Merge remote-tracking branch 'origin/main' into claude/issue-14399-view-container-name-order

Author: claude

.changeset/authz-brand-structured-clone-doc.md

@@ -0,0 +1,42 @@
+---
+'@objectstack/core': patch
+---
+
+docs(core): the `AuthzStoreUnavailableError` brand doc states the measured `structuredClone` behaviour instead of claiming survival (#14006)
+
+Documentation only — no runtime change, no type change, no accept/reject
+behaviour moves. It ships as a patch because the docblock is a **published
+byte**: `tsup`'s declaration rollup carries it into `dist/index.d.ts` and
+`dist/index.d.cts`, so it is what a consumer reads on hover.
+
+The brand's docblock justified the string-keyed own property with two reasons
+joined by an `and`, of which only the second was true:
+
+> A string-keyed own property (not a `Symbol.for` registry key) so it survives
+> `structuredClone`, and so a duplicated copy of this module still brands
+> identically.
+
+Measured on Node 22.22.2: the structured-clone algorithm gives `Error` a
+dedicated serialization carrying `message`, `stack` and `cause` only, and drops
+every other own property — the brand, the ADR-0112 `code`, `status` and
+`object` alike (a subclass's own `name` returns as `'Error'`). The
+plain-object control is the half that proves it: `{ __brand: true, code: 'C' }`
+keeps **both** keys through the same call, so the loss is specific to `Error`,
+not general to `structuredClone`.
+
+The property and the reason that actually earns it are kept — a duplicated copy
+of the module still brands identically, which is exactly what `instanceof`
+cannot do across two installed copies of `@objectstack/core`. The false half is
+replaced by the measured behaviour, carrying the reproducible script and the
+Node version rather than a second unsourced assertion, and phrased to match
+what `service-not-registered.ts` already records for its own brand (one
+phrasing across the two modules, not two).
+
+⛔ The clone gap is deliberately NOT "fixed" with a `toJSON` or a custom
+serialization: no call site crosses a clone boundary today
+(`rethrowAuthzStoreUnavailable` on the rest rethrow paths,
+`isAuthzStoreUnavailableError` inside service `catch` blocks — all in-process),
+and adding one would widen the module's surface with nothing pulling on it. The
+docblock instead names the trap the false claim invited: branching on the brand
+across a worker or `postMessage` boundary would answer `false` and fail OPEN on
+a security path.

.changeset/core-plugin-type-closed-set.md

@@ -0,0 +1,35 @@
+---
+"@objectstack/core": minor
+---
+
+feat(core): `Plugin.type` is the closed set the spec declares — a `PluginType` derived from `CORE_PLUGIN_TYPES` (#13925)
+
+**BREAKING** accept-set narrowing on a published type, shipped as `minor`
+under the repo's launch-window convention for breaking changes. `Plugin.type`
+(and, through it, `PluginMetadata.type`) was declared `string`, so nothing
+type-checked a plugin author against the eight values the platform accepts —
+the TSDoc beside it carried the whole enumeration as prose, and prose drifted.
+Maintainer ruling 2026-09-01: the Zod enum in `@objectstack/spec`
+(`PluginSchema.type`, declared `z.enum(['standard', ...CORE_PLUGIN_TYPES])`)
+is the authority and the contract was always a closed set; the `string` in
+core was the mismatch, and narrowing it is core aligning to the declared
+contract rather than a new restriction. Paid in one stroke — no warning window.
+
+What changes:
+
+- `@objectstack/core` now exports `PluginType`, derived from the spec's own
+  constant: `'standard' | (typeof CORE_PLUGIN_TYPES)[number]` — today
+  `standard`, `ui`, `driver`, `server`, `app`, `theme`, `agent`, `objectql`.
+  It is not re-spelled in core, so the compiler's accept set and the Zod gate's
+  cannot drift apart; a runtime parity test pins the two against each other.
+- `Plugin.type` is typed `PluginType`. A literal outside the set, or a value
+  typed `string`, no longer compiles. Runtime behaviour is unchanged: the Zod
+  gate refused such a value before and still does (`invalid_value` at `type`).
+
+**Migration.** A plugin that declares one of the eight members needs no change.
+A plugin that assigned a computed or `string`-typed value narrows it at the
+producer — declare the literal, or type the variable `PluginType` — rather than
+casting at the assignment; a value that was never one of the eight was never a
+valid plugin type and was already refused at parse time.
+
+<!-- adr-0087: not-required (no-migration-prescription) A TypeScript narrowing on a published runtime interface, aligning `packages/core` to the accept set `packages/spec` already declared. No metadata key, spec symbol, Zod schema, object definition or stored representation is added, removed or renamed — `CORE_PLUGIN_TYPES` and `PluginSchema.type` are read, not changed — so `objectstack migrate meta` has nothing to rewrite and there is no tombstone to mint. The channel that reaches an affected author is the compiler, at the assignment, which is more precise than a ledger line; which member a formerly `string`-typed value should become is authoring intent no migration entry can decide. The in-repo census under the workspace typecheck is recorded on the PR. -->

