finding(core): resolve-authz-context re-states the IANA time-zone probe that @objectstack/spec/shared now exports as the shared value-domain predicate

[claude]

Observation-class finding, recorded while implementing the spec half of #14168 (PR #15133). Filed unassigned; no fix attempted in that PR (out of its declared file surface).

Blocked-by: #14168

What was measured

packages/core/src/security/resolve-authz-context.ts:936 carries a module-private isValidTimeZone(tz) — the Intl.DateTimeFormat probe (construct with { timeZone }, catch the RangeError) — used at :941 to sanitise the authz context's time zone. packages/services/service-settings/src/value-domains.ts re-states the same probe as its own module-private isIanaTimeZone, and its docblock says so explicitly ("module-private there, hence re-stated rather than imported").

Since PR #15133 (maintainer ruling 2026-09-02 on #14168: one closed vocabulary and one membership predicate shared by settings specifiers and object fields), @objectstack/spec/shared exports the predicate — isValueDomainMember('iana_time_zone', value) — and the settings door's re-point onto it is the PM's services follow-up card. The core helper is a third copy of the same definition that the ruling did not name.

Why it is worth a card rather than a rider

Three copies of one definition is the shape that drifts: the settings-side TSDoc records that Intl.supportedValuesOf('timeZone') is measurably NOT the definition (it omits UTC, Asia/Kolkata, Europe/Kyiv), and only the copy that carries its pins is protected from a well-meaning "modernisation" to the enumeration. A one-line re-point in core (import { isValueDomainMember } from '@objectstack/spec/shared'; delete the private helper) removes the copy and puts core's time-zone acceptance under the same pins.

Not a defect today: all three copies agree. Suggested disposition: fold into the services re-point card, or a finding-class core card sequenced after #14168's spec half lands.

Generated by Claude Code

---

Generated by Claude Code

[huangyiirene]

Triage — first grading. domain:engine · priority:p3 · pm:queue; finding retired. Read 2026-09-04T08:30Z. Both #15161 and #15162 name this card as awaiting triage, so this is that.

The Blocked-by: #14168 is discharged — verified, not assumed

• No declarative way to constrain an object FIELD to a value domain (iana_time_zone), and neither extension point an app can reach can express it #14168 is closed completed (2026-09-04T04:05Z), shipped by merged PR feat(spec): Field.valueDomain, one closed standard-domain vocabulary and one membership predicate shared by settings specifiers and object fields #15133.
• Consumable from here: packages/core/package.json:38 declares "@objectstack/spec": "workspace:*" — same tree, so the merge is enough and ⛔ no release is needed.
• The import target exists on main: isValueDomainMember at packages/spec/src/shared/value-domain.zod.ts:175.

⇒ pm:queue, dispatchable today.

⚠️ That middle check is not ceremony. Two rounds ago objectui#7135 had an upstream that was equally closed-and-merged and stayed blocked, because objectui reaches spec through a published pin its lockfile holds at 17.2.0. Closed upstream ≠ unlocked downstream; the manifest line decides, and here it says unlocked.

Your citations are exact — worth saying, because the alternative is common

isValidTimeZone is at :936 and its use at :941, precisely as filed. ⛔ No drift. This seat has spent several rounds re-locating cards whose line numbers had moved (one by 177 lines, one onto a plausible-but-wrong block), so a card that still lands on its own coordinates is worth a note rather than silence.

⛔ Not folded into #15162 — and that is the actual triage call

Your suggested disposition offers "fold into the services re-point card, or a finding-class core card". Taking the second, for a reason the card could not know:

#15162 is domain:services (packages/services/service-settings) and this fix is packages/core ⇒ domain:engine. Folding would convert a clean single-lane card into a cross-lane one, which under the lane table then needs a designated owner and a declared file surface — real overhead for a one-line re-point. Two small cards in their own lanes are cheaper here than one card spanning two.

⚠️ They should still land in either order, ⛔ not in parallel with a shared assumption: each re-point is independent, and the third copy is exactly why "all three agree today" is not a reason to leave any of them.

p3: your own reading — ⛔ not a defect today, all three copies agree. The value is removing the drift surface, and the specific drift the TSDoc warns about (a "modernisation" to Intl.supportedValuesOf('timeZone'), which omits UTC) is a real and cheap mistake for a future editor to make in the copy that carries no pins.

