Merge remote-tracking branch 'origin/main' into claude/issue-21445-object-grid-typed-members

Author: claude

.changeset/20871-page-requires-live.md

@@ -0,0 +1,14 @@
+---
+'@objectstack/spec': patch
+'@objectstack/lint': patch
+---
+
+`page.requires` says what the runtime now does with it: refused at save, reported at load (ADR-0080 §5).
+
+Clause-②: no
+
+The key's description used to say the list is "validated at save and load" while the liveness ledger recorded it as not enforced yet. Both are now true and say so. On a server that has the deployment's SDUI component manifest, saving a `kind: 'html'` page compiles its source, refuses a written `requires` that disagrees with it (`422 INVALID_METADATA`, `page-requires-disagrees-with-source`; a draft at its publish) and stores the derived list. At load, a stored page whose list names a plugin no manifest component carries is reported and still served. A server with no manifest checks neither and says so once at boot. Omit `requires`: it is derived from the source. The liveness row moves from `planned` to `live`, and the generated page reference carries the new description.
+
+`validateJsxPages`' reason for staying off the runtime publish gate no longer says it parses through `typescript`/`sucrase`. It parses with the dependency-free `@objectstack/sdui-parser`, and it stays CLI-only because the save door already runs that compiler on every html page. The `ui-html-page-div-refused` upgrade-guide entry now names that save door too: on a server with a manifest, a `div` page saved from Studio or through the metadata API is refused under the same rule ids.
+
+No schema accepts or refuses anything it did not before, and no runtime behaviour changes.

.changeset/21000-analytics-metric-type-verdict.md

@@ -0,0 +1,45 @@
+---
+'@objectstack/service-analytics': minor
+---
+
+fix(service-analytics)!: both analytics strategies refuse a cube measure whose `type` names no aggregate, in the spec's words — the custom-SQL `EXPRESSION_METRIC_TYPES` partition is gone with the three types it named (#21000)
+
+**BREAKING** — `@objectstack/spec` retired the cube metric types `number`, `string`
+and `boolean` from `AggregationMetricType` (a measure's `sql` is a column reference,
+so they had nothing left to compute). Every door that parses a cube refuses them;
+this release removes the runtime branches that still served them for a cube that
+reached the analytics service WITHOUT meeting that parse — one a host registers
+in-process from a literal, through `AnalyticsServicePlugin({ cubes })` or
+`AnalyticsService({ cubes })` (the registry never parses).
+
+| | before | now |
+| --- | --- | --- |
+| `NativeSQLStrategy`, a measure typed `number` / `string` / `boolean` | served: the column emitted UNAGGREGATED in the statement (`amount AS "m"` beside `GROUP BY`) | refused, nothing executed |
+| `ObjectQLStrategy`, the same measure | refused `INVALID_FIELD` / 400 | refused, nothing executed |
+| either strategy, a type the spec never declared (`median`) | native: refused; ObjectQL: forwarded to `executeAggregate` as the method (the auto-bridge refused it; a host's own executor received it), and `/analytics/sql` echoed `MEDIAN(amount)` | refused, nothing executed |
+
+**The one refusal** is `aggregateOfMeasure`'s, shared by both strategies and both
+doors (`POST /analytics/query` and `POST /analytics/sql`): it names the measure and
+the cube, then quotes the spec's own verdict on the type — for a retired type the
+retirement prescription (the six aggregates to choose from, and where a per-row or
+derived value goes instead), for anything else zod's message listing the six. It is
+a bare `Error`, the undeclared-500 tier this package assigns to a cube that never
+met the parse, so the HTTP answer is `500` with the message readable in the body
+(measured through the dispatcher's analytics route), never a caller-blaming `400`.
+The ObjectQL envelope for the three retired types therefore moves from
+`INVALID_FIELD` / 400 to that tier.
+
+**The fix:** give the measure one of the six aggregate types — `count`, `sum`,
+`avg`, `min`, `max`, `count_distinct` — or parse the cube through `CubeSchema`
+before registering it, which refuses the same types with the same prescription.
+
+**Removed export:** `EXPRESSION_METRIC_TYPES` from
+`strategies/native-sql-strategy.ts` (internal to the package; not re-exported from
+its entry point). **Unchanged:** every aggregate measure on both strategies, the
+auto-bridge's own parse of an engine method (still pinned, driven directly), and
+`GET /analytics/meta`, which keeps publishing each registered measure's `type` as
+registered.
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: registered cube-metric-expression-types-retired -->

