Merge remote-tracking branch 'origin/main' into claude/issue-23074-member-envelope

Author: claude

.changeset/23013-section-heading-count.md

@@ -0,0 +1,22 @@
+---
+"@objectstack/spec": minor
+"@objectstack/lint": minor
+---
+
+A `record:details` section heading can show how many values a multi-value field holds on the current record: `sections[].count: { field }`, with the section's `label` writing the `{{ count }}` hole where the number goes.
+
+Clause-②: yes (widening)
+
+```ts
+{
+  name: 'plan_gap',
+  label: '{{ count }} features need a higher plan',
+  fields: ['capabilities_not_on_plan'],
+  count: { field: 'capabilities_not_on_plan' },
+}
+```
+
+- **`@objectstack/spec`.** `RecordDetailsProps.sections[]` accepts `count`, a closed object whose one key, `field`, is a bare machine name (snake_case, no dotted path). A section that declares `count` must write the `{{ count }}` hole in its `label`, in every locale of an inline label map. It is refused when it has no `label`, when the label has no hole, when the label writes any other `{{ … }}` hole (another variable, or the count with a formatter), when it writes the single-brace `{count}` / `${count}`, and beside `group` (a group-referencing section's heading is the group's own label). A translated `objects.<object>._sections.<name>.label` writes the same `{{ count }}` hole, and `os i18n extract` seeds it from the authored label. `SECTION_HEADING_COUNT_HOLE` exports the hole's grammar (inner whitespace is free: `{{count}}` is the same hole).
+- **`@objectstack/lint`.** The page field-binding pass resolves `count.field` against the bound object, at error severity, on `os validate`, `os lint` and `os build`: a field the object does not declare is `page-field-unknown`, and a declared field that holds one value is the new `page-section-count-not-multi-value`. A multi-value field is `multiselect`, `checkboxes` or `tags`, or a `select`, `lookup`, `user`, `file` or `image` field with `multiple: true`. A section's `fields[]` miss stays a warning.
+- **Not rendered yet.** The key is declared ahead of its renderer and its description carries the `[EXPERIMENTAL — not enforced]` marker: until the record detail renderer reads it, the hole renders as literal text.
+- **Nothing to migrate.** No stack that parsed before is refused: every new refusal needs the new key. A `{{ count }}` hole in a section that declares no `count` is still accepted.

.changeset/23047-me-permissions-outer-catch-closed.md

@@ -0,0 +1,18 @@
+---
+'@objectstack/plugin-hono-server': patch
+---
+
+`GET /api/v1/auth/me/permissions` answers "no capabilities", not "capabilities unknown", when it fails after the caller is known
+
+Clause-②: no
+
+Once the handler knows who the caller is, it has two ways to fail. When the permission-set resolution rejects, it already answered a closed body: `systemPermissions: []`, so every capability gate closes. Any other throw inside the handler (the effective-object merge, or a resolver that throws synchronously) was caught by an outer `catch` that answered `{ authenticated: true, userId, objects: {}, fields: {} }`. That body has no `systemPermissions`, which is the shape a deployment predating ADR-0066 sends, and the console reads it as "capabilities unknown" and fails open on it. So a server-side fault offered authoring handles the server then refused.
+
+The outer `catch` now answers the closed body, built by the same function the success path uses:
+
+- `authenticated: true`, the caller's `userId`, and `tenantId` (the session's, or `null`), which this body did not carry before;
+- `positions`, `permissionSets` and `systemPermissions` as `[]`, and `objects`, `fields` and `tabPermissions` as `{}`.
+
+The log line is unchanged: `[hono] /auth/me/permissions failed` at `warn`, once.
+
+**What does not change.** The success body is byte-identical. The resolver-rejection path still reports the session's positions. A stack with no SecurityPlugin or no metadata service still answers its deliberate open body without `systemPermissions`, since there the server enforces nothing either. A caller with no session still gets `{ authenticated: false }`. No accept set, export or `spec` key moves, and the console needs no change.

