@@ -52,9 +52,9 @@ import type { MetadataProtocol } from '@objectstack/spec/api';
5252// [#20408] …and the item route's post-read chain, the book-tree route, the
5353// list's unknown-type refusal, the object mask's cache posture and the
5454// organization a caller's `/meta` request is scoped to.
55- // [#20478] …and the layered view, on both of its spellings: its whole answer,
56- // the deprecated `?layers=` flag's parse and the headers that flag is served
57- // under.
55+ // [#20478] …and the layered view, on both of its spellings: its post-read
56+ // chain, the deprecated `?layers=` flag's parse and the headers that flag is
57+ // served under.
5858// Imported, never restated — AGENTS.md 〈Route & surface ownership〉 rule 1.
5959import {
6060 createMetaBookTreeAnswer ,
@@ -880,6 +880,7 @@ export async function handleMetadataRequest(deps: DomainHandlerDeps, path: strin
880880 operation : 'save' ,
881881 } ) ;
882882 } ;
883+
883884 // Defense-in-depth: the metadata catch-all must honour the same
884885 // anonymous-deny (#2567) as the REST `/meta` routes (which serve `/meta` on
885886 // the cloud runtime). Object/field schemas — SYSTEM-object schemas on a
@@ -1005,12 +1006,11 @@ export async function handleMetadataRequest(deps: DomainHandlerDeps, path: strin
10051006 // its own resource (#5882).
10061007 //
10071008 // [#20478] `RestServer` serves this route, and this domain had none: the
1008- // path fell to the located `ROUTE_NOT_FOUND` tail below. The whole answer is
1009- // `createMetaLayeredAnswer` in `@objectstack/rest` ({@link
1010- // answerMetaLayered}), the one `RestServer`'s handler calls. EXACTLY three
1011- // segments, like `/published` beside it. The anonymous gate above
1012- // keeps its deny here (`metaReadRouteOf` names no route), as `RestServer`'s
1013- // does.
1009+ // path fell to the located `ROUTE_NOT_FOUND` tail below. Everything after
1010+ // the read is `createMetaLayeredAnswer` in `@objectstack/rest` ({@link
1011+ // answerMetaLayered}), the chain `RestServer`'s handler calls. EXACTLY three
1012+ // segments, like `/published` beside it. The anonymous gate above keeps its
1013+ // deny here (`metaReadRouteOf` names no route), as `RestServer`'s does.
10141014 if ( parts . length === 3 && parts [ 2 ] === 'layers' && ( ! method || method . toUpperCase ( ) === 'GET' ) ) {
10151015 const type = parts [ 0 ] ;
10161016 const name = decodeMetaNameSegment ( parts [ 1 ] ) ;
@@ -1188,7 +1188,6 @@ export async function handleMetadataRequest(deps: DomainHandlerDeps, path: strin
11881188 // Extract optional package filter from query string
11891189 const packageId = query ?. package || undefined ;
11901190
1191-
11921191 // PUT /metadata/:type/:name (Save)
11931192 //
11941193 // [#8842] The condition is the METHOD alone. It used to be
0 commit comments