fix(core,plugin-auth,plugin-security): every OS_PLATFORM_OWNER_EMAIL reader asks the ONE list-aware parser (#13319)

* fix(core,plugin-auth,plugin-security): every OS_PLATFORM_OWNER_EMAIL reader asks the ONE list-aware parser

The variable accepts one address or a comma-separated list (#11663 Choice 2B),
but only the authorization derivation understood the list grammar. The other
six readers held the operator's whole raw value as ONE address, so a configured
list silently matched nobody: no promotion, no operator stamp, no Layer 0 wall
bypass, and a boot diagnostic that printed the raw list where an address
belongs. All fail-closed, all silent.

All six now ask the shared parser in @objectstack/core. Adds
isConfiguredPlatformAdminEmail (the membership half of
matchesConfiguredPlatformAdmin, for readers holding a bare address) and
PlatformAdminEmailConfig.declaredSpellings (the as-typed entries, so nothing
splits the raw value a second time). A census pin enumerates the two remaining
raw readers -- both grammar-independent truthiness checks -- and fails on a
seventh.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012WkdHQwHr2KQmaX7P1BHzi

* fix(plugin-auth): seed the reader-census pin from __dirname, not import.meta

This package is CJS-typed, so under module: NodeNext `import.meta` is TS1470
however well it runs under vitest. The package's own typecheck excludes
**/*.test.ts and never saw it, but the test layer IS in front of tsc through
the @objectstack/plugin-auth TEST_DEBT entry in check-type-check-coverage.mjs
-- a shrink-only ratchet. The import.meta spelling pushed it 94 -> 95 and
turned Type Check / debt ledger red.

__dirname type-checks under the package's own config, is defined at runtime by
vitest's transform, and is a spelling check:cross-package-test-inputs resolves
statically -- which this file needs, since its walk of the sibling
plugin-security tree is an escaping read that gate exists to see. Two sibling
files in this package and one in plugin-security already record the same trap
and the same remedy.

No assertion changes: this is only how the test locates its own directory.
Re-measured: 94 raw tsc errors, equal to the frozen ledger entry.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012WkdHQwHr2KQmaX7P1BHzi

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: Elon Musk

.changeset/platform-owner-email-list-readers.md

@@ -0,0 +1,53 @@
+---
+"@objectstack/core": patch
+"@objectstack/plugin-auth": patch
+"@objectstack/plugin-security": patch
+---
+
+fix(core,plugin-auth,plugin-security): every `OS_PLATFORM_OWNER_EMAIL` reader asks the ONE list-aware parser (#13147)
+
+`OS_PLATFORM_OWNER_EMAIL` accepts one address **or a comma-separated list** of
+them (#11663 Choice 2B). The list parse landed in a single home
+(`@objectstack/core`'s `platform-admin.ts`) and the authorization derivation
+consumed it — but every other reader kept calling `resolvePlatformOwnerEmail()`,
+which returns the operator's value trimmed and otherwise verbatim, and kept
+treating that whole string as ONE address.
+
+An operator who configured a list therefore entered a self-contradictory state:
+authorization recognised them as a platform administrator, while four separate
+capabilities silently did nothing. Every direction failed **closed** — no
+privilege escalation existed at any point — but a declared capability vanished
+with no error anywhere:
+
+- `bootstrap-platform-admin` promoted **nobody**, logging "will be promoted when
+  that account registers" on every boot forever;
+- the walled operator stamp (`plugin-auth`) stamped **no** list member verified,
+  so the account it should have provisioned was then refused elevation as
+  `walled_owner_not_verified`;
+- `isVerifiedPlatformOwnerSession` / `platform-owner-wall-bypass` let **nobody**
+  across the Layer 0 organization wall — the largest of the affected surfaces;
+- the walled boot diagnostic printed the raw list in the slot where an operator
+  reads one address, and its dev-seed silence clause never matched.
+
+All six readers now ask the same parser. `@objectstack/core` gains
+`isConfiguredPlatformAdminEmail(email, config)` — the membership half of
+`matchesConfiguredPlatformAdmin`, spelled once and shared, for the readers that
+hold a bare address rather than a `sys_user` row (the elevation gate keeps its
+two halves apart so `walled_owner_not_registered` and `walled_owner_not_verified`
+stay distinct answers; the stamp is handed an email before any row exists; the
+wall takes a fast negative before spending a row read). `PlatformAdminEmailConfig`
+gains `declaredSpellings`, the entries as the operator typed them, so the by-email
+`sys_user` lookup and the boot diagnostic get the as-typed form **from the one
+parse** instead of splitting the raw value a second time.
+
+Behaviour for a single declared address is unchanged, including the
+case-insensitive match and the verbatim-spelling store lookup. A **refused**
+list (Choice 2B fails the whole variable closed on one unparseable entry) now
+reaches these readers as "zero administrators", which is the same answer they
+already gave for an unset variable — never a silently narrower set.
+
+Two readers deliberately keep reading the raw value: the walled-boot refusal and
+the verification-path probe guard in `auth-plugin.ts` both use it as a pure
+truthiness test ("did the operator declare anything at all?"), which is
+grammar-independent. A census pin now enumerates the raw readers across both
+plugin packages and fails on a seventh.

