Merge remote-tracking branch 'origin/main' into claude/issue-11525-objectql-double-limit-gate

Author: claude

.changeset/audience-posture-invite-only-default.md

@@ -0,0 +1,19 @@
+---
+'@objectstack/spec': minor
+'@objectstack/plugin-auth': minor
+'@objectstack/verify': patch
+---
+
+feat(spec,plugin-auth)!: one declared audience posture — `invite_only | email_domain | open`, default `invite_only`
+
+**BREAKING CHANGE (ships as `minor` under the launch-window rule; every publishable package rides the fixed group).** "Who may become a user of an environment's apps" is now ONE declaration instead of an emergent property of five switches — and its default flips to the safe end.
+
+- New authorable surface `auth.audience` on `AuthConfig` (`@objectstack/spec/system`): `posture` (`invite_only` | `email_domain` | `open`), `allowedEmailDomains` (required non-empty for `email_domain`), `selfRegistrationPermissionSet` (required whenever the posture permits self-registration; `admin_full_access` refused). Off-vocabulary postures and inert declarations (domains outside `email_domain`, a permission set under `invite_only`) are refused at parse AND at plugin-auth's config entry — never coerced.
+- **FROM:** an undeclared audience meant open email/password self-registration with no email verification, and self-registrants implicitly fell back to the `member_default` permission set. **TO:** an undeclared audience IS `invite_only` — self-serve sign-up (email/password, social-provider OAuth JIT, magic-link/OTP/phone/anonymous, and any unclassified creation method) is refused `403 SELF_REGISTRATION_CLOSED` unless the address holds a pending `sys_invitation` (the first account on a fresh install is exempt — the bootstrap bypass). One-line fix for deployments that mean to stay open: declare `auth: { audience: { posture: 'open', selfRegistrationPermissionSet: 'member_default' } }`.
+- `email_domain` admits only allowlisted domains (`403 EMAIL_DOMAIN_NOT_ALLOWED` otherwise; exact case-insensitive match, subdomains not implied, `+tag` local parts irrelevant). Any self-registration-permitting posture FORCES `requireEmailVerification` on (an explicit `false` beside it is refused at boot) and grants each self-registrant the DECLARED permission set (`sys_user_permission_set`); a declaration that cannot be resolved refuses admission (`403 AUTH_CONFIG_ERROR`) rather than admitting ungranted.
+- Operator-driven creation is never posture-gated: admin create-user / bulk import, SCIM provisioning, and JIT through operator-registered identity providers (`oidcProviders`, `@better-auth/sso`) keep working under every posture.
+- `/api/v1/auth/config` now serves `features.audiencePosture` and mirrors the forced verification flag; `SELF_REGISTRATION_CLOSED` and `EMAIL_DOMAIN_NOT_ALLOWED` are registered in the ADR-0112 ledger.
+- The BOOTSTRAP bypass counts non-system HUMANS, not `sys_user` rows, so a database still carrying the legacy `usr_system` service row is still a fresh install; the same predicate now backs the dev-admin seed's own precondition. The `emailAndPassword.disableSignUp` bootstrap bypass reads it too.
+- `@objectstack/verify`: `stack.signUp(...)` seeds a pending `sys_invitation` for the address before signing up, so harness fixtures that mint a second/third identity enter through the invitation carve-out under the new default. Fixtures asserting on their environment's pending invitations should filter by their own `organization_id` (the harness rows carry `org_verify_audience_gate`).
+
+<!-- adr-0087: registered audience-posture-default-invite-only -->

