Merge remote-tracking branch 'origin/main' into claude/issue-20653-plugin-bundle-leaves

Author: claude

.changeset/20305-inline-row-filter-converts.md

@@ -0,0 +1,21 @@
+---
+'@objectstack/spec': minor
+---
+
+feat(spec): the stored-filter conversion rewrites a filter on a block whose rows are inline, as it does on any other block
+
+The ADR-0087 D2 conversion `page-component-filter-record-to-rule-array` no longer leaves every filter of a page component whose rows are inline (`data: { provider: 'value', … }`, a `data` array, or `staticData`) as stored. Such a filter, the binding's `dataSource.filter` included, is now rewritten to the `[{ field, operator, value }, ...]` rule array exactly as it is on a block that queries an object. What still stays as stored, and is still reported as a TODO, is only a filter with a part that has no lossless rule spelling: a combinator, a null value, or an operator the rule vocabulary does not spell. That holds on any block.
+
+Why the conversion declined, and why it no longer needs to: the `object-map`, `object-tree`, `object-calendar` and `object-gantt` blocks match that filter against their own rows in objectui's in-memory data source (`ValueDataSource.find`). The conversion was written against an objectui version whose `find` excluded every row for a rule array, so it left those filters alone and said so in the TODO. The objectui version this repository pins (`.objectui-sha`, the same pin the previous release shipped) lowers a rule array before it matches, and it selects the rows the stored form selected. That was measured over every operator the conversion maps: 114 filters on eight rows, null and missing values included. The same filters select no row on the objectui build just before that fix. So the decline was already protecting nothing: it only left convertible filters unconverted and reported TODOs that no longer needed to exist.
+
+What an operator sees:
+
+- `os migrate meta --stored` now lists such a page as a pending rewrite. It used to list it as a `skipped` row with a TODO. A preview over a database whose only legacy filters sat on inline-row blocks therefore exits 1 until `os migrate meta --stored --apply` rewrites them.
+- Until then, every stored-row read replays the same rewrite, so the block reads the rule array and shows the same rows.
+- Nothing an author writes is accepted or refused differently. The conversion stays retired from the authoring path, and no schema changes.
+
+The migration entries `element-data-source-and-object-block-filter-rule-array` and `object-grid-default-filters-rule-array`, and the protocol-18 step rationale, no longer say that inline-row filters are left as stored.
+
+ADR-0087 disposition: already registered. This changes the behaviour of the registered D2 conversion `page-component-filter-record-to-rule-array` and edits its two D3 entries. There is nothing new to register.
+
+Clause-②: no

.changeset/20596-plugin-security-provenance-anchors.md

@@ -0,0 +1,11 @@
+---
+'@objectstack/plugin-security': patch
+---
+
+Provenance comments in `plugin-security` were re-anchored
+
+Comment and docblock lines under `src/` that cited tracker numbers which no
+longer resolve on GitHub now cite the record in this repository that decided
+the matter (an ADR where one exists, otherwise the commit in this repository's
+history), and say in their own words what was decided. Comments only: no type,
+schema, export, log or refusal text, or runtime behaviour changes.

content/docs/automation/connectors.mdx

@@ -114,6 +114,8 @@ Materializes a single **`request`** action accepting
 payload per call. Use it when the upstream is "just HTTP" and you don't have a
 spec document.
 
+Do not put a credential in `headers` or `defaultHeaders`: both are stored in metadata and served with it. Declare it as `auth.credentialRef` instead — the resolved `auth` is applied to every request — as the `Authorization` header, or for `api-key` as `headerName` (default `X-API-Key`) or the `paramName` query parameter.
+
 ### `provider: 'openapi'` — one action per operation
 
