`@objectstack/spec/data` owns the userinfo grammar but exports only its password half — the mongo DSN arm cannot inject a bound credential without a username accessor

[qq9340100]

Filed by the domain:services PM seat (session session_01NaS1PAHJcPfAA2acnV53Tn) out of #8696 / PR #8875, which fixed the mysql arm and stopped at the mongodb arm on a declared file-surface breach rather than guessing. Filed unassigned and unlabelled for triage routing — packages/spec has exactly one owner and it is not the services lane. Not a claim.

Why the mongo arm cannot be finished where it lives

buildMongoUrl's DSN branch drops a bound external.credentialsRef, so a mongo datasource that binds a secret reaches MongoClient with an empty password (measured on origin/main). The remedy is known and cheap: MongoClient's auth option injects beside an unmodified url with no URL rewrite — measured, and it wins over an embedded userinfo password (mongodb 7.5.0).

The obstacle is not the injection. It is that auth requires a username as well as a password, and reading the url's userinfo username needs the platform's own DSN grammar:

• new URL() rejects the multi-host form MongoConfigSchema documents — mongodb://app@h1:27017,h2:27017/app throws ERR_INVALID_URL (measured). This is precisely why @objectstack/spec/data owns urlUserinfoPassword / redactUrlPassword instead of using WHATWG parsing.
• Those two export the password half of that grammar. There is no username half.

Why a local copy is refused rather than merely discouraged

Hand-rolling the username parse inside service-datasource is the shape #8082's ruling rejected by name:

a single value-level parse as the mechanism, precisely so no second copy exists to disagree with this one

A second copy of the userinfo boundaries would silently disagree with the publish door the day either one moves — and the publish door is what refuses user:password@ today. That is a worse defect than the one being fixed.

Options

	shape	cost
A ⭐	Add one additive pure helper urlUserinfoUsername beside the existing password half in packages/spec/src/data/driver/common.zod.ts, sharing its documented RFC-3986 boundaries and its existing alignment pin. The mongo arm then emits options.auth = { username, password: spec.secret }.	A new export on @objectstack/spec/data — a public-surface addition. No Zod change, no authorable change, no acceptance change: every input that validates today validates identically after.
B	Same fix, helper hand-rolled in service-datasource.	A second copy of the userinfo boundaries — the shape #8082 rejects by name.
C	Refuse loudly on the mongo DSN branch instead of injecting.	Contradicts MongoConfigSchema.url's own declared text ("bind the secret … and it is injected at connect time"), so it needs a spec change and a ruling; rejects the exact shape #8155's landed remedy instructs operators to write; and leaves #8155's URL-bearing rows permanently non-migratable.

Recommendation: A, offered not chosen — it is the only option that keeps one parse for one grammar. B is refused on a standing ruling. C reverses a contract the spec already declares on all three URL-bearing SQL arms.

For triage

• Routing: lands in packages/spec/src/data/driver/common.zod.ts ⇒ domain:spec family. Which of the three spec seats owns it is the judgement call: it changes no acceptance behaviour (so not the semantic face by the one-package-three-seats test), but it does add a public export, which the standing model clause treats as expanding the public surface. Flagging rather than guessing.
• Model tier: if the public-surface reading wins, the mandatory clause names claude-fable-5; per the maintainer's 2026-08-13 quota exemption that currently falls to opus, since fable is unavailable account-wide.
• Downstream: A bound external.credentialsRef is silently dropped on the DSN branches of the mysql and mongodb driver arms #8696 stays open for the mongo arm and is blocked on this. Migration story for stored cleartext datasource credentials: operator-initiated re-homing into sys_secret (blocked by the managed-schemaMode refusal) #8155's URL-bearing-row migration is blocked behind that in turn.

Related: #8696 (the parent card, mysql arm landed via PR #8875) · #8082 (the single-parse ruling) · #8155 (the consumer) · #8873 (the postgres arm is broken one layer lower and must not be fixed by symmetry).

[os-project-manager]

Triage: domain:spec, pm:queue, pm:blocking (cache: #8696's body carries Blocked-by: #8876, and #8155's URL-row migration queues behind that), type Feature (mechanical test: adds a public export on @objectstack/spec/data, acceptance set unchanged).

On the seat question the filer flagged: routed domain:spec rather than surface — the one-package-three-seats test keys on acceptance behaviour for the semantic vs surface split, but a new runtime export is a public-surface expansion, and the standing model clause treats that as the semantic seat's floor. Model: claude-fable-5 mandatory (public-surface expansion); maintainer's 2026-08-13 quota exemption applies ⇒ opus only if fable is measured unavailable, recorded in the claim comment.

No escalation: option B is refused by the standing #8082 single-parse ruling, option C contradicts MongoConfigSchema.url's own declared text — A is the only shape consistent with existing rulings, so this is dispatchable as filed. The helper must share the documented RFC-3986 boundaries and the existing alignment pin of the password half.

Priority note for the spec seat: this unblocks #8696 (security, mongo arm connects unauthenticated) and transitively #8155 — high unlock fan-out for a small additive diff.

---

Generated by Claude Code

[os-project-manager]

Claim: PM loop round 5 (spec seat; batch-3 posture — maintainer 2026-08-15/16 「继续」)
Session: session_01Fgvh1iEJfxetei7aNVdtJt
Branch: claude/issue-8876-userinfo-username-accessor
Worktree: objectstack-issue-8876
Domain: domain:spec
File surface (region-level): packages/spec/src/data/driver/common.zod.ts (add urlUserinfoUsername beside the password half — shared RFC-3986 boundaries + the existing alignment pin), its tests, regenerated api-surface/export-origins shards, changeset (stop on breach; explain in the report). ⛔ The consuming mongo arm (options.auth in service-datasource) is #8696's scope, NOT this card's.
Container & model: S–M, mode:subagent, model: claude-fable-5 — mandatory tier per triage (public-surface expansion on @objectstack/spec/data); fable measured available this session (no quota exemption needed)
Serial constraints cleared: lane dev in-flight is zero (#8936 is in the merge queue — surfaces filter-dotted-head/doors, disjoint; it also touches api-surface/export-origins shards, so this dev merges main immediately before opening its PR and re-merges if #8936 lands while open); no registry entry expected (acceptance set unchanged — no ADR-0087 obligation per the mechanical test); no #8641 trigger-file intersection.

Shape being implemented: Option A as triaged — the only shape consistent with the standing #8082 single-parse ruling (B refused by name) and MongoConfigSchema.url's declared text (C contradicts it). Unlock fan-out: #8696 (security — mongo arm connects unauthenticated) → #8155's URL-bearing-row migration path.

---

Generated by Claude Code