@objectstack/core 17.0.0-rc.0 → 17.0.0-rc.1

package/CHANGELOG.md

@@ -0,0 +1,3047 @@
+# @objectstack/core
+
+## 17.0.0-rc.1
+
+### Minor Changes
+
+- 32ccb23: feat(spec,core,runtime)!: ADR-0112 batch 1 — one error-code vocabulary, SCREAMING_SNAKE, schema-enforced (#3841)
+
+  Settles #3841 per ADR-0112: the top-level `error.code` vocabulary is
+  SCREAMING_SNAKE, in two tiers.
+
+  - **`StandardErrorCode` members renamed in place** (`validation_error` →
+    `VALIDATION_ERROR`, all 53). Breaking for importers that branch on the old
+    lowercase members; the type name and member _meanings_ are unchanged.
+  - **New `ERROR_CODE_LEDGER`** (`@objectstack/spec/api`): service-specific codes
+    (`AUTH_REQUIRED`, `VALIDATION_FAILED`, `ATTACHMENT_DOWNLOAD_DENIED`, …) are
+    registered per owning package. `ErrorCode` = standard ∪ registered.
+  - **`ApiErrorSchema.code` is now `ErrorCode`**, not `z.string()` — an
+    unregistered code fails parse, so the envelope conformance suites assert
+    values, not just shape.
+  - **`FieldErrorSchema.code` widened to `z.string()`** (ADR-0112 D6): field-level
+    codes are a separate vocabulary the enum never described; #3977 owns its real
+    catalog.
+  - **Derived codes changed case on the wire**: `standardErrorCodeForHttpStatus`
+    now yields SCREAMING members (`permission_denied` → `PERMISSION_DENIED`,
+    `method_not_allowed` → `METHOD_NOT_ALLOWED`, …) — this map was #3842's
+    designated one-file sweep point for exactly this decision.
+  - **`ANONYMOUS_DENY_CODE` is `'UNAUTHENTICATED'`** (was `'unauthenticated'`) —
+    the promoted code on anonymous-denied requests and the REST `enforceAuth`
+    body change spelling with it.
+
+  `error-catalog.mdx` and the error-handling guides are rewritten to the single
+  vocabulary; a spec test now locks the catalog page's headings to the enum so
+  they cannot drift apart again. Remaining lowercase emitters (cloud-connection,
+  plugin-auth envelope codes, metadata-protocol, …) are the batch-2 sweep.
+
+- 0af50a3: fix(driver-sql,service-analytics): a bare-day upper bound covers the whole day on `Field.datetime` (#3777)
+
+  A bare `YYYY-MM-DD` comparand anchors to midnight UTC. That is right for a
+  lower bound and was silently wrong for an upper one: the dashboard date-range
+  filter compiles `{ $gte: from, $lte: to }` with bare-day bounds, so on a
+  `datetime` column every row created after 00:00 of the `to` day vanished from
+  the result — no error, the chart renders, the numbers are just smaller. The
+  default configuration hit it: the filter's default field is `created_at`
+  (a system-injected `Field.datetime`) and 7 of the 13 presets end "today".
+
+  The translation is operator-sensitive and half-open, applied at every
+  comparison emitter:
+
+  - `SqlDriver` (and `SqliteWasmDriver` by inheritance): `$lte`/`<=` with a
+    bare-day comparand on a `datetime` column compiles to `< next-day-midnight`
+    in the column's storage form; `$between [min, max]` with a bare-day max
+    decomposes to `>= min AND < next-day(max)`. Both the plain and the
+    legacy-repair (mixed-storage) column paths, both `where` spellings.
+  - `NativeSQLStrategy`: `dateRange` windows and `lte` filters bind `< next-day`
+    instead of an inclusive `BETWEEN`/`<=` when the bound is a bare day.
+  - The `/analytics/sql` rendering and the dataset preview evaluator apply the
+    same rule, so the echoed SQL and drafted numbers reproduce execution.
+
+  `@objectstack/core` gains the shared primitive `nextUtcCalendarDay(value)`:
+  the next calendar day of a valid bare `YYYY-MM-DD` (else `null` — instants,
+  `Date`s and impossible days are never widened).
+
+  Unchanged on purpose, per the semantics table on #3777: `date`/`time` columns
+  (`<= day` is already whole-day-correct there), full-ISO/`Date` comparands
+  (instant semantics), and `$gte`/`$gt`/`$lt` (midnight anchoring is correct for
+  those). No authored metadata changes: a dashboard's existing
+  `{ $gte, $lte }` window now simply includes its final day.
+
+- 3c628ce: feat(auth)!: retire the `api.requireAuth` opt-out — anonymous access to object data is always denied (#3963)
+
+  `api.requireAuth: false` let a deployment open its ENTIRE data plane with one
+  config key. It is removed. Auth is a kernel concern, not a deployment posture:
+  anonymous callers are denied on every HTTP surface that reaches object data,
+  unconditionally.
+
+  Every surface that legitimately serves a session-less caller already derives its
+  own narrow authorization from a DECLARATION, so none of them needed the global
+  switch:
+
+  - control plane (`/auth/*`, `/health`, `/ready`, `/discovery`, ADR-0069
+    remediation) — the auth-gate allowlist;
+  - public form submission — `publicFormGrant` (ADR-0056 Option A);
+  - share links — the capability token, validated then read as SYSTEM;
+  - a `book.audience: 'public'` read — the ADR-0046 §6.7 audience gate (#3995);
+  - MCP — an OAuth token or API key.
+
+  **Breaking changes.**
+
+  - `api.requireAuth` is a retired key. It is tombstoned (`retiredKey`) in both
+    `RestApiConfigSchema` and the stack `api` block, so authoring it now fails with
+    a fix-it message rather than being silently stripped (the ADR-0104 / #3733
+    quiet-failure this whole line of work has been closing). `os migrate meta`
+    drops it via the protocol-17 conversion `stack-api-require-auth-removed`.
+  - `shouldDenyAnonymous` (@objectstack/core) no longer takes a `requireAuth`
+    input; it denies any anonymous, non-system caller outside the control-plane
+    allowlist.
+  - A stack that mounts **no auth at all** now FAILS AT BOOT when it would serve a
+    data API (`objectstack serve`, plugin-dev), instead of getting an explicit
+    fail-open. Enable auth (the `auth` tier or AuthPlugin), or run without the data
+    API. There is no anonymous-data carve-out any more — publishing a public
+    surface is done by declaration (see above).
+
+  **Migration.** Delete `api.requireAuth` from the stack config (or run
+  `os migrate meta`). If you were serving data publicly with `requireAuth: false`,
+  replace it with the declaration that fits: a public form view, a share link, or
+  `book.audience: 'public'`. If you have an auth-less stack that intentionally
+  served data, it must now mount auth or stop serving the data API.
+
+- d13004a: feat(core,runtime): plugin ordering is a declared, kernel-enforced contract (ADR-0116, #4131)
+
+  `kernel.use()` registration order was never a contract — the kernel resolves
+  init/start order from the plugin dependency graph — but a plugin that needed a
+  service at init _when its provider is composed_ while also booting _without_
+  the provider had no way to declare that. `AppPlugin` was the standing example:
+  it grabs `manifest`/`objectql` synchronously in `init()`, declared nothing
+  (a hard dependency would break empty-env / metadata-only / mock-engine
+  kernels), and so its correctness rode on which array slot each caller put it
+  in. That convention failed the same way twice (`DefaultDatasourcePlugin`'s
+  first cut; then #4085, disguised for months as "crashes when the artifact is
+  missing").
+
+  The kernel `Plugin` contract gains three additive fields, enforced by both
+  `ObjectKernel` and `LiteKernel` through one shared implementation
+  (`plugin-order.ts` — the previously duplicated topological sort is unified
+  there):
+
+  - **`optionalDependencies: string[]`** — order-if-present: hoisted ahead
+    exactly like `dependencies` when composed (real topology edges, including
+    cycle detection), silently skipped when absent.
+  - **`requiresServices: string[]`** — services resolved synchronously during
+    `init()` with no fallback. Validated **before Phase 1**: a required service
+    whose only declared provider initializes later fails the boot with an error
+    naming both plugins, both slots, and the fix — before any init side
+    effects. Re-checked immediately before the plugin's own init, where a still-
+    missing service becomes a named composition error exactly where the old
+    bare `Service not found` crash fired.
+  - **`providesServices: string[]`** — services a plugin's `init()`
+    unconditionally registers; powers the validation and the diagnostics.
+
+  Plugins that declare nothing get the diagnosis too: a `getService` miss
+  during Phase 1 now appends which plugin was initializing and — when a
+  composed plugin declares the service — who provides it and how to declare the
+  ordering. The `Service '<name>' not found` prefix and the factory-backed
+  `is async - use await` message are unchanged.
+
+  First adopters: `AppPlugin` declares
+  `optionalDependencies: ['com.objectstack.engine.objectql']` +
+  `requiresServices: ['manifest']` (cleared on the empty-env no-op path), so
+  the #4085 composition — AppPlugin registered before the engine — now boots
+  correctly in every slot; `ObjectQLPlugin` declares
+  `providesServices: ['objectql', 'data', 'manifest', 'lifecycle']` and
+  `MetadataPlugin` declares `providesServices: ['metadata']`.
+
+  Everything is additive — plugins that declare nothing keep their exact
+  ordering semantics; no existing declaration changes meaning.
+
+- e4c2dc8: Order temporal operands correctly when one side is a JS `Date` on the two
+  type-blind filter backends (ADR-0053 D-A3 / #4191).
+
+  `utcInstantMs` joins `nextUtcCalendarDay` in `@objectstack/spec/data`
+  (re-exported from `@objectstack/core`): it reads the UTC instant a temporal
+  operand denotes, accepting only unambiguous spellings — a `Date`, epoch ms, a
+  bare `YYYY-MM-DD`, and an ISO timestamp with or without an explicit zone (a
+  zone-naive one being UTC, per D-B2) — and returning `null` for everything
+  else, notably a bare wall clock, which denotes no instant.
+
+  Both type-blind evaluators now use it to compare a `Date` against wire text,
+  which JS relational operators cannot do: `<` and friends coerce with hint
+  `number`, so the `Date` becomes its epoch and the string becomes `NaN`.
+
+  - `formula`'s `matchesFilterCondition` (the RLS write-side `check`) dropped
+    every `Date`-valued row in 10 of the 16 shared conformance cases. The
+    post-image is the caller's raw write payload, so an SDK write of
+    `new Date()` hit this directly, and fail-closed turned it into a **denied
+    write**.
+  - `service-analytics`' preview evaluator diverged on the same 10 cases in
+    BOTH directions, because `String(new Date())` sorts after every `'2026-…'`
+    comparand — a drafted chart both lost rows and gained ones, then changed
+    its numbers at publish. Rows from a mongo-backed dataset arrive as BSON
+    `Date`s, so this was reachable in normal use.
+
+  Comparisons that did not involve a `Date` are unchanged.
+
+### Patch Changes
+
+- 2af1988: fix(formula,spec,core): the RLS write-side `check` evaluator honours calendar-day upper bounds (ADR-0053 D-D)
+
+  `@objectstack/formula`'s `matchesFilterCondition` — the evaluator behind RLS
+  write-side `check` policies (ADR-0058 D4) — compared a bare `YYYY-MM-DD` `$lte`
+  bound literally. On a `datetime` post-image that meant a policy of the shape
+  `{ signed_on: { $lte: '{today}' } }` **denied every write made after 00:00**:
+  the write-side twin of the read-side data loss #3777 fixed, and the last of the
+  platform's filter backends that disagreed about what a bare day means as a
+  bound.
+
+  `$lte` and a `$between` max now evaluate half-open against the next calendar
+  day, matching the SQL compiler, the memory and mongo drivers, and the analytics
+  preview evaluator. Unchanged, per the same semantics table: full-ISO bounds keep
+  exact-instant semantics, `$gte`/`$gt`/`$lt` keep their midnight anchoring, and a
+  plain `YYYY-MM-DD` value compares identically (string ordering makes the two
+  forms equivalent). The evaluator stays fail-closed on a null bound.
+
+  **Where the rule now lives.** `nextUtcCalendarDay` moved from
+  `@objectstack/core` to `@objectstack/spec/data` — beside `date-macros.zod.ts`,
+  whose vocabulary it interprets. `formula` cannot depend on `core`, and a second
+  copy of the rule is exactly the divergence #3777 catalogued; `spec` is the one
+  package all six consumers already depend on, so this adds no dependency edge.
+
+  No import changes are required: `@objectstack/core` re-exports the symbol, so
+  existing `import { nextUtcCalendarDay } from '@objectstack/core'` keeps working.
+  New code should prefer `@objectstack/spec/data`.
+
+- 2e836de: chore(packaging): CHANGELOG.md ships in every npm tarball (#4261)
+
+  The AGENTS.md post-task checklist requires breaking changesets to carry their
+  FROM → TO migration because "this text ships to consumers as `CHANGELOG.md`
+  inside the npm package and is what an upgrading agent greps after the tombstone
+  error." That delivery path was severed for 68 of the 69 publishable packages:
+  npm packs `package.json` / `README*` / `LICENSE*` unconditionally but — unlike
+  older npm versions — not `CHANGELOG.md`, and the canonical
+  `"files": ["dist", "README.md"]` whitelist never named it. Measured on npm
+  10.9.7: `npm pack --dry-run` on `@objectstack/types` shipped 3 files while its
+  70KB `CHANGELOG.md` stayed behind. Only `@objectstack/spec` listed it
+  explicitly.
+
+  The tombstone-error scenario is precisely the one where the repo is out of
+  reach — the upgrading agent has `node_modules` and nothing else — so the
+  migration text has to ride in the tarball. Every publishable package now
+  declares `CHANGELOG.md` in `files`, and the canonical whitelist is
+  `["dist", "README.md", "CHANGELOG.md"]`.
+
+  The other half is the gate: `check:published-files` gains a fifth invariant,
+  COMPLETE — a whitelist that fails to cover `CHANGELOG.md` fails the
+  always-required lint job, so the next package cannot silently sever the path
+  again. `@objectstack/spec`'s per-package EXTRA_ENTRIES exemption dissolves
+  into the canonical set.
+
+  Consumer-visible change: one more file per install (the package's changelog,
+  e.g. 70.8KB for `@objectstack/types`), and `grep -r "removed key"
+node_modules/@objectstack/*/CHANGELOG.md` now finds the migration it was
+  promised.
+
+- 45dc446: Every in-memory fallback and dev stub now self-describes with the standard `__serviceInfo` descriptor, classified by what it actually is (#4058 step 1).
+
+  ADR-0076 D12 gave services one way to say "I am not the real thing", but the producers never converged on it:
+
+  - The kernel's own fallbacks (`createMemoryCache` / `Queue` / `Job` / `I18n` / `Metadata`) carried `_fallback: true` — a marker **no** consumer recognized, `readServiceSelfInfo` included — so both discovery builders reported them as fully `available`.
+  - `plugin-dev` marked all of its implementations with the same `_dev: true`, normalized to `status: 'stub', handlerReady: false`. That declared a working in-memory search index exactly as fake as an AI stub returning invented text.
+
+  Both now carry `__serviceInfo`, split by a rule that holds across the whole set:
+
+  - **`degraded`** — really does the work, with reduced capability: `cache`, `queue`, `job`, `file-storage`, `search`, `i18n`, `metadata`, `workflow`, `realtime`. Its answers are true answers; the `message` names what is missing (no persistence, no scheduling timer, no state-machine validation, …).
+  - **`stub`** — the answer is fabricated: `ai`, `automation`, `notification`, `data`, `auth`, `security.permissions`, `security.rls`, `security.fieldMasker`. Never to be mistaken for a capability.
+
+  `handlerReady: false` is set independently wherever no HTTP handler serves the slot (`cache` / `queue` / `job` / `realtime`, and every `stub`).
+
+  Discovery output changes accordingly — a kernel fallback that used to report `status: 'available'` now reports `degraded` with an explanatory message. No routing, gating, or dispatch behavior changes: every dispatcher domain still resolves services exactly as before. Consumers reading `discovery.services.*` get the truth instead of a uniform claim.
+
+  For anything that duck-typed the old markers: `svc._fallback` / `svc._dev` → `readServiceSelfInfo(svc)` from `@objectstack/spec/api` (the legacy `_dev` key is still understood by that reader, so third-party stubs carrying it keep working).
+
+- f985b3f: fix(spec,core,cloud-connection,metadata): one HTTP contract, one canonical slot name — and the dead shadow copy that helped cause the false exemption is deleted (#4251)
+
+  **`packages/core/src/contracts/` was a dead near-copy of the real contracts,
+  and it is gone.** The directory (http-server.ts, data-engine.ts, logger.ts) had
+  ZERO importers — no relative import, no subpath export, not a tsup entry;
+  core's barrel has re-exported the `@objectstack/spec/contracts` versions all
+  along ("Re-export contracts from @objectstack/spec for backward
+  compatibility"). But the shadow had already **diverged** from the live
+  contract (spec's `IHttpResponse` grew `write?`/`end?` and `IHttpRequest` grew
+  `rawBody?`; the copy never did), so anyone who grepped their way into it read a
+  stale contract that nothing enforces — the exact both-humans-and-AI failure
+  mode behind the false `http.server` exemption (#4382). Deleting it is
+  zero-risk by construction: nothing could reach it.
