Merge remote-tracking branch 'origin/main' into claude/issue-14653-i18n-walk-parity-gate

Author: claude

.changeset/action-engine-facade-find-filter.md

@@ -0,0 +1,33 @@
+---
+"@objectstack/spec": patch
+---
+
+fix(spec): `ActionEngineFacade.find` declares its second parameter as a FILTER, not an ObjectQL envelope (#14175)
+
+`find(object, query: Record<string, unknown>)` documented nothing, and its
+parameter carried the name of the envelope every other read on the platform
+takes. The runtime (`buildActionEngineFacade`,
+`packages/runtime/src/action-execution.ts`) treats the argument as the bare
+`where` half — wrapping a non-empty one as `{ where: filter }` and passing
+`{}` through unwrapped — so a handler that passed the envelope got
+`{ where: { where: … } }`, matched nothing and returned `[]` with no error,
+while its one unfiltered read kept working. A hand-written test double built
+on the same belief passed every assertion; an application's headline action
+was a silent no-op for its whole life under a green suite.
+
+The member is now `find(object, filter: FilterCondition)` — the published
+`QueryAST.where` type — with a doc comment stating the contract, the runtime's
+wrap, and both limbs (envelope wrapped; empty passed through); the facade
+docblock points at it. The parameter's TYPE now says what the runtime does
+at the one place a handler author reads.
+
+Compile-layer signal only, shipped as `patch` (the #12615 precedent — a
+compile-time narrowing with no change in what parses or runs): no runtime
+behaviour changes, nothing changes in what the facade accepts or returns, and
+the narrowing bites only a primitive or a mistyped `$and` / `$or` / `$not`.
+⚠️ It does NOT refuse `{ where: … }` at compile time — `FilterCondition`'s
+string index signature admits `where` as a field name — so the compile-time
+bar is partial and the doc comment is the contract of record. An
+implementation typed with the old `Record<string, unknown>` still satisfies
+the interface (method parameters are bivariant), so nothing constructing the
+facade changes.

.changeset/action-method-example-data-door-path.md

@@ -0,0 +1,40 @@
+---
+"@objectstack/spec": patch
+---
+
+fix(spec): `ActionSchema.method`'s worked example now names the shipped data door
+
+The `method` docblock's only worked example of a `type: 'api'` PATCH pointed at
+`/api/v1/sys_api_key/{id}` — a path the router never mounts. The shipped data
+door composes as `getApiBasePath()` + `crud.dataPrefix` + `/:object/:id`, so the
+update endpoint is `PATCH /api/v1/data/:object/:id` on a default host. The `/data`
+segment was missing, and nothing catches the difference at authoring time:
+`objectstack validate` does not check `target`, `type: 'api'` has no author-time
+route validation, and the action parses green, renders, is clickable, and 404s at
+the click — the same silent shape as an unregistered handler, arriving through a
+doc example. This mattered more than an ordinary stale comment because it is the
+one worked example of that route on the published contract.
+
+The example now reads `/api/v1/data/sys_api_key/${ctx.recordId}`. The object name
+is unchanged on purpose — the error was the path STRUCTURE, not which object the
+example picks — and the id is spelled with the `${ctx.X}` interpolation that
+`target`'s own docblock documents, so the two placeholder conventions in this one
+schema stop reading as interchangeable (a bare `{recordId}` is `newTabUrl`'s
+convention alone).
+
+Two things the corrected example now says that the old one did not:
+
+- **The full path is host-dependent.** Under `enableProjectScoping` with
+  `projectResolution: 'required'` only
+  `/api/v1/environments/:environmentId/data/:object/:id` is registered, so even a
+  correctly spelled unscoped path still 404s on such a host. An author copying a
+  full path needs to know which base their host mounts.
+- **A single-record field write has a declarative form now.** `operation: 'update'`
+  with `patch` writes the current record on the data plane as the caller, with no
+  endpoint, method or id placeholder to spell. The `type: 'api'` + `PATCH` form
+  remains the way to call an explicit endpoint.
+
+Documentation only: no schema member, no `.describe()` and no runtime behaviour
+changes. It is a `patch` rather than a `skip-changeset` because the corrected text
+publishes — `@objectstack/spec` ships `dist/**` and `src/**/*.zod.ts`, and both
+carry this docblock.

