Merge remote-tracking branch 'origin/main' into claude/project-thread-gru6pg

Author: claude

.changeset/25203-adr-0131-small-carriers.md

@@ -0,0 +1,16 @@
+---
+'@objectstack/plugin-sharing': patch
+'@objectstack/plugin-security': patch
+'@objectstack/cli': patch
+'@objectstack/spec': patch
+---
+
+fix(plugin-sharing): the declared-rule organization walk ends on the rows read, and a row with no readable id answers unknown; texts that still described the retired NULL-organization reading are corrected
+
+Clause-②: no
+Metadata-protocol: none
+
+- **`@objectstack/plugin-sharing`.** The boot's organization walk for declared sharing-rule scopes (`resolveDeclaredRuleScopes`) judged "short page, stop" on the ids it kept, so a full page of `sys_organization` holding one row with no readable `id` ended the walk early and served a partial list, and the boot sweep then revoked the declared-rule grants of every organization past it. The walk now ends on the number of rows READ, and such a row makes the answer unknown: declared rules are served in no organization until the next boot and no declared rule's grant is revoked, with a warning that names the cause. Under the shipped schema every organization row has a text id, so no install is expected to see the new warning.
+- **`@objectstack/plugin-security`.** The Organization help on `sys_user_position` and `sys_user_permission_set` no longer says an empty value means "global" or "applies in every org context". A grant or assignment applies only in its own organization, and one with no organization applies nowhere. The four locale bundles carry the new text.
+- **`@objectstack/cli`.** `os migrate organization-ownership`'s warning about rows whose owner cannot be derived reads "…while one stays NULL, except on a table whose column is not the tenancy anchor." where it read "(but on a table …)".
+- **`@objectstack/spec`.** Wording only, no schema moves: the upgrade guide's `driver-read-scope-follows-tenant-wall` entry names update and delete "by id or by predicate"; the `sharing-rule-declared-mirror-retired` entry no longer paraphrases ADR-0131 D13 as asking an entry of every retirement; `IEmailService`'s `organizationId` TSDoc no longer says an absent value leaves the row unstamped (the engine stamps the derivable organization or refuses the insert); a TSDoc citation in `schedule-organization.zod.ts` names the run store instead of a deleted file.

.changeset/25208-default-organization-one-definition.md

@@ -0,0 +1,22 @@
+---
+'@objectstack/core': patch
+'@objectstack/plugin-auth': patch
+'@objectstack/plugin-security': patch
+'@objectstack/cli': patch
+---
+
+fix(core,plugin-auth)!: the last-admin guard judges a `sys_organization` insert that moves the Default Organization, and one definition of the Default Organization is exported from core
+
+Clause-②: yes (narrowing)
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any metadata schema is removed, renamed or re-shaped, so there is nothing for `objectstack migrate meta` to rewrite and no tombstone. The narrowing is one more organization write the last-administrator guard refuses at runtime. -->
+
+**BREAKING** for a `single`-posture deployment whose only organization is not slugged `default` and whose last administrator holds nothing but the Default Organization's `admin_full_access` grant.
+
+- **`registerLastAdminGuard` (`@objectstack/plugin-auth`) now judges a `sys_organization` insert.** Under `single` the Default Organization is the one slugged `default`, else the only one, and its `admin_full_access` grant is what makes the platform administrator one (ADR-0131 D5). Adding an organization can move it with no grant touched: a second organization beside a sole one with another slug leaves none, and a new one slugged `default` takes its place.
+  - FROM: the insert was admitted. The administrator lost platform standing in silence, and the guard then admitted a ban or delete of that same administrator, because it no longer counted anyone.
+  - TO: the insert is refused (`PERMISSION_DENIED`, 403, on `sys_organization`) when it would leave nobody who can sign in and administer. An organization owner or admin, an `OS_PLATFORM_OWNER_EMAIL` administrator, or a Default Organization slugged `default` (which a new organization cannot move) admits it, as on the update and delete halves. Under a wall no grant anchors, so the insert is admitted and costs no reads.
+- **One definition of the Default Organization (`@objectstack/core`).** New exports: `findDefaultOrganization(read)` (the rule, over a read the caller supplies), `DEFAULT_ORGANIZATION_SLUG`, and `readDefaultOrganizationId(ql)` (the resolver's own read, which fails loud on an unreachable store). plugin-auth's boot invariant, default-organization bootstrap, tenancy service and last-admin guard, plugin-security's `resolveDefaultOrganizationId`, and the ownership ceremony's plan now name the organization through it. Each keeps its own read policy: whether a failed read throws or reads as none, the guard's simulation of a pending write, and the ceremony's raw SQL. Two edge answers align with the resolver's. A `default`-slugged row with a blank id now falls through to the only-organization reading in the ceremony's plan. A numeric id is now read as its string in plugin-security's reader.
+
+**What an operator does.** Before you create a second organization on a `single` deployment whose only organization has another slug, either give that organization the slug `default` (while it is the only one, that changes nothing else), or make sure another account can administer: an organization owner or admin, or an address in `OS_PLATFORM_OWNER_EMAIL`.