.changeset/21000-cube-metric-expression-types-retired.md

@@ -0,0 +1,69 @@
+---
+'@objectstack/spec': minor
+---
+
+feat(spec)!: retire the cube metric types `number`, `string` and `boolean` — a measure's `sql` is a column reference, so the custom-SQL-expression types had nothing left to compute (#21000)
+
+**BREAKING** — three members leave `AggregationMetricType`, so a cube measure's
+`measures.<metric>.type` no longer accepts `number`, `string` or `boolean`. ADR-0049
+enforce-or-remove. They declared "a custom SQL expression returning a number /
+string / boolean": the measure's `sql` was the whole computation. A cube member's
+`sql` is a column reference since `cube-member-sql-expression-retired` (#20943), so
+the three were left naming nothing: measured before this change, the raw-SQL
+analytics path returned the referenced column UNAGGREGATED (a bare column in a
+grouped statement — by SQL's own rules an error on PostgreSQL and an arbitrary row's
+value on SQLite), and the ObjectQL path refused the measure. The six aggregates — `count`, `sum`,
+`avg`, `min`, `max`, `count_distinct` — are unchanged and are now the whole
+vocabulary.
+
+### FROM → TO
+
+| removed | what to write instead |
+| --- | --- |
+| `measures.<metric>.type: 'number'`, `'string'` or `'boolean'` | the aggregate the measure means: `sum`, `avg`, `min` or `max` over the column; `count` (over `'*'` for a row count, or over a column for its non-null values); or `count_distinct`. |
+| a measure whose old expression computed a value per row | keep that value as a field of the object (a stored or formula field) and aggregate the field. |
+| a measure whose old expression combined measures (a ratio, a difference) | `derived: { op, of: [...] }` on an ADR-0021 dataset over the same object. |
+
+**The one-line fix: give the measure an aggregate type.** There is no mechanical
+rewrite — the column alone does not say whether `amount` meant its sum, its average
+or its largest value — so `os migrate meta` lists nothing for this change.
+
+Each retired member is refused at parse with a prescription naming the six
+aggregates, at the measure's `type`, and in `tsc` (the members are gone from the
+`AggregationMetricType` type). A value the enum never declared keeps zod's own
+message.
+
+### The retirement kit
+
+- **Value-level retirement.** `AggregationMetricType` is declared through
+  `enumWithRetiredValues` (`shared/retired-key.ts`), with the prescriptions
+  module-private. No authorable KEY and no def changed, so nothing lands in
+  `RETIRED_KEYS_BY_MAJOR`, and the four surface ratchets (`api-surface`,
+  `authorable-surface`, `json-schema.manifest`, `api-surface-signatures`) are
+  byte-identical.
+- **No D2 conversion, by design.** A stored or built cube that still carries one of
+  the three is REFUSED, never rewritten or dropped: the boot door
+  (`ObjectStackDefinitionSchema`, which a built artifact is parsed through), the
+  `analytics_cube` write door and `defineStack` refuse it with the prescription, and
+  the rehydration seam replays no conversion over it.
+- **D3 entry `cube-metric-expression-types-retired`**, with its step-18 rationale
+  fragment, carries the judgement the upgrader owes: which aggregate each measure
+  meant.
+- **Liveness.** The `analytics_cube` row `measures.type` stays `live`, re-verified
+  2026-10-02, with the narrowing recorded.
+- **Docs.** The `data/analytics` reference page is regenerated.
+- **No deprecation window**, per the project's startup-stage posture.
+
+### Reach, measured
+
+- This repository authors no cube measure of the three types outside tests:
+  `examples/**`, `packages/**` (the platform objects included) and the skills and
+  docs carry none. The showcase cube's `type: 'string'` entries are dimensions,
+  whose `DimensionType` is a separate enum and is unchanged.
+- objectui at its pinned commit carries no `AggregationMetricType` mirror and no
+  cube measure of the three types.
+- Out-of-repo authored cubes: NOT MEASURED.
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: registered cube-metric-expression-types-retired -->

