Merge commit 'c2c21f357c' into claude/issue-21326-aad-scope-discriminant

Author: claude

.changeset/21385-driver-sql-refusal-log-lines-cut.md

@@ -0,0 +1,14 @@
+---
+'@objectstack/driver-sql': patch
+---
+
+fix(driver-sql): the driver's own refusal log lines no longer write the statement or the values bound into it
+
+Clause-②: no
+
+Five warning lines wrote the dialect's message to the server log as it came back. That message opens with the statement, with its bound values inlined on SQLite and MySQL, and on PostgreSQL a value-bearing diagnostic carries the value itself. The lines are the read terminal, the raw-statement terminal, and the refusals for a WHERE, a groupBy or aggregation, and a listed-distinct column the backend could not resolve. Each line now writes the dialect's text through the driver-fault redaction in `@objectstack/types`, the cut the engine applies at its boundary.
+
+- **What stays on each line.** Its code, the class of fault it reports, the object and column it names, the dialect's error code where the line printed one, and the dialect's own diagnostic.
+- **What goes.** The statement and the values bound or inlined into it, replaced by `[statement and bound values redacted]`, and the value slot of each diagnostic the redaction's templates own, replaced by `[value redacted]`. The raw-statement line no longer writes the statement it was sent, which also holds for `@objectstack/driver-turso`'s remote transport, whose refusals reach the same line. The two debug lines the read terminal writes inside a pre-DDL question, or for a table whose DDL the driver deferred, take the same cut.
+- **The envelopes.** The code, status, `cause` and withheld text of every refusal are unchanged. Two composed messages, the read terminal's `DATABASE_ERROR` and the raw-statement terminal's, said the statement was written to the server log; they now say the diagnostic was written with the statement and its bound values cut.
+- **What changes for an operator.** A log reader that took the statement or a bound value from these lines now finds the marker where the dialect's text carried them, and nothing where the raw-statement line wrote the sent statement on its own. The diagnostic, the codes and the named object and column are where they were.

.changeset/21385-objectql-redaction-from-types.md

@@ -0,0 +1,9 @@
+---
+'@objectstack/objectql': patch
+---
+
+refactor(objectql): the engine takes its driver-fault redaction from `@objectstack/types`
+
+Clause-②: no
+
+The redaction the engine applies to its write-path log lines, at its boundary, at the raw-statement door and in the lifecycle sweep now lives in `@objectstack/types`, so `@objectstack/driver-sql` calls the same cut. The engine calls it as before, with the same arguments, and its answers are unchanged. None of the moved names was exported from `@objectstack/objectql`'s entries, so its public surface does not move.

.changeset/21385-types-driver-fault-redaction-home.md

@@ -0,0 +1,12 @@
+---
+'@objectstack/types': minor
+---
+
+feat(types): the driver-fault redaction is exported from types, so a driver's own log lines take the same cut the engine applies
+
+Clause-②: no
+
+- **New exports.** `redactBoundStatement`, `redactStatementFromMessage`, `redactPropagatedDriverFault` and the `DriverFaultOrigin` type are exported from `@objectstack/types`, by name. They moved here from `@objectstack/objectql`, which never exported them from its entries. The cut is unchanged by the move: the same split, the same structural cut at the separator, the same value templates and the same property rules.
+- **Why here.** `@objectstack/driver-sql`, `@objectstack/objectql` and `@objectstack/core` all depend on this package, and `operatorFacingErrorText` lives in it, so this is the lowest package all of them can import the cut from. The module imports only this package's own leak predicate, which is unchanged.
+- **One widening, on the log face.** `redactStatementFromMessage` takes an optional second argument, `{ statementSent: true }`. With it the cut runs without asking the shared leak predicate, as `redactPropagatedDriverFault` already did with the same flag. Without it the function answers exactly as before.
+- **Why minor.** The package gains four exported names, and `redactStatementFromMessage` gains the optional parameter above. No existing export of `@objectstack/types` changes.