packages/core/src/security/index.ts

@@ -175,6 +175,7 @@ export {
   resolvePlatformAdminEmails,
   resetPlatformAdminEmailMemo,
   matchesConfiguredPlatformAdmin,
+  isConfiguredPlatformAdminEmail,
   reportLegacyPlatformAdminGrant,
   resetLegacyPlatformAdminGrantReport,
   setPlatformAdminConfigSink,

packages/core/src/security/platform-admin.test.ts

@@ -14,6 +14,7 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 
 import {
+  isConfiguredPlatformAdminEmail,
   matchesConfiguredPlatformAdmin,
   normalizePlatformAdminEmail,
   parsePlatformAdminEmails,
@@ -101,6 +102,31 @@ describe('[Choice 2B] parsePlatformAdminEmails', () => {
     }
   });
 
+  it('[#13147] declaredSpellings: the as-typed form of every entry, index-aligned with emails', () => {
+    // The reason the field exists: two readers need the operator's own spelling
+    // (the by-email `sys_user` lookup, whose driver `where` is an exact match,
+    // and the boot diagnostic that quotes the addresses back) and NEITHER may
+    // split `raw` a second time to get it.
+    const parsed = parsePlatformAdminEmails(' Ops@Corp.example , second@corp.example ,OPS@corp.EXAMPLE ');
+    expect(parsed.emails).toEqual(['ops@corp.example', 'second@corp.example']);
+    expect(parsed.declaredSpellings).toEqual(['Ops@Corp.example', 'second@corp.example']);
+    // Trimmed but NOT lowercased — byte-for-byte what `resolvePlatformOwnerEmail()`
+    // used to hand a single-value reader, which is what makes this a
+    // behaviour-preserving substitution at those call sites.
+    expect(parsed.declaredSpellings[0]).toBe('Ops@Corp.example');
+    // The duplicate collapsed on the NORMALIZED form, and the spelling that
+    // survives is the one that won the position — so the arrays cannot drift.
+    expect(parsed.declaredSpellings).toHaveLength(parsed.emails.length);
+  });
+
+  it('[#13147] declaredSpellings is empty for every zero-administrator outcome', () => {
+    for (const raw of [undefined, '', '   ', 'good@corp.example,nonsense']) {
+      const parsed = parsePlatformAdminEmails(raw);
+      expect(parsed.emails, `raw=${JSON.stringify(raw)}`).toEqual([]);
+      expect(parsed.declaredSpellings, `raw=${JSON.stringify(raw)}`).toEqual([]);
+    }
+  });
+
   it('a refused variable is reported as refused, not as unset', () => {
     // Both answer "zero config-derived administrators"; only one of them is an
     // operator mistake, and a caller must be able to tell them apart.
@@ -236,3 +262,50 @@ describe('[#11663 P5] reportLegacyPlatformAdminGrant', () => {
     expect(sink.warns[0]).toContain(`${ENV}=<the administrator's verified email address>`);
   });
 });
+
+// ---------------------------------------------------------------------------
+describe('[#13147] isConfiguredPlatformAdminEmail — the ONE membership expression', () => {
+  const LIST = parsePlatformAdminEmails('ops@corp.example, Second@Corp.Example');
+
+  it('answers for EVERY member of a comma-separated list, not just the first', () => {
+    // The defect this predicate closes: the five single-value readers held the
+    // operator's whole raw value as ONE address, so `'a@b.c,d@e.f'` could never
+    // equal any single candidate and matched NOBODY.
+    expect(isConfiguredPlatformAdminEmail('ops@corp.example', LIST)).toBe(true);