.changeset/action-row-update-declarative.md

@@ -0,0 +1,19 @@
+---
+'@objectstack/spec': minor
+---
+
+feat(spec): a row action gets the declarative single-record field write — `operation: 'update'` + `patch` (#14092)
+
+The most common action in any app — set a field on the current record — had no declarative form for a ROW action while the BULK form was fully declarative: a list view's `bulkActionDefs` `{ operation: 'update', patch, visible }` runs on the data plane under the caller's own permissions with hooks and validations firing, and the identical intent on one row had to be a hand-written, system-elevated handler that re-established that authorization by hand. Maintainer ruling 2026-09-01: the row action gets the bulk def's declarative counterpart.
+
+`ActionSchema` now accepts, mirroring the bulk vocabulary word for word and inventing no second spelling:
+
+- `operation: 'update'` — the declarative single-record field write. One member by ruling; `'delete'` and `'custom'` are refused with the reason (a row delete is the object's own affordance; `'custom'` means "dispatch the action this def names", and on a row the action is already the action).
+- `patch: Record<string, unknown>` — static field values written to the current record, merged UNDER the values `params` collects (a param of the same name wins). Passed through verbatim.
+- The action's existing `params`, `visible`, `confirmText` and `undoable` keys are reused, nothing duplicated; `undoable` now has its anchor — the patch names exactly the fields whose prior values are captured.
+
+Key shape, pinned for contract review: `operation` is a parallel key beside `type`, not a new `ActionType` member. `type` stays at its default `'script'` — the platform action route, which is where the write is performed — and answers WHERE the action dispatches; `operation` answers WHAT the platform does there. Every contradiction is refused at its own path with a prescription: any other explicit `type`, `target`, `body`, `method`, `bodyExtra`, `bodyShape`, `recordIdParam`/`recordIdField`, `onSuccess`, `opensInNewTab`/`newTabUrl` beside `operation: 'update'`; `patch` without it; `operation: 'update'` with neither `patch` nor `params`; a `list_toolbar` location (no current record). `defineStack` refuses a standalone `operation: 'update'` action that names no `objectName` (an object-embedded one is bound by the object it is written on). An inline page-element action cannot carry the keys at all.
+
+Executor contract for the downstream halves (runtime action dispatcher, objectui row-action executor — separate cards; both keys are `planned` in the liveness ledger until they land): a single-record data-plane update of the CURRENT record executed AS THE CALLER and never system-elevated, so the caller's object/row/field permissions, the object's hooks and its validations fire exactly as for a user edit; a caller who cannot read or write the row is refused; `undoable` captures the prior values of exactly the fields written.
+
+Pure widening: nothing that parsed before stops parsing — `operation` and `patch` were unknown keys on this strict shape, and every new refusal is keyed on one of them.

.changeset/activation-ledger-tenant-less.md

@@ -0,0 +1,61 @@
+---
+"@objectstack/platform-objects": patch
+"@objectstack/core": patch
+"@objectstack/objectql": patch
+"@objectstack/service-automation": patch
+---
+
+fix(platform-objects,core): `sys_metadata_activation` ships tenant-less — drop the reserved organization column (#15024)
+
+The ADR-0126 activation ledger records that **this environment** switched a
+packaged artifact off. That is deployment-level state, owned by no
+organization — so the table ships with no tenant column at all.
+
+It briefly declared one: an `organization_id` marked "RESERVED", nullable, and
+written by nobody, held for a per-organization dimension ADR-0126 §5
+pre-charted. A reserved nullable tenant column is exactly the shape the
+total-organization-ownership record proposed in PR #14976 rules out, and this
+one had no reader either. **This is a plain removal, not a migration:** the
+table landed after the 17.2.0 tag, so no released version ever carried the
+column and no deployment has data in it. Should a per-organization dimension
+ever be wanted, it returns as a separate org-owned object — never as a column
+on this ledger.
+
+What changed:
+
+- **`sys_metadata_activation` declares `systemFields: { tenant: false }`** and
+  no longer declares the column. Both halves are needed: the tenant anchor is
+  INJECTED at registration, so deleting the field alone would have left the
+  column exactly where it was. ⚠️ Deliberately NOT `tenancy: { enabled: false }`
+  — that key is the ADR-0066 D2 platform-global *posture*, which the sibling
+  `sys_sso_provider` uses for the opposite shape (a table that KEEPS its tenant
+  column and needs the wall over it stood down). Here there is no column to
+  wall. Both spellings reach `plugin-security`'s `tenancyDisabled`, which is
+  required rather than incidental: a Layer 0 wall composing an equality on a
+  column the table does not have denies every row.
+- **The declared unique index states `unique: 'global'`** over
+  `(metadata_type, name)` instead of `'organization'`. ⚠️ The materialized DDL
+  is unchanged: `normalizeDeclaredIndex` prepends the NULL-safe tenant key part
+  only when the table HAS a tenant column, so `'organization'` already degraded
+  to exactly these two columns. What changes is that the declaration now states
+  the boundary it actually gets, rather than claiming a per-organization one
+  that does not exist. Still explicit rather than bare `unique: true`, which
+  lint `unique/unscoped-declared-index` warns on and protocol 18 rejects.
+- **`ObjectStoreMetadataActivationStore` drops its NULL filter and its
+  org-row skip.** `list()` is now every activation row of its type, scoped by
+  the `metadata_type` discriminator alone, and `setActive` takes the single row
+  its keyed read returns instead of picking the NULL-organization one out of
+  the result. Both guarded a column that no longer exists; the declared unique
+  index over the two columns the lookup keys on is what makes that read
+  single-valued. `ObjectStoreFlowActivationStore` and
+  `ObjectStoreActionActivationStore` inherit the change.
+
+Unchanged, and pinned: the operator gate on activation writes under walled
+postures (ADR-0126 D3), the `execute()`-time flow consult and the dispatch-time
+action consult, "absence of a row means ACTIVE", re-enabling UPDATES the row
+rather than deleting it, and a driver `0` reading as false. The pins that
+asserted the reserved column and the org-row skip are rewritten to pin the
+column's ABSENCE rather than deleted — including at the injection authority
+(`resolveInjectedSystemColumns`, which decides whether the column exists) and
+in a real booted stack, where the row's key set is a reading of the physical
+table.

