Merge remote-tracking branch 'origin/main' into claude/issue-9416-resume-value-type-refusal

Author: claude

.changeset/action-onsuccess-navigation.md

@@ -0,0 +1,38 @@
+---
+"@objectstack/spec": minor
+---
+
+feat(spec): `ActionSchema.onSuccess` — post-success navigation for `api`/`script` actions, with `${result.*}` joining the navigate template's interpolation scope (#9566, #9474)
+
+<!-- adr-0087: not-required (accept-set expansion) One new CLOSED optional key
+on an existing shape; nothing authorable is renamed, retired or tombstoned, so
+there is no conversion to register. Previously-refused spellings stay refused —
+three of them now carry guidance pointing at the new key. -->
+
+The maintainer's 2026-08-18 ruling (recorded on #9566, mirrored on #9474)
+declares ONE post-success navigation contract for both server-executing action
+types instead of two per-type conventions:
+
+- `onSuccess: { navigate, openIn? }` — a strict object, read for
+  `type: 'api'` and `type: 'script'` only (a refinement refuses it on
+  `url`/`modal`/`flow`/`form`, where no success event exists for it to ride —
+  the ADR-0078 posture, same enforcement shape as the `body`-on-non-script
+  refinement).
+- `navigate` is a route/URL template. Its documented interpolation scope is
+  `${param.*}` + `${ctx.*}` (existing) + **`${result.*}` — NEW: the action's
+  server response payload** (an `api` action's response body, a `script`
+  handler's return value), which is what makes "server clones a record → jump
+  to the new record" declarable: `navigate: '/apps/crm/tasks/${result.id}'`.
+  The interpolation ENGINE stays the renderer's (objectui `interpolateTarget`);
+  the spec records the contract.
+- `openIn` is the closed enum `'self' | 'newTab'`, defaulting **`'self'`**
+  (materialized, the file's default convention) — no general navigation DSL.
+- The shipped handler-return convention (`{ redirectUrl, openIn? }`,
+  objectui#2967/#2904) keeps its 17.0.0 semantics: absent `openIn` still means
+  new-tab (no silent behavior flip for existing handlers); a handler may return
+  `openIn: 'self'` explicitly.
+
+The console consumer is the downstream objectui half (SPA navigation branch,
+`executeAPI` navigation handling, `${result.*}` interpolation), filed
+Blocked-by these cards; the liveness ledger records the key at `planned`
+strength with the amend-on-landing instruction.

.changeset/field-reference-target-unanswerable.md

@@ -0,0 +1,13 @@
+---
+"@objectstack/metadata-protocol": patch
+---
+
+Refuse `GET /api/v1/meta/field/<object>.<field>/references` instead of clearing it for deletion
+
+A `field` metadata item is addressed by the composite key `<object>.<field>` (e.g. `account.owner`), but every metadata property that names a field holds the **bare** field name — `view.list.columns[].field`, `dataset.dimensions[].field`, `object.validations[].field`, `object.fields{}` and 150 further non-recursive paths across nine source types. The two sides are drawn from disjoint vocabularies, so the reference scan answered `{ references: [] }` for every field, on every deployment, regardless of real usage.
+
+The admin "Used by" panel renders that empty answer verbatim as *"Nothing in the metadata graph points at this item. Safe to delete."* — an unanswerable question shown as a positive clearance, on the screen where someone decides to delete.
+
+`findReferencesToMeta` now refuses a `field` target with `501 NOT_IMPLEMENTED` in the ADR-0112 envelope, carrying the answerable alternative (`GET /api/v1/meta/object/<object>/references`). Per ADR-0110 D3, a miss and a fault are different facts. Nothing is added to the success response, and no new error code is introduced — this is the same code the route already returns when the protocol cannot compute the graph at all.
+
+Every other target type is unaffected: a genuine "nothing points at this item" still answers `{ references: [] }`.