+    expect(isConfiguredPlatformAdminEmail('second@corp.example', LIST)).toBe(true);
+    expect(isConfiguredPlatformAdminEmail('stranger@corp.example', LIST)).toBe(false);
+    // ⛔ And the raw list is not itself an address.
+    expect(isConfiguredPlatformAdminEmail('ops@corp.example, Second@Corp.Example', LIST)).toBe(false);
+  });
+
+  it('applies the ONE normalization to the candidate — trim AND lowercase', () => {
+    expect(isConfiguredPlatformAdminEmail('  OPS@Corp.EXAMPLE  ', LIST)).toBe(true);
+    // The trim is the half a hand-rolled `.toLowerCase()` compare drops, which
+    // is exactly how a seventh dialect would be born.
+    expect(isConfiguredPlatformAdminEmail(' second@corp.example', LIST)).toBe(true);
+  });
+
+  it('fail-closed on every other shape', () => {
+    for (const empty of [
+      parsePlatformAdminEmails(undefined),
+      parsePlatformAdminEmails('   '),
+      parsePlatformAdminEmails('ops@corp.example,nonsense'), // REFUSED
+    ]) {
+      expect(isConfiguredPlatformAdminEmail('ops@corp.example', empty)).toBe(false);
+    }
+    for (const candidate of [undefined, null, '', '   ', 42, {}]) {
+      expect(isConfiguredPlatformAdminEmail(candidate, LIST), String(candidate)).toBe(false);
+    }
+  });
+
+  it('is the membership half of matchesConfiguredPlatformAdmin — one expression, not two', () => {
+    // Same list, same address: the row predicate adds the verified check and
+    // nothing else. If these two ever disagree about membership, the config
+    // anchor and the plugin readers have split again.
+    expect(matchesConfiguredPlatformAdmin({ email: 'second@corp.example', email_verified: true }, LIST)).toBe(true);
+    expect(isConfiguredPlatformAdminEmail('second@corp.example', LIST)).toBe(true);
+    // Verified is the ONLY difference.
+    expect(matchesConfiguredPlatformAdmin({ email: 'second@corp.example' }, LIST)).toBe(false);
+    expect(isConfiguredPlatformAdminEmail('second@corp.example', LIST)).toBe(true);
+  });
+});

packages/core/src/security/platform-admin.ts

@@ -107,6 +107,20 @@ export interface PlatformAdminEmailConfig {
    * they are told apart by {@link refusal} rather than by a second empty value.
    */
   readonly emails: readonly string[];
+  /**
+   * The SAME administrators as {@link emails} and index-aligned with it, each
+   * spelled as the operator typed it — trimmed only, never lowercased (exactly
+   * what `resolvePlatformOwnerEmail()` used to hand a single-value reader).
+   *
+   * It exists so that no consumer ever has a reason to split {@link raw} a
+   * second time. Two readers need the as-typed form and neither may re-parse
+   * to get it: the elevation gate's by-email `sys_user` lookup queries the
+   * verbatim spelling alongside the normalized one (an imported/legacy row may
+   * not be stored lowercased, and a driver `where` is an exact match), and the
+   * walled boot diagnostic quotes the addresses back to the operator, who
+   * should see what they wrote.
+   */
+  readonly declaredSpellings: readonly string[];
   /** What the operator actually typed, when the variable was set to anything. */
   readonly raw?: string;
   /**
@@ -117,7 +131,10 @@ export interface PlatformAdminEmailConfig {
   readonly refusal?: string;
 }
 
