has to
+ // re-run this package's suite. The `.d.mts` sibling is what gives
+ // `maskComments` its type, so this package's typecheck verdict is a
+ // function of it too.
+ globs: [
+ 'scripts/js-comment-mask.mjs',
+ 'scripts/js-comment-mask.d.mts',
+ ],
+ },
  '@objectstack/plugin-auth': {
  // src/managed-extension-fields.test.ts walks every `*.object.ts`, and pins
  // core's api-key source alongside it.

turbo.json

@@ -156,6 +156,18 @@
  "$TURBO_ROOT$/packages/cloud-connection/src/cloud-connection-ui.ts"
  ]
  },
+ "@objectstack/mcp#test": {
+ "dependsOn": ["^build"],
+ "outputs": [],
+ "inputs": [
+ "$TURBO_DEFAULT$",
+ "!dist/**",
+ "!coverage/**",
+ "!.turbo/**",
+ "$TURBO_ROOT$/scripts/js-comment-mask.mjs",
+ "$TURBO_ROOT$/scripts/js-comment-mask.d.mts"
+ ]
+ },
  "@objectstack/plugin-auth#test": {
  "dependsOn": ["^build"],
  "outputs": [],