.changeset/register-flow-conversion-conflict.md

@@ -0,0 +1,13 @@
+---
+"@objectstack/spec": patch
+---
+
+Register `FLOW_CONVERSION_CONFLICT` (409) in the ADR-0112 error-code ledger under
+`@objectstack/metadata-protocol` (#9567). The code was already live on the wire —
+`saveMetaItem`'s flow-conversion rename guard (`protocol.ts`) has thrown it since
+ADR-0078 landed, already SCREAMING_SNAKE — but was invisible to
+`check:dispatcher-error-vocabulary`'s scan because the site stamps it through a
+cast (`(err as any).code = 'FLOW_CONVERSION_CONFLICT'`) rather than the bare-
+identifier `assign` shape the scan matched at the time. This is an ordinary,
+additive admission: no accept/reject behavior, no producer, and no wire shape
+changes.

.changeset/service-readmes-document-real-exports.md

@@ -0,0 +1,76 @@
+---
+"@objectstack/service-analytics": patch
+"@objectstack/service-automation": patch
+"@objectstack/service-cache": patch
+"@objectstack/service-i18n": patch
+"@objectstack/service-job": patch
+---
+
+docs: five published service READMEs stop documenting an API that does not exist (#9532)
+
+A version bump is the point, not a side effect: these five READMEs are in their
+packages' `files` arrays with `private` unset, so they are the pages npm renders —
+and a docs-only fix with no bump never reaches npm at all.
+
+Each of the five told a reader to an import of a `Service…` class from its own package
+and call a static `.configure({...})` on it. Neither has ever existed: no class in
+this repo exposes a static `configure`, and none of `ServiceAnalytics`,
+`ServiceAutomation`, `ServiceCache`, `ServiceI18n` or `ServiceJob` is exported by
+anything. A reader following any of them wrote code that could not compile. The real
+entry point in every case is a kernel plugin constructed with `new`:
+`AnalyticsServicePlugin`, `AutomationServicePlugin`, `CacheServicePlugin`,
+`I18nServicePlugin`, `JobServicePlugin`.
+
+⛔ A name swap alone would not have been enough, and the gate landed in #9546 is what
+proves it: substituting the genuine class while keeping `.configure(...)` turns the
+import finding into a call-site finding rather than into silence. Each README is
+rewritten against the package's built type surface, and each package's entry is
+deleted from `scripts/published-readme-exports.baseline.json` in the same change
+(the baseline is reconciled in both directions, so a stale entry fails too).
+
+What was removed as fabricated, beyond the entry point:
+
+- **service-analytics** — a nine-endpoint REST surface (`/analytics/count`, `/sum`,
+  `/avg`, `/min`, `/max`, `/group-by`, `/time-series`, `/metrics`, `/metrics/:name`)
+  of which none exists; the real surface is `POST /analytics/query`,
+  `GET /analytics/meta`, `POST /analytics/sql` and `POST /analytics/dataset/query`.
+  Also removed: `defineMetric`, `getMetric`, `compare`, `funnel`,
+  `executeDashboard`, `invalidateCache`, and an `AnalyticsServiceConfig` block whose
+  four keys (`defaultDriver`, `enableCaching`, `cacheTTL`, `maxMemoryResults`) are
+  none of the real ones.
+- **service-automation** — `executeFlow`/`getFlow`/`listFlows`/`getFlowHistory`/
+  `registerTrigger` as the contract (the real contract is `execute(flowName, context?)`
+  plus `listFlows()` and a set of optional members), and a five-endpoint REST list that
+  matches no mounted route. The flow-authoring half of that README was already accurate
+  and is kept.
+- **service-cache** — `mget`/`mset`/`del`/`delPattern`/`namespace`/`ttl`/`expire`/
+  `persist`/`incr`/`incrby`/`decr`/`getOrSet`/`invalidateTag`/`resetStats`, none of
+  which exist; `ICacheService` has six members. `CacheStats.keys`/`hitRate` corrected to
+  `keyCount` (there is no `hitRate`), and `set(key, value, { ttl })` corrected to the
+  real positional `set(key, value, ttl?)` in seconds.
+- **service-i18n** — an `await i18n.t('ns:key')` dialect with namespaces, plural
+  suffixes, `context`, `returnObjects`, `setLocale`/`getLocale`, `formatDate`/
+  `formatNumber`/`formatRelative`, `addLocale`/`removeLocale`/`reload`, `getCoverage`/
+  `getMissingKeys`, and a `{{lng}}/{{ns}}` file layout. The real `t()` is synchronous
+  and takes the locale positionally — `t(key, locale, params?)` — over one
+  `{locale}.json` file per locale. The `POST /i18n/translate` endpoint does not exist.
+- **service-job** — `scheduleInterval`/`scheduleOnce`/`getJob`/`stopJob`/`resumeJob`/
+  `deleteJob`/`runNow`/`getJobHistory`/`clearHistory`/`getLastExecution`, and a
+  `schedule({ name, schedule, handler })` options-object call. The real `schedule` is
+  positional — `schedule(name, schedule, handler, options?)` — and returns `void`.
+  Retry defaults corrected to the enforced ones (`maxRetries: 0`,
+  `backoffMultiplier: 1`).
+
+Two capability claims are corrected rather than deleted, because the source is what
+decides:
+
+- **service-cache** advertised Redis as production support. `RedisCacheAdapter` throws
+  `RedisCacheAdapter not yet implemented` from every method, and
+  `new CacheServicePlugin({ adapter: 'redis' })` throws during `init` rather than
+  falling back to memory. The README now says so at the top and points at registering
+  a custom `ICacheService` under the slot instead.
+- **service-job**'s `adapter: 'interval'` stores cron registrations that never fire.
+  That is now stated in the adapter table rather than left for a reader to discover.
+
+No compliance claim (SOC 2 / HIPAA / GDPR or similar) was found in any of the five —
+the shape that raised `plugin-audit`'s severity in #9517 is absent here.