.changeset/job-once-schedule-leader-election.md

@@ -0,0 +1,35 @@
+---
+"@objectstack/service-job": patch
+---
+
+fix(service-job): leader-elect `type: 'once'` schedules on `DbJobAdapter` (#13918)
+
+`DbJobAdapter.schedule()` decides which adapter owns a scheduled fire, and only
+`CronJobAdapter` takes the cluster lock (`runScheduled()` -> `lock.acquire('job:'
++ name, { waitMs: 0 })`). `cron` schedules were routed there from the start and
+`interval` schedules since #13686 — but `once` schedules still went to the inner
+`IntervalJobAdapter`, a bare `setTimeout` with no lock. On a multi-replica
+deployment a one-shot job therefore ran **once per replica**, not once per
+cluster, and a one-shot is the worst-shaped of the three: there is no later tick
+during which a business-level de-duplication marker could win, so every replica's
+copy lands inside the same short window.
+
+`once` now takes the same leader-elected path as `cron` and `interval` whenever a
+cron adapter is assembled, and stays registered on the inner adapter via
+`register()` (stored, not armed), so `trigger()`, `replay()`, `getExecutions()`
+and `listJobs()` answer for it exactly as before. Affected paths in this repo:
+the automation wait-node's timer resume and its cold-boot re-arm
+(`@objectstack/service-automation`), schedule-triggered flows with an `at`
+(`@objectstack/trigger-schedule`), and app-declared jobs with a `once` schedule
+(`@objectstack/runtime`).
+
+**Behaviour change, on multi-replica assemblies only.** A `once` job now fires on
+one replica per cluster instead of on every replica. Single-node behaviour is
+unchanged in both assemblies: with a cron adapter and no cluster driver the lock
+is always granted, and with no cron adapter at all the job still fires on the
+inner timer exactly as before. The semantics are **at-most-once per cluster**
+(maintainer ruling 2026-09-01): election decides who fires, not that the fire
+survives — a leader that dies mid-fire loses it, and nothing re-arms it. That
+takes nothing away, because the previous unelected `setTimeout` was not persisted
+either and the same crash lost it on every replica at once. No re-arm, retry or
+persistence mechanism is added.

.changeset/rest-duplicate-record-arm-field-restored.md

@@ -0,0 +1,16 @@
+---
+'@objectstack/rest': patch
+---
+
+Restore the `field` key and the curated conflict sentence on the 409 body for an insert refused by a unique constraint
+
+Since the ObjectQL engine began answering a driver's unique violation with its own `DUPLICATE_RECORD` envelope (`status: 409`, `object`, `field`, the driver error on `cause`), `POST /api/v1/data/:object` let that envelope leave `classifyDataError` through the generic declared-status passthrough: still 409, but with `code: 'DUPLICATE_RECORD'`, no `field`, and the engine's own sentence in `error`. The `isUniqueViolationError` arm that names the conflicting column (`field: 'email'`, "A record with this email already exists") was no longer reached for an insert conflict. Measured with the real engine and real drivers: on `driver-sqlite-wasm` the `field` key disappeared from every conflict on a single-column index; on `driver-memory` the sentence changed.
+
+A dedicated arm for the engine's envelope now sits with the other structured 409s (`DELETE_RESTRICTED`, `CONCURRENT_UPDATE`), ahead of the passthrough:
+
+- `code` stays `UNIQUE_VIOLATION` — the code every client branching on this conflict already reads.
+- `field` is restored whenever the dialect determinably named the column (SQLite, Postgres); composite keys and index-naming dialects (MySQL) carry no `field` key, exactly as before.
+- `error` is the curated end-user sentence again; the engine's own sentence rides on `developerMessage`, the same split the `DELETE_RESTRICTED` body uses.
+- The body still quotes nothing the driver said — no offending value, no statement, no index name — including on `driver-memory`, whose raw refusal used to echo the offending values as JSON through the passthrough.
+
+`patch`: a restoration of the shipped body's keys and wording; the wire `code` and the status are unchanged. The arm fires for the engine's envelope only; a plugin or sandbox body that throws the registered `DUPLICATE_RECORD` itself keeps the answer it gets today.

