@@ -0,0 +1,39 @@
+---
+'@objectstack/spec': minor
+---
+
+feat(spec)!: retire the view-level `api` data source — a view binds its object or static rows, and a metadata-declared API call is the page element's binding (#23082)
+
+**BREAKING** — `provider: 'api'` on a view's `data` (`ViewDataSchema`, with its `read` / `write` request blocks) is now refused at parse. The arm took any `url` and any `headers`, so a credential or a cross-origin call written into a view was stored as metadata, served to every client that read the view and sent by the console as written. The page element's API binding (`ElementApiDataSourceSchema`, `dataSource` on a page component) is the one door for a metadata-declared API call: same-origin, no credential key, read with the console's own signed-in fetch. One operation with two implementations that behave differently keeps the governed one — the view-level source is re-homed on the page element and removed, not aligned.
+
+Clause-②: no (narrowing)
+
+Measured before removal: no producer wrote `provider: 'api'` on a view outside documentation in objectstack (`bcebd8409`), objectui (`origin/main` `f228d710` — the console's approval-requests source builds `ApiDataSource` in code from an `ApiDataSourceConfig`, never a `ViewData`) or hotcrm (`0f84c9c`), each with a lit `provider: 'object'` control. A renderer reader existed at the objectui pin (`ListView` routed the block to `ApiDataSource`; `ObjectGantt` built one from `read` / `write`) and is now unreachable from authored metadata.
+
+## FROM → TO
+
+| you wrote (17.7 and earlier) | write instead |
+| --- | --- |
+| `data: { provider: 'api', read: { url, method?, params?, headers? } }` on a list or form view | `data: { provider: 'object', object: '<object_name>' }` (or `{ provider: 'value', items: [...] }`), and the read as a page component's `dataSource: { provider: 'api', read: { url: '/api/...' }, path? }` |
+| `data: { provider: 'api', write: { url, method, body? } }` on a form view | nothing — a form submits to its object; a submit-to-endpoint is not a view concern |
+| `read.headers: { Authorization: '...' }` | nothing — a credential never lives in metadata; the page element binding refuses a credential key and the console sends its signed-in fetch |
+
+**The one-line fix:** bind every `provider: 'api'` view to its object or to static rows, and move the endpoint read onto a page component's `dataSource`.
+
+**What an author who still writes it sees.** `tsc` fails at the authoring site (`ViewData` no longer has the arm), and the parse — `defineView()`, `defineStack({ views })`, `os validate`, `PUT /api/v1/meta/view/:name` — refuses it at `data.provider` with the prescription:
+
+> `view.data.provider: 'api'` was removed in @objectstack/spec 17.8.0 (ADR-0049 enforce-or-remove) — a view-level API source took any `url` and any `headers`, so a credential or a cross-origin call written there was stored with the view, served to every client that read it and sent by the console as written; a metadata-declared API call now has one door, the page element's binding, which is same-origin and credential-free. Bind the view to its object — `data: { provider: 'object', object: '<object_name>' }` — or to static rows — `data: { provider: 'value', items: [...] }` — and move the API read onto a page component: `dataSource: { provider: 'api', read: { url: '/api/...' } }` (with an optional `path` into the response) under a page's `regions[].components[]`, which the console reads with its own signed-in fetch.
+
+## The retirement kit
+
+- **A value retirement, not a key**: `data` survives one arm lighter, so there is no `retiredKey()` tombstone and no `RETIRED_KEYS_BY_MAJOR` row. The prescription rides the discriminated union's own `error` map, keyed on the input's `provider === 'api'` — the retired bare-string `sort` clause's shape — so every other unknown provider keeps zod's own report, which lists the live arms (`object`, `value`, `schema`).
+- **No D2 conversion, deliberately.** The replacement lives on a different metadata type (a page element), and the only mechanical edit a conversion could make — deleting the view's `data` so the view falls back to querying its bound object — would change what the view shows without telling anyone. An authored source or a stored `sys_metadata` row still carrying the arm meets the prescription at parse instead.
+- **The D3 entry `view-data-api-provider-retired`** asks the author, per such view, which page composes the endpoint it read and what the view itself should now bind.
+- **`HttpRequestSchema` / `HttpMethodSubsetSchema` stay exported** from `@objectstack/spec/shared` and `@objectstack/spec/ui`, unchanged. After this change no schema in the package composes `HttpRequestSchema`; that orphan is recorded, not acted on here.
+- **Ledger:** `view.list.data` and `view.form.data` stay `live` (their surviving arms are read) and carry the arm's retirement record.
+- **Docs and the published skill** no longer teach a view-level `api` source; both point at the page element binding.
+- **No deprecation window**, per the project's startup-stage posture.
+
+⚠️ **The out-of-repo consumer population is NOT MEASURED.** `@objectstack/spec` is published, and `objectstack-ai/cloud`'s own view metadata was not readable from this change's session; a cloud view carrying an `api` source is refused at parse with the prescription above.
+
+<!-- adr-0087: registered view-data-api-provider-retired -->
@@ -294,25 +294,26 @@ writing it by hand would smuggle an action definition past the action registry.
 
