Merge remote-tracking branch 'origin/main' into claude/row-crud-cel-predicates-uzb7pz

Author: claude

.changeset/ai-toolexecutioncontext-fail-closed.md

@@ -0,0 +1,5 @@
+---
+'@objectstack/spec': minor
+---
+
+Security (#2991): the AI `ToolExecutionContext` contract no longer documents system-level execution as the missing-actor default. A missing `toolExecutionContext` / `actor` now means an unauthenticated (RLS-on, sees-nothing) principal — executors MUST fail closed to anonymous, never fall open to system. System execution becomes an explicit, greppable opt-in via the new `ToolExecutionContext.isSystem?: boolean` field (same convention as `IDataEngine` / `IKnowledgeService`), reserved for trusted server-side invocations and ignored when an `actor` is present. Migration for internal callers that relied on the old omission default (cron, migrations, server jobs): pass `toolExecutionContext: { isSystem: true }` explicitly.

.changeset/cors-allow-if-match.md

@@ -0,0 +1,13 @@
+---
+'@objectstack/plugin-hono-server': patch
+'@objectstack/hono': patch
+---
+
+CORS default `allowHeaders` now includes `If-Match`. The REST record update
+accepts the OCC token as an `If-Match` header (objectui's record-level inline
+edit sends it on every save), but the preflight allow-list omitted it — so on
+any split-origin deployment (console dev server against a backend on another
+origin) the browser failed the preflight and every inline-edit save died with
+"Failed to fetch". Found live while dogfooding objectui#2572; same
+split-origin failure class as the #2548 Bearer fixes. Explicit user-supplied
+`allowHeaders` still win unchanged.

.changeset/fix-async-import-cancel-2824.md

@@ -0,0 +1,27 @@
+---
+'@objectstack/rest': patch
+---
+
+fix(import): make async import-job cancellation actually stop the worker (#2824)
+
+Cancelling a running async import used to have no effect on a synchronous
+storage driver (better-sqlite3 / wasm fallback): every `await` in the row
+loop resolved as a microtask, so a 50k-row import monopolized the Node event
+loop for minutes — the cancel route's HTTP handler (and every progress poll)
+could never run, so the in-memory flag `shouldCancel` polls was never set.
+The job then finished `succeeded` with all rows written despite the user's
+cancel.
+
+Three-part fix:
+
+- **`runImport` yields one macrotask at every progress boundary** (every
+  `progressEvery` rows), so pending I/O — the cancel request, progress
+  polls, any other traffic — gets serviced during a large import. This is
+  the root-cause fix; it also unblocks progress polling for the wizard.
+- **The worker's `shouldCancel` now also reads the durable job row** as a
+  fallback: a cancel accepted by another process (or after a restart
+  dropped the in-memory flag) still stops the worker.
+- **A late cancel wins the terminal state**: the worker's final patch no
+  longer overwrites the cancel route's durable `cancelled` with
+  `succeeded`, and a job cancelled while still `pending` doesn't start at
+  all. Counts stay truthful — they reflect what was actually written.

.changeset/import-multivalue-reference-split.md

@@ -0,0 +1,29 @@
+---
+'@objectstack/rest': patch
+---
+
+fix(rest): split multi-value fields on import so `multiple: true` columns resolve per-token (#3063)
+
+The bulk-import coercion (`import-coerce.ts`) resolved a reference cell as a
+single value regardless of the field's `multiple` flag: a `multiple: true`
+lookup/user cell like `张焊工;李质检` was passed whole to name resolution and
+always failed with `no <object> matches "张焊工;李质检"`, so every multi-value
+association had to be back-filled by hand in the record UI after import.
+
+Coercion now mirrors objectql's `isMultiValueField` predicate. A field whose
+stored value is an array — an inherently-multi type (multiselect/checkboxes/tags)
+or a multi-capable type flagged `multiple: true` (per the spec: select, lookup,
+file, image; `radio` shares select's branch and `user` shares lookup's) — has
+its cell split on the export separator (`, ` / `;` / `、` / newline) and each
+token coerced individually:
+
+- **lookup / user (`multiple: true`)** — resolve each name token to an id, store
+  the id array; an unmatched/ambiguous token reports the **specific token**
+  (`no sys_user matches "查无此人"`) instead of the whole string.
+- **select / radio (`multiple: true`)** — match each token against the options,
+  store the option-value array.
+- **file / image (`multiple: true`)** — split into an id/url array.
+
+Single-value fields and the non-multi-capable reference types (master_detail /
+reference / tree) are unchanged — a stray `multiple: true` on them stays a
+single resolved value, matching the engine.

.changeset/owner-id-anchor-and-bulk-write-scoping.md

@@ -55,6 +55,6 @@ row-level scoping keys off to decide who may update/delete a record.
   now correctly affects zero rows instead of all of them.
 