+
+  **`http.server` is the canonical slot name, and the ledger now says so.**
+  `ServiceSlotContracts` gains `'http.server': IHttpServer` plus the deprecated
+  `'http-server'` alias entry (same instance — hono-plugin and qa's node-plugin
+  register both two lines apart; cloud's two server entrypoints do the same).
+  Canonical is the only name present on EVERY provider path: runtime's
+  `config.server` path registers no alias, so the three cloud-connection plugins
+  that read the alias alone (marketplace-proxy, runtime-config,
+  marketplace-install-local) found an empty slot there — a live miss, now fixed:
+  all readers go canonical-first with the alias as a fallback that dies with the
+  alias registrations. The registrations themselves are untouched this release;
+  both sites now carry the deprecation note.
+
+  **`getRawApp?(): any` joins `IHttpServer`** — the deliberate framework-handle
+  escape, declared once. Four consumers were each declaring it locally
+  (cloud-connection ×2, metadata's HMR routes, cloud's serverless node-server);
+  those local `RawAppHost`/`HttpServerWithRawApp` types are deleted. The `any`
+  return is deliberate and documented at the single declaration: the handle's
+  real type belongs to the framework, and naming it would give the contract a
+  framework dependency. Adapters are not required to expose it; consumers
+  feature-detect.
+
+  **`IMetadataService.bulkRegister`/`bulkUnregister` declare the write options
+  their implementation has always accepted.** `bulkRegister`'s contract options
+  dropped the `MetadataWriteOptions` half its implementation intersects in
+  (`notify` is destructured on the method's first line); `bulkUnregister`
+  declared no options at all while the manager takes them. Same shape as the
+  `IDataEngine` read-methods gap from B2: a caller typed to the contract could
+  not reach the channel without erasing the lookup. Both additive; no implementor
+  or caller breaks.
+
+  Slot-lookup baseline ratchets 168 → 167 (marketplace-install-local's lookup
+  typed while touched).
+
+- 7777e8f: fix(spec)!: retire the never-built typed-event system; the lifecycle registry now lists the events that actually fire (#4212 follow-up)
+
+  The lifecycle-event surface promised a typed-event system that was never
+  built, in three layers. `kernel/plugin-lifecycle-events.zod.ts` shipped ten
+  payload schemas (`PluginRegisteredEvent`, `PluginErrorEvent`,
+  `HookTriggeredEvent`, `KernelReadyEvent`, …) and a 21-name
+  `PluginLifecycleEventType` enum — zero consumers for every export, and the
+  enum was wrong in both directions: 17 names nothing fires, 10 real events
+  missing. `contracts/plugin-lifecycle-events.ts` declared the same 17 dead
+  names in `IPluginLifecycleEvents` next to 5 real ones, plus an
+  `ITypedEventEmitter` interface nothing implements. All of it read as a
+  promise; anyone who coded against it (hooking `plugin:started`, awaiting
+  `plugin:error`) registered a handler that could never fire, with no error
+  saying so — the same silent-drop shape as the #4212 lifecycle-hook family.
+
+  Removed, with zero consumers verified repo-wide:
+
+  - `kernel/plugin-lifecycle-events.zod.ts` and every export: `EventPhase`,
+    `PluginEventBase`, `PluginRegisteredEvent`, `PluginLifecyclePhaseEvent`,
+    `PluginErrorEvent`, `ServiceRegisteredEvent`, `ServiceUnregisteredEvent`,
+    `HookRegisteredEvent`, `HookTriggeredEvent`, `KernelEventBase`,
+    `KernelReadyEvent`, `KernelShutdownEvent`, `PluginLifecycleEventType`
+    (schemas and inferred types).
+  - `ITypedEventEmitter` from `contracts/plugin-lifecycle-events.ts`.
+  - The 17 never-fired names from `IPluginLifecycleEvents`.
+
+  `IPluginLifecycleEvents` is now the registry of the **14 events with a real
+  emitter** — `kernel:{ready,bootstrapped,listening,shutdown}`, `app:seeded`,
+  `metadata:reloaded` (payload `metadata` now optional, matching the documented
+  contract), `external.schema.drift`, `ai:routes`, `auth:configure`, and the
+  `{service}:ready` convention family (`mcp`, `automation`, `analytics`,
+  `external-datasource`, `datasource-admin`) — each payload as observed at its
+  fire site. A new `LifecycleEventName` union types
+  `PluginContext.hook`/`trigger` in `@objectstack/core` as
+  `LifecycleEventName | (string & {})`: known names autocomplete, custom
+  cross-plugin names stay legal, existing callers compile unchanged. A pinning
+  test asserts two-way equality between the interface keys and the fire-site
+  inventory.
+
+  FROM → TO:
+
+  - `PluginLifecycleEventType` → `LifecycleEventName` (the union of names that
+    fire). There is no runtime enum; the bus is open by design.
+  - Event payload schemas (`KernelReadyEvent`, `PluginErrorEvent`, …) → the
+    payload tuples on `IPluginLifecycleEvents`. No wire format existed or
+    exists; payloads are in-process arguments.
+  - `ITypedEventEmitter` → `PluginContext.hook`/`trigger` (the emitter that
+    actually exists).
+  - Handlers for the 17 dead names → delete them; they never ran. For plugin
+    phase observation use the boot report (ADR-0084); for per-plugin errors the
+    kernel throws/logs at the failing phase.
+
+  Plain deletion rather than `retiredKey()` tombstones, per the #4233
+  precedent: these keys were never authorable — they described runtime event
+  payload records no config author can write, so the silent-strip class the
+  authorable-surface ratchet guards against is vacuous. Its baseline entries
+  and the `json-schema.manifest.json` keys are dropped deliberately in this PR.
+  No ADR-0087 conversion: no stack metadata names these types; there is nothing
+  for `os migrate meta` to rewrite.
+
+- 7ce02eb: feat(spec,objectql): `IObjectQLEngine` — the `objectql` slot's contract exists, the class `implements` it, and the seven consumer-local stand-ins are deleted (#4251 B3)
+
+  ObjectQL registers one instance under two names, and the ledger can finally say
+  what each name means: `data` stays `IDataEngine` (the data plane), `objectql`
+  now resolves to **`IObjectQLEngine`** — the full engine: schema access
+  (`getSchema` / `getObject` / `registry`), actions (`registerAction` /
+  `removeActionsByPackage` / `executeAction`), the hook/middleware seams
+  (`registerHook` / `unregisterHooksByPackage` / `registerFunction` /
+  `registerMiddleware` / `bindHooks`), the first-wins default runners and hook
+  metrics, boot wiring (`registerDriver` / `setDatasourceMapping` /
+  `registerApp`), and the ops probes (`checkDriversHealth` /
+  `wasDatastoreCreatedFromEmpty` / `invalidateDataMigrationFlags`). The ledger
+  test pins the new relation: `objectql` strictly widens `data`, deliberately no
+  longer equal.
+
+  **Why now, and why `implements` is the point.** The honest state for two
+  batches was recorded on `DomainHandlerContext.getObjectQL`: ObjectQL is wider
+  than `IDataEngine`, the wider part had no contract, and typing it `IDataEngine`
+  would be "the more comfortable-looking lie". The interim discipline — each
+  consumer declares the narrow slice it uses — produced seven local surfaces
+  (`AppEngineSurface`, `EngineRegistrySurface`, `EngineExtensionSurface`,
+  `SecurityEngineSurface`, `FreshDatastoreEngine`, the dispatcher's inline
+  `checkDriversHealth` slice, the `getObjectQL: any` itself). Each was honest and
+  each was an UNCHECKED claim: `getService<Surface>('objectql')` is an assertion,
+  so an engine rename would have broken every consumer at runtime with zero
+  compile errors. `ObjectQL implements IObjectQLEngine` converts all of them into
+  one compiler-verified claim. All seven stand-ins are deleted; consumers import
+  the one declaration. `getObjectQL` is typed `Promise<IObjectQLEngine | null>`
+  end to end, closing the oldest documented `any` in the dispatcher.
+
+  **Evidence bar unchanged.** Every declared member has a cross-package consumer
+  reaching it through the slot; engine members without one (e.g. `triggerHooks`,
+  cross-package only in tests) stay off until a caller appears. The registry view
+  (`EngineSchemaRegistryView`) declares exactly the eight members consumers use.
+
+  **`_registry` never leaves the engine package now.** plugin-security's
+  declared-metadata readers (`readDeclared`, permission-set projection, suggested
+  audience bindings) reached ObjectQL's private `_registry` field through `any` —
+  the same private reach `/me/apps` had in B2, five more times. All migrated to
+  the public `registry` getter the contract declares, test doubles included.
+
+  **`IMetadataService` gains `subscribe?` / `loadMany?`** — implemented by
+  `MetadataManager` beside `watch` all along, reached through the slot only via
+  `any` by ObjectQLPlugin's metadata bridge (the re-sync keeping runtime-authored
+  hooks/actions live). With them declared, the bridge's six `metadata` lookups
+  and metadata-protocol's `objectql` lookup carry contract types, and both files
+  leave the grandfather list entirely: baseline **167 → 159 sites, 36 → 34
+  files**.
+
+- be7360c: chore(plugins,services): declare `providesServices` on the 20 remaining init-time service providers (ADR-0116 follow-up, #4131)
+
+  ADR-0116 gave the kernel a declared ordering contract, but only
+  `ObjectQLPlugin` and `MetadataPlugin` had declared what their `init()`
+  registers. The pre-Phase-1 ordering check can only _name a provider_ for
+  services someone declared, so its coverage was two plugins wide.
+
+  An audit of every plugin's `init()` body (brace-matched, comments stripped,
+  each call classified by whether it sits inside a `try`/`if`) found 20 plugins
+  that register a service on every path without declaring it. All 20 now
+  declare `providesServices`. Purely additive: no ordering changes, no new
+  failure modes — a `providesServices` entry only lets the kernel say _who_
+  provides a service when it reports a misordering, and enriches the Phase-1
+  `getService` miss diagnostic.
+
+  Three needed a closer read before declaring, because they register the same
+  service from several branches (`cache`, `queue`, `job`): each early-return
+  branch plus the fallback registers it, so every path does — the declaration
+  is honest. ADR-0116's rule that a _conditionally_ registered service must
+  never be declared is unchanged and was applied throughout.
+
+  The same audit found 12 plugins that hard-resolve a service during `init()`
+  (11 of them `manifest`) without declaring `requiresServices`. None is a live
+  exposure — every one already declares a hard `dependencies` entry on the
+  provider, so the kernel orders them correctly today. Those are tracked
+  separately: with a hard dependency in place, `requiresServices` mostly
+  restates what the kernel already enforces, and its real value is on
+  _soft_-dependency consumers, of which `AppPlugin` is currently the only one.
+
+- 857a6cf: fix(cli,core,metadata,runtime): `os serve` boots with no compiled artifact — the platform does not need an application to start (#4085)
+
+  The artifact (`dist/objectstack.json`) defines an **application**. ObjectStack is
+  a development platform, so it has to start without one — but `os serve
+objectstack.config.ts` died during boot whenever the artifact was absent:
+
+  ```
+    Loading objectstack.config.ts...
+  [StandaloneStack] artifact read FAILED: path='…/dist/objectstack.json' error=ENOENT…
+
+    ✗ Service 'manifest' is async - use await
+  ```
+
+  Exit 1 — on a **known-good app** (`examples/app-todo` fails the same way with
+  only its `dist/objectstack.json` moved aside), and on every freshly authored
+  project between `os init` and its first `os compile`. The message named neither
+  the missing artifact nor a fix, so it read as an internal kernel fault.
+
+  Three separate faults, each of which alone was enough to refuse the boot:
+
+  - **`serve` registered the config-derived `AppPlugin` before the stack's own
+    `plugins[]`.** Registration order _is_ the kernel's init/start order, and that
+    slot sits ahead of `ObjectQLPlugin` (which registers `manifest`/`objectql`) and
+    `DefaultDatasourcePlugin` (which connects the database the app seeds through).
+    The wrap is now **appended** to `plugins[]`, the same slot
+    `createStandaloneStack` gives its artifact-derived `AppPlugin` — so config-boot
+    and artifact-boot share one plugin order. The artifact path never hit this,
+    which is exactly what made a plugin-**order** bug look artifact-related.
+
+  - **`ctx.getService()` reported a never-registered service as "is async".**
+    `PluginLoader.getService` is an `async` method, so its return value is _always_
+    a Promise and its internal "not found" rejection can never surface
+    synchronously — the kernel read the answer off that Promise and told every
+    caller to `await` a service that did not exist, while the `not found` branch
+    below it was unreachable. It now decides from the registry: absent ⇒
+    `[Kernel] Service 'x' not found`, registered-but-uninstantiated ⇒ the unchanged
+    `Service 'x' is async - use await`. The same crash now reads
+    `[Kernel] Service 'manifest' not found`, which points at the layer that is
+    actually wrong.
+
+  - **`MetadataPlugin` treated an absent `local-file` artifact as fatal.**
+    `createStandaloneStack` always points it at `dist/objectstack.json`, so a stack
+    with no app at all could not boot. A **missing** local artifact is now "nothing
+    compiled yet": it logs, starts empty, and leaves the artifact watcher armed, so
+    a later `os compile` hydrates the running server. The tolerance is
+    ENOENT-only — a malformed or unreadable artifact stays fatal — and
+    `bootstrap: 'artifact-only'` (sealed runtime, where the artifact _is_ the
+    deployment) keeps failing loudly rather than silently serving an empty runtime.
+
+  `[StandaloneStack] artifact read FAILED … ENOENT` is likewise no longer shouted
+  at callers for whom "no artifact" is a healthy state; a present-but-unusable
+  artifact keeps the loud warning.
+
+  Pinned by an e2e pair that drives the real `os serve` with **no `os compile`
+  anywhere**: an app defined only by `objectstack.config.ts` (asserting its object
+  is in the started plugin set, not merely that boot survived) and a bare
+  `export default {}` platform. The #4012 fixture drops the `os compile` this bug
+  had forced on it.
+
+- d92c72d: fix(lint,runtime,core): the slot-lookup guard sees the split-declaration form — the shape that made the ratchet look cleaner the more it was used (#4251)
+
+  The three selectors from #4321 all key off the erasure and the lookup being in
+  ONE expression. Split them and every selector misses:
+
+  ```ts
+  let ql: any;
+  try {
+    ql = ctx.getService("objectql");
+  } catch {
+    /* optional */
+  }
+  ```
+
+  Selector 1 needs the call inside the declarator (this declarator has no init),
+  selector 2 needs `as`, selector 3 needs a type argument. The contract is erased
+  exactly as in `const ql: any = ctx.getService(…)`.
+
+  **Why this could not wait for the batches.** The baseline's monotonicity check
+  means a file that leaves the grandfather list can never be re-added. So every
+  batch converted more of this shape from "grandfathered" into "lint covers this
+  file and says nothing" — B2 alone moved `plugin-security/security-plugin.ts`
+  into that state. A ratchet that reports a cleaner number the more you sweep is
+  the #4342 failure wearing different clothes, and the fix only gets more
+  expensive per batch shipped.
+
+  **It is a rule, not a fourth selector, and that is the whole finding.** esquery
+  can match `AssignmentExpression:has(CallExpression[…])`, but it cannot tell
+  which declaration the assigned identifier resolves to — so it would equally
+  flag the correctly-typed form this work line exists to produce (`let
+i18nService: II18nService | undefined; i18nService = …`, 8 such sites today in
+  runtime/app-plugin.ts, service-automation and metadata-protocol). Resolving the
+  identifier needs SCOPE analysis. That is cheap and needs no type information, so
+  this stays out of the typed-lint pass the KNOWN RESIDUAL still waits on — but it
+  is a rule, and the earlier "just one more selector" estimate was wrong.
+
+  Verified against exactly that: the rule flags all 16 real sites and none of the
+  8 correctly-typed lookalikes.
+
+  **Scale.** The baseline goes 140 → **169 sites** with the file count unchanged
+  at 37: 29 sites were already inside grandfathered files and simply invisible.
+  16 more could NOT be grandfathered (12 in files earlier batches had cleared, 3
+  in files never listed, 1 the regex sweep had missed) and are typed here —
+  `runtime/app-plugin.ts` ×5, `core/fallbacks/authored-translation-sync.ts` ×2,
+  `plugin-security/security-plugin.ts` ×2, `cloud-connection/{runtime-config,
+marketplace-proxy}-plugin.ts` ×3, `platform-objects/src/plugin.ts` ×2,
+  `runtime/http-dispatcher.ts`, `runtime/domains/ai.ts`. No baseline key was
+  added; the key set still only shrinks.
