Revert "chore: version packages (#2954)"

This reverts commit ca30acd.

Author: os-zhuang

.changeset/adr-0076-honest-capabilities-framework-slice.md

@@ -0,0 +1,42 @@
+---
+'@objectstack/spec': minor
+'@objectstack/runtime': minor
+'@objectstack/metadata-protocol': minor
+'@objectstack/objectql': patch
+'@objectstack/rest': patch
+'@objectstack/plugin-hono-server': patch
+---
+
+feat(discovery): honest capabilities — standardized stub/fallback marker + realtime route honesty (ADR-0076 D12/A1.5 framework slice, #2462)
+
+**Spec** — new service self-description marker for honest discovery
+(ADR-0076 D12): `SERVICE_SELF_INFO_KEY` (`__serviceInfo`),
+`ServiceSelfInfoSchema` / `ServiceSelfInfo`, and `readServiceSelfInfo()`,
+which also normalizes plugin-dev's legacy `_dev: true` flag to
+`{ status: 'stub', handlerReady: false }`. A registered service that is a
+stub / dev fake / degraded fallback self-identifies via this marker; a fully
+real service carries no marker.
+
+**Runtime + metadata-protocol** — both discovery builders
+(`HttpDispatcher.getDiscoveryInfo` and the protocol shim's `getDiscovery`)
+now honor the marker instead of hardcoding `status: 'available',
+handlerReady: true` for every registered service. Dev stubs report `stub`,
+the ObjectQL analytics fallback reports `degraded` (it keeps serving — no
+`/analytics` 404), and consumers can finally trust
+`status === 'available'` / `handlerReady === true`.
+
+**Realtime honesty fix** — discovery no longer advertises a
+`/realtime` route or `websockets: true`: `service-realtime` is an
+in-process pub/sub bus, no dispatcher branch or plugin mounts any
+`/realtime` HTTP surface, so the advertised route always 404'd. The
+registered service now reports `status: 'degraded', handlerReady: false`
+with no route (clients using the SDK are unaffected — it falls back to the
+conventional path, which behaves exactly as before). Also corrects the
+advertised realtime provider from the nonexistent `plugin-realtime` to
+`service-realtime`.
+
+**REST (A1.5)** — the REST layer's protocol dependency is narrowed from the
+`ObjectStackProtocol` god-union to the new `RestProtocol =
+DataProtocol & MetadataProtocol` slice (exported from
+`@objectstack/rest`), per the ADR-0076 D9 incremental narrowing guidance.
+Type-level only; no runtime change.

.changeset/adr-0085-2548-followups.md

@@ -0,0 +1,17 @@
+---
+'@objectstack/lint': patch
+'@objectstack/plugin-audit': patch
+---
+
+ADR-0085 #2548 follow-ups surfaced by the real-backend browser pass:
+
+- **lint**: new `field-group-shadowed` warning in `validate-semantic-roles` — a
+  declared fieldGroup whose every visible member is hoisted into the detail
+  highlight strip (or is the record title) renders on forms but silently never
+  on detail pages (detail bodies hide the first 4 highlightFields). Warning
+  tier, same as the other semantic-role rules.
+- **plugin-audit**: feed/audit summaries ("Created … / Deleted … / Updated …")
+  now name the object by its display label ("Semantic Zoo") instead of its API
+  name ("showcase_semantic_zoo") — these strings render verbatim in the record
+  Discussion feed and Setup dashboards. Falls back to the API name when the
+  object definition isn't resolvable. Existing stored rows are unchanged.

.changeset/adr-0085-pr4-renderviaschema-comment-2548.md

@@ -0,0 +1,14 @@
+---
+'@objectstack/spec': patch
+---
+
+docs(spec): retire the stale `renderViaSchema` forward-reference now that objectui#2546 landed (ADR-0085 PR4 follow-up, #2548)
+
+The `ObjectSchema` source comment forward-referenced `renderViaSchema`
+retiring "together with the legacy monolith render path" — a promise about
+work that had not yet shipped. That path, and the `detail.renderViaSchema`
+kill-switch that was its only steering wheel, were removed in objectui#2546
+(ADR-0085 PR4). The comment now records the completed state with a breadcrumb
+to that PR instead of a forward reference, closing the cleanup #2546 flagged.
+
+Comment-only change; no type, schema, or runtime behavior is affected.

