Merge remote-tracking branch 'origin/main' into claude/issue-10427-scansource-nested-template

Author: claude

.changeset/external-validate-read-capability.md

@@ -0,0 +1,11 @@
+---
+"@objectstack/rest": patch
+---
+
+**Behaviour change (tightening) — `POST /datasources/:name/external/validate` now requires `manage_platform_settings`** (#10255, completing the #9901 federation-family gate). This was the one route of the external-datasource federation family still admitting **any authenticated caller**; it now requires the same capability as the family's two read routes. Maintainer ruling, 2026-08-20 (verbatim: 「同意你的意见。」, accepting option A on #10255).
+
+**This is published SDK surface.** `datasources.external.validate` on `ObjectStackClient` and the CLI's `os datasource validate` reach exactly this route. An existing integration that presents a valid credential — a better-auth session or a `sys_api_key` — and does not hold `manage_platform_settings` was served before and is **refused now**: `403` with the standard catalog code `PERMISSION_DENIED` (ADR-0112), the message naming the missing capability so the caller knows which grant to request. The anonymous floor is unchanged: no identity is still `401 UNAUTHENTICATED`.
+
+**Why the read capability.** `validateAll` drives the same live remote-schema introspection the family's gated read routes expose (`introspect` per datasource), and its report — schema diffs naming remote columns and types, driver error strings for unreachable remotes — is a read of the same federation surface. An unentitled caller refused at `GET /:name/external/tables` could previously still trigger live remote introspection through this route and read what it found. One family, one door-type: reads on `manage_platform_settings`, writes on `manage_metadata`.
+
+**Migration.** Grant the calling credential's permission set `manage_platform_settings` — the same grant the family's read routes have required since #10254, so an integration already migrated for those is covered. The platform's `admin_full_access` set carries it; a purpose-built operator set is the case to check.

.changeset/meta-org-scope-folded-not-raw.md

@@ -0,0 +1,14 @@
+---
+"@objectstack/rest": patch
+"@objectstack/metadata-core": patch
+---
+
+**Fix:** the REST `/meta` doors now decide **organization scope on the folded type**, never on the raw URL spelling (#10340).
+
+Storage folds `/meta/:type` through `META_URL_TO_SINGULAR` — the complete spelling map — while the doors' scope predicate (`declaresOrgOverride`) tolerates only the manifest-collection spellings. For the two registry-derived spellings, `translations` and `email_templates`, the doors therefore read and wrote **env-wide** where the singular twin was org-scoped: an org-active author's `PUT /meta/translations/:name` landed an env-wide row their own org-scoped read then shadowed (persisted, receipted as live, served by nothing), and `GET` under one spelling answered a different partition than the other — one item, two namespaces, addressed by spelling (#4432 / #7894's defect one layer down).
+
+- All nine `/meta` org-scope call sites (list, single read, layers view, compound read, save, compound save, delete, publish, rollback) fold the segment through `canonicalMetaUrlType` **before** calling `organizationIdForMetaRead` / `organizationIdForMetaWrite`, exactly as `metadata-url-spelling.ts` mandates: folding happens at the boundary and only there.
+- The `GET /meta/:type/:name/published` code-store fallback folds too — the smaller second site of the same class: it reads a registry keyed by canonical types, so a recognised plural of a code-published item answered 404 while the singular answered 200.
+- **Deliberately unchanged:** `GET /meta/_drafts` still applies no fold (it filters by the draft row's *stored* type, which is canonical because the protocol folds on save), the request `type` handed to the protocol stays the raw segment (the protocol owns its own fold), and `declaresOrgOverride` does **not** absorb the URL map — a predicate below the boundary consuming the URL spelling contract is the repair #7894 forbids. `@objectstack/metadata-core` changes are documentation and pins only: the predicate's header no longer claims parity with the protocol's normalization (measured false), and new tests pin both the composed fold→predicate contract and the predicate's deliberate limit.
+
+No stored rows move: rows previously minted env-wide through a plural spelling stay env-wide and keep serving org-less callers (and org-active callers until an org overlay exists), which is the same layering the singular spelling always had.