.changeset/21135-liveness-readme-author-warnings.md

@@ -0,0 +1,15 @@
+---
+"@objectstack/spec": patch
+---
+
+Liveness ledger README: the "Author warnings" section now describes the model the liveness lint ships. A `dead`, `live-elsewhere` or `experimental` verdict warns on its own, and `authorWarn` only opts a `planned` row in.
+
+Clause-②: no
+
+- The section said warnings were opt-in per ledger row, and that only `experimental` warned without the marker. That stopped being true when the lint made a `dead` or `live-elsewhere` verdict warn on its own. The section now has one table of which verdicts warn, and under which rule id.
+- `authorHint` no longer "falls back to `note`". Every warning shows the row's `authorHint`, or else the verdict's default hint. The `note` never reaches an author.
+- Rule 1 now talks about the verdict, not the marker. Grading a row `dead`, `live-elsewhere` or `experimental` warns every author who sets the key, and fails their `os lint --strict` / `os validate --strict` run. No marker keeps it quiet, so a benign display key is measured against the designer-previews ruling before it is graded `dead`.
+- Rule 2 (booleans) now covers any key whose schema default materializes. It no longer points at an `_authorWarnSkipped` marker, which no ledger carries.
+- The coverage paragraph states the walk's real reach: the types it visits, one level of `children`, and that a governed type it does not visit warns no author through this lint.
+- Two sentences elsewhere in the README said a `dead` row needs `authorWarn` to warn. Both are corrected the same way.
+- ⛔ Documentation only: no ledger row, schema, export or lint behaviour changes.

.changeset/21207-keyed-served-content-hash.md

@@ -0,0 +1,24 @@
+---
+'@objectstack/metadata-protocol': minor
+'@objectstack/objectql': minor
+'@objectstack/mcp': minor
+'@objectstack/plugin-audit': minor
+'@objectstack/service-analytics': minor
+'@objectstack/cli': minor
+---
+
+fix(metadata-protocol)!: a metadata body's stored content hash is served and compared only in keyed form, never copied, and never evaluated (#21207)
+
+Clause-②: yes (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) the stored content hash of a metadata body stays the canonical hash at rest and no metadata body, authorable key, spelling or export moves; what changes is the form a door serves the hash in (a keyed digest: the crypto provider's, or a process-scoped ephemeral key's when none is registered), the form an inbound version token is compared in, and which query shapes the doors accept over the two hash columns, so `objectstack migrate meta` has nothing to rewrite. The operator-run rewrite this release asks for is of audit, activity and decision-audit copies, not of metadata. The other categories are closed on facts: every package here publishes (not `unpublished`); no ADR-0087 id covers a served version token or a refused query shape (not `registered` / `already-registered`); and the change is runtime behaviour, not a declaration (not `runtime-interface-only` / `type-surface-only`). -->
+
+**BREAKING**: this narrows what the metadata doors serve and accept for the stored content hash of a metadata body — a hash over the whole stored body, withheld credential material included. Served beside the projected body it let a reader confirm a guess at that material offline; filtered on, it confirmed one online. It ships as `minor` under the launch-window convention for accept-set narrowings.
+
+**Three things change for callers and operators.**
+
+1. **A held version token gets one `409 METADATA_CONFLICT`.** Every door that hands out a metadata version token — the save, publish, package-publish and rollback receipts and the history read — now hands out a keyed digest of the stored hash instead of the hash itself, and the save and reset doors compare a token they are sent in that same form. The key is the crypto provider's; a host that registers none keys under a process-scoped ephemeral key instead, so a token is always issued and never empty. A token a client held from before the upgrade is refused once; take the token from the next read or receipt and retry. On a host with no provider the same happens after a restart, and on any host when a provider is first registered. An empty, withheld, raw or stale token is refused with the same `409`; it is never read as "no pin".
+2. **Filter, sort and group on the two stored content-hash columns, and on the version history's change note, now answer `400 INVALID_FIELD`** — on the generic data door, the MCP stdio reader and the analytics door, before the engine runs. The change note is included because a draft promotion that stated no message of its own recorded the draft's stored hash in it; the publish door now always states a hash-free message, and a note written before this release is served with the quoted hash in keyed form. A data-door search over the two stored-metadata tables no longer scans those columns or the stored body column, and an explicit search-field list naming one answers the same `400`. Every other column of the two tables is served, filtered, sorted and grouped as before, and every other object is unchanged.
+3. **Operators run `os migrate audit-metadata-bodies` once after upgrading, dry run first.** The audit ledger, the activity feed and the metadata decision-audit trail no longer copy the stored hash. The extended command drops it from the copies already written and withholds it in the decision-audit notes and their copies: a dry run by default, `--apply` to rewrite, idempotent. The version history stays the lineage.
+
+**What else changes.** The data door serves the two hash columns of the stored-metadata tables in keyed form, under the same key as the version tokens. The MCP stdio reader serves them keyed under the crypto provider's key, and omits them on a host with no provider. A `409` conflict refusal carries keyed values or none. The ObjectQL engine gains a read accessor for the registered provider's keyed digest; it is additive. A member's read of these tables is refused as before.

