Merge remote-tracking branch 'origin/main' into fix/3278-retire-js-expression-dialect

# Conflicts:
#	content/docs/references/ui/app.mdx

Author: os-zhuang

.changeset/action-body-org-identifier.md

@@ -0,0 +1,12 @@
+---
+"@objectstack/runtime": patch
+---
+
+**Extend the blessed `organizationId` org name to the action-body surface (follow-up to #3280).** Hooks now teach `ctx.user.organizationId` / `ctx.session.organizationId` as the blessed name for the caller's active org; action bodies — the sibling authoring surface that shares the same sandbox runner — were left behind: the REST dispatch path exposed only `ctx.user.tenantId` (the deprecated name) and no `ctx.session` at all, and the MCP `run_action` path exposed neither.
+
+Both action-dispatch sites (`handleActions`, MCP `runAction`) now populate:
+
+- **`ctx.user.organizationId`** — the blessed name (matches the `organization_id` column and `current_user.organizationId` in RLS); `ctx.user.tenantId` is kept as a deprecated alias with the identical value on the REST path.
+- **`ctx.session`** (`{ userId, organizationId, tenantId, roles? }`) — mirrors the hook `ctx.session` shape, `undefined` for a context-less / self-invoked call.
+
+Action bodies execute trusted (the `ctx.engine` / `ctx.api` facade bypasses RLS/FLS), so a body that must scope by org has to read it from `ctx` — now under the same name a hook author uses. Additive and behavior-preserving; the objectstack-ui skill documents the action-body `ctx` and the `organizationId` read.

.changeset/adr-0099-p0-equivalence-gate.md

@@ -0,0 +1,5 @@
+---
+'@objectstack/plugin-security': patch
+---
+
+ADR-0099 P0: land the probe-vs-carried-rung equivalence gate in the authz matrix (`authz-matrix-gate.test.ts`) — seeded-shape equivalence cells, two adversarial `KNOWN DIVERGENCE` pins (scoped `admin_full_access` grant; piecemeal platform-exclusive capability), the I2 nesting and I3 narrowing invariant cells, posture-blindness staging pins for the P1 flip, and the EXTERNAL dead-branch cell. Extracts the platform-admin capability probe as the exported pure `hasPlatformAdminCapability` (mechanical, behavior unchanged). Test-only gate; the ADR-0099 P1 flip lands behind it (#3211).

.changeset/adr-0099-p1-layer0-reads-rung.md

@@ -0,0 +1,9 @@
+---
+'@objectstack/plugin-security': patch
+---
+
+ADR-0099 P1 (#3211 M2): the Layer 0 cross-tenant exemption gate now reads the carried `ctx.posture` rung (#2956) as authoritative, with the platform-admin capability probe demoted to a fallback for resolver-less contexts (delegated-admin bridge, sharing service, `getReadFilter`). The read and write (insert/update post-image) tenant checks share one decision (`computeLayeredRlsFilter`), so they cannot drift. A probe↔rung disagreement logs a defect breadcrumb and enforces the narrower rung verdict.
+
+**Behavior change (security narrowing, multi-org / `@objectstack/organizations` only):** a principal whose carried rung is not `PLATFORM_ADMIN` no longer crosses the tenant wall on private / platform-global / better-auth-managed objects, even when its resolved permission sets carry a platform-exclusive capability. Two shapes are affected: (a) a **scoped** `admin_full_access` grant (`sys_user_permission_set.organization_id` non-null), and (b) a custom set granting a platform capability (e.g. `studio.access`) piecemeal alongside a superuser bit. Both are now walled to their own org — the fail-safe direction (the carried rung is a strict subset of the probe). Single-org / env-per-database deployments are unaffected (Layer 0 is inert).
+
+**Upgrade check:** before upgrading, scan `sys_user_permission_set` for `admin_full_access` rows with a non-null `organization_id`, and custom permission sets whose `systemPermissions` intersect `{manage_metadata, manage_platform_settings, studio.access, manage_users}`. To restore cross-tenant operator access for such a principal, grant the **unscoped** `admin_full_access` instead. The `[authz/ADR-0099]` warn log names any principal hitting the divergence at runtime.

