fix(client,spec): 补 client 路由约定表的 mcp 项,并在合并树上重生成 authorable-surface (#5679)

CI 上两条不同签名的红,都是合并 origin/main 之后才出现的:

1. `@objectstack/client` DTS build — TS2741: `getRoute()` 的约定回退表
   `Record<ApiRouteType, string>` 按设计对 `keyof ApiRoutes` **全键必填**,
   所以给 ApiRoutesSchema 新增一个已声明键就必须给出它的约定路径。这是我
   消费半径漏掉的包。补 `mcp: '/api/v1/mcp'` —— 不是猜的,正是两个 discovery
   生产者实测发出的值,所以回退值与被发现值一致而非互相打架;而且该表本就
   是 unscoped 约定表(每行都是 /api/v1/...),恰好符合 /mcp 裸挂载的事实。
   全仓复扫 `keyof ApiRoutes` / ApiRoutes 型字面量,确认没有第三处:其余站点
   都是 `Partial<ApiRoutes>` 或只填两个必填键,不受影响。

2. `check:authorable-surface` — 合并带进了 #5721 的 `ui/ActionSession` 源,
   但 authorable-surface.json 未在合并树上重生成。跑 gen:schema 重出,该文件
   现同时含本单的 `api/ApiRoutes:mcp` 与 main 的 ActionSession 三键。

`authorable-surface.base.json` 的 baseRev 重锚照 #5358 再次剔除 —— 那是 main
前移导致的机械重锚,不属本单。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018fxLGQdatPbBUvCgiVxg6D

Author: claude

.changeset/discovery-routes-mcp-declared.md

@@ -1,6 +1,7 @@
 ---
 "@objectstack/spec": minor
 "@objectstack/rest": patch
+"@objectstack/client": patch
 ---
 
 feat(spec): declare `routes.mcp` on `ApiRoutesSchema`, and extend the discovery conformance gate one level down (#5679)
@@ -38,6 +39,15 @@ JSON.
   of scope, and `capabilities` / `services` are `z.record`s whose keys are open
   by design.
 
+- **`@objectstack/client`'s conventional route table gains an `mcp` row.** That
+  table is `Record<keyof ApiRoutes, string>` — total by design — so a newly
+  declared route owes a convention, and the public `ApiRouteType` (`keyof
+  ApiRoutes`) widens by one member. The path is `/api/v1/mcp`, which is what
+  both producers emit, so the fallback agrees with the discovered value instead
+  of competing with it. Resolution behaviour is unchanged: `getRoute()` still
+  prefers the discovered route, and the pre-existing catch-all already produced
+  the same string.
+
 Corrects one detail of the issue's premise: the runtime dispatcher's
 `getDiscoveryInfo()` **does** also emit `routes.mcp` (its routes literal always
 carries the key, holding the path or `undefined`), so both producers were

packages/client/src/index.ts

@@ -4584,6 +4584,16 @@ export class ObjectStackClient {
       notifications: '/api/v1/notifications',
       ai: '/api/v1/ai',
       i18n: '/api/v1/i18n',
+      // [#5679] `mcp` became a declared `ApiRoutes` key, and this map is
+      // TOTAL over them by design — a new declared route owes a convention.
+      // `/api/v1/mcp` is not a guess: it is what both discovery producers
+      // actually emit, so the fallback agrees with the discovered value
+      // rather than competing with it.
+      //
+      // Note this table is the UNSCOPED convention (every row is `/api/v1/…`),
+      // which suits `mcp` exactly: `/mcp` is mounted bare, so even a
+      // project-scoped discovery response advertises the unscoped path.
+      mcp: '/api/v1/mcp',
     };
 
     return routeMap[type] || `/api/v1/${type}`;

packages/spec/authorable-surface.json

@@ -6925,6 +6925,9 @@
     "ui/ActionParam:requiresFeature",
     "ui/ActionParam:type",
     "ui/ActionParam:visible",
+    "ui/ActionSession:organizationId",
+    "ui/ActionSession:roles",
+    "ui/ActionSession:userId",
     "ui/AddRecordConfig:enabled",
     "ui/AddRecordConfig:formView",
     "ui/AddRecordConfig:mode",