@12-apps/mcp 3.14.0 → 3.16.0

package/dist/chunk-F3LMK6OL.js

@@ -0,0 +1,25 @@
+import {
+  __name
+} from "./chunk-7QVYU63E.js";
+
+// src/e2e/world.ts
+var installed = null;
+function defineMcpConnectWorld(world) {
+  installed = world;
+}
+__name(defineMcpConnectWorld, "defineMcpConnectWorld");
+function mcpConnectWorld() {
+  if (!installed) {
+    throw new Error(
+      "No mcp e2e world is installed. Call defineMcpConnectWorld({ \u2026 }) from a module inside your own `steps` glob \u2014 playwright-bdd imports those before any scenario runs, which is what makes the registration land in every worker."
+    );
+  }
+  return installed;
+}
+__name(mcpConnectWorld, "mcpConnectWorld");
+
+export {
+  defineMcpConnectWorld,
+  mcpConnectWorld
+};
+//# sourceMappingURL=chunk-F3LMK6OL.js.map

package/dist/chunk-F3LMK6OL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/e2e/world.ts"],"sourcesContent":["import type { Page } from '@playwright/test';\n\n/**\n * The port a HOST implements to run the packaged AI-connect journeys.\n *\n * These journeys were written because the walkthrough they cover was tested\n * NOWHERE. `./react` ships the whole flow — the landing, the assistant picker,\n * the endpoint to copy, the configure and connect steps, the confirmation and\n * its re-test — and twenty test ids go with it. Not one of them appeared in\n * this package's own suite, and not one appeared in the origin host's specs\n * either: that host's `ai.e2e.ts` drives its OWN plan lock and upsell modal,\n * reaching only `ai-onboarding` and the status board on the way past.\n *\n * So the flow a store owner actually walks was covered by nothing, in either\n * repo. That is the gap the `e2e` capability exists to convert into a\n * declaration rather than an omission nobody can see.\n *\n * What stays the host's: how it signs an owner in, where it mounts the flow,\n * and which assistant its `hosts` config offers — the guides are REQUIRED\n * config (FUT-760), so the package has no assistant of its own to name.\n */\n\n/** Facts about the host that the assertions have to name. */\nexport interface McpConnectFixtures {\n  /**\n   * The id of an assistant the host offers whose guide has NO `pluginUrl`.\n   *\n   * The flow BRANCHES on that field: a guide carrying one gets `InstallStep`\n   * (a single \"open the install link\" button), and a guide without one gets\n   * the three-step manual path — copy the endpoint, configure, connect. These\n   * journeys walk the MANUAL path, so the host has to point at a guide that\n   * takes it. Naming the branch here rather than guessing keeps the scenario\n   * from failing in a host whose first assistant happens to ship a plugin.\n   */\n  manualHostId: string;\n  /** The endpoint URL that host serves, as it is rendered for copying. */\n  endpointUrl: string;\n}\n\n/** What a host must be able to do for these journeys to run in it. */\nexport interface McpConnectWorld {\n  /**\n   * Put the browser in a known signed-in state as somebody who may connect an\n   * assistant, with the flow's progress RESET to its first run.\n   *\n   * The reset is load-bearing rather than hygiene: the wizard persists its step\n   * through `@12-apps/onboarding`, so a scenario that advanced it would hand\n   * the next one a flow resuming from the middle — and the landing step, which\n   * two of these scenarios assert, would never render.\n   */\n  signInAsOwner(page: Page): Promise<void>;\n  /** Land on the screen that mounts `AiIntegrationOnboarding`. */\n  openAiIntegrationScreen(page: Page): Promise<void>;\n  fixtures: McpConnectFixtures;\n}\n\nlet installed: McpConnectWorld | null = null;\n\n/**\n * Install the host's implementation. Call this from a module inside the host's\n * OWN steps glob — playwright-bdd imports every step file before any scenario\n * runs, so a top-level call there is registered in time, in every worker.\n */\nexport function defineMcpConnectWorld(world: McpConnectWorld): void {\n  installed = world;\n}\n\n/**\n * The installed world, or a refusal naming the fix.\n *\n * Throws rather than returning null: a step that ran against an absent world\n * would fail on whatever it touched next, somewhere unrelated to the actual\n * mistake, which is a diagnosis nobody should have to make twice.\n */\nexport function mcpConnectWorld(): McpConnectWorld {\n  if (!installed) {\n    throw new Error(\n      'No mcp e2e world is installed. Call defineMcpConnectWorld({ … }) from a module inside ' +\n        \"your own `steps` glob — playwright-bdd imports those before any scenario runs, \" +\n        'which is what makes the registration land in every worker.',\n    );\n  }\n  return installed;\n}\n"],"mappings":";;;;;AAwDA,IAAI,YAAoC;AAOjC,SAAS,sBAAsB,OAA8B;AAClE,cAAY;AACd;AAFgB;AAWT,SAAS,kBAAmC;AACjD,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AACA,SAAO;AACT;AATgB;","names":[]}

package/dist/e2e/index.d.ts

@@ -0,0 +1,109 @@
+import { Page } from '@playwright/test';
+
+/** Every packaged `.feature`, for `defineBddConfig({ features })`. */
+declare const mcpFeatures: string;
+/**
+ * The base `defineBddConfig({ featuresRoot })` must be given, and it is NOT
+ * optional decoration.
+ *
+ * bddgen mirrors each feature's path RELATIVE TO `featuresRoot` under
+ * `outputDir`. Left unset it defaults to the config's own directory, so a
+ * feature living under `node_modules/...` compiles to a path Playwright then
+ * IGNORES, because its default `testIgnore` excludes `**\/node_modules/**`.
+ *
+ * The result is the worst kind of green: bddgen reports the features compiled,
+ * Playwright collects zero specs from them, and the run passes with the whole
+ * packaged suite silently absent.
+ *
+ * A host running SEVERAL packaged suites gives `featuresRoot` the directory they
+ * all sit under, since bddgen takes exactly one — and that is safe to do,
+ * because a feature outside it is a hard exit from bddgen, never a quiet
+ * omission.
+ */
+declare const mcpFeaturesRoot: string;
+/**
+ * Every packaged step definition, for `defineBddConfig({ steps })`.
+ *
+ * COMPILED JavaScript, and that is the reason this package has a build step at
+ * all while everything else it exports is raw `.ts` through the `exports` map.
+ * Those entries are consumed by an application's BUNDLER, which transpiles
+ * whatever it is pointed at. These are loaded by NODE — `playwright.config.ts`
+ * imports this module, and bddgen imports the step files — and Node refuses to
+ * strip types from anything under `node_modules`
+ * (`ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING`). Playwright's own TS transform
+ * does not rescue them either; it skips `node_modules` by design.
+ *
+ * The host's own steps glob must ALSO be listed — that is where its
+ * `defineMcpConnectWorld` call lives, and playwright-bdd imports every step
+ * file before any scenario runs, which is what makes the registration land in
+ * time in every worker.
+ */
+declare const mcpSteps: string;
+
+/**
+ * The port a HOST implements to run the packaged AI-connect journeys.
+ *
+ * These journeys were written because the walkthrough they cover was tested
+ * NOWHERE. `./react` ships the whole flow — the landing, the assistant picker,
+ * the endpoint to copy, the configure and connect steps, the confirmation and
+ * its re-test — and twenty test ids go with it. Not one of them appeared in
+ * this package's own suite, and not one appeared in the origin host's specs
+ * either: that host's `ai.e2e.ts` drives its OWN plan lock and upsell modal,
+ * reaching only `ai-onboarding` and the status board on the way past.
+ *
+ * So the flow a store owner actually walks was covered by nothing, in either
+ * repo. That is the gap the `e2e` capability exists to convert into a
+ * declaration rather than an omission nobody can see.
+ *
+ * What stays the host's: how it signs an owner in, where it mounts the flow,
+ * and which assistant its `hosts` config offers — the guides are REQUIRED
+ * config (FUT-760), so the package has no assistant of its own to name.
+ */
+/** Facts about the host that the assertions have to name. */
+interface McpConnectFixtures {
+    /**
+     * The id of an assistant the host offers whose guide has NO `pluginUrl`.
+     *
+     * The flow BRANCHES on that field: a guide carrying one gets `InstallStep`
+     * (a single "open the install link" button), and a guide without one gets
+     * the three-step manual path — copy the endpoint, configure, connect. These
+     * journeys walk the MANUAL path, so the host has to point at a guide that
+     * takes it. Naming the branch here rather than guessing keeps the scenario
+     * from failing in a host whose first assistant happens to ship a plugin.
+     */
+    manualHostId: string;
+    /** The endpoint URL that host serves, as it is rendered for copying. */
+    endpointUrl: string;
+}
+/** What a host must be able to do for these journeys to run in it. */
+interface McpConnectWorld {
+    /**
+     * Put the browser in a known signed-in state as somebody who may connect an
+     * assistant, with the flow's progress RESET to its first run.
+     *
+     * The reset is load-bearing rather than hygiene: the wizard persists its step
+     * through `@12-apps/onboarding`, so a scenario that advanced it would hand
+     * the next one a flow resuming from the middle — and the landing step, which
+     * two of these scenarios assert, would never render.
+     */
+    signInAsOwner(page: Page): Promise<void>;
+    /** Land on the screen that mounts `AiIntegrationOnboarding`. */
+    openAiIntegrationScreen(page: Page): Promise<void>;
+    fixtures: McpConnectFixtures;
+}
+/**
+ * Install the host's implementation. Call this from a module inside the host's
+ * OWN steps glob — playwright-bdd imports every step file before any scenario
+ * runs, so a top-level call there is registered in time, in every worker.
+ */
+declare function defineMcpConnectWorld(world: McpConnectWorld): void;
+/**
+ * The installed world, or a refusal naming the fix.
+ *
+ * Throws rather than returning null: a step that ran against an absent world
+ * would fail on whatever it touched next, somewhere unrelated to the actual
+ * mistake, which is a diagnosis nobody should have to make twice.
+ */
+declare function mcpConnectWorld(): McpConnectWorld;
+
+export { type McpConnectFixtures, type McpConnectWorld, defineMcpConnectWorld, mcpConnectWorld, mcpFeatures, mcpFeaturesRoot, mcpSteps };

