From d34a69f0e10d35b28edb5193c33864c90c6df1d7 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 17 Sep 2026 23:55:28 +0000 Subject: [PATCH 1/2] fix(spec): register sys_environment_credential in CLOUD_PROVIDED_OBJECT_NAMES The curated cloud list carried the tenant runtime's app, environment, environment-member, license and package objects but not the rotatable credential store that @objectstack/service-tenant registers on the same path, so a reference to that name resolved against nothing and the object-reference ladder classed it as a platform-prefixed name nobody provides. Add the one entry, pin it by name beside sys_license and the package family, and add the changeset. Claude-Session: https://claude.ai/code/session_01JbZnqu8bt6YqfJsr9vaFb3 Co-authored-by: Claude --- ...c-cloud-provided-environment-credential.md | 37 +++++++++++++++++++ .../constants/platform-object-names.test.ts | 24 ++++++++++++ .../system/constants/platform-object-names.ts | 1 + 3 files changed, 62 insertions(+) create mode 100644 .changeset/spec-cloud-provided-environment-credential.md diff --git a/.changeset/spec-cloud-provided-environment-credential.md b/.changeset/spec-cloud-provided-environment-credential.md new file mode 100644 index 00000000000..fd1571ceec4 --- /dev/null +++ b/.changeset/spec-cloud-provided-environment-credential.md @@ -0,0 +1,37 @@ +--- +"@objectstack/spec": minor +--- + +`CLOUD_PROVIDED_OBJECT_NAMES` (`@objectstack/spec/system`) gains a member: +`sys_environment_credential`. `isPlatformProvidedObjectName('sys_environment_credential')` +now returns `true`, so a reference to that name resolves instead of being +diagnosed as a platform-prefixed name nothing registers (#18309). + +This widens an accept set. The list is a closed set and the name was not in it, +so the object-reference ladder now accepts a value it used to warn on, and the +widening reaches every surface that consults the predicate: a dataset `object`, +an action parameter `reference`, a field `reference`, a dashboard +`optionsFrom.object`, a navigation `requiresObject` and a translation +`objects.` subtree naming `sys_environment_credential` all stop being +diagnosed. + +Why this name: `@objectstack/service-tenant` registers it in the cloud +repository on exactly the path the list's existing `sys_package`, +`sys_package_version` and `sys_package_installation` members take — +`objects/sys-environment-credential.object.ts` exported through +`objects/index.ts`, listed in `tenantObjects`, spread into +`manifestService.register({ objects })` by `tenant-plugin.ts`. + +Unlike the earlier additions, this one fixes no diagnostic that fires today: no +`*.object.ts` in this repository references the name, so nothing shipped was +being mis-diagnosed. What was wrong is the registry's own claim about the name. +This repository's governed records already treat the object as real — ADR-0007's +inventory table lists it as existing, and ADR-0131 cites a measured cross-tenant +read of its rows — while the list that decides whether a reference resolves said +no package registers it. The first author to write the reference would have been +told it looked like a typo. + +One entry is added; no other member moves and nothing is removed or narrowed. +The cloud-side half of the contract — that `@objectstack/service-tenant` +registers the table — is owned by the cloud repository per the list's header and +is not asserted from here. diff --git a/packages/spec/src/system/constants/platform-object-names.test.ts b/packages/spec/src/system/constants/platform-object-names.test.ts index b2a4cde7197..2609d32754a 100644 --- a/packages/spec/src/system/constants/platform-object-names.test.ts +++ b/packages/spec/src/system/constants/platform-object-names.test.ts @@ -184,4 +184,28 @@ describe('platform-object predicates', () => { expect(CLOUD_PROVIDED_OBJECT_NAMES, name).toContain(name); } }); + + it('resolves the tenant credential store the cloud runtime registers', () => { + // `sys_environment_credential` is registered by `@objectstack/service-tenant` + // on the same path as the `sys_package*` family above: declared in + // `objects/sys-environment-credential.object.ts`, exported through + // `objects/index.ts`, listed in `tenantObjects` in `manifest.ts`, and spread + // into `manifestService.register({ objects })` by `tenant-plugin.ts`. + // + // Unlike `sys_license` and `sys_package_version`, no `*.object.ts` in THIS + // repository references it today, so nothing here was being mis-diagnosed + // while it was absent. What was wrong is the registry's own claim: this + // repo's governed records already treat the object as real — ADR-0007's + // inventory table lists it as `✅ exists`, and ADR-0131 §1.1 cites a + // measured cross-tenant read of its rows — while the list that decides + // whether a reference to it resolves said no package registers that name. + // So the first author to write the reference would have been told it looked + // like a typo. Pinned by name, beside `sys_license` and the package family, + // for the same reason: dropping it fails one readable assertion instead of + // nothing. The other half of the contract — that the cloud runtime really + // registers the table — is owned by the cloud repository per the list's + // header, and is not asserted here. + expect(isPlatformProvidedObjectName('sys_environment_credential')).toBe(true); + expect(CLOUD_PROVIDED_OBJECT_NAMES).toContain('sys_environment_credential'); + }); }); diff --git a/packages/spec/src/system/constants/platform-object-names.ts b/packages/spec/src/system/constants/platform-object-names.ts index f691ad7939d..c10c88f1e01 100644 --- a/packages/spec/src/system/constants/platform-object-names.ts +++ b/packages/spec/src/system/constants/platform-object-names.ts @@ -149,6 +149,7 @@ export const PLATFORM_OBJECTS_BY_PACKAGE: Readonly Date: Fri, 18 Sep 2026 00:05:48 +0000 Subject: [PATCH 2/2] fix(spec): attribute the cloud registration reading to its filer The list's header already says this half of the contract cannot be conformance-tested from this repository. The pin comment and the changeset stated the cloud registration chain as though this change had re-taken it; they now name it as a reading carried on the filer's name, at the cloud ref it was taken against, and say plainly that only the objectstack half is asserted here. Claude-Session: https://claude.ai/code/session_01JbZnqu8bt6YqfJsr9vaFb3 Co-authored-by: Claude --- .../spec-cloud-provided-environment-credential.md | 13 ++++++++----- .../system/constants/platform-object-names.test.ts | 14 +++++++++----- 2 files changed, 17 insertions(+), 10 deletions(-) diff --git a/.changeset/spec-cloud-provided-environment-credential.md b/.changeset/spec-cloud-provided-environment-credential.md index fd1571ceec4..b15aea36c29 100644 --- a/.changeset/spec-cloud-provided-environment-credential.md +++ b/.changeset/spec-cloud-provided-environment-credential.md @@ -15,12 +15,15 @@ an action parameter `reference`, a field `reference`, a dashboard `objects.` subtree naming `sys_environment_credential` all stop being diagnosed. -Why this name: `@objectstack/service-tenant` registers it in the cloud -repository on exactly the path the list's existing `sys_package`, -`sys_package_version` and `sys_package_installation` members take — -`objects/sys-environment-credential.object.ts` exported through +Why this name: as read in the cloud repository at `cb8ee7ff60`, +`@objectstack/service-tenant` registers it on exactly the path the list's +existing `sys_package`, `sys_package_version` and `sys_package_installation` +members take — `objects/sys-environment-credential.object.ts` exported through `objects/index.ts`, listed in `tenantObjects`, spread into -`manifestService.register({ objects })` by `tenant-plugin.ts`. +`manifestService.register({ objects })` by `tenant-plugin.ts`. That reading is +the cloud repository's and is carried here on its filer's name; per this list's +header it cannot be conformance-tested from this repo, and this change does not +claim to have re-taken it. Unlike the earlier additions, this one fixes no diagnostic that fires today: no `*.object.ts` in this repository references the name, so nothing shipped was diff --git a/packages/spec/src/system/constants/platform-object-names.test.ts b/packages/spec/src/system/constants/platform-object-names.test.ts index 2609d32754a..a903e5a11cd 100644 --- a/packages/spec/src/system/constants/platform-object-names.test.ts +++ b/packages/spec/src/system/constants/platform-object-names.test.ts @@ -186,8 +186,12 @@ describe('platform-object predicates', () => { }); it('resolves the tenant credential store the cloud runtime registers', () => { - // `sys_environment_credential` is registered by `@objectstack/service-tenant` - // on the same path as the `sys_package*` family above: declared in + // The cloud-side registration is a READING TAKEN IN THE CLOUD REPOSITORY, + // at `cb8ee7ff60`, and carried here on its filer's name — like every other + // member of this list, it is not re-checkable from this repo, which is what + // the list's own header means by "they cannot be conformance-tested from + // this repo". As read there, `@objectstack/service-tenant` registers the + // name on the same path as the `sys_package*` family above: declared in // `objects/sys-environment-credential.object.ts`, exported through // `objects/index.ts`, listed in `tenantObjects` in `manifest.ts`, and spread // into `manifestService.register({ objects })` by `tenant-plugin.ts`. @@ -202,9 +206,9 @@ describe('platform-object predicates', () => { // So the first author to write the reference would have been told it looked // like a typo. Pinned by name, beside `sys_license` and the package family, // for the same reason: dropping it fails one readable assertion instead of - // nothing. The other half of the contract — that the cloud runtime really - // registers the table — is owned by the cloud repository per the list's - // header, and is not asserted here. + // nothing. What this test asserts is the objectstack half alone — that the + // list carries the name and the predicate resolves it. The cloud half is + // owned by the cloud repository and is not asserted here. expect(isPlatformProvidedObjectName('sys_environment_credential')).toBe(true); expect(CLOUD_PROVIDED_OBJECT_NAMES).toContain('sys_environment_credential'); });