Merge branch 'main' into fix/analytics-label-scope-3602

Author: os-zhuang

.changeset/better-auth-team-member-count.md

@@ -0,0 +1,43 @@
+---
+"@objectstack/platform-objects": patch
+"@objectstack/plugin-auth": patch
+---
+
+fix(auth): provision the better-auth 1.7 columns `sys_team` / `sys_team_member` / `sys_two_factor` were missing (#3624)
+
+better-auth 1.7.0-rc.1 added fields to three models that the platform objects
+never provisioned and `auth-schema-config.ts` never mapped. Because an unmapped
+field keeps its camelCase name, the adapter emitted columns no table had:
+
+| model | field | column now provisioned |
+|:---|:---|:---|
+| `team` | `memberCount` | `sys_team.member_count` |
+| `teamMember` | `membershipKey` | `sys_team_member.membership_key` |
+| `twoFactor` | `failedVerificationCount` / `lockedUntil` | `sys_two_factor.failed_verification_count` / `locked_until` |
+
+The team pair broke org creation outright. The organization plugin's team
+sub-feature is on by default, so `POST /api/v1/auth/organization/create`
+auto-creates a default team — and that insert died with `table sys_team has no
+column named memberCount` *after* the organization row had already committed.
+Callers got an HTTP 500 on top of a half-created org: a real org row with no
+default team behind it. Every multi-org deployment's create-org flow hit this.
+
+The two-factor pair broke the 2FA lockout path the same way: better-auth
+guard-increments `failedVerificationCount` on each wrong code and stamps
+`lockedUntil` past the threshold, so a wrong code 500'd instead of being
+counted. All four columns are better-auth's own state — provisioned, readable,
+and never written from the ObjectStack side.
+
+Existing environments pick the columns up through the driver's additive schema
+sync; no data migration is needed. `member_count` backfills to 0 and
+better-auth's own `syncTeamMemberCount` reconciles it on the next membership
+change, and `membership_key` stays null on pre-upgrade rows, which better-auth
+tolerates by falling back to the `(team_id, user_id)` pair.
+
+A new drift gate (`better-auth-schema-parity.test.ts`) now asserts that every
+column the installed better-auth version can write exists on the platform
+object backing it, across the auth manager's whole model surface. The ADR-0092
+D7 guard only ever caught *collisions* between our extension fields and
+better-auth's, so a bump that adds a brand-new field passed the build and failed
+at runtime — twice now, counting the 1.7 `oauthAccessToken.authorizationCodeId`
+regression. The next one fails the build instead.

.changeset/invitation-accepted-host-seam.md

@@ -0,0 +1,20 @@
+---
+"@objectstack/plugin-auth": minor
+---
+
+feat(auth): `onInvitationAccepted` host seam — better-auth's
+`afterAcceptInvitation` forwarded to the host (ADR-0105 D8 prerequisite)
+
+An invitation may carry placement intent (target business unit + positions,
+extension fields on `sys_invitation` per the ADR-0092 whitelist), but there
+was no server-side seam to apply it when the invitation is accepted —
+better-auth's org-plugin models don't fire core `databaseHooks` (framework
+#3541 D8 note).
+
+`AuthManagerConfig.onInvitationAccepted` mirrors `onOrganizationCreated`:
+invoked from `organizationHooks.afterAcceptInvitation` with the mapped ids
+(`invitationId`, `organizationId`, `userId`, `memberId`, `role`, `email`)
+plus the RAW `invitation` / `member` rows so a host reads its own extension
+columns without a second query. Failure-isolated — acceptance never rolls
+back on a side-effect miss; hosts needing effectively-atomic placement
+should make the callback idempotent and reconcile on retry.

