Merge origin/main: #23835 landed the 11 lead lines, which drop out of this diff

Claude-Session: https://claude.ai/code/session_016PVjjuVPte5XEJvaQx1E4t
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/23394-branding-logo-live.md

@@ -0,0 +1,16 @@
+---
+'@objectstack/spec': patch
+---
+
+fix(spec): the liveness ledger reads `app.branding.logo` as `live`, citing the console's `AppMark` reader (#23394)
+
+Clause-②: no
+
+**What was wrong.** The liveness ledger shipped with `@objectstack/spec` graded `app.branding.logo` `planned`, with a note saying no mounted component rendered it. The console now does: objectui's `AppMark` draws `branding.logo` as the app's square icon on the top-bar app pill, on each App Switcher row and in the phone drawer header.
+
+**What changes.**
+
+- `liveness/app.json`: `branding.logo` reads `live`, citing `AppMark` and the two shell components that mount it at the `.objectui-sha` pin. The designer pages that write the key stay cited as its `producer`. The `branding` container's note says the same.
+- `liveness/state-counts/app.md` is regenerated: `app` moves from `live 50 · planned 1` to `live 51 · planned 0`.
+
+Unchanged: what `AppSchema` accepts and refuses (an app-level `logo` is still refused, and the refusal still points at `branding`), and every other ledger row.

.changeset/23553-default-record-page-remedy.md

@@ -0,0 +1,17 @@
+---
+'@objectstack/spec': patch
+'@objectstack/metadata-protocol': patch
+'@objectstack/runtime': patch
+---
+
+docs: the default-record-page remedies name the other package's page, not the whole package
+
+Clause-②: no
+
+A second `isDefault: true` record page for one object is refused with `DEFAULT_RECORD_PAGE_CONFLICT`. The package registry's refusal already told the author to keep one default or "compose the deployment without the other package's page". Three sibling texts still told them to drop the whole package, though a deployment can keep a package and leave out the one page it ships:
+
+- `@objectstack/metadata-protocol`: the metadata save door's refusal now reads "a page a package ships stays the default unless the deployment is composed without that package's page." Only the remedy clause changed; `code`, `status`, `object` and `holders` are unchanged.
+- `@objectstack/spec`: `PageSchema.isDefault`'s TSDoc and the error-code ledger's comment on `DEFAULT_RECORD_PAGE_CONFLICT` say the same.
+- `@objectstack/runtime`: `AppPlugin`'s private `bundle` field now documents the three readers outside the class that read it structurally, so a rename is not made blind.
+
+No behaviour changes; nothing to migrate.

.changeset/23792-memory-url-refusal-no-url.md

@@ -0,0 +1,18 @@
+---
+'@objectstack/cli': patch
+---
+
+fix(cli): `os serve`'s refusal of a `memory://` or `mingo://` `OS_DATABASE_URL` names the URL's scheme and never prints the URL, so a password or token in it no longer reaches the console
+
+Clause-②: no
+
+This is the `os serve` path a host config takes (one whose `plugins` hold plugin instances), and the one `OS_MODE=off|none|legacy` takes. `os dev` and `os start` reach it through their `serve` child. Both schemes name the retired in-memory (mingo) engine, and both accept anything after the `//`, a `user:password@` and a query string included. The refusal interpolated the whole URL, and the CLI prints it as it exits 1.
+
+With `OS_DATABASE_URL=memory://PLACEHOLDER-USER:PLACEHOLDER-SECRET@127.0.0.1:6399/0?authToken=PLACEHOLDER-TOKEN`:
+
+- FROM: `✗ OS_DATABASE_URL "memory://PLACEHOLDER-USER:PLACEHOLDER-SECRET@127.0.0.1:6399/0?authToken=PLACEHOLDER-TOKEN" selects the in-memory (mingo) engine, …`
+- TO: `✗ An OS_DATABASE_URL with the "memory://" scheme selects the in-memory (mingo) engine, …`
+
+`mingo://` reads the same way, with `"mingo://"`. These are the runtime host's words for the same URL (`os dev` / `os start` over a plain config, and `os migrate`), so the two hosts print one sentence. The rest of the sentence, which names the SQLite replacements (`os dev --fresh`, and the URL `:memory:`), is unchanged.
+
+What does not change: both schemes are still refused, with the same error class and exit code, in dev and production; every other URL resolves as before, to the same driver.

