@objectstack/runtime 13.0.0 → 14.5.0

package/dist/index.d.cts

@@ -682,6 +682,19 @@ interface DispatcherPluginConfig {
      * where membership has not been seeded.
      */
     enforceProjectMembership?: boolean;
+    /**
+     * Reject anonymous requests to `auth: true` service routes (AI, etc.) with
+     * HTTP 401, mirroring the REST API's `requireAuth` gate. Must match the
+     * REST plugin's `api.requireAuth` so `/ai` and `/meta` stay in lockstep
+     * with `/data` — otherwise the AI routes' declared `auth: true` contract is
+     * never enforced and anonymous callers reach adapter/model status routes.
+     *
+     * Defaults to `false` (backward-compatible: previously nothing enforced
+     * `RouteDefinition.auth` here). Hosts pass their `api.requireAuth` through —
+     * the framework `serve` command and the cloud apps do so from the same
+     * stack `api` config the REST plugin reads.
+     */
+    requireAuth?: boolean;
     /**
      * Security response headers. When provided, every response routed
      * through this plugin gets the headers merged in (route-specific
@@ -955,6 +968,14 @@ interface HttpDispatcherOptions {
      * called on every scoped request so idle projects are evicted after TTL.
      */
     scopeManager?: EnvironmentScopeManager;
+    /**
+     * Reject anonymous requests to `auth: true` service routes (AI) and to the
+     * metadata catch-all with HTTP 401, mirroring the REST API's `requireAuth`
+     * gate. Matches {@link DispatcherPluginConfig.requireAuth}; the dispatcher
+     * plugin threads the host's `api.requireAuth` here. Defaults to `false`
+     * (backward-compatible — nothing enforced `RouteDefinition.auth` before).
+     */
+    requireAuth?: boolean;
 }
 /**
  * The HTTP dispatch engine — translates an inbound (method, path, body, ctx)
@@ -982,6 +1003,12 @@ declare class HttpDispatcher {
      * `DispatcherConfig.enforceProjectMembership`).
      */
     private enforceMembership;
+    /**
+     * When `true`, `auth: true` AI routes and the metadata catch-all reject
+     * anonymous callers with 401 (mirrors the REST `requireAuth` gate). Set
+     * from {@link HttpDispatcherOptions.requireAuth}. Defaults to `false`.
+     */
+    private requireAuth;
     /**
      * In-memory cache of positive membership checks, keyed by
      * `${environmentId}:${userId}`. Entries expire 60 seconds after insertion
@@ -1065,6 +1092,18 @@ declare class HttpDispatcher {
      * OAuth 2.1 TLS rule), the dispatcher only relays it. Never throws.
      */
     private getMcpResourceMetadataUrl;
+    /**
+     * `GET /mcp/skill` — the environment-customized portable Agent Skill
+     * (`SKILL.md`), rendered by the MCP service (ADR-0036 Amendment C: ONE
+     * generic skill; only the connection URL is environment-specific).
+     *
+     * Served PUBLIC like `/discovery`: the content is generic agent
+     * instructions plus a URL the caller already knows — no schema, no
+     * tenant data. Gated on the same default-on switch as the `/mcp` route
+     * (404 when opted out, so the surface isn't advertised) and 501 when the
+     * MCP plugin isn't loaded, mirroring `handleMcp`.