+
+  Contracts where they exist (`IAIService`, `IJobService`, `IMetadataService`,
+  `II18nService`, `IDataEngine`, `IHttpServer`), named local surfaces where they
+  do not — `AppEngineSurface`, `SecurityEngineSurface`, `RawAppHost`,
+  `EnvRegistrySurface`, `FreshDatastoreEngine`, `AuthoredTranslationSink`. Two of
+  those record something worth naming: `IHttpServer` has no `getRawApp()` (the
+  contract is framework-agnostic and the raw app is Hono's own handle), and
+  ObjectQL's `_defaultBodyRunner` / `_defaultActionRunner` have no public reader
+  at all — the engine attaches them via `(this as any)` and publishes nothing,
+  while `getHookMetricsRecorder()` exists for exactly that question about the
+  metrics recorder. Declared rather than laundered through `any`, and filed.
+
+- Updated dependencies [6a67d7a]
+- Updated dependencies [0ecc656]
+- Updated dependencies [06772eb]
+- Updated dependencies [270650f]
+- Updated dependencies [3aef718]
+- Updated dependencies [1ea6bce]
+- Updated dependencies [c1dcacd]
+- Updated dependencies [ad303ed]
+- Updated dependencies [32ccb23]
+- Updated dependencies [f5a4ef0]
+- Updated dependencies [2d3e255]
+- Updated dependencies [7d7521f]
+- Updated dependencies [5dc4d02]
+- Updated dependencies [05154a1]
+- Updated dependencies [9b6fe7c]
+- Updated dependencies [8c711fb]
+- Updated dependencies [09e4547]
+- Updated dependencies [91f4c78]
+- Updated dependencies [820eff9]
+- Updated dependencies [8d895ff]
+- Updated dependencies [f6472d7]
+- Updated dependencies [78caf51]
+- Updated dependencies [62a789b]
+- Updated dependencies [789ad63]
+- Updated dependencies [2af1988]
+- Updated dependencies [12a19a8]
+- Updated dependencies [41dcda3]
+- Updated dependencies [c8124e5]
+- Updated dependencies [a1a4140]
+- Updated dependencies [217e2e6]
+- Updated dependencies [86a71d1]
+- Updated dependencies [d5c75e2]
+- Updated dependencies [03d26f7]
+- Updated dependencies [4384921]
+- Updated dependencies [3c628ce]
+- Updated dependencies [7cb922e]
+- Updated dependencies [1d22114]
+- Updated dependencies [b5f9397]
+- Updated dependencies [ed77493]
+- Updated dependencies [58a03d2]
+- Updated dependencies [dc530b4]
+- Updated dependencies [e59786e]
+- Updated dependencies [bcf1112]
+- Updated dependencies [9774b78]
+- Updated dependencies [b07d829]
+- Updated dependencies [a648e96]
+- Updated dependencies [a47ac06]
+- Updated dependencies [e4c61a7]
+- Updated dependencies [cc60165]
+- Updated dependencies [081aa6f]
+- Updated dependencies [91f4c78]
+- Updated dependencies [e8d0c21]
+- Updated dependencies [c1d44f7]
+- Updated dependencies [ab9fb5c]
+- Updated dependencies [f985b3f]
+- Updated dependencies [9a4932a]
+- Updated dependencies [f9fc874]
+- Updated dependencies [011b386]
+- Updated dependencies [7777e8f]
+- Updated dependencies [507b92a]
+- Updated dependencies [7309c81]
+- Updated dependencies [20bc1ec]
+- Updated dependencies [90c2b15]
+- Updated dependencies [42eeb7d]
+- Updated dependencies [01e124d]
+- Updated dependencies [7ce02eb]
+- Updated dependencies [a13827e]
+- Updated dependencies [7733604]
+- Updated dependencies [40e420f]
+- Updated dependencies [d13004a]
+- Updated dependencies [5b47ab5]
+- Updated dependencies [b09d8d9]
+- Updated dependencies [b09d8d9]
+- Updated dependencies [8675db6]
+- Updated dependencies [b09d8d9]
+- Updated dependencies [3eb1b2b]
+- Updated dependencies [59b85c0]
+- Updated dependencies [6e357ed]
+- Updated dependencies [d6938bf]
+- Updated dependencies [31e0be9]
+- Updated dependencies [4bfd455]
+- Updated dependencies [ffd2ce2]
+- Updated dependencies [62f8017]
+- Updated dependencies [a831df1]
+- Updated dependencies [f752ee3]
+- Updated dependencies [a1b61e0]
+- Updated dependencies [cd6b9f2]
+- Updated dependencies [2cb6d3c]
+- Updated dependencies [af2a095]
+- Updated dependencies [ec796d5]
+- Updated dependencies [e87fea1]
+- Updated dependencies [c65e529]
+- Updated dependencies [3ca34c1]
+- Updated dependencies [239c3a3]
+- Updated dependencies [94a0bbc]
+- Updated dependencies [d6bfb3d]
+- Updated dependencies [a2266a6]
+- Updated dependencies [d25a0ec]
+- Updated dependencies [667b83e]
+- Updated dependencies [627b188]
+- Updated dependencies [8d4eae7]
+- Updated dependencies [65a3a84]
+- Updated dependencies [ccd9397]
+- Updated dependencies [bca935b]
+- Updated dependencies [c54c822]
+- Updated dependencies [8dcc0f5]
+- Updated dependencies [75b9e51]
+- Updated dependencies [0a2f233]
+- Updated dependencies [8621cdd]
+- Updated dependencies [6f23667]
+- Updated dependencies [5d21a48]
+- Updated dependencies [19365b7]
+- Updated dependencies [b7ed26d]
+- Updated dependencies [b3a3d83]
+- Updated dependencies [7a55913]
+- Updated dependencies [35accbf]
+- Updated dependencies [6038de7]
+- Updated dependencies [eb95d97]
+- Updated dependencies [e4c2dc8]
+- Updated dependencies [1bd2795]
+- Updated dependencies [8186a70]
+- Updated dependencies [a329cca]
+- Updated dependencies [6eec18c]
+- Updated dependencies [4d7bebf]
+- Updated dependencies [821ac7a]
+- Updated dependencies [8f81731]
+- Updated dependencies [8b50cb3]
+- Updated dependencies [8c2db68]
+- Updated dependencies [22b5e54]
+- Updated dependencies [0166bd5]
+- Updated dependencies [9b702dc]
+- Updated dependencies [ab16331]
+  - @objectstack/spec@17.0.0-rc.1
+
+## 17.0.0-rc.0
+
+### Minor Changes
+
+- 879ea13: ADR-0105 Phase 0 + Phase 1: group tenancy posture; organization scope as a
+  first-class authorization dimension.
+
+  > This release carries BREAKING spec removals (see "Enforce-or-remove" below)
+  > but is recorded as `minor`: every publishable package is in the Changesets
+  > lockstep group, so one `major` would promote the whole monorepo. Breaking
+  > changes ship as `minor` during the launch window — the migration notes below
+  > are what reach consumers in `CHANGELOG.md`.
+
+  ## Tenancy is now a spectrum (D1)
+
+  `single | group | isolated`, resolved by the `tenancy` service and selected with
+  the new `OS_TENANCY_POSTURE` env var. Existing deployments are unchanged:
+  `OS_TENANCY_POSTURE` unset derives the posture from `OS_MULTI_ORG_ENABLED`
+  (`true` ⇒ `isolated`, else `single`). An unrecognized value throws at boot
+  rather than silently landing in a posture with no organization wall.
+
+  - `single` — no wall (unchanged).
+  - `group` — **new.** Organizations are membership boundaries over one shared
+    dataset; Layer 0 becomes `organization_id IN accessible_org_ids` (union / MOAC
+    semantics). Enforced by the OPEN engine.
+  - `isolated` — today's `multi`, renamed. Behavior, enterprise `org-scoping`
+    probe and degraded-boot handling all unchanged.
+
+  ## Organization scope is a first-class context field (D2)
+
+  `ExecutionContext.accessible_org_ids` — every organization the caller holds a
+  currently-valid membership in (ADR-0091 validity windows) — is resolved once by
+  `resolveAuthzContext` and carried by every transport. The `group` wall reads it
+  directly; RLS policies may reference it as
+  `organization_id IN (current_user.accessible_org_ids)`. An empty or absent set
+  fails the wall closed.
+
+  Only the Layer 0 PREDICATE widens. Composition is untouched: the wall is still
+  computed independently of the RLS compiler, AND-composed outermost, and
+  crossable only by a true `PLATFORM_ADMIN` on a posture-permitting object — so
+  ADR-0095's W1/W2 invariants hold in every posture.
+
+  ## Two P0 correctness fixes (D3, D4) — behavior changes
+
+  **D3 — app-authored org-scoped RLS policies are no longer silently dropped**
+  (finding F1, framework#3539). `collectRLSPolicies` used to strip any policy whose
+  `using` contained the substring `current_user.organization_id` when isolation was
+  inactive, which swallowed app-authored policies as well as the platform's own.
+  Stripping is now decided by PROVENANCE (identity against the shipped
+  declaration). **Upgrade impact:** in a deployment with no organization wall, an
+  app-authored policy referencing the active organization is now RETAINED and
+  fails closed (zero rows) with a one-time warning, where it previously vanished
+  and the object read unscoped. `getReadFilter` shared the defect, so analytics and
+  raw-SQL consumers were affected too. If a policy was only ever meant for
+  multi-org, delete it or install `@objectstack/organizations`.
+
+  **D4 — `viewAllRecords`/`modifyAllRecords` never cross an organization
+  boundary** (finding F2, framework#3540). Under a wall-less posture nothing
+  bounded the wildcard superuser bits `organization_admin` carries, so a
+  deployment that accumulated organizations (personal orgs on signup) made every
+  owner/admin an environment-wide superuser. `auto-org-admin-grant` now grants a
+  de-VAMA'd `organization_admin_no_bypass` variant when no wall is enforced, and
+  revokes the superseded variant whenever the posture changes. **Upgrade impact:**
+  in `single` posture an org owner/admin keeps full CRUD but loses the blanket
+  ownership/sharing/RLS bypass. Deliberate deployment-wide visibility remains
+  available through `admin_full_access` or an explicitly authored permission set —
+  it just stops being a side effect of a better-auth membership role.
+
+  ## Engine-owned organization stamping (D5)
+
+  Under any wall-enforcing posture the engine stamps `organization_id` from the
+  caller's active organization on an insert that omits it, and validates every
+  supplied value against the wall. Idempotent with the enterprise auto-stamp
+  (neither overwrites a supplied value). This also closes a real hole: the
+  pre-existing post-image check required a non-array payload, so a BULK insert
+  could carry a forged `organization_id` per row. One forged row now denies the
+  whole write.
+
+  ## Group structure, extension fields and red-line lints (D6, D7)
+
+  - `sys_organization` gains `parent_organization_id` and `sort_order` — a
+    **reporting dimension only**.
+  - New lint `validateOrgAxisRedLines` (`org-axis-permission-inheritance`,
+    `org-axis-cross-org-bu-grant`), wired into `os lint` / `os compile` /
+    `os validate`: an RLS policy or sharing rule that walks the org tree is an
+    error, as is a business-unit grant on a platform-global object.
+  - Extension fields on better-auth-managed objects ride the existing ADR-0092
+    whitelist. A new guard derives better-auth's real field surface from
+    `getAuthTables()` at the pinned version and fails the build on any name
+    collision, so a library upgrade cannot silently take ownership of a column.
+
+  ## Enforce-or-remove (D11) — BREAKING
+
+  Both removals are of surface that had **zero runtime consumers**, so no
+  behavior changes; authoring them is now a no-op instead of a lint warning.
+
+  - **`PermissionSet.contextVariables` — REMOVED.** The RLS compiler never read
+    it. FROM → TO: a set a policy needs as `field IN (current_user.<key>)` is now
+    supplied by a registered membership resolver (below); a constant belongs in
+    the policy itself as a literal (`status = 'published'`).
+  - **`Territory` / `TerritoryModel` / `TerritoryType` (`security/territory.zod.ts`)
+    — REMOVED.** No runtime object, stack field or resolver existed. FROM → TO:
+    matrix requirements are served by multi-position × business-unit anchoring; a
+    generalized dimension-security module will arrive with its own ADR.
+  - **`ExecutionContext.rlsMembership` — PRODUCTIZED.** The bag the compiler has
+    merged since ADR-0056 finally has a producer: register an
+    `IRlsMembershipResolver` (`@objectstack/spec/contracts`) under the
+    `rls-membership-resolver` service, declaring the keys it owns. Fail-closed by
+    construction — an unresolved key makes its policies drop out. Kernel-owned
+    keys (`accessible_org_ids`, `org_user_ids`, …) are reserved and cannot be
+    overwritten from this seam.
+
+  ## Edition boundary (D12)
+
+  The `group` posture's enforcement primitives ship OPEN — the union wall,
+  `accessible_org_ids` resolution, D5 stamping/validation, the D3/D4 correctness
+  fixes and the D6 lints — because the correctness of a wall is never a paid
+  feature (cloud ADR-0016 铁律「强制免费、治理收费」). `isolated` keeps its existing
+  enterprise `org-scoping` probe, so the current commercial boundary for
+  legal-entity isolation is unchanged by this release.
+
+- 763931e: feat(filters): evaluate `{filter-token}` placeholders server-side (#3582)
+
+  Filter values travel as JSON, so a time- or user-scoped slice writes a
+  placeholder instead of code:
+
+  ```ts
+  filter: { close_date: { $gte: '{current_year_start}' }, owner: '{current_user_id}' }
+  ```
+
+  The vocabulary has been in `@objectstack/spec` for a while (`date-macros.zod.ts`,
+  `context-tokens.zod.ts`) and `objectstack build` rejects tokens outside it
+  (#3574). What was missing is the half that _substitutes a value_: **nothing on
+  the server ever did**. A placeholder reached the driver as the literal string
+  `'{current_year_start}'`, compared as text, and matched nothing.
+
+  That failure is invisible — an empty widget looks exactly like a metric that is
+  legitimately zero — so apps worked around it by computing dates at module load,
+  which freezes "this year" into the built artifact and quietly goes stale.
+
+  **New: `resolveFilterTokens()` in `@objectstack/core`**, wired into the two
+  server-side seams every filter passes through:
+
+  - **ObjectQL read path** — `find` / `findOne` / `count` / `aggregate`, so REST
+    queries, related lists, saved-view filters and flow `find_records` all resolve.
+    It runs before the middleware chain, so only author-supplied filters are
+    inspected; RLS/sharing filters are injected downstream from concrete values.
+  - **Analytics dataset executor** — a dataset's intrinsic `filter`, a widget's
+    `runtimeFilter`, measure-scoped filters, and time-dimension `dateRange`s.
+    This path needs its own call: `NativeSQLStrategy` compiles raw SQL and binds
+    comparands directly, so a dashboard widget never passes through `engine.find()`.
+
+  Behavioural notes:
+
+  - Date tokens resolve to ISO strings (`YYYY-MM-DD`, or a full timestamp for
+    `{now}` / `{N_hours_ago}` / `{N_minutes_ago}`). Turning that into a column's
+    on-disk form stays the driver's job (`SqlDriver.temporalFilterValue`), so
+    there is still exactly one source of truth for the storage convention.
+  - Calendar boundaries follow `ExecutionContext.timezone`; one instant is pinned
+    per filter tree, so a `>= {current_month_start}` / `< {next_month_start}` pair
+    can never straddle a boundary.
+  - `{current_org_id}` reads `ExecutionContext.tenantId`; `{current_user_id}` reads
+    `userId`. A request carrying neither now **throws** instead of resolving to
+    `null` — a null comparand degrades to `IS NULL` on most drivers and would hand
+    back the rows the filter was written to exclude.
+  - An unrecognised placeholder **throws**, carrying the near-miss fix
+    (`{current_user}` → `{current_user_id}`, `{this_quarter_start}` →
+    `{current_quarter_start}`). This matches what `objectstack build` already
+    enforces. Consequence, previously implicit and now load-bearing: a filter value
+    that is _entirely_ `{...}` is always read as a placeholder, so a literal value
+    of that shape is not expressible — rename the value.
+
+  Also in this change: `notify` no longer sends the six-character string
+  `"undefined"` as an audience member. `to: ['{record.owner.manager}']` walks
+  `.manager` on a scalar foreign-key id, resolves to nothing, and `String(undefined)`
+  turned that into a phantom recipient — the emit "succeeded", addressed nobody,
+  and said nothing. Unresolved recipients are now dropped, and a node with no
+  recipient left fails naming the offending template and pointing at the start
+  node's `config.expand` (#3475), which does hydrate the relation.
+
+- 4cca74c: fix(i18n)!: the `translation` metadata type speaks the same `objects.` shape everything else does (#3778)
+
+  A translation authored in the product saved successfully and then rendered
+  nothing. Not a resolver gap — a contract split. The `translation` metadata type
+  (`allowRuntimeCreate: true`, so Studio/the metadata API/an agent can author it)
+  was registered against `AppTranslationBundleSchema`, an object-first shape keyed
+  on `o.<object>`. Every resolver, `os i18n extract`, `os i18n check`, the objectui
+  hooks, and all nine shipped bundles read `objects.<object>`. Nothing bridged the
+  two, so the save path and the read path never met.
+
+  **Why converge instead of bridge.** A converter was the obvious fix and the
+  wrong one: it would be throwaway code, and it would start producing _working_
+  `o.`-shaped rows — closing the migration-free window that exists precisely
+  because the feature never functioned. The retired shape's real-world footprint
+  was zero: all three `*.translation.ts` files in the tree (platform-objects,
+  CRM and todo examples) were already `objects.`-shaped, contradicting the type's
+  own registered schema. Converging is a registration fix, not a migration.
