Merge remote-tracking branch 'origin/main' into claude/issue-23050-s13b-meta-item-read

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QyoWKK9RwUNxBxmevy9Neb

Author: claude

.changeset/24137-oauth-token-organization.md

@@ -0,0 +1,12 @@
+---
+'@objectstack/runtime': patch
+---
+
+fix(runtime): an OAuth MCP agent acts in the organization the user's consent bound, so the user's organization-scoped grants count for it
+
+Clause-②: no
+
+- **What was wrong.** On the `/mcp` door, `resolveExecutionContext` built a verified OAuth access token's principal with no organization. The agent's delegator (the user it acts for, ADR-0090 D10) was then resolved with no active organization and held only its global grants. Every grant an administrator assigns is scoped to an organization, so an ordinary user's agent was refused every object operation: `on-behalf-of principal may not 'find' … the delegator lacks that grant (ADR-0090 D10 intersection)`.
+- **What changed.** The principal is resolved in the organization the consent bound: the `organizationId` that `IAuthService.verifyMcpAccessToken` returns from the token's `organization_id` claim. It is handed to the shared resolver where a session carries its active organization, so it is vetted on every request by the rule a browser session's organization gets (`vetOrganizationClaim`, `@objectstack/core`). The user's grants scoped to that organization count for the agent; grants scoped to the user's other organizations do not. It is never the union of the user's organizations, never the organization the user's browser session has selected now, and never a widened global grant.
+- **A membership that is gone.** Under a walled tenancy posture (`isolated`, `group`), a token whose organization the user no longer belongs to resolves with no organization, so only global grants apply. Under `isolated`, a former member's agent gets an empty `200` read and a refused tenant write. The same holds for an organization the user never belonged to, whatever put it on the token. Under `single`, or with no `tenancy` service, the organization stands as claimed, exactly as a browser session's does there.
+- **Unchanged.** A token with no `organization_id` (minted before consents bound one, or by a user with no active organization at consent) resolves with no organization, as before: global grants only, until the user re-confirms the consent once. A platform admin's global grant applies as before. The API-key and session tracks are untouched.

.changeset/24210-metadata-protocol-by-name-disabled-non-object.md

@@ -0,0 +1,19 @@
+---
+'@objectstack/metadata-protocol': minor
+---
+
+fix(metadata-protocol)!: the by-name `/meta` read answers a disabled package's item of every type but `object` and `package` as absent, as the list already omits it
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) the narrowing is the served set of a runtime read door, getMetaItem for an item whose owning package is disabled: no stored metadata changes shape, no spec key, export or error code is added or removed, and nothing must be rewritten; re-enabling the package restores the read -->
+
+**BREAKING** (a served-set narrowing), shipped as `minor` under the launch-window convention for breaking changes.
+
+Disabling a package already took its apps, views, pages, dashboards, flows and every other item out of `GET /meta/:type`. The by-name read `GET /meta/:type/:name` still served them. It now answers such an item the way it answers a name with nothing behind it.
+
+- **Absent now:** `getMetaItem({ type, name })` for an item whose `_packageId` names a disabled package, for every type except `object` and `package`. The active read and `previewDrafts` serve no `item`, which both transports answer `404 RESOURCE_NOT_FOUND`, byte for byte the answer for a missing name. The strict draft read (`state: 'draft'`) throws the missing draft's `404 NO_DRAFT`. The list read and the by-name read ask one predicate, so they hide the same items.
+- **Kept:** the protection envelope (`lock`, `editable`, `deletable`, `version` and the rest) still reports the write doors' verdicts about the address, because a disable does not change how the lock gate judges a save there. Only `item` and a flow's `registration` are withheld.
+- **Unchanged:** objects, which keep their `404 OBJECT_PACKAGE_DISABLED`; packages, which are never hidden, so a disabled package can still be read and re-enabled; items of enabled packages; and `getMetaItemLayered` (`?layers=true`, `/layers`) and `/published`, which still serve a disabled package's non-object item.
+
+What changes for you: a client that read a disabled package's app, view, page or other item by name now gets `404 RESOURCE_NOT_FOUND`, as for a missing name. Re-enable the package to read it again.

.changeset/24210-plugin-security-echo-binding-disabled-package.md

@@ -0,0 +1,7 @@
+---
+'@objectstack/plugin-security': patch
+---
+
+fix(plugin-security): the security catalog echo keeps naming a disabled package's permission set or position as that package's
+
+The echo reads which package owns a stored overlay from the protocol's by-name read. That read now withholds a disabled package's item and keeps its protection envelope, so the echo reads the envelope's `packageId` instead of `item._packageId`. Before, a disabled package's set was echoed unowned, lost its ADR-0090 D5 audience-binding suggestion, and stayed unowned after the package was re-enabled until the next save, publish or boot. Enforcement is unchanged.