+     */
+    handleMcpSkill(method: string, context: HttpProtocolContext): Promise<HttpDispatcherResult>;
     /**
      * Normalise the inbound request into a Web-standard `Request` for the MCP
      * transport. Accepts an already-Web `Request`, or a node/Hono-style req
@@ -1486,7 +1525,7 @@ declare class HttpDispatcher {
      * Handles Analytics requests
      * path: sub-path after /analytics/
      */
-    handleAnalytics(path: string, method: string, body: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult>;
+    handleAnalytics(path: string, method: string, body: any, context: HttpProtocolContext): Promise<HttpDispatcherResult>;
     /**
      * Handles in-app notification requests (ADR-0030) — the
      * `/api/v1/notifications` surface backed by the messaging service's inbox
@@ -1501,6 +1540,21 @@ declare class HttpDispatcher {
      *   POST /read/all   → markAllRead
      */
     handleNotification(path: string, method: string, body: any, query: any, context: HttpProtocolContext): Promise<HttpDispatcherResult>;
+    /**
+     * Handle the security admin surface (`/security/...`) — ADR-0090 D5/D9
+     * suggested audience bindings. A package's `isDefault: true` permission
+     * set is an install-time SUGGESTION to bind it to the `everyone` position;
+     * these routes let an admin see and resolve those suggestions. The
+     * `security` service does the real gating (tenant-admin pre-check, and the
+     * confirm write runs under the audience-anchor + delegated-admin gates
+     * with the caller's execution context — never auto-bound, never system).
+     *
+     * Routes:
+     *   GET  /security/suggested-bindings?status=&packageId=   → list (reconciles first)
+     *   POST /security/suggested-bindings/:id/confirm          → create the anchor binding
+     *   POST /security/suggested-bindings/:id/dismiss          → decline the suggestion
+     */
+    handleSecurity(path: string, method: string, _body: any, query: any, context: HttpProtocolContext): Promise<HttpDispatcherResult>;
     /**
      * Handles i18n requests
      * path: sub-path after /i18n/

package/dist/index.d.ts

@@ -682,6 +682,19 @@ interface DispatcherPluginConfig {
      * where membership has not been seeded.
      */
     enforceProjectMembership?: boolean;
+    /**
+     * Reject anonymous requests to `auth: true` service routes (AI, etc.) with
+     * HTTP 401, mirroring the REST API's `requireAuth` gate. Must match the
+     * REST plugin's `api.requireAuth` so `/ai` and `/meta` stay in lockstep
+     * with `/data` — otherwise the AI routes' declared `auth: true` contract is
+     * never enforced and anonymous callers reach adapter/model status routes.
+     *
+     * Defaults to `false` (backward-compatible: previously nothing enforced
+     * `RouteDefinition.auth` here). Hosts pass their `api.requireAuth` through —
+     * the framework `serve` command and the cloud apps do so from the same
+     * stack `api` config the REST plugin reads.
+     */
+    requireAuth?: boolean;
     /**
      * Security response headers. When provided, every response routed
      * through this plugin gets the headers merged in (route-specific
@@ -955,6 +968,14 @@ interface HttpDispatcherOptions {
      * called on every scoped request so idle projects are evicted after TTL.
      */
     scopeManager?: EnvironmentScopeManager;
+    /**
+     * Reject anonymous requests to `auth: true` service routes (AI) and to the
+     * metadata catch-all with HTTP 401, mirroring the REST API's `requireAuth`
+     * gate. Matches {@link DispatcherPluginConfig.requireAuth}; the dispatcher
+     * plugin threads the host's `api.requireAuth` here. Defaults to `false`
+     * (backward-compatible — nothing enforced `RouteDefinition.auth` before).
+     */
+    requireAuth?: boolean;
 }
 /**
  * The HTTP dispatch engine — translates an inbound (method, path, body, ctx)
@@ -982,6 +1003,12 @@ declare class HttpDispatcher {
      * `DispatcherConfig.enforceProjectMembership`).
      */
     private enforceMembership;
+    /**
+     * When `true`, `auth: true` AI routes and the metadata catch-all reject
+     * anonymous callers with 401 (mirrors the REST `requireAuth` gate). Set
+     * from {@link HttpDispatcherOptions.requireAuth}. Defaults to `false`.
+     */
+    private requireAuth;
     /**
      * In-memory cache of positive membership checks, keyed by
      * `${environmentId}:${userId}`. Entries expire 60 seconds after insertion
@@ -1065,6 +1092,18 @@ declare class HttpDispatcher {
      * OAuth 2.1 TLS rule), the dispatcher only relays it. Never throws.