.changeset/share-link-enabled-at-redemption.md

@@ -0,0 +1,69 @@
+---
+"@objectstack/plugin-sharing": minor
+---
+
+fix(plugin-sharing): hold `publicSharing.enabled` at redemption, not only at mint (#14033)
+
+**BREAKING** runtime behaviour change on a published package: share links that
+were legitimately minted can now stop resolving without anyone revoking them —
+every link on an object whose `publicSharing.enabled` is not `true`. Shipped as
+`minor` under the repo's launch-window convention (a breaking change does not
+burn a major while the stack is in lockstep). No export is added, removed or
+re-shaped; the level carries the breaking banner, not a surface change.
+
+`ShareLinkService.createLink()` refused to mint on an object whose
+`publicSharing` block was absent or had `enabled !== true` (422
+`SHARING_NOT_ENABLED`), and nothing checked the switch again. `resolveToken()`
+checked `revoked_at`, `expires_at`, the audience gates, the password, record
+existence and — since #13608 — the block's `eligibility` predicate, then served
+whatever survived, under the system context, to a caller with no principal at
+all. So the platform held the block's CHILD predicate as a standing policy while
+its PARENT switch governed minting only: an author who turned the whole feature
+off stopped new links and not one existing link, and would have had to narrow
+the predicate to stop anonymous serving — the opposite of what the surface
+reads like. Measured before it was changed: a token minted while the block was
+on kept serving the record in full after the block was turned off.
+
+**What changed.** `resolveToken()` reads the object's CURRENT `publicSharing`
+block on every redemption and refuses when `enabled` is not `true` — before the
+record is read, before the usage stamp, before any sibling key inside the block
+is evaluated. Re-enabling the block restores the same tokens: this is a standing
+policy, not a revocation, and no `sys_share_link` row is touched. How a link was
+minted buys it nothing at redemption — a link minted under a system context or
+the service's `permissive` bypass (the system-context ledger's row 37 path) on a
+switched-off object refuses exactly like one orphaned by an author turning the
+block off, and an object with no `publicSharing` block at all is the same switch
+at its default and refuses too. With the block on, `eligibility` (#13608) and
+the declared `redactFields` (#13856) keep their existing redemption-time
+behaviour; nothing new is evaluated. An object the engine cannot return a
+schema for — no `getSchema` on the engine, or an object not registered at the
+moment of redemption — is `enabled: false` by `getPolicy`'s definition and is
+refused at redemption: fail-closed, the same definition `createLink` uses. The
+#13856 entry's "an opted-out object's links keep resolving with the declared
+redactions" state is superseded: with the block off they do not resolve at all.
+
+**The refusal is deliberately indistinguishable.** It is the same answer a
+revoked, expired, unknown or no-longer-eligible token already gets: the
+undifferentiated `null` — no new error code, no new response branch, and no
+usage stamp. Over HTTP a switched-off link is answered with the generic
+`404 INVALID_OR_EXPIRED`, byte-for-byte what a token that never existed
+receives. The readable reason (`SHARING_NOT_ENABLED`, with the link, object and
+record ids) is written to the server-side log at `warn`, where the eligibility
+refusal already writes its own.
+
+**Operator impact — retroactive, on deploy.** Every live link on an object whose
+`publicSharing` block is currently switched off — or that never declared one —
+stops resolving the moment this version is deployed, with no revocation event
+and no grace period. That is the intent: the alternative is a declared switch
+the platform does not hold. Measure before rollout: the objects to read are
+those whose `publicSharing.enabled` is not `true`, and the links at risk are the
+`sys_share_link` rows naming them (`object_name`). To keep such links working,
+enable the block — and narrow it with `eligibility` / `redactFields` if the
+feature was off for a reason; there is no per-link opt-out, deliberately.
+Minting is unchanged: `createLink` still refuses `SHARING_NOT_ENABLED` for an
+ordinary caller, and the system / `permissive` bypass still mints — what it
+mints simply does not serve until the block is on. The refusal logs one `warn`
+line per refused hit and is not latched, so a retroactive deploy with many live
+links on switched-off objects will burst the log once.
+
+<!-- adr-0087: not-required (no-migration-prescription) Nothing authorable is removed, renamed or re-shaped: `publicSharing.enabled` keeps its name, its type, its default and its accept-set, and the change is WHEN the platform holds it. There is therefore no tombstone for `objectstack migrate meta` to carry and no mechanical rewrite it could perform — a deployment whose links stop resolving must decide whether the block should be on at all, which is an authoring decision no ledger entry can make on its behalf. -->

