fix(runtime): use single-string logger.error in auto-connect catch (DTS build)

os-zhuang · claude · os-zhuang · commit 68a8318a14a7 · 2026-06-22T19:23:30.000+08:00
The context logger interface types error(message, error?: Error) — passing a meta
object {appId, error} tripped the tsup DTS build (TS2353) even though tsc --noEmit
passed. Switch to a single interpolated message; the rethrow still surfaces the
real cause to the kernel.

Co-Authored-By: Claude Opus 4.8 &lt;noreply@anthropic.com&gt;
diff --git a/content/docs/references/ai/agent.mdx b/content/docs/references/ai/agent.mdx
@@ -76,6 +76,7 @@ const result = AIKnowledge.parse(data);
 | **instructions** | `string` | ✅ | System Prompt / Prime Directives |
 | **model** | `Object` | optional |  |
 | **lifecycle** | `Object` | optional | State machine defining the agent conversation follow and constraints |
+| **surface** | `Enum<'ask' \| 'build'>` | ✅ | Product surface this agent binds ('ask' | 'build') — ADR-0063 §1 |
 | **skills** | `string[]` | optional | Skill names to attach (Agent→Skill→Tool architecture) |
 | **tools** | `Object[]` | optional | Direct tool references (legacy fallback) |
 | **knowledge** | `Object` | optional | RAG access |
diff --git a/content/docs/references/ai/skill.mdx b/content/docs/references/ai/skill.mdx
@@ -36,6 +36,7 @@ const result = Skill.parse(data);
 | **name** | `string` | ✅ | Skill unique identifier (snake_case) |
 | **label** | `string` | ✅ | Skill display name |
 | **description** | `string` | optional | Skill description |
+| **surface** | `Enum<'ask' \| 'build' \| 'both'>` | ✅ | Agent surface this skill binds to ('ask' | 'build' | 'both') — ADR-0063 §3 |
 | **instructions** | `string` | optional | LLM instructions when skill is active |
 | **tools** | `string[]` | ✅ | Tool names belonging to this skill (supports trailing wildcard, e.g. `action_*`) |
 | **triggerPhrases** | `string[]` | optional | Phrases that activate this skill |
diff --git a/content/docs/references/api/contract.mdx b/content/docs/references/api/contract.mdx
@@ -154,7 +154,7 @@ const result = ApiError.parse(data);
 | **having** | `[__schema2](./__schema2)` | optional | HAVING clause for aggregation filtering |
 | **windowFunctions** | `Object[]` | optional | Window functions with OVER clause |
 | **distinct** | `boolean` | optional | SELECT DISTINCT flag |
-| **expand** | `Record<string, [__schema0](./__schema0)>` | optional | Recursive relation loading map. Keys are lookup/master_detail field names; values are nested QueryAST objects that control select, filter, sort, and further expansion on the related object. The engine resolves expand via batch $in queries (driver-agnostic) with a default max depth of 3. |
+| **expand** | `Record<string, [__schema0](./__schema0)>` | optional | Recursive relation loading map. Keys are lookup/master_detail field names; values are nested QueryAST objects that control select (`fields`) and filter (`where`, AND-merged with the batch $in), plus further expansion on the related object. The engine resolves expand via batch $in queries (driver-agnostic) with a default max depth of 3; per-parent `limit`/`offset`/`orderBy` are NOT applied on this path. |
 
 
 ---
diff --git a/content/docs/references/data/data-engine.mdx b/content/docs/references/data/data-engine.mdx
@@ -481,6 +481,7 @@ QueryAST-aligned options for DataEngine.aggregate operations
 | **where** | `Record<string, any> \| [__schema0](./__schema0)` | optional |  |
 | **groupBy** | `string[]` | optional |  |
 | **aggregations** | `Object[]` | optional |  |
+| **timezone** | `string` | optional |  |
 