.changeset/adr-0099-p2prime-two-axis-cells.md

@@ -0,0 +1,5 @@
+---
+'@objectstack/plugin-security': patch
+---
+
+ADR-0099 P2′ (#3211 M3′): pin the two-axis Amendment in the authz matrix. The original P2 (collapse the Layer 1 tier onto posture) was rejected — Layer 1's tier input is the per-object super-bit, a per-principal × per-object delegation primitive posture cannot represent. New cells pin: seeded-face agreement (seeded super-bit holders are already ≥ TENANT_ADMIN), the load-bearing delegation cell (a MEMBER with a delegated per-object `viewAllRecords`/`modifyAllRecords` short-circuits Layer 1 yet stays walled by Layer 0 — the auditor pattern), invariant I7 (the scope axis never crosses a boundary posture has not opened), and the contrast that the bit is a real grantable capability, not conditionally inert. Test-only; zero behavior change.

.changeset/create-user-result-dialog-phone.md

@@ -0,0 +1,12 @@
+---
+'@objectstack/platform-objects': minor
+---
+
+feat(platform-objects): surface phone number in the create_user result dialog
+
+`sys_user`'s `create_user` action now declares `user.phoneNumber` in its
+`resultDialog.fields`, so admins creating phone-based accounts see the
+sign-in phone number alongside the email and temporary password. The
+create-user response carries `phoneNumber` only for phone-based users;
+objectui's ActionResultDialog skips declared fields whose path is absent
+from the payload, so email-only users see no extra row.

.changeset/cross-object-batch-authz-hardening.md

@@ -0,0 +1,35 @@
+---
+'@objectstack/rest': patch
+'@objectstack/spec': minor
+---
+
+fix(rest): gate the cross-object transactional batch by the same per-object API rules as single-record writes (#1604)
+
+The `POST {basePath}/batch` route (issue #1604 / ADR-0034) wraps N cross-object
+create/update/delete ops in one engine transaction, but it skipped the
+per-object API-exposure gate every single-record route applies — an
+authenticated caller could write to an `apiEnabled: false` object, or run an
+operation outside an object's `apiMethods` whitelist, straight through the batch
+surface (ADR-0049 / #1889 — the same "declared ≠ enforced" hole closed for the
+generic write path in #3220 / #3213).
+
+The route now:
+
+- validates the body against a new `CrossObjectBatchRequestSchema`
+  (`@objectstack/spec/api`, Zod-First) — a malformed op, an unknown action, or a
+  missing `object` is a `400` instead of a `500`;
+- enforces `enable.apiEnabled` / `enable.apiMethods` for **every** op (metadata
+  fetched once, each distinct `(object, action)` checked) BEFORE opening the
+  transaction — `404 OBJECT_API_DISABLED` / `405 OBJECT_API_METHOD_NOT_ALLOWED`;
+- requires an `id` for `update` / `delete` (`400`);
+- rejects an unresolvable `{ $ref }` with `400 BATCH_UNRESOLVED_REF` instead of
+  silently writing a `null` FK;
+- rejects an explicit `atomic: false` (`400 BATCH_NOT_ATOMIC`) rather than
+  silently applying atomically — non-atomic per-object batches stay on
+  `POST /data/:object/batch`.
+
+`enforceApiAccess` is refactored to share the pure `apiAccessDenialFromEnable`
+check + a `loadObjectItems` helper with the batch route (single-record behavior
+unchanged). Adds `rest-batch-endpoint.test.ts` — the REST-boundary coverage
+ADR-0034 flagged as missing (commit, `$ref`, rollback surfacing, API-access
+denial, request validation).

.changeset/drill-range-datetime-tz.md

@@ -0,0 +1,25 @@
+---
+'@objectstack/core': minor
+'@objectstack/service-analytics': minor
+---
+
+feat(analytics): scope a datetime date-bucket drill to the reference-tz midnight instants (#1752 follow-up)
+
+Closes the one gap left by the initial #1752 change: a `datetime` date dimension
+bucketed under a **non-UTC reference timezone** previously fell back to a superset
+drill (its bucket boundary is that tz's midnight *instant*, which `YYYY-MM-DD`
+calendar bounds can't express).
+
+- **`@objectstack/core`** adds `zonedDateStartToUtcMs(ymd, tz)` — the UTC instant
+  at which a calendar day begins in a reference timezone (the inverse of
+  `calendarPartsInTz`). DST-safe: the offset is read from the platform tz
+  database via `Intl`, with a two-pass resolution for the rare offset-boundary
+  case; an unset/`'UTC'`/invalid zone returns plain UTC midnight.
+- **`@objectstack/service-analytics`** now emits `drillRanges` bounds per the
+  field's temporal type (ADR-0053): a `datetime` field → ISO **instant** bounds
+  at the reference tz's midnight (works under any tz, incl. DST); a `date` field
+  → `YYYY-MM-DD` calendar bounds (tz-naive, exact under any tz). An unknown field
+  type is still emitted only under UTC and omitted (superset) under a non-UTC tz.
+
+No objectui change is needed — the client already forwards whatever bound values
+the server sends into the drill filter and the `filter[field][gte|lt]` URL.

