Merge remote-tracking branch 'origin/main' into claude/issue-24186-mcp-verifier-jwks-seam

Author: claude

.changeset/24016-org-invite-action.md

@@ -0,0 +1,12 @@
+---
+'@objectstack/platform-objects': patch
+'@objectstack/spec': patch
+---
+
+`sys_organization` now declares an `invite_user` action at `record_header`, so an organization record page can offer "Invite User" as its primary header button. It calls `/api/v1/auth/organization/invite-member` with the record's id as `organizationId`, asks for `email` and `role` (the role picker offers only the roles the caller may grant), and is gated like the other three invite mirrors: the `organization` capability and the owner / admin / delegated_admin grades. Its `order: -1` puts it first in the header.
+
+`leave_organization` keeps `variant: 'danger'` and now declares `order: 1`, so it sorts last among the header actions and folds into the `⋯` overflow menu instead of taking the third inline slot. Its confirmation now names what is lost: the organization's environments and members (en, zh-CN, ja-JP and es-ES).
+
+`@objectstack/spec` books the new action in `PUBLIC_AUTH_FEATURES.organization.gatedInputs`, beside the other three invite mirrors.
+
+Clause-②: no

.changeset/24182-extender-withdrawal-restores-owner.md

@@ -0,0 +1,12 @@
+---
+'@objectstack/objectql': patch
+'@objectstack/cloud-connection': patch
+---
+
+Clause-②: no
+
+fix(objectql): withdrawing a package that extends another package's object puts the owner's definition back at `GET /api/v1/meta/object/NAME` at once, not at the next restart
+
+- **What was wrong.** When a package whose content is an `objectExtensions` field on another package's object is registered on a started kernel, the ObjectQL bridge rewrites the OWNER's copy of that object in the `metadata` service with the merged body, extension included. `DELETE /api/v1/marketplace/install-local/:manifestId` of the extender withdrew its contribution from the registry, so the object listing and the data plane dropped the field, but nothing rewrote the owner's copy. The by-name read asks that copy first, so `GET /api/v1/meta/object/NAME` kept serving the withdrawn field until the runtime restarted.
+- **What changes.** The ObjectQL bridge remembers which owners' copies each package's extensions rewrote, and the `manifest` service gains `restoreExtendedObjectCopies(packageId)`: once the registry no longer holds the package, it re-registers each such copy with the registry's current definition. The install-local DELETE calls it right after the registry withdrawal. The by-name read then serves the owner's body without the extension's fields, as the listing and the data plane already did.
+- **Not touched.** Only a copy stamped with the registry owner's id is rewritten, the same rule the bridge overwrites by, so an authored copy stays. The DELETE answer is unchanged. A copy that cannot be restored is logged once at `error`, naming the objects and the remedy: restart the runtime.

.changeset/24196-auth-session-api-declared-fields.md

@@ -0,0 +1,13 @@
+---
+"@objectstack/spec": minor
+"@objectstack/core": patch
+"@objectstack/service-print": patch
+---
+
+feat(spec): `AuthSessionApi.getSession`'s result declares the fields its in-process readers read
+
+Clause-②: yes (widening)
+
+- **`@objectstack/spec/contracts` — `AuthSessionApi.getSession`'s result gains five optional members**, each declared for a named reader and typed as that reader takes it: `user.email` and `session.id` / `session.token` (read by `resolveAuthzContext`'s session arm in `@objectstack/core`), `user.authGate` as `unknown` (the ADR-0069 posture, which `normalizeAuthGate` validates against the closed posture vocabulary), and `session.impersonatedBy` as `string | null` (read by the print door's `impersonatorOf` in `@objectstack/service-print`). Before this, those reads went through `any` or a cast, so a field better-auth dropped or renamed compiled and read `undefined`. For `impersonatedBy`, that would have silently turned off the impersonation refusal. Every member is optional, so every implementer and caller typechecks unchanged.
+- **`@objectstack/core`**: `resolveAuthzContext`'s session arm reads the session through the declared type instead of `any`. `ResolveAuthzInput.getSession`'s own type is unchanged. Runtime behaviour is unchanged.
+- **`@objectstack/service-print`**: `impersonatorOf` reads `session.impersonatedBy` through the declared type instead of a cast. Runtime behaviour is unchanged.

.github/workflows/board-snapshot.yml

@@ -152,9 +152,9 @@ on:
     # platform-checklist watchdog at :51 — 44 minutes after this run starts —
     # plus CodeQL on Mondays. `4,10,16,22` was the obvious alternative and is
     # worse on the same measurement: it drops an 800-request run into the busiest
-    # scheduled hour on this board (04:00 rerun-safety, 04:19 release-coverage
-    # patrol, 04:23 required-set patrol, 04:37 branch reaper on Mondays, 04:41
-    # create-smoke) and shares hour 16 with the required-set patrol.
+    # scheduled hour on this board (04:19 release-coverage patrol, 04:23
+    # required-set patrol, 04:37 branch reaper on Mondays, 04:41 create-smoke)
+    # and shares hour 16 with the required-set patrol.
     #
     # The minute is off the top of the hour on purpose, as in every patrol here:
     # scheduled workflows queue behind everyone else's :00 cron.