.changeset/manifest-contributes-dead-members-retired.md

@@ -0,0 +1,60 @@
+---
+"@objectstack/spec": minor
+---
+
+feat(spec): retire the nine dead members of the plugin-manifest `contributes` block — `events` / `menus` / `themes` / `translations` / `actions` / `drivers` / `fieldTypes` / `functions` / `commands` (#10724, ADR-0049 enforce-or-remove)
+
+<!-- adr-0087: registered plugin-manifest-contributes-dead-members-retired -->
+
+**BREAKING** accept-set narrowing, landing after the v17.0.0 cut (the lockstep
+launch-window convention ships it as `minor`; the migration prescription is
+registered under protocol major 18, where `os migrate meta` users will look).
+
+The census behind it (#10627, controlled and re-verified at claim time across
+objectstack, objectui and cloud) measured that the ENTIRE monorepo contains
+exactly one non-test read of `manifest.contributes`, and it reads `kinds`
+(`packages/objectql/src/engine.ts` → `registry.registerKind`). The other nine
+members parsed, entered the manifest, and changed nothing — while published
+material kept teaching them: `commands` documented Commander.js runtime
+resolution the CLI dropped for oclif auto-discovery, `fieldTypes` advertised a
+registration seam that has never existed, and `events` was decorative even for
+its only in-repo author, which already subscribes imperatively.
+
+**What is refused:** authoring any of the nine keys. Each is a `retiredKey()`
+tombstone (the `manifest.loading` precedent — neither `ManifestSchema` nor the
+`contributes` object is `.strict()`, so a plain deletion would have silently
+stripped the keys), so authoring one is a `tsc` error and a parse error
+carrying the per-key prescription.
+
+**FROM → TO, per member** (each tombstone carries its own one-line fix):
+
+- `contributes.events` → subscribe in plugin code (`ctx.hook('kernel:ready', …)`
+  from `init`/`start`); delete the key.
+- `contributes.menus` → app `navigation` / `manifest.navigationContributions`
+  (ADR-0029 D7); delete the key.
+- `contributes.themes` → the stack-level `themes` metadata collection (an
+  unrelated `ThemeSchema` surface); delete the key.
+- `contributes.translations` → the `translation` metadata type:
+  `defineTranslationBundle` in `defineStack({ translations })`; delete the key.
+- `contributes.actions` → the stack `actions` collection or
+  `engine.registerAction`; delete the key.
+- `contributes.drivers` → register a kernel service named `driver.*`; delete
+  the key.
+- `contributes.fieldTypes` → nothing (no registration seam exists; the
+  vocabulary is the spec `FieldType` enum); delete the key.
+- `contributes.functions` → `defineStack({ functions })`; delete the key.
+- `contributes.commands` → oclif native plugin auto-discovery (an `oclif`
+  section in the plugin's own `package.json`; see `cli-extension.zod.ts`);
+  delete the key.
+
+**What stays:** `contributes.kinds` (the block's one live member) and
+`contributes.routes` (an open enforce-or-remove fork, #10726 — deliberately
+untouched here). Runtime behaviour is unchanged: nothing ever read the nine
+members, so removing them removes no behaviour; a stored manifest still
+carrying one degrades to a single `[metadata_spec_invalid]` log line at
+registration rather than a boot failure.
+
+D3 semantic entry `plugin-manifest-contributes-dead-members-retired`; no D2
+conversion, because a package manifest is not a stack collection member
+(`PLURAL_TO_SINGULAR` has no `packages`/`plugins` entry) and a conversion
+would be a transform with no seam that ever runs.

.changeset/manifest-kind-globs-retired.md

@@ -0,0 +1,39 @@
+---
+"@objectstack/spec": minor
+---
+
+feat(spec): retire `contributes.kinds[].globs` — the declared file-type watch patterns nothing ever read (#11169, ADR-0049 enforce-or-remove; maintainer-ruled 2026-08-24)
+
+<!-- adr-0087: registered plugin-manifest-kind-globs-retired -->
+
+**BREAKING** accept-set narrowing, landing after the v17.0.0 cut (the lockstep
+launch-window convention ships it as `minor`; the migration prescription is
+registered under protocol major 18, where `os migrate meta` users will look).
+
+**Removed key:** `manifest.contributes.kinds[].globs`.
+
+The schema promised that declaring `globs` "enables the system to parse and
+validate new file types" (its own example: a BI plugin handling
+`*.report.ts`). The promise was never kept: real glob-driven artifact
+discovery reads `filePatterns` off the metadata type registry — which
+`contributes.kinds` does not extend, as `metadata-plugin.zod.ts` records
+outright — so an authored `globs` was accepted, stored, served back through
+`GET /metadata/kind`, and never consulted. Measured (PR #11168, re-verified
+with positive control at claim): zero value reads anywhere; the only non-test
+occurrences of the path were the schema declaration and two type positions.
+
+**FROM → TO:** `kinds: [{ id, globs: […], description? }]` →
+`kinds: [{ id, description? }]` — delete the `globs` key; the kind's `id` and
+`description` are unchanged and still register. The key is a `retiredKey()`
+tombstone, so authoring it is a `tsc` error and a parse error carrying this
+prescription.
+
+**What stays:** the `contributes.kinds` bucket itself and its `id` field
+(live: engine → `registry.registerKind`, served via `GET /metadata/kind`).
+File-type discovery remains single-channel on the metadata type registry's
+`filePatterns`; if plugin-extensible discovery is ever wanted, it gets
+designed against that registry, not revived here. The `registerKind` /
+`getAllKinds` type positions drop `globs` (type-only; the parameter widens).
+
+D3 semantic entry `plugin-manifest-kind-globs-retired`; no D2 conversion (a
+manifest is not a stack collection member — no seam would ever run it).