.changeset/adr-0087-completion.md

@@ -0,0 +1,37 @@
+---
+'@objectstack/spec': minor
+'@objectstack/cli': minor
+'@objectstack/runtime': minor
+'@objectstack/service-package': minor
+'create-objectstack': minor
+---
+
+feat(protocol): complete ADR-0087 — load-seam handshake, chain backfill 12–15, release artifacts (#2643)
+
+Closes the remaining ADR-0087 gaps (see the ADR's as-built Addendum):
+
+- **P0 load seams (D1).** The protocol handshake now runs on the boot-time
+  durable-package rehydration path (`@objectstack/service-package` refuses an
+  incompatible `sys_packages` row with the structured `OS_PROTOCOL_INCOMPATIBLE`
+  diagnostic and keeps booting) and on `AppPlugin` for code-defined stacks
+  (fail-fast before the manifest is decomposed). `objectstack lint` gains
+  `protocol/missing-engines-range` (warning + fix-it) and the
+  `create-objectstack` blank template stamps `engines: { protocol: '^<major>' }`
+  (re-stamped at version time by `scripts/sync-template-versions.mjs`) — the
+  two ends of the grandfathering ratchet.
+- **Chain backfill (D2/D3).** `MetadataConversion.retiredFromLoadPath`
+  implements the load-window's second half (retired entries replay only via
+  `migrate meta` / fixture CI). Steps 12–15 land: the `api.requireAuth` flip
+  (semantic), the ADR-0090 wave (3 retired conversions + 5 semantic TODOs), the
+  `BookAudience` rename (retired conversion), and the ADR-0089 visibility
+  unification (`visibleOn`/`visibility` → `visibleWhen` as LIVE load-window
+  conversions) + the `.strict()` flip (semantic). The protocol-11
+  `compactLayout` → `highlightFields` rename is backfilled as a retired step-11
+  conversion. `migrate meta --from 10` now reaches protocol 15.
+- **Release artifacts (D4).** `spec-changes.json` is generated from the
+  registries (`gen:spec-changes`, CI drift-checked), ships in the npm artifact
+  together with `api-surface.json`, and is attached to each `@objectstack/spec`
+  GitHub Release with `added[]`/`removed[]` filled from the api-surface diff
+  against the previously published release. The upgrade guide
+  (`docs/protocol-upgrade-guide.md`) is generated from the same registries and
+  CI drift-checked — a projection that cannot drift.

.changeset/adr-0096-declarative-connectors.md

@@ -0,0 +1,49 @@
+---
+'@objectstack/spec': minor
+'@objectstack/service-automation': minor
+'@objectstack/connector-rest': minor
+'@objectstack/connector-openapi': minor
+'@objectstack/connector-mcp': minor
+---
+
+feat(connectors): ADR-0096 — provider-bound declarative connector instances materialized at boot (#2977)
+
+Declarative `connectors:` stack entries used to be **descriptor-only** (#2612):
+registered as metadata but never dispatchable, the platform's one dead metadata
+surface. An entry may now name a **`provider`** — an installed generic executor
+(`openapi` / `mcp` / `rest`) — and the automation service **materializes** it
+into a live, dispatchable connector at boot. AI can now wire an integration as
+pure metadata and a flow `connector_action` calls it end-to-end.
+
+- **Schema (`@objectstack/spec`).** `ConnectorSchema` gains `provider`,
+  `providerConfig`, and `auth` (a `credentialRef`-based instance-auth shape —
+  `ConnectorInstanceAuthSchema` — that references credentials, never inlines
+  them); `authentication` now defaults to `{ type: 'none' }` so a provider-bound
+  instance need not author it (loosening — existing connectors are unaffected).
+  `DeclarativeConnectorEntrySchema` (used by `stack.zod.ts`) rejects inline
+  secrets, orphan `providerConfig`/`auth`, and authored `actions`/`triggers` on a
+  provider-bound entry. A new `integration/connector-provider.ts` defines the
+  provider-factory contract as pure types.
+
+- **Engine + boot (`@objectstack/service-automation`).** The engine adds a
+  connector-provider registry (`registerConnectorProvider`/`getConnectorProvider`)
+  and origin-tags registered connectors. At boot the service resolves each
+  provider-bound entry — looking up the factory, resolving `auth.credentialRef`
+  via a pluggable `CredentialResolver` (open-tier default: environment
+  variables), and registering the materialized connector. Boot **fails loudly**
+  for an unknown provider, invalid `providerConfig`, an unresolvable
+  `credentialRef`, or a name conflict with a plugin-registered connector (no
+  silent precedence).
+
+- **Providers (`connector-rest` / `connector-openapi` / `connector-mcp`).** Each
+  plugin registers a provider factory in `init()` reusing its existing
+  generator/adapter API. Plugin options are now **optional**: with none the
+  plugin contributes only its provider factory; with instance options it also
+  registers a hand-wired connector (back-compat). `connector-openapi` adds a
+  `ConnectorOpenApiPlugin`.
+
+Open tier: static auth (`none`/`api-key`/`basic`/`bearer`) with `credentialRef`
+resolved from env vars. Managed vaulting, OAuth2 refresh, and per-tenant
+connection lifecycle remain the enterprise tier (ADR-0015) — an enterprise host
+injects a vault-backed `CredentialResolver` with no change to the materialization
+path.

