Merge branch 'main' into claude/platform-migration-gating-764pf2

Author: os-zhuang

.changeset/app-metadata-reference-integrity-assessment.md

@@ -0,0 +1,4 @@
+---
+---
+
+Docs-only: development assessment routing the reference-integrity / option-key lint work for app metadata (issue #3583). Releases nothing.

.changeset/better-auth-1-7-0-rc-2-and-prod-dep-batch.md

@@ -0,0 +1,58 @@
+---
+"@objectstack/plugin-auth": major
+"@objectstack/platform-objects": major
+"@objectstack/client": major
+"@objectstack/cli": patch
+"create-objectstack": patch
+"@objectstack/plugin-hono-server": patch
+"@objectstack/plugin-pinyin-search": patch
+"@objectstack/hono": patch
+---
+
+chore(deps)!: better-auth 1.7.0-rc.2 (account identity restructuring) + the
+production-dependency batch from #3517
+
+**better-auth 1.7.0-rc.1 → 1.7.0-rc.2** across the family (`better-auth`,
+`@better-auth/core`, `@better-auth/oauth-provider`, `@better-auth/sso`, and the
+adapter/telemetry overrides). `@better-auth/scim` deliberately stays on
+1.7.0-rc.1 — rc.2 replaces its whole model (code-defined connections; the
+`scimProvider` model and the generate-token endpoint are gone), which is a
+feature migration, not a version bump. Its peer range accepts rc.2 core, and the
+advisory that forced the original pin (GHSA-j8v8-g9cx-5qf4) is still fixed.
+
+**BREAKING — account identity.** better-auth renamed `account.accountId` to
+`account.providerAccountId` and added a REQUIRED `account.issuer`; sign-in now
+resolves accounts by `(issuer, providerAccountId)`.
+
+- FROM `fields: { accountId: 'account_id' }` → TO
+  `fields: { issuer: 'issuer', providerAccountId: 'account_id' }`. The provider
+  account id keeps its `account_id` column — only the better-auth-side name
+  moved — and `sys_account` gains an `issuer` column.
+- FROM `internalAdapter.createAccount({ providerId, accountId, … })` → TO
+  `createAccount({ providerId, issuer, providerAccountId, … })`. A local
+  password account carries the issuer better-auth mints for itself,
+  `local:credential`.
+- FROM `client.auth.accounts.unlink({ providerId, accountId })` → TO
+  `unlink({ accountId })`, where `accountId` is now the account ROW id (the `id`
+  from `accounts.list()`), matching better-auth's narrowed body.
+  `accounts.list()` returns `issuer` + `providerAccountId` in place of
+  `accountId`.
+
+**Existing deployments:** rows written before 1.7 have no issuer and are
+invisible to sign-in until stamped. The auth plugin now runs an idempotent
+boot-time backfill that stamps what it can derive — `local:credential` for
+password accounts, `local:oauth:<providerId>` for configured social providers,
+and the registered IdP's real `iss` from `sys_sso_provider` for federated ones.
+Accounts from a federated IdP that is no longer registered cannot be derived;
+they are logged with their provider id and row count rather than guessed, and
+those users cannot sign in through that provider until the row is stamped with
+the IdP's issuer or removed so a fresh login re-links it.
+
+**Also required by 1.7:** `SecondaryStorage` gained two mandatory methods, both
+now implemented over the kernel cache service — `getAndDelete` (single-use
+verification values) and `increment` (fixed-window rate-limit counter;
+`rateLimit.storage: 'secondary-storage'` throws at boot without it).
+
+The rest of #3517's production-dependency batch rides along: `@oclif/core`
+4.13.0, `@hono/node-server` 2.0.12, `hono` 4.12.32, `tar` 7.5.22, `jose` 6.2.4,
+`pinyin-pro` 3.28.2, plus the private docs app's fumadocs/next/react bumps.

.changeset/better-auth-team-member-count.md

@@ -0,0 +1,43 @@
+---
+"@objectstack/platform-objects": patch
+"@objectstack/plugin-auth": patch
+---
+
+fix(auth): provision the better-auth 1.7 columns `sys_team` / `sys_team_member` / `sys_two_factor` were missing (#3624)
+
+better-auth 1.7.0-rc.1 added fields to three models that the platform objects
+never provisioned and `auth-schema-config.ts` never mapped. Because an unmapped
+field keeps its camelCase name, the adapter emitted columns no table had:
+
+| model | field | column now provisioned |
+|:---|:---|:---|
+| `team` | `memberCount` | `sys_team.member_count` |
+| `teamMember` | `membershipKey` | `sys_team_member.membership_key` |
+| `twoFactor` | `failedVerificationCount` / `lockedUntil` | `sys_two_factor.failed_verification_count` / `locked_until` |
+
+The team pair broke org creation outright. The organization plugin's team
+sub-feature is on by default, so `POST /api/v1/auth/organization/create`
+auto-creates a default team — and that insert died with `table sys_team has no
+column named memberCount` *after* the organization row had already committed.
+Callers got an HTTP 500 on top of a half-created org: a real org row with no
+default team behind it. Every multi-org deployment's create-org flow hit this.
+
+The two-factor pair broke the 2FA lockout path the same way: better-auth
+guard-increments `failedVerificationCount` on each wrong code and stamps
+`lockedUntil` past the threshold, so a wrong code 500'd instead of being
+counted. All four columns are better-auth's own state — provisioned, readable,
+and never written from the ObjectStack side.
+
+Existing environments pick the columns up through the driver's additive schema
+sync; no data migration is needed. `member_count` backfills to 0 and
+better-auth's own `syncTeamMemberCount` reconciles it on the next membership
+change, and `membership_key` stays null on pre-upgrade rows, which better-auth
+tolerates by falling back to the `(team_id, user_id)` pair.
+
+A new drift gate (`better-auth-schema-parity.test.ts`) now asserts that every
+column the installed better-auth version can write exists on the platform
+object backing it, across the auth manager's whole model surface. The ADR-0092
+D7 guard only ever caught *collisions* between our extension fields and
+better-auth's, so a bump that adds a brand-new field passed the build and failed
+at runtime — twice now, counting the 1.7 `oauthAccessToken.authorizationCodeId`
+regression. The next one fails the build instead.

