Merge remote-tracking branch 'origin/main' into claude/envelope-drift-route-modules-v2zoky

Author: claude

.changeset/actions-failures-speak-http.md

@@ -0,0 +1,41 @@
+---
+"@objectstack/runtime": major
+"@objectstack/client": minor
+---
+
+fix(actions)!: failures speak HTTP — business rejections are 400, success is a single wrap (#3962)
+
+**BREAKING (raw-HTTP callers of `POST /api/v1/actions/...` only).** The
+200-with-inner-envelope wire was never a designed contract: no ADR or doc ever
+specified it, it originated as the route's catch block reusing
+`deps.success()`, and `/actions` was the only route of 12 that double-wrapped.
+#3962 classifies it as a bug. Five defects traced back to that one extra layer
+(the console's green toast on failed actions, `redirectUrl` never firing, a
+marketplace install reported as installed when it failed, the client-envelope
+divergence #3927 papered over, and crashes invisible to monitoring).
+
+The contract now, identical to `/data`:
+
+| Outcome | HTTP | Body |
+|:---|:---:|:---|
+| Ran, returned | **200** | `{success: true, data: <handler return value>}` — single wrap |
+| Ran, rejected (business rule / validation) | **400** | `{success: false, error: {message, code, details: {code?, fields?}}}` |
+| Never dispatched (unknown / denied / wrong type / unavailable) | 404 / 403 / 400 / 503 | unchanged (#3930/#3951) |
+| Crashed (`TypeError`, driver class, sandbox timeout) | **500** | unchanged (#3951) |
+
+A validation rejection carries `details.code: 'VALIDATION_FAILED'` and
+`details.fields[]` — the exact payload #3937 fought for, now on the same wire
+shape `/data` has always used, which `@objectstack/client` normalizes to
+`err.code` / `err.fields` (#3927). A rejected flow is a 400 with
+`details.code: 'FLOW_FAILED'`. The crash-vs-rejection discriminator (#3951,
+error `name`) now selects 400 vs 500.
+
+`client.actions.invoke` / `invokeGlobal` still never throw: they fold every
+failure status into `{success: false, error}`, read the single wrap on
+success, and keep a NARROW legacy heuristic so a current SDK talking to a
+pre-#3962 server still folds the old double-wrapped 200s correctly.
+
+**Migration for raw-HTTP third parties:** branch on the HTTP status — a
+non-2xx is the failure, `error.message` / `error.details` carry the detail; on
+a 200, `data` is the handler's return value directly (one level less than
+before). Callers using `@objectstack/client` need no change.

.changeset/adr-0110-action-declaration-admission.md

@@ -0,0 +1,36 @@
+---
+'@objectstack/runtime': major
+'@objectstack/objectql': minor
+'@objectstack/metadata': minor
+---
+
+**ADR-0110 — an action's identity is its `name`, and anything executable over a
+governed surface must have a declaration.**
+
+`POST /api/v1/actions/:object/:action` resolved the DECLARATION from the URL
+segment as a `name` but dispatched the HANDLER using that same segment as a
+registry key. For a target-bound action (`{ name: 'complete_task', target:
+'completeTask' }`) those are different strings, so the two documented callers
+each worked on exactly the half the other broke: the documented curl resolved
+the declaration then 404ed, while the Console's `target`-addressed call
+dispatched fine and resolved no declaration — silently skipping the ADR-0066 D4
+capability gate and the ADR-0104 param contract (#3935).
+
+- **D1/D2** — identity is always the declarative `name`; the handler key is
+  derived from the resolved declaration through a rotation now shared with the
+  MCP `run_action` bridge (`resolveActionHandlerKeys`, `executeRegisteredAction`).
+  The REST route previously rotated only the object key, never the handler key.
+- **D3 (breaking)** — declaration resolution is a trichotomy. A genuinely
+  undeclared handler is **refused (404)** with the `defineAction` to add, rather
+  than executed ungated with system privileges; an unreachable metadata plane is
+  a **503** rather than a silent ungating (`MetadataManager.loadDiagnosed` tells
+  a clean miss from an outage). `OS_ALLOW_UNDECLARED_ACTIONS=1` is the migration
+  valve — it warns on every invocation and is removed in 18.
+- **D5** — `reconcileActionRegistrations` plus `ObjectQLEngine.listRegisteredActions`
+  power a `kernel:ready` inventory logging every registered-but-undeclared
+  handler (refused at dispatch) and every declared script action bound to no
+  handler — the ADR-0078 converse, mechanised.
+- **D6** — security-gate strictness is opt-**out** (`OS_ALLOW_*`), never opt-in.
+
+Apps whose actions are all declared need no changes beyond gaining enforcement
+of the `requiredPermissions` they already declared.