.changeset/route-audit-tranche-3-service-mounts.md

@@ -0,0 +1,51 @@
+---
+"@objectstack/service-storage": patch
+"@objectstack/service-i18n": patch
+"@objectstack/client": patch
+---
+
+fix(client,service-i18n): ledger the autonomously-mounted service routes, and repair the two i18n calls that reached nothing (#3636)
+
+Tranche 3 of the #3563 route audit — the last un-audited server surface. The
+dispatcher ledger (#3563) and the REST ledger (#3587) each stop at their own
+package boundary, and two services mount routes outside both: they reach for
+the `http-server` service and register straight on `IHttpServer`, so neither
+`RouteManager` nor `RestServer.getRoutes()` has ever seen them. That left the
+SDK's entire storage surface, plus all of i18n, in the pre-#3563 posture:
+expressed, working, guarded by nothing.
+
+**Ledgers + guards.** `storage-route-ledger.ts` (10 routes) and
+`i18n-route-ledger.ts` (3) sit next to the registrars that mount them, each
+enumerated for real — the registrar runs against a capturing mock
+`IHttpServer` and its registration calls *are* the route set, so a new route
+lands with a reviewed disposition or fails CI. The client half is
+`packages/client/src/service-route-ledger-coverage.test.ts`; ledgers cross the
+boundary as relative source imports, never a service→client package edge.
+
+**Two wire-level 404s fixed.** `i18n.getTranslations` sent
+`/i18n/translations?locale=xx` and `i18n.getFieldLabels` sent
+`/i18n/labels/:object?locale=xx`, while every serving surface — service-i18n's
+mounts, the dispatcher's HTTP mounts, and the `plugin-rest-api.zod.ts`
+contract — mounts only the path form. Neither call could ever be answered.
+Both had carried a green `sdk` row in the dispatcher ledger since tranche 1,
+because that guard asks whether the client *method* exists, not whether it
+speaks a URL anything mounts. The client now sends the path dialect, the same
+resolution #3611 gave `meta.getView`, and a new suite drives the real client
+at a real router so a revert cannot pass quietly.
+
+**One response-shape fix.** service-i18n's success bodies omitted the
+`success` flag that `ObjectStackClient.unwrapResponse` keys on, so the SDK
+returned the raw `{ data: … }` wrapper against that provider while returning
+the declared unwrapped shape against the dispatcher — one method, two shapes,
+decided by which plugin mounted the route. Its three handlers now emit the
+`{ success: true, data }` envelope the `i18n` route group declares. `data` did
+not move, so direct body readers are unaffected.
+
+Storage audited clean: 7 routes SDK-expressed, 3 reviewed `server-only` (the
+browser capability URL objectql stamps into file-field payloads, and the two
+local-driver loopbacks). The chunked-upload family, flagged for triage, turned
+out fully expressed. Both ledgers ratchet `gap` and `mismatch` at zero.
+
+Filed, not fixed: `GET {base}/_local/file/:key` is built by three call sites
+and mounted by none (#3641); the cross-surface URL conformance guard that would
+have caught all of the above mechanically is the capstone (#3642).

.changeset/showcase-action-disabled-specimen.md

@@ -0,0 +1,4 @@
+---
+---
+
+feat(showcase): add the action `disabled`-predicate specimen (`showcase_archive_task`) — greyed until `record.done`, contrasting `visible` (hide) with `disabled` (grey). Examples-only; releases nothing.

.github/workflows/ci.yml

@@ -247,6 +247,35 @@ jobs:
             echo "::endgroup::"
           done
 
+  dogfood-gate:
+    # Stable required-check name for a SHARDED job (#3622 follow-up).
+    #
+    # Branch protection requires the context "Dogfood Regression Gate". Once
+    # the job became a 2-way matrix its checks publish as "Dogfood Regression
+    # Gate (1/2)" / "(2/2)" — the bare context could never appear again, so
+    # EVERY pull request in the repo sat permanently BLOCKED (mergeable, all
+    # checks green, merge button dead). #3622's own comment called for updating
+    # branch protection; keeping the contract HERE instead means a future
+    # shard-count change cannot deadlock the repo a second time.
+    #
+    # `if: always()` + result inspection so a legitimately skipped matrix (the
+    # `filter` job says no core paths changed) still satisfies the gate.
+    name: Dogfood Regression Gate
+    needs: dogfood
+    if: always()
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Verify dogfood shard results
+        run: |
+          result="${{ needs.dogfood.result }}"
+          echo "dogfood matrix aggregate result: $result"
+          case "$result" in
+            success|skipped) echo "Dogfood gate satisfied." ;;
+            *) echo "::error::Dogfood shards did not pass (aggregate result: $result)"; exit 1 ;;
+          esac
+
   build-core:
     name: Build Core
     needs: filter

docs/audits/2026-07-dispatcher-client-route-coverage.md

@@ -157,6 +157,49 @@ expression exists for: `GET /search`, `POST /email/send`, `forms/:slug`
 `external-datasource-routes.ts`). Auditing that surface with the same
 three-column method is the next tranche of #3563.
 