 Proven end-to-end on the real showcase app
-(`packages/dogfood/test/owner-anchor-and-bulk-writes.dogfood.test.ts`) and pinned
+(`packages/qa/dogfood/test/owner-anchor-and-bulk-writes.dogfood.test.ts`) and pinned
 in the ADR-0096 authz-conformance ledger (`ownership-anchor-guard`,
 `bulk-write-owner-scoping`).

.changeset/pinyin-search-companion.md

@@ -5,7 +5,7 @@
 '@objectstack/cli': minor
 ---
 
-Generic pinyin search recall (#2486, ADR-0097): a locale-gated
+Generic pinyin search recall (#2486, ADR-0098): a locale-gated
 `OS_SEARCH_PINYIN_ENABLED` switch (auto-on when the stack configures any
 `zh-*` locale) provisions a hidden `__search` companion column for each
 object's display/name field at compile time, the new

.changeset/turn-atomic-publish.md

@@ -0,0 +1,6 @@
+---
+'@objectstack/metadata-protocol': minor
+'@objectstack/objectql': minor
+---
+
+Package-draft publishing is now turn-atomic (ADR-0067 Decision-2, #3066). `publishPackageDrafts` runs every draft promotion AND the `sys_metadata_commit` record inside ONE engine transaction — a mid-batch failure rolls back the whole batch (`publishedCount: 0`; the causal item carries its real error, the rest report `batch_aborted`). Side effects (registry refresh, table DDL, seed apply, materializers, ADR-0094 projections, events) run after the metadata commits and are surfaced-not-swallowed on failure. `@objectstack/objectql`'s `engine.transaction()` now JOINS an already-open ambient transaction instead of opening a nested driver transaction (deadlock on single-connection pools; escaped the outer rollback). BREAKING (behavioral): API consumers that relied on partial batch publishes ("2 of 3 landed") now get all-or-nothing; engines without `transaction()` (memory driver, minimal stubs) keep the previous sequential behavior.

.github/workflows/ci.yml

@@ -107,18 +107,21 @@ jobs:
       # spec sits at the root of the dependency graph, so spec-touching PRs
       # still run (close to) everything — but the many PRs that don't touch
       # spec skip the bulk of the 75-package matrix.
+      # --concurrency=4: turbo's default (10) oversubscribes the 4-vCPU
+      # hosted runner; matching the core count bounds peak memory and the
+      # job is CPU-bound anyway.
       - name: Run affected tests (PR)
         if: github.event_name == 'pull_request'
         env:
           TURBO_SCM_BASE: ${{ github.event.pull_request.base.sha }}
-        run: pnpm turbo run test --affected
+        run: pnpm turbo run test --affected --concurrency=4
 
       # Push to main: full run, but exclude spec's plain test task — the
       # coverage step below executes the exact same 250-file spec suite once,
       # with coverage. Previously the spec suite ran twice per push.
       - name: Run all tests (push)
         if: github.event_name == 'push'
-        run: pnpm turbo run test --filter=!@objectstack/spec
+        run: pnpm turbo run test --filter=!@objectstack/spec --concurrency=4
 
       - name: Generate coverage report
         if: github.event_name == 'push'

.github/workflows/lint.yml

@@ -123,9 +123,15 @@ jobs:
       # bad signal to copy from. tsup transpiles them without a full typecheck,
       # so build alone will not catch type drift — typecheck them explicitly.
       # They import from built workspace packages, so the packages must be built
-      # first for cross-package type resolution to succeed.
+      # first for cross-package type resolution to succeed. The examples'
+      # dependency closure is requested EXPLICITLY (`./examples/*^...` = deps
+      # of the examples, not the examples themselves): the bare `./packages/*`
+      # glob only matches direct children, and the connector packages the
+      # showcase imports were previously built only by accident — through
+      # dogfood's dependency chain, which broke when dogfood moved to
+      # packages/qa/ (#3037).
       - name: Build workspace packages
-        run: pnpm exec turbo run build --filter='./packages/*'
+        run: pnpm exec turbo run build --filter='./packages/*' --filter='./examples/*^...'
 
       - name: Type check example apps
         run: pnpm --filter './examples/*' run typecheck

.github/workflows/spec-liveness-check.yml

@@ -9,15 +9,15 @@ name: Spec Liveness Check
 #
 # ADR-0054 (prove-it-runs): bound high-risk 'live' properties must carry a `proof`
 # pointing to a dogfood test that declares the matching `@proof:` tag. The gate also
-# triggers on packages/dogfood/** so deleting/renaming a proof re-runs this check and
+# triggers on packages/qa/dogfood/** so deleting/renaming a proof re-runs this check and
 # the dangling reference is caught (the proof files live outside packages/spec/).
 
 on:
   pull_request:
     types: [opened, synchronize, reopened]
     paths:
       - 'packages/spec/**'
-      - 'packages/dogfood/**'
+      - 'packages/qa/dogfood/**'
 
 permissions:
   contents: read