 
 ---
diff --git a/content/docs/references/data/datasource.mdx b/content/docs/references/data/datasource.mdx
@@ -43,6 +43,7 @@ const result = Datasource.parse(data);
 | **retryPolicy** | `Object` | optional | Connection retry policy for transient failures |
 | **description** | `string` | optional | Internal description |
 | **active** | `boolean` | ✅ | Is datasource enabled |
+| **autoConnect** | `boolean` | ✅ | Force a live driver connection at boot even when managed + unrouted (ADR-0062 D2). |
 | **schemaMode** | `Enum<'managed' \| 'external' \| 'validate-only'>` | ✅ | Schema ownership mode |
 | **external** | `Object` | optional | External datasource federation settings (schemaMode != "managed") |
 | **origin** | `Enum<'code' \| 'runtime'>` | ✅ | Datasource provenance (server-managed, read-only) |
diff --git a/content/docs/references/data/driver.mdx b/content/docs/references/data/driver.mdx
@@ -95,6 +95,7 @@ const result = DriverCapabilities.parse(data);
 | **skipCache** | `boolean` | optional | Bypass cache |
 | **traceContext** | `Record<string, string>` | optional | OpenTelemetry context or request ID |
 | **tenantId** | `string` | optional | Tenant Isolation identifier |
+| **timezone** | `string` | optional | Business reference timezone (IANA) for date-dependent generation, e.g. autonumber date tokens |
 
 
 ---
diff --git a/content/docs/references/data/hook-body.mdx b/content/docs/references/data/hook-body.mdx
@@ -15,6 +15,14 @@ a capability it did not declare, the call throws at invocation time.
 
 - `api.write`  — `ctx.api.object(...).insert / update / delete`
 
+- `api.transaction` — `ctx.api.transaction(async () => \{ … \})` — runs the
+
+callback's `ctx.api` writes/reads inside one driver transaction, committed
+
+on return and rolled back if the callback throws. Requires `api.write`
+
+alongside it to be useful (the transaction body still needs write access).
+
 - `crypto.uuid` — `ctx.crypto.randomUUID()`
 
 - `crypto.hash` — `ctx.crypto.hash(algo, data)`
@@ -86,7 +94,7 @@ L2 sandboxed JS body — runs inside an isolated VM with declared capabilities
 | :--- | :--- | :--- | :--- |
 | **language** | `string` | ✅ |  |
 | **source** | `string` | ✅ | Function body source |
-| **capabilities** | `Enum<'api.read' \| 'api.write' \| 'crypto.uuid' \| 'crypto.hash' \| 'log'>[]` | ✅ | Granted capability tokens |
+| **capabilities** | `Enum<'api.read' \| 'api.write' \| 'api.transaction' \| 'crypto.uuid' \| 'crypto.hash' \| 'log'>[]` | ✅ | Granted capability tokens |
 | **timeoutMs** | `integer` | optional | Per-invocation timeout (ms) |
 | **memoryMb** | `integer` | optional | Per-invocation memory cap (MB) |
 
@@ -101,6 +109,7 @@ L2 sandboxed JS body — runs inside an isolated VM with declared capabilities
 
 * `api.read`
 * `api.write`
+* `api.transaction`
 * `crypto.uuid`
 * `crypto.hash`
 * `log`
@@ -118,7 +127,7 @@ L2 sandboxed JS body — runs inside an isolated VM with declared capabilities
 | :--- | :--- | :--- | :--- |
 | **language** | `string` | ✅ |  |
 | **source** | `string` | ✅ | Function body source |
-| **capabilities** | `Enum<'api.read' \| 'api.write' \| 'crypto.uuid' \| 'crypto.hash' \| 'log'>[]` | ✅ | Granted capability tokens |
+| **capabilities** | `Enum<'api.read' \| 'api.write' \| 'api.transaction' \| 'crypto.uuid' \| 'crypto.hash' \| 'log'>[]` | ✅ | Granted capability tokens |
 | **timeoutMs** | `integer` | optional | Per-invocation timeout (ms) |
 | **memoryMb** | `integer` | optional | Per-invocation memory cap (MB) |
 