packages/drivers/driver-sql/src/schema-drift.ts

@@ -1290,7 +1290,7 @@ export function diffManagedTable(args: {
     // never revisits an existing column, so a deployment upgrading into that
     // release gets no change AND no diagnostic. The server keeps refusing the
     // same write, and the refusal is a poor substitute for a report: the live
-    // probe behind `objectql`'s `driver-fault-redaction.ts` measured Postgres's
+    // probe behind `types`' `driver-fault-redaction.ts` measured Postgres's
     // `22001` as identifier-only and naming the TYPE rather than the column
     // (`value too long for type character varying(255)`), MySQL's `1406` as
     // `Data too long for column 'label' at row 1`. Meanwhile every

packages/drivers/driver-sql/src/schema-drift.unbounded-text-column.test.ts

@@ -28,7 +28,7 @@
  * never revisits an existing one — so a deployment upgrading into that release
  * gets no change AND no diagnostic, while the server keeps refusing the same
  * write. That refusal is a poor substitute for a report: the live probe behind
- * `objectql`'s `driver-fault-redaction.ts` measured Postgres's `22001` as
+ * `types`' `driver-fault-redaction.ts` measured Postgres's `22001` as
  * identifier-only and naming the TYPE rather than the column (`value too long
  * for type character varying(255)`).
  *

packages/drivers/driver-sql/src/sql-driver-11455-aggregate-fault-envelope.test.ts

@@ -241,12 +241,19 @@ describe(`[#11455] driver-sql — aggregate() takes the backend-fault envelope (
   // THE LOG — a withholding, not a deletion
   // ───────────────────────────────────────────────────────────────
 
-  it('writes the full dialect text to the SERVER LOG, statement included', async () => {
+  it('writes the dialect diagnostic to the SERVER LOG, the statement cut', async () => {
     const { err, logged } = await withLog(driver, () => driver.aggregate(MISSING_TABLE, COUNT_ALL));
     expect(err.code).toBe('DATABASE_ERROR');
     const line = logged.find((l) => l.includes(MISSING_TABLE));
     expect(line, 'an operator must still be able to read what the backend said').toBeDefined();
-    expect(String(line)).toMatch(/\bselect\b/i);
+    // [#21385, maintainer ruling 2026-10-02] A redaction, not a deletion, and
+    // since this ruling a cut one: the dialect's diagnostic still reaches the
+    // log for an operator, the statement and its bound values do not (a server
+    // log leaves the data's trust boundary). The cut's marker says one stood
+    // there. The sentinel pins for this line live in
+    // `sql-driver-21385-refusal-log-line-redaction.test.ts`.
+    expect(String(line)).not.toMatch(/\bselect\b/i);
+    expect(String(line)).toContain('[statement and bound values redacted]');
     expect(String(line)).toContain('DATABASE_ERROR');
   });
 

packages/drivers/driver-sql/src/sql-driver-11541-aggregate-unresolvable-column-refusal.test.ts

@@ -274,7 +274,12 @@ describe(`[#11541] driver-sql — aggregate() attributes an unresolvable column
     // The withholding half: the dialect's own words reach the operator.
     const line = logged.find((l) => l.includes('INVALID_FIELD') && l.includes('nosuchcol'));
     expect(line, 'the dialect message must reach the server log').toBeDefined();
-    expect(String(line), 'the log carries the compiled statement').toMatch(/\bselect\b/i);
+    // [#21385, maintainer ruling 2026-10-02] …cut: the compiled statement and
+    // the literal bound into it no longer reach the log (a server log leaves
+    // the data's trust boundary); the cut's marker says a statement stood there.
+    expect(String(line), 'the log no longer carries the compiled statement').not.toMatch(/\bselect\b/i);
+    expect(String(line).includes(SECRET_LITERAL), 'the bound literal reached the log').toBe(false);
+    expect(String(line)).toContain('[statement and bound values redacted]');
   });
 
   // ───────────────────────────────────────────────────────────────

packages/drivers/driver-sql/src/sql-driver-16019-raw-statement-fault-envelope.test.ts

@@ -139,14 +139,20 @@ describe('[#16019] SqlDriver.execute() declares a backend refusal as DATABASE_ER
     expect(looksLikeInternalErrorLeak('no such column: bogus_dim')).toBe(true);
   });
 