.changeset/close-approvals-and-record-shares-gaps.md

@@ -0,0 +1,13 @@
+---
+"@objectstack/client": minor
+"@objectstack/rest": patch
+---
+
+feat(client): close the approvals (6) + record-shares (3) REST gaps (#3587 batch 3/5)
+
+`client.approvals` gains the full request lifecycle beyond approve/reject:
+`recall` (submitter withdraw), `revise` / `resubmit` (ADR-0044 send-back
+round-trip), and the thread interactions `remind` / `requestInfo` / `comment`.
+New `client.shares` namespace for per-record sharing grants: `list` / `grant` /
+`revoke` (204-safe) under `/data/:object/:id/shares`. REST route-ledger
+ratchet: 26 → 17.

.changeset/close-sharing-rules-explain-search-gaps.md

@@ -0,0 +1,13 @@
+---
+"@objectstack/client": minor
+"@objectstack/rest": patch
+---
+
+feat(client): close the sharing-rules (5) + security-explain (2) + search (1) REST gaps (#3587 batch 4/5)
+
+New `client.shares.rules` sub-namespace for tenant-wide sharing rules
+(M10.17): `list` / `save` / `get` / `delete` (204-safe, grants cascade) /
+`evaluate` (reconcile). `client.security.explain` speaks the ADR-0090 D6
+access-explanation contract via the POST transport (the GET query form is the
+same `ExplainRequestSchema`). Top-level `client.search` covers global
+cross-object search (M10.5). REST route-ledger ratchet: 17 → 9.

.changeset/close-the-eight-reports-rest-gaps.md

@@ -0,0 +1,13 @@
+---
+"@objectstack/client": minor
+"@objectstack/rest": patch
+---
+
+feat(client): close the 8 reports-family REST gaps (#3587 batch 2/5)
+
+New `client.reports` namespace speaking the plugin-reports REST surface:
+`list` / `save` / `get` / `delete` (schedules cascade), `run`, `schedule`,
+`listSchedules`, `unschedule`. The two DELETE routes return 204 — the client
+methods return `{ deleted: true }` without attempting to parse an empty body.
+Fixed path (`/api/v1/reports` is not in `ApiRoutesSchema`), matching the
+keys / share-links precedent. REST route-ledger ratchet: 34 → 26.

.changeset/close-the-final-nine-rest-gaps.md

@@ -0,0 +1,15 @@
+---
+"@objectstack/client": minor
+"@objectstack/rest": patch
+---
+
+feat(client): close the final 9 REST gaps — ratchet 9 → 0 (#3587 batch 5/5)
+
+`data.clone` (enable.clone duplication) and `data.export` (streaming
+CSV/JSON/XLSX; returns the raw `Response` — a file stream, not a JSON
+envelope). New `email.send` (IEmailService; branch on the returned `status`).
+`analytics.queryDataset` speaks the ADR-0021 REST dataset-query dialect. New
+`datasources.external.*` federation admin: `listTables` / `draft` / `import` /
+`refreshCatalog` / `validate` (ADR-0015 Addendum, 503-degrading). Every REST
+route is now either SDK-expressed or carries a reviewed non-sdk disposition —
+the #3587 gap ratchet rests at ZERO.

.changeset/close-the-nine-metadata-rest-gaps.md

@@ -0,0 +1,16 @@
+---
+"@objectstack/client": minor
+"@objectstack/rest": patch
+---
+
+feat(client): close the 9 metadata-family REST gaps the #3587 ledger carried (#3587)
+
+New `meta` surface: `getDiagnostics` (spec-validation sweep), `getReferences`
+(reverse references), `getBookTree` (ADR-0046 §6 spine resolution), `getAudit`
+(ADR-0010 §3.6 protection trail), `publishItem` / `rollbackItem` / `diffItem`
+(ADR-0033 per-item draft lifecycle). The two compound-name routes
+(`GET|PUT /meta/:type/:section/:name`) turned out to be already expressible —
+`getItem`/`saveItem` pass slashes through unencoded — so they are flipped to
+`sdk` with URL-pinning tests instead of new methods (the audit note claiming
+an encoding barrier was wrong; only `deleteItem` encodes). REST route-ledger
+ratchet: 43 → 34.

.changeset/console-09c6a177bb4a.md

@@ -0,0 +1,9 @@
+---
+"@objectstack/console": patch
+---
+
+Console (objectui) refreshed to `09c6a177bb4a`. Frontend changes in this range:
+
+- fix(grid): localize import result errors (objectstack#3566) (#2861)
+
+objectui range: `c6cfdf1288b6...09c6a177bb4a`

.changeset/fix-stale-scaffolder-changeset-refs.md

@@ -0,0 +1,4 @@
+---
+---
+
+Repo-plumbing only: two pending changesets referenced the scaffolder by its old `@objectstack/create-objectstack` name, which `changeset version` rejects because the workspace package is named `create-objectstack`. Renamed the entries; releases nothing by itself.