Merge remote-tracking branch 'origin/main' into claude/issue-16091-text-column-unbounded

Author: claude

.changeset/client-oauth-delete-zero-byte-200.md

@@ -0,0 +1,56 @@
+---
+"@objectstack/client": minor
+---
+
+fix(client)!: `oauth.applications.delete` resolves on the zero-byte 200 its route answers, instead of rejecting on every successful delete (#15451)
+
+**BREAKING** on two independent axes, and it makes a published method usable for the first time. Before this change `client.oauth.applications.delete(id)` **rejected on every successful delete** — there was no success path a caller could observe. It ships as `minor` under the lockstep launch-window convention (`scripts/check-changeset-no-major.mjs`); the version number is not the migration signal here, this entry is.
+
+<!-- adr-0087: registered client-oauth-applications-delete-void -->
+
+The fifth and last method of the `oauth.*` family, and the one #14312 / PR #15445 deliberately could not close: its ruling fenced that card to *narrowing published return types*, and no declared return type could be true while the `res.json()` call stood.
+
+## The defect, measured end to end
+
+Real `betterAuth` + real `@better-auth/oauth-provider` over the real ObjectQL adapter on real SQLite, a real signed-up user and a real session, driven through the **real** `ObjectStackClient` with only the socket stood in for:
+
+```
+POST /api/v1/auth/oauth2/delete-client  ->  200 · 0 bytes
+                                            content-type: application/json
+                                            content-length: (absent)
+through the client, BEFORE  ->  REJECTED: SyntaxError | Unexpected end of JSON input
+the row, server-side        ->  ALREADY GONE (get-client answers 404 not_found)
+through the client, AFTER   ->  RESOLVED | undefined
+```
+
+The handler returns nothing and the vendor declares the endpoint `void`. `res.json()` had nothing to parse, so the method rejected — *after* the delete had committed. A caller who did the obvious thing saw a failure, retried, and the retry failed **differently**, because the row no longer existed.
+
+## What changes for a caller
+
+| | before | now |
+|:--|:--|:--|
+| a successful delete | rejects `SyntaxError` | resolves |
+| the resolved value | `any` (unreachable — the promise never resolved) | `void` |
+| deleting a client that is not there | rejects `not_found` | rejects `not_found` — unchanged |
+| a malformed non-empty body | rejects `SyntaxError` | rejects `SyntaxError` — unchanged |
+
+⚠️ **The `catch` you wrote around this call stops firing on success.** Code shaped like
+
+```ts
+try { await client.oauth.applications.delete(id); }
+catch { /* the delete probably worked anyway */ }
+```
+
+still compiles and still runs, but its catch block was executing on **every** successful delete and now executes only on a real failure. Any workaround that lived in there is now inert and can be deleted. And because the promise never used to resolve, a read off its resolved value — `(await …delete(id)).deleted` — was dead code that has never executed; it now stops compiling (TS2339), which is the compiler delivering the change at the call site.
+
+## Why `void`, and not `{ deleted: boolean }`
+
+"Deleted" and "was already gone" **are** distinguished by the route, but on the error channel: a missing client answers 404 `{ error: 'not_found' }`, which the client already raises as a throw. The 200 answer carries zero bytes and therefore zero information, so a synthesised `{ deleted: true }` would be a shape the wire never sends and strictly less informative than the 404 a caller already receives.
+
+## Why the emptiness is detected by reading the body
+
+Both shortcuts were measured against the real route and both are unusable: the status is **200**, not the `204` five other delete surfaces in this client key off, and the response carries **no `content-length` header at all** — so a header test would never fire and would leave the defect in place while looking like a fix. The body itself is the only thing that answers.
+
+A non-empty body is still parsed and its failure still thrown, so **the only behaviour this change moves is the zero-byte case**: a malformed response stays loud, and the day this route grows a payload, surfacing it is a deliberate widening of the return type rather than a silent change of shape.
+
+`packages/client/exported-any-returns.json` loses this method's entry in the same change — the ledger is shrink-only, so the entry goes **with** the binding. Its last `oauth.*` entry is now gone; 35 sites remain open.

.changeset/delete-data-request-schema-provenance.md

@@ -0,0 +1,9 @@
+---
+"@objectstack/spec": patch
+---
+
+Record, on `DeleteDataRequestSchema` itself, what it is for and why the DELETE data door carries no `requestSchema` for it.
+
+The schema is the request contract of `DataProtocol.deleteData()`, consumed statically through the `DeleteDataRequest` type alias and parsed at runtime nowhere — a grep that finds "exported, documented, zero `safeParse` call sites" is reading the wrong surface, and had already filed it once as a gap. Its docblock now says so; records that the absence of a `requestSchema` on `DELETE /api/v1/data/:object/:id` is a pinned decision (#3899 — the catalog entry states it in place of the key, and `plugin-rest-api.schema-refs.test.ts` goes red if one is added, because the route reads no body); and points at the compile-time check (#15866) under which a field added to the schema as required reddens the door at build instead of being silently unsent.
+
+Documentation only: no shape, `.describe()` text, or export changes. `@objectstack/spec` ships the new text in its published type declarations and in the source file it publishes directly via its `src/**/*.zod.ts` entry.