.changeset/adr-0111-share-link-reshare.md

@@ -0,0 +1,15 @@
+---
+"@objectstack/plugin-sharing": minor
+---
+
+feat(sharing): a record's share-manager may revoke any share-link on that record (ADR-0111 D8)
+
+`ShareLinkService.revokeLink` was creator-or-system only, so a record's owner or
+a Modify-All admin could not kill a link someone else minted on their record —
+their record's exposure, but not their link to revoke. Revoke authority now
+also admits a record **share-manager**, probed via the sharing service's
+late-bound `canManageShares` (owner / `modifyAllRecords`). The probe fails
+closed: a deployment without it (or a throwing probe) keeps the pre-D8
+creator-only behaviour. Mint authority is unchanged and now documented as the
+D8 decision it always enforced — the object's `publicSharing` opt-in AND the
+caller's visibility of the record.

.changeset/adr-0111-sharing-authorization-face.md

@@ -0,0 +1,43 @@
+---
+"@objectstack/spec": minor
+"@objectstack/plugin-sharing": minor
+"@objectstack/plugin-security": minor
+"@objectstack/rest": minor
+---
+
+fix(sharing)!: the share-management surface gains the authorization layer it never had (ADR-0111 P0, #3902)
+
+Record sharing shipped as a data layer with no authorization of its own: every
+`/data/:object/:id/shares` and `/sharing/rules` route authenticated the caller
+and then ran the service under `SYSTEM_CTX` — any signed-in user could revoke
+anyone's share, enumerate who-can-see-what, write self-grants, and define /
+evaluate org-wide sharing rules. ADR-0111's P0 rulings land here:
+
+- **D1/D2** — `ISharingService.canManageShares(object, recordId, context)`:
+  system, the record's owner, or a holder of Modify All Data (probed via the
+  new fail-closed `ISecurityService.hasWriteBypass`). Enforced in the SERVICE,
+  so every caller is covered; without plugin-security it fails closed to
+  owner-only.
+- **D4** — `revoke` is symmetric with grant, validates the share belongs to the
+  URL's record (`NOT_FOUND` on mismatch), and refuses non-`manual` rows
+  (`CONFLICT` — a rule-materialised grant would be resurrected by the next
+  reconcile).
+- **D5** — `listShares` is management-gated (invisible record → `NOT_FOUND`,
+  visible-but-not-manager → `PERMISSION_DENIED`), and the open
+  `/data/sys_record_share` read surface is self-scoped: non-admin callers see
+  only rows naming them as recipient or grantor.
+- **D6** — the whole `/sharing/rules` surface (list/create/get/delete/evaluate)
+  requires the new **`manage_sharing`** capability (D9; seeded into
+  `admin_full_access`, `manage_platform_settings` honoured as the legacy
+  equivalent), enforced in `SharingRuleService`.
+- **D7** — no inert grants: `recipientType` is narrowed to `user` (the only
+  type any gate enforces), grants on objects the sharing gates never consult
+  (public model, no `owner_id`, bypass, `controlled_by_parent`) fail with
+  `SHARING_NOT_ENABLED` (422), and the manual upsert keys on
+  `(object, record, recipient, source)` so manual and rule rows coexist.
+
+**Breaking** for callers that relied on the missing gate: unauthorized share
+management now fails with 403/404/409/422 instead of silently succeeding, and
+`ISharingService.revoke` gained an optional `scope` parameter. The verb
+boundary (edit ≠ delete, ADR-0111 D3) is NOT in this change — it lands as the
+separate P1.

