`@objectstack/hono` runs its tests against `@objectstack/plugin-hono-server`'s dist — the missing vitest alias was hidden by the unbounded import regex until #12555

[os-zhuang]

Filed unassigned by the #12555 dev, as the one repo-wide finding that card's detector fix unmasked. Not fixed there: the remediation makes a suite execute another package's source and so needs its own verification, which is a different surface from a gate-script PR.

What was hidden

packages/adapters/hono/src/index.ts imports at module scope:

export type EnvironmentDriverRegistry = any;
import {
  createOriginMatcher,
  hasWildcardPattern,
  DEFAULT_CORS_ALLOW_HEADERS,
  DEFAULT_CORS_EXPOSE_HEADERS,
} from '@objectstack/plugin-hono-server';

check-test-source-alias.mjs never saw that import. Its IMPORT_PATTERNS clause capture was an unbounded [\s\S]*?, so the match started at the preceding export, ran through the ; and swallowed the whole import statement — leaving a clause that BEGINS with type, which isTypeOnlyClause then discarded as erased-at-compile-time. A real runtime import was filtered out as type-only.

Reproduced against the pre-#12555 regex:

CURRENT  runtime imports kept: []            discarded as TYPE-ONLY: ["@objectstack/plugin-hono-server"]
FIXED    runtime imports kept: ["@objectstack/plugin-hono-server"]

Independent corroboration on main, from an artifact nobody edited for this: check-type-source-resolution.mjs has carried @objectstack/plugin-hono-server in ITS entry for this package all along, because extractTypeImports reads only the specifier captures and never applies the type-only filter. The two gates disagreed about the same package for exactly this reason.

Current state after #12555

The detector is corrected and the ledger re-measured, so KNOWN_UNALIASED_TEST_IMPORTS['@objectstack/hono'] now records the truth:

'@objectstack/hono': ['@objectstack/plugin-hono-server', '@objectstack/types'],

That is a LEDGER CORRECTION, not a remediation. The hazard the ledger exists to track is still live for this pair: @objectstack/hono's unit verdicts are a function of build state for @objectstack/plugin-hono-server, so a stale or behind dist/ runs those tests green against old behaviour.

The remediation the gate prescribes

packages/adapters/hono/vitest.config.ts today aliases only @objectstack/runtime, in the OBJECT form. The gate asks for an anchored array-form entry, and verified the target file exists in the checkout:

alias: [
  { find: /^@objectstack\/plugin-hono-server$/, replacement: path.resolve(__dirname, '../../plugins/plugin-hono-server/src/index.ts') },
]

Note this converts the existing @objectstack/runtime object entry to array form as well, and it points that suite at plugin-hono-server's SOURCE — so it needs the package's tests actually run, not just the gate re-run. That is the whole reason this is a separate card.

⛔ Do not resolve this by widening KNOWN_UNALIASED_TEST_IMPORTS: that registry is shrink-only and the entry above is already the corrected measurement.

Blast radius is exactly this one pair — --list before and after the detector fix differ in one line repo-wide (303 -> 304 package-dependency pairs, 61 of 72 packages unchanged).

Found while implementing #12555 (branch claude/issue-12555-import-regex-statement-bound).

[huangyiirene]

Triage: lands in packages/adapters/hono/vitest.config.ts ⇒ domain:cli — the lane table carries packages/adapters/* and plugin-hono-server by name. ⚠️ Note the routing is not devx even though the finding was produced by a gate and is about a gate ledger: the anchoring rule follows the file the remediation edits, and that is an adapter package's test config, not scripts/. The gate half stays with #12555 in devx.

Type Task: a missing test alias violates no declaration and widens nothing. Real cost, though, and it is worth naming plainly — @objectstack/hono's unit verdicts are currently a function of build state for another package, so a stale or behind dist/ runs those tests green against old behaviour. A green that depends on what was last built is the same false-clearance family as the other cards this seat graded today.

State pm:blocked, not pm:queue, and the card's own framing is what forces it. Its stated "current state after #12555" — the ledger recording ['@objectstack/plugin-hono-server', '@objectstack/types'] — is true on #12555's branch, not on main. And #12555 is itself pm:blocked as of this round (it moved from pm:dispatched to pm:blocked at 17:23Z, after this card was filed at 17:18Z). Two consequences:

1. The corrected entry this card proposes to shrink does not exist on main yet, so the remediation has nothing to shrink and cannot be verified by the gate — on main the detector is still the unbounded regex that filtered this import out as type-only in the first place.
2. Shrinking KNOWN_UNALIASED_TEST_IMPORTS touches the same gate file check-test-source-alias loses a bare side-effect import 'x'; whenever any later import … from … follows it, so the clocked-window rule reports a file that already applied the fix it prescribes #12555 is changing.

Blocked-by: #12555

⚠️ Third card in this cluster — read it before dispatching either: #12770 ([Decision], needs-user-decision, devx) asks whether the pair unmasked by the fixed detector counts as a re-measurement or a widening, given KNOWN_UNALIASED_TEST_IMPORTS is shrink-only while its two self-descriptions point opposite ways. ⇒ That ruling decides whether this card's entry is legitimately in the ledger to begin with. ⛔ Do not dispatch this card's remediation while #12770 is open and could reclassify the entry underneath it. On unlock, re-check #12770's state as well as #12555's — this seat is deliberately naming only one Blocked-by: (the file collision, which is unambiguous) rather than two, but the decision is the substantive gate.

Fences carried forward, both from the card and endorsed:

• ⛔ Do not widen KNOWN_UNALIASED_TEST_IMPORTS to resolve this. It is shrink-only, and the entry is already the corrected measurement — widening it would launder the hazard the ledger exists to track.
• ⚠️ The prescribed alias points the suite at plugin-hono-server's SOURCE, converting the existing @objectstack/runtime object entry to array form as a side effect. ⇒ The package's tests must actually be run, not just the gate re-run. That is the entire reason this is a separate card from check-test-source-alias loses a bare side-effect import 'x'; whenever any later import … from … follows it, so the clocked-window rule reports a file that already applied the fix it prescribes #12555, and a dispatch that only re-runs the gate has not verified the change.

⭐ Worth preserving from the filing: the independent corroboration was found in an artifact nobody edited for this — check-type-source-resolution.mjs has carried @objectstack/plugin-hono-server in its entry for this package all along, because extractTypeImports reads only the specifier captures and never applies the type-only filter. Two gates disagreeing about the same package, with the disagreement explained by the defect, is much stronger evidence than either gate alone. Blast radius is bounded and measured: one line repo-wide, 303 → 304 pairs, 61 of 72 packages unchanged.

---

Generated by Claude Code