[v3 DX] Contract legacy seams and verify the complete all-plugin matrix

[olliethedev]

Parent

• #202 — Centralize client runtime configuration and normalize all plugin interfaces

What to build

Complete the contract phase of #202 after every maintained consumer is migrated. Remove all temporary expansion bridges and prove the final public surface across every built-in plugin, generated framework and package artifact.

Remove, rather than deprecate indefinitely:

• temporary stack and createStackClient aliases;
• legacy client definitions that capture shared API/site/query/header runtime;
• stale unqualified/ignored client baseURL or basePath fields;
• canonical-path StackProvider.api, StackProvider.basePath, manual override generics/maps and other duplicated runtime props;
• legacy plugin name/registration-ID fallbacks and kebab-case programmatic built-in IDs;
• positional/flat backend factory forms;
• old client/backend lifecycle callback spellings;
• ambiguous stack.api, stack.internal and forRequest(request).api server namespaces.

Do not remove kebab-case package export paths or URL slugs.

Required all-plugin audit

Commit a completed matrix with focused evidence for:

Plugin	Required final evidence
AI Chat	aiChat; model/mode/tools preserved; public/authenticated parity; unified runtime and hooks
Blog	options-object backend; unified loaders/metadata/sitemap/browser runtime; lifecycle grammar
CMS	content types preserved; unified runtime; request/trusted/raw boundaries
Comments	flags/moderation/user resolution preserved; nested hooks; unified runtime
Form Builder	formBuilder; form/submission lifecycle and runtime parity
Kanban	options object; user search/resolution; board/column/task lifecycle and runtime parity
Media	storage/tenant server boundary; upload lifecycle; no secret leakage; unified runtime
OpenAPI	openApi; intentional backend-only behavior and schema output
Route Docs	routeDocs; intentional client-only behavior and relevant site/runtime inheritance
UI Builder	uiBuilder; intentional client-only-over-CMS composition and inferred component overrides
Consumer fixture	third-party factory/definition, stable ID and inferred overrides without internal types

Acceptance criteria

• Only createBackendStack and createClientStack remain as public stack constructors; legacy aliases are absent from runtime, exports and declarations.
• Canonical client configuration has one real source of truth for API, site, query client and optional per-request headers; no accepted-but-ignored field remains.
• SSR loader, metadata, sitemap, SSG, hydration, browser query/mutation and provider observations agree for every applicable client plugin.
• Same-origin path override, complete endpoint replacement and cross-origin sensitive-header isolation pass through public seams.
• StackProvider infers override keys/values from its client stack and preserves router/auth/notify/i18n plus tri-state initialIdentity without duplicated API/site wiring.
• Programmatic IDs match the canonical ten-ID list everywhere; registration mismatch/duplicates fail; package/URL slugs remain independently correct.
• Every backend plugin follows the one-options-object/nested-hooks contract and all lifecycle callbacks follow the documented grammar.
• Server surfaces expose only forRequest(request).operations, trusted and raw with post-[v3 auth] Remove RC authorization paths and publish the v3 contract #193 authorization/validation/lifecycle semantics intact.
• OpenAPI, Route Docs and UI Builder retain their intentional one-sided composition with no fake counterparts.
• The consumer-defined fixture compiles against public exports and fails negative ID/override/config cases.
• Repository guards find no removed shape outside explicit migration-before/negative fixtures.
• Package exports, ESM resolution, declaration output, client-bundle boundaries and strict unused-export checks are clean.
• Registry output is freshly generated, reproducible and passes install/build tests.
• Next.js, React Router and TanStack generated production builds, hydration flows and codegen E2E suites pass.
• Docs production build and all API type tables pass.
• Full root build, typecheck, lint and test suites pass on Node 22, with build run before tests.
• No real-project validation is required here; better-stack-web and Bio Mogging RC3 validation begins after publication under user ownership.

Authorization regression requirements

• Omitted backend auth stays permissive; enabled auth with a missing/denying rule stays authoritative.
• Request operations derive trusted facts before rule evaluation and never trust client-supplied ownership/tenant facts.
• trusted skips user authorization only; raw is explicitly outside operation composition.
• Client rules remain presentation-only and schema-bound; no open-string global permission API returns.
• initialIdentity remains request-hydrated and tri-state in all three framework helpers, with no caching added.

Blocked by

• #224 — Publish the complete canonical DX and migration guide

[olliethedev]

Completed by #242 and merged into v3 at 55ee4454.

Verification completed on Node 22:

• root lint, typecheck, build, Knip, and 1,202 tests
• package ESM/CJS/declaration and consumer negative contracts
• reproducible registry generation plus clean install/build validation
• generated Next.js, React Router, and TanStack production/E2E suites
• docs production build (54 pages)
• all-plugin audit matrix and canonical-DX guard

The Code Review bot completed with no findings.