      */
     private getMcpResourceMetadataUrl;
+    /**
+     * `GET /mcp/skill` — the environment-customized portable Agent Skill
+     * (`SKILL.md`), rendered by the MCP service (ADR-0036 Amendment C: ONE
+     * generic skill; only the connection URL is environment-specific).
+     *
+     * Served PUBLIC like `/discovery`: the content is generic agent
+     * instructions plus a URL the caller already knows — no schema, no
+     * tenant data. Gated on the same default-on switch as the `/mcp` route
+     * (404 when opted out, so the surface isn't advertised) and 501 when the
+     * MCP plugin isn't loaded, mirroring `handleMcp`.
+     */
+    handleMcpSkill(method: string, context: HttpProtocolContext): Promise<HttpDispatcherResult>;
     /**
      * Normalise the inbound request into a Web-standard `Request` for the MCP
      * transport. Accepts an already-Web `Request`, or a node/Hono-style req
@@ -1486,7 +1525,7 @@ declare class HttpDispatcher {
      * Handles Analytics requests
      * path: sub-path after /analytics/
      */
-    handleAnalytics(path: string, method: string, body: any, _context: HttpProtocolContext): Promise<HttpDispatcherResult>;
+    handleAnalytics(path: string, method: string, body: any, context: HttpProtocolContext): Promise<HttpDispatcherResult>;
     /**
      * Handles in-app notification requests (ADR-0030) — the
      * `/api/v1/notifications` surface backed by the messaging service's inbox
@@ -1501,6 +1540,21 @@ declare class HttpDispatcher {
      *   POST /read/all   → markAllRead
      */
     handleNotification(path: string, method: string, body: any, query: any, context: HttpProtocolContext): Promise<HttpDispatcherResult>;
+    /**
+     * Handle the security admin surface (`/security/...`) — ADR-0090 D5/D9
+     * suggested audience bindings. A package's `isDefault: true` permission
+     * set is an install-time SUGGESTION to bind it to the `everyone` position;
+     * these routes let an admin see and resolve those suggestions. The
+     * `security` service does the real gating (tenant-admin pre-check, and the
+     * confirm write runs under the audience-anchor + delegated-admin gates
+     * with the caller's execution context — never auto-bound, never system).
+     *
+     * Routes:
+     *   GET  /security/suggested-bindings?status=&packageId=   → list (reconciles first)
+     *   POST /security/suggested-bindings/:id/confirm          → create the anchor binding
+     *   POST /security/suggested-bindings/:id/dismiss          → decline the suggestion
+     */
+    handleSecurity(path: string, method: string, _body: any, query: any, context: HttpProtocolContext): Promise<HttpDispatcherResult>;
     /**
      * Handles i18n requests
      * path: sub-path after /i18n/

package/dist/index.js

@@ -2119,6 +2119,7 @@ function checkApiExposure(def, action) {
 }
 
 // src/security/resolve-execution-context.ts
+import { scopesToAgentPermissionSets, MCP_OAUTH_SCOPE_ACTIONS } from "@objectstack/spec/ai";
 import {
   resolveAuthzContext,
   resolveLocalizationContext
@@ -2182,7 +2183,15 @@ async function resolveExecutionContext(opts) {
     isSystem: false
   };
   if (authz.userId) {
-    ctx.principalKind = "human";
+    if (oauthPrincipal?.clientId) {
+      ctx.principalKind = "agent";
+      ctx.onBehalfOf = { userId: authz.userId, principalKind: "human" };
+      ctx.permissions = scopesToAgentPermissionSets(oauthPrincipal.scopes);
+      ctx.positions = [];
+      ctx.systemPermissions = oauthPrincipal.scopes?.includes(MCP_OAUTH_SCOPE_ACTIONS) ? authz.systemPermissions ?? [] : [];
+    } else {
+      ctx.principalKind = "human";
+    }
   } else {
     ctx.principalKind = "guest";
     ctx.positions = ["guest"];
@@ -2266,6 +2275,7 @@ var _HttpDispatcher = class _HttpDispatcher {
       }
     };
     this.enforceMembership = options?.enforceProjectMembership ?? true;
+    this.requireAuth = options?.requireAuth ?? false;
     this.kernelResolver = options?.kernelResolver ?? resolveService("kernel-resolver");
     this.scopeManager = options?.scopeManager ?? resolveService("scope-manager");
   }
@@ -2557,6 +2567,73 @@ var _HttpDispatcher = class _HttpDispatcher {
       return null;
     }
   }
+  /**
+   * `GET /mcp/skill` — the environment-customized portable Agent Skill
+   * (`SKILL.md`), rendered by the MCP service (ADR-0036 Amendment C: ONE
+   * generic skill; only the connection URL is environment-specific).