+
+  **Breaking.** `AppTranslationBundleSchema`, `ObjectTranslationNodeSchema`, and
+  their types are **deleted** — no deprecation cycle. Nothing worked end-to-end
+  through them, so there is no functioning consumer to protect, and a
+  deprecated-but-present schema is exactly the exemplar an AI agent copies into
+  new code. The optional `II18nService.getAppBundle` / `loadAppBundle` methods go
+  with them: zero implementers, so they advertised a capability the runtime never
+  delivered.
+
+  **The replacement.** `TranslationItemSchema` — one locale of the same
+  `TranslationData` groups a file bundle uses, plus the `locale` it translates,
+  with a `defineTranslation()` factory. An item is one entry of a
+  `TranslationBundle`; that is the whole type.
+
+  Three details are deliberate, all aimed at the failure being silent rather than
+  loud:
+
+  - **`locale` is required**, not inferred from the item name. The sync skips an
+    item whose locale it cannot resolve, and a skip is invisible to whoever — or
+    whatever — authored it. (The name fallback still covers rows written before
+    this.)
+  - **Retired keys are rejected, not stripped.** Zod drops undeclared keys
+    silently, which would reproduce this bug exactly: save succeeds, nothing
+    renders. A pre-parse guard turns that silence into a 422 naming the group to
+    use (`'o' … — use 'objects.<object_name>'`). It runs ahead of the parse so the
+    retired keys stay out of the schema itself — the generated JSON Schema and the
+    Studio editor never advertise a shape that cannot work.
+  - **`ObjectTranslationData.label` is now optional.** Partial translation is the
+    normal state and every resolver already treats each key as independent.
+    Requiring it forced authors to restate the source label just to validate,
+    filling bundles with fake translations that mask real coverage gaps.
+
+  Also in this change: the authored-translation sync warns (naming the row and the
+  fix) when it meets a row still in the retired shape instead of loading it into
+  nowhere, and no longer merges publish bookkeeping (`_lockReason`,
+  `_packageVersion`, …) into the translation layer. `GET
+/i18n/labels/:object/:locale`'s fallback now reads the nested
+  `objects.<obj>.fields.<field>.label` data it is actually given — it scanned for
+  flat dotted `o.<obj>.fields.<field>` keys, a third dialect no producer ever
+  wrote, so it always returned `{}`.
+
+  Migration: author every translation — file or runtime item — under `objects.`.
+  `o` → `objects`, `app` → `apps`, `nav` → `apps.<app>.navigation.<id>.label`,
+  `dashboard` → `dashboards`, `_globalOptions` →
+  `objects.<obj>.fields.<field>.options`, `_meta.locale` → top-level `locale`,
+  `_actions.confirmMessage` → `_actions.confirmText`. `reports`, `notifications`,
+  `errors`, and `namespace` had no runtime consumer and have no replacement.
+
+### Patch Changes
+
+- a227ed7: fix(objectql)!: one key for the empty group bucket — real `null`, on both aggregation paths (#3839)
+
+  A grouped row whose dimension value is empty now carries `null` for that
+  dimension no matter which way the aggregate ran. Downstream code can test the
+  empty bucket with a plain `value == null` again: charts render their own empty
+  label, drill-through on that bucket builds `field = null` and returns the rows
+  it should, and a dashboard no longer changes shape when the driver, the
+  granularity or the reference timezone changes.
+
+  ### What was wrong
+
+  `engine.aggregate` has two implementations of one feature. It pushes the
+  aggregate down as SQL when the driver advertises every requested granularity and
+  the reference timezone is UTC; otherwise it fetches rows and buckets them in JS.
+  The two disagreed about how to spell "empty":
+
+  ```
+  --- same dataset, same query, one row with a NULL value ---
+    pushed-down SQL : [{ "key": null,     "type": "null",   "total": 2 }, …]
+    in-memory       : [{ "key": "(null)", "type": "string", "total": 2 }, …]
+  ```
+
+  The measures were always right — only the key's type and literal differed —
+  which is why this went unnoticed for so long: every total reconciled. But the
+  engine picks a path per query, so the same data produced a different bucket key
+  on SQLite-plus-UTC-plus-`month` than on `week` (which SQLite does not advertise),
+  a non-UTC timezone, or `driver-rest` / `driver-memory` / a remote Turso, all of
+  which bucket in memory unconditionally.
+
+  It was never date-specific either. A plain `groupBy: ['stage']` over a NULL
+  column diverged the same way.
+
+  Consumers are written against `null` — they check `== null` and supply their own
+  empty label ('—', '(empty)', a localized "Uncategorized"). The sentinel defeated
+  every one of them: it rendered a raw English debug string in the UI, and a drill
+  on the empty bucket compiled to `field = '(null)'` and matched nothing.
+
+  The in-memory path's comment justified the string as staying "consistent with
+  the client `useReportData` hook". That hook was removed with ADR-0021, and the
+  literal never appeared in it.
+
+  ### What changed
+
+  - `applyInMemoryAggregation` and `bucketDateValue` (`@objectstack/objectql`) key
+    the empty bucket as `null`. `bucketDateValue` now returns `string | null`. A
+    null instant and an unparseable one still share one bucket, because SQL cannot
+    tell them apart either (`strftime('%Y-%m', 'not-a-date')` is NULL).
+  - The internal composite bucket id is JSON-encoded, so the empty bucket stays
+    distinct from a row whose value is the literal string `"null"`.
+  - `bucketKeyToCalendarRange` (`@objectstack/core`) accepts `string | null`. The
+    empty bucket has no calendar span, so a drill on it opens the unscoped
+    superset instead of an invented bound — unchanged behavior, honest signature.
+  - The driver output contract in `@objectstack/spec` now states the rule: a row
+    with no value keys as `null`, never a sentinel. Propagating NULL through the
+    bucket expression is the whole of it; a driver only breaks it by adding a
+    `COALESCE`.
+
+  ### Gates
+
+  `checkDateBucketParity` (`@objectstack/verify`) deliberately carried no null
+  instant, because the divergence would have failed it for a reason it was not
+  about. Its fixture now has one, so the convergence is held in place — including
+  for out-of-tree drivers that run the check against themselves.
+
+  Two fixes were needed to make that fixture meaningful:
+
+  - The check folded bucket labels through `String(value)`, which turns SQL NULL
+    into `'null'` — a label a TEXT column can genuinely hold. A driver spelling
+    "empty" as a string could compare equal to one returning real NULL. The empty
+    bucket is now keyed out of band.
+  - Label sets were compared with `JSON.stringify`, which is sensitive to key
+    insertion order. Row order is not part of this contract and the two paths
+    naturally differ (SQL sorts its groups; the in-memory path emits first-seen
+    order), so a driver with entirely correct buckets could be reported as
+    disagreeing — with an empty diff message, since nothing actually differed.
+    The comparison is now order-insensitive.
+
+  A new dogfood check covers the non-date half against real drivers: same dataset,
+  plain and date-bucketed `groupBy`, both paths, one key.
+
+- Updated dependencies [50616d9]
+- Updated dependencies [08b5a3d]
+- Updated dependencies [d99aeb3]
+- Updated dependencies [4727eb8]
+- Updated dependencies [f63cd09]
+- Updated dependencies [fa3d0cf]
+- Updated dependencies [af5a224]
+- Updated dependencies [71f76e1]
+- Updated dependencies [37b1346]
+- Updated dependencies [99736a0]
+- Updated dependencies [fe67e34]
+- Updated dependencies [fdb4f50]
+- Updated dependencies [1bd5652]
+- Updated dependencies [14252d3]
+- Updated dependencies [7fb436c]
+- Updated dependencies [879ea13]
+- Updated dependencies [201b31f]
+- Updated dependencies [e2616e0]
+- Updated dependencies [6fdc5c6]
+- Updated dependencies [8b9d71e]
+- Updated dependencies [33f5e23]
+- Updated dependencies [259af21]
+- Updated dependencies [587fc91]
+- Updated dependencies [1986594]
+- Updated dependencies [ad4af62]
+- Updated dependencies [d44dbfa]
+- Updated dependencies [474fe39]
+- Updated dependencies [0bc685a]
+- Updated dependencies [b949059]
+- Updated dependencies [be1c52c]
+- Updated dependencies [c5ff96d]
+- Updated dependencies [84e7be9]
+- Updated dependencies [a6c3f38]
+- Updated dependencies [debc23a]
+- Updated dependencies [0f8ad09]
+- Updated dependencies [8f9689f]
+- Updated dependencies [57a3bb3]
+- Updated dependencies [5f9a987]
+- Updated dependencies [db02d47]
+- Updated dependencies [0bfdf46]
+- Updated dependencies [376a061]
+- Updated dependencies [7c7e246]
+- Updated dependencies [f35cdc5]
+- Updated dependencies [9ea2bc5]
+- Updated dependencies [c2d9098]
+- Updated dependencies [a227ed7]
+- Updated dependencies [9613396]
+- Updated dependencies [e47b342]
+- Updated dependencies [4ed7ed4]
+- Updated dependencies [2fa4ca1]
+- Updated dependencies [f5a2320]
+- Updated dependencies [deb538f]
+- Updated dependencies [5b89711]
+- Updated dependencies [0c8a22f]
+- Updated dependencies [763931e]
+- Updated dependencies [de9af8a]
+- Updated dependencies [c4df271]
+- Updated dependencies [a41ba5c]
+- Updated dependencies [189854c]
+- Updated dependencies [0e3a226]
+- Updated dependencies [1d4756e]
+- Updated dependencies [720c5ad]
+- Updated dependencies [a8d1e24]
+- Updated dependencies [41642b0]
+- Updated dependencies [4cca74c]
+- Updated dependencies [88ef03e]
+- Updated dependencies [9e2caf3]
+- Updated dependencies [81ce41a]
+- Updated dependencies [85e1e4e]
+- Updated dependencies [dac6a08]
+- Updated dependencies [394b7a1]
+- Updated dependencies [677b591]
+- Updated dependencies [d77d1b7]
+- Updated dependencies [5b79a34]
+- Updated dependencies [c757854]
+- Updated dependencies [0045682]
+- Updated dependencies [2a5f04a]
+- Updated dependencies [4f740b0]
+- Updated dependencies [67452d1]
+- Updated dependencies [0fc6219]
+- Updated dependencies [605e190]
+- Updated dependencies [c6c59f1]
+- Updated dependencies [b0e78a8]
+- Updated dependencies [f31cc8d]
+- Updated dependencies [f343dc4]
+- Updated dependencies [8269e32]
+- Updated dependencies [74f7339]
+- Updated dependencies [a6c35a2]
+- Updated dependencies [c2f1002]
+- Updated dependencies [f163028]
+- Updated dependencies [f07808c]
+- Updated dependencies [7ffc3d3]
+- Updated dependencies [88346ba]
+- Updated dependencies [4631592]
+- Updated dependencies [32ff033]
+- Updated dependencies [5ac93d4]
+- Updated dependencies [93f267f]
+- Updated dependencies [0024abf]
+- Updated dependencies [acbf364]
+- Updated dependencies [7687f7b]
+- Updated dependencies [1659072]
+- Updated dependencies [abceb0d]
+- Updated dependencies [0c302a7]
+- Updated dependencies [6633337]
+- Updated dependencies [f00d8d4]
+- Updated dependencies [503be86]
+- Updated dependencies [cde1975]
+- Updated dependencies [0bc685a]
+- Updated dependencies [11949fc]
+- Updated dependencies [b098b0e]
+- Updated dependencies [4d00b13]
+- Updated dependencies [57bab76]
+- Updated dependencies [b90086a]
+- Updated dependencies [b95577a]
+- Updated dependencies [83c161f]
+- Updated dependencies [d8c4957]
+- Updated dependencies [f24cb83]
+- Updated dependencies [5dbbb92]
+- Updated dependencies [69f1dfd]
+  - @objectstack/spec@17.0.0-rc.0
+
+## 16.1.0
+
+### Minor Changes
+
+- b20201f: fix(service-automation): `runAs:'user'` runs data ops with the triggering user's
+  real permission sets + positions, not a bare member fallback (#3356, follow-up to
+  #1888)
+
+  Since #1888 the automation engine honours `flow.runAs` (`system` elevates), but
+  the `runAs:'user'` credential propagation was hollow. A record-change-triggered
+  `runAs:'user'` flow ran its data nodes (`update_record`, …) with a **zero-grant**
+  principal — only the `member`/`everyone` baseline — even when the triggering user
+  was fully authorized. Two faces by object config: a `private` object 403'd the
+  in-flow write (`not permitted for positions [org_member, everyone]` — the user's
+  permission sets were invisible); a `public_read_write` object let the write
+  through but **silently stripped** readonly/FLS-gated fields. The root cause: the
+  ObjectQL record-change hook session carries only a `userId` — never the writer's
+  positions/permission sets — and nothing in between resolved them, so the comment
+  promising "enforces RLS exactly as the user who made the change" never held.
+
+  The fix resolves the triggering user's **actual** authorization at run setup, from
+  the same tables a direct REST request resolves through:
+
+  - **`@objectstack/core`** factors the userId-driven core of `resolveAuthzContext`
+    into a new exported `resolveUserAuthzGrants(ql, userId, opts)` — the single place
+    that reads `sys_member` / `sys_user_position` / `sys_*_permission_set` and
+    derives positions, permission-set names, `platform_admin`, and posture. The
+    HTTP resolver now delegates to it (behaviour byte-identical; the full contract
+    suite still passes), so a non-HTTP surface that already knows the user id builds
+    the SAME envelope instead of re-implementing the reads.
+  - **`@objectstack/service-automation`** gains `AutomationEngine.setUserGrantsResolver`,
+    wired by the plugin to `resolveUserAuthzGrants` over the objectql/data engine.
+    For a `runAs:'user'` run whose trigger left the authz envelope unresolved (no
+    `permissions`), the engine now resolves the user's positions + permission sets
+    once at run setup and threads them into every data node's ObjectQL context —
+    so the run enforces RLS/FLS exactly as that user. Contexts that already carry
+    `permissions` are left untouched (a REST trigger, and notably an ADR-0090 agent
+    ceiling acting on-behalf-of a user — always non-empty — so a deliberately
+    narrowed identity is never re-broadened). `runAs:'system'` is unchanged, and a
+    resolver error fails safe (warns, keeps the bare user — never elevates).
+  - **`@objectstack/trigger-record-change`** stops forwarding the misleading
+    half-populated `positions` (empty in practice, and never `permissions`) from the
+    hook session; it forwards `userId` + tenant only and lets the engine resolve the
+    full grants authoritatively.
+
+  When no ObjectQL engine is present (bare engine / tests) the resolver is unwired
+  and run identity is unchanged from before.
+
+### Patch Changes
+
+- Updated dependencies [9e45b63]
+  - @objectstack/spec@16.1.0
+
+## 16.0.0
+
+### Minor Changes
+
+- dd9f223: feat(analytics): scope a datetime date-bucket drill to the reference-tz midnight instants (#1752 follow-up)
+
+  Closes the one gap left by the initial #1752 change: a `datetime` date dimension
+  bucketed under a **non-UTC reference timezone** previously fell back to a superset
+  drill (its bucket boundary is that tz's midnight _instant_, which `YYYY-MM-DD`
+  calendar bounds can't express).
+
+  - **`@objectstack/core`** adds `zonedDateStartToUtcMs(ymd, tz)` — the UTC instant
+    at which a calendar day begins in a reference timezone (the inverse of
+    `calendarPartsInTz`). DST-safe: the offset is read from the platform tz
+    database via `Intl`, with a two-pass resolution for the rare offset-boundary
+    case; an unset/`'UTC'`/invalid zone returns plain UTC midnight.
+  - **`@objectstack/service-analytics`** now emits `drillRanges` bounds per the
+    field's temporal type (ADR-0053): a `datetime` field → ISO **instant** bounds
+    at the reference tz's midnight (works under any tz, incl. DST); a `date` field
+    → `YYYY-MM-DD` calendar bounds (tz-naive, exact under any tz). An unknown field
+    type is still emitted only under UTC and omitted (superset) under a non-UTC tz.
+
+  No objectui change is needed — the client already forwards whatever bound values
+  the server sends into the drill filter and the `filter[field][gte|lt]` URL.
+
+- 290e2f0: feat(analytics): emit a half-open date-range drill scope for granularity-bucketed date dimensions (#1752)
+
+  A report/dashboard cell grouped by a `dateGranularity` date dimension ("2026-Q2")
+  covers a SPAN of records, so drilling it needs a range (`>= start AND < nextStart`),
+  which the equality drill contract (`drillRawRows`) can't express — date dims were
+  therefore excluded from drill metadata and a drill landed on an unscoped superset.
+
+  - **`@objectstack/core`** adds `bucketKeyToCalendarRange(key, granularity)`, the
+    inverse of `bucketDateValue`: it turns a canonical bucket key into its half-open
+    `[start, end)` calendar span (`YYYY-MM-DD`, `end` exclusive). Pure, timezone-naive
+    calendar arithmetic; returns `null` for unbucketable / out-of-range keys so the
+    caller falls back to an unscoped (superset) drill rather than emit a wrong bound.
