fix(spec): reconcile the api and platform skill indexes with what their bodies teach (#15424)

* fix(spec): reconcile the api and platform skill indexes with what their bodies teach

`SKILL_MAP['objectstack-api']` advertised `api/rest-server.zod.ts`, which the
skill's authored markdown never teaches: nothing there names the file,
`RestServerConfig` or any of its sub-configs, or the words "rest server", while
every other core entry is reachable from the body by at least one exported name.
An index entry is a POINTER, so that row sent an agent into `node_modules` for a
lesson that does not exist. The schema keeps existing and stays importable.

The other direction, same rule: `SKILL_MAP['objectstack-platform']` had no
pointer to `stack.zod.ts`, the file declaring the body's main subject — it
teaches `defineStack()` and names `ObjectStackDefinitionSchema`,
`ObjectStackDefinition`, `ObjectStackDefinitionInput` and `ObjectStack` in its
own prose.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019RfFHiRCSs3JXLK4cwcfox

* fix(spec): constrain the platform skill index to the closure its body teaches

`objectstack-platform` declared no `TRANSITIVE_ALLOWLIST`, so its index
published the whole import closure of its core entries — 73 transitive pointers
once `stack.zod.ts` joined the map. Most of them are shapes the SKILL.md never
teaches, and two are shapes the platform retired from its surface, so the
catalogue routed an authoring agent at lessons the body cannot give.

Declare the list, populated by one mechanical rule and nothing else: a closure
member stays only if `skills/objectstack-platform/SKILL.md` names one of that
module's exported names, as an exact word-bounded identifier. Five of the 73
survive. The retired shapes fall out by the rule, not by hand.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019RfFHiRCSs3JXLK4cwcfox

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

packages/spec/scripts/build-skill-references.ts

@@ -125,7 +125,13 @@ const SKILL_MAP: Record<string, string[]> = {
     'api/endpoint.zod.ts',
     'api/auth.zod.ts',
     'api/realtime.zod.ts',
-    'api/rest-server.zod.ts',
+    // `api/rest-server.zod.ts` left this list: the SKILL.md never teaches it.
+    // Nothing in the skill's authored markdown names the file, `RestServerConfig`
+    // or any of its sub-configs, or the words "rest server", while every other
+    // core entry here is reachable from the body by at least one exported name.
+    // An index entry is a POINTER, and pointing at a schema the body cannot help
+    // with sends an agent into `node_modules` for a lesson that does not exist.
+    // The schema keeps existing and stays importable; only the false promise goes.
     'api/websocket.zod.ts',
     'api/errors.zod.ts',
     'api/batch.zod.ts',
@@ -169,6 +175,12 @@ const SKILL_MAP: Record<string, string[]> = {
   ],
   'objectstack-platform': [
     // project setup (was objectstack-quickstart)
+    // The body's main subject: it teaches `defineStack()` and names
+    // `ObjectStackDefinitionSchema`, `ObjectStackDefinition`,
+    // `ObjectStackDefinitionInput` and `ObjectStack` in its own prose, while the
+    // catalog had no pointer to the file that declares them. Taught, never
+    // advertised -- the other direction of the same rule.
+    'stack.zod.ts',
     'kernel/manifest.zod.ts',
     'data/datasource.zod.ts',
     'data/seed.zod.ts',

packages/spec/scripts/lib/skill-map-guards.ts

@@ -231,6 +231,15 @@ export function checkSingleOwner(map: SkillCoreMap, shared: Record<string, strin
  * whose face someone has actually read should carry one.
  */
 export const TRANSITIVE_ALLOWLIST: Record<string, readonly string[]> = {
+  // Kept iff `skills/objectstack-platform/SKILL.md` names one of the module's
+  // exported names, as an exact word-bounded identifier.
+  'objectstack-platform': [
+    'data/field.zod.ts',
+    'data/hook.zod.ts',
+    'data/object.zod.ts',
+    'security/rls.zod.ts',
+    'ui/app.zod.ts',
+  ],
   // Everything else the closure reaches here is `strictObject()`'s error-message
   // machinery and what that drags behind it -- the Unified Query DSL among them,
   // a different skill's whole subject, shipped into every i18n session with an

skills/objectstack-api/references/_index.md

@@ -14,7 +14,6 @@ from `node_modules` — there is no local copy in the skill bundle.
 - `node_modules/@objectstack/spec/src/api/endpoint.zod.ts` — Exports: ApiMappingSchema, ApiEndpointSchema, ApiEndpoint
 - `node_modules/@objectstack/spec/src/api/errors.zod.ts` — Standardized Error Codes Protocol
 - `node_modules/@objectstack/spec/src/api/realtime.zod.ts` — Exports: TransportProtocol, RealtimeEventType, SubscriptionEventSchema, SubscriptionSchema, RealtimePresenceSchema
-- `node_modules/@objectstack/spec/src/api/rest-server.zod.ts` — REST API Server Protocol
 - `node_modules/@objectstack/spec/src/api/versioning.zod.ts` — API Versioning Protocol
 - `node_modules/@objectstack/spec/src/api/websocket.zod.ts` — WebSocket Event Protocol
 

skills/objectstack-platform/references/_index.md

@@ -18,36 +18,15 @@ from `node_modules` — there is no local copy in the skill bundle.
 - `node_modules/@objectstack/spec/src/kernel/plugin-loading.zod.ts` — Plugin Loading Protocol
 - `node_modules/@objectstack/spec/src/kernel/plugin.zod.ts` — Exports: PluginContextSchema, PluginSchema
 - `node_modules/@objectstack/spec/src/kernel/service-registry.zod.ts` — Service Registry Protocol
+- `node_modules/@objectstack/spec/src/stack.zod.ts` — Exports: DatasourceMappingRuleSchema, ArtifactPackageEntrySchema, AssembledPackageBodySchema, ArtifactPackageSchema, ObjectStackDefinitionSchema
 