content/docs/references/ui/component.mdx

@@ -1694,7 +1694,7 @@ View filter rule
 | :--- | :--- | :--- | :--- |
 | **columns** | `Enum<'1' \| '2' \| '3' \| '4'>` | optional (default: `"2"`) | Number of columns for field layout (1-4) |
 | **layout** | `never` | optional | [REMOVED] `record:details` property `layout` was removed in @objectstack/spec 17.0.0 (ADR-0087 D2) — its declared `auto` \| `custom` semantics were never implemented: the renderer tests `layout` only against `inline` \| `compact`, two values the schema never permitted, so both legal values took the same branch and the key selected nothing. Delete the key — the body is already chosen by what you author: `sections` renders the explicit groups (the old `custom`), and omitting it falls back to the object's `highlightFields` (the old `auto`). Run `os migrate meta --from 16` to list the mechanical edits for existing sources; `--write` applies the ones it can prove, and you apply the rest by hand. |
-| **sections** | `{ name?: string; label?: string \| Record<string, string>; columns?: integer; group?: string; … }[]` | optional | Field groups rendered as the detail body, in order. Object form: `{ name?, label?, columns?, fields, hideEmpty?, collapsible?, showBorder?, defaultCollapsed?, icon?, description?, headerColor? }` — or the group-reference form `{ group, columns?, hideEmpty?, showBorder?, headerColor? }`, which inherits members and presentation from the object's `fieldGroups` entry (ADR-0085 §5). |
+| **sections** | `{ name?: string; label?: string \| Record<string, string>; columns?: integer; group?: string; … }[]` | optional | Field groups rendered as the detail body, in order. Object form: `{ name?, label?, columns?, fields, hideEmpty?, collapsible?, showBorder?, defaultCollapsed?, icon?, description?, headerColor?, count? }` — or the group-reference form `{ group, columns?, hideEmpty?, showBorder?, headerColor? }`, which inherits members and presentation from the object's `fieldGroups` entry (ADR-0085 §5). `count: { field }` shows how many values a multi-value field holds in the heading, through its `{{ count }}` hole. |
 | **fields** | `string[]` | optional | Explicit field list to display (optional, overrides highlightFields) |
 | **hideFields** | `string[]` | optional | Field names to omit from the body — applied to `fields` and to every section's `fields` (used to dedupe fields already shown in `record:highlights` or as the page title) |
 | **inlineEdit** | `boolean` | optional | Allow inline field editing in the detail body (renderer default: on, where the object itself is editable — set `false` to force it off). |
@@ -1720,6 +1720,7 @@ View filter rule
 | **icon** | `string` | optional | Heading icon, as a lucide icon name (kebab-case, e.g. `building-2`). A value that is not an ASCII identifier (emoji, CJK text) renders as literal text beside the heading instead. Shown where the section heading renders: a titled section, or any collapsible section. |
 | **description** | `string` | optional | Sub-heading text rendered under the section heading (plain string — the renderer applies no translation to it, unlike `label`). Renders on a titled or collapsible section; a collapsible section hides it while collapsed. |
 | **headerColor** | `Enum<'muted' \| 'muted/50' \| 'accent' \| 'primary/10' \| 'secondary/10' \| 'destructive/10'>` | optional | Section-header background tint, from the closed six-token vocabulary rendered by objectui's `record:details` header (`muted` \| `muted/50` \| `accent` \| `primary/10` \| `secondary/10` \| `destructive/10`). A value outside the enum is refused at authoring time rather than silently not painting. Omit for an untinted header. |
+| **count** | `{ field: string }` | optional | [EXPERIMENTAL — not enforced] Show how many values a multi-value field holds on the current record in this section's heading: `{ field: 'tags' }`, with `label` writing the `{{ count }}` hole where the number goes (`'{{ count }} tags'`). The field must be a multi-value field the bound object declares — `multiselect`, `checkboxes`, `tags`, or a `select` / `lookup` / `user` / `file` / `image` field with `multiple: true` — and an absent or empty value counts 0. Every locale of an inline label map, and a translated `objects.<object>._sections.<name>.label`, writes the same `{{ count }}` hole. Not allowed beside `group`. Declared ahead of its renderer: until the record detail renderer reads it, the hole renders as literal text. |
 