.github/workflows/lint.yml

@@ -172,6 +172,32 @@ jobs:
       - name: scripts/ entry guards go through one predicate
         run: pnpm check:entry-guard
 
+      # Every `scripts/**` TypeScript parse goes through ONE module (#10133 /
+      # #10573), and this is the half that keeps it that way (#10574).
+      # NONE of the three parser entry points throws on a source it cannot
+      # read: `ts.createSourceFile` returns a tree built by error recovery with
+      # the errors parked on `parseDiagnostics`; `ts.createProgram` parks them
+      # behind a second call, `getSyntacticDiagnostics()`; `ts.transpileModule`
+      # reports nothing at all without `reportDiagnostics: true` and still
+      # hands back an `outputText`. A gate then walks the wreckage, finds none
+      # of the shapes it is looking for, and scores the file CLEAN — so the
+      # SYMPTOM OF A MISSING REFUSAL IS A GREEN LINE, and an unguarded gate is
+      # indistinguishable from a guarded one by reading CI. That is not a
+      # theory: one gate here forced `ScriptKind.TSX` on 2504 test files, read
+      # 32 of them as wreckage, and printed `OK` while six pinned engine
+      # doubles went uncounted.
+      # The #10573 sweep converted 32 call sites across 15 gates; it could not
+      # stop the sixteenth being typed, and within the hour a new gate landed
+      # with two raw calls in it — caught by this step, which is the whole
+      # argument for having it. Same shape as `check:entry-guard` above.
+      # Also prints the parses OUTSIDE `scripts/**` (#10575) that it does not
+      # govern, so its green line is read as a claim about `scripts/` and not
+      # about the repository.
+      # Scans ~121 scripts/ files plus a read-only census of the rest, no
+      # spawns; ~0.6s.
+      - name: scripts/ TypeScript parses go through one module
+        run: pnpm check:parse-guard
+
       # Stack-collection enumerations vs the schema (#6242). `stack.zod.ts`
       # decides which collections a stack may declare; eight other enumerations
       # of that same set are hand-maintained (the map-format list, the
@@ -441,14 +467,25 @@ jobs:
       #
       # Nothing in CI *uses* the lock (GitHub runners are one job per machine),
       # so this step exists to keep the mechanism honest rather than to serialise
-      # anything: 29 cases over the budget clamp, ticket liveness (dead pid,
+      # anything: 48 cases over the budget clamp, ticket liveness (dead pid,
       # REUSED pid, over-age), fd hygiene, exit-code passthrough, and real
       # multi-process contention — queue timeout, legacy free-hand coexistence in
       # both directions, and three staggered waiters acquiring in arrival order.
+      #
+      # Since #10289 it also guards the BASH 3.2 FLOOR and the bounded-refusal
+      # rule, which is why the count moved: `/usr/bin/env bash` is 3.2.57 on
+      # macOS, and a bash 4+/5+ construct there does not fail loudly — it makes
+      # the acquisition deadline unreachable and turns the wait into an unbounded
+      # spin that prints no VERDICT at all. So the suite now scans the
+      # acquisition path for 4+/5+ constructs, runs a real acquisition with
+      # EPOCHSECONDS/EPOCHREALTIME unset and mapfile disabled, and asserts that
+      # an unusable host (no `flock`) and a stopped clock each REFUSE with a
+      # verdict and a non-zero exit rather than waiting forever.
+      #
       # It runs entirely on a private lock under a temp dir; it never touches
       # /tmp/os-heavy-verify.lock, so a runner and an agent container behave the
       # same. Unconditional and un-`if:`-ed, like the self-tests above — an
-      # exemption is what a self-test must not have. No network, ~15 s.
+      # exemption is what a self-test must not have. No network, ~40 s.
       - name: Verify-lock entry-point self-test
         run: bash scripts/pm/os-verify-lock.sh --self-test
 
@@ -1329,10 +1366,42 @@ jobs:
       - name: Shard partitioner self-test
         run: node scripts/partition-test-shards.mjs --self-test
 
