Merge remote-tracking branch 'origin/main' into claude/issue-19086-fix-builds-what-it-writes-from

Author: claude

.changeset/18571-permission-set-skipped-unowned.md

@@ -0,0 +1,26 @@
+---
+"@objectstack/plugin-security": minor
+---
+
+**The permission-set seeder's unowned refusal now moves a counter.** `PermissionSeedOutcome` gains a required `skippedUnowned`, incremented on the `!packageId` branch of `upsertPackagePermissionSet` — the branch that refuses to materialize a declared set with no resolvable owner (#18571).
+
+⛔ **The refusal itself is unchanged.** A `managed_by:'package'` row with no `package_id` makes uninstall undefined, which is exactly the ADR-0086 D3 ambiguity the branch exists to prevent. This card adds a channel, not a verdict.
+
+#18564 gave that refusal its author-visible line. What it left is the programmatic half: the outcome came back with all six counters at zero, so a caller that reads no log at all — a boot report, a Setup surface, a test — could not tell a pass that refused a declaration from a pass with nothing to do. Measured against the sibling axis, which has counted the same refusal at the same boundary since #4967:
+
+```
+axis                       unowned refusal      counter moved   author-visible line
+capability                 skippedUnowned            1                  1
+permission set (before)    — none declared —         0                  1
+permission set (after)     skippedUnowned            1                  1
+```
+
+**Required, not optional** — like `skippedForeign` and unlike `deleted`. An absent key on a *refusal* count reads exactly like a pass with nothing to refuse, which is the defect restated. All four construction sites initialize it (`bootstrapDeclaredPermissions`, `upsertPackagePermissionSet`, `upsertEnvPermissionSet`, `retirePermissionSetRecord`), so every door that returns this outcome answers the question.
+
+**Both doors onto the branch increment it.** The boot catalog loop aggregates it alongside the five counters it already forwarded; the ADR-0086 P2 publish materializer passes no collector and returns its own outcome, so a fix wired only into the aggregation would have left that caller as silent as before.
+
+**The accounting closes.** `seeded + updated + unchanged + skippedEnvAuthored + skippedForeign + skippedUnowned + unreadable` is now the number of named declarations a pass read — pinned by a conservation test modelled on the capability axis'. Before this counter that sum was short by every unowned declaration. (Pre-existing caveat, unchanged and outside this change: a write the engine rejects increments no counter; it is reported through `SeedWriteRefusals`.)
+
+New published surface on `@objectstack/plugin-security`: the `skippedUnowned` member of the barrel-exported `PermissionSeedOutcome`. Reading an outcome is unaffected — the member only adds a number to read.
+
+The sweep for construction sites covered this repository, the pinned `objectui` checkout and the downstream app repositories available to it, and found none outside the package. That is what was measured, and it cannot speak for a consumer outside those trees. So: if you construct a `PermissionSeedOutcome` yourself — a test double standing in for the seeder is the shape that does — add `skippedUnowned: 0`. Nothing else changes.