 ## Transitive dependencies
 
-- `node_modules/@objectstack/spec/src/api/errors.zod.ts` — Standardized Error Codes Protocol
-- `node_modules/@objectstack/spec/src/data/driver/common.zod.ts` — Shared building blocks for the per-driver `datasource.config` shapes.
-- `node_modules/@objectstack/spec/src/data/driver/config-registry.zod.ts` — The driver-id → `datasource.config` shape registry.
-- `node_modules/@objectstack/spec/src/data/driver/memory.zod.ts` — Memory Driver Configuration Schema
-- `node_modules/@objectstack/spec/src/data/driver/mongo.zod.ts` — MongoDB Standard Driver Protocol
-- `node_modules/@objectstack/spec/src/data/driver/mysql.zod.ts` — MySQL / MariaDB driver configuration — the `config` slot of a `datasource`
-- `node_modules/@objectstack/spec/src/data/driver/postgres.zod.ts` — PostgreSQL driver configuration — the `config` slot of a `datasource` whose
-- `node_modules/@objectstack/spec/src/data/driver/sqlite.zod.ts` — SQLite driver configuration — the `config` slot of a `datasource` whose
-- `node_modules/@objectstack/spec/src/data/driver/turso.zod.ts` — Turso / libSQL Driver Protocol.
-- `node_modules/@objectstack/spec/src/data/field-value.zod.ts` — Field runtime VALUE-shape contract (ADR-0104 D1).
 - `node_modules/@objectstack/spec/src/data/field.zod.ts` — Exports: FieldType, SelectOptionSchema, LocationCoordinatesSchema, CurrencyConfigSchema, CurrencyValueSchema
-- `node_modules/@objectstack/spec/src/data/filter.zod.ts` — Unified Query DSL Specification
-- `node_modules/@objectstack/spec/src/data/hook-body.zod.ts` — Exports: HookBodyCapability, ExpressionBodySchema, ScriptBodySchema, HookBodySchema
-- `node_modules/@objectstack/spec/src/kernel/cluster.zod.ts` — Cluster Protocol
-- `node_modules/@objectstack/spec/src/kernel/metadata-loader.zod.ts` — Metadata Manager Configuration
-- `node_modules/@objectstack/spec/src/kernel/metadata-protection.zod.ts` — Metadata Protection Model — Phase 1 (ADR-0010)
-- `node_modules/@objectstack/spec/src/shared/expression.zod.ts` — Expression Protocol
-- `node_modules/@objectstack/spec/src/shared/identifiers.zod.ts` — Exports: SystemIdentifierSchema, SnakeCaseIdentifierSchema, MetadataItemNameSchema
-- `node_modules/@objectstack/spec/src/shared/metadata-types.zod.ts` — Exports: MetadataFormatSchema, BaseMetadataRecordSchema
-- `node_modules/@objectstack/spec/src/shared/protection.zod.ts` — Package-level metadata protection (ADR-0010 §3.7 — Phase 4.3)
-- `node_modules/@objectstack/spec/src/shared/suggestions.zod.ts` — "Did you mean?" Suggestion Utilities
-- `node_modules/@objectstack/spec/src/shared/value-domain.zod.ts` — Standard value domains: one closed vocabulary and one membership predicate for settings and fields.
-- `node_modules/@objectstack/spec/src/system/tenant.zod.ts` — Tenant Schema (Multi-Tenant Architecture)
-- `node_modules/@objectstack/spec/src/ui/action-params.zod.ts` — The action DISPATCH contract: what the platform validates on the way in, and
-- `node_modules/@objectstack/spec/src/ui/action.zod.ts` — Exports: ActionParamSchema, ActionType, ActionLocationSchema, ActionAiSchema, ActionSchema
+- `node_modules/@objectstack/spec/src/data/hook.zod.ts` — Exports: HookEvent, HookSchema, HookContextSchema
+- `node_modules/@objectstack/spec/src/data/object.zod.ts` — Exports: ApiMethod, ApiOperationSchema, ObjectCapabilities, IndexSchema, TenancyConfigSchema
+- `node_modules/@objectstack/spec/src/security/rls.zod.ts` — Row-Level Security (RLS) Protocol
 - `node_modules/@objectstack/spec/src/ui/app.zod.ts` — Exports: ObjectNavItemSchema, DashboardNavItemSchema, PageNavItemSchema, UrlNavItemSchema, ReportNavItemSchema
-- `node_modules/@objectstack/spec/src/ui/i18n.zod.ts` — Display-label and ARIA-label primitives shared by every `ui/` shape.
 
 ## How to read these