.changeset/driver-sql-shadow-plain-unique-duplicates.md

@@ -0,0 +1,13 @@
+---
+"@objectstack/driver-sql": patch
+---
+
+MySQL: a plain unique index over existing duplicate rows no longer takes the boot down when the index has to be carried by a hash shadow.
+
+`syncDeclaredIndexes` handles a declared unique that the database refuses in one `catch`, and that `catch` has two arms: the DIRECT one, and the hash-shadow one MySQL takes when a key part is wider than the 768-char utf8mb4 ceiling. #14902 taught the direct arm that a uniqueness violation over existing rows is a durability degradation rather than a fatal — log it, name the conflicting rows and the remedy, let the boot continue. The shadow arm kept the older guard, which also required a NULL-safe organization key part, so a PLAIN unique (`tenancy: { enabled: false }`, or an explicit `unique: 'global'`) matched neither branch.
+
+Measured on live MySQL 8.0.46: the boot died carrying `ER_BLOB_KEY_WITHOUT_LENGTH` — a refusal about an unkeyable TEXT column, telling the operator to declare a `maxLength` the field already declared — while the real cause was two duplicate rows it never mentioned. It named no rows and no remedy.
+
+The two arms now agree, and they say different things because they mean different things. The NULL-safe arm keeps its wording (existing rows violate the NULL-safe key, duplicating what the previous void constraint admitted); the plain arm gets the direct arm's reviewed sentence, because neither of those clauses is true of a plain unique — nothing admitted the rows, and there is no NULL-safe key. Widening the guard alone would have shipped a factually false durability log, which is worse than the throw it replaces.
+
+`os migrate plan` already reported this operation as `destructive` with the row report and is unchanged.

.changeset/lint-collection-copies-guarded-readers.md

@@ -0,0 +1,29 @@
+---
+'@objectstack/lint': patch
+---
+
+Fix: a name-keyed `pages:` map no longer passes every source-page lint vacuously.
+
+`pages` has two authoring carriers — a list, or a map keyed by page name that
+`normalizeStackInput` folds into a list before the schema sees it. Four rules
+(`validate-jsx-pages`, `validate-page-source-styling`,
+`validate-react-page-props`, `validate-react-pages`) read the collection through
+a private coercion that answered a map with an empty list, and they run on the
+raw `os lint` path where nothing has normalized it yet. On a map-shaped stack
+all four therefore returned no findings by never walking a single page: an
+empty source, a syntax error, an unparseable component and a Tailwind
+`className` were all reported as clean. They now read `collectionEntries`,
+which handles both carriers, and a finding on the map carrier is located by the
+author's own key (`pages.home.source`) rather than a synthetic index.
+
+The same change removes the last sixteen private copies of the collection
+coercion in this package. Twelve rules — the `function` form, which had already
+grown the non-record filter locally in two different spellings — now read
+`recordsOf` from `object-graph.ts`. Two behaviour changes fall out, both on
+input that was already malformed: an array-typed member of `agents:` /
+`skills:` / `tools:` used to survive the looser local filter and draw one
+reference-integrity finding at a position nobody authored, and is now dropped;
+a member of a name-keyed `validations:` map whose value is not a record is now
+carried as `{ name }` rather than discarded, which reaches no check that reads
+it. No rule id, message or severity changes, and every finding path on the list
+carrier is unchanged.

