@@ -0,0 +1,23 @@
+---
+'@objectstack/metadata-protocol': minor
+---
+
+fix(metadata-protocol)!: the cross-object search asks the spec's exposure decision for `search` on each object, so an `apiMethods` whitelist that withholds `list` keeps the object out of the sweep (#22640)
+
+Clause-②: no
+
+<!-- adr-0087: not-required (no-migration-prescription) No metadata moves: no spec key, authorable spelling, export or stored shape is removed, renamed or re-shaped, so there is nothing for `objectstack migrate meta` to rewrite. What narrows is a runtime read door: the search stops serving objects whose existing `enable` declaration already refuses `search` on every other generic exit, and the remedy is the declaration the author already wrote. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id is named or touched (not registered or already-registered); and no exported declaration is removed or narrowed (not runtime-interface-only or type-surface-only). -->
+
+**BREAKING** (an accept-set narrowing), shipped as `minor` under the launch-window convention for breaking changes.
+
+The REST data routes, the runtime dispatcher, the MCP data tools and the analytics door judge an object's `enable` block through the spec's one exposure decision (`apiExposureDenialReason` / `canServeApiOperation`). In the derivation table, `search` derives from `list`. The cross-object search (`GET /search`, `searchAll`) spelled its own skip instead, and that skip read only `apiEnabled: false` and `searchable: false`.
+
+**FROM.** The search swept an object whose `apiMethods` whitelist does not grant `list` (for example `['get']`, or the deny-all `[]`), unless the object also declared `searchable: false` or `apiEnabled: false`. It served that object's rows while every data route refused them.
+
+**TO.** Before an object is queried, the search asks `canServeApiOperation(enable, 'search')`, and an object it refuses is skipped. A skipped object is never queried, named or counted. An explicit `objects=` naming it answers like one naming no object at all.
+
+- **Every caller.** The decision takes no user, so administrators and context-less in-process calls skip the same objects.
+- **`searchable: false` keeps its own skip.** The decision answers an object with no whitelist without reading that flag.
+- **Unchanged.** An object with no whitelist, or with one that grants `list`, is swept exactly as before.
+
+**Measured producers.** Read on `origin/main` `cb3bb933`: every object in this repository whose whitelist withholds `list` also declares `searchable: false` or `apiEnabled: false`, and no example app declares `apiMethods`. So no shipped object's search results change. Deployed and cloud-held object definitions were NOT MEASURED.
@@ -0,0 +1,197 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#22640] Every door that serves object rows OUTSIDE the data routes asks the
+ * spec's one exposure decision: `apiExposureDenialReason` or its boolean face
+ * `canServeApiOperation` (`@objectstack/spec/data`, ADR-0049).
+ *
+ * The data routes (REST, the runtime dispatcher, MCP) ask it per request. Two
+ * other doors were each found reading an object's exposure by hand, or not at
+ * all, after the data routes were settled: the analytics door (#22634) and
+ * the cross-object search (#22640). Each was fixed in its own package and
+ * pinned there by behaviour. This file is the ENUMERATION: it names the doors
+ * of that family, holds each one to the decision, and goes red when a new
+ * door of the same shape appears without being classified here.
+ *
+ * ## How a door of this family is found, mechanically
+ *
+ * A data route gets its read admission from the engine middleware, one object
+ * per request. A door that sweeps or joins objects it chose itself (search,
+ * analytics) has to decide per object which ones the caller may read, so it
+ * asks the `security` service's `canReadObject` itself. That call is the
+ * discriminator: every non-test `.ts` source under `packages/` that CALLS
+ * `canReadObject` must be classified in {@link CALLERS} below, either as a
+ * door (with the file where it asks the exposure decision, and the behaviour
+ * pin that holds it) or as something that is not a door (with the reason).
+ * An unclassified caller, or a classified file that no longer calls it, turns
+ * this red.