.changeset/23806-metadata-core-vitest-peer.md

@@ -0,0 +1,22 @@
+---
+'@objectstack/metadata-core': patch
+---
+
+fix(metadata-core): the package installs on npm 10 again, and into projects that use vitest 5, because it no longer declares an optional `vitest` peer
+
+Clause-②: no
+
+On npm 10, the npm that Node 22 bundles, `npm install @objectstack/metadata-core` exited 1 with `Cannot read properties of null (reading 'edgesOut')`. So did installing a package that depends on it, such as `@objectstack/objectql`. The cause was this package's optional peer `vitest: ^4.0.0`. It led npm 10 to vitest 4.1.12, whose own peer declarations contradict each other, and npm 10's resolver crashes on that. The same peer also made npm refuse (`ERESOLVE`) to install the package into a project that already uses vitest 5.
+
+The package's main entry never imports `vitest`. Only the test-only `@objectstack/metadata-core/testing` entry does, so the peer is removed. Nothing the package exports changes.
+
+If you import `@objectstack/metadata-core/testing`, list `vitest` in your own `devDependencies`, as that entry's documentation already says. This package runs that suite on vitest 4. In a pnpm workspace with hoisting turned off (`hoist=false`), that entry can no longer find `vitest` from inside a workspace package. Declare the peer back in your `pnpm-workspace.yaml`:
+
+```yaml
+packageExtensions:
+  '@objectstack/metadata-core':
+    peerDependencies:
+      vitest: '*'
+```
+
+`@objectstack/plugin-auth` still fails the same way on npm 10, because its `better-auth` dependency declares its own optional `vitest` peer. Install it with npm 11, or add `"overrides": { "vitest": "~4.0.0" }` to your project's `package.json`.

.changeset/23813-minted-session-no-refresh.md

@@ -0,0 +1,14 @@
+---
+'@objectstack/plugin-auth': patch
+---
+
+Clause-②: no
+
+A session minted by `IAuthService.mintPrincipalSession` is no longer refreshed by a read. Before,
+`get-session` (and every endpoint that reads the session) still renewed it on each request: #23772's
+guard held its expiry, but the row's `updatedAt` was rewritten, the session cookie was re-set with a
+7-day `Max-Age`, and `bearer()` answered `set-auth-token`. The console reads that header as a token
+rotation, so a browser carrying a minted cookie stayed on "Opening your console…" and the print
+service could not render under the requesting user. A request that carries a minted session now
+sets better-auth's own per-request skip-refresh switch, on the cookie lane, the bearer lane and
+in-process. The mint's contract, TTL, refusals and revoke are unchanged.

packages/cli/src/utils/driver-vocabulary-parity.test.ts

@@ -257,6 +257,28 @@ describe('driver vocabulary parity: `os start` and `os migrate` answer alike (#6
     },
   );
 
+  // The URL door's refusal is printed on the way out, and both schemes take a
+  // `user:password@` and an `?authToken=`. Both hosts name the SCHEME, never the
+  // URL, in the same words: the CLI host's refusal is the runtime host's minus
+  // its `[StandaloneStack]` tag. Placeholder credentials only.
+  it.each(['memory://', 'mingo://'])(
+    'both hosts refuse a credentialed %s OS_DATABASE_URL in the same words, and neither prints the credentials',
+    (scheme) => {
+      const url = `${scheme}PLACEHOLDER-USER:PLACEHOLDER-SECRET@127.0.0.1:6399/0?authToken=PLACEHOLDER-TOKEN`;
+      const cli = refusalMessage(() => resolveDriverType(undefined, url));
+      process.env.OS_DATABASE_URL = url;
+      const standalone = refusalMessage(() => resolveStandaloneDatabase({ artifactPath: '/nonexistent/objectstack.json' }));
+      for (const [host, message] of [['os start', cli], ['os migrate', standalone]] as const) {
+        expect(message, `${host} accepted ${scheme}…`).not.toBeNull();
+        expect(message, host).toContain(`"${scheme}"`);
+        for (const placeholder of ['PLACEHOLDER-USER', 'PLACEHOLDER-SECRET', 'PLACEHOLDER-TOKEN']) {
+          expect(message, `${host} prints ${placeholder}`).not.toContain(placeholder);
+        }
+      }
+      expect(cli).toBe(standalone!.replace(/^\[StandaloneStack\] /, ''));
+    },
+  );
+
   // The control on the URL door: the replacement the refusals name is accepted
   // by both hosts, as SQLite — so the refusal is scoped to the engine, not to
   // the word "memory".