-const EMPTY_CONFIG: PlatformAdminEmailConfig = Object.freeze({ emails: Object.freeze([]) as readonly string[] });
+const EMPTY_CONFIG: PlatformAdminEmailConfig = Object.freeze({
+  emails: Object.freeze([]) as readonly string[],
+  declaredSpellings: Object.freeze([]) as readonly string[],
+});
 
 /**
  * Parse one raw `OS_PLATFORM_OWNER_EMAIL` value into the administrator list.
@@ -132,6 +149,7 @@ export function parsePlatformAdminEmails(raw: string | undefined): PlatformAdmin
   if (text.trim() === '') return EMPTY_CONFIG;
 
   const emails: string[] = [];
+  const declaredSpellings: string[] = [];
   for (const piece of text.split(PLATFORM_ADMIN_EMAIL_SEPARATOR)) {
     const entry = normalizePlatformAdminEmail(piece);
     // Blanks are DROPPED, not refused: a trailing separator or a line wrapped
@@ -141,6 +159,7 @@ export function parsePlatformAdminEmails(raw: string | undefined): PlatformAdmin
     if (!isParseableAddress(entry)) {
       return {
         emails: Object.freeze([]) as readonly string[],
+        declaredSpellings: Object.freeze([]) as readonly string[],
         raw: text,
         refusal:
           `${PLATFORM_OWNER_EMAIL_ENV} entry ${JSON.stringify(piece)} is not an email address, so the `
@@ -151,11 +170,19 @@ export function parsePlatformAdminEmails(raw: string | undefined): PlatformAdmin
           + 'comma-separated list of them.',
       };
     }
-    // Duplicates collapse; first declaration wins the position.
-    if (!emails.includes(entry)) emails.push(entry);
+    // Duplicates collapse; first declaration wins the position — and the
+    // spelling that wins it is the one kept, so the two arrays stay aligned.
+    if (!emails.includes(entry)) {
+      emails.push(entry);
+      declaredSpellings.push(piece.trim());
+    }
   }
 
-  return { emails: Object.freeze(emails) as readonly string[], raw: text };
+  return {
+    emails: Object.freeze(emails) as readonly string[],
+    declaredSpellings: Object.freeze(declaredSpellings) as readonly string[],
+    raw: text,
+  };
 }
 
 /**
@@ -246,11 +273,49 @@ export function matchesConfiguredPlatformAdmin(
 ): boolean {
   if (config.emails.length === 0) return false;
   if (!row || typeof row !== 'object') return false;
-  const email = normalizePlatformAdminEmail((row as { email?: unknown }).email);
-  if (email === '' || !config.emails.includes(email)) return false;
+  if (!isConfiguredPlatformAdminEmail((row as { email?: unknown }).email, config)) return false;
   return isEmailVerifiedUserRow(row);
 }
 
+/**
+ * [#13147] Is this bare ADDRESS one of the declared administrators?
+ *
+ * The membership half of {@link matchesConfiguredPlatformAdmin}, spelled once
+ * and exported, because the row-and-verified predicate above is not the shape
+ * every reader of `OS_PLATFORM_OWNER_EMAIL` needs:
+ *
+ *  - the elevation gate (`plugin-security/bootstrap-platform-admin.ts`) must
+ *    keep the two halves SEPARATE — its `walled_owner_not_registered` and
+ *    `walled_owner_not_verified` diagnostics are different answers;
+ *  - the creation-time operator stamp (`plugin-auth`) is handed an email
+ *    STRING by better-auth, before any row exists to read;
+ *  - the Layer 0 wall bypass takes a fast negative on the session's
+ *    server-resolved email before it spends a `sys_user` read.
+ *
+ * ⛔ Those readers must NOT hand-roll `config.emails.includes(x.toLowerCase())`
+ * instead. That expression is where a seventh dialect gets born: it silently
+ * drops the trim, and a stray space in one list entry then makes an
+ * administrator vanish with nothing to notice. One membership expression, one
+ * normalization ({@link normalizePlatformAdminEmail}), one place to fix.
+ *
+ * Fail-closed like everything else here: an empty or refused config answers
+ * `false` without looking at the candidate, and a blank/non-string candidate
+ * answers `false` against any config.
+ *
+ * ⚠️ This is a match against CONFIGURATION only — it says nothing about whether
+ * the address is verified, or whether the caller actually holds it. Standing
+ * still requires {@link matchesConfiguredPlatformAdmin} over the caller's own
+ * stored row; see this module's header for why `grants.email` is never it.
+ */
+export function isConfiguredPlatformAdminEmail(
+  email: unknown,
+  config: PlatformAdminEmailConfig,
+): boolean {
+  if (config.emails.length === 0) return false;
+  const candidate = normalizePlatformAdminEmail(email);
+  return candidate !== '' && config.emails.includes(candidate);
+}
+
 /**
  * [#11663 P5] The migration pointer for the LEGACY anchor.
  *