+ *
+ * ⛔ What the discriminator does NOT see, stated rather than discovered later:
+ * a door that reads rows without asking `canReadObject` at all, such as one
+ * that relies on the engine middleware by passing the caller's context to
+ * `find`, or one that reads as the system behind its own token. Read on
+ * `origin/main` at cb3bb933, the doors of that kind are the share-link door
+ * (`plugin-sharing`, gated by its own opt-in public-sharing policy) and
+ * knowledge retrieval (`service-knowledge`, an admin-declared source with no
+ * HTTP door in this repository). They are named here, not held.
+ *
+ * The scan surface and its prefilter follow
+ * `operation-private-keys.pin.test.ts` in this directory: git's authored-file
+ * list, never a directory crawl, and `.ts` only, the radius this package
+ * declares in the cross-package test-inputs table. That is also why this file
+ * is listed in this package's `repo` vitest project.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { describe, it, expect } from 'vitest';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+/** …/packages/core/src/security → repo root */
+const REPO_ROOT = resolve(HERE, '../../../..');
+
+/** The read-admission method, as data. */
+const ADMISSION = 'canReadObject';
+
+/** A CALL of the admission on some receiver: `svc.canReadObject(`, `svc.canReadObject!(`. */
+const admissionCall = (): RegExp => new RegExp(`\\.${ADMISSION}!?\\s*\\(`);
+
+/** A CALL of the spec's exposure decision, either face. */
+const decisionCall = (): RegExp => /\b(?:apiExposureDenialReason|canServeApiOperation)\s*\(/;
+
+type Classification =
+  | {
+      kind: 'door';
+      /** The door, in words, with the operation it is judged as. */
+      door: string;
+      operation: 'search' | 'aggregate';
+      /** Where the door asks the exposure decision. */
+      decisionSite: string;
+      /** The behaviour pin that holds the door to it. */
+      pin: string;
+    }
+  | { kind: 'not-a-door'; reason: string };
+
+/** Every non-test caller of the read admission, classified. */
+const CALLERS: Record<string, Classification> = {
+  'packages/metadata-protocol/src/protocol.ts': {
+    kind: 'door',
+    door: 'the cross-object search (`GET /search`, `searchAll`)',
+    operation: 'search',
+    decisionSite: 'packages/metadata-protocol/src/protocol.ts',
+    pin: 'packages/metadata-protocol/src/protocol.search-api-exposure.test.ts',
+  },
+  'packages/services/service-analytics/src/plugin.ts': {
+    kind: 'door',
+    door: 'the analytics door (`AnalyticsService` query and registration)',
+    operation: 'aggregate',
+    decisionSite: 'packages/services/service-analytics/src/api-exposure-door.ts',
+    pin: 'packages/services/service-analytics/src/__tests__/api-exposure-door.test.ts',
+  },
+  'packages/plugins/plugin-security/src/security-plugin.ts': {
+    kind: 'not-a-door',
+    reason: 'the provider: it implements the admission and binds it into the security service it registers; it serves no rows',
+  },
+};
+
+const SCAN_TIMEOUT_MS = 60_000;
+
+function git(args: string[]): string[] {
+  let stdout: string;
+  try {
+    stdout = execFileSync('git', args, { cwd: REPO_ROOT, encoding: 'utf8', maxBuffer: 1 << 28 });
+  } catch (error) {
+    const failure = error as { status?: number; stderr?: string };
+    // `git grep` exits 1 for "found nothing", which is data. Anything else is a
+    // broken scan and must not read as "no callers".