 ### Nested Shape: `RecordDetailsProps.aria`
 

docs/audits/2026-07-unknown-key-strictness-ledger.counts/ui.md

@@ -21,7 +21,7 @@ The `strict` column is the one the campaign schedules against; it counts both th
 
 | Dir | Sites | strict | passthrough | catchall | strip |
 |---|---|---|---|---|---|
-| `ui/` | 212 | 201 | 4 | 0 | 7 |
+| `ui/` | 213 | 202 | 4 | 0 | 7 |
 
 ## `ui/` — sites
 
@@ -36,7 +36,7 @@ classify and is not listed (it becomes reportable the day it grows its first sit
 | `app.zod.ts` | 19 |
 | `bulk-action.zod.ts` | 4 |
 | `chart.zod.ts` | 8 |
-| `component.zod.ts` | 79 |
+| `component.zod.ts` | 80 |
 | `dashboard.zod.ts` | 11 |
 | `dataset.zod.ts` | 4 |
 | `i18n.zod.ts` | 1 |
@@ -46,23 +46,23 @@ classify and is not listed (it becomes reportable the day it grows its first sit
 | `sharing.zod.ts` | 1 |
 | `view.zod.ts` | 59 |
 | `widget.zod.ts` | 1 |
-| **total** | **212** |
+| **total** | **213** |
 
 ## `ui/` — open
 
 Per file, how many of its sites still silently discard unknown keys. The `Class`
 column that decides the bucket split is hand-written in the ledger; the arithmetic
 over it is here.
 
-**7 strip of 212**, in 4 file(s).
+**7 strip of 213**, in 4 file(s).
 
 | File | Strip | Sites |
 |---|---|---|
 | `action-params.zod.ts` | 1 | 1 |
 | `app.zod.ts` | 1 | 19 |
 | `view.zod.ts` | 4 | 59 |
 | `widget.zod.ts` | 1 | 1 |
-| **total** | **7** | **212** |
+| **total** | **7** | **213** |
 
 | Bucket | Sites |
 |---|---|

packages/lint/src/index.ts

@@ -532,6 +532,7 @@ export {
   PAGE_FIELD_UNKNOWN,
   PAGE_FIELD_UNPROVISIONED,
   PAGE_SECTION_GROUP_UNKNOWN,
+  PAGE_SECTION_COUNT_NOT_MULTI_VALUE,
 } from './validate-page-field-bindings.js';
 export type { PageFieldFinding, PageFieldSeverity } from './validate-page-field-bindings.js';
 

packages/lint/src/validate-page-field-bindings.test.ts

@@ -9,8 +9,11 @@ import {
   PAGE_FIELD_UNKNOWN,
   PAGE_FIELD_UNPROVISIONED,
   PAGE_SECTION_GROUP_UNKNOWN,
+  PAGE_SECTION_COUNT_NOT_MULTI_VALUE,
+  componentSectionCountRefs,
 } from './validate-page-field-bindings.js';
 import { indexUnprovisionedAnchors } from './system-fields.js';
+import { validateReferenceIntegrity } from './reference-integrity-suite.js';
 
 const baseStack = () => ({
   objects: [
@@ -220,6 +223,107 @@ describe('validatePageFieldBindings — dangling `section.group` (#13855)', () =
   });
 });
 
