feat(client): keys, shareLinks, and security surfaces (#3563 PR-3)

[os-zhuang]

PR-3 of #3563: three more zero-expression domains closed. Gap ratchet: 24 → 17.

The surfaces

Each is implemented against the dispatcher's actual contract (domains/keys.ts, domains/share-links.ts, domains/security.ts — all read in full before writing a line):

// API keys — there was previously NO SDK path to mint one at all
const apiKey = await client.keys.create({ name: 'CI key', expiresAt: '2027-01-01' });
apiKey.key; // raw secret, returned exactly once — only its hash is stored

// Share links — authenticated management; listing is server-pinned to the caller
const link = await client.shareLinks.create('crm_account', recordId, { permission: 'view' });
await client.shareLinks.list({ object: 'crm_account' });
await client.shareLinks.revoke(link.token);

// Security admin — ADR-0090 suggested audience bindings
const { suggestions } = await client.security.suggestedBindings.list({ status: 'pending' });
await client.security.suggestedBindings.confirm(suggestions[0].id);

Contract-faithful details:

• keys.create forwards expiresAt as expires_at (ISO or epoch — the server normalizes and rejects past dates); user_id is never sent (pinned server-side, body-whitelisted).
• The public share-link token routes (:token/resolve, :token/messages) stay browser-only by design — their ledger rows remain public, not gap.
• All three use fixed /api/v1 paths: none of these domains are in ApiRoutesSchema (the actions / projects precedent, noted at each definition).

Ledger + docs

• Seven rows flip gap → sdk; the conformance ratchet drops to 17.
• Docs-site SDK page gains the three namespaces in the coverage table + usage snippets (including the "secret shown once" warning).

Test plan

• 7 new unit tests (URL shapes, body whitelisting, query-string building, URL-encoding, one-time-secret passthrough).
• Client suite 129 passed; both ledger-guard halves green; ESLint clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LX9ut3MK3KykE11S9bJmv5

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Jul 27, 2026 7:25am

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/client, @objectstack/runtime.

26 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/ai/skills-reference.mdx (via packages/client)
• content/docs/api/client-sdk.mdx (via @objectstack/client, packages/runtime)
• content/docs/api/data-flow.mdx (via @objectstack/client)
• content/docs/api/environment-routing.mdx (via @objectstack/client)
• content/docs/api/error-catalog.mdx (via @objectstack/client)
• content/docs/api/index.mdx (via @objectstack/runtime)
• content/docs/api/wire-format.mdx (via @objectstack/runtime)
• content/docs/automation/hook-bodies.mdx (via @objectstack/runtime)
• content/docs/concepts/north-star.mdx (via packages/runtime)
• content/docs/data-modeling/drivers.mdx (via @objectstack/runtime)
• content/docs/deployment/index.mdx (via @objectstack/runtime)
• content/docs/deployment/production-readiness.mdx (via @objectstack/runtime)
• content/docs/deployment/single-project-mode.mdx (via @objectstack/runtime)
• content/docs/deployment/vercel.mdx (via @objectstack/runtime)
• content/docs/getting-started/your-first-project.mdx (via @objectstack/client, @objectstack/runtime)
• content/docs/kernel/runtime-services/data-service.mdx (via packages/client)
• content/docs/kernel/runtime-services/index.mdx (via packages/client)
• content/docs/permissions/authentication.mdx (via @objectstack/client, @objectstack/runtime)
• content/docs/permissions/authorization.mdx (via packages/runtime)
• content/docs/plugins/packages.mdx (via @objectstack/client, @objectstack/runtime)
• content/docs/protocol/kernel/http-protocol.mdx (via @objectstack/runtime)
• content/docs/protocol/kernel/index.mdx (via @objectstack/runtime)
• content/docs/protocol/kernel/lifecycle.mdx (via @objectstack/runtime)
• content/docs/protocol/kernel/realtime-protocol.mdx (via @objectstack/client)
• content/docs/releases/implementation-status.mdx (via @objectstack/client, @objectstack/runtime)
• content/docs/releases/v16.mdx (via @objectstack/client)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.