Merge remote-tracking branch 'origin/main' into claude/sys-member-role-assessment-s09jvx

Author: claude

.changeset/agents-pd12-alias-retirement-path.md

@@ -0,0 +1,4 @@
+---
+---
+
+docs(agents): PD #12 now points at the alias retirement path (`readAliasedConfig` shim → ADR-0087 D2 conversion layer) instead of two examples that have since moved — releases nothing.

.changeset/aggregate-temporal-output.md

@@ -0,0 +1,48 @@
+---
+"@objectstack/driver-sql": patch
+"@objectstack/service-analytics": patch
+---
+
+fix(driver-sql,analytics): stop `aggregate()` / `distinct()` leaking SQLite's raw epoch storage (#3797)
+
+Both returned `await builder` directly, without the `formatOutput` pass every
+`find()` row gets. On SQLite — the one dialect where a `Field.datetime` is
+stored as INTEGER epoch milliseconds rather than a native timestamp — that raw
+storage form went straight to the caller:
+
+| call | before | after |
+| --- | --- | --- |
+| `find()` | `"2026-01-10T09:00:00.000Z"` | unchanged |
+| `distinct('closed_at')` | `[1768035600000]` | `["2026-01-10T09:00:00.000Z"]` |
+| `aggregate()` `max(closed_at)` | `1768035600000` | `"2026-01-10T09:00:00.000Z"` |
+| `aggregate()` `groupBy: ['closed_at']` | key `1768035600000` | key `"2026-01-10T09:00:00.000Z"` |
+
+Same root cause as #3773, different exit. `Field.date` was never affected — it
+is ISO TEXT on every dialect, so its storage form already equals its
+presentation.
+
+The visible surfaces were a `_max`/`_min` measure over a datetime (a "last
+closed" KPI tile rendered `1768035600000`) and a `groupBy` on a raw datetime
+dimension, which also disagreed with the in-memory `applyInMemoryAggregation`
+fallback — that one consumes already-formatted `find()` rows, so the same
+dataset changed key type depending on which path served it.
+
+Which columns hold an instant is now recorded while the statement is built,
+because that is the only point where a column name and its meaning are both
+known: a `min()` lands under its alias and never under the field name, while a
+date-BUCKETED column lands under the field name but holds a label (`'2026-01'`)
+rather than an instant. Matching on names afterwards gets both backwards.
+
+`distinct()` additionally re-deduplicates after presenting: SQL `DISTINCT`
+compares STORED values, and one SQLite datetime column holds both INTEGER and
+TEXT forms, so two rows recording the same instant survived as two and then
+presented identically. It has no in-repo callers today; this keeps it honest
+rather than leaving a second convention in the driver.
+
+**`cross-object-rebucket` was fixed alongside it, because presenting min/max
+correctly is what exposed it.** `recombine()` coerced every operand with
+`Number()`, which silently depended on receiving an epoch: handed the ISO string
+the driver now returns it produced `NaN`, and on Postgres/MySQL (where knex
+returns a `Date`) it had always flattened the value back to an epoch integer one
+layer above the driver. `min`/`max` now order by the instant and return the
+winning value in the shape it arrived in; `sum`/`count` stay numeric.