.changeset/walled-owner-no-verification-path-warning.md

@@ -0,0 +1,27 @@
+---
+"@objectstack/plugin-auth": patch
+---
+
+feat(plugin-auth): warn at boot when a walled deployment declares an owner it can never verify (#11640)
+
+A walled deployment (`OS_TENANCY_POSTURE=group|isolated`) that declares
+`OS_PLATFORM_OWNER_EMAIL` but wires **no verification path** — no email
+transport and no trusted federated sign-in — now emits a loud, named boot
+warning (`walled_owner_no_verification_path`) on `kernel:ready`.
+
+Since #11343, walled platform-admin elevation requires the declared owner's
+address to be **verified**, and verification can only arrive by an emailed
+link or by a federated sign-in that inserts the account already verified. With
+neither wired, the declared owner registers, is refused
+(`walled_owner_not_verified`), and has no in-product way to satisfy the
+condition — a dead end that previously surfaced only weeks later, at the
+owner's rejected registration. The warning names both missing inputs and the
+concrete wiring for either remedy (an email service, or SSO / a social
+provider), since either one alone clears it.
+
+⛔ **Boot proceeds — this is not a refusal**, and no accept/reject behaviour
+changes anywhere: the walled + undeclared-owner boot refusal (#11184) and the
+fail-closed elevation refusal (#11343) are untouched. Deployments already
+wiring either verification path see no new output, and neither does a
+dev/harness boot whose declared owner is the dev-admin the seed provisions and
+stamps verified.

content/docs/protocol/kernel/i18n-standard.mdx

@@ -590,44 +590,63 @@ context.i18n.formatNumber(smallNumber, {
 
 ## Plugin Integration
 
-Plugins register translation bundles in their manifest:
+Translations are **metadata**, declared on the stack — not manifest entries.
+(The former `contributes.translations` manifest key was removed in v17 (#10724,
+ADR-0049): no loader ever read its `{ locale, path }` entries, so a manifest
+that still carries it now fails the parse with the upgrade prescription.)
+
+A package declares a translation bundle and registers it in its stack's
+`translations` collection:
 
 {/* os:check */}
 ```typescript
-// plugin.manifest.ts — a plugin manifest validated by `ManifestSchema`
-// from `@objectstack/spec/kernel` (there is no `definePlugin()` helper).
-// Translation files are registered under `contributes.translations` as
-// { locale, path } entries (see packages/spec/src/kernel/manifest.zod.ts).
-const manifest = {
-  id: 'com.mycompany.crm',
-  name: '@mycompany/crm',
-  version: '1.0.0',
-
-  contributes: {
-    translations: [
-      { locale: 'en', path: 'i18n/en/account.json' },
-      { locale: 'de', path: 'i18n/de/account.json' },
-    ],
+// src/translations/crm.translation.ts
+import { defineTranslationBundle } from '@objectstack/spec/system';
+
+export const CrmTranslationBundle = defineTranslationBundle({
+  en: {
+    objects: {
+      crm_account: {
+        label: 'Account',
+        pluralLabel: 'Accounts',
+        fields: {
+          name: { label: 'Account Name' },
+        },
+      },
+    },
   },
-};
-
-export default manifest;
+  de: {
+    objects: {
+      crm_account: {
+        label: 'Konto',
+        pluralLabel: 'Konten',
+        fields: {
+          name: { label: 'Kontoname' },
+        },
+      },
+    },
+  },
+});
 ```
 
