Merge remote-tracking branch 'origin/main' into claude/project-thread-xn40qf

Author: claude

.changeset/25629-org-logo-zh-label.md

@@ -0,0 +1,10 @@
+---
+'@objectstack/platform-objects': patch
+---
+
+fix(platform-objects): the zh-CN label for an organization's logo reads 「徽标」, no longer 「标识」, which read as the slug (「标识符」) on the same record page and in the Rename Organization dialog
+
+Clause-②: no
+Metadata-protocol: none
+
+`sys_organization.fields.logo.label` in the zh-CN bundle was 「标识」 ("identifier"), directly beside the slug's 「标识符」. The Rename Organization and Edit Organization dialogs take their `logo` param label from this field label, so a zh-CN admin read the logo URL input as the organization's identifier. ja-JP (「ロゴ」 / 「スラッグ」) and es-ES (「Logotipo」 / 「Slug」) had no such collision and are unchanged.

.changeset/25898-list-empty-state-access.md

@@ -0,0 +1,20 @@
+---
+'@object-ui/plugin-list': patch
+'@object-ui/plugin-grid': patch
+'@object-ui/i18n': patch
+---
+
+fix(plugin-list,plugin-grid): an empty list tells "no records you can see" and "nothing of yours yet" apart from "no records"
+
+Clause-②: no
+Metadata-protocol: none
+
+An empty list chose its copy from the user's query and the view's filter alone. A member who may read none of an object's records and may not create one was told "Nothing here yet / Create your first record to get started." beside no Create button, and every "my …" view (`owner` equals the current user) told someone who owns nothing "No records match this view's filter."
+
+- **No filter, no create grant.** When the permission answer has loaded and the caller does not hold the create grant (the `listNew` row of the affordance-to-grant map, the verdict the page's own New reads), the empty state reads "No records you can see" and asks the reader to contact an administrator. The add-record action is not drawn for that caller, even on a view that enables `addRecord`.
+- **A filter naming the signed-in user.** When the view's declared filter compares a field to the caller's own id (or still carries the `{current_user_id}` placeholder), the empty state reads "Nothing of yours yet", with the add-record action only under the create grant.
+- **Unchanged.** The first-run copy and action for a caller who may create, the user-query and view-filter copy, an authored `emptyState`, the 403 error panel, and every surface with no permission provider mounted.
+
+`ListView` (grid and gallery), the standalone `ObjectGallery` and `ObjectGrid`'s default empty state decide the same way. `@object-ui/i18n` gains `list.ownedNoneTitle`, `list.ownedNoneMessage`, `list.noneVisibleTitle` and `list.noneVisibleMessage` in all ten locale packs.
+
+What to do: nothing. A view that authors its own `emptyState` keeps it.

.changeset/25967-builtin-permission-set-descriptions.md

@@ -0,0 +1,14 @@
+---
+'@objectstack/plugin-security': patch
+---
+
+Every built-in permission set says who holds it, in English, Chinese, Japanese and Spanish
+
+Clause-②: no
+Metadata-protocol: none
+
+Setup → Permission Sets lists the platform's own permission sets beside every app's. Five of them (*Administrator — Full Access*, *Organization Administrator*, *Member — Standard Access*, *Viewer — Read-Only* and *External Member — Own Records*) had no description, and the no-bypass organization administrator set and the three MCP agent sets had descriptions written for platform engineers. An administrator picking a set for a new user could not tell an administrator set from a member set.
+
+Each built-in set now has one plain sentence saying who holds it and what it opens or withholds. For example, *Organization Administrator* reads "Owners and admins of an organization: full control of its records and members in Setup, but no app authoring or platform-wide settings." The sentences are translated into zh-CN, ja-JP and es-ES through the permission-set group of the translation bundle (`permissions.<name>.description`), so the page shows them in the user's language. The engineering detail that used to be in the no-bypass and MCP descriptions is now in code comments.
+
+No set's grants, name or label changed. This changes only the text shown about each set, not its permissions.