+   *
+   * Served PUBLIC like `/discovery`: the content is generic agent
+   * instructions plus a URL the caller already knows — no schema, no
+   * tenant data. Gated on the same default-on switch as the `/mcp` route
+   * (404 when opted out, so the surface isn't advertised) and 501 when the
+   * MCP plugin isn't loaded, mirroring `handleMcp`.
+   */
+  async handleMcpSkill(method, context) {
+    if (!_HttpDispatcher.isMcpEnabled()) {
+      return { handled: true, response: this.error("MCP server is not enabled for this environment", 404) };
+    }
+    if (method !== "GET") {
+      return {
+        handled: true,
+        response: {
+          status: 405,
+          headers: { Allow: "GET" },
+          body: { success: false, error: { message: "Method not allowed \u2014 use GET", code: 405 } }
+        }
+      };
+    }
+    const mcp = await this.resolveService("mcp", context.environmentId);
+    if (!mcp || typeof mcp.renderSkill !== "function") {
+      return { handled: true, response: this.error("MCP server is not available", 501) };
+    }
+    let mcpUrl;
+    try {
+      const authService = await this.resolveService("auth", context.environmentId);
+      const url = authService?.getMcpResourceUrl?.();
+      if (typeof url === "string" && url) mcpUrl = url;
+    } catch {
+    }
+    if (!mcpUrl) {
+      try {
+        const webReq = this.toMcpWebRequest(context.request, void 0);
+        const host = webReq?.headers.get("host");
+        if (host) {
+          const proto = webReq?.headers.get("x-forwarded-proto") || "http";
+          mcpUrl = `${proto}://${host}/api/v1/mcp`;
+        }
+      } catch {
+      }
+    }
+    const markdown = mcp.renderSkill({ mcpUrl });
+    return {
+      handled: true,
+      result: {
+        type: "stream",
+        status: 200,
+        contentType: "text/markdown; charset=utf-8",
+        headers: {
+          "content-type": "text/markdown; charset=utf-8",
+          "content-disposition": 'inline; filename="SKILL.md"',
+          // Same reasoning as /discovery (cloud#152): reflects mutable
+          // runtime config (base URL), must never be edge-cached stale.