package/dist/e2e/index.js

@@ -0,0 +1,27 @@
+import {
+  defineMcpConnectWorld,
+  mcpConnectWorld
+} from "../chunk-F3LMK6OL.js";
+import {
+  __name
+} from "../chunk-7QVYU63E.js";
+
+// src/e2e/globs.ts
+import { createRequire } from "module";
+import { dirname, join } from "path";
+var require_ = createRequire(import.meta.url);
+function packageRoot() {
+  return dirname(require_.resolve("@12-apps/mcp/package.json"));
+}
+__name(packageRoot, "packageRoot");
+var mcpFeatures = join(packageRoot(), "features/**/*.feature");
+var mcpFeaturesRoot = join(packageRoot(), "features");
+var mcpSteps = join(packageRoot(), "dist/e2e/steps/**/*.js");
+export {
+  defineMcpConnectWorld,
+  mcpConnectWorld,
+  mcpFeatures,
+  mcpFeaturesRoot,
+  mcpSteps
+};
+//# sourceMappingURL=index.js.map

package/dist/e2e/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/e2e/globs.ts"],"sourcesContent":["import { createRequire } from 'node:module';\nimport { dirname, join } from 'node:path';\n\n/**\n * Where this package's journeys and their steps live, ON DISK, in the consumer's\n * `node_modules`.\n *\n * `defineBddConfig` takes filesystem globs, not module specifiers — it hands\n * them to a glob matcher, so `'@12-apps/mcp/features/**'` matches\n * nothing and, worse, matches nothing SILENTLY: bddgen compiles the features it\n * found, finds none, and the run is green with zero journeys.\n *\n * So the paths are RESOLVED here instead of written down by every consumer. A\n * host that hard-codes `node_modules/@12-apps/mcp/...` is broken by\n * pnpm's nested store, by a workspace link, and by this package's own layout\n * changing; resolving from the package's own entry point is correct under all\n * three.\n */\nconst require_ = createRequire(import.meta.url);\n\n/**\n * The package root, found from a file this package definitely exports.\n * `./package.json` is exported precisely so this lookup needs no guess about\n * directory depth.\n */\nfunction packageRoot(): string {\n  return dirname(require_.resolve('@12-apps/mcp/package.json'));\n}\n\n/** Every packaged `.feature`, for `defineBddConfig({ features })`. */\nexport const mcpFeatures: string = join(packageRoot(), 'features/**/*.feature');\n\n/**\n * The base `defineBddConfig({ featuresRoot })` must be given, and it is NOT\n * optional decoration.\n *\n * bddgen mirrors each feature's path RELATIVE TO `featuresRoot` under\n * `outputDir`. Left unset it defaults to the config's own directory, so a\n * feature living under `node_modules/...` compiles to a path Playwright then\n * IGNORES, because its default `testIgnore` excludes `**\\/node_modules/**`.\n *\n * The result is the worst kind of green: bddgen reports the features compiled,\n * Playwright collects zero specs from them, and the run passes with the whole\n * packaged suite silently absent.\n *\n * A host running SEVERAL packaged suites gives `featuresRoot` the directory they\n * all sit under, since bddgen takes exactly one — and that is safe to do,\n * because a feature outside it is a hard exit from bddgen, never a quiet\n * omission.\n */\nexport const mcpFeaturesRoot: string = join(packageRoot(), 'features');\n\n/**\n * Every packaged step definition, for `defineBddConfig({ steps })`.\n *\n * COMPILED JavaScript, and that is the reason this package has a build step at\n * all while everything else it exports is raw `.ts` through the `exports` map.\n * Those entries are consumed by an application's BUNDLER, which transpiles\n * whatever it is pointed at. These are loaded by NODE — `playwright.config.ts`\n * imports this module, and bddgen imports the step files — and Node refuses to\n * strip types from anything under `node_modules`\n * (`ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING`). Playwright's own TS transform\n * does not rescue them either; it skips `node_modules` by design.\n *\n * The host's own steps glob must ALSO be listed — that is where its\n * `defineMcpConnectWorld` call lives, and playwright-bdd imports every step\n * file before any scenario runs, which is what makes the registration land in\n * time in every worker.\n */\nexport const mcpSteps: string = join(packageRoot(), 'dist/e2e/steps/**/*.js');\n"],"mappings":";;;;;;;;;AAAA,SAAS,qBAAqB;AAC9B,SAAS,SAAS,YAAY;AAiB9B,IAAM,WAAW,cAAc,YAAY,GAAG;AAO9C,SAAS,cAAsB;AAC7B,SAAO,QAAQ,SAAS,QAAQ,2BAA2B,CAAC;AAC9D;AAFS;AAKF,IAAM,cAAsB,KAAK,YAAY,GAAG,uBAAuB;AAoBvE,IAAM,kBAA0B,KAAK,YAAY,GAAG,UAAU;AAmB9D,IAAM,WAAmB,KAAK,YAAY,GAAG,wBAAwB;","names":[]}

package/dist/e2e/steps/journey.steps.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/e2e/steps/journey.steps.js

@@ -0,0 +1,79 @@
+import {
+  mcpConnectWorld
+} from "../../chunk-F3LMK6OL.js";
+import {
+  __name
+} from "../../chunk-7QVYU63E.js";
+
+// src/e2e/steps/journey.steps.ts
+import { expect } from "@playwright/test";
+import { createBdd } from "playwright-bdd";
+var { Given, When, Then } = createBdd();
+Given("I am signed in as somebody who may connect an assistant", async ({ page }) => {
+  await mcpConnectWorld().signInAsOwner(page);
+});
+When("I open the AI integration screen", async ({ page }) => {
+  await mcpConnectWorld().openAiIntegrationScreen(page);
+  await expect(page.getByTestId("ai-onboarding")).toBeVisible();
+});
+Then("the landing explains the permission model before anything is connected", async ({ page }) => {
+  await expect(page.getByTestId("ai-landing")).toBeVisible();
+  await expect(page.getByTestId("ai-permission-callout")).toBeVisible();
+});
+Then("it shows examples of what an assistant can be asked", async ({ page }) => {
+  await expect(page.getByTestId("ai-capability-examples")).toBeVisible();
+});
+When("I start the walkthrough", async ({ page }) => {
+  await page.getByTestId("ai-landing-start").click();
+  await expect(page.getByTestId("ai-host-select")).toBeVisible();
+});
+When("I choose an assistant that has no one-click install", async ({ page }) => {
+  await page.getByTestId(`ai-host-card-${mcpConnectWorld().fixtures.manualHostId}`).click();
+});
+Then("I am asked to copy the store's endpoint", async ({ page }) => {
+  await expect(page.getByTestId("ai-copy-step")).toBeVisible();
+  await expect(page.getByTestId("mcp-endpoint-url")).toContainText(
+    mcpConnectWorld().fixtures.endpointUrl
+  );
+});
+async function copyEndpoint(page) {
+  await page.getByTestId("ai-copy-endpoint").click();
+}
+__name(copyEndpoint, "copyEndpoint");
+async function openConnectorPage(page) {
+  await page.getByTestId(`ai-host-link-${mcpConnectWorld().fixtures.manualHostId}`).click();
+}
+__name(openConnectorPage, "openConnectorPage");
+When("I copy the endpoint", async ({ page }) => {
+  await copyEndpoint(page);
+});
+Then("the walkthrough has moved on to configuring the connector", async ({ page }) => {
+  await expect(page.getByTestId("ai-configure-step")).toBeVisible();
+  await expect(page.getByTestId("ai-copy-step")).toHaveCount(0);
+});
+Then("continuing is refused until I open the connector page", async ({ page }) => {
+  await expect(page.getByTestId("ai-configure-next")).toBeDisabled();
+});
+Then("once opened, continuing reaches the connect step", async ({ page }) => {
+  await openConnectorPage(page);
+  await expect(page.getByTestId("ai-configure-next")).toBeEnabled();
+  await page.getByTestId("ai-configure-next").click();
+  await expect(page.getByTestId("ai-connect-step")).toBeVisible();
+});
+When("I go back a step", async ({ page }) => {
+  await page.getByTestId("ai-step-back").click();
+});
+When("I work through configuring and connecting", async ({ page }) => {
+  await openConnectorPage(page);
+  await page.getByTestId("ai-configure-next").click();
+  await expect(page.getByTestId("ai-connect-step")).toBeVisible();
+  await page.getByTestId("ai-connect-done").click();
+});
+Then("the confirmation is still waiting for the assistant", async ({ page }) => {
+  await expect(page.getByTestId("ai-confirm-waiting")).toBeVisible();
+  await expect(page.getByTestId("ai-confirm-connected")).toHaveCount(0);
+});
+Then("it offers to test the connection again", async ({ page }) => {
+  await expect(page.getByTestId("ai-confirm-retest")).toBeVisible();
+});
+//# sourceMappingURL=journey.steps.js.map

