chore!: remove unused HTTP adapters (keep Hono only) + MSW plugin (12.0) (#2391)

The express/fastify/nextjs/nestjs/nuxt/sveltekit adapters and @objectstack/plugin-msw
had ZERO internal consumers and were not dogfooded — pure release/maintenance
surface + untested-integration liability. Removed; @objectstack/hono (the adapter
actually used, via @objectstack/client) is kept. Open edition = Hono adapter only.

- Delete 6 adapter packages + plugin-msw (fixed group 73 → 66).
- client: drop plugin-msw / msw dev usage (deleted client.msw.test.ts).
- Correct HttpDispatcher's misleading `@deprecated → createDispatcherPlugin` note
  (createDispatcherPlugin is a kernel route plugin, not a drop-in); the class is
  now used only by the Hono adapter + internal dispatcher-plugin.
- Docs: rest/README + hono/README adapter references updated to Hono-only.

Resolves the #2380 blast-radius concern (HttpDispatcher consumers collapse to Hono).
Verified: full workspace build green (69 tasks); client tests 101.

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

.changeset/config.json

@@ -40,7 +40,6 @@
       "@objectstack/plugin-email",
       "@objectstack/plugin-hono-server",
       "@objectstack/mcp",
-      "@objectstack/plugin-msw",
       "@objectstack/plugin-org-scoping",
       "@objectstack/plugin-reports",
       "@objectstack/plugin-security",
@@ -52,13 +51,7 @@
       "@objectstack/connector-mcp",
       "@objectstack/connector-rest",
       "@objectstack/connector-slack",
-      "@objectstack/express",
-      "@objectstack/fastify",
       "@objectstack/hono",
-      "@objectstack/nestjs",
-      "@objectstack/nextjs",
-      "@objectstack/nuxt",
-      "@objectstack/sveltekit",
       "@objectstack/service-analytics",
       "@objectstack/service-automation",
       "@objectstack/service-cache",

.changeset/v11-remove-unused-adapters.md

@@ -0,0 +1,23 @@
+---
+"@objectstack/client": major
+"@objectstack/runtime": patch
+---
+
+Remove the unused HTTP framework adapters and the MSW plugin — the open edition ships the **Hono** adapter only.
+
+The `express` / `fastify` / `nextjs` / `nestjs` / `nuxt` / `sveltekit` adapters and
+`@objectstack/plugin-msw` had **zero internal consumers** and were not dogfooded —
+pure release/maintenance surface (and an untested-integration liability). They are
+removed; `@objectstack/hono` (the adapter actually used, via `@objectstack/client`)
+is kept.
+
+- Deleted packages: `@objectstack/express`, `@objectstack/fastify`,
+  `@objectstack/nextjs`, `@objectstack/nestjs`, `@objectstack/nuxt`,
+  `@objectstack/sveltekit`, `@objectstack/plugin-msw` (fixed group 73 → 66).
+- `@objectstack/client`: dropped the `plugin-msw` / `msw` dev usage (MSW test removed).
+- `HttpDispatcher` (the dispatch engine) is now used only by the Hono adapter +
+  the internal dispatcher-plugin, so its misleading `@deprecated → createDispatcherPlugin`
+  note (createDispatcherPlugin is a kernel plugin, not a drop-in) is corrected.
+
+Anyone needing another framework adapter can build one on the public
+`HttpDispatcher` / `createDispatcherPlugin` API or maintain it out-of-tree.