.changeset/19071-between-blank-endpoint-runtime-door.md

@@ -0,0 +1,45 @@
+---
+'@objectstack/spec': minor
+---
+
+**BREAKING for callers** — `parseFilterAST` now refuses a blank `$between` endpoint, exactly as the authoring schema already does. An empty-string or absent (`undefined`) bound, at either side, is refused with `INVALID_FILTER` / 400, and the refusal names the blank side — MIN or MAX, plus the index (#19071).
+
+Clause-②: no
+
+## What changed, and why it is the implementation catching up rather than a new rule
+
+`RANGE_ENDPOINT_DESCRIPTION` — the published endpoint contract shared by both of `$between`'s bounds — has stated since 2026-09-17 that "BOTH are required NON-BLANK: an empty string, null and undefined are refused, and the refusal names the blank side". That rule shipped at the authoring schema only. The runtime door disagreed with it: `parseFilterAST({ at: { $between: ['', ''] } })` returned the filter unchanged, same object reference, measured on `origin/main` before this change and re-measured after.
+
+One published sentence therefore had two truth values, decided by which door a caller came through — and the door that passed it is the one that matters most here. A caller that lowers a filter with `parseFilterAST` and hands it straight to a driver (an embedder; this repo's own driver conformance suites) never meets the schema. At every backend a blank bound stops bounding on that side while the range still reads as a complete two-element range, so the query runs with one meaningless boundary and returns rows outside the window its filter names, with no signal at any layer.
+
+```
+FROM  parseFilterAST({ at: { $between: ['2026-01-01', ''] } })
+      -> { at: { $between: ['2026-01-01', ''] } }   // unchanged, same reference,
+                                                    // straight on to the driver
+
+TO    parseFilterAST({ at: { $between: ['2026-01-01', ''] } })
+      -> throws INVALID_FILTER / 400:
+         'Operator "$between" on field "at" requires two non-blank bounds.
+          Received an empty string at where.at.$between[1] (the MAX bound). …'
+```
+
+## Migration — FROM → TO
+
+| You wrote | Write instead |
+| --- | --- |
+| `{ $between: ['2026-01-01', ''] }` | `{ $between: ['2026-01-01', '2026-12-31'] }` — the bound you meant, written out |
+| `{ $between: ['', 100] }` | `{ $between: [0, 100] }` — the lower bound you meant |
+| a range that was only ever bounded on ONE side | `{ "$gte": min }` or `{ "$lte": max }` — a one-sided bound is not a range |
+
+**The one-line fix: write the bound that is missing, or — if only one side was ever meant — drop `$between` and write that side as a scalar comparison.** The same prescription the authoring door already gives, now given at the door an embedder actually reaches.
+
+## What does NOT change
+
+- **`null` bounds** keep their own message, refused since 2026-08-31. It prescribes the null PREDICATE, because an author who wrote `null` was reaching for absence and an author who left a bound empty was reaching for a bound — two blank spellings, two intents, two remedies. `null` is also checked first, so a pair that is blank on one side and null on the other keeps the message it has always had.
+- **Whitespace-only endpoints** are still accepted, at BOTH doors. The 2026-09-17 ruling is the empty string; the authoring door pins `{ $between: [' ', 'M'] }` as parsing green on purpose, and trimming here would re-open the very split this change closes, in the opposite direction.
+- **Falsiness.** `{ $between: [0, 0] }` and `{ $between: ['0', '9'] }` lower exactly as before. The rule is blankness, not falsiness.
+- **`$in` / `$nin` members.** A falsy or empty-string MEMBER is a value, not an absence (2026-08-31, `filter-comparand-shape.test.ts`). Only a range ENDPOINT is judged here, and only the `$between` row of that pin moves.
+- **Arity**, which was already refused with its own message, and every legal range: numbers, Dates, ISO days, UTC instants, clock times and non-temporal text all lower byte-identically, same object reference.
+- **The published export surface.** No export is added, removed or renamed; the refusal rides the existing `$between` arm of the shared comparand-shape door, so the engine's delegating wrapper inherits it unchanged.
+
+<!-- adr-0087: not-required (already-registered filter-between-blank-endpoint-refused) the transition from a blank $between endpoint to two present, non-empty bounds was registered by #18012 for this same surface set; this change adds no new transition, it brings the runtime lowering face under the one already on the ledger, and the entry's own prescription and acceptance criteria apply verbatim -->

.changeset/19417-install-door-parses-manifest-id.md

@@ -0,0 +1,76 @@
+---
+'@objectstack/runtime': minor
+---
+
+fix(runtime): `POST /api/v1/packages` parses the manifest's `id` leg instead of reading it positionally (#19417)
+
+Clause-②: no (narrowing)
+
+**BREAKING for callers of the install door** — a manifest whose `id` is not
+reverse-domain notation is now refused `400` / `VALIDATION_ERROR`. It used to
+install and answer `201`.
+
+The accept set only shrinks back to what the published declaration has always
+said. `MANIFEST_ID_PATTERN` is declared once in
+`packages/spec/src/kernel/manifest.zod.ts` and referenced by both faces of one
+identity — `ManifestSchema.id`, what an author writes, and
+`PackageSchema.manifestId`, what the registry stores and publishes by. The door
+read `manifest.id` POSITIONALLY (`typeof manifest?.id === 'string' ?
+manifest.id.trim() : ''`) and parsed nothing, so `id: 'pkg-a'` installed and
+answered `201` while `defineStack()`, `os build`, `os validate` and the publish
+face all refused the same id. The author was handed a package that could never
+be rebuilt or published. That is «declared ≠ enforced» on a published API
+contract — and nothing in `packages/spec` moves for it: the declaration was
+already right.
+
+The gate asks the declaration **by reference** — `ManifestSchema.shape.id` —
+rather than keeping a copy of the grammar, exactly as the `version` leg beside
+it does, so a future move of the reverse-domain rule reaches this door with no
+further edit. The sentence the caller reads is the declaration's own
+(`manifestIdRefusal`), **surfaced rather than reworded**: it names the key,
+echoes the value, lists the two examples, and carries a suggestion arm that
+verifies its candidate against the pattern before offering it. Posting
+`id: 'pkg-a'` now answers, in the response envelope's `error.message`:
+
+```text
+Invalid package id 'pkg-a' on `manifest.id`. Expected reverse-domain notation
+('com.steedos.crm', 'org.apache.superset') — lowercase dot-separated segments;
+hyphens allowed inside a segment, underscores are not. Did you mean
+'com.example.pkg-a'?
+```
+
+**What is not affected.** Boot-time and in-process installs reach
+`SchemaRegistry.installPackage` / `ObjectQL.registerApp` directly and never pass
+through this branch, so nothing about how a package is loaded from disk or
+registered by a plugin changes. A conforming manifest installs exactly as
+before, on both body forms (wrapped and bare) and on both install limbs (the
+protocol primitive and the bare-registry fallback).
+
+**The `Package id is required` sentence does NOT move.** `''` fails
+`MANIFEST_ID_PATTERN` too, so where this gate sits decides whether a published
+message changes or only the accept set does. It is ordered AFTER the existing
+`!pkgId` check: an absent, empty, whitespace-only or non-string `id` still
+answers `400 Package id is required`, never the schema's sentence — which on
+that input is the one case where the suggestion arm has nothing to offer.
+Measured both directions. It is ordered BEFORE the `version` gate for the
+mirror-image reason: that refusal's sentence names the id it prescribes for, and
+prescribing a `version` repair for an id that can never be legal sends the
+author round twice.
+
+**Scope — the `id` leg alone.** The declaration's residual docblock records the
+classes this door answers `201` to while `PackageInstallBodySchema` refuses
+them. This change closes one: `id`. A missing `type`, unknown keys on either
+body form, a string-typed `enableOnInstall` / `overwrite`, and install options
+spelled on the bare form are each left exactly as they were — measured after the
+change, all seven spellings of those four classes still answer `201`, against a
+`pkg-a` control that answers `400` and a conforming control that answers `201`.
+Each is its own reading and its own card. Closing them is the one call this
+handler still pointedly does not make, `PackageInstallBodySchema.safeParse(body)`.
+
+**If you are refused.** Give the manifest an id in reverse-domain notation —
+lowercase dot-separated segments, hyphens allowed inside a segment, underscores
+not. The refusal names the key, echoes what you wrote and, where a mechanical
+repair exists, offers one it has already checked against the rule, so the
+prescription arrives with the `400` rather than in a changelog.
+
+<!-- adr-0087: not-required (no-migration-prescription) Nothing authorable is removed, renamed or reshaped: no spec key, no export, no stored row. `objectstack migrate meta` has nothing to reach, because there is no old spelling that maps to a new one — a caller supplies an id the declaration already required, and an id's repair changes the package's identity, so no mechanical mapping could be prescribed even in principle. The refusal itself carries the remedy. -->