+    if (failure.status === 1) return [];
+    throw new Error(`git ${args.join(' ')} failed with status ${String(failure.status)}: ${failure.stderr ?? ''}`);
+  }
+  return stdout.split('\0').filter((line) => line.length > 0);
+}
+
+const isScannedSource = (path: string) =>
+  path.endsWith('.ts') && !path.endsWith('.d.ts') && !/\.(test|spec)\.ts$/.test(path);
+
+/** Code lines only: a docblock or line comment that names a call is not one. */
+const codeLines = (file: string) =>
+  readFileSync(join(REPO_ROOT, file), 'utf8')
+    .split('\n')
+    .filter((line) => !/^\s*(\*|\/\/|\/\*)/.test(line));
+
+const calls = (file: string, matcher: () => RegExp) => codeLines(file).some((line) => matcher().test(line));
+
+/** Fixed-string prefilter over tracked plus untracked sources; the regex decides. */
+function filesMentioningTheAdmission(): string[] {
+  return git(['grep', '--files-with-matches', '-z', '--untracked', '--fixed-strings', '-e', ADMISSION, '--', 'packages'])
+    .filter(isScannedSource);
+}
+
+function admissionCallers(): string[] {
+  return filesMentioningTheAdmission().filter((file) => calls(file, admissionCall)).sort();
+}
+
+describe('[#22640] every row-serving door outside the data routes asks the exposure decision', () => {
+  it(
+    'every caller of the read admission is classified, and every classified file still calls it',
+    () => {
+      const found = admissionCallers();
+      const unclassified = found.filter((file) => !(file in CALLERS));
+      const stale = Object.keys(CALLERS).filter((file) => !found.includes(file));
+
+      expect(
+        unclassified,
+        [
+          'These sources ask the read admission themselves, which is how a door that serves rows outside',
+          'the data routes looks, and this pin does not know them:',
+          ...unclassified.map((f) => `  - ${f}`),
+          '',
+          'Classify each in CALLERS. A door must ask `canServeApiOperation` / `apiExposureDenialReason`',
+          '(`@objectstack/spec/data`) for the operation it serves, before any row is read, and carry a',
+          'behaviour pin in its own package.',
+        ].join('\n'),
+      ).toEqual([]);
+      expect(stale, 'These classified files no longer call the read admission; re-classify or remove them.').toEqual([]);
+    },
+    SCAN_TIMEOUT_MS,
+  );
+
+  it(
+    'each door asks the decision at its decision site, and its behaviour pin exists',
+    () => {
+      const doors = Object.values(CALLERS).filter(
+        (c): c is Extract<Classification, { kind: 'door' }> => c.kind === 'door',
+      );
+      expect(doors.map((d) => d.operation).sort()).toEqual(['aggregate', 'search']);
+
+      for (const door of doors) {
+        expect(calls(door.decisionSite, decisionCall), `${door.door} does not ask the exposure decision in ${door.decisionSite}`).toBe(true);
+        expect(
+          readFileSync(join(REPO_ROOT, door.decisionSite), 'utf8'),
+          `${door.decisionSite} does not import the decision from the spec`,
+        ).toMatch(/from '@objectstack\/spec\/data'/);
+        expect(existsSync(join(REPO_ROOT, door.pin)), `the behaviour pin of ${door.door} is missing: ${door.pin}`).toBe(true);
+      }
+    },
+    SCAN_TIMEOUT_MS,
+  );
+
+  it(
+    'the scan cannot pass vacuously: the prefilter reaches every classified file and the matcher fires on each',
+    () => {
+      const mentioning = filesMentioningTheAdmission();
+      for (const file of Object.keys(CALLERS)) {
+        expect(mentioning, `the prefilter did not reach ${file}`).toContain(file);
+        expect(calls(file, admissionCall), `the call matcher does not fire on ${file}`).toBe(true);
+      }
+      // The contract DECLARES the method and names it in prose; neither is a call.
+      const contract = 'packages/spec/src/contracts/security-service.ts';
+      expect(mentioning).toContain(contract);
+      expect(calls(contract, admissionCall)).toBe(false);
+    },
+    SCAN_TIMEOUT_MS,
+  );
+});
@@ -1,5 +1,6 @@
 [
   "src/security/authz-store-unavailable.test.ts",
   "src/security/granted-permissions-not-enforced.pin.test.ts",
-  "src/security/operation-private-keys.pin.test.ts"
+  "src/security/operation-private-keys.pin.test.ts",
+  "src/security/row-serving-door-exposure.pin.test.ts"
 ]
Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,6 @@`
`1`	`1`	`[`
`2`	`2`	`"src/security/authz-store-unavailable.test.ts",`
`3`	`3`	`"src/security/granted-permissions-not-enforced.pin.test.ts",`
`4`		`- "src/security/operation-private-keys.pin.test.ts"`
	`4`	`+ "src/security/operation-private-keys.pin.test.ts",`
	`5`	`+ "src/security/row-serving-door-exposure.pin.test.ts"`
`5`	`6`	`]`