content/docs/references/ai/solution-blueprint.mdx

@@ -34,8 +34,8 @@ batch-draft. This is the safety valve for low-specificity input.
 ## TypeScript Usage
 
 ```typescript
-import { BlueprintApp, BlueprintDashboard, BlueprintField, BlueprintNavItem, BlueprintObject, BlueprintSeed, BlueprintView, SolutionBlueprint, SolutionBlueprintStrict } from '@objectstack/spec/ai';
-import type { BlueprintApp, BlueprintDashboard, BlueprintField, BlueprintNavItem, BlueprintObject, BlueprintSeed, BlueprintView, SolutionBlueprint, SolutionBlueprintStrict } from '@objectstack/spec/ai';
+import { BlueprintApp, BlueprintDashboard, BlueprintField, BlueprintNavItem, BlueprintObject, BlueprintSeed, BlueprintView, BlueprintWidgetCondition, SolutionBlueprint, SolutionBlueprintStrict } from '@objectstack/spec/ai';
+import type { BlueprintApp, BlueprintDashboard, BlueprintField, BlueprintNavItem, BlueprintObject, BlueprintSeed, BlueprintView, BlueprintWidgetCondition, SolutionBlueprint, SolutionBlueprintStrict } from '@objectstack/spec/ai';
 
 // Validate data
 const result = BlueprintApp.parse(data);
@@ -78,7 +78,7 @@ const result = BlueprintApp.parse(data);
 | :--- | :--- | :--- | :--- |
 | **name** | `string` | ✅ | Field machine name (snake_case) |
 | **label** | `string` | optional | Human-readable field label |
-| **type** | `Enum<'text' \| 'textarea' \| 'email' \| 'url' \| 'phone' \| 'password' \| 'secret' \| 'markdown' \| 'html' \| 'richtext' \| 'number' \| 'currency' \| 'percent' \| 'date' \| 'datetime' \| 'time' \| 'boolean' \| 'toggle' \| 'select' \| 'multiselect' \| 'radio' \| 'checkboxes' \| 'lookup' \| 'master_detail' \| 'tree' \| 'image' \| 'file' \| 'avatar' \| 'video' \| 'audio' \| 'formula' \| 'summary' \| 'autonumber' \| 'composite' \| 'repeater' \| 'record' \| 'location' \| 'address' \| 'code' \| 'json' \| 'color' \| 'rating' \| 'slider' \| 'signature' \| 'qrcode' \| 'progress' \| 'tags' \| 'vector'>` | ✅ | Field data type |
+| **type** | `Enum<'text' \| 'textarea' \| 'email' \| 'url' \| 'phone' \| 'password' \| 'secret' \| 'markdown' \| 'html' \| 'richtext' \| 'number' \| 'currency' \| 'percent' \| 'date' \| 'datetime' \| 'time' \| 'boolean' \| 'toggle' \| 'select' \| 'multiselect' \| 'radio' \| 'checkboxes' \| 'lookup' \| 'master_detail' \| 'tree' \| 'user' \| 'image' \| 'file' \| 'avatar' \| 'video' \| 'audio' \| 'formula' \| 'summary' \| 'autonumber' \| 'composite' \| 'repeater' \| 'record' \| 'location' \| 'address' \| 'code' \| 'json' \| 'color' \| 'rating' \| 'slider' \| 'signature' \| 'qrcode' \| 'progress' \| 'tags' \| 'vector'>` | ✅ | Field data type |
 | **required** | `boolean` | optional | Whether the field is required |
 | **reference** | `string` | optional | Target object name for lookup / master_detail relationship fields |
 | **options** | `Object[]` | optional | Choices for select / multiselect / radio fields |
@@ -140,6 +140,19 @@ const result = BlueprintApp.parse(data);
 | **groupBy** | `string` | optional | REQUIRED for kanban views: the select/status field whose options become the board columns (e.g. "stage", "status"). Without it a kanban renders as a plain list. |
 
 
+---
+
+## BlueprintWidgetCondition
+
+### Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **field** | `string` | ✅ | Field on the widget object to filter by (e.g. "stock_quantity", "status") |
+| **op** | `Enum<'lt' \| 'lte' \| 'gt' \| 'gte' \| 'eq' \| 'ne'>` | ✅ | Comparison operator |
+| **value** | `number \| string \| boolean` | ✅ | Comparison value (e.g. 10, "open") |
+
+
 ---
 
 ## SolutionBlueprint

content/docs/references/api/auth-endpoints.mdx

@@ -61,6 +61,7 @@ const result = AuthEndpoint.parse(data);
 | **passkeys** | `boolean` | ✅ | Passkey/WebAuthn support enabled |
 | **magicLink** | `boolean` | ✅ | Magic link login enabled |
 | **organization** | `boolean` | ✅ | Multi-tenant organization support enabled |
+| **ssoEnforced** | `boolean` | optional | SSO-only login enforced: the UI hides the local password form + self-registration (a break-glass "use a password" link remains) |
 
 
 ---

content/docs/references/automation/execution.mdx

@@ -141,7 +141,7 @@ const result = Checkpoint.parse(data);
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
 | **nodeId** | `string` | ✅ | Node ID that was executed |
-| **nodeType** | `string` | ✅ | Node action type (e.g., "decision", "http_request") |
+| **nodeType** | `string` | ✅ | Node action type (e.g., "decision", "http") |
 | **nodeLabel** | `string` | optional | Human-readable node label |
 | **status** | `Enum<'success' \| 'failure' \| 'skipped'>` | ✅ | Step execution result |
 | **startedAt** | `string` | ✅ | When the step started |

content/docs/references/automation/flow.mdx

@@ -74,7 +74,6 @@ const result = FlowNode.parse(data);
 * `delete_record`
 * `get_record`
 * `http`
-* `http_request`
 * `notify`
 * `script`
 * `screen`

content/docs/references/data/object.mdx

@@ -14,8 +14,8 @@ API Operations Enum
 ## TypeScript Usage
 