packages/lint/src/lazy-deps.test.ts

@@ -1,4 +1,5 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+// test-budget: 20 — whole-package import: the in-process case imports the whole @objectstack/lint barrel cold and loads each lazy dep on its trigger, and the two built-dist probes each spawn node once to cold-load the dist and every lazy dep (typescript among them); slowest CI reading 13.91 s (run 40200279306, refresh PR #25960's window (hourly runs 40200279306 to 40272142430)) x 1.25, rounded up
 //
 // Boot-path contract: importing @objectstack/lint must NOT load its heavy,
 // gate-only dependencies. The package sits on the kernel boot path, while each

packages/lint/src/non-record-object-entry.test.ts

@@ -87,10 +87,50 @@ const NON_RECORD_ENTRIES: readonly (readonly [string, unknown])[] = [
 ];
 
 const stackWith = (junk: unknown): AnyRec => ({ objects: [junk, VALID_OBJECT] });
-const validOnly: AnyRec = { objects: [VALID_OBJECT] };
+const validOnly = (): AnyRec => ({ objects: [VALID_OBJECT] });
 
-const findingCount = (stack: AnyRec): number =>
-  AUTHORING_RULES.reduce((n, rule) => n + rule.run(stack, {}).length, 0);
+/** What one rule did with one stack: the message it threw, or how many findings it returned. */
+type RuleOutcome = { readonly rule: string } & ({ readonly threw: string } | { readonly findings: number });
+
+/**
+ * One sweep per distinct stack. Every rule is pure, `(stack) => Finding[]`, so
+ * running the table once over a stack and recording what each rule did answers
+ * both questions a case asks of that stack — did any rule throw, and how many
+ * findings did the rest return. The "throws" case and the "count" case of one
+ * stack read the same sweep, and a control stack shared by every junk shape is
+ * swept once. Each rule still gets a stack of its own, built fresh.
+ */
+const sweeps = new Map<string, readonly RuleOutcome[]>();
+const sweep = (key: string, build: () => AnyRec): readonly RuleOutcome[] => {
+  let outcomes = sweeps.get(key);
+  if (!outcomes) {
+    outcomes = AUTHORING_RULES.map((rule): RuleOutcome => {
+      try {
+        return { rule: rule.name, findings: rule.run(build(), {}).length };
+      } catch (e) {
+        return { rule: rule.name, threw: (e as Error).message };
+      }
+    });
+    sweeps.set(key, outcomes);
+  }
+  return outcomes;
+};
+
+/** `rule: message` for every rule that threw. */
+const throwsOf = (outcomes: readonly RuleOutcome[]): string[] =>
+  outcomes.flatMap((o) => ('threw' in o ? [`${o.rule}: ${o.threw}`] : []));
+
+/**
+ * The finding count over every rule not in `skip`. A rule outside `skip` that
+ * threw fails the count with its own message rather than counting as zero, as
+ * the count did when it ran the rules itself.
+ */
+const countOf = (outcomes: readonly RuleOutcome[], skip: readonly string[] = []): number =>
+  outcomes.reduce((n, o) => {
+    if (skip.includes(o.rule)) return n;
+    if ('threw' in o) throw new Error(`${o.rule}: ${o.threw}`);
+    return n + o.findings;
+  }, 0);
 
 describe('a non-record entry in `stack.objects` (#15552)', () => {
   /**
@@ -103,23 +143,17 @@ describe('a non-record entry in `stack.objects` (#15552)', () => {
     expect(AUTHORING_RULES.length).toBeGreaterThanOrEqual(42);
   });
 
