Merge remote-tracking branch 'origin/main' into claude/pagination-tie-breaker-missing-p98qf0

Author: claude

.changeset/action-body-write-set-lint.md

@@ -10,8 +10,10 @@ that carries one. An action body is the same artefact: the same
 `HookBodySchema` union, parsed by the same `HookBodySchema.safeParse` in
 `actionBodyRunnerFactory`, run in the same QuickJS sandbox. So it fails the
 same way — `ctx.api.object('crm_deal').update({ stag: 'won' })` inside an
-action succeeds, returns success to the caller, and the unknown column simply
-never lands. Half the surface was still blind.
+action reaches the driver unfiltered, and the outcome splits by driver: on SQL
+the stray column fails the whole call with a driver-level error far from the
+authoring site, and on a schemaless driver the stray key is persisted. Half
+the surface was still blind.
 
 **New rule — `action-body-write-unknown-field` (advisory).** Wired into
 `REFERENCE_INTEGRITY_RULES`, so `os validate`, `os lint` and `os compile` all

.changeset/body-write-lint-message-driver-truth.md

@@ -0,0 +1,41 @@
+---
+"@objectstack/lint": patch
+"@objectstack/spec": patch
+---
+
+fix(lint): the write-set diagnostics describe what the runtime actually does (#4271)
+
+`hook-body-write-unknown-field` and `action-body-write-unknown-field` told
+authors the undeclared column "silently never lands in the stored record".
+Measured on `main`, that is wrong in **both** directions. Nothing between the
+body and the driver filters the key — `applyMutationsToInput` is a plain
+`Object.assign`, and `validateRecord` walks declared fields on insert and
+`continue`s past a key with no field def on update — so the driver decides:
+
+- **SQL** — the stray column enters the statement and the **whole write
+  fails** with a driver-level error (`table deal has no column named stagee`).
+  Nothing is stored, so the correctly-spelled fields of that row are lost too,
+  and the error names a column far from the body that wrote it.
+- **Schemaless** (memory, MongoDB — both spread the payload without consulting
+  the declared field set) — the stray key **is** persisted, as an undeclared
+  column nothing downstream reads.
+
+A lint that misdescribes the failure it is warning about teaches the wrong
+debugging instinct: an author told the value silently vanishes will not connect
+the driver error they actually see to the typo that caused it, and on a
+schemaless driver will not go looking for the stray key that is really there.
+All three messages now state the split, matching the "What still happens at
+runtime" description #4355 gave `content/docs/automation/hook-bodies.mdx`.
+
+Both outcomes are pinned by a new integration test —
+`runtime/src/sandbox/undeclared-field-write-driver-split.integration.test.ts`.
+Its insert cases run the full chain (real QuickJS sandbox, real hook body, real
+engine, real driver against a real SQLite table), so "reaches the driver
+unfiltered" is proved rather than asserted: if anything on that path ever
+learns to filter, the SQL half stops throwing and the test goes red. The rule
+headers, the `ScriptBodySchema` / `ActionSchema.body` notes and the two
+still-unreleased #4271 changesets are corrected to match. #4355 fixed the
+prose docs; this is the same correction on the surfaces that ship in the
+packages — the diagnostic an author actually reads, and a test that pins it.
+
+`@objectstack/spec`: doc comments only — no schema or generated-artifact change.

.changeset/hook-body-write-set-lint.md

@@ -7,12 +7,23 @@ feat(lint): L2 hook-body writes to undeclared fields warn at author time (#4271)
 