-  it('writes the statement and the dialect message to the server log — after this change, the only copy', async () => {
+  it("writes the dialect's diagnostic to the server log, with the statement cut", async () => {
     await faultOf(() => driver.execute(TRANSLATE_SQL));
 
     const line = driver.warned.find((m) => m.includes('DATABASE_ERROR'));
     expect(line).toBeDefined();
     expect(line).toContain('(SQLITE_ERROR)');
-    expect(line).toContain(TRANSLATE_SQL);
     expect(line).toContain('no such function: translate');
+    // [#21385, maintainer ruling 2026-10-02] The line used to write the
+    // statement too, sent and compiled. Both carry the values a raw statement
+    // binds or spells inline, and a server log leaves the data's trust
+    // boundary, so neither is written: the cut's marker stands in their place.
+    expect(line).not.toContain(TRANSLATE_SQL);
+    expect(line).not.toContain('statement: ');
+    expect(line).toContain('[statement and bound values redacted]');
   });
 
   it('a missing table on the raw path stays classifiable through `cause` (isMissingTableError)', async () => {

packages/drivers/driver-sql/src/sql-driver-17639-distinct-fault-envelope.test.ts

@@ -245,12 +245,19 @@ describe(`[#17639] driver-sql — distinct() takes the backend-fault envelope ($
   // THE LOG — a withholding, not a deletion
   // ───────────────────────────────────────────────────────────────
 
-  it('writes the full dialect text to the SERVER LOG, statement included', async () => {
+  it('writes the dialect diagnostic to the SERVER LOG, the statement cut', async () => {
     const { err, logged } = await withLog(driver, () => driver.distinct(MISSING_TABLE, 'title'));
     expect(err.code).toBe('DATABASE_ERROR');
     const line = logged.find((l) => l.includes(MISSING_TABLE));
     expect(line, 'an operator must still be able to read what the backend said').toBeDefined();
-    expect(String(line)).toMatch(/\bselect\b/i);
+    // [#21385, maintainer ruling 2026-10-02] A redaction, not a deletion, and
+    // since this ruling a cut one: the dialect's diagnostic still reaches the
+    // log for an operator, the statement and its bound values do not (a server
+    // log leaves the data's trust boundary). The cut's marker says one stood
+    // there. The sentinel pins for this line live in
+    // `sql-driver-21385-refusal-log-line-redaction.test.ts`.
+    expect(String(line)).not.toMatch(/\bselect\b/i);
+    expect(String(line)).toContain('[statement and bound values redacted]');
     expect(String(line)).toContain('DATABASE_ERROR');
   });
 

packages/drivers/driver-sql/src/sql-driver-17857-distinct-unresolvable-column-refusal.test.ts

@@ -251,12 +251,19 @@ describe(`[#17857] driver-sql — distinct() attributes an unresolvable column (
     expect(err.code).not.toBe('DATABASE_ERROR');
   });
 
-  it('arm 1: writes the full dialect text to the SERVER LOG, statement included', async () => {
+  it('arm 1: writes the dialect diagnostic to the SERVER LOG, the statement cut', async () => {
     const { err, logged } = await withLog(driver, () => driver.distinct(TABLE, MISSING_COLUMN));
     expect(err.code).toBe('INVALID_FIELD');
     const line = logged.find((l) => l.includes(MISSING_COLUMN));
     expect(line, 'an operator must still be able to read what the backend said').toBeDefined();
-    expect(String(line), 'the withheld statement is in the log').toMatch(/\bselect\b/i);
+    // [#21385, maintainer ruling 2026-10-02] A redaction, not a deletion, and
+    // since this ruling a cut one: the dialect's diagnostic still reaches the
+    // log for an operator, the statement and its bound values do not (a server
+    // log leaves the data's trust boundary). The cut's marker says one stood
+    // there. The sentinel pins for this line live in
+    // `sql-driver-21385-refusal-log-line-redaction.test.ts`.
+    expect(String(line), 'the withheld statement is cut from the log').not.toMatch(/\bselect\b/i);
+    expect(String(line), 'the cut says a statement stood there').toContain('[statement and bound values redacted]');
     expect(String(line), 'the log line names the envelope it produced').toContain('INVALID_FIELD');
   });