+      # Hand-written `.d.mts` mirrors (#10549). `scripts/js-comment-mask.mjs`
+      # and `scripts/check-regen-pending.mjs` are untyped `.mjs` that each ship
+      # a hand-written declaration beside them, and both files say "keep this in
+      # step with the module by hand". Nothing checked that they were. A
+      # `.d.mts` has no runtime existence, so nothing executes it and nothing
+      # notices: TypeScript consumers see ONLY the declaration, so a drift makes
+      # every consumer type-check GREEN against a signature the module does not
+      # implement, first symptom a runtime failure downstream. That this file
+      # silently decides typecheck outcomes is measured rather than theoretical
+      # — PR #10513 went red with `TS2578` on two lanes purely because the
+      # mirror existed on the merged tree and not on the branch's, and that
+      # episode cost PR #10450 two merge-queue evictions. This gate asserts
+      # name, kind and required arity per declared export, and it DISCOVERS its
+      # corpus (every `scripts/**/*.d.mts`), so a third mirror added tomorrow is
+      # covered by existing rather than by anyone remembering to enrol it.
+      # Invoked as `node` rather than through a `pnpm check:*` alias for the
+      # same reason as the two steps above: that alias belongs in root
+      # package.json, declared territory of the @changesets/cli v3 lane (#9465)
+      # while it runs. dispatch-gates.mjs derives gate families from either
+      # spelling. Imports two small modules; milliseconds.
+      - name: Hand-written declaration mirrors
+        run: |
+          node scripts/check-declaration-mirrors.mjs --self-test
+          node scripts/check-declaration-mirrors.mjs
+
       # The inventory of `packages/**` tests coupled to `examples/**` (#8754).
-      # Sibling of the gate above, on the axis it cannot see: that one detects
-      # tests whose FILESYSTEM READS escape their package, this one detects
-      # tests that IMPORT an example app live. `packages/cli` dynamically
+      # Sibling of the cross-package gate above, on the axis that gate does not
+      # own. ⚠️ The line that used to stand here — "that one detects tests whose
+      # FILESYSTEM READS escape their package, this one detects tests that
+      # IMPORT an example app live" — stopped being true in #10452, which taught
+      # the cross-package gate to read escaping import SPECIFIERS as well as
+      # path-shaped reads. Both now see the same couplings and do different
+      # things with them: the cross-package gate turns one into a declared input
+      # radius plus the turbo glob that hashes it, while this gate keeps the
+      # `examples/**` INVENTORY and grades what CI can see of each entry.
+      # `packages/cli` dynamically
       # imports `examples/app-showcase/src/ui/views/contact.view` and asserts
       # `toEqual` over a hardcoded `_sections` key list; `packages/lint`
       # statically imports the same app's `Contact`/`ContactViews`. Neither

examples/app-showcase/test/fixtures/late-console-teardown/leaked-console.test.ts

@@ -0,0 +1,34 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * FIXTURE — not part of this app's suite.
+ *
+ * `vitest.config.ts` excludes `test/fixtures/**`, so a normal
+ * `pnpm --filter @objectstack/example-showcase test` never collects this file.
+ * It is run only by `test/vitest-console-teardown-race.test.ts`, which spawns
+ * vitest against THIS directory as its root (at which point the exclude no
+ * longer matches, because the path is relative to the root being used).
+ *
+ * WHAT IT REPRODUCES. The file passes its one assertion and then leaves a
+ * `console.log` rescheduling itself past the end of the file — the shape #9371
+ * had (a messaging dispatcher that outlived its test file) and the shape any
+ * leaked timer, poll or fire-and-forget write has. In a worker whose console is
+ * intercepted, each of those logs is an `onUserConsoleLog` RPC whose promise
+ * vitest discards, so one landing inside the teardown window is rejected with
+ * `EnvironmentTeardownError` and nobody holds it — an unhandled rejection, and
+ * vitest fails a run on an unhandled error even with zero failed assertions.
+ *
+ * ⛔ Do not "fix" the leak here. The leak IS the instrument.
+ */
+
+import { it, expect } from 'vitest';
+
+it('passes, and leaves a console.log rescheduling past the end of the file', () => {
+  const tick = (): void => {
+    console.log('late log from a callback that outlived the test file');
+    setImmediate(tick).unref?.();
+  };
+  setImmediate(tick).unref?.();
+
+  expect(1).toBe(1);
+});

examples/app-showcase/test/fixtures/late-console-teardown/vitest.unguarded.config.ts

@@ -0,0 +1,21 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The ABLATION leg of `test/vitest-console-teardown-race.test.ts`.
+ *
+ * `disableConsoleIntercept: false` is vitest's own default, spelled out here
+ * rather than left implicit: this config exists to state that the ONE variable
+ * between the two legs is the guard, and to keep the leg honest if the default
+ * ever changes upstream. It deliberately does not extend the app's real config
+ * — the fixture imports nothing from the workspace, so the app's aliases and
+ * excludes cannot affect the measurement, and re-exporting a config that reads
+ * `__dirname` from a different directory would silently repoint them.
+ */
+
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    disableConsoleIntercept: false,
+  },
+});