 An L2 (`language:'js'`) hook body that writes a field the target object never
 declares — `ctx.input.amout = 0`, `ctx.api.object('deal').update({ stag: … })`
-— runs clean in the QuickJS sandbox, reports success, and the unknown column
-simply never lands in the stored record. No diagnostic anywhere: the #4001
-"silent no-op manufactures false completion" failure mode at the
-runtime-expression layer. The read side (`hook.condition`) and the capability
-surface were already statically checked; the write side was the one blind face,
-and `hook-body.zod.ts` carried it as an **accepted gap**.
+— runs clean in the QuickJS sandbox and reaches the driver **unfiltered**:
+`applyMutationsToInput` is a plain `Object.assign`, and the write-path
+validator walks declared fields on insert and skips a key it has no field def
+for on update. What happens next depends on the driver, and neither half is
+acceptable:
+
+- **SQL** — the stray column enters the statement and the **whole write fails**
+  with a driver-level error (`table deal has no column named stagee`). The
+  write is lost, and the error surfaces far from the mistake that caused it.
+- **Schemaless** (memory, MongoDB) — the driver spreads the payload, so the
+  stray key **is** persisted: an undeclared column nothing downstream reads.
+
+No diagnostic anywhere, and nothing at the authoring site either way — the
+#4001 "the mistake is invisible where it is made" family. The read side
+(`hook.condition`) and the capability surface were already statically checked;
+the write side was the one blind face, and `hook-body.zod.ts` carried it as an
+**accepted gap**.
 
 **New rule — `hook-body-write-unknown-field` (advisory).** `@objectstack/lint`
 now parses each L2 body (TypeScript parser; parsed, never executed, never

.changeset/http-server-exemption-revoked.md

@@ -0,0 +1,41 @@
+---
+"@objectstack/metadata": patch
+---
+
+fix(lint,metadata): revoke the `http.server` lint exemption — its stated reason was false (#4251)
+
+`http.server` was added to `UNCONTRACTED_SLOTS` in #4321 on the ground that
+"no IHttpServer contract exists". The contract does exist —
+`packages/spec/src/contracts/http-server.ts` — and eight call sites were
+already resolving the slot as `getService<IHttpServer>(…)` when the exemption
+was written. An exemption is a claim like any other, and this one rested on a
+premise nobody checked: the same shape as the gaps the rule exists to find.
+
+Revoked. That surfaced **9 erasures the exemption had been hiding** — 7 in
+files never grandfathered, 2 as count growth inside grandfathered ones, none of
+which the baseline could legally absorb. All typed to `IHttpServer`;
+`packages/metadata/src/plugin.ts` came out clean entirely, so the baseline
+ratchets **DOWN to 168 sites in 36 files** and loses a file.
+
+Two things confirmed on the way, reported rather than changed:
+
+**`http.server` and `http-server` are the same instance under two names.**
+plugin-hono-server and qa's node-plugin each register it twice, two lines
+apart; runtime's `config.server` path registers only `http.server`.
+`metadata/src/plugin.ts` reads both with a `??`, which is how it survived. No
+registration is removed here — that is a runtime-behaviour change and belongs
+with whoever picks the canonical name.
+
+**`IHttpServer` is defined twice and the two have already diverged.**
+`packages/spec/src/contracts/http-server.ts` (15 importers) declares `write?()`
+and `end?()`; `packages/core/src/contracts/http-server.ts` (8 importers) does
+not. Spec's is the superset and the one the ledger points at, so it is the
+source; core's is a stale near-copy and should re-export it. Left for its own
+change — collapsing a duplicated contract is not a lint fix.
+
+Also worth a note for whoever writes the wider HTTP contract: `getRawApp()` now
+has a **third** independent consumer (metadata's HMR routes, joining
+cloud-connection's two). It is deliberately absent from `IHttpServer` — the
+contract is framework-agnostic and the raw app is the framework's own handle —
+so each consumer names it locally. Three is enough evidence to decide whether
+that stays the right answer.