package/dist/e2e/steps/journey.steps.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/e2e/steps/journey.steps.ts"],"sourcesContent":["import { expect, type Page } from '@playwright/test';\nimport { createBdd } from 'playwright-bdd';\n\nimport { mcpConnectWorld } from '../world.js';\n\n/**\n * The packaged AI-connect journeys' step definitions.\n *\n * Every locator is a test id THIS package's own components render —\n * `ai-landing`, `ai-host-select`, `ai-copy-step`, `ai-configure-step`,\n * `ai-connect-step`, `ai-confirm-waiting`, `mcp-endpoint-url` — which is what\n * makes the scenarios portable: they mean the same thing in any app mounting\n * `AiIntegrationOnboarding`. Everything a host owns (sign-in, where the flow is\n * mounted, which assistants it offers) arrives through the world port.\n *\n * ## Why `package.json` declares this file under `sideEffects`\n *\n * Every Given/When/Then below runs at IMPORT time — registering a step is the\n * whole point of the module, and it exports nothing anybody imports by name. To\n * a bundler doing tree-shaking that reads as dead weight, and dropping it is\n * licensed: the result is a suite where bddgen reports the features compiled\n * and every scenario then fails on an undefined step.\n *\n * Not one step asserts a SENTENCE. The assistants' names, the button words and\n * the permission prose are REQUIRED host config (FUT-760) — this package ships\n * no assistant and no copy of its own — so a spec written against them could\n * only ever have run in one adopter.\n */\nconst { Given, When, Then } = createBdd();\n\nGiven('I am signed in as somebody who may connect an assistant', async ({ page }) => {\n  await mcpConnectWorld().signInAsOwner(page);\n});\n\nWhen('I open the AI integration screen', async ({ page }) => {\n  await mcpConnectWorld().openAiIntegrationScreen(page);\n  await expect(page.getByTestId('ai-onboarding')).toBeVisible();\n});\n\nThen('the landing explains the permission model before anything is connected', async ({ page }) => {\n  await expect(page.getByTestId('ai-landing')).toBeVisible();\n  // The callout is the point of the landing: an owner is about to hand a third\n  // party a key to their store, and this is the screen that says what the key\n  // opens. It renders BEFORE any assistant is chosen, which is the only moment\n  // the answer is still \"nothing\".\n  await expect(page.getByTestId('ai-permission-callout')).toBeVisible();\n});\n\nThen('it shows examples of what an assistant can be asked', async ({ page }) => {\n  await expect(page.getByTestId('ai-capability-examples')).toBeVisible();\n});\n\nWhen('I start the walkthrough', async ({ page }) => {\n  await page.getByTestId('ai-landing-start').click();\n  await expect(page.getByTestId('ai-host-select')).toBeVisible();\n});\n\nWhen('I choose an assistant that has no one-click install', async ({ page }) => {\n  // The flow BRANCHES on the guide's `pluginUrl`: with one it becomes\n  // Escolher → Instalar → Confirmar and there is no endpoint to copy at all.\n  // The host names a guide that takes the manual path, because which\n  // assistants exist is its configuration and not this package's.\n  await page.getByTestId(`ai-host-card-${mcpConnectWorld().fixtures.manualHostId}`).click();\n});\n\nThen(\"I am asked to copy the store's endpoint\", async ({ page }) => {\n  await expect(page.getByTestId('ai-copy-step')).toBeVisible();\n  await expect(page.getByTestId('mcp-endpoint-url')).toContainText(\n    mcpConnectWorld().fixtures.endpointUrl,\n  );\n});\n\n/** Copying is the ACTION that advances this step — there is no next button. */\nasync function copyEndpoint(page: Page): Promise<void> {\n  await page.getByTestId('ai-copy-endpoint').click();\n}\n\n/**\n * Open the assistant's connector page — the one action that unlocks \"next\".\n *\n * By its OWN id, not `getByRole('link')`: this control is a Button calling\n * `window.open`, and the only real `<a>` in the step is the DOCS link, which\n * deliberately does not unlock anything. A role query would have taken the\n * docs link and then failed on an assertion about the button.\n */\nasync function openConnectorPage(page: Page): Promise<void> {\n  await page.getByTestId(`ai-host-link-${mcpConnectWorld().fixtures.manualHostId}`).click();\n}\n\nWhen('I copy the endpoint', async ({ page }) => {\n  await copyEndpoint(page);\n});\n\nThen('the walkthrough has moved on to configuring the connector', async ({ page }) => {\n  // The claim is that COPYING advanced it. The copy step offers no \"next\", so\n  // reaching the configure step at all proves the copy handler drove the\n  // wizard rather than some button the operator happened to press.\n  await expect(page.getByTestId('ai-configure-step')).toBeVisible();\n  await expect(page.getByTestId('ai-copy-step')).toHaveCount(0);\n});\n\nThen('continuing is refused until I open the connector page', async ({ page }) => {\n  // The guard that stops an owner walking past the one step that does the\n  // actual work: the connector page has to be opened before \"next\" unlocks.\n  await expect(page.getByTestId('ai-configure-next')).toBeDisabled();\n});\n\nThen('once opened, continuing reaches the connect step', async ({ page }) => {\n  await openConnectorPage(page);\n  await expect(page.getByTestId('ai-configure-next')).toBeEnabled();\n  await page.getByTestId('ai-configure-next').click();\n  await expect(page.getByTestId('ai-connect-step')).toBeVisible();\n});\n\nWhen('I go back a step', async ({ page }) => {\n  await page.getByTestId('ai-step-back').click();\n});\n\nWhen('I work through configuring and connecting', async ({ page }) => {\n  await openConnectorPage(page);\n  await page.getByTestId('ai-configure-next').click();\n  await expect(page.getByTestId('ai-connect-step')).toBeVisible();\n  await page.getByTestId('ai-connect-done').click();\n});\n\nThen('the confirmation is still waiting for the assistant', async ({ page }) => {\n  // Waiting rather than connected, because nothing has actually connected: the\n  // wizard reaching its last step is not evidence of a live connection, and\n  // this is the step that refuses to claim otherwise.\n  await expect(page.getByTestId('ai-confirm-waiting')).toBeVisible();\n  await expect(page.getByTestId('ai-confirm-connected')).toHaveCount(0);\n});\n\nThen('it offers to test the connection again', async ({ page }) => {\n  await expect(page.getByTestId('ai-confirm-retest')).toBeVisible();\n});\n"],"mappings":";;;;;;;;AAAA,SAAS,cAAyB;AAClC,SAAS,iBAAiB;AA2B1B,IAAM,EAAE,OAAO,MAAM,KAAK,IAAI,UAAU;AAExC,MAAM,2DAA2D,OAAO,EAAE,KAAK,MAAM;AACnF,QAAM,gBAAgB,EAAE,cAAc,IAAI;AAC5C,CAAC;AAED,KAAK,oCAAoC,OAAO,EAAE,KAAK,MAAM;AAC3D,QAAM,gBAAgB,EAAE,wBAAwB,IAAI;AACpD,QAAM,OAAO,KAAK,YAAY,eAAe,CAAC,EAAE,YAAY;AAC9D,CAAC;AAED,KAAK,0EAA0E,OAAO,EAAE,KAAK,MAAM;AACjG,QAAM,OAAO,KAAK,YAAY,YAAY,CAAC,EAAE,YAAY;AAKzD,QAAM,OAAO,KAAK,YAAY,uBAAuB,CAAC,EAAE,YAAY;AACtE,CAAC;AAED,KAAK,uDAAuD,OAAO,EAAE,KAAK,MAAM;AAC9E,QAAM,OAAO,KAAK,YAAY,wBAAwB,CAAC,EAAE,YAAY;AACvE,CAAC;AAED,KAAK,2BAA2B,OAAO,EAAE,KAAK,MAAM;AAClD,QAAM,KAAK,YAAY,kBAAkB,EAAE,MAAM;AACjD,QAAM,OAAO,KAAK,YAAY,gBAAgB,CAAC,EAAE,YAAY;AAC/D,CAAC;AAED,KAAK,uDAAuD,OAAO,EAAE,KAAK,MAAM;AAK9E,QAAM,KAAK,YAAY,gBAAgB,gBAAgB,EAAE,SAAS,YAAY,EAAE,EAAE,MAAM;AAC1F,CAAC;AAED,KAAK,2CAA2C,OAAO,EAAE,KAAK,MAAM;AAClE,QAAM,OAAO,KAAK,YAAY,cAAc,CAAC,EAAE,YAAY;AAC3D,QAAM,OAAO,KAAK,YAAY,kBAAkB,CAAC,EAAE;AAAA,IACjD,gBAAgB,EAAE,SAAS;AAAA,EAC7B;AACF,CAAC;AAGD,eAAe,aAAa,MAA2B;AACrD,QAAM,KAAK,YAAY,kBAAkB,EAAE,MAAM;AACnD;AAFe;AAYf,eAAe,kBAAkB,MAA2B;AAC1D,QAAM,KAAK,YAAY,gBAAgB,gBAAgB,EAAE,SAAS,YAAY,EAAE,EAAE,MAAM;AAC1F;AAFe;AAIf,KAAK,uBAAuB,OAAO,EAAE,KAAK,MAAM;AAC9C,QAAM,aAAa,IAAI;AACzB,CAAC;AAED,KAAK,6DAA6D,OAAO,EAAE,KAAK,MAAM;AAIpF,QAAM,OAAO,KAAK,YAAY,mBAAmB,CAAC,EAAE,YAAY;AAChE,QAAM,OAAO,KAAK,YAAY,cAAc,CAAC,EAAE,YAAY,CAAC;AAC9D,CAAC;AAED,KAAK,yDAAyD,OAAO,EAAE,KAAK,MAAM;AAGhF,QAAM,OAAO,KAAK,YAAY,mBAAmB,CAAC,EAAE,aAAa;AACnE,CAAC;AAED,KAAK,oDAAoD,OAAO,EAAE,KAAK,MAAM;AAC3E,QAAM,kBAAkB,IAAI;AAC5B,QAAM,OAAO,KAAK,YAAY,mBAAmB,CAAC,EAAE,YAAY;AAChE,QAAM,KAAK,YAAY,mBAAmB,EAAE,MAAM;AAClD,QAAM,OAAO,KAAK,YAAY,iBAAiB,CAAC,EAAE,YAAY;AAChE,CAAC;AAED,KAAK,oBAAoB,OAAO,EAAE,KAAK,MAAM;AAC3C,QAAM,KAAK,YAAY,cAAc,EAAE,MAAM;AAC/C,CAAC;AAED,KAAK,6CAA6C,OAAO,EAAE,KAAK,MAAM;AACpE,QAAM,kBAAkB,IAAI;AAC5B,QAAM,KAAK,YAAY,mBAAmB,EAAE,MAAM;AAClD,QAAM,OAAO,KAAK,YAAY,iBAAiB,CAAC,EAAE,YAAY;AAC9D,QAAM,KAAK,YAAY,iBAAiB,EAAE,MAAM;AAClD,CAAC;AAED,KAAK,uDAAuD,OAAO,EAAE,KAAK,MAAM;AAI9E,QAAM,OAAO,KAAK,YAAY,oBAAoB,CAAC,EAAE,YAAY;AACjE,QAAM,OAAO,KAAK,YAAY,sBAAsB,CAAC,EAAE,YAAY,CAAC;AACtE,CAAC;AAED,KAAK,0CAA0C,OAAO,EAAE,KAAK,MAAM;AACjE,QAAM,OAAO,KAAK,YAAY,mBAAmB,CAAC,EAAE,YAAY;AAClE,CAAC;","names":[]}