-  describe.each(NON_RECORD_ENTRIES)('with %s beside a valid object', (_label, junk) => {
+  describe.each(NON_RECORD_ENTRIES)('with %s beside a valid object', (label, junk) => {
+    const withJunk = (): readonly RuleOutcome[] => sweep(`objects · ${label}`, () => stackWith(junk));
+
     it('no authoring rule throws', () => {
-      const threw: string[] = [];
-      for (const rule of AUTHORING_RULES) {
-        try {
-          rule.run(stackWith(junk), {});
-        } catch (e) {
-          threw.push(`${rule.name}: ${(e as Error).message}`);
-        }
-      }
-      expect(threw).toEqual([]);
+      expect(throwsOf(withJunk())).toEqual([]);
     });
 
     it('still judges the valid object standing beside it', () => {
-      const baseline = findingCount(validOnly);
+      const baseline = countOf(sweep('objects · valid only', validOnly));
       expect(baseline).toBeGreaterThan(0);
-      expect(findingCount(stackWith(junk))).toBe(baseline);
+      expect(countOf(withJunk())).toBe(baseline);
     });
   });
 
@@ -575,19 +609,12 @@ describe('a non-record entry in any other stack collection (#15636)', () => {
 
     describe.each(NON_RECORD_ENTRIES)('with %s', (shape, junk) => {
       const key = `${collection.label} · ${shape}`;
+      const withJunk = (): readonly RuleOutcome[] => sweep(key, () => collection.stack(members(junk)));
 
       it('throws out of no rule but the ones still filed as broken', () => {
-        const threw: string[] = [];
-        const detail: string[] = [];
-        for (const rule of AUTHORING_RULES) {
-          try {
-            rule.run(collection.stack(members(junk)), {});
-          } catch (e) {
-            threw.push(rule.name);
-            detail.push(`${rule.name}: ${(e as Error).message}`);
-          }
-        }
-        expect(threw.sort(), detail.join(' | ')).toEqual([...(RESIDUAL_THROWS[key] ?? [])].sort());
+        const outcomes = withJunk();
+        const threw = outcomes.flatMap((o) => ('threw' in o ? [o.rule] : []));
+        expect(threw.sort(), throwsOf(outcomes).join(' | ')).toEqual([...(RESIDUAL_THROWS[key] ?? [])].sort());
       });
 
       it('invents no finding about the entry no author wrote', () => {
@@ -596,9 +623,8 @@ describe('a non-record entry in any other stack collection (#15636)', () => {
         // folding that into the population count would let a crash read as
         // "reported nothing", which is the confusion this file exists to end.
         const skip = RESIDUAL_THROWS[key] ?? [];
-        const count = (stack: AnyRec): number =>
-          AUTHORING_RULES.reduce((n, rule) => (skip.includes(rule.name) ? n : n + rule.run(stack, {}).length), 0);
-        expect(count(collection.stack(members(junk))) - count(control())).toBe(RESIDUAL_INVENTED[key] ?? 0);
+        const controlOutcomes = sweep(`${collection.label} · control`, control);
+        expect(countOf(withJunk(), skip) - countOf(controlOutcomes, skip)).toBe(RESIDUAL_INVENTED[key] ?? 0);
       });
     });
   });

packages/lint/src/runtime-lazy-deps.test.ts

@@ -1,4 +1,5 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+// test-budget: 20 — whole-package import: the in-process cases import the @objectstack/lint/runtime entry cold, which reaches the whole gate graph, and the built-dist probes each spawn node once to cold-load it; slowest CI reading 13.05 s (run 40200279306, refresh PR #25960's window (hourly runs 40200279306 to 40272142430)) x 1.25, rounded up
 //
 // The kernel boot-path contract for `@objectstack/lint/runtime` (#4463).
 //

packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts

@@ -535,7 +535,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
         help: "适合 URL 使用的标识符"
       },
       logo: {
-        label: "标识"
+        label: "徽标"
       },
       metadata: {
         label: "元数据",