.changeset/aliased-install-host-importer.md

@@ -0,0 +1,34 @@
+---
+"@objectstack/types": patch
+---
+
+fix(types): an aliased install (`"foo": "npm:bar@1"`) is now found by the host importer's ESM-only fallback
+
+`createHostImporter`'s #14041 fallback finder verifies the one directory it
+consults — `<hostRoot>/node_modules/<key>` — by matching that directory's
+`package.json` `name` against the declared package name. An aliased install
+fails that check by construction: `{ "dependencies": { "foo": "npm:bar@1" } }`
+puts a manifest named `bar` at `node_modules/foo`. The finder answered
+`absent`, and an ESM-only aliased package therefore kept the pre-#14041 INSTALL
+wording — a confidently-wrong remedy sending an operator to run `pnpm install`
+against an install that is already correct, on a declaration shape
+`packageNameFromSpecifier`'s own documentation blesses.
+
+The declaration is now parsed for the name it promises: `npm:bar@1`,
+`npm:@acme/x@^2` and the aliased `workspace:bar@*` name the package installed
+under the key, so that is the manifest name the finder expects there. An
+aliased ESM-only package is rescued exactly as a plain one is, and an aliased
+install publishing nothing loadable gets the message about the PACKAGE's own
+shape instead of the INSTALL message.
+
+⚠️ The manifest-name check itself is NOT loosened — that check is what keeps
+the fallback strictly tighter than the CJS resolution it backs up (#4719's
+declaration gate, from the fallback side). What moved is the EXPECTATION, still
+authored by the host and still read out of the host's own `package.json`: an
+alias naming one package refuses a directory holding another, a non-aliased
+declaration is unchanged, and a value that is not a bare package name — a
+`workspace:` range, an alias carrying a subpath — yields no expectation to move
+to, so the key stays and today's refusal is kept. `link:` and `file:` name a
+LOCATION rather than a package, so no name is derivable from them at all; they
+keep the key expectation, and with it the conservative direction the finder had
+before.