.changeset/adr-0096-openapi-spec-file-path.md

@@ -0,0 +1,36 @@
+---
+'@objectstack/spec': minor
+'@objectstack/service-automation': minor
+'@objectstack/connector-openapi': minor
+'@objectstack/cli': minor
+---
+
+feat(connector-openapi): resolve `providerConfig.spec` from a package-relative file path (#3016, ADR-0096 follow-up)
+
+ADR-0096's canonical example authors an OpenAPI-backed instance as
+`providerConfig: { spec: './billing-openapi.json' }`, but the landed `openapi`
+provider factory only accepted an inline document object or an http(s) URL.
+The spec union is now complete: **inline object | file path | remote URL**.
+
+- **`@objectstack/spec`.** `ConnectorProviderContext` gains an optional
+  host-injected `loadPackageFile(relativePath)` capability (pure type): reads a
+  UTF-8 file resolved against the declaring stack/package root, confined to
+  that root. `undefined` on hosts without a filesystem.
+
+- **`@objectstack/service-automation`.** New `packageRoot` plugin option (the
+  base for relative file refs; defaults to `process.cwd()`) and an exported
+  `createPackageFileLoader(packageRoot)` that implements the confinement
+  guard — absolute paths and `..`-escaping paths are rejected — with lazy
+  `node:fs`/`node:path` imports so non-Node hosts only fail if a file ref is
+  actually dereferenced. The materializer injects the capability into every
+  provider factory's context. Failures follow the existing reconcile policy:
+  **fatal at boot, entry skipped on reload**.
+
+- **`@objectstack/connector-openapi`.** A string `providerConfig.spec` that is
+  not an http(s) URL is now read via `ctx.loadPackageFile` and parsed as an
+  OpenAPI JSON document (clear errors for missing/unreadable files, unparseable
+  JSON, and hosts without package file access).
+
+- **`@objectstack/cli`.** `serve`/`dev` pass the project folder (the
+  `objectstack.config.ts` directory) as the automation service's `packageRoot`,
+  mirroring how the standalone sqlite default is anchored.

.changeset/adr-0096-runtime-rematerialization.md

@@ -0,0 +1,26 @@
+---
+'@objectstack/service-automation': minor
+---
+
+feat(connectors): ADR-0096 runtime re-materialization of declarative connectors (#2977 follow-up)
+
+Provider-bound declarative `connectors:` instances (ADR-0096) previously
+materialized only at boot — a connector published from Studio while the server
+ran did not become dispatchable until a restart. `materializeDeclaredConnectors`
+is now a **reconcile** run both at boot and on `metadata:reloaded`:
+
+- **Add** newly-declared instances, **tear down** removed / newly-`enabled:false`
+  ones (calling their `close`, e.g. an MCP connection), and **re-materialize**
+  only instances whose signature — a stable hash of `provider` + `providerConfig`
+  + `auth` + identity — changed. An unchanged MCP instance is never needlessly
+  reconnected on an unrelated metadata reload.
+- **Boot stays fatal** ("fail loudly"): unknown provider / invalid providerConfig
+  / unresolvable credentialRef / name conflict aborts startup. **Reload is soft**:
+  the same problems are logged and the offending entry skipped, so a bad publish
+  never crashes a running server; a changed instance's old connector keeps
+  serving until its replacement materializes successfully.
+
+Also: `ConnectorDescriptor` (served by `GET /api/v1/automation/connectors`) now
+carries an `origin` field (`'plugin' | 'declarative'`), so a designer can
+distinguish a materialized declarative instance from a plugin-registered
+connector.