.github/workflows/ci.yml

@@ -828,6 +828,24 @@ jobs:
               pnpm turbo run build "--filter=$PKG" --concurrency=4 --log-order=stream
           done < "$RUNNER_TEMP/shard-packages.txt"
 
+      # ── Test leftovers, step 1 of 2: the snapshot (#23880, ruling 乙) ──────
+      #
+      # REPORT ONLY, never a gate; the rationale, the listing and the closed
+      # exclusion list are in the `scripts/ci/report-test-leftovers.mjs` header.
+      # Taken HERE, after both dependency-closure builds above and before the
+      # tests, so the report after the tests can tell what the test run added
+      # from what the builds wrote. A package's OWN build (a test task that
+      # turbo.json makes depend on `build` without `^`) still runs inside the
+      # test step; the report excludes its declared outputs, read from
+      # turbo.json on every run. The snapshot goes to $RUNNER_TEMP, outside the
+      # tree, or the report would count it.
+      #
+      # ⛔ No `if:` and no `continue-on-error`: the script exits 0 on every
+      # path, by construction (a failure prints one NOT MEASURED warning), so
+      # this step cannot fail the shard or withhold its attestation.
+      - name: Snapshot the working tree before this shard's tests
+        run: node scripts/ci/report-test-leftovers.mjs snapshot --out "$RUNNER_TEMP/test-leftovers/before.json"
+
       # --concurrency=4: turbo's default (10) oversubscribes the 4-vCPU
       # hosted runner; matching the core count bounds peak memory and the
       # job is CPU-bound anyway.
@@ -1056,6 +1074,27 @@ jobs:
           done
           exit $STATUS
 
+      # ── Test leftovers, step 2 of 2: the report (#23880, ruling 乙) ────────
+      #
+      # Every path this shard's test run ADDED to the working tree since the
+      # snapshot, ignored paths included -- `.objectstack/` is gitignored, so
+      # `git status` cannot see that class -- grouped by package directory: a
+      # table in the job summary and one `::warning::` annotation per package.
+      # Placed directly after the test step so no later step's writes are
+      # charged to the tests, and `if: always()` so a red shard still reports.
+      #
+      # ⛔ REPORT ONLY by ruling, never a gate: the script exits 0 on findings,
+      # on a missing snapshot and on a crash, so the step carries no
+      # `continue-on-error` and cannot fail the shard. Making it block is the
+      # maintainer's word, not an edit here. It stays ABOVE the attestation
+      # pair at the bottom of the job (#6082), like every step after the tests.
+      - name: Report what this shard's tests left in the working tree
+        if: always()
+        run: |
+          node scripts/ci/report-test-leftovers.mjs report \
+            --before "$RUNNER_TEMP/test-leftovers/before.json" \
+            --label "Test Core (${{ matrix.shard }}/6)"
+
       # --summarize above costs nothing at runtime and writes
       # `.turbo/runs/<id>.json`: one per-task record with the execution window
       # turbo actually observed. That file IS the balancing input for the next
@@ -2106,6 +2145,13 @@ jobs:
             --report-dir "$RUNNER_TEMP/stall-reports" -- \
             pnpm turbo run build --filter=@objectstack/dogfood --concurrency=4 --log-order=stream
 
+      # Test leftovers, step 1 of 2 (#23880, ruling 乙): the snapshot, after the
+      # closure build and before the tests. Report only; the same pair as Test
+      # Core's, whose comments carry the rationale. `dogfood#test` depends on
+      # `^build` alone, so the step above builds everything the tests need.
+      - name: Snapshot the working tree before the dogfood tests
+        run: node scripts/ci/report-test-leftovers.mjs snapshot --out "$RUNNER_TEMP/test-leftovers/before.json"
+
       # Boots real example apps in-process (in-memory SQLite) and exercises them
       # through the real HTTP + service stack — catches runtime regressions that
       # build / unit tests / spec-liveness pass over (e.g. the #2018 tz-bucketing
@@ -2147,6 +2193,16 @@ jobs:
             --report-dir "$RUNNER_TEMP/stall-reports" -- \
             pnpm turbo run test --filter=@objectstack/dogfood --log-order=stream
 
+      # Test leftovers, step 2 of 2 (#23880, ruling 乙): what the dogfood test
+      # run added to the working tree. Report only -- exits 0 on every path, no
+      # `continue-on-error` -- and `if: always()`; see Test Core's pair.
+      - name: Report what the dogfood tests left in the working tree
+        if: always()
+        run: |
+          node scripts/ci/report-test-leftovers.mjs report \
+            --before "$RUNNER_TEMP/test-leftovers/before.json" \
+            --label "Dogfood Regression Gate (${{ matrix.shard }}/3)"
+
       # Dogfood boots real apps in-process, so a native/OOM abort is likelier
       # here than in the unit suites — and a shard that dies silently looks like
       # a shard that had less work.