diff --git a/content/docs/references/data/object.mdx b/content/docs/references/data/object.mdx
@@ -14,8 +14,8 @@ API Operations Enum
 ## TypeScript Usage
 
 ```typescript
-import { ApiMethod, CDCConfig, Index, ObjectCapabilities, ObjectExternalBinding, ObjectOwnershipEnum, PartitioningConfig, SoftDeleteConfig, TenancyConfig, VersioningConfig } from '@objectstack/spec/data';
-import type { ApiMethod, CDCConfig, Index, ObjectCapabilities, ObjectExternalBinding, ObjectOwnershipEnum, PartitioningConfig, SoftDeleteConfig, TenancyConfig, VersioningConfig } from '@objectstack/spec/data';
+import { ApiMethod, Index, ObjectCapabilities, ObjectExternalBinding, ObjectOwnershipEnum, PartitioningConfig, SoftDeleteConfig, TenancyConfig, VersioningConfig } from '@objectstack/spec/data';
+import type { ApiMethod, Index, ObjectCapabilities, ObjectExternalBinding, ObjectOwnershipEnum, PartitioningConfig, SoftDeleteConfig, TenancyConfig, VersioningConfig } from '@objectstack/spec/data';
 
 // Validate data
 const result = ApiMethod.parse(data);
@@ -43,19 +43,6 @@ const result = ApiMethod.parse(data);
 * `export`
 
 
----
-
-## CDCConfig
-
-### Properties
-
-| Property | Type | Required | Description |
-| :--- | :--- | :--- | :--- |
-| **enabled** | `boolean` | ✅ | Enable Change Data Capture |
-| **events** | `Enum<'insert' \| 'update' \| 'delete'>[]` | ✅ | Event types to capture |
-| **destination** | `string` | ✅ | Destination endpoint (e.g., "kafka://topic", "webhook://url") |
-
-
 ---
 
 ## Index
diff --git a/content/docs/references/data/query.mdx b/content/docs/references/data/query.mdx
@@ -202,7 +202,7 @@ Type: `string`
 | **having** | `[__schema1](./__schema1)` | optional | HAVING clause for aggregation filtering |
 | **windowFunctions** | `Object[]` | optional | Window functions with OVER clause |
 | **distinct** | `boolean` | optional | SELECT DISTINCT flag |
-| **expand** | `Record<string, [#](./#)>` | optional | Recursive relation loading map. Keys are lookup/master_detail field names; values are nested QueryAST objects that control select, filter, sort, and further expansion on the related object. The engine resolves expand via batch $in queries (driver-agnostic) with a default max depth of 3. |
+| **expand** | `Record<string, [#](./#)>` | optional | Recursive relation loading map. Keys are lookup/master_detail field names; values are nested QueryAST objects that control select (`fields`) and filter (`where`, AND-merged with the batch $in), plus further expansion on the related object. The engine resolves expand via batch $in queries (driver-agnostic) with a default max depth of 3; per-parent `limit`/`offset`/`orderBy` are NOT applied on this path. |
 
 
 ---
diff --git a/content/docs/references/kernel/execution-context.mdx b/content/docs/references/kernel/execution-context.mdx
@@ -48,12 +48,18 @@ const result = ExecutionContext.parse(data);
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
 | **userId** | `string` | optional |  |
+| **actor** | `string` | optional |  |
+| **email** | `string` | optional |  |
 | **tenantId** | `string` | optional |  |
+| **timezone** | `string` | optional |  |
+| **locale** | `string` | optional |  |
+| **currency** | `string` | optional |  |
 | **roles** | `string[]` | ✅ |  |
 | **permissions** | `string[]` | ✅ |  |
 | **systemPermissions** | `string[]` | optional |  |
 | **tabPermissions** | `Record<string, Enum<'visible' \| 'hidden' \| 'default_on' \| 'default_off'>>` | optional |  |
 | **org_user_ids** | `string[]` | optional |  |
+| **rlsMembership** | `Record<string, string[]>` | optional |  |
 | **isSystem** | `boolean` | ✅ |  |
 | **accessToken** | `string` | optional |  |
 | **transaction** | `any` | optional |  |
diff --git a/content/docs/references/security/permission.mdx b/content/docs/references/security/permission.mdx
@@ -24,8 +24,8 @@ Refined with enterprise data lifecycle controls:
 ## TypeScript Usage
 
