Merge remote-tracking branch 'origin/main' into claude/issue-20574-conversions-merge-clean

Author: claude

.changeset/20305-inline-row-filter-converts.md

@@ -0,0 +1,21 @@
+---
+'@objectstack/spec': minor
+---
+
+feat(spec): the stored-filter conversion rewrites a filter on a block whose rows are inline, as it does on any other block
+
+The ADR-0087 D2 conversion `page-component-filter-record-to-rule-array` no longer leaves every filter of a page component whose rows are inline (`data: { provider: 'value', … }`, a `data` array, or `staticData`) as stored. Such a filter, the binding's `dataSource.filter` included, is now rewritten to the `[{ field, operator, value }, ...]` rule array exactly as it is on a block that queries an object. What still stays as stored, and is still reported as a TODO, is only a filter with a part that has no lossless rule spelling: a combinator, a null value, or an operator the rule vocabulary does not spell. That holds on any block.
+
+Why the conversion declined, and why it no longer needs to: the `object-map`, `object-tree`, `object-calendar` and `object-gantt` blocks match that filter against their own rows in objectui's in-memory data source (`ValueDataSource.find`). The conversion was written against an objectui version whose `find` excluded every row for a rule array, so it left those filters alone and said so in the TODO. The objectui version this repository pins (`.objectui-sha`, the same pin the previous release shipped) lowers a rule array before it matches, and it selects the rows the stored form selected. That was measured over every operator the conversion maps: 114 filters on eight rows, null and missing values included. The same filters select no row on the objectui build just before that fix. So the decline was already protecting nothing: it only left convertible filters unconverted and reported TODOs that no longer needed to exist.
+
+What an operator sees:
+
+- `os migrate meta --stored` now lists such a page as a pending rewrite. It used to list it as a `skipped` row with a TODO. A preview over a database whose only legacy filters sat on inline-row blocks therefore exits 1 until `os migrate meta --stored --apply` rewrites them.
+- Until then, every stored-row read replays the same rewrite, so the block reads the rule array and shows the same rows.
+- Nothing an author writes is accepted or refused differently. The conversion stays retired from the authoring path, and no schema changes.
+
+The migration entries `element-data-source-and-object-block-filter-rule-array` and `object-grid-default-filters-rule-array`, and the protocol-18 step rationale, no longer say that inline-row filters are left as stored.
+
+ADR-0087 disposition: already registered. This changes the behaviour of the registered D2 conversion `page-component-filter-record-to-rule-array` and edits its two D3 entries. There is nothing new to register.
+
+Clause-②: no

.changeset/20596-plugin-security-provenance-anchors.md

@@ -0,0 +1,11 @@
+---
+'@objectstack/plugin-security': patch
+---
+
+Provenance comments in `plugin-security` were re-anchored
+
+Comment and docblock lines under `src/` that cited tracker numbers which no
+longer resolve on GitHub now cite the record in this repository that decided
+the matter (an ADR where one exists, otherwise the commit in this repository's
+history), and say in their own words what was decided. Comments only: no type,
+schema, export, log or refusal text, or runtime behaviour changes.

.changeset/cli-provenance-anchors.md

@@ -0,0 +1,14 @@
+---
+'@objectstack/cli': patch
+---
+
+Provenance comments in `@objectstack/cli` were re-anchored
+
+Comment and docblock lines under `src/` that cited tracker numbers which no
+longer resolve on GitHub now cite the commit in this repository's history that
+decided the matter, and say in their own words what was decided. Two strings
+move with them: the `os i18n extract --source-hashes` help text now says what
+the provenance companion records instead of citing a number, and the header
+that flag writes into each `<locale>.source-hashes.generated.ts` cites the
+commit that introduced the companion. No command, flag, exit code, error code,
+type, export or runtime behaviour changes.

content/docs/automation/connectors.mdx

@@ -114,6 +114,8 @@ Materializes a single **`request`** action accepting
 payload per call. Use it when the upstream is "just HTTP" and you don't have a
 spec document.
 
+Do not put a credential in `headers` or `defaultHeaders`: both are stored in metadata and served with it. Declare it as `auth.credentialRef` instead — the resolved `auth` is applied to every request — as the `Authorization` header, or for `api-key` as `headerName` (default `X-API-Key`) or the `paramName` query parameter.
+
 ### `provider: 'openapi'` — one action per operation
 