+  - **`@objectstack/service-analytics`** emits a `drillRanges` sidecar (aligned to
+    `rows` by index — the range companion to `drillRawRows`) for `date` +
+    `dateGranularity` dimensions, computed from the canonical bucket key in the
+    pre-label-resolution snapshot pass. A `datetime` field under a non-UTC reference
+    timezone is omitted (host drills a superset) until instant-boundary support
+    lands; a tz-naive `date` field is exact under any timezone (ADR-0053).
+
+  Consumed by objectui's report drill-through to scope the drilled record list to the
+  clicked time bucket.
+
+### Patch Changes
+
+- e057f42: fix: harden the bulk-write path — retries, idempotency, contracts, and summary visibility (#3147–#3152)
+
+  Six reliability fixes to the batched seed/import + `engine.insert(array)` path
+  introduced by the #2678 bulk-write rework:
+
+  - **#3151** `bulkWrite` validates that `writeBatch` returns one record per input
+    row (a short/long/non-array return is degraded per-row, not backfilled as
+    phantom success); `engine.insert(array)` likewise rejects a short driver
+    `bulkCreate` return instead of padding afterInsert with `undefined`.
+  - **#3150** wraps the two remaining un-retried write points (seed
+    `writeRecord`/`resolveDeferredUpdates`, import's no-`createManyData`
+    fallback) in `withTransientRetry`; `defaultIsTransientError` short-circuits
+    definitive logical errors to non-transient.
+  - **#3148** import `resolveRef` flushes pending creates on a same-object miss so
+    a later row can reference an earlier same-file CREATE, and no longer
+    negatively caches a miss.
+  - **#3149** threads an `attempt` counter through `bulkWrite`; seed rechecks by
+    `externalId` and import by `matchFields` before re-writing, so a
+    commit-then-lost-response retry cannot duplicate a batch.
+  - **#3147** `recomputeSummaries` retries transient failures and, on exhaustion,
+    surfaces `SummaryRecomputeError` (`ERR_SUMMARY_RECOMPUTE`) instead of a
+    silent warn; seed/import recover it to a warning without re-writing.
+  - **#3152** autonumbers are assigned after validation, so a batch that dies in
+    validation consumes no sequence value (no number-range gaps).
+
+- 5f05de2: **`createLogger({ file })` now actually writes the file under ESM.** `openFileStream` loaded `fs` with a lazy `require()` to keep the browser-safe logger entry out of the `fs` bundle graph; esbuild rewrites that to its `__require` shim in the ESM output, which throws `Dynamic require of "fs" is not supported`, and a bare `catch {}` swallowed it. Since the workspace is `type: module`, every Node ESM consumer — `os serve`, `os dev` — silently got no file logging at all, while the CJS build kept working. The builtin now loads via `process.getBuiltinModule` (opaque to bundlers, works in both module systems, with a `require` fallback for Node < 20.16), and a `file` destination that cannot be opened reports itself on stderr instead of disappearing.
+
+  Turning the destination back on also fixed three faults that were unreachable while it never opened: `child()` opened a second stream per child and orphaned it, destroying a child logger closed the stream its parent and siblings were still writing to, and an async open failure (e.g. an unwritable path) hit an `'error'` event with no listener and took the process down.
+
+- 021ba4c: fix(core): ObjectLogger honors NO_COLOR and TTY detection before emitting ANSI colors
+
+  The kernel/plugin logger (`ctx.logger`, wired by `os serve` / `os dev`) colorized its
+  `pretty`-format level tags unconditionally, so `NO_COLOR=1` runs and piped/CI output
+  still carried ANSI escapes (e.g. `\x1b[31m…ERROR\x1b[0m`), breaking plain-text log
+  scanners (see scripts/publish-smoke.sh, which had to strip ANSI before grepping).
+
+  Per the no-color.org convention, color is now emitted only when the destination stream
+  (stdout, or stderr for error/fatal) is an interactive TTY **and** `NO_COLOR` is unset or
+  empty — any non-empty `NO_COLOR` value disables color. Interactive terminals keep the
+  existing colorized output. The optional file destination now always receives plain text.
+
+- Updated dependencies [f972574]
+- Updated dependencies [6289ec3]
+- Updated dependencies [22013aa]
+- Updated dependencies [3ad3dd5]
+- Updated dependencies [8efa395]
+- Updated dependencies [3a18b60]
+- Updated dependencies [a8aa34c]
+- Updated dependencies [a3823b2]
+- Updated dependencies [43a3efb]
+- Updated dependencies [524696a]
+- Updated dependencies [bfa3c3f]
+- Updated dependencies [5e3301d]
+- Updated dependencies [46e876c]
+- Updated dependencies [158aa14]
+- Updated dependencies [62a2117]
+- Updated dependencies [d2723e2]
+- Updated dependencies [fefcd54]
+- Updated dependencies [beaf2de]
+- Updated dependencies [369eb6e]
+- Updated dependencies [06ff734]
+- Updated dependencies [b659111]
+- Updated dependencies [5754a23]
+- Updated dependencies [6c270a6]
+- Updated dependencies [668dd17]
+- Updated dependencies [8abf133]
+- Updated dependencies [e0859b1]
+- Updated dependencies [04ecd4e]
+- Updated dependencies [4d5a892]
+- Updated dependencies [16cebeb]
+- Updated dependencies [86d30af]
+- Updated dependencies [8923843]
+- Updated dependencies [a2795f6]
+- Updated dependencies [f16b492]
+- Updated dependencies [4b6fde8]
+- Updated dependencies [2018df9]
+- Updated dependencies [fc5a3a2]
+- Updated dependencies [8ff9210]
+  - @objectstack/spec@16.0.0
+
+## 16.0.0-rc.1
+
+### Patch Changes
+
+- Updated dependencies [6289ec3]
+- Updated dependencies [8efa395]
+- Updated dependencies [bfa3c3f]
+- Updated dependencies [62a2117]
+- Updated dependencies [06ff734]
+  - @objectstack/spec@16.0.0-rc.1
+
+## 16.0.0-rc.0
+
+### Minor Changes
+
+- dd9f223: feat(analytics): scope a datetime date-bucket drill to the reference-tz midnight instants (#1752 follow-up)
+
+  Closes the one gap left by the initial #1752 change: a `datetime` date dimension
+  bucketed under a **non-UTC reference timezone** previously fell back to a superset
+  drill (its bucket boundary is that tz's midnight _instant_, which `YYYY-MM-DD`
+  calendar bounds can't express).
+
+  - **`@objectstack/core`** adds `zonedDateStartToUtcMs(ymd, tz)` — the UTC instant
+    at which a calendar day begins in a reference timezone (the inverse of
+    `calendarPartsInTz`). DST-safe: the offset is read from the platform tz
+    database via `Intl`, with a two-pass resolution for the rare offset-boundary
+    case; an unset/`'UTC'`/invalid zone returns plain UTC midnight.
+  - **`@objectstack/service-analytics`** now emits `drillRanges` bounds per the
+    field's temporal type (ADR-0053): a `datetime` field → ISO **instant** bounds
+    at the reference tz's midnight (works under any tz, incl. DST); a `date` field
+    → `YYYY-MM-DD` calendar bounds (tz-naive, exact under any tz). An unknown field
+    type is still emitted only under UTC and omitted (superset) under a non-UTC tz.
+
+  No objectui change is needed — the client already forwards whatever bound values
+  the server sends into the drill filter and the `filter[field][gte|lt]` URL.
+
+- 290e2f0: feat(analytics): emit a half-open date-range drill scope for granularity-bucketed date dimensions (#1752)
+
+  A report/dashboard cell grouped by a `dateGranularity` date dimension ("2026-Q2")
+  covers a SPAN of records, so drilling it needs a range (`>= start AND < nextStart`),
+  which the equality drill contract (`drillRawRows`) can't express — date dims were
+  therefore excluded from drill metadata and a drill landed on an unscoped superset.
+
+  - **`@objectstack/core`** adds `bucketKeyToCalendarRange(key, granularity)`, the
+    inverse of `bucketDateValue`: it turns a canonical bucket key into its half-open
+    `[start, end)` calendar span (`YYYY-MM-DD`, `end` exclusive). Pure, timezone-naive
+    calendar arithmetic; returns `null` for unbucketable / out-of-range keys so the
+    caller falls back to an unscoped (superset) drill rather than emit a wrong bound.
+  - **`@objectstack/service-analytics`** emits a `drillRanges` sidecar (aligned to
+    `rows` by index — the range companion to `drillRawRows`) for `date` +
+    `dateGranularity` dimensions, computed from the canonical bucket key in the
+    pre-label-resolution snapshot pass. A `datetime` field under a non-UTC reference
+    timezone is omitted (host drills a superset) until instant-boundary support
+    lands; a tz-naive `date` field is exact under any timezone (ADR-0053).
+
+  Consumed by objectui's report drill-through to scope the drilled record list to the
+  clicked time bucket.
+
+### Patch Changes
+
+- e057f42: fix: harden the bulk-write path — retries, idempotency, contracts, and summary visibility (#3147–#3152)
+
+  Six reliability fixes to the batched seed/import + `engine.insert(array)` path
+  introduced by the #2678 bulk-write rework:
+
+  - **#3151** `bulkWrite` validates that `writeBatch` returns one record per input
+    row (a short/long/non-array return is degraded per-row, not backfilled as
+    phantom success); `engine.insert(array)` likewise rejects a short driver
+    `bulkCreate` return instead of padding afterInsert with `undefined`.
+  - **#3150** wraps the two remaining un-retried write points (seed
+    `writeRecord`/`resolveDeferredUpdates`, import's no-`createManyData`
+    fallback) in `withTransientRetry`; `defaultIsTransientError` short-circuits
+    definitive logical errors to non-transient.
+  - **#3148** import `resolveRef` flushes pending creates on a same-object miss so
+    a later row can reference an earlier same-file CREATE, and no longer
+    negatively caches a miss.
+  - **#3149** threads an `attempt` counter through `bulkWrite`; seed rechecks by
+    `externalId` and import by `matchFields` before re-writing, so a
+    commit-then-lost-response retry cannot duplicate a batch.
+  - **#3147** `recomputeSummaries` retries transient failures and, on exhaustion,
+    surfaces `SummaryRecomputeError` (`ERR_SUMMARY_RECOMPUTE`) instead of a
+    silent warn; seed/import recover it to a warning without re-writing.
+  - **#3152** autonumbers are assigned after validation, so a batch that dies in
+    validation consumes no sequence value (no number-range gaps).
+
+- 5f05de2: **`createLogger({ file })` now actually writes the file under ESM.** `openFileStream` loaded `fs` with a lazy `require()` to keep the browser-safe logger entry out of the `fs` bundle graph; esbuild rewrites that to its `__require` shim in the ESM output, which throws `Dynamic require of "fs" is not supported`, and a bare `catch {}` swallowed it. Since the workspace is `type: module`, every Node ESM consumer — `os serve`, `os dev` — silently got no file logging at all, while the CJS build kept working. The builtin now loads via `process.getBuiltinModule` (opaque to bundlers, works in both module systems, with a `require` fallback for Node < 20.16), and a `file` destination that cannot be opened reports itself on stderr instead of disappearing.
+
+  Turning the destination back on also fixed three faults that were unreachable while it never opened: `child()` opened a second stream per child and orphaned it, destroying a child logger closed the stream its parent and siblings were still writing to, and an async open failure (e.g. an unwritable path) hit an `'error'` event with no listener and took the process down.
+
+- 021ba4c: fix(core): ObjectLogger honors NO_COLOR and TTY detection before emitting ANSI colors
+
+  The kernel/plugin logger (`ctx.logger`, wired by `os serve` / `os dev`) colorized its
+  `pretty`-format level tags unconditionally, so `NO_COLOR=1` runs and piped/CI output
+  still carried ANSI escapes (e.g. `\x1b[31m…ERROR\x1b[0m`), breaking plain-text log
+  scanners (see scripts/publish-smoke.sh, which had to strip ANSI before grepping).
+
+  Per the no-color.org convention, color is now emitted only when the destination stream
+  (stdout, or stderr for error/fatal) is an interactive TTY **and** `NO_COLOR` is unset or
+  empty — any non-empty `NO_COLOR` value disables color. Interactive terminals keep the
+  existing colorized output. The optional file destination now always receives plain text.
+
+- Updated dependencies [f972574]
+- Updated dependencies [22013aa]
+- Updated dependencies [3ad3dd5]
+- Updated dependencies [3a18b60]
+- Updated dependencies [a8aa34c]
+- Updated dependencies [a3823b2]
+- Updated dependencies [43a3efb]
+- Updated dependencies [524696a]
+- Updated dependencies [5e3301d]
+- Updated dependencies [46e876c]
+- Updated dependencies [158aa14]
+- Updated dependencies [d2723e2]
+- Updated dependencies [fefcd54]
+- Updated dependencies [beaf2de]
+- Updated dependencies [369eb6e]
+- Updated dependencies [b659111]
+- Updated dependencies [5754a23]
+- Updated dependencies [6c270a6]
+- Updated dependencies [668dd17]
+- Updated dependencies [8abf133]
+- Updated dependencies [e0859b1]
+- Updated dependencies [04ecd4e]
+- Updated dependencies [4d5a892]
+- Updated dependencies [16cebeb]
+- Updated dependencies [86d30af]
+- Updated dependencies [8923843]
+- Updated dependencies [a2795f6]
+- Updated dependencies [f16b492]
+- Updated dependencies [4b6fde8]
+- Updated dependencies [2018df9]
+- Updated dependencies [fc5a3a2]
+  - @objectstack/spec@16.0.0-rc.0
+
+## 15.1.1
+
+### Patch Changes
+
+- @objectstack/spec@15.1.1
+
+## 15.1.0
+
+### Minor Changes
+
+- f531a26: refactor(security): converge the anonymous-deny decision into one shared function + a source-enumerating ratchet (#2567 Phase 2)
+
+  Phase 1 gated every HTTP surface (REST `/data`, dispatcher `/graphql` + `/meta`,
+  raw-hono `/data`) against the secure-by-default `requireAuth` posture, but each
+  seam hand-rolled the same `!userId && !isSystem → 401` check. Phase 2 removes
+  that duplication and pins the surfaces so a new ungated entry point fails CI.
+
+  - **New `shouldDenyAnonymous` in `@objectstack/core`** (`security/anonymous-deny.ts`)
+    — the single anonymous-deny decision + shared 401 body/constants, mirroring the
+    `auth-gate.ts` pattern (pure function so the seams can never drift). All five
+    seams — REST `enforceAuth`, dispatcher `handleGraphQL` / `handleMetadata` /
+    `handleAI`, hono `denyAnonymous` — now delegate to it. **Pure refactor: no
+    runtime behavior change** (verified by the unchanged Phase-1 handler + e2e
+    proofs). Identity resolution and the dynamic exemptions (public-form grants,
+    share-link tokens) are untouched — they run upstream and only ever hand the
+    seam an already-resolved context.
+  - **A `discover()` ratchet on the authz-conformance matrix** — it statically
+    enumerates the data/meta/graphql HTTP entry points from source (curated
+    per-file probes, control-plane routes excluded) and asserts each is classified
+    by a matrix `covers` key. A new `/data`/`/meta`/`/graphql` route (or a
+    removed/stale `covers`) now fails CI as UNCLASSIFIED / STALE, not in review. A
+    companion negative test proves the ratchet bites.
+
+  A design trap is guarded: `isAuthGateAllowlisted(undefined)` returns `true`, so a
+  body-routed seam (GraphQL, which has no request path) must pass no path — the
+  shared function's non-empty-path guard denies anonymous unconditionally there,
+  never falling through to the control-plane allowlist.
+
+- f531a26: feat(kernel): add `kernel:bootstrapped` lifecycle anchor — the phase that fires after every `kernel:ready` handler has settled but before `kernel:listening` (HTTP socket open). `kernel:ready` handlers run sequentially in plugin-registration order, so a handler that consumes data produced by a later-starting plugin (e.g. the security bootstrap seeds `sys_position`; the app plugin's seed loader inserts records) would race the very rows it needs. `kernel:bootstrapped` is the correct anchor for reconcile/backfill work: every producer's ready handler has finished by the time it fires. Both `ObjectKernel` and `LiteKernel` trigger it. The sharing-rule boot backfill moves from `kernel:listening` to `kernel:bootstrapped` (semantics-only; behaviour unchanged).
+
+### Patch Changes
+
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [3fe9df1]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [4109153]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [627f225]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+- Updated dependencies [f531a26]
+  - @objectstack/spec@15.1.0
+
+## 15.0.0
+
+### Minor Changes
+
+- 13749ec: ADR-0095 D2/D3: the authorization kernel now resolves an explicit **posture
+  ladder** — a monotonic principal tier `PLATFORM_ADMIN > TENANT_ADMIN > MEMBER >
+EXTERNAL` — once, in `resolveAuthzContext`, and carries it on
+  `ResolvedAuthzContext.posture`.