package/dist/{guide-KQNcXlMG.d.ts → guide-CrzdsdNf.d.ts}

@@ -147,4 +147,4 @@ interface AiConnectPromptCopy {
  */
 declare function aiConnectPrompt(spec: AiConnectPromptSpec, copy: AiConnectPromptCopy): string;
 
-export { type AiCapability as A, type AiConnectPromptCopy as a, type AiConnectPromptSpec as b, type AiHostBrand as c, type AiHostConfigureStage as d, type AiHostGuide as e, type AiHostLink as f, type AiProvider as g, aiConnectPrompt as h, type AiPermissionModel as i, providerForHostId as p };
+export { type AiConnectPromptSpec as A, type AiHostGuide as a, type AiCapability as b, type AiPermissionModel as c, type AiProvider as d, type AiConnectPromptCopy as e, type AiHostBrand as f, type AiHostConfigureStage as g, type AiHostLink as h, aiConnectPrompt as i, providerForHostId as p };

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 import { J as JsonSchema, a as ToolAnnotations, G as GeneratedTool, D as DispatchConfig, b as DispatchResult, R as RequestAuth, T as ToolManifest } from './generate-BCDqBUjZ.js';
 export { A as AuthResolver, c as GenerateOptions, O as OpenApiDocument, d as OpenApiOperation, e as OpenApiParameter, f as OpenApiRequestBody, g as OpenApiResponse, P as ParameterLocation, h as ToolParameter, i as generateTools } from './generate-BCDqBUjZ.js';
-export { A as AiCapability, a as AiConnectPromptCopy, b as AiConnectPromptSpec, c as AiHostBrand, d as AiHostConfigureStage, e as AiHostGuide, f as AiHostLink, g as AiProvider, h as aiConnectPrompt, p as providerForHostId } from './guide-KQNcXlMG.js';
+export { b as AiCapability, e as AiConnectPromptCopy, A as AiConnectPromptSpec, f as AiHostBrand, g as AiHostConfigureStage, a as AiHostGuide, h as AiHostLink, d as AiProvider, i as aiConnectPrompt, p as providerForHostId } from './guide-CrzdsdNf.js';
 import { z } from 'zod';
-export { A as AI_CAPABILITIES, a as AI_CONNECT_PROMPT, b as AI_HOST_GUIDES, c as AI_PERMISSION_MODEL, E as EN_US_AI_CAPABILITIES, d as EN_US_AI_CONNECT_PROMPT, e as EN_US_AI_HOST_GUIDES, f as EN_US_AI_PERMISSION_MODEL, P as PT_BR_AI_CAPABILITIES, g as PT_BR_AI_CONNECT_PROMPT, h as PT_BR_AI_HOST_GUIDES, i as PT_BR_AI_PERMISSION_MODEL } from './locales-eKE_OJw4.js';
+export { A as AI_CAPABILITIES, a as AI_CONNECT_PROMPT, b as AI_HOST_GUIDES, c as AI_PERMISSION_MODEL, E as EN_US_AI_CAPABILITIES, d as EN_US_AI_CONNECT_PROMPT, e as EN_US_AI_HOST_GUIDES, f as EN_US_AI_PERMISSION_MODEL, P as PT_BR_AI_CAPABILITIES, g as PT_BR_AI_CONNECT_PROMPT, h as PT_BR_AI_HOST_GUIDES, i as PT_BR_AI_PERMISSION_MODEL } from './locales-Cv0Pecvu.js';
 
 /**
  * Raised when a JSON Schema cannot be turned into a flat, self-contained tool

package/dist/{locales-eKE_OJw4.d.ts → locales-Cv0Pecvu.d.ts}

@@ -1,4 +1,4 @@
-import { b as AiConnectPromptSpec, e as AiHostGuide, A as AiCapability, i as AiPermissionModel } from './guide-KQNcXlMG.js';
+import { A as AiConnectPromptSpec, a as AiHostGuide, b as AiCapability, c as AiPermissionModel } from './guide-CrzdsdNf.js';
 
 /**
  * The AI hosts a store owner can connect, in recommended order. Same OAuth flow

package/dist/manifest/index.d.ts

@@ -53,13 +53,29 @@
  *   three hosts pass differently, which is the opposite of what a surface
  *   contribution is for. When the flow grows a real bound surface, the
  *   inventory grows with it.
- * - **No `env`.** The signing-key variables (`DEFAULT_SIGNING_KEY_ENV`,
- *   `DEFAULT_SIGNING_KEY_ID_ENV`) and `trustedOriginsFromEnv` are NAMES this
- *   package exports for a host to read `process.env` with; the package reads
- *   nothing itself, and the names are overridable per call. Declaring them
- *   would oblige a host to answer for variables it may legitimately have
- *   spelled differently.
- * - **No `e2e`.** This package packages no journeys.
+ * - **No `env`.** Three helpers here DO read `process.env`
+ *   (`trustedOriginsFromEnv`, and `loadSigningKeyFromEnv` for the key and its
+ *   id) — this used to say "the package reads nothing itself", which was
+ *   simply untrue and is the kind of sentence that makes a narrowing unfalsifiable.
+ *   The accurate reason is narrower and still holds: nothing is read at import
+ *   time or unconditionally, so a host that never calls these helpers has no
+ *   environment dependency on this package at all; and where they ARE called,
+ *   the variable's NAME is the caller's — passed as an argument by
+ *   `trustedOriginsFromEnv`, and defaulted but overridable per call by
+ *   `loadSigningKeyFromEnv`. `env` declares variables a host must answer for.
+ *   Declaring these would oblige every host to answer for names it may
+ *   legitimately have spelled differently, or never reads at all.
+ * - **`e2e` IS declared** (`../e2e`). It was narrowed away with "this package
+ *   packages no journeys", which was true as a statement of fact and circular
+ *   as an argument: it packaged none because nobody had written any, while
+ *   `./react` shipped the entire AI-connect walkthrough — landing, assistant
+ *   picker, endpoint copy, configure, connect, confirm — behind twenty test
+ *   ids that NO suite touched. Not this package's (its two React tests cover
+ *   the status board and the step primitives), and not the origin host's,
+ *   whose `ai.e2e.ts` drives its own plan lock and upsell modal and only
+ *   passes `ai-onboarding` on the way. A flow every adopter's owner has to
+ *   walk was covered in neither repo, which is exactly the omission this
+ *   capability exists to turn into a declaration.
  * - **No `jobs`.** Nothing here sweeps: authorization codes are stateless
  *   signed blobs (the partial's header says so — there is no `oauth_codes`
  *   table and nothing to expire), and refresh-token revocation happens on
@@ -88,6 +104,12 @@ declare const mcpManifest: {
         readonly namespace: "mcp";
     };
     readonly server: readonly ["http"];
+    readonly e2e: {
+        readonly entry: "@12-apps/mcp/e2e";
+        readonly world: {
+            readonly factory: "defineMcpConnectWorld";
+        };
+    };
 };
 
 export { mcpManifest };

package/dist/manifest/index.js

@@ -14,7 +14,8 @@ var mcpManifest = {
    * code by specification.
    */
   observability: { namespace: "mcp" },
-  server: ["http"]
+  server: ["http"],
+  e2e: { entry: "@12-apps/mcp/e2e", world: { factory: "defineMcpConnectWorld" } }
 };
 export {
   mcpManifest