packages/plugins/plugin-security/src/objects/default-permission-sets.test.ts

@@ -394,6 +394,10 @@ describe('sys_comment_reaction delete is ownership-shaped (#22566)', () => {
  * And `manage_mailboxes` (ruling 6116489638, Q4 → A on the inbound-mail record —
  * platform and organization administrators hold the mailbox administrator
  * capability by default).
+ *
+ * The set's `description` is admin-facing copy, not capability, so it is left
+ * out of the comparison (its shape is pinned by
+ * `permission-set-descriptions.test.ts`).
  */
 describe('admin_full_access imports the kernel capability declaration unchanged (#11965)', () => {
   it('parsed declaration deep-equals the pre-#11965 inline literal', () => {
@@ -432,7 +436,8 @@ describe('admin_full_access imports the kernel capability declaration unchanged
           .map(([name]) => [`sys_user.${name}`, { readable: true, editable: true }]),
       ),
     });
-    expect(setByName('admin_full_access')).toEqual(preMove);
+    const { description: _copy, ...declared } = setByName('admin_full_access') as Record<string, unknown>;
+    expect(declared).toEqual(preMove);
   });
 
   it('[#21260] no other shipped set carries the ledger audit capability: every other position holds it only by explicit grant', () => {

packages/plugins/plugin-security/src/objects/default-permission-sets.ts

@@ -324,6 +324,11 @@ const baseDefaultPermissionSets: PermissionSet[] = [
   PermissionSetSchema.parse({
     name: ADMIN_FULL_ACCESS,
     label: 'Administrator — Full Access',
+    // Admin-facing copy on Setup → Permission Sets: one business sentence, no
+    // engineering terms (the detail lives in the comments beside each set).
+    // `permission-set-descriptions.test.ts` pins the shape for every set here.
+    description:
+      'Platform operators: read and change every record in every organization, manage all users and settings, and author apps in Studio.',
     // [#11965 / #11663 Choice 6A] The capability CONTENT (object wildcard +
     // `systemPermissions`) is the kernel platform-admin declaration exported
     // by `@objectstack/spec` — one list, imported here and read by core's
@@ -378,6 +383,10 @@ const baseDefaultPermissionSets: PermissionSet[] = [
   PermissionSetSchema.parse({
     name: ORGANIZATION_ADMIN,
     label: 'Organization Administrator',
+    // Inherited by `organization_admin_no_bypass` through the derivation's
+    // spread, which then writes its own.
+    description:
+      'Owners and admins of an organization: full control of its records and members in Setup, but no app authoring or platform-wide settings.',
     objects: {
       '*': {
         allowRead: true,
@@ -590,6 +599,10 @@ const baseDefaultPermissionSets: PermissionSet[] = [
   PermissionSetSchema.parse({
     name: 'member_default',
     label: 'Member — Standard Access',
+    // No business object is named here (see the NO-WILDCARD note below), so the
+    // copy says where business access comes from instead.
+    description:
+      "Every signed-in member's baseline: their own profile, keys and inbox and the member directory; business records come from their other sets.",
     objects: {
       // [#5491] NO `'*'` WILDCARD GRANT. This set is the additive `everyone`
       // baseline — it resolves for EVERY authenticated member — and object
@@ -1130,6 +1143,10 @@ const baseDefaultPermissionSets: PermissionSet[] = [
   PermissionSetSchema.parse({
     name: 'viewer_readonly',
     label: 'Viewer — Read-Only',
+    // A read wildcard without the superuser bits: row visibility is still
+    // sharing's, so the copy says "as far as sharing allows", not "every record".
+    description:
+      'Read-only users: read records across every object, as far as sharing allows, but create, edit or delete nothing.',
     objects: {
       '*': {
         allowRead: true,
@@ -1282,6 +1299,8 @@ const baseDefaultPermissionSets: PermissionSet[] = [
   PermissionSetSchema.parse({
     name: EXTERNAL_DEFAULT_PERMISSION_SET,
     label: 'External Member — Own Records',
+    description:
+      'People from outside the organization, such as customers or suppliers: their own profile and records, plus only what is shared with them.',
     objects: {
       // Self-service profile edits, bounded exactly as `member_default`'s