 ### Data Source
 
-Views can load data from several sources (`object`, `api`, `value`, and `schema`):
+Views can load data from several sources (`object`, `value`, and `schema`):
 
 ```typescript
 // From an Object (most common)
 data: { provider: 'object', object: 'task' }
 
-// From an external API
-data: {
-  provider: 'api',
-  read: { url: '/api/external/tasks', method: 'GET' },
-}
-
 // Static values
 data: {
   provider: 'value',
   items: [{ id: '1', name: 'Item 1' }],
 }
 ```
 
+A view does not call an API. The view-level `api` data source — a `read` / `write`
+request block with its own `url` and `headers` — was retired: it let a credential or
+a cross-origin call be written into metadata and served with the view. A
+metadata-declared API call is a **page element's** `dataSource` binding, which is
+same-origin, carries no credentials and is read with the console's signed-in fetch —
+see [Element data sources](/docs/ui/pages#element-data-sources).
+
 ### Type-Specific Configuration
 
 Each non-grid visualization reads its settings from a **nested config block
 
@@ -877,7 +877,9 @@ describe('#14107 — the skips', () => {
   });
 
   it('skips a list view whose provider is not `object`', () => {
-    const stack = stackWith(mutate({ data: { provider: 'api', endpoint: '/x' }, columns: ['nope'] }));
+    // A `value` source: the one non-`object` provider a list view can still
+    // bind (the `api` arm is retired, and `schema` is form-only).
+    const stack = stackWith(mutate({ data: { provider: 'value', items: [] }, columns: ['nope'] }));
     expect(validateListViewFieldRefs(stack)).toEqual([]);
   });
 
 
@@ -435,8 +435,9 @@ describe('validatePresetComparands — arm 2, the FIELD-TYPED equality / members
         ],
       }],
       views: [
-        // A non-`object` provider names no fields on any object graph.
-        { name: 'api', data: { provider: 'api', object: 'crm_opportunity' }, filter: [{ field: 'close_date', operator: 'equals', value: 'last_30_days' }] },
+        // A non-`object` provider names no fields on any object graph (the
+        // `value` arm; the view-level `api` arm is retired).
+        { name: 'static', data: { provider: 'value', items: [] }, filter: [{ field: 'close_date', operator: 'equals', value: 'last_30_days' }] },
         // No binding at all.
         { name: 'unbound', filter: [{ field: 'close_date', operator: 'in', value: ['last_30_days'] }] },
       ],
 
