fix(runtime)!: the dispatcher's PATCH /data/:object/:id honours a body expectedVersion and If-Match, as RestServer's twin does

Claude-Session: https://claude.ai/code/session_01Q9PZ5Pzqcus4woVvTZwWNU
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/runtime/src/action-execution.ts

@@ -364,8 +364,34 @@ export async function callData(deps: ActionExecutionDeps,
     }
 
     if (action === 'update') {
+        // [#23462] `expectedVersion` rides through to `updateData`, whose
+        // version check refuses a stale update. This arm forwarded only
+        // `{ object, id, data }`, so a token the `/data` domain read was
+        // dropped here a second time. Present only when a caller sent one:
+        // every other caller hands `{ object, id, data }` and reaches
+        // `updateData` as before. The `delete` arm below does the same.
+        const expectedVersion = params?.expectedVersion;
         if (protocol && typeof protocol.updateData === 'function') {
-            return await protocol.updateData({ object: params.object, id: params.id, data: params.data, ...(scopeId ? { environmentId: scopeId } : {}), context: executionContext });
+            return await protocol.updateData({
+                object: params.object,
+                id: params.id,
+                data: params.data,
+                ...(expectedVersion !== undefined ? { expectedVersion } : {}),
+                ...(scopeId ? { environmentId: scopeId } : {}),
+                context: executionContext,
+            });
+        }
+        // [#23462] The fallback below updates by id and nothing else, so it
+        // cannot judge a version. A caller who sent one is refused `501`
+        // before anything is read, never updated unguarded: that is the very
+        // drop the arm above just closed. The `delete` arm's fallback refuses
+        // it the same way.
+        if (expectedVersion !== undefined) {
+            throw {
+                statusCode: 501,
+                message: 'This host has no protocol updateData, so it cannot honour expectedVersion or If-Match on an '
+                    + 'update. Send the update without them, or update through a host whose protocol implements updateData.',
+            };
         }
         if (ql && params.id && typeof ql.update === 'function') {
             let all = await ql.find(params.object, findOpts({ where: { id: params.id }, limit: 1 }));

packages/runtime/src/domains/data.ts

@@ -162,8 +162,31 @@ export async function handleDataRequest(deps: DomainHandlerDeps, path: string, m
         // PATCH /data/:object/:id
         if (parts.length === 2 && m === 'PATCH') {
             const id = parts[1];
+            // [#23462] The optimistic-concurrency token, read the way
+            // `RestServer`'s twin of this route reads it: the body's
+            // `expectedVersion`, else `If-Match`, and forwarded to `updateData`,
+            // which refuses an update whose version moved (`409
+            // CONCURRENT_UPDATE`). This branch read neither and handed the
+            // whole body over as the patch, so through the `@objectstack/hono`
+            // catch-all a stale `If-Match` update was APPLIED, and a body
+            // `expectedVersion` reached the engine as a field it refused as
+            // unknown. The key is stripped from the patch whatever its value,
+            // and a token is forwarded only when truthy: the twin's own
+            // statements, so both doors send `updateData` the same thing.
+            const bodyVersion = (body && typeof body === 'object') ? body.expectedVersion : undefined;
+            const expectedVersion = bodyVersion ?? requestIfMatch(_context.request?.headers);
+            let data = body;
+            if (body && typeof body === 'object' && 'expectedVersion' in body) {
+                const { expectedVersion: _token, ...patch } = body;
+                data = patch;
+            }
             // Spec: returns UpdateDataResponse = { object, id, record }
-            const result = await actionExec.callData(deps, _context, 'update', { object: objectName, id, data: body }, _context.dataDriver, _context.environmentId, _context.executionContext);
+            const result = await actionExec.callData(deps, _context, 'update', {
+                object: objectName,
+                id,
+                data,
+                ...(expectedVersion ? { expectedVersion: String(expectedVersion) } : {}),
+            }, _context.dataDriver, _context.environmentId, _context.executionContext);
             return { handled: true, response: deps.success(result) };
         }