fix(rest,runtime): ?package=all names no package on every /meta door of both hosts

The layered read, the list, the book tree and the diagnostics sweep on
RestServer, and the dispatcher's book tree, layered read, item read and
save, and list, forwarded ?package=all to the store as a literal package
id. The layered read answered 404, the list [], the book tree an empty
implicit book, and the dispatcher's PUT bound the row to a package called
all. Each now reads ?package= through metaItemPackageBinding, which
@objectstack/rest exports from its entry for the runtime to take.

Claude-Session: https://claude.ai/code/session_01RWZbGvPFcRKvUqASZtunCU
Co-Authored-By: Claude <noreply@anthropic.com>

Author: claude

.changeset/22188-rest-meta-package-all-fold.md

@@ -0,0 +1,14 @@
+---
+"@objectstack/rest": minor
+---
+
+`metaItemPackageBinding` is exported, and every `/meta` door that reads `?package=` reads it through that function, so `?package=all` names no package on the layered read, the list, the book tree and the diagnostics sweep
+
+Clause-②: yes (widening)
+
+- `metaItemPackageBinding(raw)` answers the package a request's `?package=` names, or `undefined` for `all` (the metadata list's "show everything" scope), the empty value or a non-string. The item read, the save and the publish already read `?package=` through it. The runtime dispatcher's `/meta` domain now reads it through the same function.
+- `GET /meta/:type/:name/layers?package=all` answered `404` for an item stored in a package, and now serves the layers that the read without `?package=` serves. The Studio editor sends this read when it is opened from the list's "show everything" scope.
+- `GET /meta/:type?package=all` answered `[]`, and now lists what `GET /meta/:type` lists: the items of every package and the env-local ones.
+- `GET /meta/book/:name/tree?package=all` served the empty implicit book of a package called `all`, and now resolves the declared book as the read without `?package=` does.
+- `GET /meta/diagnostics?package=all` swept nothing, and now sweeps what the plain sweep sweeps.
+- Unchanged: a real package id still scopes each of these reads. The item read's cache bypass still reads the raw parameter, so `?package=all` keeps the uncached read and its served `version`.

.changeset/22188-runtime-meta-package-all-fold.md

@@ -0,0 +1,12 @@
+---
+"@objectstack/runtime": patch
+---
+
+The runtime dispatcher's `/meta` domain reads `?package=all` as naming no package, as `RestServer` does, so a `PUT ?package=all` through the `@objectstack/hono` catch-all no longer binds the row to a package called `all`
+
+Clause-②: no
+
+- The dispatcher's `PUT /meta/:type/:name?package=all` stored the row with `package_id: 'all'`. It now stores it env-local (`package_id` null), as `RestServer`'s `PUT` does.
+- Its layered read (`/meta/:type/:name/layers`), list (`/meta/:type`), book tree (`/meta/book/:name/tree`) and item read forwarded `all` to the store as a package id. The layered read answered `404` and the list `[]` for an item stored in a package. Each now answers `?package=all` as it answers the same request without `?package=`.
+- Every branch reads `?package=` through `metaItemPackageBinding` from `@objectstack/rest`, the function `RestServer`'s doors read it through.
+- Unchanged: a real package id still scopes each read and still binds a save.

packages/rest/src/index.ts

@@ -183,3 +183,13 @@ export type {
     MetaSaveRequestMembers,
     MetaSaveRequestOptions,
 } from './meta-save-request.js';
+
+// [#22188] …and the one reading of `?package=` on every `/meta` door: the
+// package a request names, or none for `all` (the list's "show everything"
+// scope), the empty value or a non-string. `RestServer`'s doors read it, and so
+// does the runtime dispatcher's `/meta` domain on its own copies of them — the
+// layered read, the list, the book tree and the item read and save — which
+// forwarded `all` to the store as a package id until this landed. It stays in
+// `rest-server.ts`, beside the doors that read it (its docblock is the
+// authority); this entry already loads that module.
+export { metaItemPackageBinding } from './rest-server.js';