+          "cache-control": "no-store"
+        },
+        events: (async function* () {
+          yield markdown;
+        })()
+      }
+    };
+  }
   /**
    * Normalise the inbound request into a Web-standard `Request` for the MCP
    * transport. Accepts an already-Web `Request`, or a node/Hono-style req
@@ -3364,6 +3441,15 @@ var _HttpDispatcher = class _HttpDispatcher {
    * Fallback for backward compat: /metadata (all objects), /metadata/:objectName (get object)
    */
   async handleMetadata(path, _context, method, body, query) {
+    if (this.requireAuth) {
+      const ec = _context.executionContext;
+      if (!ec?.userId && !ec?.isSystem) {
+        return {
+          handled: true,
+          response: this.error("Authentication is required to access this endpoint.", 401, { code: "unauthenticated" })
+        };
+      }
+    }
     const parts = path.replace(/^\/+/, "").split("/").filter(Boolean);
     if (parts[0] === "types") {
       const protocol = await this.resolveService("protocol");
@@ -3663,13 +3749,13 @@ var _HttpDispatcher = class _HttpDispatcher {
    * Handles Analytics requests
    * path: sub-path after /analytics/
    */
-  async handleAnalytics(path, method, body, _context) {
+  async handleAnalytics(path, method, body, context) {
     const analyticsService = await this.getService(CoreServiceName.enum.analytics);
     if (!analyticsService) return { handled: false };
     const m = method.toUpperCase();
     const subPath = path.replace(/^\/+/, "");
     if (subPath === "query" && m === "POST") {
-      const result = await analyticsService.query(body);
+      const result = await analyticsService.query(body, context?.executionContext);
       return { handled: true, response: this.success(result) };
     }
     if (subPath === "meta" && m === "GET") {
@@ -3677,7 +3763,7 @@ var _HttpDispatcher = class _HttpDispatcher {
       return { handled: true, response: this.success(result) };
     }
     if (subPath === "sql" && m === "POST") {
-      const result = await analyticsService.generateSql(body);
+      const result = await analyticsService.generateSql(body, context?.executionContext);
       return { handled: true, response: this.success(result) };
     }
     return { handled: false };
@@ -3722,6 +3808,56 @@ var _HttpDispatcher = class _HttpDispatcher {
     }
     return { handled: false };
   }
+  /**
+   * Handle the security admin surface (`/security/...`) — ADR-0090 D5/D9
+   * suggested audience bindings. A package's `isDefault: true` permission
+   * set is an install-time SUGGESTION to bind it to the `everyone` position;
+   * these routes let an admin see and resolve those suggestions. The
+   * `security` service does the real gating (tenant-admin pre-check, and the
+   * confirm write runs under the audience-anchor + delegated-admin gates
+   * with the caller's execution context — never auto-bound, never system).
+   *
+   * Routes:
+   *   GET  /security/suggested-bindings?status=&packageId=   → list (reconciles first)
+   *   POST /security/suggested-bindings/:id/confirm          → create the anchor binding
+   *   POST /security/suggested-bindings/:id/dismiss          → decline the suggestion
+   */
+  async handleSecurity(path, method, _body, query, context) {
+    const service = await this.resolveService("security", context.environmentId);
+    if (!service || typeof service.listAudienceBindingSuggestions !== "function") {
+      return { handled: true, response: this.error("Security service not available", 503) };
+    }
+    const ec = context.executionContext;
+    if (!ec?.userId && !ec?.isSystem) {
+      return { handled: true, response: this.error("Authentication required", 401) };
+    }
+    const m = method.toUpperCase();
+    const parts = path.split("/").filter(Boolean);
+    if (parts[0] !== "suggested-bindings") return { handled: false };
+    try {
+      if (parts.length === 1 && m === "GET") {
+        const status = query?.status ? String(query.status) : void 0;
+        const packageId = query?.packageId ? String(query.packageId) : void 0;
+        const result = await service.listAudienceBindingSuggestions(ec, { status, packageId });
+        return { handled: true, response: this.success(result) };
+      }