.claude/skills/checklist-author/SKILL.md

@@ -28,27 +28,18 @@ metadata:
 `node scripts/check-platform-checklist.mjs` 下校验为绿,并按 AGENTS.md
 (worktree-first,PD#11)落在任务分支上。
 
-## 编排契约
-
-1. **Worktree 先行**(PD#11):`git fetch origin main && git worktree add --no-track ../objectstack-<task>
-   -b <branch> origin/main`。全部编辑都在那里做。派发任何 agent 之前先读清单现状。
-2. **五个只读 gap hunter 并行** —— 每个 SWEEP.md 角度一个(console UI / spec 枚举 /
-   路由与运行时 / 内置应用 / 文档声称)。每个拿到:当前 item-id 清单、已知的 waiver
-   与 blocked 项(不重复上报),以及输出契约 `surface | evidence path | coverage
-   verdict | proposed id | sketch | fixture?`。hunter 不写任何文件。
-3. **去重并入一个草稿登记表**(落地前删掉)。跨角度的重复命中是高优先级信号,不是噪
-   音。
-4. **按区 writer agent** —— 每个 `areas/*.json` 文件一个 agent,writer 之间永不相
-   撞;除编排者外谁都不碰 `coverage.json` 与 `scripts/`。每个测试项都遵守 README.md
-   的 deep-test 契约;缺 fixture 就记 `blocked`/`knownGaps`,永不伪造覆盖。writer
-   断言之前把每个 endpoint、枚举、错误码都对到源码上 —— 把本技能的简报当假设,源码
-   才是真相。
-5. **集中对账**:hunter 证明有现成 fixture 的种类一律解除 waiver(2026-08 那轮
-   sweep 里六条 waiver 有四条已过期 —— 每次都重审全部 waiver),新项映射进
-   `coverage.json`,新的 variants 矩阵钉上 `enumSource`(见 README「Variants stay
-   fresh automatically」)。
-6. **校验 + 落地**:校验器绿,再提交到任务分支。产品缺陷与文档漂移进
-   `FOLLOW-UPS.md`;安全敏感的发现,没有维护者的决定**永不**公开立单。
+## 编排契约 —— 只写 SWEEP 没有的
+
+六步流程照 `SWEEP.md`「How to run it」执行,⛔ 这里不复述。它没有、而这一轮必须成
+立的三条:
+
+1. **Worktree 先行**(PD#11):`git fetch origin main && git worktree add --no-track
+   ../objectstack-<task> -b <branch> origin/main`。全部编辑落在那里;派发任何 agent
+   之前先读清单现状。
+2. **只有编排者碰 `coverage.json` 与 `scripts/`。** hunter 一个文件都不写,writer 一
+   个区文件一人 —— 这是并行 agent 之间唯一的串行化依据。
+3. **本技能的简报是假设,源码才是真相** —— 每个测试项按 README.md「Item anatomy」
+   的契约写;缺 fixture 记 `blocked`/`knownGaps`,永不伪造覆盖。
 
 ## 规模指引