package/dist/manifest/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/manifest/index.ts"],"sourcesContent":["/**\n * `@12-apps/mcp/manifest` — the SHARED wiring manifest.\n *\n * Identity, the Prisma contribution (the three tables behind the\n * authorization server) and the runtime inventory: `http` on the server.\n *\n * ON THE `db` DECLARATION — the reason this manifest exists at all.\n *\n * This package ships `prisma/mcp.prisma` and a migration beside it, and until\n * now nothing said so in a form a host assembler could read. The origin\n * host's assembler discovers partials in two steps: a package that carries\n * `\"wiring\": { \"db\": ... }` in its package.json is taken at its word, and a\n * package that carries nothing falls back to a STRUCTURAL scan — every\n * `prisma/*.prisma` under the package root is treated as a partial. So three\n * tables reach somebody's database because a `readdir` found them, not\n * because this package said they should. `@12-apps/notifications`' manifest\n * closed exactly this gap for its four models and the anti-pattern audit\n * names it directly; declaring changes no assembler behaviour (the\n * declaration is read where the scan used to run) and closes the one case\n * where composition was happening by accident.\n *\n * The mirror is what makes the declaration reachable: host assemblers are\n * plain Node reading `node_modules` and cannot execute this TypeScript, so\n * the contribution is repeated under `package.json` `\"wiring\": { \"db\": … }`\n * and `assertDbMirror` pins the two together in this package's own test run.\n *\n * `composed`, not `isolated`, and the choice is forced. An isolated stack\n * needs models carrying no relation into host tables — true of the three\n * here as SHIPPED (`user_id` and `user_email` are deliberately by-value\n * scalars, see the partial's header) — but the host is invited to add the FK\n * in its own migration, and the origin host's is `ON DELETE CASCADE`. A\n * package cannot declare isolation for models whose adopters relate them\n * into their own account tables.\n *\n * ## THE NARROWINGS, each deliberate\n *\n * - **No `mcp` capability.** This package IS the MCP runtime — the\n *   OpenAPI→tools generator, the registry, the JSON-RPC transport, the\n *   coverage gate. It advertises no tools of its own, and a manifest that\n *   declared any would be the runtime describing itself to itself.\n * - **No `permissions`.** Authorization here is the OAuth scope set\n *   (`MCP_SUPPORTED_SCOPES`) plus whatever the host's own RBAC says about\n *   the proxied endpoint — the point of bearer passthrough is that an agent\n *   inherits the caller's permissions rather than holding its own. There is\n *   no id for this package to contribute.\n * - **No `web` inventory**, though `./react` ships the whole AI-connect\n *   onboarding flow. A `surface` contribution is a `createWeb*` FACTORY —\n *   one config object in, an object of component types out, memoised once by\n *   the binder. `./react` has no such factory: it exports components a host\n *   mounts with its own props (`AiIntegrationOnboarding` takes the store,\n *   the endpoint URL and the live connection at the call site). Inventing a\n *   factory here to have something to declare would freeze a props table\n *   three hosts pass differently, which is the opposite of what a surface\n *   contribution is for. When the flow grows a real bound surface, the\n *   inventory grows with it.\n * - **No `env`.** The signing-key variables (`DEFAULT_SIGNING_KEY_ENV`,\n *   `DEFAULT_SIGNING_KEY_ID_ENV`) and `trustedOriginsFromEnv` are NAMES this\n *   package exports for a host to read `process.env` with; the package reads\n *   nothing itself, and the names are overridable per call. Declaring them\n *   would oblige a host to answer for variables it may legitimately have\n *   spelled differently.\n * - **No `e2e`.** This package packages no journeys.\n * - **No `jobs`.** Nothing here sweeps: authorization codes are stateless\n *   signed blobs (the partial's header says so — there is no `oauth_codes`\n *   table and nothing to expire), and refresh-token revocation happens on\n *   the rotation path rather than on a clock.\n *\n * `@12-apps/wiring` is a TYPE-ONLY devDependency (the report-builder move):\n * the manifest is a plain `satisfies`-checked value, and the producer\n * factories' runtime assertions run in this package's own test suite.\n */\n\nimport type { PackageManifest } from \"@12-apps/wiring\";\n\nexport const mcpManifest = {\n  name: \"@12-apps/mcp\",\n  contract: 1,\n  db: { partial: \"prisma/mcp.prisma\", migrations: \"prisma/migrations\" },\n  /**\n   * A refused token grant, an unresolvable signing key or a rejected\n   * redirect URI files under `mcp` rather than under whichever host mounted\n   * the authorization server. Mandatory for runtime manifests since wiring\n   * 1.3.0, and this is the surface that most needs it: every failure here is\n   * a caller who cannot connect, reported to them as an opaque OAuth error\n   * code by specification.\n   */\n  observability: { namespace: \"mcp\" },\n  server: [\"http\"],\n} as const satisfies PackageManifest;\n"],"mappings":";;;AA0EO,IAAM,cAAc;AAAA,EACzB,MAAM;AAAA,EACN,UAAU;AAAA,EACV,IAAI,EAAE,SAAS,qBAAqB,YAAY,oBAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASpE,eAAe,EAAE,WAAW,MAAM;AAAA,EAClC,QAAQ,CAAC,MAAM;AACjB;","names":[]}
+{"version":3,"sources":["../../src/manifest/index.ts"],"sourcesContent":["/**\n * `@12-apps/mcp/manifest` — the SHARED wiring manifest.\n *\n * Identity, the Prisma contribution (the three tables behind the\n * authorization server) and the runtime inventory: `http` on the server.\n *\n * ON THE `db` DECLARATION — the reason this manifest exists at all.\n *\n * This package ships `prisma/mcp.prisma` and a migration beside it, and until\n * now nothing said so in a form a host assembler could read. The origin\n * host's assembler discovers partials in two steps: a package that carries\n * `\"wiring\": { \"db\": ... }` in its package.json is taken at its word, and a\n * package that carries nothing falls back to a STRUCTURAL scan — every\n * `prisma/*.prisma` under the package root is treated as a partial. So three\n * tables reach somebody's database because a `readdir` found them, not\n * because this package said they should. `@12-apps/notifications`' manifest\n * closed exactly this gap for its four models and the anti-pattern audit\n * names it directly; declaring changes no assembler behaviour (the\n * declaration is read where the scan used to run) and closes the one case\n * where composition was happening by accident.\n *\n * The mirror is what makes the declaration reachable: host assemblers are\n * plain Node reading `node_modules` and cannot execute this TypeScript, so\n * the contribution is repeated under `package.json` `\"wiring\": { \"db\": … }`\n * and `assertDbMirror` pins the two together in this package's own test run.\n *\n * `composed`, not `isolated`, and the choice is forced. An isolated stack\n * needs models carrying no relation into host tables — true of the three\n * here as SHIPPED (`user_id` and `user_email` are deliberately by-value\n * scalars, see the partial's header) — but the host is invited to add the FK\n * in its own migration, and the origin host's is `ON DELETE CASCADE`. A\n * package cannot declare isolation for models whose adopters relate them\n * into their own account tables.\n *\n * ## THE NARROWINGS, each deliberate\n *\n * - **No `mcp` capability.** This package IS the MCP runtime — the\n *   OpenAPI→tools generator, the registry, the JSON-RPC transport, the\n *   coverage gate. It advertises no tools of its own, and a manifest that\n *   declared any would be the runtime describing itself to itself.\n * - **No `permissions`.** Authorization here is the OAuth scope set\n *   (`MCP_SUPPORTED_SCOPES`) plus whatever the host's own RBAC says about\n *   the proxied endpoint — the point of bearer passthrough is that an agent\n *   inherits the caller's permissions rather than holding its own. There is\n *   no id for this package to contribute.\n * - **No `web` inventory**, though `./react` ships the whole AI-connect\n *   onboarding flow. A `surface` contribution is a `createWeb*` FACTORY —\n *   one config object in, an object of component types out, memoised once by\n *   the binder. `./react` has no such factory: it exports components a host\n *   mounts with its own props (`AiIntegrationOnboarding` takes the store,\n *   the endpoint URL and the live connection at the call site). Inventing a\n *   factory here to have something to declare would freeze a props table\n *   three hosts pass differently, which is the opposite of what a surface\n *   contribution is for. When the flow grows a real bound surface, the\n *   inventory grows with it.\n * - **No `env`.** Three helpers here DO read `process.env`\n *   (`trustedOriginsFromEnv`, and `loadSigningKeyFromEnv` for the key and its\n *   id) — this used to say \"the package reads nothing itself\", which was\n *   simply untrue and is the kind of sentence that makes a narrowing unfalsifiable.\n *   The accurate reason is narrower and still holds: nothing is read at import\n *   time or unconditionally, so a host that never calls these helpers has no\n *   environment dependency on this package at all; and where they ARE called,\n *   the variable's NAME is the caller's — passed as an argument by\n *   `trustedOriginsFromEnv`, and defaulted but overridable per call by\n *   `loadSigningKeyFromEnv`. `env` declares variables a host must answer for.\n *   Declaring these would oblige every host to answer for names it may\n *   legitimately have spelled differently, or never reads at all.\n * - **`e2e` IS declared** (`../e2e`). It was narrowed away with \"this package\n *   packages no journeys\", which was true as a statement of fact and circular\n *   as an argument: it packaged none because nobody had written any, while\n *   `./react` shipped the entire AI-connect walkthrough — landing, assistant\n *   picker, endpoint copy, configure, connect, confirm — behind twenty test\n *   ids that NO suite touched. Not this package's (its two React tests cover\n *   the status board and the step primitives), and not the origin host's,\n *   whose `ai.e2e.ts` drives its own plan lock and upsell modal and only\n *   passes `ai-onboarding` on the way. A flow every adopter's owner has to\n *   walk was covered in neither repo, which is exactly the omission this\n *   capability exists to turn into a declaration.\n * - **No `jobs`.** Nothing here sweeps: authorization codes are stateless\n *   signed blobs (the partial's header says so — there is no `oauth_codes`\n *   table and nothing to expire), and refresh-token revocation happens on\n *   the rotation path rather than on a clock.\n *\n * `@12-apps/wiring` is a TYPE-ONLY devDependency (the report-builder move):\n * the manifest is a plain `satisfies`-checked value, and the producer\n * factories' runtime assertions run in this package's own test suite.\n */\n\nimport type { PackageManifest } from \"@12-apps/wiring\";\n\nexport const mcpManifest = {\n  name: \"@12-apps/mcp\",\n  contract: 1,\n  db: { partial: \"prisma/mcp.prisma\", migrations: \"prisma/migrations\" },\n  /**\n   * A refused token grant, an unresolvable signing key or a rejected\n   * redirect URI files under `mcp` rather than under whichever host mounted\n   * the authorization server. Mandatory for runtime manifests since wiring\n   * 1.3.0, and this is the surface that most needs it: every failure here is\n   * a caller who cannot connect, reported to them as an opaque OAuth error\n   * code by specification.\n   */\n  observability: { namespace: \"mcp\" },\n  server: [\"http\"],\n  e2e: { entry: \"@12-apps/mcp/e2e\", world: { factory: \"defineMcpConnectWorld\" } },\n} as const satisfies PackageManifest;\n"],"mappings":";;;AA0FO,IAAM,cAAc;AAAA,EACzB,MAAM;AAAA,EACN,UAAU;AAAA,EACV,IAAI,EAAE,SAAS,qBAAqB,YAAY,oBAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASpE,eAAe,EAAE,WAAW,MAAM;AAAA,EAClC,QAAQ,CAAC,MAAM;AAAA,EACf,KAAK,EAAE,OAAO,oBAAoB,OAAO,EAAE,SAAS,wBAAwB,EAAE;AAChF;","names":[]}