.changeset/spec-prompts-real-exports-9545.md

@@ -0,0 +1,32 @@
+---
+'@objectstack/spec': patch
+---
+
+Published agent-authoring prompts now reference real exports.
+
+`prompts/create-new-project.md`, `prompts/implement-objectql.md` and
+`prompts/implement-objectos.md` told agents to import five symbols that
+`@objectstack/spec` does not export. Four failed loudly. The fifth did not:
+`import { Object } from '@objectstack/spec/data'` does not resolve, so the
+annotation in `export const AccountObject: Object = { ... }` bound to the
+**JavaScript global** `Object` instead — metadata authored from that prompt
+type-checked against a type that constrains nothing.
+
+- Object definitions now use the house authoring convention measured in the
+  example apps, `ObjectSchema.create({ ... })`, which genuinely validates.
+  Correcting it exposed that the prompt's own example set `enable.audit` /
+  `enable.workflow`, neither of which exists; they are now `trackHistory` /
+  `files`, the pair the schema's own docstring uses.
+- `implement-objectql.md` keeps the real `Field` and `QuerySchema` imports and
+  derives the object metadata type as `z.infer<typeof ObjectSchema>`, matching
+  both `prompts/instructions.md` ("interfaces must be inferred from Zod") and
+  spec's own `src/contracts/schema-driver.ts`.
+- `ManifestSchema` becomes `ObjectStackDefinitionSchema` from the package root:
+  the prompt's subject is `objectstack.config.ts`, which is neither of the
+  `/system` manifests.
+- `IdentitySchema` / `PolicySchema` have no bare referent; Rule #2 now names
+  `RLSUserContextSchema` and `RowLevelSecurityPolicySchema` from
+  `@objectstack/spec/security`.
+- The three non-existent "Key Files to Watch" paths
+  (`system/{manifest,identity,events}.zod.ts`) now point at `stack.zod.ts`,
+  `security/rls.zod.ts` and `kernel/events.zod.ts`.