 Config: **`spec`** (required) and **`baseUrl`** (optional — overrides the

content/docs/automation/flows.mdx

@@ -261,15 +261,19 @@ nothing is assigned or written in its place.
 {
   id: 'notify_slack',
   type: 'http',
-  label: 'Send Slack Notification',
+  label: 'Post Order Event',
   config: {
-    url: 'https://hooks.slack.com/services/...',
+    url: 'https://api.example.com/v1/order-events',
     method: 'POST',
-    body: { text: 'New order: {record.name}' },
+    body: { event: 'order.created', name: '{record.name}' },
   },
 }
 ```
 
+<Callout type="warn" title="Do not put a secret in an http node's url or headers">
+A flow definition, including an `http` node's `url` and `headers`, is served to every member who can read flows. A token, API key or signed webhook url written there is readable by all of them. Route an outbound credential to a declarative connector's `auth.credentialRef` and call it with a `connector_action` node instead — see [Connectors](/docs/automation/connectors#authentication). Only `signingSecret` (and a start node's `secret`) is withheld when a definition is served; `url` and `headers` are served as written.
+</Callout>
+
 **Script:**
 
 The built-in `script` executor never evaluates an arbitrary JavaScript string —

packages/plugins/plugin-security/src/bootstrap-declared-capabilities.test.ts

@@ -60,12 +60,12 @@ function makeQl(declared: any[] = []) {
           return (v === null ? r[k] == null : r[k] === v);
         }),
       );
-      // [#11518] `limit` is HONOURED, and a paged read is ordered by `id`
+      // [commit e1d773eb7] `limit` is HONOURED, and a paged read is ordered by `id`
       // ascending (#4363's pagination tie-breaker). Both are properties of the
       // shipped drivers, measured for the sibling double in
       // `bootstrap-system-capabilities.test.ts`; this one ignored `limit`
       // entirely, which made the whole class of page-cap defect INEXPRESSIBLE
-      // here — including #11518's, whose consequence lands on THIS seeder.
+      // here — including the cap commit e1d773eb7 fixed, whose consequence lands on THIS seeder.
       if (q?.limit === undefined) return matched;
       return [...matched]
         .sort((a, b) => (String(a.id) < String(b.id) ? -1 : String(a.id) > String(b.id) ? 1 : 0))
@@ -434,7 +434,7 @@ describe('unowned-declaration diagnostic (#4967 Part 3)', () => {
 });
 
 /**
- * [#11518] THE CONSEQUENCE THIS SEEDER PAYS FOR A TRUNCATED EXISTENCE PAGE.
+ * [commit e1d773eb7] THE CONSEQUENCE THIS SEEDER PAYS FOR A TRUNCATED EXISTENCE PAGE.
  *
  * This is one of the two callers on `main` that read UNSCOPED (the other is
  * `permission-set-projection`'s overlay pass), and `seed-name-lookup.ts` capped

packages/plugins/plugin-security/src/bootstrap-platform-admin-existing-holder-scan.test.ts

@@ -1,7 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * #16861 — whether this deployment ALREADY has a platform admin, and why the
+ * Commit 1c83ca226 — whether this deployment ALREADY has a platform admin, and why the
  * answer stopped being a function of how many ORG admins it has.
  *
  * ## The defect, re-measured on this branch's base before anything changed
@@ -58,7 +58,7 @@
  * ## Why the row ORDER is permuted rather than a second driver package
  *
  * Same reason as `bootstrap-platform-admin-promotion-selection.test.ts`
- * (#16682): `@objectstack/driver-memory` cannot be declared here without a
+ * (commit 9b9581b11): `@objectstack/driver-memory` cannot be declared here without a
  * `scripts/driver-memory-census.ledger.json` disposition, which is a
  * maintainer ruling. Each case runs the REAL engine over the REAL
  * better-sqlite3 driver behind a facade that permutes a result ONLY when the

packages/plugins/plugin-security/src/bootstrap-platform-admin-promotion-selection.test.ts

@@ -1,7 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * #16682 — WHICH user the `single`-posture bootstrap promotes, and why.
+ * Commit 9b9581b11 — WHICH user the `single`-posture bootstrap promotes, and why.
  *
  * ## The defect, re-measured on this branch's base before anything changed
  *
@@ -199,7 +199,7 @@ async function seedUser(
   email: string,
   createdAt: string,
   withAccount: boolean,
-  // [#16682, maintainer ruling batch #100] Absent means UNVERIFIED, which is
+  // [commit 9b9581b11, maintainer ruling batch #100] Absent means UNVERIFIED, which is
   // what `isEmailVerifiedUserRow` reads an absent column as — so every fixture
   // that does not say otherwise is a row the declared-owner leg must REFUSE.
   emailVerified = false,

packages/plugins/plugin-security/src/bootstrap-platform-admin-seeded-provenance.test.ts

@@ -1,7 +1,7 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 
 /**
- * #8692 — what provenance a REAL `bootstrapPlatformAdmin` run leaves on the
+ * [commit 712e185db] What provenance a REAL `bootstrapPlatformAdmin` run leaves on the
  * platform default permission sets, and what `os meta resync` then does with it.
  *
  * ## Why this file exists at all
@@ -136,7 +136,7 @@ async function rowViaEngine(engine: ObjectQL, name: string): Promise<any> {
 }
 
 /**
- * A row exactly as a PRE-#8692 install holds it — written the way the old
+ * A row exactly as an install before commit 712e185db holds it — written the way the old
  * seeder wrote it, which is to say WITHOUT `managed_by`, so the value comes
  * from the declaration's `defaultValue: 'admin'` by the very mechanism that
  * produced it on every install created before the ruling.

packages/plugins/plugin-security/src/bootstrap-platform-admin-walled-owner.test.ts

@@ -6,7 +6,7 @@
  * History of this surface, because the pins below flip an older family:
  *  - #11184 (framework leg of cloud#1509): walled postures stopped promoting
  *    the first registrant; only the env-declared owner elevated.
- *  - #11343: the walled match additionally required a VERIFIED email.
+ *  - commit c0714eb5d: the walled match additionally required a VERIFIED email.
  *  - #13147: `OS_PLATFORM_OWNER_EMAIL` became a comma-separated list through
  *    the ONE parser in `@objectstack/core`.
  *  - **#11974 (#11663 L4, maintainer acceptance 2026-08-25, Choice 4A/5A):
@@ -24,7 +24,7 @@
  * state, and `single` still PROMOTES (Choice 4A — the over-denial guard:
  * retiring the walled write must not retire the `single` one).
  *
- *  - **#16682: the `single` SELECTION is repaired.** That guard used to be
+ *  - **Commit 9b9581b11: the `single` SELECTION is repaired.** That guard used to be
  *    written as "byte-for-byte", and one case snapshotted the incumbent's
  *    refusal to read `OS_PLATFORM_OWNER_EMAIL` on this branch. The incumbent
  *    was the defect: an unordered, cap-50 `sys_user` read sorted client-side,
@@ -460,7 +460,7 @@ describe('single posture — "first user is owner" is ruled reasonable and UNCHA
   });
 
   /**
-   * ⚠️ RE-AUTHORED by #16682. This case used to assert the opposite —
+   * ⚠️ RE-AUTHORED by commit 9b9581b11. This case used to assert the opposite —
    * "never consults the owner-email variable: a declared owner does NOT
    * redirect the single-org promotion" — and it is worth being explicit about
    * what changed and what did NOT, because the two are easy to confuse.
@@ -479,7 +479,7 @@ describe('single posture — "first user is owner" is ruled reasonable and UNCHA
    * only on the walled branch.
    *
    * The authority for the reversal is a MAINTAINER ruling — 2026-09-08,
-   * decision batch #100, recorded on #16682 (comment 5587754690), which
+   * decision batch #100, applied by commit 9b9581b11, which
    * supersedes the Choice 4A sentence for this one point and states what
    * survives it, verbatim:
    *
@@ -490,7 +490,7 @@ describe('single posture — "first user is owner" is ruled reasonable and UNCHA
    *   > `single` one, and the over-denial invariant (`adminPromoted === true`
    *   > with a grant row minted) stays pinned.
    *
-   * ⛔ An earlier revision of this comment quoted the #16682 TRIAGE seat's
+   * ⛔ An earlier revision of this comment quoted the TRIAGE seat's
    * ruling instead. That quotation was the reviewer's F3 finding: a pin
    * recorded under a maintainer ruling cannot be rewritten under a seat's.
    * The quotation above is the record that resolved it.
@@ -518,7 +518,7 @@ describe('single posture — "first user is owner" is ruled reasonable and UNCHA
     // #11974's over-denial guard, unchanged: the `single` write still happens.
     expect(r.adminPromoted).toBe(true);
     expect(ql.grants()).toHaveLength(1);
-    // #16682: and it goes to the address the operator declared, not to
+    // Commit 9b9581b11: and it goes to the address the operator declared, not to
     // whichever row the driver handed back first.
     expect(ql.grants()[0]?.user_id).toBe('u_second');
     expect(r.basis).toBe('declared-owner');
@@ -550,8 +550,8 @@ describe('single posture — "first user is owner" is ruled reasonable and UNCHA
 });
 
 // ───────────────────────────────────────────────────────────────────────────
-// [#11974, amended by #16682] The bootstrap-replay trigger set. #11974
-// narrowed it to `single` + create/insert: the #11343 update arm (email /
+// [#11974, amended by commit 9b9581b11] The bootstrap-replay trigger set. #11974
+// narrowed it to `single` + create/insert: commit c0714eb5d's update arm (email /
 // email_verified) fired for the walled verify-then-elevate sequence, which no
 // longer exists, and its own rationale was that "`single` promotes the oldest
 // authenticable human and never reads `email`/`email_verified`".