.changeset/approval-actor-is-the-authenticated-caller.md

@@ -0,0 +1,61 @@
+---
+"@objectstack/plugin-approvals": minor
+"@objectstack/rest": patch
+---
+
+fix(approvals): an approval action is recorded against the authenticated caller, never a body field (#3800)
+
+Every mutating approvals entrypoint takes an `actorId`, and the REST routes
+filled it from `body.actorId ?? body.actor_id ?? context.userId` — so the body
+won. The service then authorized *that value*: `pending_approvers.includes(
+input.actorId)` for a decision, `submitter_id === actorId` for a recall. It never
+checked that the value named the caller.
+
+So any authenticated user could POST `{"actorId": "<someone else>"}` and have
+that person's approval recorded, the request finalized, and the owning flow run
+resumed down the `approve` edge — or name a request's submitter and recall it.
+With `api.requireAuth` unset the anonymous-deny never fires either, so an
+unauthenticated request could do the same.
+
+#3783 drew this line for the *data-write* identity and called the audit-row half
+"tolerable". It was not: the same unchecked string was the authorization key, so
+naming someone else was not a mislabelled audit row, it was how you got through
+the door.
+
+The actor is now resolved server-side (`ApprovalService.resolveActor`) on all
+nine entrypoints — `decide` / `decideNode`, `recall`, `sendBack`, `resubmit`,
+`reassign`, `remind`, `requestInfo`, `comment`.
+
+**The rule is not "`actorId` must equal `context.userId`."** A slot can
+legitimately be keyed by something else: the approver resolver stores the
+`type:value` literal when a graph lookup finds no holders, and the Console picks
+from the caller's own identity list — user id, email, or `role:<r>`. The rule is
+**"the actor must be an identity the server can prove belongs to the caller"**:
+
+- A **system** context keeps its explicit actor. The SLA sweep's reserved
+  `system:sla` sentinel and the ADR-0043 action link — whose single-use hashed
+  token binds exactly one approver — are unchanged. They are the only callers
+  holding a trustworthy actor with no session behind them.
+- A caller with **no identity at all** is now refused. This is the anonymous case
+  above.
+- **No `actorId`, or one naming the caller**, resolves to the caller. This is the
+  common path and what the Console already sends.
+- **Any other value** is accepted only when the server can prove the caller holds
+  it — `position:<p>` / `role:<p>` against the positions on the resolved authz
+  context, or the caller's own email (one lazy `sys_user` read, taken only when
+  nothing cheaper matched). Otherwise `FORBIDDEN`.
+
+REST still forwards the body value; it is now a *hint* the service validates,
+which is what keeps the email and `type:value` slot cases working.
+
+**Upgrade note.** A client that deliberately sent another user's `actorId` now
+gets `403 FORBIDDEN` instead of silently succeeding. Send the action as the
+acting user's own session — the field can be omitted entirely, and the caller is
+used. Server-to-server callers that legitimately act for someone else should
+present a system context, as the SLA sweep and the action link already do.
+
+This also makes two existing claims true that were previously aspirational: the
+approval object's declared actions say "`actorId` defaults to the caller
+server-side… the service remains the authority on who may act", and
+`attachViewers` documents `can_act` as mirroring "the exact authorization the
+decision methods enforce".

.changeset/approval-status-mirror-names-the-actor.md

@@ -0,0 +1,56 @@
+---
+"@objectstack/plugin-approvals": minor
+"@objectstack/service-automation": patch
+---
+
+fix(approvals): the status mirror names the human who caused the transition (#3783)
+
+When an approval moves, the service writes the new status onto the business
+record (`approvalStatusField`). That write is what fires the record-change flows
+bound to that object — so it is the seam "when the invoice is approved, do X"
+runs through. It presented a bare `{ isSystem: true }` context with **no
+`userId`**, at six call sites that each know exactly who acted: a submitter
+submitting, an approver approving, rejecting, sending back, recalling.
+
+Combined with #3760 — which stopped letting a `runAs:'user'` run with no trigger
+user touch data — that identity gap made the most natural approvals automation
+there is unwritable in its obvious form. The cascade inherited no user, so its
+data nodes were refused, and the author's only way forward was to declare
+`runAs: 'system'` and take blanket elevation for a case where a perfectly good
+scoped identity existed at the call site all along.
+
+The mirror now carries the acting user. It stays `isSystem` — the record is
+normally locked while its approval is live, so only a platform write can land the
+status — because elevation and anonymity are separate choices, and this write
+only ever needed the first. Cascades now run as the deciding user with RLS
+enforced.
+
+- **The identity is the authenticated principal, never the request body's
+  `actorId`.** `actorId` arrives from the caller (`body.actorId ?? context.userId`)
+  and is only checked against the pending approver slate, never against the
+  caller. That is tolerable on an audit row; promoting it to the identity of an
+  RLS-scoped write would have turned a mislabelled audit trail into identity
+  spoofing.
+- **Approval-by-email-link is attributed too.** ADR-0043 action links carry no
+  session, so they used to decide as pure system. The single-use hashed token
+  binds exactly one approver and is re-checked against the live slate at
+  redemption — that is an authentication — so the redeemed decision now presents
+  that approver, and an emailed approval cascades identically to one made in the
+  UI.
+- **The two machine-driven transitions stay user-less on purpose**: the SLA
+  escalation's auto-decision and the dead-run sweep. `system:sla` and
+  `system:dead-run` are reserved audit actors, not users, and presenting one as a
+  user would put a non-user in `updated_by` and in every downstream flow's
+  identity. A flow that wants to react to those declares `runAs:'system'` — the
+  honest answer, and now a deliberate one rather than an artefact.
+- **Attribution only — the write is not newly org-scoped.** On an
+  ExecutionContext `tenantId` is a driver-scoping knob, not attribution
+  (ObjectQL turns it into a tenant predicate), so passing the request's org would
+  have silently no-op'd the mirror on a record whose org differs. The automation
+  engine already back-fills a run's `tenantId` from the resolved user's grants.
+
+**Visible change:** the mirrored record's `updated_by` now names the acting user
+instead of retaining its previous value — ObjectQL's audit stamping is gated on
+the write context's `userId` alone, and `isSystem` buys no exemption. That is the
+attribution this fix is for: the approver who set the record to `approved` is now
+its last modifier.