+
+  - **D2 — the ladder.** New `@objectstack/core/security` module `posture-ladder.ts`
+    reuses the spec `AuthzPosture` enum and pins the rung → row-visibility
+    injection-rule mapping (exactly one rule per rung) plus its two ADR-required
+    invariants as unit-tested properties: strict nesting (rung _n_'s visible set ⊇
+    rung _n−1_'s) and the `EXTERNAL` deny-by-default semantics (explicitly shared
+    rows only — OWD baselines and sharing rules never widen it). `EXTERNAL` is
+    defined and test-locked now but never resolved: no external principal type
+    exists yet (portal/ADR-0093), so the resolver's floor is `MEMBER`.
+  - **D3 — capability-derived, single track.** The rung derives from held
+    **capability grants**, never a better-auth role: `PLATFORM_ADMIN` from the
+    unscoped `admin_full_access` grant (the same `viewAllRecords`/`modifyAllRecords`
+    evidence the superuser bypass trusts), `TENANT_ADMIN` from the
+    `organization_admin` grant. The better-auth `role='admin'` remains only a
+    _provisioning source_ of those grants (`auto-org-admin-grant.ts`,
+    `mapMembershipRole`); no enforcement path reads the raw role, closing the
+    #2836 dual-track adjudication class by construction.
+  - New spec export `ORGANIZATION_ADMIN` (the org-admin capability-grant name),
+    alongside the existing `ADMIN_FULL_ACCESS`.
+
+  **Behavior-preserving.** Enforcement is unchanged — the per-object Layer 0
+  exemption and per-side superuser bypass still gate access exactly as before;
+  `posture` is an additive, derived, explainable field. The `authz-matrix-gate`
+  unit snapshot and the dogfood authz-conformance matrix stay green. No migration
+  required.
+
+### Patch Changes
+
+- Updated dependencies [28b7c28]
+- Updated dependencies [13749ec]
+- Updated dependencies [e62c233]
+- Updated dependencies [ed61c9b]
+- Updated dependencies [31d04d4]
+  - @objectstack/spec@15.0.0
+
+## 14.8.0
+
+### Patch Changes
+
+- Updated dependencies [16b4bf6]
+- Updated dependencies [16b4bf6]
+- Updated dependencies [10e8983]
+- Updated dependencies [607aaf4]
+- Updated dependencies [bb71321]
+  - @objectstack/spec@14.8.0
+
+## 14.7.0
+
+### Patch Changes
+
+- Updated dependencies [d6a72eb]
+  - @objectstack/spec@14.7.0
+
+## 14.6.0
+
+### Patch Changes
+
+- Updated dependencies [609cb13]
+- Updated dependencies [ce6d151]
+  - @objectstack/spec@14.6.0
+
+## 14.5.0
+
+### Patch Changes
+
+- Updated dependencies [526805e]
+- Updated dependencies [d79ca07]
+- Updated dependencies [33ebd34]
+- Updated dependencies [c044f08]
+- Updated dependencies [01274eb]
+  - @objectstack/spec@14.5.0
+
+## 14.4.0
+
+### Minor Changes
+
+- 82e745e: ADR-0091 L1 — grant validity windows: effective-dated assignments, resolution-time filtering, explain expired state, authoring lint.
+
+  - **plugin-security (objects)**: `sys_user_position` and `sys_user_permission_set` gain the D1 lifecycle columns — `valid_from`, `valid_until` (half-open `[from, until)`, UTC; null = unbounded, existing rows unchanged), `reason`, `delegated_from`, `last_certified_at`, `certified_by`.
+  - **core**: new shared predicate `isGrantActive` / `isGrantExpired` (`@objectstack/core`), and `resolveAuthzContext` now filters BOTH grant tables through it (D2, fail-closed — an expired unscoped `admin_full_access` grant no longer derives `platform_admin`). Present-but-unparseable bounds fail closed.
+  - **plugin-security (explain)**: `buildContextForUser` applies the same filter and returns `expiredGrants`; the principal layer reports the dedicated "held until … — expired" contributor state so "why did access disappear" is self-answering. Spec `ExplainLayerSchema` contributors gain an optional `state: 'active' | 'expired'`.
+  - **plugin-sharing**: `PositionGraphService.expandPositionUsers` filters expired holders — sharing-rule recipients stop including them at resolution time.
+  - **lint (D7)**: two new error rules over seed data — `security-grant-expired-at-authoring` (a `valid_until` in the past, or unparseable, is a grant that can never resolve) and `security-delegation-missing-reason` (a `delegated_from` row without `reason` breaks the D3 dual audit). Also re-exported the missing `SECURITY_MASTER_DETAIL_UNGRANTED` constant.
+
+  No background job is involved anywhere — per ADR-0049, an expired grant simply stops resolving, in every edition.
+
+### Patch Changes
+
+- Updated dependencies [7953832]
+- Updated dependencies [82e745e]
+- Updated dependencies [f3035bd]
+- Updated dependencies [82c0d94]
+- Updated dependencies [7449476]
+  - @objectstack/spec@14.4.0
+
+## 14.3.0
+
+### Patch Changes
+
+- Updated dependencies [2a71f48]
+- Updated dependencies [02f6af4]
+- Updated dependencies [c1064f1]
+  - @objectstack/spec@14.3.0
+
+## 14.2.0
+
+### Patch Changes
+
+- Updated dependencies [ac8f029]
+- Updated dependencies [4ab9958]
+  - @objectstack/spec@14.2.0
+
+## 14.1.0
+
+### Patch Changes
+
+- Updated dependencies [5a8465f]
+- Updated dependencies [7f8620b]
+- Updated dependencies [82ba3a6]
+  - @objectstack/spec@14.1.0
+
+## 14.0.0
+
+### Patch Changes
+
+- Updated dependencies [0a8e685]
+- Updated dependencies [afa8115]
+- Updated dependencies [80f12ca]
+- Updated dependencies [e2fa074]
+- Updated dependencies [23c8668]
+- Updated dependencies [29f017d]
+- Updated dependencies [216fa9a]
+- Updated dependencies [6c22b12]
+  - @objectstack/spec@14.0.0
+
+## 13.0.0
+
+### Major Changes
+
+- 6d83431: ADR-0090 P1 breaking wave — permission model v2 concept convergence.
+
+  Pre-launch one-step renames and secure defaults (no compatibility aliases, per
+  ADR-0090 D3/D4 superseding ADR-0057 D5/D7's alias discipline):
+
+  - `sys_role` → `sys_position`, `sys_user_role` → `sys_user_position` (field
+    `role` → `position`), `sys_role_permission_set` → `sys_position_permission_set`
+    (field `role_id` → `position_id`); `RoleSchema`/`defineRole` →
+    `PositionSchema`/`definePosition` with **no `parent`** (positions are flat;
+    hierarchy lives on the business-unit tree).
+  - `ExecutionContext.roles[]` → `positions[]`; the EvalUser/CEL contract
+    `current_user.roles` → `current_user.positions` (formula validators updated);
+    stack property `roles:` → `positions:`; metadata kinds `role`/`profile` →
+    `position` (profile kind removed).
+  - `isProfile` removed from `PermissionSetSchema` (ADR-0090 D2); `isDefault`
+    narrows to an install-time suggestion; `appDefaultProfileName` →
+    `appDefaultPermissionSetName` (isDefault-only).
+  - OWD enum drops legacy aliases `read`/`read_write`/`full`; new optional
+    `externalSharingModel` (external dial, `private` default) lands as P1 spec
+    shape (ADR-0090 D11).
+  - **Secure default (D1)**: a custom object with an owner field and NO
+    `sharingModel` now resolves `private` (was: fully public). System objects
+    keep their explicit posture. Unrecognised stored values fail closed.
+  - ExecutionContext gains the P1 principal-taxonomy shape (D10):
+    `principalKind` / `audience` / `onBehalfOf` (optional, semantics phase in
+    later).
+  - Sharing recipients: `role` → `position` (expanded via `sys_user_position`
+    ∪ the better-auth membership transition source); `role_and_subordinates`
+    removed — `unit_and_subordinates` now expands the business-unit subtree
+    (finishes ADR-0057 D5's re-homing).
+
+### Minor Changes
+
+- 01917c2: ADR-0090 P2 — audience anchors: `everyone`/`guest` builtin positions.
+
+  - `EVERYONE_POSITION` / `GUEST_POSITION` constants in `@objectstack/spec`;
+    both anchors seeded (system-managed) alongside the builtin identity names.
+  - Every authenticated principal implicitly holds `everyone` in
+    `ctx.positions`, so sets bound to it resolve as ordinary position-bound
+    grants — ADDITIVE. The fallback CLIFF is abolished: the configured
+    baseline (`fallbackPermissionSet`, default `member_default`) now applies
+    in addition to explicit grants instead of only when the user had none,
+    and is also seeded as an `everyone` binding (same table/audit/explain
+    path as admin-authored defaults).
+  - Sessionless HTTP principals resolve as `principalKind: 'guest'` holding
+    exactly `['guest']`; internal bare contexts are untouched.
+  - Audience-anchor binding gate: `sys_position_permission_set` writes that
+    would bind a high-privilege set (VAMA, delete/purge/transfer, system
+    permissions, `'*'` wildcard) to `everyone`/`guest` are rejected at the
+    data layer, unconditionally (`describeHighPrivilegeBits` predicate is
+    exported and shared with the seed-time validation).
+
+### Patch Changes
+
+- Updated dependencies [6d83431]
+- Updated dependencies [01917c2]
+- Updated dependencies [b271691]
+- Updated dependencies [a5a1e41]
+- Updated dependencies [466adf6]
+- Updated dependencies [5be00c3]
+- Updated dependencies [466adf6]
+- Updated dependencies [2bee609]
+- Updated dependencies [fc7e7f7]
+  - @objectstack/spec@13.0.0
+
+## 12.6.0
+
+### Minor Changes
+
+- 21420d9: Seed loader and data-import now route bulk writes through the engine's array-form `insert()` (one round-trip per batch, with parent-deduplicated summary recompute) instead of one `insert()`/`createData()` call per record, and both retry transient driver errors instead of silently dropping the row (#2678).
+
+  A new shared helper, `bulkWrite` (`@objectstack/core`), batches rows through a caller-supplied batch-write function, retries a whole-batch transient failure (network blip / timeout) with exponential backoff, and degrades to per-row writes (each itself retried) when a batch fails for a non-transient reason — so one bad row can't drop the other N-1. `withTransientRetry` wraps a single write (e.g. an update) with the same retry behavior.
+
+  - `SeedLoaderService.loadDataset()` (`@objectstack/metadata-protocol`) buffers insert-mode records and flushes them in batches of 200 via the engine's array `insert()`. Datasets with a self-referencing field (e.g. `employee.manager_id -> employee`) keep the historical per-record write path, since a later record may need an earlier one's freshly-assigned id.
+  - `runImport()` (`@objectstack/rest`) buffers create-resolved rows and flushes them via `protocol.createManyData()` when the protocol supports it, falling back to the original per-row `createData()` call otherwise. `Protocol.createManyData` (`@objectstack/metadata-protocol`) now forwards `context` to `engine.insert()` like `createData` already did, so tenant-scoped bulk creates work correctly.
+
+  Previously, a 1000-row seed or import into an object with a rollup summary issued 1000+ round-trips and up to 1000 summary recomputes; a single transient network error on any one row silently dropped it with no retry (the 2026-07-06 HotCRM first-boot incident). A `bulkCreate`-capable driver now sees roughly `ceil(N/batch)` writes, and a transient error is retried before a row is ever reported as failed.
+
+  **Fix (`@objectstack/driver-sql`):** `SqlDriver.bulkCreate()` never generated a client-side id for a row missing one, unlike `create()` — a latent gap that this change is the first to exercise at scale (a bulk-inserted row without a driver-native id default silently landed with `id: NULL`). `bulkCreate()` now mirrors `create()`'s id/`_id` normalization per row.
+
+### Patch Changes
+
+- Updated dependencies [6cebf22]
+  - @objectstack/spec@12.6.0
+
+## 12.5.0
+
+### Patch Changes
+
+- Updated dependencies [8b3d363]
+  - @objectstack/spec@12.5.0
+
+## 12.4.0
+
+### Patch Changes
+
+- Updated dependencies [60dc3ba]
+  - @objectstack/spec@12.4.0
+
+## 12.3.0
+
+### Patch Changes
+
+- Updated dependencies [e7eceec]
+  - @objectstack/spec@12.3.0
+
+## 12.2.0
+
+### Patch Changes
+
+- 4f5b791: Wire three more Studio-authored metadata surfaces at runtime (#2605 — the
+  "declared but never wired" family, following the #2596 hooks template).
+
+  **Authored actions now execute (#2605 item 1).** `engine.executeAction`'s map
+  was only ever populated from the app bundle at boot, so a published `action`
+  row (standalone or embedded in an authored object's `actions[]`) was stored
+  and listed but never executable — before OR after a restart. Now:
+
+  - `AppPlugin` installs a QuickJS-sandboxed default action runner at boot
+    (`engine.setDefaultActionRunner`), the action-path twin of the #2596 hook
+    body runner. Opt out with `OS_DISABLE_AUTHORED_ACTIONS=1`.
+  - `ObjectQLPlugin` re-registers runtime-authored actions from their
+    `sys_metadata` rows under `packageId: 'metadata-service'` at
+    `kernel:ready`, on `metadata:reloaded`, and on `action`/`object` protocol
+    mutations — saves, publishes, edits, and deletes take effect live.
+    Package-artifact actions are excluded (AppPlugin owns those; re-registering
+    would clobber their handlers).
+
+  **Authored translations reach the i18n runtime (#2591).** `translation`
+  metadata items (single-locale `AppTranslationBundle` payloads; locale from
+  `_meta.locale`, a top-level `locale`, or a BCP-47-shaped item name) now load
+  into the i18n service as a separate authored layer that overlays static
+  bundles. Both adapters carry the layer — service-i18n's `FileI18nAdapter`
+  AND the kernel's in-memory fallback (`createMemoryI18n`), which is what dev
+  and standalone stacks actually run. The shared sync
+  (`wireAuthoredTranslationSync`, exported from `@objectstack/core`, wired by
+  the runtime's AppPlugin and by I18nServicePlugin with single-owner
+  semantics) runs at `kernel:ready`, on `metadata:reloaded`, and on
+  `translation` protocol mutations, with clear-then-reload semantics so
+  deleted items/keys stop resolving instead of lingering in the deep-merged
+  map.
+
+  **Sharing rules created at runtime bind without a restart (#2592).**
+  `bindRuleHooks` was boot-only, so the first rule authored at runtime for an
+  object with no boot-time rule silently never evaluated (rule authoring is a
+  data insert — `metadata:reloaded` never fires). The sharing plugin now binds
+  afterInsert/afterUpdate/afterDelete triggers on `sys_sharing_rule` that
+  unbind + re-bind the rule-hook package from a fresh `listRules()`, serialized
+  so overlapping writes can't leave a stale snapshot bound, and fail-safe so a
+  rebind failure never fails the rule write.
+
+- Updated dependencies [fce8ff4]
+- Updated dependencies [3962023]
+- Updated dependencies [2bb193d]
+- Updated dependencies [0426d27]
+- Updated dependencies [da807f7]
+  - @objectstack/spec@12.2.0
+
+## 12.1.0
+
+### Patch Changes
+
+- Updated dependencies [93e6d02]
+  - @objectstack/spec@12.1.0
+
+## 12.0.0
+
+### Patch Changes
+
+- Updated dependencies [a8df396]
+- Updated dependencies [e695fe0]
+- Updated dependencies [7c09621]
+- Updated dependencies [7709db4]
+- Updated dependencies [2082109]
+- Updated dependencies [7c09621]
+- Updated dependencies [9860de4]
+- Updated dependencies [069c205]
+  - @objectstack/spec@12.0.0
+
+## 11.10.0
+
+### Patch Changes
+
+- Updated dependencies [6a9397e]
+- Updated dependencies [c0efe5d]
+  - @objectstack/spec@11.10.0
+
+## 11.9.0
+
+### Patch Changes
+
+- Updated dependencies [d3595d9]
+  - @objectstack/spec@11.9.0
+
+## 11.8.0
+
+### Patch Changes
+
+- @objectstack/spec@11.8.0
+
+## 11.7.0
+
+### Patch Changes
+
+- Updated dependencies [5178906]
+  - @objectstack/spec@11.7.0
+
+## 11.6.0
+
+### Patch Changes
+
+- @objectstack/spec@11.6.0
+
+## 11.5.0
+
+### Patch Changes
+
+- Updated dependencies [6ee4f04]
+- Updated dependencies [c1e3a65]
+  - @objectstack/spec@11.5.0
+
+## 11.4.0
+
+### Patch Changes
+
+- Updated dependencies [5821c51]
+- Updated dependencies [a0fce3f]
+  - @objectstack/spec@11.4.0
+
+## 11.3.0
+
+### Patch Changes
+
+- Updated dependencies [58e8e31]
+- Updated dependencies [b4a5df0]
+  - @objectstack/spec@11.3.0
+
+## 11.2.0
+
+### Patch Changes
+
+- Updated dependencies [d0f4b13]
+- Updated dependencies [302bdab]
+  - @objectstack/spec@11.2.0
+
+## 11.1.0
+
+### Minor Changes
+
+- ce0b4f6: Auth: password expiry — the session-validation gate (ADR-0069 D1, P1)
+
+  Builds the **authentication-policy session gate** ADR-0069 needs and uses it for password expiry. When `password_expiry_days` (new `auth` setting, 0 = off) is exceeded, an authenticated user is blocked from protected REST resources with `403 PASSWORD_EXPIRED` until they change their password — while auth + remediation paths stay reachable.
