feat: drop the 2.8 columns, moves and aliases kept for a downgrade

packages/plugin-sdk/cli/index.mjs

@@ -18,7 +18,11 @@ const COMMANDS = {
   build,
   patch: async ({ cwd }) => applyPatches(cwd, readManifest(cwd).id),
   validate,
-  test,
+  // The tests exercise patched dependencies, so patch first like build does.
+  test: async (options) => {
+    applyPatches(options.cwd, readManifest(options.cwd).id);
+    return test(options);
+  },
   pack,
   sign,
   verify,
@@ -36,7 +40,7 @@ if (!command || command === "--help" || command === "-h") {
       "  build      Bundle the plugin into dist/",
       "  patch      Apply the plugin's dependency patches (build does this too)",
       "  validate   Check manifest.json and the files it names",
-      "  test       Run the plugin's vitest suite",
+      "  test       Apply the patches, then run the plugin's vitest suite",
       "  pack       Write <id>-<version>.tmxplug of the built plugin [--out dir]",
       "  sign       Sign a .tmxplug with TERMIX_PLUGIN_SIGNING_KEY <file>",
       "  verify     Check a .tmxplug's .sig <file> --key <base64>[,...]",

packages/plugin-sdk/src/backend.ts

@@ -373,7 +373,7 @@ export interface PluginHttp {
   /**
    * The public base URL a request came in on: origin plus the install's base
    * path, no trailing slash. Honours forwarded headers from a trusted proxy,
-   * BASE_PATH and OIDC_FORCE_HTTPS. For building absolute callback URLs.
+   * BASE_PATH and EXTERNAL_FORCE_HTTPS. For building absolute callback URLs.
    */
   baseUrl: (req: unknown) => string;
 }
@@ -1368,10 +1368,9 @@ export type PluginVerifiedIdentity =
         sid?: string | null;
       };
       /**
-       * The values a 2.8 install kept on the user row (`oidc_identifier`,
-       * `sso_provider_id`). Only for a plugin that took over a 2.8 login
-       * method: core finds pre-2.9 accounts by `identifier` and keeps writing
-       * both for new users so a downgrade still works.
+       * The identifier a 2.8 install kept for the user. Only for a plugin
+       * that took over a 2.8 login method: core also checks `identifier`
+       * against `allowedUsers`. `providerRowId` is no longer read.
        */
       legacy?: { identifier: string; providerRowId?: number | null };
       /**

packages/plugin-sdk/src/manifest.ts

@@ -275,11 +275,6 @@ export interface PluginSettingsField {
   group?: string;
   /** Registered component id. Required when type is "custom". */
   component?: string;
-  /**
-   * Deprecated and ignored: host defaults cover every host field now. Still
-   * accepted so an older manifest loads. Removed in 26.10.0.
-   */
-  defaultFrom?: string;
   /**
    * Host scope only: whether the field can have a host default (server,
    * user or folder) that hosts follow until they set their own. On by
@@ -644,7 +639,6 @@ const ALLOWED_SETTINGS_FIELD = [
   "group",
   "component",
   "hidden",
-  "defaultFrom",
   "defaultable",
   "defaultLevels",
   "personal",
@@ -1614,9 +1608,6 @@ function validateSettings(settings: unknown, errors: string[]): void {
     host.fields.forEach((raw, index) => {
       if (!isPlainObject(raw)) return;
       const fieldAt = `${at}.fields[${index}]`;
-      if ("defaultFrom" in raw && typeof raw.defaultFrom !== "string") {
-        errors.push(`${fieldAt}.defaultFrom must be a string`);
-      }
       for (const flag of ["defaultable", "personal"]) {
         if (flag in raw && typeof raw[flag] !== "boolean") {
           errors.push(`${fieldAt}.${flag} must be a boolean`);
@@ -1670,7 +1661,6 @@ function validateSettings(settings: unknown, errors: string[]): void {
     fields.forEach((raw, index) => {
       if (!isPlainObject(raw)) return;
       for (const key of [
-        "defaultFrom",
         "defaultable",
         "defaultLevels",
         "personal",