       // (`sys_user_self` below + the ADR-0092 D2 column whitelist).
@@ -1475,20 +1494,24 @@ const baseDefaultPermissionSets: PermissionSet[] = [
   PermissionSetSchema.parse({
     name: MCP_AGENT_PERMISSION_SET_READ,
     label: 'MCP Agent — Read Only',
+    // The read-only ceiling for an agent acting on behalf of a user, from the
+    // OAuth `data:read` scope; bounded by the delegating user's own
+    // permissions (the D10 intersection above).
     description:
-      'Read-only ceiling for an AI agent acting on behalf of a user (OAuth `data:read`). ' +
-      'Bounded by the delegating user\'s own permissions.',
+      'AI assistants a user connects with read access: they read what that user can read and change nothing.',
     objects: {
       '*': { allowRead: true },
     },
   }),
   PermissionSetSchema.parse({
     name: MCP_AGENT_PERMISSION_SET_WRITE,
     label: 'MCP Agent — Read & Write',
+    // The read+write ceiling for an agent acting on behalf of a user, from the
+    // OAuth `data:write` scope: full CRUD, still bounded by the delegating
+    // user's own permissions. The better-auth managed identity tables stay
+    // read-only ("user and sign-in data" in the copy).
     description:
-      'Read+write ceiling for an AI agent acting on behalf of a user (OAuth `data:write`). ' +
-      'Full CRUD, still bounded by the delegating user\'s own permissions. ' +
-      'Identity tables stay read-only (better-auth managed).',
+      'AI assistants a user connects with read and write access: they read and change what that user can, except user and sign-in data.',
     objects: {
       '*': { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true },
       // Even a write-scoped agent must not mutate better-auth identity tables
@@ -1500,9 +1523,11 @@ const baseDefaultPermissionSets: PermissionSet[] = [
   PermissionSetSchema.parse({
     name: MCP_AGENT_PERMISSION_SET_RESTRICTED,
     label: 'MCP Agent — No Data Access',
+    // The no-object-access floor for an agent with no data scope (for example
+    // `actions:execute` only). It keeps the resolved set list non-empty so
+    // enforcement fails CLOSED, never open.
     description:
-      'No-object-access floor for an agent with no data scope (e.g. `actions:execute` only). ' +
-      'Keeps the resolved set list non-empty so enforcement fails CLOSED, never open.',
+      'AI assistants a user connects without data access: they can run the actions they were allowed, but read or change no record.',
     objects: {},
   }),
 ];
@@ -1534,6 +1559,12 @@ const baseDefaultPermissionSets: PermissionSet[] = [
 function deriveWallLessOrgAdmin(base: PermissionSet): PermissionSet {
   // [ADR-0105 D4 / finding F2] The description is admin copy on Setup's
   // Permission Sets page, so the decision ids stay here, not in the string.
+  // The engineering reading: organization administration WITHOUT blanket
+  // record visibility, granted instead of `organization_admin` when the tenancy
+  // posture enforces no organization wall, where nothing would bound the
+  // superuser bits. Ownership, sharing and business RLS still apply; grant
+  // `admin_full_access` (or an explicit set carrying the bits) when a
+  // deployment-wide data superuser is genuinely intended.
   const objects: Record<string, any> = { ...(base.objects ?? {}) };
   const { viewAllRecords: _v, modifyAllRecords: _m, ...wildcardWithoutBypass } =
     (objects['*'] ?? {}) as Record<string, unknown>;
@@ -1543,11 +1574,7 @@ function deriveWallLessOrgAdmin(base: PermissionSet): PermissionSet {
     name: ORGANIZATION_ADMIN_NO_BYPASS,
     label: 'Organization Administrator (no record bypass)',
     description:
-      'Organization administration WITHOUT blanket record visibility. Granted instead of ' +
-      '`organization_admin` when the tenancy posture enforces no organization wall, where nothing ' +
-      'would bound the superuser bits. Ownership, sharing and business ' +
-      'RLS still apply; grant `admin_full_access` (or an explicit set carrying the bits) when a ' +
-      'deployment-wide data superuser is genuinely intended.',
+      'Organization admins on a deployment with no wall between organizations: the same administration, but only the records their ownership and sharing open.',
     objects,
   });
 }