.changeset/driver-sql-sqlite3-peer.md

@@ -0,0 +1,21 @@
+---
+"@objectstack/driver-sql": patch
+---
+
+fix(driver-sql): drop the vestigial `sqlite3` peerDependency — the SQLite path uses `better-sqlite3` (#3277)
+
+`package.json` advertised `peerDependencies.sqlite3: "^5.0.0"`, but the driver never
+loads `sqlite3` at runtime. Every first-party SQLite construction site builds a
+`client: 'better-sqlite3'` Knex driver (`resolveSqliteDriver` in
+`@objectstack/service-datasource`, the datasource driver factory, and the whole
+driver test suite), and the README already tells consumers to `pnpm add better-sqlite3`.
+`better-sqlite3` is auto-provided as an `optionalDependency` (with the native → wasm →
+memory step-down of #2229 covering a failed native build), so the SQLite requirement is
+already satisfied without the consumer installing anything.
+
+The stale `sqlite3` peer only misled: a consumer resolving peer deps could `pnpm add
+sqlite3` (never used) while believing they'd satisfied the SQLite requirement. Removing
+it aligns the declared contract with the code and the docs. The `sqlite3` string alias
+still maps to `better-sqlite3` in the driver factory and dialect detection, so
+`driver: 'sqlite3'` config keeps working — it just resolves to `better-sqlite3` like
+everything else.

.changeset/field-form-summary-subfields.md

@@ -0,0 +1,16 @@
+---
+'@objectstack/spec': patch
+---
+
+fix(spec): declare `summaryOperations` sub-fields in the Field metadata form (#3257)
+
+`fieldForm` (the registered metadata form for editing a Field) previously
+declared `summaryOperations` as a bare `composite` with no sub-fields, so a
+protocol-driven renderer had to fall back to a raw JSON editor. It now declares
+the inner shape explicitly — `object` (`ref:object`), `function` (select),
+`field`, `relationshipField`, and `filter` (bound to `widget: 'filter-condition'`)
+— mirroring the `summaryOperations` Zod schema and surfacing the roll-up `filter`
+added in #1868. Also gates the block to `data.type == 'summary'`.
+
+Small step toward #3257 (making the Studio field designer metadata-driven rather
+than hand-coded); the live objectui inspector already edits these fields.

.changeset/hook-nested-write-timeout.md

@@ -0,0 +1,24 @@
+---
+'@objectstack/runtime': patch
+---
+
+fix(runtime): honor a hook body's declared `timeoutMs` so nested cross-object writes aren't clamped to 250ms (#1867)
+
+Hook bodies run in the QuickJS sandbox with a default 250ms timeout. The runner
+folded that engine default straight into `Math.min(...)` when resolving the
+effective timeout, so it *always* dominated for hooks: a body that declared a
+larger `timeoutMs` (the spec permits up to 30_000ms — `ScriptBody.timeoutMs`) to
+give a legitimate nested write — "when a child changes, update the parent" —
+room to settle was silently clamped back to 250ms and killed mid-flight. The
+declared knob was never enforced.
+
+The engine default is now a FALLBACK used only when no explicit timeout is
+supplied, not a hard ceiling. An explicit `body.timeoutMs` (and/or an enclosing
+hook/action timeout) is honored; when both are present the smaller wins. Bodies
+that declare nothing still get the 250ms hook / 5000ms action default, and a
+body may still LOWER its own timeout below the default.
+
+This clears the last reliability blocker for nested cross-object writes from
+hooks — the sandbox crash itself (`memory access out of bounds`) was already
+fixed by the deferred-promise host-call model — so header/rollup fields no
+longer need denormalized, hand-maintained workarounds.