+      if (parts.length === 3 && m === "POST") {
+        const id = decodeURIComponent(parts[1]);
+        if (parts[2] === "confirm") {
+          const result = await service.confirmAudienceBindingSuggestion(ec, id);
+          return { handled: true, response: this.success(result) };
+        }
+        if (parts[2] === "dismiss") {
+          const result = await service.dismissAudienceBindingSuggestion(ec, id);
+          return { handled: true, response: this.success(result) };
+        }
+      }
+      return { handled: false };
+    } catch (err) {
+      const status = typeof err?.statusCode === "number" ? err.statusCode : 500;
+      return { handled: true, response: this.error(err?.message ?? "Security operation failed", status) };
+    }
+  }
   /**
    * Handles i18n requests
    * path: sub-path after /i18n/
@@ -4727,8 +4863,16 @@ var _HttpDispatcher = class _HttpDispatcher {
         return Array.isArray(rows) ? rows : rows?.value ?? [];
       }
     };
-    const userIdFromAuth = _context?.user?.id ?? _context?.userId ?? "system";
-    const userFromAuth = _context?.user ?? { id: userIdFromAuth, name: userIdFromAuth };
+    const ec = _context?.executionContext;
+    const userFromAuth = ec?.userId ? {
+      id: ec.userId,
+      name: ec.userId,
+      email: ec.email,
+      roles: Array.isArray(ec.positions) ? ec.positions : [],
+      positions: Array.isArray(ec.positions) ? ec.positions : [],
+      permissions: Array.isArray(ec.permissions) ? ec.permissions : [],
+      tenantId: ec.tenantId
+    } : { id: "system", name: "system", roles: [], positions: [], permissions: [] };
     const actionContext = {
       record,
       user: userFromAuth,
@@ -4807,6 +4951,15 @@ var _HttpDispatcher = class _HttpDispatcher {
       if (route.method !== method) continue;
       const params = matchRoute(route.path, fullPath);
       if (params === null) continue;
+      if (this.requireAuth && route.auth !== false) {
+        const gec = context.executionContext;
+        if (!gec?.userId && !gec?.isSystem) {
+          return {
+            handled: true,
+            response: this.error("Authentication is required to access this endpoint.", 401, { code: "unauthenticated" })
+          };
+        }
+      }
       const ec = context.executionContext;
       const user = ec?.userId ? {
         userId: ec.userId,
@@ -5110,6 +5263,9 @@ var _HttpDispatcher = class _HttpDispatcher {
       if (cleanPath.startsWith("/data")) {
         return this.handleData(cleanPath.substring(5), method, body, query, context);
       }
+      if (cleanPath === "/mcp/skill" || cleanPath.startsWith("/mcp/skill?")) {
+        return this.handleMcpSkill(method, context);
+      }
       if (cleanPath === "/mcp" || cleanPath.startsWith("/mcp/") || cleanPath.startsWith("/mcp?")) {
         return this.handleMcp(body, context);
       }
@@ -5137,6 +5293,9 @@ var _HttpDispatcher = class _HttpDispatcher {
       if (cleanPath.startsWith("/notifications")) {
         return this.handleNotification(cleanPath.substring(14), method, body, query, context);
       }
+      if (cleanPath === "/security" || cleanPath.startsWith("/security/")) {
+        return this.handleSecurity(cleanPath.substring(9), method, body, query, context);
+      }
       if (cleanPath.startsWith("/packages")) {
         return this.handlePackages(cleanPath.substring(9), method, body, query, context);
       }
@@ -5533,7 +5692,7 @@ function resolveErrorReporter(ctx, override) {
 }
 
 // src/dispatcher-plugin.ts
-function mountRouteOnServer(route, server, routePath, securityHeaders, resolveUser) {
+function mountRouteOnServer(route, server, routePath, securityHeaders, resolveUser, requireAuth = false) {
   const handler = async (req, res) => {
     try {
       let user;
@@ -5543,6 +5702,17 @@ function mountRouteOnServer(route, server, routePath, securityHeaders, resolveUs
         } catch {
         }
       }
+      if (requireAuth && route.auth !== false && !user) {
+        res.status(401);
+        if (securityHeaders) {
+          for (const [k, v] of Object.entries(securityHeaders)) res.header(k, v);
+        }
+        res.json({
+          error: "unauthenticated",
+          message: "Authentication is required to access this endpoint."