packages/rest/src/rest-server.ts

@@ -1736,8 +1736,20 @@ function mayReadPendingDrafts(caller: unknown): boolean {
  * save then judged, and a client that pinned `If-None-Match: *` on that `null`
  * was refused. ⛔ Never a third inline copy at a door: the save and publish
  * doors each carried one, and the read door had none.
+ *
+ * [#22188] …and on every other `/meta` door that reads `?package=`: the
+ * layered read, the list, the book tree and the diagnostics sweep, which each
+ * forwarded `all` to the store as a package id no item is bound to (the
+ * layered read answered `404`, the list `[]`). Without `?package=`, the list
+ * already spans every package and the env-local overlay, so "no package" is
+ * the list's "show everything". Exported from the package entry, and the
+ * runtime dispatcher's `/meta` domain reads `?package=` through it on its own
+ * copies of these doors, so the two transports cannot read `all` differently.
+ * The item read's cache bypass (`packageScoped`) is not a second reading: it
+ * asks whether the raw parameter is present to pick the uncached arm, and that
+ * arm asks this function.
  */
-function metaItemPackageBinding(raw: unknown): string | undefined {
+export function metaItemPackageBinding(raw: unknown): string | undefined {
     return typeof raw === 'string' && raw !== '' && raw !== 'all' ? raw : undefined;
 }
 
@@ -3920,7 +3932,8 @@ export class RestServer {
         // `getMetaItemLayered({ packageId: ['a','b'] })`. Gated in the helper,
         // not in its two callers, so both entry points answer identically.
         if (refuseRepeatedQueryParams(req, res, ['package'])) return;
-        const layeredPackageId = req.query?.package || undefined;
+        // [#22188] Read through {@link metaItemPackageBinding}: `all` names no package.
+        const layeredPackageId = metaItemPackageBinding(req.query?.package);
         // [#9454] State the ORG scope, exactly as the `/published` overlay read
         // already does. Without it the layered view resolved the env-wide row
         // only, so an author who had just saved an org overlay opened Studio to
@@ -5804,7 +5817,9 @@ export class RestServer {
                         const result = await (p as any).getMetaDiagnostics({
                             type: diagnosticsType,
                             severity,
-                            packageId: (req.query?.package as string | undefined) || undefined,
+                            // [#22188] The list's reading ({@link metaItemPackageBinding}):
+                            // each swept type is a list read, so `all` names no package.
+                            packageId: metaItemPackageBinding(req.query?.package),
                             // SPREAD, never `organizationId: x ?? null` — the
                             // implementation declares `organizationId?: string`
                             // (optional plain string, not nullable), and a
@@ -6045,7 +6060,9 @@ export class RestServer {
                         // `query-multiplicity.ts` for why picking one of two
                         // conflicting intents is worse than a 400.
                         if (refuseRepeatedQueryParams(req, res, ['package', 'preview', 'object', 'include', 'id'])) return;
-                        const packageId = req.query?.package || undefined;
+                        // [#22188] Read through {@link metaItemPackageBinding}:
+                        // `all`, this list's "show everything" scope, names no package.
+                        const packageId = metaItemPackageBinding(req.query?.package);
                         const environmentId = isScoped ? req.params?.environmentId : undefined;
                         const p = await this.resolveProtocol(environmentId, req);
                         // [#9488] …and BEFORE any listing work: a `:type` that
@@ -6379,7 +6396,8 @@ export class RestServer {
                         const prot = await this.resolveProtocol(environmentId, req);
                         // [#6877] One package scopes the book lookup.
                         if (refuseRepeatedQueryParams(req, res, ['package'])) return;
-                        const packageId = req.query?.package || undefined;
+                        // [#22188] Read through {@link metaItemPackageBinding}: `all` names no package.
+                        const packageId = metaItemPackageBinding(req.query?.package);
                         // [#20408] The route's whole answer is
                         // `createMetaBookTreeAnswer` in `./meta-item-read-gate.ts`
                         // — the book and doc reads, THE `DocsAudience` (#19790: one