fix(actions): mount the object-less /actions//:action shape; bump objectui to e651c936870e (#4005)

Two things, both closing the #3913/#3962 arc at the HTTP surface.

1. The object-less action shape was unreachable. #3913 taught
handleActionsRequest to route a single-segment path at the canonical 'global'
key, and that code was correct and unit-tested — but nothing delivered the path:
the dispatcher mounts routes explicitly, `:object` does not match an empty
segment, and no registration covered `POST /actions//:action`. Over real HTTP it
fell through to Hono's notFound with a bare {error:'Not found'} and the actions
domain never ran, so the exact URL #3913 was filed against still did not
dispatch. The tests call handleActions()/dispatch() directly and so could not
see it — the same class of bug dispatcher-plugin.routes.test.ts exists for after
/mcp and /keys shipped that way. Registered the route (Hono matches the literal
`//` without shadowing `:object/:action`, verified against the router) and
extended that guard to cover the action shapes.

Found by dogfooding the running showcase app.

2. Bumped .objectui-sha a136322f8723 → e651c936870e so the vendored console
carries the console-side halves of this work: objectui#2971 (read #3962's
single-wrapped responses; PeoplePicker render-phase cursor fix) and objectui#2972
(declared-response-envelope unwrap on the datasource page and api-action runner).

Verified in the browser at the new pin: a validation-failing action answers 400
with error.code VALIDATION_FAILED and details.fields[] anchoring issued_on, the
console shows a RED error toast and the record stays Draft; the succeeding call
answers 200 with data as the handler's return value (single wrap) and shows the
green success toast with the record flipped to Sent.


Claude-Session: https://claude.ai/code/session_011AvZj6cLX7APd7roh2eK4F

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang

.changeset/actions-empty-object-segment-route.md

@@ -0,0 +1,26 @@
+---
+"@objectstack/runtime": patch
+---
+
+fix(actions): the object-less `POST /actions//:action` shape is actually reachable over HTTP (#3913 follow-up)
+
+#3913 taught `handleActionsRequest` to route a single-segment path — the
+object-less shape `POST /api/v1/actions//:action` — at the canonical `'global'`
+key. That code was correct and unit-tested, and **unreachable**: the dispatcher
+mounts its routes explicitly, `:object` does not match an empty path segment,
+and no registration covered the `//` form. Over real HTTP the request fell
+through to Hono's `notFound` and answered a bare `{error: 'Not found'}` with the
+actions domain never running — so the exact URL #3913 was filed against still
+did not dispatch.
+
+The tests could not catch it because they call `dispatcher.handleActions()` /
+`dispatcher.dispatch()` directly, bypassing the route table. This is the same
+class of bug `dispatcher-plugin.routes.test.ts` was created for after `/mcp` and
+`/keys` shipped the same way; the guard now covers the action routes too.
+
+Found by dogfooding the running showcase app, not by the suite.
+
+`POST /api/v1/actions//:action` now answers identically to
+`POST /api/v1/actions/global/:action` — same envelope, same `'global'` key. The
+object-scoped registrations are untouched and unshadowed (Hono matches the
+literal `//` without competing with `:object/:action`).

packages/runtime/src/dispatcher-plugin.routes.test.ts

@@ -161,4 +161,25 @@ describe('createDispatcherPlugin — HTTP route registration', () => {
     // Non-discovery routes are unaffected by the cession.
     expect(routes).toContain('GET /api/v1/packages');
   });
+
+  // [#3913 follow-up] The exact bug this file's header describes, committed
+  // again: `handleActionsRequest` learned to route the OBJECT-LESS shape
+  // `POST /actions//:action` at the canonical 'global' key, and its unit tests
+  // called `handleActions()` / `dispatch()` DIRECTLY — so they passed while the
+  // path had no `server.post()` of its own. `:object` does not match an empty
+  // segment, so over real HTTP the request fell through to Hono's `notFound`
+  // and answered a bare `{error: 'Not found'}` with the domain never running.
+  // Found by dogfooding, not by the suite. Assert the registration, which is
+  // the only thing that makes the branch reachable.
+  it('mounts the object-less action shape /actions//:action so it reaches dispatch()', async () => {
+    const { server, routes } = makeFakeServer();
+    const plugin = createDispatcherPlugin({ prefix: '/api/v1', securityHeaders: false });
+    await plugin.start?.(makeCtx(server));
+
+    expect(routes).toContain('POST /api/v1/actions//:action');
+    // The object-scoped shapes must keep their registrations — the empty-segment
+    // route is additive and must not replace or shadow them.
+    expect(routes).toContain('POST /api/v1/actions/:object/:action');
+    expect(routes).toContain('POST /api/v1/actions/:object/:action/:recordId');
+  });
 });

packages/runtime/src/dispatcher-plugin.ts

@@ -1053,6 +1053,30 @@ export function createDispatcherPlugin(config: DispatcherPluginConfig = {}): Plu
             // `req.params` and is picked up by `prepareResolverHints`, exactly as
             // the automation routes handle it.
             const registerActionRoutes = (base: string) => {
+                // [#3913 follow-up] The OBJECT-LESS shape, with the object
+                // segment left empty: `POST /actions//:action`. This is the URL
+                // an SDK that has no object to name emits, and it is the exact
+                // one #3913 was filed against. `handleActionsRequest` has
+                // routed it at the canonical `'global'` key since #3913 — but
+                // ONLY when something delivers the path, and nothing did:
+                // `:object` does not match an empty segment, so the request
+                // fell through to Hono's `notFound` and answered a bare
+                // `{error: 'Not found'}` without the domain ever running. The
+                // unit tests call `handleActions()` / `dispatch()` directly,
+                // which is precisely why they could not catch this — found by
+                // dogfooding the real HTTP surface.
+                //
+                // Registered FIRST and with the empty segment spelled out.
+                // Hono matches the literal `//` and does not let this shadow
+                // the two-segment route below (verified against the router).
+                server!.post(`${base}/actions//:action`, async (req: any, res: any) => {
+                    try {
+                        const result = await dispatcher.dispatch('POST', `/actions//${req.params.action}`, req.body, req.query, { request: req });
+                        sendResult(result, res);
+                    } catch (err: any) {
+                        errorResponse(err, res);
+                    }
+                });
                 server!.post(`${base}/actions/:object/:action`, async (req: any, res: any) => {
                     try {
                         const result = await dispatcher.dispatch('POST', `/actions/${req.params.object}/${req.params.action}`, req.body, req.query, { request: req });