 ```typescript
-import { FieldPermission, ObjectPermission, PermissionSet } from '@objectstack/spec/security';
-import type { FieldPermission, ObjectPermission, PermissionSet } from '@objectstack/spec/security';
+import { FieldPermission, ObjectAccessScope, ObjectPermission, PermissionSet } from '@objectstack/spec/security';
+import type { FieldPermission, ObjectAccessScope, ObjectPermission, PermissionSet } from '@objectstack/spec/security';
 
 // Validate data
 const result = FieldPermission.parse(data);
@@ -43,6 +43,19 @@ const result = FieldPermission.parse(data);
 | **editable** | `boolean` | ✅ | Field edit access |
 
 
+---
+
+## ObjectAccessScope
+
+### Allowed Values
+
+* `own`
+* `own_and_reports`
+* `unit`
+* `unit_and_below`
+* `org`
+
+
 ---
 
 ## ObjectPermission
@@ -60,6 +73,8 @@ const result = FieldPermission.parse(data);
 | **allowPurge** | `boolean` | ✅ | [EXPERIMENTAL — not enforced] Permanently delete (Hard Delete/GDPR) |
 | **viewAllRecords** | `boolean` | ✅ | View All Data (Bypass Sharing) |
 | **modifyAllRecords** | `boolean` | ✅ | Modify All Data (Bypass Sharing) |
+| **readScope** | `Enum<'own' \| 'own_and_reports' \| 'unit' \| 'unit_and_below' \| 'org'>` | optional | [ADR-0057 D1] Read depth: own|unit|unit_and_below|org |
+| **writeScope** | `Enum<'own' \| 'own_and_reports' \| 'unit' \| 'unit_and_below' \| 'org'>` | optional | [ADR-0057 D1] Write depth: own|unit|unit_and_below|org |
 
 
 ---
@@ -73,6 +88,7 @@ const result = FieldPermission.parse(data);
 | **name** | `string` | ✅ | Permission set unique name (lowercase snake_case) |
 | **label** | `string` | optional | Display label |
 | **isProfile** | `boolean` | ✅ | Whether this is a user profile |
+| **isDefault** | `boolean` | ✅ | [ADR-0056 D7] When true, this profile is the FALLBACK assigned to authenticated users who have no explicit grants — an app declares its default access posture here instead of relying on the built-in member_default. Foundation for SSO/JIT provisioning. |
 | **objects** | `Record<string, Object>` | ✅ | Entity permissions |
 | **fields** | `Record<string, Object>` | optional | Field level security |
 | **systemPermissions** | `string[]` | optional | System level capabilities |
diff --git a/content/docs/references/security/rls.mdx b/content/docs/references/security/rls.mdx
@@ -25,31 +25,37 @@ permissions (CRUD), RLS provides record-level filtering.
 
 - Users only see records from their organization
 
-- `using: "organization_id = current_user.organization_id"`
+- `using: "organization_id == current_user.organization_id"`
 
 2. **Ownership-Based Access**
 
 - Users only see records they own
 
-- `using: "owner_id = current_user.id"`
+- `using: "owner_id == current_user.id"`
 
-3. **Department-Based Access**
+3. **Organization Member Visibility**
 
-- Users only see records from their department
+- Users see fellow members of their active organization
 
-- `using: "department = current_user.department"`
+- `using: "id in current_user.org_user_ids"`
 
-4. **Regional Access Control**
+(`org_user_ids` is pre-resolved by the runtime)
 
-- Sales reps only see accounts in their territory
+4. **Territory / Regional Access (§7.3.1 dynamic membership)**
 
-- `using: "region IN (current_user.assigned_regions)"`
+- Sales reps only see accounts in their assigned territories
 
-5. **Time-Based Access**
+- `using: "account_id in current_user.territory_account_ids"`
 
-- Users can only access active records
+(the runtime stages `territory_account_ids` in `ExecutionContext.rlsMembership`)
 