+
+  - **core**: new pure `evaluateAuthGate` / `isAuthGateAllowlisted` helper (`@objectstack/core/security`) — single source of truth for the allow-list (auth endpoints, change-password, health, UI-bootstrap reads).
+  - **plugin-auth**: `customSession` computes the gate posture once and attaches `user.authGate`; `computeAuthGate` reads `sys_user.password_changed_at` vs the configured window; `password_changed_at` is stamped on sign-up / change / reset; `isAuthGateActive()` keeps the gate **zero-overhead** when off.
+  - **platform-objects**: new `sys_user.password_changed_at` column.
+  - **rest**: `resolveExecCtx` carries `authGate`; `enforceAuth` blocks gated sessions (independent of `requireAuth`) using the core allow-list.
+  - **service-settings**: new `password_expiry_days` field.
+
+  Default-off / additive (no upgrade behavior change); a null `password_changed_at` never expires (existing users). Per ADR-0049 the setting ships with its enforcement; timestamps written as `Date` (ADR-0074).
+
+  This gate is the shared seam for **enforced MFA** (ADR-0069 D3), which lands next as a small addition (a second `authGate` branch). The dispatcher/MCP path is a follow-up (tracked in #2375); the REST surface the Console uses is fully gated here.
+
+- 3e593a7: Remove the deprecated `DriverInterface` type alias — use `IDataDriver` (11.0).
+
+  `DriverInterface` was a `@deprecated` alias of `IDataDriver` (the authoritative
+  driver contract). It is removed from `@objectstack/spec/contracts` and
+  `@objectstack/core`; `objectql`'s engine now types drivers as `IDataDriver`
+  directly (a type-identical change, since the alias _was_ `IDataDriver`).
+
+  Driver authors: replace `DriverInterface` with `IDataDriver` (same shape).
+
+  Note: this is unrelated to the live `IDataEngine` interface (engine-layer
+  contract, not deprecated) and to the separate zod-derived `DriverInterface` /
+  `DriverInterfaceSchema` in `@objectstack/spec/data` (the runtime driver schema),
+  both of which are unchanged.
+
+### Patch Changes
+
+- 9ccfcd6: perf(core): authenticated requests issued ~16 sequential queries — duplicate authz + repeated localization — now request-scoped memoized
+
+  An authenticated REST request resolves its execution context (identity +
+  RBAC/RLS + localization) many times in a single handler — the data operation
+  itself, app-nav RBAC filtering, dashboard widget gating, the ADR-0069 auth gate.
+  Each `resolveExecCtx` pass is the full `resolveAuthzContext` aggregation plus the
+  localization read (~16 sequential queries), and nothing memoized it, so a request
+  that resolves twice paid for duplicate authz and repeated localization.
+
+  - **`@objectstack/rest`** — `resolveExecCtx` is now memoized per request, keyed by
+    the request object (a `WeakMap`, so the entry is collected with the request — no
+    TTL, no cross-request leak) and the input `environmentId`. The in-flight Promise
+    is cached so concurrent callers share one resolution. The heavy path moved to
+    `computeExecCtx`. Anonymous (`undefined`) resolutions are cached too.
+  - **`@objectstack/core`** — within a single `resolveAuthzContext` pass, `sys_user`
+    is now read at most once (the email fallback and the `ai_seat` synthesis shared a
+    duplicate query on the API-key path); `resolveLocalizationContext`'s direct-read
+    fallback batches `timezone`/`locale`/`currency` into one `sys_setting` query
+    (`$in` on `key`) instead of three sequential reads.
+
+  No authorization-behavior change — the same roles/permissions/RLS context is
+  resolved, just without the redundant reads. The `sys_member` reads (per-user roles
+  vs. all-org-members) are intentionally left distinct (different filters/limits).
+
+  Tests: query-counting regressions assert `sys_user` reads once and localization
+  reads once; new rest-server tests pin the per-request/per-environment memo contract.
+
+- Updated dependencies [ecf193f]
+- Updated dependencies [51bec81]
+- Updated dependencies [3e593a7]
+- Updated dependencies [63d5403]
+  - @objectstack/spec@11.1.0
+
+## 11.0.0
+
+### Patch Changes
+
+- c715d25: chore(license): unify the framework repo to a single Apache-2.0 license
+
+  The repo was left in a half-finished, self-contradictory source-available
+  transition: 44 package `LICENSE` files carried restrictive dual-license text
+  (a Licensor of "ObjectStack AI LLC", a four-year conversion date, and an
+  anti-competitive-hosting grant) while those same packages' `package.json`
+  already declared `"license": "Apache-2.0"` — and that license text pointed at
+  `LICENSING.md` for the authoritative list of restricted packages, which listed
+  none. The root also carried a redundant `LICENSE.apache` left over from that
+  transition.
+
+  The framework is deliberately permissive Apache-2.0 to maximize adoption; value
+  capture lives in the separate closed-source cloud repo, not here. This change
+  makes that unambiguous: every package `LICENSE` now contains the canonical
+  Apache 2.0 text (copied from the root `LICENSE`), the redundant root
+  `LICENSE.apache` is removed, and `LICENSING.md` states the entire repository is
+  Apache-2.0 with no dual-license language. No restrictive-license residue remains
+  anywhere outside `node_modules`.
+
+  This is a metadata-only change (license text and `package.json` already agreed);
+  the patch bump republishes the affected packages with the corrected `LICENSE`.
+
+- aa33b02: fix(security): single-source the request authorization resolver — REST no longer drops sys_user_position
+
+  The REST server and the runtime dispatcher each carried their own copy of the request → ExecutionContext identity/role resolver, and they drifted on a security path. The REST copy silently omitted `sys_user_position` (so custom roles granted via the ADR-0057 D4 platform-RBAC path did not apply over REST), `sys_position_permission_set`, the `owner→org_owner` membership normalization, the platform-admin derivation, and the `ai_seat` synthesis — fail-closed (legitimate access denied), not an escalation.
+
+  Both entry points now delegate to a single shared resolver, `resolveAuthzContext` in `@objectstack/core/security` (joining the API-key verifier that already lived there). A contract test locks every authorization source and a lint gate (`check:authz-resolver`) prevents a future duplicate resolver or a dropped delegation.
+
+- Updated dependencies [ab5718a]
+- Updated dependencies [4845c12]
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [5eef4cf]
+- Updated dependencies [72759e1]
+- Updated dependencies [6c4fbd9]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [cd51229]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [ad143ce]
+- Updated dependencies [5c4a8c8]
+- Updated dependencies [3afaeed]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+- Updated dependencies [d980f0d]
+- Updated dependencies [a658523]
+- Updated dependencies [82ff91c]
+- Updated dependencies [638f472]
+  - @objectstack/spec@11.0.0
+
+## 10.3.0
+
+### Patch Changes
+
+- @objectstack/spec@10.3.0
+
+## 10.2.0
+
+### Patch Changes
+
+- Updated dependencies [b496498]
+  - @objectstack/spec@10.2.0
+
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+
+## 10.0.0
+
+### Patch Changes
+
+- d5f6d29: fix(runtime): surface code-defined datasources at `GET /api/v1/datasources` and `GET /api/v1/meta/datasource` on the standalone / host-config boot path (ADR-0015 §18, follow-up to #2111).
+
+  A datasource declared in `defineStack({ datasources: [...] })` (e.g. the showcase's `showcase_external`) is stamped `origin: 'code'` and registered by `AppPlugin` via `metadata.registerInMemory('datasource', …)` — gated on `typeof metadata.registerInMemory === 'function'`. On the standalone / host-config path (`os dev`/`serve` for a config whose `plugins` are already instantiated — `isHostConfig` true — so no `MetadataPlugin` loads) the `metadata` service is an in-memory fallback that implemented `register`/`list`/`get` but **not** `registerInMemory`. The guard was therefore false, AppPlugin silently skipped the registration, and the datasource was absent from both REST surfaces (and Setup → Integrations → Datasources) even though the boot banner counted it and its federated objects were queryable.
+
+  Both in-memory `metadata` fallbacks (`@objectstack/core`'s `createMemoryMetadata` and `@objectstack/plugin-dev`'s dev stub) now implement `registerInMemory` (synchronous, no persistence — identical to `register` for these in-memory stores, matching `MetadataManager`'s signature). The read paths (`metadata.list`, datasource-admin `listDatasources`, and `protocol.getMetaItems` which merges `metadata.list`) were already correct; this restores the write-side registration they depend on. It also makes stack-declared security metadata (`roles`/`permissions`/`sharingRules`/`policies`, registered through the same guard) listable on this path.
+
+- Updated dependencies [d7ff626]
+- Updated dependencies [2a1b16b]
+- Updated dependencies [e16f2a8]
+- Updated dependencies [e411a82]
+- Updated dependencies [a581385]
+- Updated dependencies [220ce5b]
+- Updated dependencies [3efe334]
+- Updated dependencies [feead7e]
+- Updated dependencies [6ca20b3]
+- Updated dependencies [5f875fe]
+- Updated dependencies [b469950]
+  - @objectstack/spec@10.0.0
+
+## 9.11.0
+
+### Patch Changes
+
+- Updated dependencies [e7f6539]
+- Updated dependencies [2365d07]
+- Updated dependencies [6595b53]
+- Updated dependencies [fa8964d]
+- Updated dependencies [36138c7]
+- Updated dependencies [a8e4f3b]
+- Updated dependencies [4c213c2]
+- Updated dependencies [2afb612]
+  - @objectstack/spec@9.11.0
+
+## 9.10.0
+
+### Patch Changes
+
+- Updated dependencies [db02bd5]
+- Updated dependencies [641675d]
+- Updated dependencies [94e9040]
+- Updated dependencies [1f88fd9]
+- Updated dependencies [1f88fd9]
+  - @objectstack/spec@9.10.0
+
+## 9.9.1
+
+### Patch Changes
+
+- @objectstack/spec@9.9.1
+
+## 9.9.0
+
+### Minor Changes
+
+- 601cc11: feat(analytics): timezone-aware date bucketing (ADR-0053 Phase 2)
+
+  Analytics day/week/month/quarter/year buckets now resolve on a **reference timezone's** calendar days, so a row near a tz day-boundary lands in the bucket a user in that zone would expect — identically on SQLite and Postgres.
+
+  Per ADR-0053 decision **D2**, bucketing is done **in-memory, uniformly** for non-UTC zones rather than emitting dialect-specific `date_trunc … AT TIME ZONE` (SQLite has no tz database and MySQL needs tz tables loaded, so splitting by dialect would shift bucket boundaries for the same data). `engine.aggregate({ timezone })` therefore forces the in-memory aggregation path when a non-UTC reference tz is set — the date-range `where` still goes to the driver, so only matching rows are fetched. **UTC / unset keeps the native driver fast path unchanged.**
+
+  - New shared `calendarPartsInTz` / `calendarPartsInTzOrUtc` util in `@objectstack/core` (DST-safe via `Intl.DateTimeFormat`, never hand-rolled offset math; falls back to UTC for an unset/`'UTC'`/invalid zone).
+  - `EngineAggregateOptions` and the analytics `executeAggregate` bridge / `ObjectQLStrategy` thread the reference timezone (sourced from the dataset selection / `ExecutionContext`) through to `applyInMemoryAggregation` → `bucketDateValue`, and the draft-preview evaluator's `bucketDate`.
+  - `formatDateBucket` (dimension labels) stays UTC-only by design: it re-labels values that were _already_ bucketed upstream, so re-applying a timezone there would shift a correct bucket by a day.
+
+### Patch Changes
+
+- Updated dependencies [84249a4]
+- Updated dependencies [11af299]
+- Updated dependencies [d5774b5]
+- Updated dependencies [134043a]
+- Updated dependencies [90108e0]
+- Updated dependencies [9afeb2d]
+- Updated dependencies [6bec07e]
+- Updated dependencies [601cc11]
+- Updated dependencies [575448d]
+  - @objectstack/spec@9.9.0
+
+## 9.8.0
+
+### Patch Changes
+
+- Updated dependencies [97c55b3]
+- Updated dependencies [1b1f490]
+  - @objectstack/spec@9.8.0
+
+## 9.7.0
+
+### Patch Changes
+
+- @objectstack/spec@9.7.0
+
+## 9.6.0
+
+### Patch Changes
+
+- Updated dependencies [d1e930a]
+- Updated dependencies [71578f2]
+- Updated dependencies [5e3a301]
+- Updated dependencies [5db2742]
+  - @objectstack/spec@9.6.0
+
+## 9.5.1
+
+### Patch Changes
+
+- Updated dependencies [ee72aae]
+  - @objectstack/spec@9.5.1
+
+## 9.5.0
+
+### Patch Changes
+
+- Updated dependencies [d08551c]
+- Updated dependencies [707aeed]
+- Updated dependencies [7a103d4]
+- Updated dependencies [4b01250]
+  - @objectstack/spec@9.5.0
+
+## 9.4.0
+
+### Patch Changes
+
+- Updated dependencies [060467a]
+- Updated dependencies [0856476]
+- Updated dependencies [b678d8c]
+- Updated dependencies [b678d8c]
+- Updated dependencies [b678d8c]
+  - @objectstack/spec@9.4.0
+
+## 9.3.0
+
+### Patch Changes
+
+- Updated dependencies [1ada658]
+- Updated dependencies [3219191]
+- Updated dependencies [290f631]
+- Updated dependencies [50b7b47]
+- Updated dependencies [f15d6f6]
+- Updated dependencies [f8684ea]
+- Updated dependencies [b4765be]
+  - @objectstack/spec@9.3.0
+
+## 9.2.0
+
+### Patch Changes
+
+- Updated dependencies [2f57b75]
+- Updated dependencies [2f57b75]
+  - @objectstack/spec@9.2.0
+
+## 9.1.0
+
+### Patch Changes
+
+- Updated dependencies [b9062c9]
+  - @objectstack/spec@9.1.0
+
+## 9.0.1
+
+### Patch Changes
+
+- Updated dependencies [1817845]
+  - @objectstack/spec@9.0.1
+
+## 9.0.0
+
+### Patch Changes
+
+- Updated dependencies [4c3f693]
+- Updated dependencies [0bf39f1]
+- Updated dependencies [f533f42]
+- Updated dependencies [1c83ee8]
+  - @objectstack/spec@9.0.0
+
+## 8.0.1
+
+### Patch Changes
+
+- @objectstack/spec@8.0.1
+
+## 8.0.0
+
+### Minor Changes
+
+- c262301: fix(rest): REST data API honors sys_api_key — one shared verifier with MCP (closes #1633)
+
+  Staging e2e found the MCP surface authenticated a `sys_api_key` but the REST data
+  API (`@objectstack/rest`) returned 401 for the same key — its `resolveExecCtx`
+  only checked the better-auth session, never the API key.
+
+  Converged both surfaces onto ONE verifier so they can't drift:
+
+  - **`@objectstack/core/security`** now owns the shared `sys_api_key` primitives
+    (`hashApiKey`, `generateApiKey`, `extractApiKey`, `parseScopes`, `isExpired`)
+    plus a new `resolveApiKeyPrincipal(ql, headers, nowMs?)` that hashes the
+    inbound key, looks it up by the indexed at-rest hash, and rejects unknown /
+    revoked / expired / owner-less keys (fail-closed). `core` is the natural home:
+    both `rest` and `runtime` depend on it, it depends on neither (no cycle), and
+    it's server-side (already uses `node:crypto`).
+  - **`@objectstack/runtime`** — `security/api-key.ts` re-exports the primitives
+    from core (stable import surface) and `resolveExecutionContext` now delegates
+    its API-key branch to `resolveApiKeyPrincipal`.
+  - **`@objectstack/rest`** — `resolveExecCtx` resolves the data engine once and
+    tries `resolveApiKeyPrincipal` (x-api-key / `Authorization: ApiKey`) BEFORE the
+    session, so `/api/v1/data` + `/api/v1/meta` now authenticate an API key under
+    the key's permissions + RLS, exactly like the dispatcher/MCP path.
+
+  Tests: core `api-key.test.ts` (primitives + verifier: valid / revoked / expired /
+  unknown / owner-less / plaintext-not-matched / fail-closed-ql). runtime + rest
+  suites green.