-### Translation File Registration
+```typescript
+// objectstack.config.ts
+import { defineStack } from '@objectstack/spec';
+import { CrmTranslationBundle } from './src/translations/crm.translation.js';
 
-```
-@mycompany/crm/
-  i18n/
-    en/
-      account.json        → Namespace: crm.account
-      contact.json        → Namespace: crm.contact
-    de/
-      account.json
-      contact.json
+export default defineStack({
+  manifest: {
+    id: 'com.mycompany.crm',
+    version: '1.0.0',
+    type: 'app',
+    name: 'CRM',
+  },
+  translations: [CrmTranslationBundle],
+});
 ```
 
-**Namespace Convention:** `{pluginName}.{filename}`
+The engine registers the collection as `translation` metadata (the governed
+`translation` type), and the i18n pipeline serves it.
 
 ### Using Plugin Translations
 

content/docs/references/api/contract.mdx

@@ -27,7 +27,7 @@ const result = ApiErrorSchema.parse(data);
 
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
-| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +285 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
+| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +287 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
 | **declaredCode** | `string` | optional | The producer-declared code, verbatim, when it is not a member of the closed `code` vocabulary — the open, author-authored channel (app-specific spellings; ADR-0112, #9106) |
 | **message** | `string` | ✅ | Readable error message |
 | **userMessage** | `string` | optional | Producer-marked user-facing refusal text, verbatim (#9934). Present exactly when the producer opted in at throw time; consumers render it to end users and keep their generic substitution (#3821) for anything unmarked. Status-agnostic; never replaces `message`. |
@@ -140,6 +140,7 @@ const result = ApiErrorSchema.parse(data);
 * `DRIVER_UNAVAILABLE`
 * `DUPLICATE_REQUEST`
 * `ELIGIBILITY_UNEVALUABLE`
+* `EMAIL_DOMAIN_NOT_ALLOWED`
 * `EMAIL_SEND_FAILED`
 * `EMAIL_SERVICE_REQUIRED`
 * `ENQUEUE_FAILED`
@@ -288,6 +289,7 @@ const result = ApiErrorSchema.parse(data);
 * `SAML_REGISTER_FAILED`
 * `SCHEDULES_LIST_FAILED`
 * `SCHEDULE_DELETE_FAILED`
+* `SELF_REGISTRATION_CLOSED`
 * `SETTINGS_ACTION_FAILED`
 * `SETTINGS_CRYPTO_UNAVAILABLE`
 * `SETTINGS_ENGINE_NOT_BOUND`

content/docs/references/api/error-code-ledger.mdx

@@ -244,6 +244,7 @@ const result = ErrorCode.parse(data);
 * `DRIVER_UNAVAILABLE`
 * `DUPLICATE_REQUEST`
 * `ELIGIBILITY_UNEVALUABLE`
+* `EMAIL_DOMAIN_NOT_ALLOWED`
 * `EMAIL_SEND_FAILED`
 * `EMAIL_SERVICE_REQUIRED`
 * `ENQUEUE_FAILED`
@@ -392,6 +393,7 @@ const result = ErrorCode.parse(data);
 * `SAML_REGISTER_FAILED`
 * `SCHEDULES_LIST_FAILED`
 * `SCHEDULE_DELETE_FAILED`
+* `SELF_REGISTRATION_CLOSED`
 * `SETTINGS_ACTION_FAILED`
 * `SETTINGS_CRYPTO_UNAVAILABLE`
 * `SETTINGS_ENGINE_NOT_BOUND`

content/docs/references/index.mdx

@@ -1,6 +1,6 @@
 ---
 title: Protocol Reference
-description: Every schema published by @objectstack/spec — 1582 schemas across 14 protocol modules
+description: Every schema published by @objectstack/spec — 1583 schemas across 14 protocol modules
 ---
 
 {/* ⚠️  AUTO-GENERATED — DO NOT EDIT. Run build-docs.ts to regenerate. Hand-written docs live in the module folders under content/docs/. */}
@@ -31,9 +31,9 @@ counts are sums of the rows they head. Regenerate with
 | [Security Protocol](/docs/references/security) | 5 | 27 | Permission sets, row-level security, sharing rules, tenancy posture. |
 | [Shared Protocol](/docs/references/shared) | 8 | 31 | Primitives used across every protocol — identifiers, HTTP, expressions, error maps, enums. |