.changeset/adr-0097-mcp-nonfatal-boot.md

@@ -0,0 +1,35 @@
+---
+'@objectstack/spec': minor
+'@objectstack/service-automation': minor
+'@objectstack/connector-mcp': minor
+---
+
+feat(connectors): degrade + retry declarative instances whose upstream is unreachable (#3017)
+
+ADR-0097 kept every declarative-connector materialization failure fatal at
+boot. That is right for configuration faults (unknown provider, invalid
+`providerConfig`, unresolvable `credentialRef`, name conflict) but wrong for
+*operational* ones: a `provider: 'mcp'` instance must contact its MCP server
+(`tools/list`) to materialize, and a transient network blip aborted the whole
+app boot.
+
+- **spec**: a provider factory can now throw
+  `ConnectorUpstreamUnavailableError` (code `CONNECTOR_UPSTREAM_UNAVAILABLE`,
+  structural guard `isConnectorUpstreamUnavailable`) to mark a failure as
+  "upstream temporarily unreachable — degrade and retry" instead of fatal.
+- **service-automation**: the reconcile degrades such an instance in both boot
+  and reload modes: it registers an action-less husk (`state: 'degraded'` +
+  `degradedReason` on the `GET /connectors` descriptor) so the instance is
+  visible instead of silently missing — or, on a changed-config
+  re-materialization, keeps the old connector serving. A `connector_action`
+  against a degraded instance fails with the reason and a "retries
+  automatically" pointer. Degraded instances retry on an exponential backoff
+  (5s → 5min, reset by config edits) and on every `metadata:reloaded`
+  reconcile; recovery swaps the husk for the live connector atomically.
+  Reconcile runs (boot / reload / retry timer) are now serialized.
+- **connector-mcp**: the `mcp` provider classifies connect / `tools/list`
+  failures as upstream-unavailable; transport-shape validation stays a plain
+  (fatal) throw.
+
+Configuration faults remain loud boot failures — the carve-out is only for the
+unavailable marker.

.changeset/adr-0097-stdio-policy-gate.md

@@ -0,0 +1,23 @@
+---
+'@objectstack/connector-mcp': minor
+---
+
+feat(connector-mcp)!: policy-gate declarative stdio transports — default-deny + host allowlist (#3055)
+
+A declarative `provider: 'mcp'` entry with a stdio transport spawns a local
+child process **from metadata** — which a runtime Studio publish can introduce.
+Declarative stdio is now **denied by default**; hosts opt in deliberately:
+
+```ts
+new ConnectorMcpPlugin({ declarativeStdio: ['my-mcp-server'] }) // command allowlist
+new ConnectorMcpPlugin({ declarativeStdio: true })              // allow any (full trust)
+```
+
+Behavior change: a declarative stdio instance that materialized before now
+fails as a **configuration fault** (fatal at boot / skipped on reload) with an
+actionable opt-in message, and is never classified upstream-unavailable — a
+security rejection must not be retried into existence. `http` transports and
+**hand-wired** connectors (plugin instance options / `createMcpConnector`) are
+unaffected. This is the security precondition for shipping `connector-mcp` in
+default presets (#3056); see ADR-0097 §"Declarative stdio policy" and
+ADR-0024 §4.

.changeset/attachment-authenticated-downloads.md

@@ -0,0 +1,19 @@
+---
+'@objectstack/service-storage': minor
+---
+
+feat(attachments): authenticated, parent-scoped downloads for attachments files (#2970)
+
+Closes item 2 of #2970. The storage download endpoints (`GET /storage/files/:fileId`
+and `/files/:fileId/url`) were anonymous capability URLs — anyone holding a
+`fileId` could mint a download without a session or any access check.
+
+For `scope === 'attachments'`, non-`public_read` files, both endpoints now gate
+on a new `authorizeFileRead` seam: `401 AUTH_REQUIRED` without a session, `403
+ATTACHMENT_DOWNLOAD_DENIED` when the caller is neither the file's owner nor able
+to READ a record the file is attached to (parent-derived, resolved through the
+full caller context via `resolveAuthzContext`), and otherwise a **short-lived**
+signed URL (`downloadTtl`, default 300s). Non-attachments files (field files,
+avatars, org logos — embedded in `<img src>` which cannot carry a bearer token)
+keep the stable anonymous capability URL, and bare kernels/tests without the
+seam wired stay open (back-compat).