 ```typescript
-import { ApiMethod, Index, ObjectCapabilities, ObjectExternalBinding, ObjectOwnershipEnum, PartitioningConfig, SoftDeleteConfig, TenancyConfig, VersioningConfig } from '@objectstack/spec/data';
-import type { ApiMethod, Index, ObjectCapabilities, ObjectExternalBinding, ObjectOwnershipEnum, PartitioningConfig, SoftDeleteConfig, TenancyConfig, VersioningConfig } from '@objectstack/spec/data';
+import { ApiMethod, Index, ObjectAccessConfig, ObjectCapabilities, ObjectExternalBinding, ObjectOwnershipEnum, PartitioningConfig, SoftDeleteConfig, TenancyConfig, VersioningConfig } from '@objectstack/spec/data';
+import type { ApiMethod, Index, ObjectAccessConfig, ObjectCapabilities, ObjectExternalBinding, ObjectOwnershipEnum, PartitioningConfig, SoftDeleteConfig, TenancyConfig, VersioningConfig } from '@objectstack/spec/data';
 
 // Validate data
 const result = ApiMethod.parse(data);
@@ -58,6 +58,17 @@ const result = ApiMethod.parse(data);
 | **partial** | `string` | optional | Partial index condition (SQL WHERE clause for conditional indexes) |
 
 
+---
+
+## ObjectAccessConfig
+
+### Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **default** | `Enum<'public' \| 'private'>` | ✅ | Default exposure posture: public (covered by wildcard grants) | private (needs explicit grant; exempt from wildcard RLS). |
+
+
 ---
 
 ## ObjectCapabilities

content/docs/references/security/index.mdx

@@ -7,7 +7,6 @@ This section contains all protocol schemas for the security layer of ObjectStack
 
 <Cards>
   <Card href="/docs/references/security/permission" title="Permission" description="Source: packages/spec/src/security/permission.zod.ts" />
-  <Card href="/docs/references/security/policy" title="Policy" description="Source: packages/spec/src/security/policy.zod.ts" />
   <Card href="/docs/references/security/rls" title="Rls" description="Source: packages/spec/src/security/rls.zod.ts" />
   <Card href="/docs/references/security/sharing" title="Sharing" description="Source: packages/spec/src/security/sharing.zod.ts" />
   <Card href="/docs/references/security/territory" title="Territory" description="Source: packages/spec/src/security/territory.zod.ts" />

content/docs/references/security/meta.json

@@ -2,7 +2,6 @@
   "title": "Security Protocol",
   "pages": [
     "permission",
-    "policy",
     "rls",
     "sharing",
     "territory"