+
+### Patch Changes
+
+- Updated dependencies [a46c017]
+- Updated dependencies [b990b89]
+- Updated dependencies [99111ec]
+- Updated dependencies [d5a8161]
+- Updated dependencies [5cf1f1b]
+- Updated dependencies [9ef89d4]
+- Updated dependencies [3306d2f]
+- Updated dependencies [bc44195]
+- Updated dependencies [9e2e229]
+  - @objectstack/spec@8.0.0
+
+## 7.9.0
+
+### Patch Changes
+
+- @objectstack/spec@7.9.0
+
+## 7.8.0
+
+### Patch Changes
+
+- Updated dependencies [06f2bbb]
+- Updated dependencies [36719db]
+- Updated dependencies [424ab26]
+  - @objectstack/spec@7.8.0
+
+## 7.7.0
+
+### Patch Changes
+
+- Updated dependencies [b391955]
+- Updated dependencies [f06b64e]
+- Updated dependencies [023bf93]
+  - @objectstack/spec@7.7.0
+
+## 7.6.0
+
+### Patch Changes
+
+- Updated dependencies [955d4c8]
+- Updated dependencies [c4a4cbd]
+- Updated dependencies [b046ec2]
+- Updated dependencies [2170ad9]
+- Updated dependencies [02d6359]
+- Updated dependencies [7648242]
+- Updated dependencies [8fa1e7f]
+- Updated dependencies [55866f5]
+- Updated dependencies [60f9c45]
+  - @objectstack/spec@7.6.0
+
+## 7.5.0
+
+### Patch Changes
+
+- @objectstack/spec@7.5.0
+
+## 7.4.1
+
+### Patch Changes
+
+- @objectstack/spec@7.4.1
+
+## 7.4.0
+
+### Patch Changes
+
+- Updated dependencies [23c7107]
+- Updated dependencies [c72daad]
+- Updated dependencies [f115182]
+- Updated dependencies [2faf9f2]
+- Updated dependencies [2faf9f2]
+- Updated dependencies [2faf9f2]
+- Updated dependencies [58b450b]
+- Updated dependencies [82eb6cf]
+- Updated dependencies [13d8653]
+- Updated dependencies [ff3d006]
+- Updated dependencies [5e831de]
+  - @objectstack/spec@7.4.0
+
+## 7.3.0
+
+### Patch Changes
+
+- 5e7c554: **Rename kernel plugin-sandbox permission schemas to remove a naming footgun** (issue #1383).
+
+  `@objectstack/spec/kernel` exported `PermissionSchema` / `PermissionSetSchema`
+  (and the `Permission` / `PermissionSet` types) for the plugin-sandbox security
+  model. Their names collided with the metadata-protocol permission set exported
+  from `@objectstack/spec/security` (`PermissionSetSchema`), making it very easy
+  to validate the `permission`/`profile` metadata type against the wrong schema
+  and reject every legal payload.
+
+  The kernel symbols are now prefixed with `Plugin` to reflect their specialized
+  semantics:
+
+  | Old (`@objectstack/spec/kernel`) | New                         |
+  | :------------------------------- | :-------------------------- |
+  | `PermissionSchema`               | `PluginPermissionSchema`    |
+  | `PermissionSetSchema`            | `PluginPermissionSetSchema` |
+  | `Permission` (type)              | `PluginPermission`          |
+  | `PermissionSet` (type)           | `PluginPermissionSet`       |
+
+  The metadata `permission`/`profile` types are unchanged — keep using
+  `PermissionSetSchema` from `@objectstack/spec/security`.
+
+- Updated dependencies [5e7c554]
+  - @objectstack/spec@7.3.0
+
+## 7.2.1
+
+### Patch Changes
+
+- @objectstack/spec@7.2.1
+
+## 7.2.0
+
+### Patch Changes
+
+- @objectstack/spec@7.2.0
+
+## 7.1.0
+
+### Patch Changes
+
+- Updated dependencies [47a92f4]
+  - @objectstack/spec@7.1.0
+
+## 7.0.0
+
+### Patch Changes
+
+- Updated dependencies [74470ad]
+- Updated dependencies [d29617e]
+- Updated dependencies [dc72172]
+  - @objectstack/spec@7.0.0
+
+## 6.9.0
+
+### Patch Changes
+
+- @objectstack/spec@6.9.0
+
+## 6.8.1
+
+### Patch Changes
+
+- @objectstack/spec@6.8.1
+
+## 6.8.0
+
+### Patch Changes
+
+- Updated dependencies [6e88f77]
+- Updated dependencies [c8b9f57]
+  - @objectstack/spec@6.8.0
+
+## 6.7.1
+
+### Patch Changes
+
+- @objectstack/spec@6.7.1
+
+## 6.7.0
+
+### Patch Changes
+
+- Updated dependencies [430067b]
+- Updated dependencies [4f9e9d4]
+  - @objectstack/spec@6.7.0
+
+## 6.6.0
+
+### Patch Changes
+
+- Updated dependencies [a49cfc2]
+  - @objectstack/spec@6.6.0
+
+## 6.5.1
+
+### Patch Changes
+
+- @objectstack/spec@6.5.1
+
+## 6.5.0
+
+### Patch Changes
+
+- @objectstack/spec@6.5.0
+
+## 6.4.0
+
+### Patch Changes
+
+- Updated dependencies [f8651cc]
+- Updated dependencies [f8651cc]
+- Updated dependencies [0bf6f9a]
+  - @objectstack/spec@6.4.0
+
+## 6.3.0
+
+### Patch Changes
+
+- @objectstack/spec@6.3.0
+
+## 6.2.0
+
+### Patch Changes
+
+- Updated dependencies [b4c74a9]
+  - @objectstack/spec@6.2.0
+
+## 6.1.1
+
+### Patch Changes
+
+- @objectstack/spec@6.1.1
+
+## 6.1.0
+
+### Patch Changes
+
+- Updated dependencies [93c0589]
+  - @objectstack/spec@6.1.0
+
+## 6.0.0
+
+### Patch Changes
+
+- Updated dependencies [629a716]
+- Updated dependencies [dbc4f7d]
+- Updated dependencies [944f187]
+  - @objectstack/spec@6.0.0
+
+## 5.2.0
+
+### Patch Changes
+
+- Updated dependencies [bab2b20]
+- Updated dependencies [fa011d8]
+- Updated dependencies [b806f58]
+  - @objectstack/spec@5.2.0
+
+## 5.1.0
+
+### Patch Changes
+
+- Updated dependencies [75f4ee6]
+- Updated dependencies [823d559]
+  - @objectstack/spec@5.1.0
+
+## 5.0.0
+
+### Patch Changes
+
+- Updated dependencies [2f9073a]
+  - @objectstack/spec@5.0.0
+
+## 4.2.0
+
+### Patch Changes
+
+- Updated dependencies [2869891]
+  - @objectstack/spec@4.2.0
+
+## 4.1.1
+
+### Patch Changes
+
+- @objectstack/spec@4.1.1
+
+## 4.1.0
+
+### Patch Changes
+
+- Updated dependencies [2108c30]
+- Updated dependencies [23db640]
+  - @objectstack/spec@4.1.0
+
+## 4.0.5
+
+### Patch Changes
+
+- 15e0df6: chore: unify all package versions to a single patch release
+- Updated dependencies [15e0df6]
+  - @objectstack/spec@4.0.5
+
+## 4.0.4
+
+### Patch Changes
+
+- Updated dependencies [326b66b]
+  - @objectstack/spec@4.0.4
+
+## 4.0.3
+
+### Patch Changes
+
+- @objectstack/spec@4.0.3
+
+## 4.0.2
+
+### Patch Changes
+
+- Updated dependencies [5f659e9]
+  - @objectstack/spec@4.0.2
+
+## 4.0.0
+
+### Minor Changes
+
+- e0b0a78: Deprecate DataEngineQueryOptions in favor of QueryAST-aligned EngineQueryOptions.
+
+  Engine, Protocol, and Client now use standard QueryAST parameter names:
+
+  - `filter` → `where`
+  - `select` → `fields`
+  - `sort` → `orderBy`
+  - `skip` → `offset`
+  - `populate` → `expand`
+  - `top` → `limit`
+
+  The old DataEngine\* schemas and types are preserved with `@deprecated` markers for backward compatibility.
+
+### Patch Changes
+
+- Updated dependencies [f08ffc3]
+- Updated dependencies [e0b0a78]
+  - @objectstack/spec@4.0.0
+
+## 3.3.1
+
+### Patch Changes
+
+- @objectstack/spec@3.3.1
+
+## 3.3.0
+
+### Patch Changes
+
+- @objectstack/spec@3.3.0
+
+## 3.2.9
+
+### Patch Changes
+
+- @objectstack/spec@3.2.9
+
+## 3.2.8
+
+### Patch Changes
+
+- @objectstack/spec@3.2.8
+
+## 3.2.7
+
+### Patch Changes
+
+- @objectstack/spec@3.2.7
+
+## 3.2.6
+
+### Patch Changes
+
+- @objectstack/spec@3.2.6
+
+## 3.2.5
+
+### Patch Changes
+
+- @objectstack/spec@3.2.5
+
+## 3.2.4
+
+### Patch Changes
+
+- @objectstack/spec@3.2.4
+
+## 3.2.3
+
+### Patch Changes
+
+- @objectstack/spec@3.2.3
+
+## 3.2.2
+
+### Patch Changes
+
+- Updated dependencies [46defbb]
+  - @objectstack/spec@3.2.2
+
+## 3.2.1
+
+### Patch Changes
+
+- Updated dependencies [850b546]
+  - @objectstack/spec@3.2.1
+
+## 3.2.0
+
+### Patch Changes
+
+- Updated dependencies [5901c29]
+  - @objectstack/spec@3.2.0
+
+## 3.1.1
+
+### Patch Changes
+
+- Updated dependencies [953d667]
+  - @objectstack/spec@3.1.1
+
+## 3.1.0
+
+### Patch Changes
+
+- Updated dependencies [0088830]
+  - @objectstack/spec@3.1.0
+
+## 3.0.11
+
+### Patch Changes
+
+- Updated dependencies [92d9d99]
+  - @objectstack/spec@3.0.11
+
+## 3.0.10
+
+### Patch Changes
+
+- Updated dependencies [d1e5d31]
+  - @objectstack/spec@3.0.10
+
+## 3.0.9
+
+### Patch Changes
+
+- Updated dependencies [15e0df6]
+  - @objectstack/spec@3.0.9
+
+## 3.0.8
+
+### Patch Changes
+
+- Updated dependencies [5a968a2]
+  - @objectstack/spec@3.0.8
+
+## 3.0.7
+
+### Patch Changes
+
+- Updated dependencies [0119bd7]
+- Updated dependencies [5426bdf]
+  - @objectstack/spec@3.0.7
+
+## 3.0.6
+
+### Patch Changes
+
+- Updated dependencies [5df254c]
+  - @objectstack/spec@3.0.6
+
+## 3.0.5
+
+### Patch Changes
+
+- Updated dependencies [23a4a68]
+  - @objectstack/spec@3.0.5
+
+## 3.0.4
+
+### Patch Changes
+
+- Updated dependencies [d738987]
+  - @objectstack/spec@3.0.4
+
+## 3.0.3
+
+### Patch Changes
+
+- c7267f6: Patch release for maintenance updates and improvements.
+- Updated dependencies [c7267f6]
+  - @objectstack/spec@3.0.3
+
+## 3.0.2
+
+### Patch Changes
+
+- Updated dependencies [28985f5]
+  - @objectstack/spec@3.0.2
+
+## 3.0.1
+
+### Patch Changes
+
+- Updated dependencies [389725a]
+  - @objectstack/spec@3.0.1
+
+## 3.0.0
+
+### Major Changes
+
+- Release v3.0.0 — unified version bump for all ObjectStack packages.
+
+### Patch Changes
+
+- Updated dependencies
+  - @objectstack/spec@3.0.0
+
+## 2.0.7
+
+### Patch Changes
+
+- Updated dependencies
+  - @objectstack/spec@2.0.7
+
+## 2.0.6
+
+### Patch Changes
+
+- Patch release for maintenance and stability improvements
+- Updated dependencies
+  - @objectstack/spec@2.0.6
+
+## 2.0.5
+
+### Patch Changes
+
+- Updated dependencies
+  - @objectstack/spec@2.0.5
+
+## 2.0.4
+
+### Patch Changes
+
+- Patch release for maintenance and stability improvements
+- Updated dependencies
+  - @objectstack/spec@2.0.4
+
+## 2.0.3
+
+### Patch Changes
+
+- Patch release for maintenance and stability improvements
+- Updated dependencies
+  - @objectstack/spec@2.0.3
+
+## 2.0.2
+
+### Patch Changes
+
+- Updated dependencies [1db8559]
+  - @objectstack/spec@2.0.2
+
+## 2.0.1
+
+### Patch Changes
+
+- Patch release for maintenance and stability improvements
+- Updated dependencies
+  - @objectstack/spec@2.0.1
+
+## 2.0.0
+
+### Patch Changes
+
+- Updated dependencies [38e5dd5]
+- Updated dependencies [38e5dd5]
+  - @objectstack/spec@2.0.0
+
+## 1.0.12
+
+### Patch Changes
+
+- chore: add Vercel deployment configs, simplify console runtime configuration
+- Updated dependencies
+  - @objectstack/spec@1.0.12
+
+## 1.0.11
+
+### Patch Changes
+
+- @objectstack/spec@1.0.11
+
+## 1.0.10
+
+### Patch Changes
+
+- 10f52e1: fix: silence unhandled promise rejections when checking for async services in kernel
+  - @objectstack/spec@1.0.10
+
+## 1.0.9
+
+### Patch Changes
+
+- @objectstack/spec@1.0.9
+
+## 1.0.8
+
+### Patch Changes
+
+- @objectstack/spec@1.0.8
+
+## 1.0.7
+
+### Patch Changes
+
+- @objectstack/spec@1.0.7
+
+## 1.0.6
+
+### Patch Changes
+
+- Updated dependencies [a7f7b9d]
+  - @objectstack/spec@1.0.6
+
+## 1.0.5
+
+### Patch Changes
+
+- b1d24bd: refactor: migrate build system from tsc to tsup for faster builds
+  - Replaced `tsc` with `tsup` (using esbuild) across all packages
+  - Added shared `tsup.config.ts` in workspace root
+  - Added `tsup` as workspace dev dependency
+  - significantly improved build performance
+- Updated dependencies [b1d24bd]
+  - @objectstack/spec@1.0.5
+
+## 1.0.4
+
+### Patch Changes
+
+- @objectstack/spec@1.0.4
+
+## 1.0.3
+
+### Patch Changes
+
+- fb2eabd: fix: resolve "process is not defined" runtime error in browser environments by adding safe environment detection and polyfills
+  - @objectstack/spec@1.0.3
+
+## 1.0.2
+
+### Patch Changes
+
+- a0a6c85: Infrastructure and development tooling improvements
+
+  - Add changeset configuration for automated version management
+  - Add comprehensive GitHub Actions workflows (CI, CodeQL, linting, releases)
+  - Add development configuration files (.cursorrules, .github/prompts)
+  - Add documentation files (ARCHITECTURE.md, CONTRIBUTING.md, workflows docs)
+  - Update test script configuration in package.json
+  - Add @objectstack/cli to devDependencies for better development experience
+
+- 109fc5b: Unified patch release to align all package versions.
+- Updated dependencies [a0a6c85]
+- Updated dependencies [109fc5b]
+  - @objectstack/spec@1.0.2
+
+## 1.0.1
+
+### Patch Changes
+
+- @objectstack/spec@1.0.1
+
+## 1.0.0
+
+### Major Changes
+
+- Major version release for ObjectStack Protocol v1.0.
+  - Stabilized Protocol Definitions
+  - Enhanced Runtime Plugin Support
+  - Fixed Type Compliance across Monorepo
+
+### Patch Changes
+
+- Updated dependencies
+  - @objectstack/spec@1.0.0
+
+## 0.9.2
+
+### Patch Changes
+
+- Updated dependencies
+  - @objectstack/spec@0.9.2
+
+## 0.9.1
+
+### Patch Changes
+
+- Patch release for maintenance and stability improvements. All packages updated with unified versioning.
+- Updated dependencies
+  - @objectstack/spec@0.9.1
+
+## 0.8.2
+
+### Patch Changes
+
+- Updated dependencies [555e6a7]
+  - @objectstack/spec@0.8.2
+
+## 0.8.1
+
+### Patch Changes
+
+- @objectstack/spec@0.8.1
+
+## 1.0.0
+
+### Minor Changes
+
+- # Upgrade to Zod v4 and Protocol Improvements
+
+  This release includes a major upgrade to the core validation engine (Zod v4) and aligns all protocol definitions with stricter type safety.
+
+### Patch Changes
+
+- Updated dependencies
+  - @objectstack/spec@1.0.0
+
+## 0.7.2
+
+### Patch Changes
+
+- fb41cc0: Patch release: Updated documentation and JSON schemas
+- Updated dependencies [fb41cc0]
+  - @objectstack/spec@0.7.2
+
+## 0.7.1
+
+### Patch Changes
+
+- Updated dependencies
+  - @objectstack/spec@0.7.1
+
+## 0.6.1
+
+### Patch Changes
+
+- Patch release for maintenance and stability improvements
+- Updated dependencies
+  - @objectstack/spec@0.6.1
+
+## 0.6.0
+
+### Minor Changes
+
+- b2df5f7: Unified version bump to 0.5.0
+
+  - Standardized all package versions to 0.5.0 across the monorepo
+  - Fixed driver-memory package.json paths for proper module resolution
+  - Ensured all packages are in sync for the 0.5.0 release
+
+### Patch Changes
+
+- Updated dependencies [b2df5f7]
+  - @objectstack/spec@0.6.0