.changeset/24210-rest-event-diff-doors-disabled-package.md

@@ -0,0 +1,18 @@
+---
+'@objectstack/rest': minor
+---
+
+fix(rest)!: `/history`, `/audit` and `/diff` answer a disabled package's item with the plain read's absence, never past the per-caller gate
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) the narrowing is the served set of three runtime read doors for an item whose owning package is disabled: no stored metadata changes shape, no spec key, export or error code is added or removed, and nothing must be rewritten; re-enabling the package restores the read -->
+
+**BREAKING** (a served-set narrowing), shipped as `minor` under the launch-window convention for breaking changes.
+
+The by-name read now answers a disabled package's item as absent. The event and diff doors judge the item the plain read would judge, and they read "no item" as "nothing behind the name": events served whole, and a view's or dashboard's diff served whole, to a caller the item's own gate refuses.
+
+- **Absent now, `404 RESOURCE_NOT_FOUND`:** `GET /meta/:type/:name/history`, `/audit` and `/diff` for an `app`, `view`, `dashboard`, `doc` or `book` the plain read withholds while its layers still resolve, which is a disabled package's item. No events and no diff are read.
+- **Unchanged:** an item that is really gone (every layer null, such as a deleted item) keeps its answer: its events, and its diff as before. Items of enabled packages keep the per-caller gate as before.
+
+What changes for you: re-enable the package to read its items' history, audit trail and diff again.

.changeset/24210-runtime-meta-disabled-package-doors.md

@@ -0,0 +1,20 @@
+---
+'@objectstack/runtime': minor
+---
+
+fix(runtime)!: the dispatcher's `/meta` doors that read past the protocol answer a disabled package's object or item as the protocol's by-name read does
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) the narrowing is the served set of runtime read doors on the dispatcher transport: no stored metadata changes shape, no spec key, export or error code is added or removed, and nothing must be rewritten; re-enabling the package restores the read -->
+
+**BREAKING** (a served-set narrowing), shipped as `minor` under the launch-window convention for breaking changes.
+
+The registry keeps a disabled package's objects on purpose, and the metadata service knows nothing of a disable. Four dispatcher doors read one of them for a disabled package's object or item and served it.
+
+- **Refused now, `404 OBJECT_PACKAGE_DISABLED`:** `GET /meta/object/:name/state/:field`, and the legacy one-segment `GET /meta/:name` exit, for an object whose owning package is disabled. Both read `registry.getObject`; they now answer the protocol's refusal, the answer `GET /meta/object/:name` gives.
+- **Refused now, `404 OBJECT_PACKAGE_DISABLED`:** `GET /meta/object/:name/published`. When the layered read refused the object, this door fell through to the published snapshot and served it. The refusal is now the answer, as on `RestServer`'s `/published`.
+- **Absent now, `404 RESOURCE_NOT_FOUND`:** `GET /meta/:type/:name` for a non-object item of a disabled package. The protocol answers it as absent, and the door no longer serves the metadata service's copy in its place. The body is byte for byte the answer for a missing name.
+- **Unchanged:** objects and items of enabled packages, and every other fall-through.
+
+What changes for you: re-enable the package to read the object or item again.

content/docs/ai/agents.mdx

@@ -65,7 +65,20 @@ SKILL.md download (`GET /api/v1/mcp/skill`), and API-key minting.
   private deployments work out of the box**. You authorize the client in the
   browser; it then acts as an **agent on your behalf** (`principalKind: 'agent'`),
   its **data access** bounded by the **intersection** of the consent scopes and
-  your own permissions/RLS — it can never exceed either. For object CRUD the
+  your own permissions/RLS — it can never exceed either. The agent acts in
+  **one organization**: the one you had selected when you consented, carried
+  in the token as its `organization_id` claim. Your grants scoped to that
+  organization count for it; grants scoped to your other organizations do not
+  (select the other organization and authorize the client again to work
+  there). Your membership is re-checked on every request by the rule a
+  browser session's organization gets: under an organization wall (`isolated`
+  or `group` tenancy) a token whose organization you no longer belong to falls
+  back to **no organization**, so only your global grants apply — under
+  `isolated`, a former member's agent gets an **empty `200`** on reads and a
+  refusal on writes to organization data. Under `single` (no wall) the
+  organization stands as consented, as a session's does. A token issued
+  before consents carried an organization holds your global grants only until
+  you re-confirm the consent once. For object CRUD the
   consent scopes (`data:read`, `data:write`) are a real ceiling, not just a
   tool-family filter: they narrow the exposed tools **and** cap what the agent
   can do at the data layer — a `data:read` token can never write a record even

packages/metadata-protocol/src/protocol.ts

@@ -533,6 +533,35 @@ function isObjectOfDisabledPackage(registry: any, name: string): boolean {
         && registry.isObjectPackageDisabled(name) === true;
 }
 