package/dist/oauth/index.d.ts

@@ -1,6 +1,6 @@
 import { b as McpSigningKeyProvider, R as RefreshTokenStore, N as NewOAuthClient, S as StoredOAuthClient, c as NewRefreshToken, d as StoredRefreshToken, e as McpOauthStores, f as McpConnectionStore } from '../create-api-mcp-oauth-CsC0jlH7.js';
 export { g as ACCESS_TOKEN_TTL_SECONDS, h as AccessTokenError, i as AccessTokenErrorCode, A as ApiMcpOauth, C as CodeReplayStore, D as DEFAULT_MCP_RESOURCE_PATH, j as DEFAULT_OAUTH_PATHS, k as DEFAULT_PROVIDER_ROOTS, l as DEFAULT_SIGNING_KEY_ENV, m as DEFAULT_SIGNING_KEY_ID_ENV, n as MCP_SUPPORTED_SCOPES, o as McpConnectionRecording, M as McpOauthConfig, p as McpOauthContext, q as McpOauthHandlers, r as McpOauthPaths, a as McpOauthRoute, s as McpOauthSession, t as McpScope, u as McpSigningKey, O as OAuthClientStore, P as ProviderAttributionRule, v as PublicSigningJwk, w as RegisterClientInput, x as RegisteredClient, y as SIGNING_ALG, z as SignAccessTokenInput, B as StoredMcpConnection, T as TokenEndpointAuthMethod, V as VerifiedAccessToken, E as VerifyAccessTokenOptions, F as createApiMcpOauth, G as hashSecret, H as inProcessCodeReplayStore, I as issuer, J as loadSigningKeyFromEnv, K as matchesRedirectUri, L as originFromRequest, Q as providerFromRedirectUris, U as registerClient, W as resolveMcpOauthConfig, X as resolveTrustedOrigin, Y as resourceAudience, Z as signAccessToken, _ as signingKeyProvider, $ as trustedOriginsFromEnv, a0 as verifyAccessToken } from '../create-api-mcp-oauth-CsC0jlH7.js';
-import { g as AiProvider } from '../guide-KQNcXlMG.js';
+import { d as AiProvider } from '../guide-CrzdsdNf.js';
 import 'jose';
 
 /**

package/dist/react/index.d.ts

@@ -1,8 +1,8 @@
 import { ConfirmActionCopy } from '@12-apps/ui/copy';
 import { OnboardingStore, OnboardingStateSnapshot } from '@12-apps/onboarding';
-import { e as AiHostGuide, g as AiProvider, A as AiCapability, c as AiHostBrand } from '../guide-KQNcXlMG.js';
-export { b as AiConnectPromptSpec, d as AiHostConfigureStage, f as AiHostLink, h as aiConnectPrompt, p as providerForHostId } from '../guide-KQNcXlMG.js';
-export { A as AI_CAPABILITIES, a as AI_CONNECT_PROMPT, b as AI_HOST_GUIDES, c as AI_PERMISSION_MODEL, E as EN_US_AI_CAPABILITIES, d as EN_US_AI_CONNECT_PROMPT, e as EN_US_AI_HOST_GUIDES, f as EN_US_AI_PERMISSION_MODEL, P as PT_BR_AI_CAPABILITIES, g as PT_BR_AI_CONNECT_PROMPT, h as PT_BR_AI_HOST_GUIDES, i as PT_BR_AI_PERMISSION_MODEL } from '../locales-eKE_OJw4.js';
+import { a as AiHostGuide, d as AiProvider, b as AiCapability, f as AiHostBrand } from '../guide-CrzdsdNf.js';
+export { A as AiConnectPromptSpec, g as AiHostConfigureStage, h as AiHostLink, i as aiConnectPrompt, p as providerForHostId } from '../guide-CrzdsdNf.js';
+export { A as AI_CAPABILITIES, a as AI_CONNECT_PROMPT, b as AI_HOST_GUIDES, c as AI_PERMISSION_MODEL, E as EN_US_AI_CAPABILITIES, d as EN_US_AI_CONNECT_PROMPT, e as EN_US_AI_HOST_GUIDES, f as EN_US_AI_PERMISSION_MODEL, P as PT_BR_AI_CAPABILITIES, g as PT_BR_AI_CONNECT_PROMPT, h as PT_BR_AI_HOST_GUIDES, i as PT_BR_AI_PERMISSION_MODEL } from '../locales-Cv0Pecvu.js';
 
 /**
  * Every word the AI-integration screens render, as REQUIRED host config

package/features/ai-connect.feature

@@ -0,0 +1,46 @@
+Feature: Connecting an AI assistant to the store
+
+  The walkthrough a store owner follows to let an assistant reach their data.
+  Every step below is this package's own component; what an assistant is
+  called, and which ones are offered, is the host's configuration.
+
+  Background:
+    Given I am signed in as somebody who may connect an assistant
+    When I open the AI integration screen
+
+  Scenario: The landing says what an assistant will be able to do
+    Then the landing explains the permission model before anything is connected
+    And it shows examples of what an assistant can be asked
+
+  Scenario: Choosing an assistant starts the manual walkthrough
+    When I start the walkthrough
+    And I choose an assistant that has no one-click install
+    Then I am asked to copy the store's endpoint
+
+  Scenario: Copying the endpoint is what advances the wizard
+    When I start the walkthrough
+    And I choose an assistant that has no one-click install
+    And I copy the endpoint
+    Then the walkthrough has moved on to configuring the connector
+
+  Scenario: Configuring will not advance until the connector page is opened
+    When I start the walkthrough
+    And I choose an assistant that has no one-click install
+    And I copy the endpoint
+    Then continuing is refused until I open the connector page
+    And once opened, continuing reaches the connect step
+
+  Scenario: Going back returns to the previous step
+    When I start the walkthrough
+    And I choose an assistant that has no one-click install
+    And I copy the endpoint
+    And I go back a step
+    Then I am asked to copy the store's endpoint
+
+  Scenario: The confirmation waits for the assistant, and can be re-tested
+    When I start the walkthrough
+    And I choose an assistant that has no one-click install
+    And I copy the endpoint
+    And I work through configuring and connecting
+    Then the confirmation is still waiting for the assistant
+    And it offers to test the connection again