.changeset/adr-0111-verb-boundary-delete.md

@@ -0,0 +1,32 @@
+---
+"@objectstack/spec": minor
+"@objectstack/plugin-sharing": minor
+"@objectstack/plugin-security": minor
+---
+
+fix(sharing)!: an edit-level share no longer grants delete (ADR-0111 D3, the verb boundary)
+
+`update` and `delete` shared one `canEdit` gate, and `canEdit` accepts an
+`edit`-level share — so one "edit" grant silently conferred delete, the
+opposite error from the retired `full` level. A share widens *which rows* a
+principal reaches, never *which verbs* they may use (Salesforce Read/Write
+cannot delete; Dataverse `Delete` is a distinct privilege; Odoo splits
+`write`/`unlink`).
+
+- `ISharingService.canDelete(object, recordId, context)` — ownership (widened
+  by write DEPTH) or the `modifyAllRecords` super-user bypass ONLY; an `edit`
+  or legacy `full` share does not confer it. `canEdit` is unchanged (the
+  update gate, share included).
+- `SharingService.buildWriteFilter` takes a `verb` parameter: a bulk
+  `delete({multi:true})` scopes to the owner/DEPTH set alone (no share
+  widening), while a bulk `update` keeps it.
+- The sharing middleware routes `delete` through `canDelete` and logs a
+  specific fail-closed reason on denial (ADR-0111 D10).
+- `/security/explain` consults `canDelete` for a `delete` operation, so the
+  record-level explanation matches enforcement.
+
+**Breaking**: a caller who could delete a record *only* through an edit-level
+share (and holds object-level delete CRUD) can no longer delete it — delete now
+requires ownership, write depth, or Modify All Data. No new delete access level
+is introduced; a future per-record delete grant would be a capability mask
+AND-ed with object CRUD, not a fourth share level.

.changeset/adr-0112-batch-1-screaming-codes.md

@@ -0,0 +1,35 @@
+---
+"@objectstack/spec": minor
+"@objectstack/core": minor
+"@objectstack/runtime": minor
+---
+
+feat(spec,core,runtime)!: ADR-0112 batch 1 — one error-code vocabulary, SCREAMING_SNAKE, schema-enforced (#3841)
+
+Settles #3841 per ADR-0112: the top-level `error.code` vocabulary is
+SCREAMING_SNAKE, in two tiers.
+
+- **`StandardErrorCode` members renamed in place** (`validation_error` →
+  `VALIDATION_ERROR`, all 53). Breaking for importers that branch on the old
+  lowercase members; the type name and member *meanings* are unchanged.
+- **New `ERROR_CODE_LEDGER`** (`@objectstack/spec/api`): service-specific codes
+  (`AUTH_REQUIRED`, `VALIDATION_FAILED`, `ATTACHMENT_DOWNLOAD_DENIED`, …) are
+  registered per owning package. `ErrorCode` = standard ∪ registered.
+- **`ApiErrorSchema.code` is now `ErrorCode`**, not `z.string()` — an
+  unregistered code fails parse, so the envelope conformance suites assert
+  values, not just shape.
+- **`FieldErrorSchema.code` widened to `z.string()`** (ADR-0112 D6): field-level
+  codes are a separate vocabulary the enum never described; #3977 owns its real
+  catalog.
+- **Derived codes changed case on the wire**: `standardErrorCodeForHttpStatus`
+  now yields SCREAMING members (`permission_denied` → `PERMISSION_DENIED`,
+  `method_not_allowed` → `METHOD_NOT_ALLOWED`, …) — this map was #3842's
+  designated one-file sweep point for exactly this decision.
+- **`ANONYMOUS_DENY_CODE` is `'UNAUTHENTICATED'`** (was `'unauthenticated'`) —
+  the promoted code on anonymous-denied requests and the REST `enforceAuth`
+  body change spelling with it.
+
+`error-catalog.mdx` and the error-handling guides are rewritten to the single
+vocabulary; a spec test now locks the catalog page's headings to the enum so
+they cannot drift apart again. Remaining lowercase emitters (cloud-connection,
+plugin-auth envelope codes, metadata-protocol, …) are the batch-2 sweep.

.changeset/adr-0112-error-code-vocabulary.md

@@ -0,0 +1,4 @@
+---
+---
+
+ADR-0112 (error-code vocabulary decision) — docs only, releases nothing.

.changeset/agents-pd12-shim-retired.md

@@ -0,0 +1,4 @@
+---
+---
+
+docs(agents): PD #12 records the #3796 endgame — all seven flow-node config aliases graduated into the protocol-17 conversion layer and the `readAliasedConfig` shim is deleted; new aliases go straight to conversion entries, never executor shims — releases nothing.