+/**
+ * [#7557, #24210] Whether `item` belongs to a disabled package: its
+ * `_packageId`, asked of `registry.isPackageDisabled`. The ONE predicate for a
+ * non-object item, asked by the list read ({@link
+ * ObjectStackProtocolImplementation.getMetaItems}, which omits the item) and
+ * the by-name read ({@link ObjectStackProtocolImplementation.getMetaItem},
+ * which answers as for a name with nothing behind it), so the two cannot
+ * disagree about which items a disable hides. Optional-called, as {@link
+ * isObjectOfDisabledPackage} is: a host whose registry cannot answer has no
+ * item hidden.
+ */
+function isItemOfDisabledPackage(registry: any, item: unknown): boolean {
+    return typeof registry?.isPackageDisabled === 'function'
+        && registry.isPackageDisabled((item as { _packageId?: unknown } | null | undefined)?._packageId) === true;
+}
+
+/**
+ * The strict draft read's `404 NO_DRAFT`: no pending draft at this address
+ * (ADR-0005 §draft-lifecycle). [#24210] One constructor for the read that
+ * finds no draft row and the read of a disabled package's draft, so the two
+ * answers are byte-identical.
+ */
+function noPendingDraftError(type: string, name: string): Error & { code: 'NO_DRAFT'; status: 404 } {
+    const err = new Error(`No pending draft exists for ${type}/${name}.`) as Error & { code: 'NO_DRAFT'; status: 404 };
+    err.code = 'NO_DRAFT';
+    err.status = 404;
+    return err;
+}
+
 /**
  * [#17501] Does a converted JSON Schema carry any authorable surface at all?
  *
@@ -10375,10 +10404,11 @@ export class ObjectStackProtocolImplementation implements
         // `assertObjectRegistered` (`OBJECT_PACKAGE_DISABLED`) — absence here
         // and refusal there are the two halves of one answer, pinned together
         // by `protocol.package-disable-enforcement.test.ts`.
+        //
+        // [#24210] The predicate is {@link isItemOfDisabledPackage}, the one the
+        // by-name read asks, so the list and the by-name read hide the same items.
         if (request.type !== 'package') {
-            items = (items as any[]).filter(
-                (it) => !this.engine.registry.isPackageDisabled((it as any)?._packageId),
-            );
+            items = (items as any[]).filter((it) => !isItemOfDisabledPackage(this.engine.registry, it));
         }
 
         // Canonical-shape exposure (ADR-0017, "Object has-many View"): a
@@ -11046,6 +11076,19 @@ export class ObjectStackProtocolImplementation implements
      * that must still see the object (the save's destructive-change check)
      * read {@link readMetaItem}, the shared body, instead: the reader-class
      * split `package-disable-enforcement.test.ts` pins.
+     *
+     * [#7557, #24210] Every other type but `package` has no data plane, so a
+     * disabled package's item is answered as ABSENT, the answer a name with
+     * nothing behind it gets: the list read omits that item, by the same
+     * predicate ({@link isItemOfDisabledPackage}) asked of the item this read
+     * resolved, in every state. The strict draft read throws the missing
+     * draft's `404 NO_DRAFT`. The other reads serve no `item`, which both
+     * transports answer `404 RESOURCE_NOT_FOUND`, byte for byte the missing
+     * name's answer, and drop `registration`, the engine's verdict on a served
+     * flow. The protection envelope stays: it reports the write doors'
+     * verdicts about this address (#21670), and a disable does not change how
+     * the lock gate judges a save there. `package` is never hidden, so a
+     * disabled package can still be read and re-enabled.
      */
     async getMetaItem(request: {
         type: string, name: string, packageId?: string, state?: 'active' | 'draft', previewDrafts?: boolean,
@@ -11057,7 +11100,14 @@ export class ObjectStackProtocolImplementation implements
         if (request.type === 'object' && isObjectOfDisabledPackage(this.engine?.registry, request.name)) {
             throw objectPackageDisabledError(request.name);
         }
-        return this.readMetaItem(request);
+        const answer = await this.readMetaItem(request);
+        if (request.type === 'object' || request.type === 'package'
+            || !isItemOfDisabledPackage(this.engine?.registry, answer?.item)) {
+            return answer;
+        }
+        if (request.state === 'draft') throw noPendingDraftError(request.type, request.name);
+        const { item: _withheld, registration: _servedOnly, ...envelope } = answer as typeof answer & { registration?: unknown };
+        return { ...envelope, item: undefined };
     }
 
     /**
@@ -11292,14 +11342,7 @@ export class ObjectStackProtocolImplementation implements
         // status code to decide "no pending edit" without sniffing
         // envelope shape. See ADR-0005 §draft-lifecycle.
         if (readState === 'draft') {
-            if (item === undefined) {
-                const err: any = new Error(
-                    `No pending draft exists for ${request.type}/${request.name}.`,
-                );
-                err.code = 'NO_DRAFT';
-                err.status = 404;
-                throw err;
-            }
+            if (item === undefined) throw noPendingDraftError(request.type, request.name);
             return {
                 type: request.type,
                 name: request.name,