package/package.json

@@ -1,8 +1,10 @@
 {
   "name": "@12-apps/mcp",
-  "version": "3.14.0",
+  "version": "3.16.0",
   "type": "module",
-  "sideEffects": false,
+  "sideEffects": [
+    "**/e2e/**"
+  ],
   "description": "App-agnostic MCP server core: generate one MCP tool per OpenAPI operation and proxy each call carrying the caller's bearer token (permission passthrough). Also ships the OAuth 2.1 authorization server (./oauth, ./hono: register/authorize/token, JWKS and both .well-known documents), the package-owned Prisma partial + migration for its three tables, the mcp:generate/mcp:check (./generate) and mcp:coverage (./coverage) gates, and the reusable AI-connect onboarding UI (./react).",
   "exports": {
     ".": {
@@ -37,7 +39,11 @@
       "types": "./dist/manifest/server.d.ts",
       "default": "./dist/manifest/server.js"
     },
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./e2e": {
+      "types": "./dist/e2e/index.d.ts",
+      "default": "./dist/e2e/index.js"
+    }
   },
   "scripts": {
     "build": "rm -rf dist && tsup",
@@ -52,15 +58,17 @@
   },
   "dependencies": {
     "@12-apps/onboarding": "^2.7.0",
-    "@12-apps/rbac": "^4.10.0",
-    "@12-apps/ui": "^6.10.0",
+    "@12-apps/rbac": "^4.11.0",
+    "@12-apps/ui": "^6.10.1",
     "@mui/icons-material": "^6.5.0",
     "jose": "^6.1.3",
     "react": "^19.2.0"
   },
   "peerDependencies": {
     "@12-apps/wiring": ">=1.9.0",
+    "@playwright/test": ">=1.55.0",
     "hono": ">=4.0.0",
+    "playwright-bdd": ">=8.3.0",
     "react": ">=19.0.0",
     "zod": ">=4.0.0"
   },
@@ -68,9 +76,15 @@
     "@12-apps/wiring": {
       "optional": true
     },
+    "@playwright/test": {
+      "optional": true
+    },
     "hono": {
       "optional": true
     },
+    "playwright-bdd": {
+      "optional": true
+    },
     "zod": {
       "optional": true
     }
@@ -81,6 +95,7 @@
     "@12-apps/typescript-config": "^1.21.0",
     "@12-apps/wiring": "^1.14.0",
     "@mui/material": "^6.5.0",
+    "@playwright/test": "^1.61.1",
     "@testing-library/react": "^16.1.0",
     "@types/node": "^22.15.3",
     "@types/react": "19.2.2",
@@ -88,6 +103,7 @@
     "eslint-plugin-test-flakiness": "^1.4.0",
     "hono": "^4.6.0",
     "jsdom": "^25.0.1",
+    "playwright-bdd": "^9.2.0",
     "react-dom": "^19.2.0",
     "tsup": "^8.0.0",
     "typescript": "^5.8.2",
@@ -129,6 +145,7 @@
     "!**/*.spec.*",
     "!**/*.stories.*",
     "!**/*.test-story.*",
-    "!**/test-helpers.*"
+    "!**/test-helpers.*",
+    "features"
   ]
 }

package/src/e2e/globs.ts

@@ -0,0 +1,70 @@
+import { createRequire } from 'node:module';
+import { dirname, join } from 'node:path';
+
+/**
+ * Where this package's journeys and their steps live, ON DISK, in the consumer's
+ * `node_modules`.
+ *
+ * `defineBddConfig` takes filesystem globs, not module specifiers — it hands
+ * them to a glob matcher, so `'@12-apps/mcp/features/**'` matches
+ * nothing and, worse, matches nothing SILENTLY: bddgen compiles the features it
+ * found, finds none, and the run is green with zero journeys.
+ *
+ * So the paths are RESOLVED here instead of written down by every consumer. A
+ * host that hard-codes `node_modules/@12-apps/mcp/...` is broken by
+ * pnpm's nested store, by a workspace link, and by this package's own layout
+ * changing; resolving from the package's own entry point is correct under all
+ * three.
+ */
+const require_ = createRequire(import.meta.url);
+
+/**
+ * The package root, found from a file this package definitely exports.
+ * `./package.json` is exported precisely so this lookup needs no guess about
+ * directory depth.
+ */
+function packageRoot(): string {
+  return dirname(require_.resolve('@12-apps/mcp/package.json'));
+}
+
+/** Every packaged `.feature`, for `defineBddConfig({ features })`. */
+export const mcpFeatures: string = join(packageRoot(), 'features/**/*.feature');
+
+/**
+ * The base `defineBddConfig({ featuresRoot })` must be given, and it is NOT
+ * optional decoration.
+ *
+ * bddgen mirrors each feature's path RELATIVE TO `featuresRoot` under
+ * `outputDir`. Left unset it defaults to the config's own directory, so a
+ * feature living under `node_modules/...` compiles to a path Playwright then
+ * IGNORES, because its default `testIgnore` excludes `**\/node_modules/**`.
+ *
+ * The result is the worst kind of green: bddgen reports the features compiled,
+ * Playwright collects zero specs from them, and the run passes with the whole
+ * packaged suite silently absent.
+ *
+ * A host running SEVERAL packaged suites gives `featuresRoot` the directory they
+ * all sit under, since bddgen takes exactly one — and that is safe to do,
+ * because a feature outside it is a hard exit from bddgen, never a quiet
+ * omission.
+ */
+export const mcpFeaturesRoot: string = join(packageRoot(), 'features');
+
+/**
+ * Every packaged step definition, for `defineBddConfig({ steps })`.
+ *
+ * COMPILED JavaScript, and that is the reason this package has a build step at
+ * all while everything else it exports is raw `.ts` through the `exports` map.
+ * Those entries are consumed by an application's BUNDLER, which transpiles
+ * whatever it is pointed at. These are loaded by NODE — `playwright.config.ts`
+ * imports this module, and bddgen imports the step files — and Node refuses to
+ * strip types from anything under `node_modules`
+ * (`ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING`). Playwright's own TS transform
+ * does not rescue them either; it skips `node_modules` by design.
+ *
+ * The host's own steps glob must ALSO be listed — that is where its
+ * `defineMcpConnectWorld` call lives, and playwright-bdd imports every step
+ * file before any scenario runs, which is what makes the registration land in
+ * time in every worker.
+ */
+export const mcpSteps: string = join(packageRoot(), 'dist/e2e/steps/**/*.js');

package/src/e2e/index.ts

@@ -0,0 +1,16 @@
+/**
+ * `@12-apps/mcp/e2e` — the packaged AI-connect journeys and the port a host
+ * implements to run them.
+ *
+ * The `e2e` capability the manifest declares. A host adds the three globs to
+ * its bdd config and calls `defineMcpConnectWorld` from inside its own steps
+ * glob; every scenario this package ships then runs in that host, including the
+ * ones added after it integrated. Nothing is copied, so nothing can rot.
+ */
+export { mcpFeatures, mcpFeaturesRoot, mcpSteps } from './globs.js';
+export {
+  defineMcpConnectWorld,
+  mcpConnectWorld,
+  type McpConnectFixtures,
+  type McpConnectWorld,
+} from './world.js';

package/src/e2e/steps/journey.steps.ts

@@ -0,0 +1,136 @@
+import { expect, type Page } from '@playwright/test';
+import { createBdd } from 'playwright-bdd';
+
+import { mcpConnectWorld } from '../world.js';
+
+/**
+ * The packaged AI-connect journeys' step definitions.
+ *
+ * Every locator is a test id THIS package's own components render —
+ * `ai-landing`, `ai-host-select`, `ai-copy-step`, `ai-configure-step`,
+ * `ai-connect-step`, `ai-confirm-waiting`, `mcp-endpoint-url` — which is what
+ * makes the scenarios portable: they mean the same thing in any app mounting
+ * `AiIntegrationOnboarding`. Everything a host owns (sign-in, where the flow is
+ * mounted, which assistants it offers) arrives through the world port.
+ *
+ * ## Why `package.json` declares this file under `sideEffects`
+ *
+ * Every Given/When/Then below runs at IMPORT time — registering a step is the
+ * whole point of the module, and it exports nothing anybody imports by name. To
+ * a bundler doing tree-shaking that reads as dead weight, and dropping it is
+ * licensed: the result is a suite where bddgen reports the features compiled
+ * and every scenario then fails on an undefined step.
+ *
+ * Not one step asserts a SENTENCE. The assistants' names, the button words and
+ * the permission prose are REQUIRED host config (FUT-760) — this package ships
+ * no assistant and no copy of its own — so a spec written against them could
+ * only ever have run in one adopter.
+ */
+const { Given, When, Then } = createBdd();
+
+Given('I am signed in as somebody who may connect an assistant', async ({ page }) => {
+  await mcpConnectWorld().signInAsOwner(page);
+});
+
+When('I open the AI integration screen', async ({ page }) => {
+  await mcpConnectWorld().openAiIntegrationScreen(page);
+  await expect(page.getByTestId('ai-onboarding')).toBeVisible();
+});
+
+Then('the landing explains the permission model before anything is connected', async ({ page }) => {
+  await expect(page.getByTestId('ai-landing')).toBeVisible();
+  // The callout is the point of the landing: an owner is about to hand a third
+  // party a key to their store, and this is the screen that says what the key
+  // opens. It renders BEFORE any assistant is chosen, which is the only moment
+  // the answer is still "nothing".
+  await expect(page.getByTestId('ai-permission-callout')).toBeVisible();
+});
+
+Then('it shows examples of what an assistant can be asked', async ({ page }) => {
+  await expect(page.getByTestId('ai-capability-examples')).toBeVisible();
+});
+
+When('I start the walkthrough', async ({ page }) => {
+  await page.getByTestId('ai-landing-start').click();
+  await expect(page.getByTestId('ai-host-select')).toBeVisible();
+});
+
+When('I choose an assistant that has no one-click install', async ({ page }) => {
+  // The flow BRANCHES on the guide's `pluginUrl`: with one it becomes
+  // Escolher → Instalar → Confirmar and there is no endpoint to copy at all.
+  // The host names a guide that takes the manual path, because which
+  // assistants exist is its configuration and not this package's.
+  await page.getByTestId(`ai-host-card-${mcpConnectWorld().fixtures.manualHostId}`).click();
+});
+
+Then("I am asked to copy the store's endpoint", async ({ page }) => {
+  await expect(page.getByTestId('ai-copy-step')).toBeVisible();
+  await expect(page.getByTestId('mcp-endpoint-url')).toContainText(
+    mcpConnectWorld().fixtures.endpointUrl,
+  );
+});
+
+/** Copying is the ACTION that advances this step — there is no next button. */
+async function copyEndpoint(page: Page): Promise<void> {
+  await page.getByTestId('ai-copy-endpoint').click();
+}
+
+/**
+ * Open the assistant's connector page — the one action that unlocks "next".
+ *
+ * By its OWN id, not `getByRole('link')`: this control is a Button calling
+ * `window.open`, and the only real `<a>` in the step is the DOCS link, which
+ * deliberately does not unlock anything. A role query would have taken the
+ * docs link and then failed on an assertion about the button.
+ */
+async function openConnectorPage(page: Page): Promise<void> {
+  await page.getByTestId(`ai-host-link-${mcpConnectWorld().fixtures.manualHostId}`).click();
+}
+
+When('I copy the endpoint', async ({ page }) => {
+  await copyEndpoint(page);
+});
+
+Then('the walkthrough has moved on to configuring the connector', async ({ page }) => {
+  // The claim is that COPYING advanced it. The copy step offers no "next", so
+  // reaching the configure step at all proves the copy handler drove the
+  // wizard rather than some button the operator happened to press.
+  await expect(page.getByTestId('ai-configure-step')).toBeVisible();
+  await expect(page.getByTestId('ai-copy-step')).toHaveCount(0);
+});
+
+Then('continuing is refused until I open the connector page', async ({ page }) => {
+  // The guard that stops an owner walking past the one step that does the
+  // actual work: the connector page has to be opened before "next" unlocks.
+  await expect(page.getByTestId('ai-configure-next')).toBeDisabled();
+});
+
+Then('once opened, continuing reaches the connect step', async ({ page }) => {
+  await openConnectorPage(page);
+  await expect(page.getByTestId('ai-configure-next')).toBeEnabled();
+  await page.getByTestId('ai-configure-next').click();
+  await expect(page.getByTestId('ai-connect-step')).toBeVisible();
+});
+
+When('I go back a step', async ({ page }) => {
+  await page.getByTestId('ai-step-back').click();
+});
+
+When('I work through configuring and connecting', async ({ page }) => {
+  await openConnectorPage(page);
+  await page.getByTestId('ai-configure-next').click();
+  await expect(page.getByTestId('ai-connect-step')).toBeVisible();
+  await page.getByTestId('ai-connect-done').click();
+});
+
+Then('the confirmation is still waiting for the assistant', async ({ page }) => {
+  // Waiting rather than connected, because nothing has actually connected: the
+  // wizard reaching its last step is not evidence of a live connection, and
+  // this is the step that refuses to claim otherwise.
+  await expect(page.getByTestId('ai-confirm-waiting')).toBeVisible();
+  await expect(page.getByTestId('ai-confirm-connected')).toHaveCount(0);
+});
+
+Then('it offers to test the connection again', async ({ page }) => {
+  await expect(page.getByTestId('ai-confirm-retest')).toBeVisible();
+});