.changeset/console-a136322f8723.md

@@ -0,0 +1,26 @@
+---
+"@objectstack/console": minor
+---
+
+Console (objectui) refreshed to `a136322f8723`. Frontend changes in this range:
+
+- fix(app-shell)!: a modal action is client-side only — drop the server fallthrough (objectstack#3959) (#2973)
+- fix(app-shell)!: the server-action URL identifies an action by `name`, not `target` (ADR-0110 D1) (#2970)
+- fix(form): a server rejection that names fields now marks those fields (#2966)
+- fix(actions): one source for the /actions envelope rule, and redirectUrl finally works (#2967)
+- fix(actions): apply the ADR-0066 D4 capability gate on every action surface (framework#3923) (#2965)
+- fix(detail): multi-value lookup is selectable in inline edit (#2957)
+- fix(actions): a failed server action no longer reports as success (green toast) (#2963)
+- fix(fields): the criteria builder stops calling an empty criteria "All records" (#2962)
+- feat(report): carry a report's `order` into the dataset selection (framework#3916) (#2964)
+- feat(views): the list toolbar speaks one vocabulary — `userActions` (#2890) (#2948)
+
+objectui range: `4a4829d0ef39...a136322f8723`
+
+**Release-critical for v17.** The previous pin (`4a4829d0ef39`) predates the
+ADR-0110 D1 client fix, so the console it builds still posts `action.target`
+to `/api/v1/actions/:object/:action`. Against a v17 server — which resolves
+the declaration by `name` and refuses an unresolvable one (D3) — every
+target-bound script action would return 404 from the shipped console. The
+lockstep the ADR called for is enforced by THIS pin, not by merging the
+objectui PR, so v17 must not ship without this bump.

.changeset/default-datasource-adopt-seam.md

@@ -0,0 +1,43 @@
+---
+"@objectstack/runtime": minor
+"@objectstack/service-datasource": minor
+"@objectstack/verify": patch
+---
+
+feat(runtime,datasource): the default-datasource connect seam accepts a host driver factory — adopt pre-built instances without forking the verdict (#3826)
+
+ADR-0062 D1's open-core convergence (#3869/#3886) left one structural question
+open: a host whose `default` needs a driver the shared factory cannot build —
+the cloud distribution's `turso`, or an instance pooled BEYOND one kernel (the
+cloud control-plane driver doubles as the proxy base of every environment
+kernel; per-environment drivers are cached across kernel rebuilds) — had only
+two options, both bad: stay on the legacy pre-built `DriverPlugin` path, whose
+connect verdict lives in `ObjectQLEngine.init()` (the second implementation
+#3826 exists to retire), or fork the connect orchestration. Either re-opens the
+#3741 → #3758 drift this whole line of work is about.
+
+Two additive pieces close it:
+
+- **`DefaultDatasourcePlugin` accepts an injected `IDatasourceDriverFactory`**
+  (defaults to the shared open-core factory, byte-for-byte unchanged when
+  omitted). The factory only changes what `create()` returns — the policy-free
+  init connect, `bootCritical` fail-fast, `OS_ALLOW_DRIVER_CONNECT_FAILURE`
+  escape hatch, and the start() replay into retained admin state are identical
+  either way, and the new tests pin that (an adopted instance that cannot
+  connect takes the exact same verdict).
+- **`createPrebuiltDriverFactory(driver, { driverId?, fallback? })`** in
+  `@objectstack/service-datasource` — the "adopt an existing driver" seam the
+  first #3826 pass found missing, landed AS a factory so it composes into the
+  one connect path instead of becoming a second entry point. `create()` returns
+  the SAME instance every call: construction, pooling, and reuse stay host
+  concerns; only the verdict converges. Not for the common case — a `default`
+  expressible as `{ driver, config }` should stay a plain definition.
+
+The `@objectstack/verify` dogfood harness now boots through
+`DefaultDatasourcePlugin` (declared `sqlite-wasm` definition) instead of a
+pre-built `DriverPlugin` — so the dogfood gate exercises the same declared
+-default connect path `objectstack dev`/`serve` use, which is the §Risk
+mitigation ADR-0062 promised ("behind the dogfood gate") and did not yet have.
+The degraded-boot parity guard stays: `ObjectQLEngine.init()`'s verdict is
+still live for the boot re-verification, `DriverPlugin` escape-hatch drivers,
+and the cloud compositions until they converge onto this seam.