.claude/settings.json

@@ -52,6 +52,10 @@
       "Bash(curl -sS -X PUT https://api.github.com/repos/objectstack-ai/objectstack/pulls/*/ccr/auto_merge *)",
       "Bash(node --use-env-proxy scripts/pm/post-stamped.mjs *)",
       "Bash(node --use-env-proxy scripts/pm/label-write.mjs *)",
+      "Bash(node scripts/pm/post-stamped.mjs *)",
+      "Bash(node scripts/pm/label-write.mjs *)",
+      "Bash(node scripts/pm/close-cards.mjs *)",
+      "Bash(node --use-env-proxy scripts/pm/close-cards.mjs *)",
       "Bash(curl -sS -X PATCH https://api.github.com/repos/objectstack-ai/objectstack/issues/* *)",
       "Bash(curl -sS -X PATCH https://api.github.com/repos/objectstack-ai/objectui/issues/* *)"
     ],

.github/workflows/lint.yml

@@ -1307,6 +1307,29 @@ jobs:
       - name: Label-write helper self-test
         run: pnpm check:pm-label-write
 
+      # Card-closure helper self-test (#19469) — same family and the same split
+      # as the two steps above, and it drives BOTH of them: `close-cards.mjs` is
+      # the three-step closure (comment · label · close) as one named command,
+      # so a seat's batch closure is one allow-listed prefix instead of a loop
+      # the session's write classifier judges act by act. The LIVE path posts
+      # comments, strips labels and closes cards, so it is emphatically not a
+      # thing CI runs against the board; the offline half is all CI can hold.
+      #
+      # What the self-test instruments is the set of rules a clean tree cannot
+      # exercise, every one of which is silent when it breaks: the skip matrix
+      # (not open · assigned · `pm:retriage` · a pm-state that is not EXACTLY
+      # the expected one · an open PR cross-referencing the card); that an
+      # unreadable card or timeline STOPS the run rather than being read as a
+      # "no"; that a 200 whose body does not read back `closed`, or reads back
+      # another `state_reason`, is not a close; and — the one this tool exists
+      # for — that a comment which lands whose label write then fails STOPS at
+      # that card, naming it and which of the three writes landed, instead of
+      # turning one half-state into a page of them. Weakening any of them leaves
+      # every ordinary invocation just as green, which is the shape
+      # `check:self-test-wired` requires this step for.
+      - name: Card-closure helper self-test
+        run: pnpm check:pm-close-cards
+
       # Board-snapshot archiver self-test (#17390) — same family and the same
       # split as every step around it. The LIVE run reads the whole board over
       # REST and commits the result to an orphan branch, so it is not a thing

package.json

@@ -88,6 +88,7 @@
     "check:pm-stale-finding": "node scripts/pm/sweep-stale-finding.mjs --self-test",
     "check:pm-post-stamped": "node scripts/pm/post-stamped.mjs --self-test",
     "check:pm-label-write": "node scripts/pm/label-write.mjs --self-test",
+    "check:pm-close-cards": "node scripts/pm/close-cards.mjs --self-test",
     "check:pm-board-snapshot": "node scripts/pm/board-snapshot.mjs --self-test",
     "check:pm-changeset-deadline-census": "node scripts/pm/changeset-deadline-census.mjs --self-test",
     "check:pm-governed-merges": "node scripts/pm/check-governed-merges.mjs --self-test",