.changeset/attachment-read-visibility-real-filter-semantics.md

@@ -0,0 +1,30 @@
+---
+---
+
+test(service-storage): give the attachment read-visibility harness real Filter Protocol semantics
+
+Test-only — releases nothing.
+
+`attachment-read-visibility.test.ts` faked its engine with a matcher that
+understood implicit equality and `$in` and nothing else: no `$and`, no `$or`,
+no `$not`. Every assertion in the file could therefore only check the *shape*
+of the filter `computeParentVisibilityFilter` emits, never the rows that filter
+selects — a poor bargain for a predicate whose whole job is narrowing.
+
+Changes:
+
+- The harness matcher now implements the protocol for real, mirroring
+  `driver-memory/memory-matcher.ts` and `formula/matches-filter.ts`: every key
+  in a filter object ANDs, `$or` ORs its branches, and a branch's own contents
+  still AND. Operators it does not implement now **throw** instead of being
+  ignored — a silently under-implemented test double is the failure mode this
+  change exists to close.
+- A new case asserts the **rows** a multi-parent-type scope returns, not just
+  its shape: rows whose discriminator matches a branch but whose id is absent
+  from that branch's id list (including one that borrows the sibling branch's
+  id) are excluded, so the per-branch pairing itself is pinned.
+- A conformance block pins the harness matcher against the same 2x2 fixture and
+  expectations as `memory-matcher-or-semantics.test.ts`,
+  `matches-filter-or-semantics.test.ts` and `sql-driver-or-filter.test.ts`, so
+  the four cannot drift apart, plus a case proving the matcher actually
+  distinguishes a correctly paired scope from a widened one.

.changeset/cli-json-pipe-truncation-sweep.md

@@ -0,0 +1,55 @@
+---
+"@objectstack/cli": patch
+---
+
+fix(cli): finish the `--json` truncation fix — every command, and the second document it was hiding (#3780 follow-up)
+
+#3780 routed three commands through `emitJson`. The other ~100 emission sites
+still wrote machine output with `console.log`, which on a **pipe** is cut off
+at one 64 KiB buffer when the command exits right after: Node buffers pipe
+writes asynchronously and the exit tears the process down mid-drain. It is
+invisible to whoever writes it — stdout to a TTY is synchronous, so every
+interactive run looks perfect while every scripted consumer, the only audience
+`--json` has, gets invalid JSON.
+
+The exit does not have to be an explicit `process.exit`. oclif ends failing
+commands with `handle()` → `Exit.exit()` → `process.exit()` and flushes
+nothing on that path (`flush()` runs only on `execute()`'s success path), so a
+plain `this.exit(1)` — or any thrown error — truncates identically. 73 of the
+104 sites had exactly that shape. Even `lint` was only half fixed: `--eval
+--json` writes a whole corpus report and was still on `console.log`.
+
+All 104 sites now go through `emitJson`, `formatOutput`'s `json`/`yaml`
+branches through the same drain-aware write (`--format yaml` truncated too),
+and an ESLint rule keeps the pattern from growing back one command at a time.
+Control flow is untouched — a following `this.exit(1)` stays, it is simply
+safe once the buffer has drained. Output bytes are unchanged: roughly half the
+sites emitted compact and half indented, and each keeps whichever it had.
+
+**Draining the write exposed a second defect underneath it.** Because
+`this.exit(1)` *throws*, a command whose body sits in one `try` unwinds its
+inner "report and stop" into the outer `catch`, which reports again — so
+`os validate --json` on a failing config printed **two** JSON documents, which
+is neither valid JSON nor valid JSONL. Truncation had been hiding the second
+one. Nine commands had this shape; their catch clauses now re-throw the exit
+signal (`isExitSignal`) instead of describing it as a failure.
+
+Measured on `os validate --json` against a config with 900 schema errors,
+piped:
+
+| | bytes | parses |
+|---|---:|---|
+| before | 131072 (exactly two buffers, cut mid-string) | no |
+| truncation fix alone | 1514711 (two documents) | no |
+| both fixes | 1514648 (one document, 900 errors) | **yes** |
+
+Pinned end to end: a real command, a real pipe, a payload past several
+buffers — plus a control case asserting the `console.log` pattern it replaced
+genuinely truncates, so the gate cannot quietly stop testing anything.
+
+Not covered: the ~30 human-facing `console.log` paths, which are unaffected,
+and `os serve` / `os dev` logging. This is deliberately not fixed by forcing
+stdout into blocking mode process-wide, which would be one line and cover
+everything — the same binary runs the dev server, and a blocking write to a
+pipe with a slow reader blocks the event loop, trading truncated JSON for a
+server that stalls on its own logs.