packages/cli/src/utils/storage-driver.test.ts

@@ -61,10 +61,15 @@ describe('inferDriverTypeFromUrl', () => {
 
   // The in-memory (mingo) engine's schemes are REFUSED at inference: the engine
   // is no longer a boot store. Asserted on the error's TYPE and on what it names
-  // (the URL and the two SQLite replacements), never on its prose.
-  it.each(['memory://', 'memory://ignored-host', 'mingo://', 'MINGO://x'])(
-    'refuses %s at inference, naming the SQLite replacements',
-    (url) => {
+  // (the variable, the scheme and the two SQLite replacements), never on its prose.
+  it.each([
+    ['memory://', 'memory://'],
+    ['memory://ignored-host', 'memory://'],
+    ['mingo://', 'mingo://'],
+    ['MINGO://x', 'MINGO://'],
+  ])(
+    'refuses %s at inference, naming its scheme and the SQLite replacements',
+    (url, scheme) => {
       let err: unknown;
       try {
         inferDriverTypeFromUrl(url);
@@ -75,12 +80,62 @@ describe('inferDriverTypeFromUrl', () => {
       const refusal = err as UnsupportedDriverError;
       // Not a kind this resolver produces — the allowlist pin's oracle reads this.
       expect(refusal.recognized).toBe(false);
-      expect(refusal.message).toContain(`"${url}"`);
+      expect(refusal.driverType).toBe(scheme);
+      expect(refusal.message).toContain('OS_DATABASE_URL');
+      expect(refusal.message).toContain(`"${scheme}"`);
       expect(refusal.message).toContain('--fresh');
       expect(refusal.message).toContain(':memory:');
     },
   );
 
+  // The refusal is printed to the console on the way out, and both schemes take
+  // anything after the `//`: a `user:password@` and an `?authToken=` ride along.
+  // It names the scheme, never the URL — in the message AND in the field a
+  // caller may log. Placeholder credentials only.
+  const PLACEHOLDERS = ['PLACEHOLDER-USER', 'PLACEHOLDER-SECRET', 'PLACEHOLDER-TOKEN'] as const;
+  const CREDENTIALED_TAIL = 'PLACEHOLDER-USER:PLACEHOLDER-SECRET@127.0.0.1:6399/0?authToken=PLACEHOLDER-TOKEN';
+  it.each(['memory://', 'mingo://'])(
+    'refuses a %s URL carrying a user, password and token, naming the scheme and none of the three',
+    (scheme) => {
+      const url = `${scheme}${CREDENTIALED_TAIL}`;
+      let err: unknown;
+      try {
+        inferDriverTypeFromUrl(url);
+      } catch (e) {
+        err = e;
+      }
+      expect(err, `inferDriverTypeFromUrl accepted ${scheme}…`).toBeInstanceOf(UnsupportedDriverError);
+      const refusal = err as UnsupportedDriverError;
+      expect(refusal.recognized).toBe(false);
+      expect(refusal.driverType).toBe(scheme);
+      expect(refusal.message).toContain(`"${scheme}"`);
+      expect(refusal.message).toContain('--fresh');
+      expect(refusal.message).toContain(':memory:');
+      for (const placeholder of PLACEHOLDERS) {
+        expect(refusal.message, `the refusal prints ${placeholder}`).not.toContain(placeholder);
+        expect(refusal.driverType, `driverType carries ${placeholder}`).not.toContain(placeholder);
+      }
+      expect(refusal.message).not.toContain('127.0.0.1');
+    },
+  );
+
+  // CONTROL: the same credentialed tail under every other scheme classifies as
+  // before — the redaction is scoped to the retired engine's arm, not to URLs
+  // that carry credentials.
+  it.each([
+    ['postgres://', 'postgres'],
+    ['postgresql://', 'postgres'],
+    ['pg://', 'postgres'],
+    ['mysql://', 'mysql'],
+    ['mysql2://', 'mysql'],
+    ['mongodb://', 'mongodb'],
+    ['mongodb+srv://', 'mongodb'],
+    ['libsql://', 'turso'],
+    ['wasm-sqlite://', 'sqlite-wasm'],
+  ])('classifies a %s URL carrying the same user, password and token as %s', (scheme, kind) => {
+    expect(inferDriverTypeFromUrl(`${scheme}${CREDENTIALED_TAIL}`)).toBe(kind);
+  });
+
   // The sqlite `:memory:` PSEUDO-FILE is SQLite's own in-memory mode — NOT the
   // mingo engine. It stays `sqlite`, and it is the replacement the refusal names.
   it('keeps sqlite `:memory:` mapped to sqlite (the replacement, distinct from memory://)', () => {