.changeset/lint-fieldless-object-skip.md

@@ -0,0 +1,47 @@
+---
+"@objectstack/lint": patch
+---
+
+fix(lint): an object declaring no fields is unjudgeable, not "has no such field" (#4383)
+
+`hook-body-write-unknown-field` and `action-body-write-unknown-field` reported
+**every** field write to an object that declares no `fields` — an external
+object, or a datasource-introspected schema whose columns are resolved at
+runtime. Measured before the fix:
+
+```
+hook  : ["hook-body-write-unknown-field / warning"]     ← false
+action: ["action-body-write-unknown-field / warning"]   ← false
+flow  : []                                              ← correct
+```
+
+`indexObjectFields` returns an **empty Set** for such an object rather than
+`undefined`, and both rules only asked "is this object in the stack?" —
+`targetSets.every((s) => s !== undefined)` and `if (!known) continue`. An empty
+Set is neither undefined nor falsy, so it became the answer to `has(field)`,
+and the answer is always `false`.
+
+That field map is not empty, it is **unknown**. The distinction already existed
+in two other rules of the same family, each with its reason written down —
+`validate-searchable-fields` skip #2 and `validate-flow-node-writes` (#4369,
+which added the guard because it gates). Two of four had it; the drift shape
+#3583 and #4330 exist to remove.
+
+**Fixed once, not twice.** The guard now lives in a shared
+`judgeableFieldsOf(index, objectName)` that returns the declared names only when
+they are a sound basis for a "resolves to nothing" judgement, and `undefined`
+for both unjudgeable cases — cross-package objects and fields-less ones. All
+three write-set rules route their lookups through it, so a fourth cannot repeat
+the omission. It is internal to the family (not re-exported from the package
+barrel), same as `indexObjectFields` and `IMPLICIT_FIELDS`.
+
+One semantic call worth naming: a **multi-target** hook where only *some*
+targets are judgeable is now skipped entirely. The `ctx.input` finding fires
+only when a field is missing from EVERY target, and an unjudgeable target is one
+the field might well exist on — so judging the remainder would assert "missing
+everywhere" on evidence that does not cover everywhere. Consistent with the
+rule's stated asymmetry: prefer a missed finding to a false one.
+
+No behaviour change for objects that declare fields: an unknown field on a
+normal object still warns exactly as before, pinned by a test placed next to
+each new skip so the guard cannot swallow the real finding.

eslint.config.mjs

@@ -69,11 +69,16 @@ const SLOT_LOOKUPS = ['resolveService', 'getService', 'getRequestKernelService']
 // place, not sprinkled through the code. Deleting a name from this list is how
 // the exemption ends once that contract gets written.
 //
-// Entries are spliced into a regex, so escape metacharacters (`http\\.server`).
-// `http.server` is served by three providers (plugin-hono-server, runtime's
-// config.server path, qa's node-plugin) and no IHttpServer contract exists;
-// callers read only `getPort()`.
-const UNCONTRACTED_SLOTS = ['protocol', 'mcp', 'kernel-resolver', 'scope-manager', 'http\\.server'].join('|');
+// Entries are spliced into a regex, so escape metacharacters if one returns.
+//
+// [#4251] `http.server` was here, on the stated ground that "no IHttpServer
+// contract exists". That was FALSE when it was written: the contract is
+// `packages/spec/src/contracts/http-server.ts`, and eight call sites were
+// already resolving the slot as `getService<IHttpServer>(…)`. An exemption is a
+// claim like any other, and this one rested on a premise nobody checked — the
+// same shape as the gaps this rule exists to find. Revoked; the slot is
+// accounted for like every other contracted slot.
+const UNCONTRACTED_SLOTS = ['protocol', 'mcp', 'kernel-resolver', 'scope-manager'].join('|');
 
 // Exported so `scripts/check-slot-lookup-ratchet.mjs` can identify THIS rule's
 // reports among the other `no-restricted-syntax` rules, by exact message —

packages/client/src/client.batch-transaction.test.ts

@@ -33,6 +33,7 @@ import { SqliteWasmDriver } from '@objectstack/driver-sqlite-wasm';
 import { HonoServerPlugin } from '@objectstack/plugin-hono-server';
 import { createRestApiPlugin } from '@objectstack/runtime';
 import { ObjectStackClient } from './index';
+import type { IHttpServer } from '@objectstack/spec/contracts';
 
 describe('data.batchTransaction (live Hono, #1604)', () => {
     let baseUrl: string;
@@ -103,8 +104,8 @@ describe('data.batchTransaction (live Hono, #1604)', () => {
         await ql.syncObjectSchema('project');
         await ql.syncObjectSchema('task');
 