.changeset/console-1bb77aa24514.md

@@ -0,0 +1,33 @@
+---
+"@objectstack/console": minor
+---
+
+Console (objectui) refreshed to `1bb77aa24514`. Frontend changes in this range:
+
+- fix(flow-runner): honor a screen field's `visibleWhen` — render and validation (framework#3528) (#2899)
+- fix(i18n): unconditional Chinese in the chatbot confirm card and field inspector (#2884, #2885) (#2900)
+- fix(actions): one precedence for `target`/`execute`, and stop mislabeling server-side `body` (#2896) (#2895)
+- fix(i18n): close the last three zh-branch gaps (#2871, part 3) (#2898)
+- feat(grid): compute all eleven spec column summary aggregations (#2890)
+- feat(console): make `delegated_admin` reachable and narrow both role pickers (framework#3697) (#2891)
+- fix(app-shell): localize the two DeclaredActionsBar strings that bypassed i18n (#2762 P0-3) (#2894)
+- fix(i18n): delete the four `pick({en,zh})` clones (#2871, part 2) (#2893)
+- fix(views): the five per-view-type configs speak the spec vocabulary (#2231 phase 3) (#2892)
+- feat(grid): gate list row Edit/Delete and bulk delete on the effective operation set (objectstack#3720) (#2889)
+- feat(charts): honor `ChartAxis.stepSize`, `ChartConfig.description` and `.height` (framework#3752) (#2888)
+- fix(i18n): retire four hand-rolled zh/en branches (#2871, part 1) (#2887)
+- feat(charts): ObjectChart honors the spec `ChartConfig` author shape (#2880) (#2883)
+- fix(hooks): stop calling translation hooks inside try/catch (#2879) (#2881)
+- fix(charts): a fieldless `count` aggregate keyed its value column `undefined` (framework#3701) (#2878)
+- fix(i18n): make `en` the complete source of truth for grid import and set-password (#2872 b/c) (#2877)
+- fix(auth): localize the ADR-0069 remediation gate and the auth split-panel (#2870) (#2875)
+- fix(metadata-admin): drop the SkillPreview "Required Permissions" panel (framework#3686) (#2874)
+- feat(console): scoped-invitation placement — invite straight into a unit and positions (framework ADR-0105 D8) (#2868)
+- fix(attachments): read the storage service's new error envelope so gated downloads keep their friendly copy (objectstack#3675) (#2869)
+- fix(fls): wire real per-caller FLS into import targets and grid columns, drop dead field.permissions shape (objectstack#3661) (#2866)
+- fix(page,field): consume the spec's type/label/maxLength keys (framework#1878 §3 recheck) (#2867)
+- fix(cloud-connection): localize the Cloud Connection panel (objectstack#3589 follow-up) (#2865)
+- fix(dashboard,charts): send widget query options to the server, order funnel stages by the pipeline (#2864)
+- fix(action): honor the spec disabled predicate on every action-rendering surface (#1885 follow-through) (#2863)
+
+objectui range: `09c6a177bb4a...1bb77aa24514`