packages/cli/src/utils/storage-driver.ts

@@ -328,10 +328,20 @@ export function inferDriverTypeFromUrl(url: string | undefined): string {
   // the same URLs. Kept ABOVE the sqlite test so it is not shadowed, and
   // deliberately distinct from sqlite's `:memory:` pseudo-file below, which is
   // the replacement this refusal names.
-  if (/^(memory|mingo):\/\//i.test(u)) {
+  //
+  // The refusal names the SCHEME, never the URL: both schemes accept anything
+  // after the `//`, a `user:password@` and a `?authToken=` included, and this
+  // sentence is printed to the console on the way out. The subject is the
+  // runtime host's own (`refuseRetiredMemoryEngine` in
+  // `packages/runtime/src/standalone-stack.ts`, module-local there, so written
+  // out here), and `driver-vocabulary-parity.test.ts` holds the two equal.
+  // The scheme is also what the error carries as `driverType`, as the
+  // unrecognised-scheme refusal below does.
+  const retiredScheme = /^(memory|mingo):\/\//i.exec(u)?.[0];
+  if (retiredScheme) {
     throw new UnsupportedDriverError(
-      u,
-      retiredMemoryEngineMessage(`OS_DATABASE_URL "${u}"`),
+      retiredScheme,
+      retiredMemoryEngineMessage(`An OS_DATABASE_URL with the "${retiredScheme}" scheme`),
       // Not a kind this resolver can produce — `database-driver-allowlist.pin`
       // reads `recognized` to tell the two apart.
       { recognized: false },

packages/metadata-core/package.json

@@ -45,14 +45,6 @@
     "@objectstack/spec": "workspace:*",
     "zod": "^4.6.5"
   },
-  "peerDependencies": {
-    "vitest": "^4.0.0"
-  },
-  "peerDependenciesMeta": {
-    "vitest": {
-      "optional": true
-    }
-  },
   "devDependencies": {
     "@types/node": "^26.6.3",
     "fast-check": "^4.10.2",

packages/metadata-protocol/src/protocol.ts

@@ -21757,7 +21757,7 @@ export class ObjectStackProtocolImplementation implements
         const others = named.length === 1 ? `${named[0]} already is` : `${named.join(' and ')} already are`;
         const remedy = unique.some((h) => h.shipped)
             ? `Save '${saveName}' with \`isDefault: false\`: a page a package ships stays the default unless the `
-              + `deployment is composed without that package.`
+              + `deployment is composed without that package's page.`
             : `Save '${saveName}' with \`isDefault: false\`, or first save ${unique.map((h) => `'${h.page}'`).join(' and ')} `
               + `with \`isDefault: false\` to make '${saveName}' the default instead.`;
         const err = new Error(