-        const httpServer = kernel.getService<any>('http.server');
-        baseUrl = `http://localhost:${httpServer.getPort()}`;
+        const httpServer = kernel.getService<IHttpServer>('http.server');
+        baseUrl = `http://localhost:${httpServer.getPort!()}`;
         client = new ObjectStackClient({ baseUrl });
     }, 30_000);
 

packages/client/src/client.environment-scoping.test.ts

@@ -20,6 +20,7 @@ import { SqliteWasmDriver } from '@objectstack/driver-sqlite-wasm';
 import { HonoServerPlugin } from '@objectstack/plugin-hono-server';
 import { createRestApiPlugin } from '@objectstack/runtime';
 import { ObjectStackClient } from './index';
+import type { IHttpServer } from '@objectstack/spec/contracts';
 
 describe('Project-scoped REST routing (live Hono)', () => {
     let baseUrl: string;
@@ -82,8 +83,8 @@ describe('Project-scoped REST routing (live Hono)', () => {
         // write fails with `no such table`.
         await ql.syncObjectSchema('task');
 
-        const httpServer = kernel.getService<any>('http.server');
-        const port = httpServer.getPort();
+        const httpServer = kernel.getService<IHttpServer>('http.server');
+        const port = httpServer.getPort!();
         baseUrl = `http://localhost:${port}`;
     }, 30_000);
 

packages/client/src/client.hono.test.ts

@@ -5,6 +5,7 @@ import { SqliteWasmDriver } from '@objectstack/driver-sqlite-wasm';
 import { HonoServerPlugin } from '@objectstack/plugin-hono-server';
 import { createRestApiPlugin } from '@objectstack/runtime';
 import { ObjectStackClient } from './index';
+import type { IHttpServer } from '@objectstack/spec/contracts';
 
 describe('ObjectStackClient (with Hono Server)', () => {
     let baseUrl: string;
@@ -130,8 +131,8 @@ describe('ObjectStackClient (with Hono Server)', () => {
         await ql.syncObjectSchema('customer');
 
         // 5. Get Port from Service
-        const httpServer = kernel.getService<any>('http.server');
-        const port = httpServer.getPort();
+        const httpServer = kernel.getService<IHttpServer>('http.server');
+        const port = httpServer.getPort!();
         baseUrl = `http://localhost:${port}`;
 
         console.log(`Test server running at ${baseUrl}`);

packages/lint/src/reference-integrity-suite.test.ts

@@ -63,8 +63,9 @@ describe('reference-integrity suite — every member actually runs', () => {
       // validateObjectReferences: a param pointing at an object nothing declares.
       { name: 'assign', label: 'Assign', params: [{ name: 'owner', reference: 'user' }] },
       // validateActionBodyWrites, both of its rule ids from one body:
-      //   - the L2 body persists a field crm_lead does not declare — the action
-      //     returns success and the column never lands (#4271);
+      //   - the L2 body writes a field crm_lead does not declare — on SQL that
+      //     fails the whole call at the driver, on a schemaless driver it
+      //     persists a stray key (#4271);
       //   - and it assigns ctx.record, a snapshot the runtime never writes
       //     back, without ever passing it anywhere (#4345).
       {
@@ -143,7 +144,8 @@ describe('reference-integrity suite — every member actually runs', () => {
     skills: [{ name: 'metadata_authoring', surface: 'build', tools: ['forecast_revenue'] }],
     hooks: [
       // validateHookBodyWrites: the L2 body writes a field crm_lead does not
-      // declare — runs clean in the sandbox, never lands in the record (#4271).
+      // declare — runs clean in the sandbox, then fails the whole write at a
+      // SQL driver / persists a stray key on a schemaless one (#4271).
       {
         name: 'score_lead',
         object: 'crm_lead',