+**Closed in #3587** — `packages/rest/src/rest-route-ledger.ts` plus its
+conformance guard; the 43 audited gaps and 2 mismatches both ratchet at zero.
+
+## 9. The third surface: autonomous service mounts (#3636)
+
+Neither ledger sees a service that reaches for the `http-server` service and
+registers straight on `IHttpServer` — it bypasses `RouteManager` and
+`RestServer.getRoutes()` alike. Two do: `service-storage`
+(`storage-routes.ts`, 10 routes — the SDK's entire storage surface) and
+`service-i18n` (`i18n-service-plugin.ts`, 3 routes). Both now carry a
+per-package ledger next to the registrar, enumerated by driving the real
+registrar against a capturing mock `IHttpServer`, with the client half in
+`packages/client/src/service-route-ledger-coverage.test.ts` (no
+service→client package edge — the tranche-1 lesson).
+
+Dispositions: storage audited clean at 7 `sdk` / 3 `server-only` (the
+browser-facing `/files/:fileId` redirect objectql stamps into file-field
+payloads, and the two `_local/raw/:token` local-driver loopbacks). The chunked
+upload family — flagged in #3636 as needing triage — turned out fully
+SDK-expressed (`initChunkedUpload` / `uploadPart` / `completeChunkedUpload` /
+`resumeUpload`), so no gap to close.
+
+i18n audited at **two mismatches**, both fixed in the same PR:
+`i18n.getTranslations` sent `/translations?locale=xx` and
+`i18n.getFieldLabels` sent `/labels/:object?locale=xx`, while every serving
+surface — service-i18n's mounts, the dispatcher's HTTP mounts, and the
+`plugin-rest-api.zod.ts` contract — mounts only the path form. Both were
+wire-level 404s, and both had carried a green `sdk` row in
+`route-ledger.ts` since tranche 1: **§1 coverage rows assert the client method
+exists, not that it speaks a URL anything mounts.** The same audit found
+service-i18n omitting the `success` flag from its `{ data }` bodies, so
+`unwrapResponse` returned the raw wrapper against that provider while
+returning the declared shape against the dispatcher — one method, two shapes,
+decided by which plugin mounted the route.
+
+Also filed, not fixed: `GET {base}/_local/file/:key` is built by three call
+sites and mounted by none (#3641).
+
+**The gap all three ledgers still share** is the reverse direction — no guard
+compares the URL a client method *builds* against the patterns any surface
+*mounts*. Four instances of that class have now been found one at a time
+(#3584 ×2, #3611, #3636 ×2). Mechanizing it is the capstone, #3642.
+
 ## Follow-up slicing (proposed)
 
 1. **`client.actions.invoke(...)`** — closes the largest hole (3 routes).
@@ -166,7 +209,9 @@ three-column method is the next tranche of #3563.
 5. **Mismatch reconciliation** (§4) — done in #3584: analytics client aligned to the dispatcher, storage protocol documented as canonical (see §4 Resolution).
 6. **Docs**: delete or regenerate README surface table + CLIENT_SPEC_COMPLIANCE.md; extend client-sdk.mdx.
 7. **Deprecate `DEFAULT_DISPATCHER_ROUTES`**; point at the ledger.
-8. **REST-surface tranche** (§8) with the same ledger+guard treatment.
+8. **REST-surface tranche** (§8) with the same ledger+guard treatment — done in #3587.
+9. **Autonomous service mounts** (§9) — done in #3636.
+10. **Cross-surface URL conformance** (§9, the reverse direction) — #3642.
 
 Each gap closed must flip its ledger row to `sdk` and lower the ratchet bound
 in the conformance test — the guard enforces both directions from PR-1 onward.

examples/app-showcase/src/ui/actions/index.ts

@@ -235,6 +235,37 @@ export const ActionParamGalleryAction = defineAction({
   refreshAfter: false,
 });
 
+/**
+ * script — the `disabled` predicate specimen. Where `visible` HIDES an action
+ * (see MarkDoneAction), `disabled` keeps it ON SCREEN but greyed until its
+ * precondition holds: Archive stays visible on every task and only becomes
+ * clickable once the task is done. Same authoring rules as `visible`
+ * (`record.`-prefixed, single comparison; disabled when the CEL is TRUE).
+ * Exercises the renderer-side wiring (objectui: DeclaredActionsBar +
+ * action:button/group/icon/menu) that #1885's follow-through completed.
+ */
+export const ArchiveTaskAction = defineAction({
+  name: 'showcase_archive_task',
+  label: 'Archive',
+  icon: 'archive',
+  objectName: task,
+  type: 'script',
+  body: {
+    language: 'js',
+    // No destructive side effect — the specimen's value is the disabled
+    // behavior itself; echo which record would be archived.
+    source:
+      "var id = ctx.recordId || (ctx.record && ctx.record.id) || input.recordId;" +
+      "return { ok: true, archived: id };",
+    capabilities: [],
+  },
+  successMessage: 'Task archived (demo — no data changed).',
+  // Disabled while the task is not done — visible either way.
+  disabled: 'record.done != true',
+  locations: ['record_header', 'record_section'],
+  refreshAfter: false,
+});
+
 export const allActions = [
   MarkDoneAction,
   OpenDocsAction,
@@ -245,4 +276,5 @@ export const allActions = [
   NewTaskAction,
   SubmitForSignoffAction,
   ActionParamGalleryAction,
+  ArchiveTaskAction,
 ];