package/src/e2e/world.ts

@@ -0,0 +1,84 @@
+import type { Page } from '@playwright/test';
+
+/**
+ * The port a HOST implements to run the packaged AI-connect journeys.
+ *
+ * These journeys were written because the walkthrough they cover was tested
+ * NOWHERE. `./react` ships the whole flow — the landing, the assistant picker,
+ * the endpoint to copy, the configure and connect steps, the confirmation and
+ * its re-test — and twenty test ids go with it. Not one of them appeared in
+ * this package's own suite, and not one appeared in the origin host's specs
+ * either: that host's `ai.e2e.ts` drives its OWN plan lock and upsell modal,
+ * reaching only `ai-onboarding` and the status board on the way past.
+ *
+ * So the flow a store owner actually walks was covered by nothing, in either
+ * repo. That is the gap the `e2e` capability exists to convert into a
+ * declaration rather than an omission nobody can see.
+ *
+ * What stays the host's: how it signs an owner in, where it mounts the flow,
+ * and which assistant its `hosts` config offers — the guides are REQUIRED
+ * config (FUT-760), so the package has no assistant of its own to name.
+ */
+
+/** Facts about the host that the assertions have to name. */
+export interface McpConnectFixtures {
+  /**
+   * The id of an assistant the host offers whose guide has NO `pluginUrl`.
+   *
+   * The flow BRANCHES on that field: a guide carrying one gets `InstallStep`
+   * (a single "open the install link" button), and a guide without one gets
+   * the three-step manual path — copy the endpoint, configure, connect. These
+   * journeys walk the MANUAL path, so the host has to point at a guide that
+   * takes it. Naming the branch here rather than guessing keeps the scenario
+   * from failing in a host whose first assistant happens to ship a plugin.
+   */
+  manualHostId: string;
+  /** The endpoint URL that host serves, as it is rendered for copying. */
+  endpointUrl: string;
+}
+
+/** What a host must be able to do for these journeys to run in it. */
+export interface McpConnectWorld {
+  /**
+   * Put the browser in a known signed-in state as somebody who may connect an
+   * assistant, with the flow's progress RESET to its first run.
+   *
+   * The reset is load-bearing rather than hygiene: the wizard persists its step
+   * through `@12-apps/onboarding`, so a scenario that advanced it would hand
+   * the next one a flow resuming from the middle — and the landing step, which
+   * two of these scenarios assert, would never render.
+   */
+  signInAsOwner(page: Page): Promise<void>;
+  /** Land on the screen that mounts `AiIntegrationOnboarding`. */
+  openAiIntegrationScreen(page: Page): Promise<void>;
+  fixtures: McpConnectFixtures;
+}
+
+let installed: McpConnectWorld | null = null;
+
+/**
+ * Install the host's implementation. Call this from a module inside the host's
+ * OWN steps glob — playwright-bdd imports every step file before any scenario
+ * runs, so a top-level call there is registered in time, in every worker.
+ */
+export function defineMcpConnectWorld(world: McpConnectWorld): void {
+  installed = world;
+}
+
+/**
+ * The installed world, or a refusal naming the fix.
+ *
+ * Throws rather than returning null: a step that ran against an absent world
+ * would fail on whatever it touched next, somewhere unrelated to the actual
+ * mistake, which is a diagnosis nobody should have to make twice.
+ */
+export function mcpConnectWorld(): McpConnectWorld {
+  if (!installed) {
+    throw new Error(
+      'No mcp e2e world is installed. Call defineMcpConnectWorld({ … }) from a module inside ' +
+        "your own `steps` glob — playwright-bdd imports those before any scenario runs, " +
+        'which is what makes the registration land in every worker.',
+    );
+  }
+  return installed;
+}

package/src/manifest/index.ts

@@ -53,13 +53,29 @@
  *   three hosts pass differently, which is the opposite of what a surface
  *   contribution is for. When the flow grows a real bound surface, the
  *   inventory grows with it.
- * - **No `env`.** The signing-key variables (`DEFAULT_SIGNING_KEY_ENV`,
- *   `DEFAULT_SIGNING_KEY_ID_ENV`) and `trustedOriginsFromEnv` are NAMES this
- *   package exports for a host to read `process.env` with; the package reads
- *   nothing itself, and the names are overridable per call. Declaring them
- *   would oblige a host to answer for variables it may legitimately have
- *   spelled differently.
- * - **No `e2e`.** This package packages no journeys.
+ * - **No `env`.** Three helpers here DO read `process.env`
+ *   (`trustedOriginsFromEnv`, and `loadSigningKeyFromEnv` for the key and its
+ *   id) — this used to say "the package reads nothing itself", which was
+ *   simply untrue and is the kind of sentence that makes a narrowing unfalsifiable.
+ *   The accurate reason is narrower and still holds: nothing is read at import
+ *   time or unconditionally, so a host that never calls these helpers has no
+ *   environment dependency on this package at all; and where they ARE called,
+ *   the variable's NAME is the caller's — passed as an argument by
+ *   `trustedOriginsFromEnv`, and defaulted but overridable per call by
+ *   `loadSigningKeyFromEnv`. `env` declares variables a host must answer for.
+ *   Declaring these would oblige every host to answer for names it may
+ *   legitimately have spelled differently, or never reads at all.
+ * - **`e2e` IS declared** (`../e2e`). It was narrowed away with "this package
+ *   packages no journeys", which was true as a statement of fact and circular
+ *   as an argument: it packaged none because nobody had written any, while
+ *   `./react` shipped the entire AI-connect walkthrough — landing, assistant
+ *   picker, endpoint copy, configure, connect, confirm — behind twenty test
+ *   ids that NO suite touched. Not this package's (its two React tests cover
+ *   the status board and the step primitives), and not the origin host's,
+ *   whose `ai.e2e.ts` drives its own plan lock and upsell modal and only
+ *   passes `ai-onboarding` on the way. A flow every adopter's owner has to
+ *   walk was covered in neither repo, which is exactly the omission this
+ *   capability exists to turn into a declaration.
  * - **No `jobs`.** Nothing here sweeps: authorization codes are stateless
  *   signed blobs (the partial's header says so — there is no `oauth_codes`
  *   table and nothing to expire), and refresh-token revocation happens on
@@ -86,4 +102,5 @@ export const mcpManifest = {
    */
   observability: { namespace: "mcp" },
   server: ["http"],
+  e2e: { entry: "@12-apps/mcp/e2e", world: { factory: "defineMcpConnectWorld" } },
 } as const satisfies PackageManifest;