Merge remote-tracking branch 'origin/main' into claude/issue-21227-create-reads-back-stored-row

Author: claude

.changeset/21185-upsert-cross-org-refusal.md

@@ -0,0 +1,50 @@
+---
+'@objectstack/driver-sql': minor
+'@objectstack/driver-turso': minor
+'@objectstack/spec': patch
+---
+
+fix(driver-sql,driver-turso)!: an upsert whose conflict lands on another organization's row is refused with `UNIQUE_VIOLATION` and writes nothing, and an upsert never changes a row's organization (#21185)
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: registered driver-upsert-cross-organization-conflict-refused -->
+
+**BREAKING for `upsert` callers on the SQL drivers and on `TursoDriver`.**
+
+**What changed.** `upsert` resolves its conflict against the whole table, and the
+primary key and a `unique: 'global'` column are installation-wide, so the row a
+tenant-scoped call (`options.tenantId` on an object with a tenant column) collided
+with could belong to another organization. The merge wrote the payload onto that
+row, tenant column included. Now:
+
+- **A tenant-scoped upsert merges only into a row of the organization the row is
+  written under**, for any conflict target, the primary key included. A conflict
+  that lands on a row of another organization, or on a row with no organization,
+  is refused with `code: 'UNIQUE_VIOLATION'`, `status: 409`, and nothing is
+  written. That is the answer `create()` gets for the same collision: from the
+  caller's organization the call is an insert, and that insert collides. The
+  refusal names no organization and no value of the row it collided with.
+- **The tenant column is insert-only** (`insertOnlyUpsertColumns`), like `id`,
+  `created_at` and `auto_number` columns: an upsert with no tenant context merges
+  into the row it lands on and keeps that row's organization.
+
+Mechanism, per face: on SQLite, PostgreSQL and the remote (libSQL) face, the merge
+statement carries the organization predicate (`DO UPDATE … WHERE`), so another
+organization's row is never written. On MySQL, whose `ON DUPLICATE KEY UPDATE`
+takes no `WHERE`, the statement and a read of the landed row run in one
+transaction (a savepoint inside a caller's transaction), and the read's failure
+rolls the write back. The remote face now also stamps the caller's organization on
+the row it inserts, as the local faces do.
+
+## FROM → TO
+
+| you relied on | now |
+|:--|:--|
+| a tenant-scoped `upsert` merging into a row of another organization | refused with `UNIQUE_VIOLATION` / 409, nothing written |
+| an `upsert` payload's tenant value moving the row it merges into | the row keeps its organization; to move a row between organizations, use `update()` |
+
+**What is not affected.** A tenant-scoped upsert whose conflict lands on a row of
+its own organization merges as before, on every target. An upsert that inserts
+lands under the caller's organization, or under the organization the payload
+names explicitly, as before.

.changeset/21207-mcp-stdio-stored-metadata-body.md

@@ -0,0 +1,18 @@
+---
+'@objectstack/mcp': minor
+---
+
+fix(mcp)!: the MCP stdio transport serves a stored metadata body only as its type's read projection, and refuses to evaluate it
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) the MCP stdio transport's engine-only reader (its query, get and aggregate verbs and its record resource) now serves a stored metadata body through the stored-metadata-body family's one projection, and refuses a group, filter, sort or aggregate member on the stored body column — the posture the generic data door already takes. No authorable key, spelling, export or stored shape moves, and no stored row is read differently by any metadata consumer. The other categories are closed on facts: the package publishes (not `unpublished`); no ADR-0087 id covers a served body projection or a refused query shape on this door (not `registered` / `already-registered`); and the change is runtime behaviour, not a declaration (not `runtime-interface-only` / `type-surface-only`). -->
+
+**BREAKING**: this narrows what one door serves and accepts for the two stored-metadata tables (the stored row and its version history). On the MCP stdio transport, a read now carries the stored body as its type's read projection instead of the stored bytes, and a call that would evaluate the stored body is refused. It ships as `minor` under the launch-window convention for accept-set narrowings. No export or published type changes.
+
+**What changes.**
+
+- **Reads.** The stdio bridge's query and get verbs, and the record resource, serve the stored body through the same projection the generic data door and every metadata read serve: stored credential material is withheld, a body that cannot be judged is omitted, and a credential-free body is served unchanged.
+- **Evaluate shapes.** A group, filter, sort or aggregate member on the stored body column is refused with `400 INVALID_FIELD` before the engine runs — the data door's code and envelope.
+
+**What stays answerable.** Every scalar column of the two tables is still served, filtered, sorted, grouped and counted; only the stored body column is affected, and every other object is unchanged. A member's read of these tables is refused as before.