.changeset/lint-field-no-consumers.md

@@ -0,0 +1,11 @@
+---
+"@objectstack/lint": minor
+---
+
+New advisory rule `field-no-consumers` (`validateFieldConsumers`): a field declared on an object that nothing in the stack reads or displays is reported as a `warning` by `os validate`, `os build` and `os lint`.
+
+Until now such a field was schema-valid and passed every platform check — the declaration was inert and nothing in the toolchain said so. The rule is object-aware (the same field name on two objects gets two verdicts, resolved against the object whose declaration encloses each reference), and it distinguishes consumers from carriers: a view column, form section, page binding, flow node, dataset dimension, widget filter, formula, validation, hook or action is a consumer; a translation label, a seed value, an import-mapping column, a field-level permission grant or a flow that only writes the field is a carrier and never counts. The finding carries the verdict (`carrier-only` with the carrier paths a removal must clean, or `inert`), the roots scanned, and — when the name is also declared elsewhere — the other objects, so a per-object verdict is never mistaken for a name-level one.
+
+Exempt, each derived from the spec rather than listed by hand: the registry-injected system columns an author re-declared, the record's title field (ADR-0079 `nameField` ladder), and `master_detail` fields (ADR-0035 — cascade delete, `controlled_by_parent` sharing and roll-ups read the relationship by declaration). A stack that declares no consumer root at all (objects only, or objects plus carriers) is not judged: its consumers live in another package. Test fixtures are never scanned.
+
+Public surface: `validateFieldConsumers`, `FIELD_NO_CONSUMERS`, `FIELD_CONSUMER_ROOTS`, `FIELD_CARRIER_ROOTS`, and the `FieldConsumerFinding` / `FieldConsumerVerdict` / `FieldConsumerSeverity` types.

.changeset/lint-label-case-localized-guard.md

@@ -0,0 +1,13 @@
+---
+"@objectstack/cli": minor
+---
+
+`os lint` no longer crashes on a localized label.
+
+`convention/label-case` indexed its argument (`label[0].toUpperCase()`) on a parameter annotated `string`, while every call site reaches it through `any`-typed config walking and the spec does not require a label to be a string: `I18nLabelSchema` is `z.union([z.string(), InlineLocaleMapSchema])`. On the map form `label[0]` is `undefined`, the rule threw a `TypeError`, and the throw escaped `lintConfig` into the command's catch-all — so an author who localized an app label or a list-view label could not lint the project at all. Every face exited 1 with `Cannot read properties of undefined (reading 'toUpperCase')`, naming no rule, no path and no remedy, on input `ObjectStackDefinitionSchema` parses clean.
+
+The rule now checks `typeof label === 'string'` first. Two of the four carriers it walks accept the inline locale map — `apps[].label` (`AppSchema`) and a view's `list` / `listViews.*` labels (`ListViewShapeSchema`); the other two are `z.string()` and reject the map at the schema door (`objects[].label`, `objects[].fields.*.label`).
+
+**Nothing about a plain string label moves.** Same warning, same message, same `fix`, same path, on all four carriers — that is pinned per carrier rather than asserted.
+
+**The rule deliberately says nothing about a localized label**, rather than resolving the map and case-checking one of its entries. Case is a property of a literal, and deciding which locale entry a case verdict is taken against is a product call, not a lint call. Widening the rule that way is a separate change.