 Config: **`spec`** (required) and **`baseUrl`** (optional — overrides the

content/docs/automation/flows.mdx

@@ -261,15 +261,19 @@ nothing is assigned or written in its place.
 {
   id: 'notify_slack',
   type: 'http',
-  label: 'Send Slack Notification',
+  label: 'Post Order Event',
   config: {
-    url: 'https://hooks.slack.com/services/...',
+    url: 'https://api.example.com/v1/order-events',
     method: 'POST',
-    body: { text: 'New order: {record.name}' },
+    body: { event: 'order.created', name: '{record.name}' },
   },
 }
 ```
 
+<Callout type="warn" title="Do not put a secret in an http node's url or headers">
+A flow definition, including an `http` node's `url` and `headers`, is served to every member who can read flows. A token, API key or signed webhook url written there is readable by all of them. Route an outbound credential to a declarative connector's `auth.credentialRef` and call it with a `connector_action` node instead — see [Connectors](/docs/automation/connectors#authentication). Only `signingSecret` (and a start node's `secret`) is withheld when a definition is served; `url` and `headers` are served as written.
+</Callout>
+
 **Script:**
 
 The built-in `script` executor never evaluates an arbitrary JavaScript string —

packages/cli/src/commands/cloud/login.ts

@@ -12,7 +12,7 @@
  * ## `--json` here is NDJSON — a declared exception, same as `os login` (#6730)
  *
  * Everywhere else in this CLI `--json` means "stdout is exactly one JSON
- * document" (#6217). Both device-flow login commands are declared exceptions to
+ * document" (commit 2b641ddd4). Both device-flow login commands are declared exceptions to
  * that, and they are the SAME exception: one compact JSON document per line.
  *
  * ### What was broken

packages/cli/src/commands/compile.ts

@@ -228,7 +228,7 @@ export default class Compile extends Command {
       // one. See `printAuthoringAdvisories` for the measurement.
       printAuthoringAdvisories(ruleAdvisories);
     };
-    // [#12125] The ADR-0087 D2 conversion notices, hoisted for the SAME reason
+    // [commit 79cf692b0] The ADR-0087 D2 conversion notices, hoisted for the SAME reason
     // and under the SAME ruling as the four lists above — one field over. The
     // notices were computed at step 2 (below) and reached the terminal SUCCESS
     // payload alone, so all nine failure exits dropped a list already in hand.

packages/cli/src/commands/create.ts

@@ -38,7 +38,7 @@
  * ObjectStack is a developer tool, so a documented developer-facing command has
  * to work for the developer who follows the docs. This command is documented on
  * four public doc pages (`deployment/cli`, `plugins/index`, the two
- * `protocol/kernel` pages) and, until #14824, every one of those readers got a
+ * `protocol/kernel` pages) and, until commit cf6b67164, every one of those readers got a
  * project that CANNOT INSTALL:
  *
  *   - the emitted `package.json` declared `@objectstack/spec` and
@@ -81,7 +81,7 @@
  *
  * ## The emitted package NAME follows the placement too (#15530)
  *
- * The audience decides the name, and #14824 moved the audience without moving
+ * The audience decides the name, and commit cf6b67164 moved the audience without moving
  * the name: the standalone default kept stamping `@objectstack/plugin-<name>`
  * — a scope the developer it now scaffolds for cannot publish to — onto every
  * project, with the emitted README telling them to install it from there. The
@@ -321,9 +321,9 @@ function pluginDirName(name: string): string {
  * ## Why the standalone name is unscoped
  *
  * `@objectstack` is a scope the developer this command scaffolds FOR cannot
- * publish to. Until #14824 that was arguably fine, because the default output
+ * publish to. Until commit cf6b67164 that was arguably fine, because the default output
  * landed inside this monorepo, where every sibling really does carry the scope.
- * That ruling pointed the default at the developer's own directory and the name
+ * That commit pointed the default at the developer's own directory and the name
  * did not move with the audience — so the standalone emission stamped a scope
  * its owner does not own onto every project generated from it. ⚠️ Nothing in
  * this repository can see that: the name is never resolved from a registry

packages/cli/src/commands/database-driver-allowlist.pin.test.ts

@@ -36,10 +36,10 @@
  * `start.ts` and once in `dev.ts`, and that duplication is exactly how the two
  * can drift apart from each other as well as from the resolver.
  *
- * SCOPE (#6860 vs #6345): this pins the CANONICAL kinds — the `driverId` values
+ * SCOPE (#6860 vs commit e2798fab7): this pins the CANONICAL kinds — the `driverId` values
  * the resolver produces. The resolver also accepts aliases (`pg`, `mysql2`,
  * `libsql`, `mingo`, `wasm`, …) which the flag deliberately does not offer;
- * converging that vocabulary is #6345's job, and this pin is written so it does
+ * converging that vocabulary was commit e2798fab7's job, and this pin is written so it does
  * not prejudge it — an alias collapses to its canonical id and is not demanded
  * of the flag.
  */
@@ -101,7 +101,7 @@ function candidateTokens(): string[] {
  * is supplied so it resolves normally; the catch is kept so the derivation
  * survives another kind growing the same "recognized but unusable" shape.
  *
- * `err.recognized` is what keeps that catch honest (#6345). The resolver now
+ * `err.recognized` is what keeps that catch honest (commit e2798fab7). The resolver now
  * ALSO throws `UnsupportedDriverError` for a spelling nothing claims — the CLI
  * half of "both hosts refuse the same input", which replaced a silent fall-through
  * to the dev SQLite default. Reading `driverType` off that error would report the

packages/cli/src/commands/database-driver-flag-derivation.test.ts

@@ -24,7 +24,7 @@
  * Deriving the flag from the CONFIG-CONTRACT face (`DRIVER_ID_ALIASES` /
  * `resolveDriverId`) instead of the SELECTION face would offer `sqlite3`,
  * `better-sqlite3`, `mariadb` and `inmemory` — spellings neither boot host has
- * ever accepted as a selection (#6345 fixes the selection face as the union of
+ * ever accepted as a selection (commit e2798fab7 fixes the selection face as the union of
  * what the two hosts accepted the day the ruling was written). The last case here
  * drives oclif's real parser to prove they are still refused at parse time.
  */