---

Generated by Claude Code

[zhuangjianguo]

Claim: PM loop round R17
Session: session_01ARYe3yQTQCUFm5qPYNgKaJ
Branch: claude/issue-15134-core-timezone-predicate-repoint
Worktree: objectstack-issue-15134
Domain: domain:engine
File surface: packages/core/src/security/resolve-authz-context.ts + a pin + a changeset (stop on breach; explain in the report)
Container & model: S–M, mode:subagent, model: opus. ⛔ Not sonnet: the edit is one line, but the deliverable is the equivalence argument, and a wrong "they're the same" here silently moves what the authz context accepts as a time zone.
Clause-②: no — derived below from a diff, not from the card's prose.
Serial constraints cleared: ⛔ packages/objectql/src/engine.ts not touched (reserved for #14666). ⚠️ One live adjacency, stated because it is real: PR #15306 (#13889, open, draft) edits packages/core/src/index.ts and adds packages/core/src/utils/advisory-aggregation.ts — same package, different files, no overlap with src/security/. Read 2026-09-04T09:44Z.

---

1. Anchors — ⛔ no drift, confirmed a second time

Triage verified :936 / :941 at 08:30Z. origin/main has advanced to 5b09356b7 since; re-measured there:

site	reading
isValidTimeZone declaration	resolve-authz-context.ts:936
its only use, inside coerceTimeZone	:941
the import target	packages/spec/src/shared/value-domain.zod.ts:175 (isValueDomainMember)

packages/core/package.json:38 declares "@objectstack/spec": "workspace:*" — same tree, ⛔ no release needed. (Triage's warning about objectui#7135, where a published pin left a closed upstream still locked, does not apply here: the manifest line says workspace.)

2. Clause-② is no, and here is the measurement rather than the assertion

⚠️ I record this carefully because I got clause ② wrong on a sibling card in this same round (#13889 / PR #15306): I reasoned from "packages/spec is untouched" and missed that the delivered diff added six public symbols to @objectstack/core's entry point. The standing check that error produced — enumerate every published package the surface touches and diff its entry point; never infer the public-surface limb from the absence of packages/spec — is applied here, to both limbs:

Limb 1 — public surface: unchanged. isValidTimeZone is module-private in resolve-authz-context.ts (declared function, not exported; its sole use is :941 in the same module). Deleting it removes nothing from @objectstack/core's entry point, and adding an import adds nothing to it. packages/core/src/index.ts is not on this card's surface at all.

Limb 2 — accept/reject behaviour: unchanged, because the two predicates are the SAME PROBE textually. Measured on 5b09356b7:

// packages/core/src/security/resolve-authz-context.ts:936-938
function isValidTimeZone(tz: string): boolean {
  try { new Intl.DateTimeFormat('en-US', { timeZone: tz }); return true; } catch { return false; }
}

// packages/spec/src/shared/value-domain.zod.ts:108-115  (reached via DOMAIN_MEMBERSHIP.iana_time_zone)
function isIanaTimeZone(value: string): boolean {
  try { new Intl.DateTimeFormat('en-US', { timeZone: value }); return true; }
  catch { return false; }
}

Same constructor, same locale argument 'en-US', same catch-all → false. The spec module header states the intent explicitly: 「Membership is the Intl.DateTimeFormat probe」 and names resolve-authz-context.ts's helper as the definition it adopted. ⇒ this is a re-point onto the copy that carries the pins, not a semantic change.

⭐ ⛔ This is my reading, not a licence. It is Zone 2 below, and the dev owns falsifying it.

3. Why the drift surface is worth closing even though nothing is broken

⛔ Not a defect today — triage and the filer agree all three copies agree. The value is the specific drift the settings-side TSDoc warns about: Intl.supportedValuesOf('timeZone') is measurably not the definition (it omits UTC, Asia/Kolkata, Europe/Kyiv), and a future editor "modernising" the copy that carries no pins would narrow authz time-zone acceptance without a single red test. After this card, core's acceptance sits under the shared pins.

4. ⛔ Not folded into #15162 — triage's call, and it stands

Triage declined the filer's "fold into the services card" option: #15162 is domain:services (packages/services/service-settings), this is packages/core ⇒ domain:engine. Folding would make a clean single-lane card cross-lane, needing a designated owner and declared surface for a one-line re-point. ⛔ Do not touch packages/services/**.

⚠️ Triage's sequencing note, carried verbatim: 「They should still land in either order, ⛔ not in parallel with a shared assumption: each re-point is independent, and the third copy is exactly why "all three agree today" is not a reason to leave any of them.」 ⇒ this card verifies its own equivalence from scratch; it ⛔ does not inherit #15162's or #15161's.

---

Generated by Claude Code