.changeset/metadata-endpoints-switch-radius-maintenance-key.md

@@ -0,0 +1,105 @@
+---
+"@objectstack/spec": minor
+"@objectstack/rest": minor
+---
+
+feat(spec): every `metadata.endpoints.*` switch gates exactly the face its name states, and the whole-store operations get their own key `maintenance` (#15542, #15854)
+
+`RestServerConfig.metadata.endpoints` declared three switches, each `describe()` naming
+exactly one route, and each gated a different set. The mismatch ran in **both**
+directions at once:
+
+- **`items`** — declared "GET /meta/:type - List items of type" — also gated the
+  whole-store family: the cross-type spec-validation sweep `GET /meta/diagnostics`, the
+  draft list `GET /meta/_drafts`, and the **`POST /meta/_migrate-stored` write door**.
+  An operator who switched off a listing read they considered chatty silently unmounted
+  a migration door.
+- **`item`** — declared "GET /meta/:type/:name - Get specific item" — gated four
+  *reads* (`/:type/:name`, `/references`, `/layers`, `/book/:name/tree`) and left the
+  per-item **writes** `PUT` and `DELETE /meta/:type/:name` plus the whole history family
+  (`/history`, `/audit`, `/diff`, `/published`, `/publish`, `/rollback`) answering to
+  `api.enableMetadata` alone. An operator who closed the per-item surface left its
+  writes mounted.
+
+Neither is a liveness defect — all three keys were genuinely read — which is why no
+ADR-0049 census could ever flag them: what drifted was each key's **radius** against its
+own documentation.
+
+**One principle now holds across the block: a switch gates exactly the face its name
+states, reads and writes alike.**
+
+| key | mounts it gates (default prefix `/meta`) |
+|---|---|
+| `types` | `GET /meta`, `GET /meta/types` — one handler, two paths (unchanged) |
+| `items` | `GET /meta/:type` — and nothing else |
+| `item` | `GET` / `PUT` / `DELETE /meta/:type/:name`, `/references`, `/layers`, `/history`, `/audit`, `/diff`, `/published`, `/publish`, `/rollback`, and `GET /meta/book/:name/tree` |
+| `maintenance` | **new** — `GET /meta/diagnostics`, `GET /meta/_drafts`, `POST /meta/_migrate-stored` |
+
+All four `describe()` strings are rewritten to enumerate what they gate, so the
+generated reference page is the radius rather than a sample of it.
+`api.enableMetadata` remains the master switch above all four, and
+`GET /meta/object/:name/state/:field` — the object FSM read, addressed by object name
+rather than by `:type/:name` — deliberately stays under that master switch alone.
+
+**BREAKING** — for a programmatic embedder that authors `RestServerConfig.metadata.endpoints`,
+the mounted route table moves for two of the four keys, in opposite directions:
+
+- **`items: false` now removes one route instead of four.** An embedder relying on it to
+  close `/diagnostics`, `/_drafts` and the `POST /_migrate-stored` door **regains all
+  three** unless it also sets `maintenance: false`. That is a write door coming back, so
+  it is the half to read twice. One line restores the old table:
+  `endpoints: { items: false, maintenance: false }`.
+- **`item: false` now removes twelve routes instead of four.** An embedder relying on it
+  to close only the per-item *reads* while keeping `PUT`, `DELETE` and the history family
+  mounted **loses those eight**. There is no key that restores them — the per-item face is
+  one face by this ruling — so an embedder that wants the writes keeps `item` on and
+  closes the surface at `api.enableMetadata` or at the object's own `enable.apiMethods`.
+- **The exported type `MetadataEndpointsConfigParsed` narrows: `endpoints` gains a
+  REQUIRED member `maintenance: boolean`.** `maintenance` is `z.boolean().default(true)`,
+  so it is optional on the way *in* and always present on the way *out* — and
+  `MetadataEndpointsConfigParsed` is `z.infer<typeof MetadataEndpointsConfigSchema>`, the
+  OUTPUT side. Any code that builds one of these objects by hand — a test fixture, a
+  helper returning the parsed shape, a `satisfies MetadataEndpointsConfigParsed` literal —
+  stops compiling with `TS2741: Property 'maintenance' is missing`. This one IS
+  compiler-carried (the ADR-0087 D8 class), which is the good case: the break is loud, it
+  lands at build time, and no runtime behaviour depends on the author noticing a
+  changelog. Add `maintenance: true` to restore the previous mounts, or `false` to keep
+  the whole-store family closed. In-repo consumers of the type: none — the narrowing was
+  measured against a probe compiled from the rebuilt declaration, not assumed.
+
+Priced and accepted rather than deferred: `RestServerConfig` is reachable from **no
+shipped boot path** today (`os serve` fixes the config and the dev plugin passes none,
+#15543), so the measured population of affected authors is **zero** and the blast radius
+is programmatic embedders only. That is precisely why this lands now — once a boot path
+starts authoring the config, the same change becomes a behaviour change on live
+operators.
+
+**ADR-0087 disposition: a D3 semantic migration, no D2 conversion.** No
+authored key changes shape or spelling — `items: false` still parses to `items: false`,
+`maintenance` is additive with `.default(true)`, and nothing is retired (`endpoints.schema`
+stays the #14691 tombstone it already was). There is nothing for the conversion layer to
+convert: a `RestServerConfig` is plugin TS configuration, never a stack collection member
+and never a `sys_metadata` row (the `RestServerConfig.openApi31` precedent, #4579), so no
+rehydration seam sees it. What changes is a mounted route table at construction time.
+
+Nor is the RADIUS change compiler-carried on the AUTHORED side — and that is the half a
+D3 is owed for. Every authored key is an optional boolean, so `{ items: false }` still
+compiles and still parses and simply mounts a different table: the author is told
+nothing. (The parsed-type narrowing in the third BREAKING bullet above *is*
+compiler-carried, but it catches only code that hand-builds the OUTPUT type — it cannot
+reach the embedder who authored `{ items: false }` and now silently gets three routes
+back.) So for the change that actually moves the route table, both channels that would
+otherwise reach a consumer are blind, which is precisely the residue D3 exists for — the prescription is registered as
+`metadata-endpoints-switch-radius-repartitioned` so `objectstack migrate meta` hands
+it to an upgrading embedder instead of leaving it as prose in a changelog.
+
+<!-- adr-0087: registered metadata-endpoints-switch-radius-repartitioned -->
+
+`@objectstack/rest` is versioned alongside rather than as a passive consumer: it is where
+the gates live, so the route-table change is observable there and not only in the
+declaration.
+
+Every key's radius is pinned route by route, in both directions, in
+`packages/rest/src/rest-config-mount-table.pin.test.ts` — the #15544 shape, which asserts
+each route is **absent from the mounted table** when its switch is off rather than what
+the switch normalizes to. A gate that grows or loses a route reddens there.