feat(client): keys, shareLinks, and security surfaces (#3563 PR-3)

[os-zhuang]

PR-3 of #3563: three more zero-expression domains closed. Gap ratchet: 24 → 17.

The surfaces

Each is implemented against the dispatcher's actual contract (domains/keys.ts, domains/share-links.ts, domains/security.ts — all read in full before writing a line):

// API keys — there was previously NO SDK path to mint one at allconstapiKey=awaitclient.keys.create({name: 'CI key',expiresAt: '2027-01-01'});apiKey.key;// raw secret, returned exactly once — only its hash is stored// Share links — authenticated management; listing is server-pinned to the callerconstlink=awaitclient.shareLinks.create('crm_account',recordId,{permission: 'view'});awaitclient.shareLinks.list({object: 'crm_account'});awaitclient.shareLinks.revoke(link.token);// Security admin — ADR-0090 suggested audience bindingsconst{ suggestions }=awaitclient.security.suggestedBindings.list({status: 'pending'});awaitclient.security.suggestedBindings.confirm(suggestions[0].id);

Contract-faithful details:

• keys.create forwards expiresAt as expires_at (ISO or epoch — the server normalizes and rejects past dates); user_id is never sent (pinned server-side, body-whitelisted).
• The public share-link token routes (:token/resolve, :token/messages) stay browser-only by design — their ledger rows remain public, not gap.
• All three use fixed /api/v1 paths: none of these domains are in ApiRoutesSchema (the actions / projects precedent, noted at each definition).

Ledger + docs

• Seven rows flip gap → sdk; the conformance ratchet drops to 17.
• Docs-site SDK page gains the three namespaces in the coverage table + usage snippets (including the "secret shown once" warning).

Test plan

• 7 new unit tests (URL shapes, body whitelisting, query-string building, URL-encoding, one-time-secret passthrough).
• Client suite 129 passed; both ledger-guard halves green; ESLint clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LX9ut3MK3KykE11S9bJmv5

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Jul 27, 2026 7:25am

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/client, @objectstack/runtime.

26 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/ai/skills-reference.mdx(via packages/client)
• content/docs/api/client-sdk.mdx(via @objectstack/client, packages/runtime)
• content/docs/api/data-flow.mdx(via @objectstack/client)
• content/docs/api/environment-routing.mdx(via @objectstack/client)
• content/docs/api/error-catalog.mdx(via @objectstack/client)
• content/docs/api/index.mdx(via @objectstack/runtime)
• content/docs/api/wire-format.mdx(via @objectstack/runtime)
• content/docs/automation/hook-bodies.mdx(via @objectstack/runtime)
• content/docs/concepts/north-star.mdx(via packages/runtime)
• content/docs/data-modeling/drivers.mdx(via @objectstack/runtime)
• content/docs/deployment/index.mdx(via @objectstack/runtime)
• content/docs/deployment/production-readiness.mdx(via @objectstack/runtime)
• content/docs/deployment/single-project-mode.mdx(via @objectstack/runtime)
• content/docs/deployment/vercel.mdx(via @objectstack/runtime)
• content/docs/getting-started/your-first-project.mdx(via @objectstack/client, @objectstack/runtime)
• content/docs/kernel/runtime-services/data-service.mdx(via packages/client)
• content/docs/kernel/runtime-services/index.mdx(via packages/client)
• content/docs/permissions/authentication.mdx(via @objectstack/client, @objectstack/runtime)
• content/docs/permissions/authorization.mdx(via packages/runtime)
• content/docs/plugins/packages.mdx(via @objectstack/client, @objectstack/runtime)
• content/docs/protocol/kernel/http-protocol.mdx(via @objectstack/runtime)
• content/docs/protocol/kernel/index.mdx(via @objectstack/runtime)
• content/docs/protocol/kernel/lifecycle.mdx(via @objectstack/runtime)
• content/docs/protocol/kernel/realtime-protocol.mdx(via @objectstack/client)
• content/docs/releases/implementation-status.mdx(via @objectstack/client, @objectstack/runtime)
• content/docs/releases/v16.mdx(via @objectstack/client)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.