@ultimat3/action 2.0.0 → 3.0.0

package/CLAUDE.md

@@ -332,6 +332,23 @@ Owns the `action` + `mutator` primitives and their six projections. Tier 3.
   `X_AUDIT_SINK_FAILED` fell into the failure branch and wrote a *second* record saying the
   action `failed` — for a handler that had committed. An audit trail lying about a write is
   worse than no audit trail; `audit.test.ts` counts the records a refusing sink was offered.
+- **`auditOutcomeFor` is TOTAL, because both callers ask inside a `catch`.**
+  `error instanceof ActionDeniedError` runs a `Proxy`'s `getPrototypeOf` trap, and the two call
+  sites are `execute`'s span attribute and the one place the `failed` record is produced — so a
+  handler throwing such a value made the probe throw *from the frame holding the app's error*,
+  and the caller got a `TypeError` in place of its own throwable. It fails closed to `failed`: a
+  value that refuses to be examined is not evidence of a policy denial. Same rule as core's
+  `isThrownError` / `isUltimateError`, and the same defect `@ultimat3/http`'s `finalize.ts` and
+  `factsOf` carried; `audit.test.ts` asserts the caller's throwable by IDENTITY, which is the only
+  assertion that catches a replacement.
+- **`json-schema.ts`'s refusal names `introspect()`, never a `toJsonSchema` member.**
+  `SchemaProvider` declares no such member and `toJsonSchema()` calls `introspect()`
+  unconditionally, so the old `fix:` told a reader to implement an API that does not exist —
+  axiom 4 inverted, and invisible to `x verify`'s `errors` step, which checks a fix line's shape
+  and never whether the API it names is real. The guard is `normalizeJsonSchema`, exported from
+  the module for its own test and absent from `src/index.ts` exactly as `sortSchema` is; the
+  shipped `toJsonSchema` cannot reach it today (it returns an object literal on every path), so
+  the test drives the guard directly rather than pretending a converter can be swapped.
 - App code reaches a projection through the action (`publishPost.tool()`), never through
   `.def` and never by importing the projection function. `facade.ts` is where a new method
   is bound; the projection itself keeps living in its own file.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/action",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "description": "The action primitive: one declaration projected to route, OpenAPI, client, MCP tool, job handle, tests",
   "license": "MIT",
   "type": "module",
@@ -31,10 +31,10 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/cache": "2.0.0",
-    "@ultimat3/core": "2.0.0",
-    "@ultimat3/http": "2.0.0",
-    "@ultimat3/policy": "2.0.0",
-    "@ultimat3/schema": "2.0.0"
+    "@ultimat3/cache": "3.0.0",
+    "@ultimat3/core": "3.0.0",
+    "@ultimat3/http": "3.0.0",
+    "@ultimat3/policy": "3.0.0",
+    "@ultimat3/schema": "3.0.0"
   }
 }

package/src/audit-gate.ts

@@ -20,9 +20,23 @@ export function auditSinkFor(action: string): AuditSink {
   return sink;
 }
 
-/** An authz refusal is `denied`; everything else that threw is `failed`, an unparsed input included. */
+/**
+ * An authz refusal is `denied`; everything else that threw is `failed`, an unparsed input
+ * included.
+ *
+ * TOTAL, the same rule core's `isThrownError` states: `instanceof` runs a `Proxy`'s
+ * `getPrototypeOf` trap, and both callers ask this question inside a `catch` that is still
+ * holding the app's own error — `execute`'s span attribute and the one place the `failed` record
+ * is produced. A probe that threw there REPLACED the caller's throwable with its own `TypeError`,
+ * so an app catching by `instanceof` upstream stopped matching. A value that refuses to be
+ * examined is not evidence of a policy denial, so it fails closed to `failed`.
+ */
 export function auditOutcomeFor(error: unknown): AuditOutcome {
-  return error instanceof ActionDeniedError ? 'denied' : 'failed';
+  try {
+    return error instanceof ActionDeniedError ? 'denied' : 'failed';
+  } catch {
+    return 'failed';
+  }
 }
 
 export function auditFailureFor(error: unknown): AuditFailure {

package/src/json-schema.ts

@@ -20,22 +20,33 @@ export type JsonSchemaObject = Record<string, unknown>;
  * reach a projection that throws.
  */
 export function jsonSchemaOf(schema: StandardSchemaV1): JsonSchemaObject {
-  return normalize(() => toJsonSchema(schema));
+  return normalizeJsonSchema(() => toJsonSchema(schema));
 }
 
 /** Draft-07, no `$schema` — the exact shape an MCP `tools/list` entry needs. */
 export function mcpSchemaOf(schema: StandardSchemaV1): JsonSchemaObject {
-  return normalize(() => toMcpInputSchema(schema));
+  return normalizeJsonSchema(() => toMcpInputSchema(schema));
 }
 
-function normalize(convert: () => unknown): JsonSchemaObject {
+/**
+ * The narrowing both projections share, and the refusal it earns: a converter that answered with
+ * something that is not a JSON object is the same failure by a quieter route, so it gets the same
+ * shipped code rather than a permissive node. Exported for its own test and nothing else — it is
+ * absent from `src/index.ts`, exactly as `sortSchema` is.
+ *
+ * **The `fix:` names `introspect`, never a `toJsonSchema` member.** `SchemaProvider` declares no
+ * such member (`packages/schema/src/provider.ts`) and `toJsonSchema()` calls `introspect()`
+ * unconditionally, so the old line — "configure a provider whose toJsonSchema returns an object" —
+ * instructed a reader to implement an API that does not exist, which is axiom 4 inverted. It is
+ * the same false clause `@ultimat3/schema` deleted from its own docs; this was the user-visible
+ * half, one package over.
+ */
+export function normalizeJsonSchema(convert: () => unknown): JsonSchemaObject {
   const raw: unknown = convert();
   if (isJsonObject(raw)) return raw;
-  // A converter that answered with something that is not a JSON object is the same failure by a
-  // quieter route, so it gets the same shipped code rather than a permissive node.
   throw new SchemaUnsupportedError({
     cause: `the schema converted to ${raw === null ? 'null' : typeof raw}, not a JSON Schema object`,
-    fix: 'declare the schema with `t` from @ultimat3/action, or configure a provider whose toJsonSchema returns an object: configureSchemaProvider({ ... })',
+    fix: 'declare the schema with `t` from @ultimat3/action, or add an introspect() returning a SchemaNode to the object passed to configureSchemaProvider()',
   });
 }