@@ -38,7 +38,10 @@
         },
         "data": {
           "status": "live",
-          "note": "objectui: ListView.tsx:841-850 fetch effect supports ViewDataSchema provider modes ('value' inline, 'api'; gantt owns api-provided data at :476). Supersedes the 2026-06 audit's 'api/schema dead in list path'. The 'schema' provider remains form/metadata-admin-only — not honored on lists."
+          "evidenceScope": "cross-repo",
+          "verifiedAt": "2026-10-13",
+          "evidence": "objectui @7578323a544e (the pin): packages/plugin-list/src/ListView.tsx reads `schema.data.provider` in its fetch effect (`value` rows are charted inline; a gantt is handed the whole `data` block) and packages/plugin-gantt/src/ObjectGantt.tsx resolves `data` through `resolveDataSource`; framework: packages/spec/src/ui/view.zod.ts#ViewDataSchema",
+          "note": "objectui: ListView.tsx fetch effect supports the ViewDataSchema provider modes it is handed ('value' inline; the gantt owns its data block). Supersedes the 2026-06 audit's 'api/schema dead in list path'. The 'schema' provider remains form/metadata-admin-only — not honored on lists. RETIREMENT RECORD (2026-10-13, ADR-0049 enforce-or-remove, maintainer ruling 2026-10-12 letter C): the `api` provider VALUE left ViewDataSchema — refused by name on the union's own error map (`VIEW_DATA_API_PROVIDER_RETIRED`), no tombstone key, no D2 conversion, D3 `view-data-api-provider-retired`. A renderer reader EXISTED at the pin (ListView.tsx routed an `api` block to `ApiDataSource`; ObjectGantt.tsx built one from the block's `read`/`write`) and is now unreachable from authored metadata: zero producers wrote the value outside documentation in objectstack (bcebd8409), objectui (origin/main f228d710 — the console's approval-requests source constructs `ApiDataSource` in code from an `ApiDataSourceConfig`, never a `ViewData`) and hotcrm (0f84c9c), each with a lit `provider: 'object'` control. This key stays `live` because the surviving arms are read; the arm's record sits on this row because the walk never descends a union arm."
         },
         "columns": {
           "status": "live",
@@ -263,7 +266,7 @@
           "status": "live",
           "verifiedAt": "2026-07-30",
           "evidence": "packages/spec/src/ui/view.zod.ts defineForm (writes data.provider=schema + schemaId onto every metadata form); packages/metadata-protocol/src/protocol.ts:1580,1598 (serves schemaId with the form to the metadata-admin pipeline)",
-          "note": "CORRECTED 2026-07-30: the #3896 sweep attempted removal on the prior dead verdict and the build itself refuted it — defineForm authors the key on every *.form.ts. The record-form provider VALUES (object/api/value) may still lack readers; that is a value-subset audit, not a key removal."
+          "note": "CORRECTED 2026-07-30: the #3896 sweep attempted removal on the prior dead verdict and the build itself refuted it — defineForm authors the key on every *.form.ts. The record-form provider VALUES (object/value) may still lack readers; that is a value-subset audit, not a key removal. 2026-10-13: the `api` value is RETIRED on the union itself (see `list.data`'s retirement record) — a form's `data` no longer admits a request block; a submit-to-endpoint is not a view concern."
         },
         "type": {
           "status": "live",
 
@@ -0,0 +1,38 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+import type { SemanticMigration } from '../../types.js';
+
+// ADR-0049 enforce-or-remove; maintainer ruling 2026-10-12 (letter C: retire
+// the view-level `api` data source, not align it to the page element's rule).
+// The `provider: 'api'` arm of `ViewDataSchema` carried `read` / `write`
+// request blocks of any `url` and any `headers`, so a credential or a
+// cross-origin call written into a view was stored as metadata, served to
+// every client that read the view and sent by the console as written. The
+// page element's API binding is the one governed door for a metadata-declared
+// API call (same-origin, credential-free, the console's own signed-in fetch);
+// one operation with two implementations that behave differently keeps the
+// governed one. No D2 conversion: the replacement lives on a different surface
+// and the only mechanical edit — deleting the view's `data` — would silently
+// change what the view shows, so an author or a stored row still carrying the
+// arm is refused at parse with the prescription instead.
+export const entry: SemanticMigration = {
+  id: 'view-data-api-provider-retired',
+  surface: "view.data (`provider: 'api'`, with its `read` / `write` request blocks) — the view-level API data source",
+  replacement: "A view binds its object (`provider: 'object'`) or static rows (`provider: 'value'`); the API read "
+    + "moves onto a page component's `dataSource` binding — `{ provider: 'api', read: { url }, path? }` under a "
+    + "page's `regions[].components[]` — which is same-origin, carries no credentials and is read with the "
+    + "console's signed-in fetch.",
+  reason: 'There is no mechanical rewrite. The replacement is a binding on a different metadata type (a page '
+    + "element, not a view), and the one edit a conversion could make — deleting the view's `data` so the "
+    + 'view falls back to querying its bound object — would change what the view shows without telling '
+    + 'anyone. So the parse refuses the arm by name with the prescription, for an authored source and for a '
+    + 'stored row alike, and the author decides for each such view which page composes the endpoint it '
+    + "read and what the view itself should now bind. The arm's `headers` block is the part with no "
+    + "successor at all: a key an author had written there was a credential in metadata, and the page "
+    + 'element binding refuses the key; the console sends its own signed-in fetch instead.',
+  acceptanceCriteria: "No view in `stack.views[]`, in any object's `listViews` / `formViews` map or in a stored "
+    + "`sys_metadata` view row carries `data.provider: 'api'`; the parse refuses one with the prescription. "
+    + "Every endpoint such a view read is either a page component's API binding on a same-origin path "
+    + 'with no credential key, or dropped on purpose; and every converted view binds its object or static '
+    + 'rows and loads.',
+};
@@ -3110,6 +3110,24 @@ const STEP18_RATIONALE: readonly RationaleFragment[] = [
       + 'offered a block `chart` input until this change); it is retired from the load path, so '
       + 'authors are refused at parse rather than rewritten.',
   },
+  {
+    id: 'view-data-api-provider-retired',
+    order: 95,
+    text:
+      "It also retires the view-level `api` data source — the `provider: 'api'` arm of `ViewDataSchema`, "
+      + 'with its `read` / `write` request blocks (ADR-0049 enforce-or-remove; maintainer ruling 2026-10-12, '
+      + 'letter C). The arm took any `url` and any `headers`, so a credential or a cross-origin call written '
+      + 'into a view was stored as metadata, served to every client that read the view and sent by the '
+      + "console as written, while the page element's API binding — the newer door for a metadata-declared "
+      + 'API call — is same-origin, credential-free and read with the console\'s own signed-in fetch. One '
+      + 'operation with two implementations that behave differently keeps the governed one: a view now binds '
+      + "its object or static rows, and an API read is a page component's `dataSource` binding. Measured "
+      + 'before removal: no producer wrote the arm outside documentation in objectstack, objectui or hotcrm. '
+      + 'The arm is refused by name on the union\'s own error map, with no `retiredKey()` tombstone (a value '
+      + 'left, not a key) and no D2 conversion (the replacement lives on another surface, and deleting the '
+      + "view's `data` would silently change what it shows); its D3 record is the semantic entry "
+      + '`view-data-api-provider-retired`.',
+  },
   {
     id: 'view-item-owner-hidden-retired',
     order: 37,
 