-- `using: "status = 'active' AND expiry_date > NOW()"`
+5. **Manager / Hierarchy Access (§7.3.1 dynamic membership)**
+
+- Managers see records assigned to anyone they manage
+
+- `using: "assigned_to_id in current_user.team_member_ids"`
+
+(the runtime pre-resolves `team_member_ids`, no subquery needed)
 
 ## PostgreSQL RLS Comparison
 
@@ -83,7 +89,7 @@ object: 'account',
 
 operation: 'select',
 
-using: 'organization_id = current_user.organization_id'
+using: 'organization_id == current_user.organization_id'
 
 \}
 
@@ -105,11 +111,11 @@ Salesforce:
 
 ObjectStack RLS:
 
-- More flexible formula-based conditions
+- A small, fixed expression grammar (equality, set-membership, always-true)
 
-- Direct SQL-like syntax
+- Subquery-shaped needs are pre-resolved by the runtime (§7.3.1)
 
-- Supports complex logic with AND/OR/NOT
+- Multiple policies OR-combine for union (any-match-allows) semantics
 
 ## Best Practices
 
@@ -265,7 +271,7 @@ const result = RLSAuditConfig.parse(data);
 | **description** | `string` | optional | Policy description and business justification |
 | **object** | `string` | ✅ | Target object name |
 | **operation** | `Enum<'select' \| 'insert' \| 'update' \| 'delete' \| 'all'>` | ✅ | Database operation this policy applies to |
-| **using** | `string` | optional | Filter condition for SELECT/UPDATE/DELETE (PostgreSQL SQL WHERE clause syntax with parameterized context variables). Optional for INSERT-only policies. |
+| **using** | `string` | optional | Filter condition for SELECT/UPDATE/DELETE. One of the four compiler-supported forms: `field = current_user.<prop>`, `field = 'literal'`, `field IN (current_user.<array>)`, or `1 = 1`. Optional for INSERT-only policies. |
 | **check** | `string` | optional | Validation condition for INSERT/UPDATE (defaults to USING clause if not specified - enforced at application level) |
 | **roles** | `string[]` | optional | Roles this policy applies to (omit for all roles) |
 | **enabled** | `boolean` | ✅ | Whether this policy is active |
diff --git a/content/docs/references/ui/component.mdx b/content/docs/references/ui/component.mdx
@@ -14,8 +14,8 @@ Empty Properties Schema
 ## TypeScript Usage
 
 ```typescript
-import { AIChatWindowProps, ElementButtonProps, ElementFilterProps, ElementImageProps, ElementNumberProps, ElementRecordPickerProps, ElementTextProps, PageAccordionProps, PageCardProps, PageHeaderProps, PageTabsProps, RecordActivityProps, RecordChatterProps, RecordDetailsProps, RecordHighlightsField, RecordHighlightsProps, RecordPathProps, RecordRelatedListProps } from '@objectstack/spec/ui';
-import type { AIChatWindowProps, ElementButtonProps, ElementFilterProps, ElementImageProps, ElementNumberProps, ElementRecordPickerProps, ElementTextProps, PageAccordionProps, PageCardProps, PageHeaderProps, PageTabsProps, RecordActivityProps, RecordChatterProps, RecordDetailsProps, RecordHighlightsField, RecordHighlightsProps, RecordPathProps, RecordRelatedListProps } from '@objectstack/spec/ui';
+import { AIChatWindowProps, ElementButtonProps, ElementFilterProps, ElementImageProps, ElementMetadataViewerProps, ElementNumberProps, ElementRecordPickerProps, ElementTextProps, PageAccordionProps, PageCardProps, PageHeaderProps, PageTabsProps, RecordActivityProps, RecordChatterProps, RecordDetailsProps, RecordHighlightsField, RecordHighlightsProps, RecordPathProps, RecordRelatedListProps } from '@objectstack/spec/ui';
+import type { AIChatWindowProps, ElementButtonProps, ElementFilterProps, ElementImageProps, ElementMetadataViewerProps, ElementNumberProps, ElementRecordPickerProps, ElementTextProps, PageAccordionProps, PageCardProps, PageHeaderProps, PageTabsProps, RecordActivityProps, RecordChatterProps, RecordDetailsProps, RecordHighlightsField, RecordHighlightsProps, RecordPathProps, RecordRelatedListProps } from '@objectstack/spec/ui';
 
 // Validate data
