test(plugin-sharing): seam ObjectQL double holds the caller limit

packages/plugins/plugin-sharing/src/exec-context-seam.limit.test.ts

@@ -0,0 +1,40 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The seam's in-memory ObjectQL holds the caller's `limit`.
+ *
+ * `resolveAuthzContext` reads through this double with real bounds (for
+ * example `limit: 1` and `limit: 2` when it picks a default organization). A
+ * double that dropped the bound answered more rows than the real engine ever
+ * would, so a test running through the seam could pass on a result the
+ * runtime never produces.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { makeSeamQl } from './exec-context-seam.testkit.js';
+
+describe('makeSeamQl().find holds the caller limit', () => {
+  const rows = [
+    { id: 'a', organization_id: 'org_1' },
+    { id: 'b', organization_id: 'org_1' },
+    { id: 'c', organization_id: 'org_2' },
+  ];
+
+  it('answers at most `limit` rows when more match', async () => {
+    const ql = makeSeamQl({ sys_member: rows });
+    const page = await ql.find('sys_member', { where: { organization_id: 'org_1' }, limit: 1 });
+    expect(page).toEqual([{ id: 'a', organization_id: 'org_1' }]);
+  });
+
+  it('applies the bound after the filter, not before it', async () => {
+    const ql = makeSeamQl({ sys_member: rows });
+    const page = await ql.find('sys_member', { where: { organization_id: 'org_2' }, limit: 1 });
+    expect(page).toEqual([{ id: 'c', organization_id: 'org_2' }]);
+  });
+
+  it('answers every match when no limit is given', async () => {
+    const ql = makeSeamQl({ sys_member: rows });
+    const page = await ql.find('sys_member', { where: { organization_id: 'org_1' } });
+    expect(page.map((r) => r.id)).toEqual(['a', 'b']);
+  });
+});

packages/plugins/plugin-sharing/src/exec-context-seam.testkit.ts

@@ -52,18 +52,24 @@ export interface SeamPrincipal {
   memberships?: SeamMembership[];
 }
 
-/** Minimal in-memory ObjectQL: `find(object, { where })` with `===` + `$in`. */
-function makeSeamQl(tables: Record<string, any[]>) {
+/**
+ * Minimal in-memory ObjectQL: `find(object, { where, limit })` with `===` +
+ * `$in`. Exported only so its own pin can drive it directly.
+ */
+export function makeSeamQl(tables: Record<string, any[]>) {
   return {
     async find(object: string, opts: any) {
       const rows = tables[object] ?? [];
       const where = opts?.where ?? {};
-      return rows.filter((r) =>
+      const matched = rows.filter((r) =>
         Object.entries(where).every(([k, v]) => {
           if (v && typeof v === 'object' && '$in' in (v as any)) return (v as any).$in.includes(r[k]);
           return r[k] === v;
         }),
       );
+      // The caller's bound, applied AFTER the filter and by PRESENCE, as the
+      // real engine does: `resolveAuthzContext` reads with real limits.
+      return typeof opts?.limit === 'number' ? matched.slice(0, opts.limit) : matched;
     },
   };
 }