examples/app-showcase/src/ui/pages/task-detail.page.ts

@@ -61,7 +61,10 @@ export const TaskDetailPage = definePage({
           properties: {
             location: 'record_section',
             align: 'start',
-            actionNames: ['showcase_mark_done', 'showcase_log_time'],
+            // showcase_archive_task is the `disabled`-predicate specimen:
+            // visible on every task, greyed until `record.done` (contrast with
+            // showcase_mark_done's `visible`, which HIDES once done).
+            actionNames: ['showcase_mark_done', 'showcase_log_time', 'showcase_archive_task'],
           },
         },
         {

packages/adapters/hono/src/index.ts

@@ -359,6 +359,16 @@ export function createHonoApp(options: ObjectStackHonoOptions): Hono {
   // ─── Catch-all: delegate to dispatcher.dispatch() ─────────────────────────
   // Handles meta, data, packages, analytics, automation, i18n, ui, openapi,
   // custom API endpoints, and any future routes added to HttpDispatcher.
+  //
+  // DELIBERATE SHAPE — read before "improving" this into explicit per-prefix
+  // mounts (ADR-0076 OQ#9 verdict, #3576 / #3608): dispatch() is a thin
+  // gates+registry pipeline (env resolution → identity → auth gate →
+  // membership → scope strip, then a first-match DomainHandlerRegistry
+  // lookup — enumerable via registry.list()). A naive split into
+  // `app.all(prefix + domain + '/*')` mounts bypasses those cross-cutting
+  // gate stages (the #2852 RLS-leak class: handlers running without an
+  // ExecutionContext). Revisit only if the gate stages are middleware-ized
+  // for an independent reason — reopen conditions are archived on #3608.
   app.all(`${prefix}/*`, async (c) => {
     try {
       const subPath = c.req.path.substring(prefix.length);

packages/client/src/client.test.ts

@@ -664,29 +664,42 @@ describe('i18n namespace', () => {
         expect(url).toContain('/api/v1/i18n/locales');
     });
 
-    it('should get translations', async () => {
+    it('i18n.getTranslations speaks the path-param dialect every surface mounts (#3636)', async () => {
         const { client, fetchMock } = createMockClient({
             success: true,
             data: { locale: 'zh-CN', translations: { hello: '你好' } }
         });
-        const result = await client.i18n.getTranslations('zh-CN', { namespace: 'common' });
+        const result = await client.i18n.getTranslations('zh-CN');
         expect(result.locale).toBe('zh-CN');
-        const url = fetchMock.mock.calls[0][0] as string;
-        expect(url).toContain('/api/v1/i18n/translations');
-        expect(url).toContain('locale=zh-CN');
-        expect(url).toContain('namespace=common');
+        // NOT `/translations?locale=zh-CN` — no server mounts a bare
+        // /translations, so the old query dialect 404'd everywhere.
+        expect(String(fetchMock.mock.calls[0][0])).toBe(
+            'http://localhost:3000/api/v1/i18n/translations/zh-CN',
+        );
+    });
+
+    it('i18n.getTranslations keeps namespace/keys as query params on the path form', async () => {
+        const { client, fetchMock } = createMockClient({
+            success: true,
+            data: { locale: 'zh-CN', translations: { hello: '你好' } }
+        });
+        await client.i18n.getTranslations('zh-CN', { namespace: 'common', keys: ['a', 'b'] });
+        expect(String(fetchMock.mock.calls[0][0])).toBe(
+            'http://localhost:3000/api/v1/i18n/translations/zh-CN?namespace=common&keys=a%2Cb',
+        );
     });
 
-    it('should get field labels', async () => {
+    it('i18n.getFieldLabels puts both object and locale on the path (#3636)', async () => {
         const { client, fetchMock } = createMockClient({
             success: true,
             data: { object: 'customer', labels: { name: '名前' } }
         });
         const result = await client.i18n.getFieldLabels('customer', 'ja');
         expect(result.object).toBe('customer');
-        const url = fetchMock.mock.calls[0][0] as string;
-        expect(url).toContain('/api/v1/i18n/labels/customer');
-        expect(url).toContain('locale=ja');
+        // NOT `/labels/customer?locale=ja` — the mount is /labels/:object/:locale.
+        expect(String(fetchMock.mock.calls[0][0])).toBe(
+            'http://localhost:3000/api/v1/i18n/labels/customer/ja',
+        );
     });
 });