 const result = AIChatWindowProps.parse(data);
@@ -83,6 +83,22 @@ const result = AIChatWindowProps.parse(data);
 | **aria** | `Object` | optional | ARIA accessibility attributes |
 
 
+---
+
+## ElementMetadataViewerProps
+
+### Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **type** | `Enum<'state_machine' \| 'flow' \| 'permission'>` | ✅ | Metadata view kind (ADR-0051): state_machine | flow | permission |
+| **name** | `string` | ✅ | Target metadata item name; resolved package-scoped (ADR-0048), then dependencies (ADR-0046 §3.3) |
+| **object** | `string` | optional | Owning object — required for object-scoped kinds: state_machine is a rule ON an object (ADR-0020), permission renders a matrix FOR one; omit for top-level flow |
+| **mode** | `Enum<'diagram' \| 'matrix' \| 'summary'>` | optional | Render form; defaults per type (diagram for flow/state_machine, matrix for permission) |
+| **detail** | `Enum<'business' \| 'technical'>` | ✅ | Authoring altitude (ADR-0051 §3.4): business collapses technical flow nodes to business steps + approvals. NOT access (cf. book.audience); permission projection is automatic and render-time, never set here |
+| **aria** | `Object` | optional | ARIA accessibility attributes |
+
+
 ---
 
 ## ElementNumberProps
diff --git a/content/docs/references/ui/dataset.mdx b/content/docs/references/ui/dataset.mdx
@@ -108,6 +108,7 @@ const result = Dataset.parse(data);
 | **field** | `string` | optional | Aggregated field; optional for count(*) |
 | **filter** | `[__schema0](./__schema0)` | optional |  |
 | **format** | `string` | optional |  |
+| **currency** | `string` | optional | Display currency code (ISO 4217) |
 | **certified** | `boolean` | ✅ | Blessed metric (governance checkpoint) |
 | **derived** | `Object` | optional |  |
 
diff --git a/content/docs/references/ui/page.mdx b/content/docs/references/ui/page.mdx
@@ -78,13 +78,17 @@ Interface-level page configuration (Airtable parity)
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
 | **source** | `string` | optional | Source object name for the page |
-| **sourceView** | `string` | optional | Named list view on the source object to inherit columns/filter/sort from (ADR-0047 iron rule: the page adds presentation policy only). Omit to use the object default view |
+| **columns** | `string[] \| Object[]` | optional | Columns shown by the page. Blank = all object fields. Defined directly on the page (no view inheritance). |
+| **sort** | `Object[]` | optional | Default sort order for the page, defined directly on the page. |
+| **filterBy** | `Object[]` | optional | Always-on page filter (base filter). |
 | **levels** | `integer` | optional | Number of hierarchy levels to display |
-| **filterBy** | `Object[]` | optional | Page-level filter criteria |
+| **sourceView** | `string` | optional | @deprecated Legacy named-view inheritance. Define columns/sort/filterBy on the page instead. |
 | **appearance** | `Object` | optional | Appearance and visualization configuration |
 | **userFilters** | `Object` | optional | End-user quick-filter bar for this page (overrides the source view's userFilters) |
 | **userActions** | `Object` | optional | User action toggles |
 | **addRecord** | `Object` | optional | Add record entry point configuration |
+| **buttons** | `string[]` | optional | Toolbar buttons — names of the source object's actions to surface in the page toolbar |
+| **recordAction** | `Enum<'drawer' \| 'page' \| 'modal' \| 'none'>` | optional | How clicking a record opens its detail (drawer | page | modal | none). Default: drawer |
 | **showRecordCount** | `boolean` | optional | Show record count at page bottom |
 | **allowPrinting** | `boolean` | optional | Allow users to print the page |
 
diff --git a/content/docs/references/ui/view.mdx b/content/docs/references/ui/view.mdx
diff --git a/packages/runtime/src/app-plugin.ts b/packages/runtime/src/app-plugin.ts
