fix(runtime): surface standalone authored action rows on the MCP action bridge (#3010)

[os-zhuang]

Summary

Closes #3010 — the last residual from the #2605 "declared-but-not-wired" family (now closed).

A standalone authored action metadata row executes since #2608 (resyncAuthoredActions registers its body under the declarative name), but the MCP action bridge read declarations exclusively from object.actions, so the row was invisible to list_actions and unresolvable by run_action — even with ai: { exposed: true } set. A declaration-surfacing gap, not an execution gap.

Changes

• collectActionDeclarations (new, http-dispatcher.ts) — the bridge's single declaration source: object.actions unioned with standalone action items from metadata.loadMany('action'). Standalone rows resolve their owning object with the same convention as the engine registration key (objectName field → legacy object field → 'global' wildcard, kept in lockstep with the ObjectQL plugin's actionObjectKey), so the declaration the bridge resolves always matches the handler executeAction will find. On an objectName:name clash the object-embedded declaration wins, mirroring the execution layer's artifact-wins rule. Tolerates metadata services without loadMany.
• listActions and resolveActionByName (backing run_action) now iterate that collection instead of object.actions only. Everything downstream is unchanged: ai.exposed fail-closed (Security: MCP action surface must gate on ai.exposed — action bodies run trusted (unbounded RLS/FLS), so invoke-time is the only agent boundary (#2849) #2849 / ADR-0011), the ADR-0066 D4 capability gate, isHeadlessInvokableAction, sys_* fail-closed, ambiguity handling, and record-context loading ('global' rows stay record-less).

Tests

7 new cases in the existing MCP-bridge suite (http-dispatcher.test.ts): object-scoped + global standalone rows listed under the engine-key object name (params summarized); shadow dedup (embedded declaration wins, no double-listing); dispatch under the declarative-name key for body actions and the global wildcard key; unexposed standalone rows fail closed; sys_*-owned standalone rows blocked; and a no-loadMany metadata service keeps the pre-existing behavior.

packages/runtime: 535/535 tests pass, tsc --noEmit clean. packages/mcp: 72/72 pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01R4uCgJCaSABHDz6UntuqEj

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jul 16, 2026 6:04am

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/runtime.

16 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/api/index.mdx (via @objectstack/runtime)
• content/docs/api/wire-format.mdx (via @objectstack/runtime)
• content/docs/automation/hook-bodies.mdx (via @objectstack/runtime)
• content/docs/concepts/north-star.mdx (via packages/runtime)
• content/docs/data-modeling/drivers.mdx (via @objectstack/runtime)
• content/docs/deployment/index.mdx (via @objectstack/runtime)
• content/docs/deployment/production-readiness.mdx (via @objectstack/runtime)
• content/docs/deployment/single-project-mode.mdx (via @objectstack/runtime)
• content/docs/deployment/vercel.mdx (via @objectstack/runtime)
• content/docs/getting-started/your-first-project.mdx (via @objectstack/runtime)
• content/docs/permissions/authentication.mdx (via @objectstack/runtime)
• content/docs/plugins/packages.mdx (via @objectstack/runtime)
• content/docs/protocol/kernel/http-protocol.mdx (via @objectstack/runtime)
• content/docs/protocol/kernel/index.mdx (via @objectstack/runtime)
• content/docs/protocol/kernel/lifecycle.mdx (via @objectstack/runtime)
• content/docs/releases/implementation-status.mdx (via @objectstack/runtime)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.