.changeset/console-0d12e95361b2.md

@@ -0,0 +1,19 @@
+---
+"@objectstack/console": patch
+---
+
+Console (objectui) refreshed to `0d12e95361b2`. Frontend changes in this range:
+
+Derived from the changesets objectui declared over the range — 2 releasing of 3 changesets added across 5 non-merge commits; omitted: 1 release-nothing changeset, 2 commits carrying no changeset (they ship no package code).
+
+- **minor** — An approver who is not an administrator sees the whole approval request page again: its fields, its decision panel with the decisions they may take, and its Timeline (objectui#133… (objectui `0d12e9536`)
+- **patch** — Setup → Datasources offers "Sync objects" only on a datasource that can be synced (objectui#13318). (objectui `b8fa2237d`)
+
+**In this console build, declared nowhere** — objectui merged 2 commits in this range with no `.changeset/*.md`. The code is inside the pin above and ships here, but nothing upstream declared them, so they appear in no objectui CHANGELOG and in no entry above. Listed by subject rather than counted, because a count cannot tell a dependency bump from a form-behaviour change (objectstack#6174); the upstream gate that would prevent this is objectui#3387.
+
+- _(no changeset)_ fix(pin): the missing-entry remedy builds with declarations whatever OS_SKIP_DTS is exported (#13325) (objectui `74ebad095`)
+- _(no changeset)_ fix(hooks): port subst_end() into guard-main-checkout-bash (objectstack 7e40e8a03 and 338297e46) (#13320) (objectui `1aa88519a`)
+
+Metadata-protocol: none (the console refresh changes no key, value or type a metadata author writes)
+
+objectui range: `cd14d8eeffe1...0d12e95361b2`

.objectui-sha

@@ -1 +1 @@
-cd14d8eeffe11ae03b6acf82e663c1d293dfdf5f
+0d12e95361b20b1eb9012f97d2d36e5fa7f14374

content/docs/permissions/tenant-audit-census.mdx

@@ -46,8 +46,10 @@ now costs nothing, and the population is **re-derivable** rather than quoted.
 `auditMissingTenant(object, op, options)` is gated in this order:
 
 1. `OS_TENANT_AUDIT=0` — off entirely;
-2. `options.bypassTenantAudit` — the engine sets this for **every**
-   `ExecutionContext.isSystem` write (ObjectQL's `buildDriverOptions`);
+2. `options.bypassTenantAudit` — on an `ExecutionContext.isSystem` write the
+   engine sets it only where the object's schema puts the write out of scope:
+   an object with no tenant field, or a federated one (ObjectQL's
+   `buildDriverOptions`). A caller may still pass it explicitly;
 3. a present `options.tenantId` — the engine fills it from `execCtx.tenantId`;
 4. the deployment posture — the warning is only meaningful on a walled install;
 5. the object having a tenant field.

content/docs/references/automation/schedule-organization.mdx

@@ -76,8 +76,8 @@ multi-plant MES example is the ADR's own). It does not.
 `sys_automation_run` has ALREADY been ruled to use: `ObjectStoreSuspendedRunStore`
 resolves a run's organization as `organizationOf(<subject record>) ?? ctx.tenantId`
 — subject first, the acting context as the fallback and *never* the primary
-(`objectql/src/tenancy/platform-object-tenancy.ts`, the `sys_automation_run`
-evidence line). Before this card the two halves disagreed under `group`: the
+(`service-automation/src/suspended-run-store.ts`, where the store stamps a
+run's row). Before this card the two halves disagreed under `group`: the
 history row was stamped from the record while the inbox and delivery rows
 followed an acting context that could not exist there, so they were refused.
 Filling the acting context from the record makes one run carry ONE

packages/cli/src/commands/migrate/organization-ownership.ts

@@ -632,7 +632,7 @@ export default class OrganizationOwnershipCeremony extends Command {
       printWarning(
         `${summary.unattributableRows} row(s) whose owner cannot be derived are listed by id, with why, in the plan ` +
           'file. The ceremony neither guesses their owner nor deletes them, and --apply does not certify the database ' +
-          'while one stays NULL (but on a table whose column is not the tenancy anchor): assign each its ' +
+          'while one stays NULL, except on a table whose column is not the tenancy anchor. Assign each its ' +
           'organization, or delete it by hand, before or after --apply, and re-run it.',
       );
     }
@@ -1121,7 +1121,7 @@ export default class OrganizationOwnershipCeremony extends Command {
     }
     console.log('');
     // Unattributable rows hold certification (ruling C on ADR-0131 D10 fate
-    // 4) but on a table whose column is not the tenancy anchor; `advisory`
+    // 4), except on a table whose column is not the tenancy anchor; `advisory`
     // counts those and the advisory departures, each said in its own terms.
     const unattributableHeld = report.tables.reduce((n, t) => n + (t.held?.rows ?? 0), 0);
     const unattributableReported = report.tables.reduce((n, t) => n + t.unattributable.length, 0) - unattributableHeld;