.changeset/analytics-result-builtin-aggregate.md

@@ -0,0 +1,49 @@
+---
+"@objectstack/spec": minor
+"@objectstack/service-analytics": minor
+---
+
+feat(spec,analytics): `AnalyticsResult.fields[].builtinAggregate` — a closed discriminator for a measure column whose display name is the server's built-in default (#14492)
+
+**What a consumer sees.** `queryDataset()` (and `POST /api/v1/analytics/dataset/query`,
+which relays the result verbatim) now carries an optional
+`fields[].builtinAggregate?: 'count' | 'sum' | 'avg' | 'min' | 'max' | 'count_distinct'`
+on a measure column. It is present exactly when the dataset measure behind the
+column declares an `aggregate` and **no** `label` — the producer then has nothing
+but the aggregate to name the column by, so it says which aggregate that is. It is
+absent whenever the author declared a label (a plain string or an inline locale
+map, even one with no entry for the request locale: an author's text is never
+re-labelled by a consumer), and absent on dimension columns and derived measures.
+The vocabulary is `AggregationFunction` (`data/query.zod.ts`), the one closed
+aggregate enum — no second spelling. `AnalyticsResultResponseSchema`
+(`api/analytics.zod.ts`) mirrors the member, refusing a spelling outside the enum.
+
+**Why.** An AI-built dashboard's "count of customers by status" chart showed the
+English axis title "Count" on a Chinese UI. The renderer (objectui
+`buildChartSeries()` / `labelOf()`) treats `fields[].label` as resolved author
+content and passes it through verbatim — correctly, since a real custom label
+("Tasks") must survive. What it could not tell apart was an author's text from
+the server's built-in default for a bare `count`. Guessing from the label text
+was refused (it would catch an author who really named a field `Count`, and break
+the moment the default is spelled in another language); translating on the
+server was not taken (it copies the front end's language decision into the
+producer and leaves nothing for a per-widget override). The ruling (2026-09-02,
+option B) is a structured discriminator on the contract: the consumer prefers a
+locale lookup keyed by `builtinAggregate` — mirroring its existing
+`report.aggregate.*` keys — and falls back to `label`, then `name`.
+
+**Producer-side changes.**
+
+- `@objectstack/service-analytics` — `queryDataset`'s measure enrichment sets
+  `builtinAggregate` from the dataset measure's own `aggregate` when the measure
+  has no authored `label`. Judged on the authored key, never on the resolved
+  string.
+- `@objectstack/spec` — the `dataset` create seed (`metadata-create-seeds.ts`)
+  drops its hardcoded `label: 'Count'` from the seeded `count` measure, so a
+  dataset created from Studio is a built-in default (wire: `builtinAggregate:
+  'count'`) instead of an authored English literal. `getMeta()` for such a
+  dataset now titles the metric by its name (`count`) rather than `Count`;
+  `CubeMeta.measures[].type` already carried the aggregate there.
+
+Purely additive: no key is removed or renamed, no authorable schema changes shape,
+and a consumer that ignores the member sees exactly the response it saw before.

.changeset/assignment-value-role-cel-envelope.md

@@ -0,0 +1,42 @@
+---
+"@objectstack/spec": minor
+---
+
+feat(spec): an `assignment` value may be a CEL value envelope — the expression ledger gains the `value` role
+
+An assignment's whole job is to compute a value into a variable, yet CEL was
+reachable from flow metadata only where the answer had to be a boolean
+(`condition`, `decision.conditions[].expression`, a screen field's
+`visibleWhen`): `FLOW_NODE_EXPRESSION_PATHS` declared two roles, `predicate`
+and `flow-template`, and the `assignment` node's values were `{token}`
+interpolation only. So the stdlib the platform already declares, documents and
+tests — `joinNonEmpty` and the rest of `CEL_STDLIB_FUNCTIONS` — could not be
+called from metadata, and the commonest outbound shape a business application
+has (one digest message listing a recipient's N records) needed a `script`
+node.
+
+Ruled (maintainer, 2026-09-02): the rendering half only, no new vocabulary.
+
+- `FlowNodeExpressionRole` gains `'value'`: a slot whose authored value may be a
+  `{ dialect: 'cel', source }` expression envelope evaluated by the expression
+  engine to the value the variable takes — not a predicate, not a template.
+  The ledger gains the `assignment` entry at `assignments.*`; ledger paths now
+  accept a `*` segment ("every key of this object", the sibling of `[]`), and
+  `resolveFlowNodeExpressions` emits only envelope-shaped objects for a `value`
+  slot — a plain string there stays `{token}` interpolation. Every entry that
+  existed before resolves byte-identically. `isExpressionEnvelopeShaped` is
+  the exported recognizer both halves discriminate on.
+- `AssignmentConfigSchema` / `AssignmentValueSchema` /
+  `AssignmentExpressionValueSchema` declare the `assignment` node's value
+  contract: a string (`{token}` interpolation), a CEL value envelope (the
+  `ExpressionSchema` spelling, narrowed to the `cel` dialect), or any other
+  literal. Every value that parsed before still parses; the one newly refused
+  shape is a malformed envelope (no `source`, an empty or non-string `source`,
+  a `template` / `cron` / unknown dialect), refused at the variable's path with
+  a fixed leading sentence. The map value carries `.meta({ xExpression:
+  'value' })`, the declaration channel the ledger reads for this slot.
+
+The executor half is a separate change in `@objectstack/service-automation`:
+until it lands, the built-in `assignment` executor still writes an envelope
+object into the variable verbatim and `notify` renders it as JSON, and the
+ledger's reconciliation ratchet there does not yet know the `value` marker.