+describe('validatePageFieldBindings — the field a section heading counts (#23013)', () => {
+  /** `baseStack()` plus multi-value fields on `crm_lead`. */
+  const countStack = () => {
+    const stack = baseStack();
+    Object.assign((stack.objects[0] as { fields: Record<string, unknown> }).fields, {
+      tags: { type: 'tags' },
+      capabilities_not_on_plan: { type: 'multiselect', options: [{ label: 'SSO', value: 'sso' }] },
+      watchers: { type: 'user', multiple: true },
+      regions: { type: 'select', multiple: true, options: [{ label: 'EU', value: 'eu' }] },
+    });
+    return stack;
+  };
+
+  /** One counted section; `fields` lists the counted field like a real page does. */
+  const countedPage = (field: string) => pageWith([{
+    type: 'record:details',
+    properties: {
+      sections: [{ name: 'plan_gap', label: '{{ count }} items', fields: [field], count: { field } }],
+    },
+  }]);
+  const COUNT_PATH = 'pages[0].regions[0].components[0].properties.sections[0].count.field';
+
+  it('is clean on every multi-value shape: an option-list type, and a multi-capable type with `multiple: true`', () => {
+    for (const field of ['tags', 'capabilities_not_on_plan', 'watchers', 'regions']) {
+      expect(validatePageFieldBindings({ ...countStack(), pages: [countedPage(field)] }), field).toEqual([]);
+    }
+  });
+
+  it('GATES on a counted field the object does not declare — reusing `page-field-unknown`', () => {
+    const findings = validatePageFieldBindings({
+      ...countStack(),
+      pages: [pageWith([{
+        type: 'record:details',
+        properties: { sections: [{ label: '{{ count }} items', fields: ['tags'], count: { field: 'capabilitie' } }] },
+      }])],
+    });
+    expect(findings.map((f) => [f.rule, f.severity, f.path])).toEqual([
+      [PAGE_FIELD_UNKNOWN, 'error', COUNT_PATH],
+    ]);
+    expect(findings[0].message).toContain('"capabilitie"');
+  });
+
+  it('GATES on a counted field that holds one value, naming its type', () => {
+    for (const [field, type] of [['status', 'select'], ['name', 'text'], ['account', 'lookup']] as const) {
+      const findings = validatePageFieldBindings({ ...countStack(), pages: [countedPage(field)] });
+      expect(findings.map((f) => [f.rule, f.severity, f.path]), field).toEqual([
+        [PAGE_SECTION_COUNT_NOT_MULTI_VALUE, 'error', COUNT_PATH],
+      ]);
+      expect(findings[0].message, field).toContain(`\`${type}\``);
+    }
+  });
+
+  it('judges a registry-injected column by its own definition: `created_at` is single-valued', () => {
+    const findings = validatePageFieldBindings({
+      ...countStack(),
+      pages: [pageWith([{
+        type: 'record:details',
+        properties: { sections: [{ label: '{{ count }} items', fields: ['tags'], count: { field: 'created_at' } }] },
+      }])],
+    });
+    expect(findings.map((f) => [f.rule, f.severity, f.path])).toEqual([
+      [PAGE_SECTION_COUNT_NOT_MULTI_VALUE, 'error', COUNT_PATH],
+    ]);
+  });
+
+  it('keeps the severity split: a section `fields[]` miss advises while the counted miss gates', () => {
+    const findings = validatePageFieldBindings({
+      ...countStack(),
+      pages: [pageWith([{
+        type: 'record:details',
+        properties: { sections: [{ label: '{{ count }} items', fields: ['ghost'], count: { field: 'ghost' } }] },
+      }])],
+    });
+    expect(findings.map((f) => [f.rule, f.severity, f.path])).toEqual([
+      [PAGE_FIELD_UNKNOWN, 'warning', 'pages[0].regions[0].components[0].properties.sections[0].fields[0]'],
+      [PAGE_FIELD_UNKNOWN, 'error', COUNT_PATH],
+    ]);
+  });
+
+  it('says nothing about an object this stack does not define', () => {
+    const findings = validatePageFieldBindings({
+      ...countStack(),
+      pages: [{ ...countedPage('anything'), object: 'other_pkg__thing' }],
+    });
+    expect(findings).toEqual([]);
+  });
+
+  it('survives off-spec input: a non-object `count`, a non-string `field`, a section that is not an object', () => {
+    const refs = componentSectionCountRefs('record:details', {
+      sections: ['overview', { count: 'tags' }, { count: { field: 7 } }, { count: { field: 'tags' } }],
+    }, 'p');
+    expect(refs).toEqual([{ name: 'tags', path: 'p.sections[3].count.field' }]);
+  });
+
+  it('reaches the gating reference-integrity suite every CLI command runs', () => {
+    const findings = validateReferenceIntegrity({ ...countStack(), pages: [countedPage('status')] });
+    expect(findings.filter((f) => f.rule === PAGE_SECTION_COUNT_NOT_MULTI_VALUE).map((f) => f.severity))
+      .toEqual(['error']);
+  });
+});
+
 describe('validatePageFieldBindings — related lists bind the related object', () => {
   it('checks columns against objectName, not the page object', () => {
     const findings = validatePageFieldBindings({