packages/plugins/plugin-auth/src/auth-plugin-walled-owner-verification-path.test.ts

@@ -136,6 +136,54 @@ describe('#11640 — the dead-end shape warns, by name and with the remedy', ()
   });
 });
 
+// ---------------------------------------------------------------------------
+describe('[#13147] the boot diagnostic under a comma-separated OS_PLATFORM_OWNER_EMAIL', () => {
+  const SECOND_OWNER = 'ops@corp.example';
+  const OWNER_LIST = `${OWNER}, ${SECOND_OWNER}`;
+
+  it('NAMES each declared administrator instead of printing the raw list in an address slot', () => {
+    // The card's fourth reader. It does not COMPARE the value, it PRINTS it —
+    // so "correct" here is not the comparators' fix pattern: the line must name
+    // the declared set, each member as the operator typed it, in a slot an
+    // operator reads as addresses.
+    walledWithDeclaredOwner('isolated', OWNER_LIST);
+    const msg = resolveWalledOwnerVerificationPathWarning(NOTHING_WIRED)!;
+    expect(msg).toBeTruthy();
+    expect(msg).toContain('OS_PLATFORM_OWNER_EMAIL');
+    expect(msg).toContain(OWNER);
+    expect(msg).toContain(SECOND_OWNER);
+    // Each member named separately — ⛔ not the raw string with its separator
+    // swallowed into one address-looking token.
+    expect(msg).toContain(`OS_PLATFORM_OWNER_EMAIL=${OWNER}, ${SECOND_OWNER}`);
+    expect(msg).toContain(WALLED_OWNER_NO_VERIFICATION_PATH);
+  });
+
+  it('prints the entries as TYPED, and only the entries the parse kept', () => {
+    // Trailing separators and blank entries are dropped by the parse, so what
+    // is printed is exactly the set that was understood — an operator comparing
+    // this line to their config can SEE an entry that did not survive.
+    walledWithDeclaredOwner('isolated', ` Ops.Lead@Corp.EXAMPLE , ${SECOND_OWNER} ,`);
+    const msg = resolveWalledOwnerVerificationPathWarning(NOTHING_WIRED)!;
+    expect(msg).toContain(`OS_PLATFORM_OWNER_EMAIL=Ops.Lead@Corp.EXAMPLE, ${SECOND_OWNER}`);
+  });
+
+  it('the dev-seed silence clause matches ANY declared member, not just the first', () => {
+    // `seedStampsDeclaredOwner`: the seed rescues the fresh-store shape when it
+    // provisions a declared administrator. Under a list that used to compare
+    // the seed address against the whole raw value and never match, so a dev
+    // boot warned about a dead end the seed had already closed.
+    process.env.NODE_ENV = 'development';
+    process.env.OS_SEED_ADMIN = '1';
+    walledWithDeclaredOwner('isolated', `${OWNER}, ${DEV_SEED_ADMIN}`);
+    expect(resolveWalledOwnerVerificationPathWarning(nothingWired('no-human-users'))).toBeNull();
+  });
+
+  it('⛔ a REFUSED list declares nobody, so the diagnostic stays silent like an unset variable', () => {
+    walledWithDeclaredOwner('isolated', `${OWNER},not-an-email`);
+    expect(resolveWalledOwnerVerificationPathWarning(NOTHING_WIRED)).toBeNull();
+  });
+});
+
 describe('#11640 — controls: every neighbouring shape stays SILENT', () => {
   it('an email transport is wired ⇒ the verification link can be delivered ⇒ no warning', () => {
     walledWithDeclaredOwner();