@@ -202,11 +202,11 @@ const EXPRESSION_AST: Reason = {
   owner: 'shared/expression.zod.ts `ExpressionSchema.ast`',
   why: 'the engine-native AST `objectstack compile` fills beside `source` — opaque at the spec layer by design; each engine validates its own shape',
 };
-const HTTP_REQUEST: Reason = {
-  kind: 'shared',
-  owner: 'shared/http.zod.ts `HttpRequestSchema`',
-  why: 'the query parameters and request body an `api` data source sends, forwarded verbatim to the endpoint the author names; their shape is that endpoint\'s',
-};
+// `HTTP_REQUEST` — the `data.read.params{}` / `data.read.body` /
+// `data.write.*` members `HttpRequestSchema` carried into every record-source
+// block — left this ledger with the view-level `api` data source (ADR-0049,
+// maintainer ruling 2026-10-12 letter C): the `api` arm of `ViewDataSchema` is
+// retired, so no `data` member reaches a request block any more.
 const INLINE_JSON_SCHEMA: Reason = {
   kind: 'shared',
   owner: 'ui/view.zod.ts `ViewDataSchema` (`provider: \'schema\'`)',
@@ -280,7 +280,6 @@ on(['action:button', 'action:icon'], ACTION_RUNNER_PATHS, RUNNER);
 on(['action:group', 'action:menu'], ACTION_RUNNER_PATHS.map((p) => `actions[].${p}`), RUNNER);
 
 // The data-source binding every record-source block shares.
-on(VIEW_DATA_TYPES, ['data.read.params{}', 'data.read.body', 'data.write.params{}', 'data.write.body'], HTTP_REQUEST);
 on(VIEW_DATA_TYPES, ['data.items[]'], RECORDS);
 on(VIEW_DATA_TYPES, ['data.schema{}'], INLINE_JSON_SCHEMA);
 
@@ -418,14 +417,15 @@ describe('§2 each recorded reason holds', () => {
     }
   });
 
-  it('a `shared` member really is the owner\'s: an `ast` beside a `source`, a request beside a `url`', () => {
+  it('a `shared` member really is the owner\'s: an `ast` beside a `source`', () => {
     for (const [key, reason] of entries) {
       if (reason !== EXPRESSION_AST) continue;
       expect(key, 'an expression-AST line names the `ast` member').toMatch(/\.ast$/);
     }
-    for (const [key, reason] of entries) {
-      if (reason !== HTTP_REQUEST) continue;
-      expect(key, 'an HTTP-request line names `params` or `body` under `read` / `write`').toMatch(/ data\.(read|write)\.(params\{\}|body)$/);
+    // No `data.read.*` / `data.write.*` line may come back: the request block
+    // left the record-source blocks with the retired view-level `api` source.
+    for (const [key] of entries) {
+      expect(key, 'a request-block member on a record-source block means the retired `api` arm is being undone').not.toMatch(/ data\.(read|write)\./);
     }
   });
 });