+        });
+        return;
+      }
       const result = await route.handler({
         body: req.body,
         params: req.params,
@@ -5726,8 +5896,10 @@ function createDispatcherPlugin(config = {}) {
       if (!server) return;
       const kernel = ctx.getKernel();
       const enforceMembership = config.enforceProjectMembership ?? (config.scoping?.enableProjectScoping ?? false);
+      const requireAuth = config.requireAuth ?? config.scoping?.requireAuth ?? false;
       const dispatcher = new HttpDispatcher(kernel, void 0, {
-        enforceProjectMembership: enforceMembership
+        enforceProjectMembership: enforceMembership,
+        requireAuth
       });
       const prefix = config.prefix || "/api/v1";
       const securityHeaders = config.securityHeaders === false ? void 0 : buildSecurityHeaders(
@@ -5855,6 +6027,14 @@ function createDispatcherPlugin(config = {}) {
       mountMcp("POST");
       mountMcp("GET");
       mountMcp("DELETE");
+      server.get(`${prefix}/mcp/skill`, async (req, res) => {
+        try {
+          const result = await dispatcher.dispatch("GET", "/mcp/skill", req.body, req.query, { request: req });
+          sendResult(result, res);
+        } catch (err) {
+          errorResponse(err, res);
+        }
+      });
       server.post(`${prefix}/keys`, async (req, res) => {
         try {
           const result = await dispatcher.dispatch("POST", "/keys", req.body, req.query, { request: req });
@@ -6159,9 +6339,7 @@ function createDispatcherPlugin(config = {}) {
       const registerActionRoutes = (base) => {
         server.post(`${base}/actions/:object/:action`, async (req, res) => {
           try {
-            const ctx2 = { request: req };
-            if (req.params?.environmentId) ctx2.environmentId = req.params.environmentId;
-            const result = await dispatcher.handleActions(`/${req.params.object}/${req.params.action}`, "POST", req.body, ctx2);
+            const result = await dispatcher.dispatch("POST", `/actions/${req.params.object}/${req.params.action}`, req.body, req.query, { request: req });
             sendResult(result, res);
           } catch (err) {
             errorResponse(err, res);
@@ -6169,9 +6347,7 @@ function createDispatcherPlugin(config = {}) {
         });
         server.post(`${base}/actions/:object/:action/:recordId`, async (req, res) => {
           try {
-            const ctx2 = { request: req };
-            if (req.params?.environmentId) ctx2.environmentId = req.params.environmentId;
-            const result = await dispatcher.handleActions(`/${req.params.object}/${req.params.action}/${req.params.recordId}`, "POST", req.body, ctx2);
+            const result = await dispatcher.dispatch("POST", `/actions/${req.params.object}/${req.params.action}/${req.params.recordId}`, req.body, req.query, { request: req });
             sendResult(result, res);
           } catch (err) {
             errorResponse(err, res);
@@ -6233,11 +6409,11 @@ function createDispatcherPlugin(config = {}) {
         const routePath = route.path.startsWith("/api/v1") ? route.path : `${prefix}${route.path}`;
         let count = 0;
         if (enableProjectScoping && projectResolution === "required") {
-          if (mountRouteOnServer(route, server, toScopedPath(routePath), securityHeaders, resolveRequestUser)) count++;
+          if (mountRouteOnServer(route, server, toScopedPath(routePath), securityHeaders, resolveRequestUser, requireAuth)) count++;
         } else {
-          if (mountRouteOnServer(route, server, routePath, securityHeaders, resolveRequestUser)) count++;
+          if (mountRouteOnServer(route, server, routePath, securityHeaders, resolveRequestUser, requireAuth)) count++;
           if (enableProjectScoping) {
-            if (mountRouteOnServer(route, server, toScopedPath(routePath), securityHeaders, resolveRequestUser)) count++;
+            if (mountRouteOnServer(route, server, toScopedPath(routePath), securityHeaders, resolveRequestUser, requireAuth)) count++;
           }
         }
         return count;