.changeset/21276-package-delete-store-refusal.md

@@ -0,0 +1,19 @@
+---
+'@objectstack/metadata-protocol': patch
+'@objectstack/runtime': patch
+'@objectstack/objectql': patch
+---
+
+fix: when the store refuses an uninstall's `sys_packages` delete, the uninstall now answers the failure and removes nothing else, instead of answering success and coming back after the next restart (#21276)
+
+Clause-②: no
+
+**`@objectstack/metadata-protocol`.** `deletePackage` now deletes the package's `sys_packages` row first, before its `sys_metadata` rows, its tables, its registry entry and the rows the uninstall cleanups own. When the `package` service refuses that delete, whether it returns `{ success: false }` or throws, `deletePackage` throws and nothing else is removed. A store fault answers `500`, with `DATABASE_ERROR` from a live SQL driver and `INTERNAL_ERROR` otherwise. A declared 4xx refusal is passed through unchanged. Before this, the refusal was logged as a warning, and `DELETE /api/v1/packages/:id` answered `200` after the package's metadata, tables and grants had been removed. The package then came back after the next restart.
+
+Before that store delete, `deletePackage` now also asks the registry whether the uninstall would be refused because another package extends an object this package owns (ADR-0029). If so, it throws the registry's own refusal with nothing removed. A registry without the new question is not asked, and the refusal then surfaces at the registry withdrawal, as before.
+
+**`@objectstack/objectql`.** New: `SchemaRegistry.assertPackageUninstallable(packageId)`. It throws the refusal `unregisterObjectsByPackage` and `uninstallPackage` raise for an object another package extends, with the same message, and it changes nothing. `unregisterObjectsByPackage` now calls it, so there is still one copy of that check.
+
+**`@objectstack/runtime`.** `DELETE /api/v1/packages/:id` now asks `deletePackage` before it touches anything. It checks that the package exists with a read, and it withdraws the package from the running registry and clears its saved disable record only after `deletePackage` has answered. So when the store refuses, the door answers `500`, the same process keeps serving the package, and a package that was disabled stays disabled after a restart. Before this, the door withdrew the package and cleared its disable record first. A refused delete then left the package missing until a restart, and brought a disabled package back enabled.
+
+An uninstall refused because another package extends an object this package owns still answers `500` with nothing changed: the stored rows, the registry entry and the disable record all stay as they were, in the same process and after a restart. That refusal is now decided before the store delete, instead of by the door withdrawing the package first. An ordinary uninstall, and a host with no `package` service, are unchanged.