.github/workflows/docs-deploy.yml

@@ -52,8 +52,8 @@ on:
     # The HOURS keep out of this repository's crowded scheduled windows, read
     # from `grep -rn 'cron:' .github/workflows/` on the day this landed: 01–05
     # UTC carry most of the nightlies (stale, CodeQL, validate-deps,
-    # rerun-safety, coverage, the release-coverage and required-set patrols,
-    # the smokes and nightly tiers), 07 carries showcase-smoke, and the board
+    # coverage, the release-coverage and required-set patrols, the smokes and
+    # nightly tiers), 07 carries showcase-smoke, and the board
     # snapshot owns :07 of 02, 08, 14 and 20. Of the six six-hour sets, only
     # 0/6/12/18 and 1/7/13/19 have hours with nothing scheduled after :00; the
     # first is taken because its :00 neighbours are short (release.yml's

.github/workflows/lint.yml

@@ -3728,6 +3728,23 @@ jobs:
         continue-on-error: true
         run: node scripts/report-test-timings.mjs --self-test
 
+      # The test-leftover report's own instrument (#23880, ruling 乙). ci.yml's
+      # test jobs run `scripts/ci/report-test-leftovers.mjs snapshot` / `report`,
+      # which exit 0 on every path BY RULING -- report only, never a gate -- so
+      # nothing there can go red when the report stops seeing what it exists to
+      # see: an ignored path a test added. This self-test is where that breaks
+      # loudly: fixture snapshots for the diff, the closed exclusion list and the
+      # turbo.json own-build derivation, plus a real throwaway git tree that
+      # proves the listing includes IGNORED paths and that every in-job failure
+      # is a warning with exit 0. It also loads the script on every pull
+      # request, the one breakage its in-job modes cannot catch about
+      # themselves. Invoked as `node` per the GATE INVOCATION IDIOM note at the
+      # top of this file. Offline; about a second.
+      - name: Test-leftover report self-test
+        id: test-leftover-report-self-test
+        continue-on-error: true
+        run: node scripts/ci/report-test-leftovers.mjs --self-test
+
       # The per-package suite-duration ratchet's own instrument (#16468). The
       # gate runs in ci.yml's `Test Core` aggregator, where a clean tree with
       # every suite under its ceiling reads OK whether or not the over-ceiling,
@@ -5184,28 +5201,6 @@ jobs:
         continue-on-error: true
         run: pnpm check:stall-guard-budget
 
-      # The `Rerun Safety` verdict table (#18590) — self-test half only, and the
-      # asymmetry is the same one the step below explains: the measurement half
-      # takes two log paths and two exit codes that exist only inside that
-      # nightly job, so there is nothing here for a bare invocation to read.
-      #
-      # ⭐ It is wired HERE rather than left in the nightly deliberately.
-      # `rerun-safety-nightly.yml` declares `schedule` and `workflow_dispatch`
-      # and no PR-time event, so a gate family reachable only from it would be
-      # this tree's first SCHEDULED-ONLY family — which `check:pm-dispatch-gates`
-      # refuses by name, on the ground that a board sweep must not be routed into
-      # a per-PR gate list.
-      #
-      # WHAT REDDENS IT: its own script's parsing rules and verdict table. Those
-      # are matching rules, so their production verdict is identical before and
-      # after they break (see `check-self-test-wired.mjs`) — this step is the
-      # only instrument watching them. Reads nothing but its own fixtures; no
-      # build, no network, no token, sub-second.
-      - name: Rerun-safety verdict table self-test
-        id: rerun-safety-verdict-table-self-test
-        continue-on-error: true
-        run: pnpm check:rerun-safety-verdict
-
       # Rationale: `scripts/measure-stall-guard-headroom.mjs` header (#13246, #13121).
       # ⛔ `--self-test` only: never append a bare run (it needs a token).
       - name: Stall-guard headroom self-test (self-test half only, never the measurement)

.github/workflows/prerelease-pin-watch.yml

@@ -57,8 +57,8 @@ name: Prerelease Pin Watch
 
 on:
   schedule:
-    # 06:00 UTC nightly — after Rerun Safety (04:00) and Spec Coverage (05:00),
-    # before Showcase Smoke (07:00). Nightly, not weekly: see the note above.
+    # 06:00 UTC nightly — after Spec Coverage (05:00), before Showcase Smoke
+    # (07:00). Nightly, not weekly: see the note above.
     - cron: '0 6 * * *'
   workflow_dispatch:
   pull_request: