Merge remote-tracking branch 'origin/main' into claude/issue-21308-tsx-esm-api-register

Author: claude

.changeset/21274-driver-fault-boundary-redaction.md

@@ -0,0 +1,14 @@
+---
+'@objectstack/objectql': patch
+---
+
+fix(objectql): a driver error that leaves the engine no longer carries the failing statement or the caller's values
+
+Clause-②: no
+
+The engine has cut the bound statement out of its own log line for a failed driver call for a long time, but it rethrew the driver's raw error. Any in-process code that logged what it caught, such as an auth library's error logger, printed the statement and the row's values. The same cut now runs where the error leaves the engine, so no consumer needs a patch of its own.
+
+- **Where.** Every engine operation that reaches a driver: `find`, `findOne`, `count`, `aggregate`, `insert` (batch included), `update` and `delete` (by id and by predicate), `execute`, `transaction`, `resolveSecretField` and `resolveInternalField`.
+- **What is cut.** The statement and the caller's values, from the error's `message` and `stack`, from the properties drivers attach (mysql2's `sql` and `sqlMessage`; node-postgres' `detail`, `where` and `internalQuery`), and down the `cause` chain. A `DuplicateRecordError` keeps its own fields and carries a cut `cause`.
+- **What stays.** The error's class (`instanceof` still holds), `name`, `code`, `errno`, `sqlState`, Postgres' identifier fields (`constraint`, `table`, `column`, …) and the database's own diagnostic. The message now reads as the statement's kind, a `[statement and bound values redacted]` marker and the diagnostic. A Postgres key-shaped `detail` keeps its column list. Every REST answer keeps its status, code and `field`.
+- **What changes for a caller.** Code that read the statement or a value out of a driver error's message or properties now gets the marker instead. Branch on the class, `code` or `errno` instead. The driver error on a `DuplicateRecordError`'s `cause` is an equivalent copy, no longer the object the driver threw. An import's row report for a value-bearing database error no longer repeats the rejected value.

docs/adr/0128-producer-discriminated-aad-for-cryptocontext.md

@@ -101,6 +101,7 @@ Any **one** of these turns the deferral over; none requires re-opening the direc
 - **The hazard stops being hypothetical**: any intersection appears between the settings-namespace set and the set of object names carrying a `Field.secret()` field — in shipped platform metadata, in an example app, or in a reported customer deployment. §1.4's "no intersection" is the whole of the deferral's evidence, and it is a fact with a shelf life.
 - **A fourth producer of `CryptoContext` is added**, or an existing one's vocabulary is widened to accept names it does not control. A fourth vocabulary in a flat space is the same defect with more surface, and the discriminant is far cheaper to introduce *with* the new producer than after it.
 - **`ICryptoProvider` is opened for another breaking change.** The migration is the expensive half; the breaking-export half should be paid once. A queued breaking change to this interface should pull D1 in with it.
+  > **Note (2026-10-02).** This trigger was met by the keyed-digest break ([#21263](https://github.com/objectstack-ai/objectstack/issues/21263), PR [#21292](https://github.com/objectstack-ai/objectstack/pull/21292): a required `keyedDigest` member on `ICryptoProvider`), which landed without D1 by the maintainer's ruling A (comment [5945612493](https://github.com/objectstack-ai/objectstack/issues/21263#issuecomment-5945612493)) because the director's census (comment [5945420994](https://github.com/objectstack-ai/objectstack/issues/21263#issuecomment-5945420994)) measured zero out-of-repo `ICryptoProvider` implementations in the organisation's repositories, so pulling D1 in would have saved a second breaking-export change for no measured implementer population; D1 is scheduled on its own as [#21326](https://github.com/objectstack-ai/objectstack/issues/21326).
 - **A compliance or customer requirement asks the platform to state its at-rest ciphertext binding.** The honest present-tense answer is §1's, and an organisation that needs a stronger one funds the work.
 
 ## 5. Alternatives considered

packages/objectql/src/driver-fault-boundary-redaction.test.ts

@@ -23,7 +23,7 @@
 // the tolerant-fallback direction, not the loud one.
 
 import { describe, it, expect } from 'vitest';
-import { isUniqueViolationError, uniqueViolationColumn } from '@objectstack/types';
+import { isUniqueViolationError, mapDataError, uniqueViolationColumn } from '@objectstack/types';
 import { ObjectQL } from './engine.js';
 import {
   VALUE_BEARING_TEMPLATES,
@@ -853,14 +853,23 @@ describe('#8682 half B — the write-path loggers', () => {
     }
   });
 
-  it('the RETHROWN error is untouched — the caller`s 400 must not move', async () => {
-    // `mapDataError` reads the driver's raw message to extract the failing
-    // field and answer `400 INVALID_FIELD`. Redacting what we THROW would break
-    // that answer; the redaction is one argument at one call site.
+  it('the caller`s 400 does not move — and since #21274 the rethrown error carries no caller value either', async () => {
+    // `mapDataError` reads the thrown message to extract the failing field and
+    // answer `400 INVALID_FIELD`. This pin used to hold that by asserting the
+    // thrown error was the driver's RAW one, statement and values included —
+    // which is the exposure #21274 closed for every in-process logger. What it
+    // protects is the ANSWER, so the answer is what it asserts now: the cut at
+    // the engine boundary keeps the diagnostic the field is read from.
     const { thrown } = await insertAgainstADriftedColumn();
 
-    expect(String(thrown?.message)).toContain('insert into');
-    expect(String(thrown?.message)).toContain(SECRET);
+    expect(String(thrown?.message)).not.toContain(SECRET);
+    expect(String(thrown?.message)).not.toContain(DESCRIPTION);
+    expect(String(thrown?.stack)).not.toContain(SECRET);
+    expect(String(thrown?.message)).toContain('has no column named secret_note');
+    expect(thrown?.code).toBe('SQLITE_ERROR');
+    const answer = mapDataError(thrown, 'crm_account');
+    expect(answer.status).toBe(400);
+    expect(answer.body).toMatchObject({ code: 'INVALID_FIELD', field: 'secret_note' });
   });
 
   /**
@@ -905,10 +914,13 @@ describe('#8682 half B — the write-path loggers', () => {
     }
   });
 
-  it('MySQL duplicate entry — the driver error reaches the caller UNTOUCHED, on `cause`', async () => {
-    // Same boundary as above: the log narrows, and what the driver said is not
-    // rewritten anywhere. `isUniqueViolationError` and `uniqueViolationColumn`
-    // read this text downstream and must keep seeing it.
+  it('MySQL duplicate entry — the driver error reaches the caller on `cause`, cut, with every verdict kept', async () => {
+    // `isUniqueViolationError` and `uniqueViolationColumn` read this error
+    // downstream and must keep answering as they did. This pin used to hold
+    // that by asserting the `cause` was the driver's error UNTOUCHED, statement
+    // and value included; #21274 cuts both where the error leaves the engine,
+    // so what is asserted now is what those readers actually read — the code,
+    // the diagnostic and the index name — and that the value is gone.
     //
     // ⚠️ [#14095] WHERE the caller finds it moved by one step, and only for a
     // recognised unique violation: the insert door now answers the
@@ -924,9 +936,10 @@ describe('#8682 half B — the write-path loggers', () => {
     expect((thrown as any)?.status).toBe(409);
 
     const cause = (thrown as any)?.cause;
-    expect(String(cause?.message)).toContain('insert into');
-    expect(String(cause?.message)).toContain(SECRET);
+    expect(String(cause?.message)).not.toContain(SECRET);
+    expect(String(cause?.message)).not.toContain(DESCRIPTION);
     expect(String(cause?.message)).toContain('Duplicate entry');
+    expect(String(cause?.message)).toContain("for key 'crm_account.secret_note'");
     expect(cause?.code).toBe('ER_DUP_ENTRY');
 
     // The verdicts the downstream consumers ask of it, asked of the envelope.