 | [Studio Protocol](/docs/references/studio) | 3 | 35 | Studio designer metadata — the authoring surfaces for the protocols above. |
-| [System Protocol](/docs/references/system) | 36 | 287 | The runtime environment — logging, jobs, cache, metrics, notifications, i18n and compliance. |
+| [System Protocol](/docs/references/system) | 36 | 288 | The runtime environment — logging, jobs, cache, metrics, notifications, i18n and compliance. |
 | [UI Protocol](/docs/references/ui) | 16 | 152 | Apps, pages, views, dashboards, reports, actions and themes — the ObjectUI layer. |
-| **Total** | **199** | **1582** | 14 protocol modules |
+| **Total** | **199** | **1583** | 14 protocol modules |
 
 ---
 
@@ -318,14 +318,14 @@ Studio designer metadata — the authoring surfaces for the protocols above.
 
 ## System Protocol
 
-**Source:** `packages/spec/src/system/` · **Import:** `@objectstack/spec/system` · **36 pages, 287 schemas**
+**Source:** `packages/spec/src/system/` · **Import:** `@objectstack/spec/system` · **36 pages, 288 schemas**
 
 The runtime environment — logging, jobs, cache, metrics, notifications, i18n and compliance.
 
 | File | Schemas |
 | :--- | :--- |
 | [`app-install.zod.ts`](/docs/references/system/app-install) | `AppCompatibilityCheck`, `AppInstallRequest`, `AppInstallResult`, `AppManifest` |
-| [`auth-config.zod.ts`](/docs/references/system/auth-config) | `AdvancedAuthConfig`, `AuthConfig`, `AuthPluginConfig`, `AuthProviderConfig`, `EmailAndPasswordConfig`, `EmailVerificationConfig`, `MutualTLSConfig`, `OidcProviderConfig`, `OidcProvidersConfig`, `SocialProviderConfig` |
+| [`auth-config.zod.ts`](/docs/references/system/auth-config) | `AdvancedAuthConfig`, `AudienceConfig`, `AuthConfig`, `AuthPluginConfig`, `AuthProviderConfig`, `EmailAndPasswordConfig`, `EmailVerificationConfig`, `MutualTLSConfig`, `OidcProviderConfig`, `OidcProvidersConfig`, `SocialProviderConfig` |
 | [`book.zod.ts`](/docs/references/system/book) | `Book`, `BookAudience`, `BookGroup`, `BookInclude`, `BookNode` |
 | [`cache.zod.ts`](/docs/references/system/cache) | `CacheAvalanchePrevention`, `CacheConfig`, `CacheConsistency`, `CacheInvalidation`, `CacheStrategy`, `CacheTier`, `CacheWarmup`, `DistributedCacheConfig` |
 | [`change-management.zod.ts`](/docs/references/system/change-management) | `ChangeImpact`, `ChangePriority`, `ChangeRequest`, `ChangeStatus`, `ChangeType`, `RollbackPlan` |

content/docs/references/kernel/manifest.mdx

@@ -40,7 +40,7 @@ const result = ManifestSchema.parse(data);
 | **datasources** | `string[]` | optional | Glob patterns for Datasource definitions |
 | **dependencies** | `Record<string, string>` | optional | Package dependencies |
 | **configuration** | `{ title?: string; properties: Record<string, object> }` | optional | Plugin configuration settings |
-| **contributes** | `{ kinds?: object[]; events?: string[]; menus?: Record<string, object[]>; themes?: object[]; … }` | optional | Platform contributions |
+| **contributes** | `{ kinds?: object[]; routes?: object[] }` | optional | Platform contributions |
 | **data** | `{ object: string; externalId?: string \| string[]; mode?: Enum<'insert' \| 'update' \| 'upsert' \| 'replace' \| 'ignore'>; env?: Enum<'prod' \| 'dev' \| 'test'>[]; … }[]` | optional | Initial seed data (prefer top-level data field) |
 | **capabilities** | `{ implements?: object[]; provides?: object[]; requires?: object[]; extensionPoints?: object[]; … }` | optional | Plugin capability declarations for interoperability |
 | **extensions** | `Record<string, any>` | optional | Extension points and contributions |