client SDK `oauth.*` family: bind the 5 `return res.json()` methods to their better-auth wire shapes (ISO `string` timestamps) — #12104 family card 1 of 3

[os-trump]

Filed by the domain:cli execution PM seat (#6024), session session_016yfqQh2dBgPAymYd7xipza, R65 — one of the three family cards the maintainer's ruling on #12104 ordered this lane to file. Part of #12104 (the family head). ⛔ domain:* / type left to triage; the lane is fixed by the parent. Family order: this card FIRST (shortest job on the hot file), then the auth.* card, then the organizations.* card.

Ruling (verbatim, 2026-08-31, maintainer, comment 5472614711 on #12104 — ⛔ 不译)

裁定:SDK 绑定的时间戳声明为线上真发的 ISO string,⛔ 不声明 Date、不建运行时复活层。 理由即本仓的第一戒律:声明一个运行时不兑现的能力(类型说 Date,运行时给 string,.getTime() 即炸)正是要结构性禁止的形状;wire 契约是唯一事实源,better-auth 的 Date 是序列化前的服务端形状,不是 wire 事实。JSDoc 注明 ISO-8601;branded 别名(IsoDateTimeString)可作后续增强,⛔ 不作本族工作的先决。

执行形状:按族三张卡 —— organizations 19 / auth 14 / oauth 5,由 domain:cli 车道立卡派发;packages/client/src/index.ts 是实测硬串行热点,三卡跨轮串行;每卡 Clause-② yes(收窄已发布返回类型),PR 建立时挂 needs:contract-review 走复审链;changeset 的 BREAKING 记号照 #13080 的类别(该门禁卡独立,⛔ 不在本族顺手做)。

Scope — the 5 methods (from #12104's census; re-locate on current main, the file has moved under several landings since)

oauth.applications.register · oauth.applications.get · oauth.applications.getPublic · oauth.applications.delete · oauth.consent

Each is an exported callable of @objectstack/client with no return annotation that ends return res.json(), so its published type is Promise< any > from lib.dom. ⛔ Grep cannot count this class — use pnpm --filter @objectstack/client check:exported-any-returns (asks the type checker on the built dist).

Constraints that bind

• Clause-② yes (narrows a published return type). Hang needs:contract-review on the PR at creation (double carrier: card + PR); the dispatching seat runs the in-seat at-tier review before any landing.
• Source of truth for each shape is the wire body. Drive at least one route of this family end to end against a real server and read the body; better-auth's own exported return types are the starting point (the A sixth client-SDK erasure spelling, larger than the other five combined: 43 exported methods return res.json() directly, whose lib.dom type is Promise< any > #12104 dev measured that every one of the 38 endpoints has a concrete better-auth return type — the card's "contracts must be authored" hypothesis is refuted). Every Date-typed field is declared as ISO string with a JSDoc ISO-8601 note, per the ruling. ⛔ No Date, ⛔ no runtime revival layer, ⛔ no any.
• check:exported-any-returns is shrink-only: delete exactly this family's ledger entries in the same PR — no others, no count-driven cleanup (read the reasons, never the count).
• Changeset states the narrowing and the exact reads that stop compiling; the **BREAKING** token follows the disposition client SDK drops the precise spec types at its boundary: 32 methods return Promise< any > on a package that already depends on @objectstack/spec #8140 / A fifth client-SDK erasure spelling no grep in #8140's census counted: 38 methods with NO return annotation, typed from unwrapResponse< …any… > #11925 / client.packages declares envelopes two mounted surfaces do not emit: get diverges between them, and install/enable/disable declare { package } where the only serving surface sends the bare row #12034 used until [finding] check-adr-0087-registration has no honest disposition for a published TYPE-surface narrowing — every category is refused, so the class is pushed to drop the **BREAKING** token instead #13080 lands (⛔ not solved here).
• Hot file: packages/client/src/index.ts — HARD SERIAL across the three family cards, released on MERGE, ⛔ never two in flight.
• Angle brackets in GitHub prose must be spaced (Promise< any >) — the body sanitizer eats tag-shaped spans, backticks included.

Re-check

pnpm --filter @objectstack/client check:exported-any-returns    # 42 ledgered sites at filing
git grep -n "applications.register\|applications.getPublic\|consent" -- packages/client/src/index.ts

Positive control: automation.trigger was bound by PR #13082 and must NOT appear in the ledger; the grep above must hit packages/client/src/index.ts before any zero is read as "already bound".

Refs: #12104 (family head, ruling) · PR #13082 (the in-repo 5 — precedent for the binding shape and the same-PR ledger deletion) · #13080 (BREAKING-token category) · #13079 (envelope convention, ⛔ not this family's question).

[huangyiirene]

Triage (R+89, triage seat, session session_019kDRpB7D2XzVzkaLp57T5D): domain:cli · priority:p2 · type Task added; pm:queue stands (a pm:queue card with no domain:* is invisible to every lane's candidate query — sweep disjunction ②). Lane fixed by the parent #12104 and the maintainer's 2026-08-31 ruling quoted in the body; Clause-② yes at dispatch as the card already states; hot-file hard serial on packages/client/src/index.ts across the three family cards — this one first.

---

Generated by Claude Code

[huangyiirene]

Triage (R+98) — pm:blocking and needs:contract-review applied.

This card is first of the #12104 family of three, and the family declares packages/client/src/index.ts a HARD SERIAL hot file ("⛔ never two in flight"). That serial existed only as prose in the three bodies until now — all three sat in pm:queue with nothing stopping two of them being dispatched at once.

The chain is now written into the state machine:

• client SDK oauth.* family: bind the 5 return res.json() methods to their better-auth wire shapes (ISO string timestamps) — #12104 family card 1 of 3 #14312 (this card, oauth, FIRST) — pm:queue, unblocked, ready. pm:blocking because client SDK auth.* family: bind the 14 return res.json() methods (auth 7 · sessions 3 · twoFactor 3 · accounts.unlink 1) to their better-auth wire shapes — #12104 family card 2 of 3 #14313 waits on it.
• client SDK auth.* family: bind the 14 return res.json() methods (auth 7 · sessions 3 · twoFactor 3 · accounts.unlink 1) to their better-auth wire shapes — #12104 family card 2 of 3 #14313 (auth, SECOND) — pm:blocked, Blocked-by: #14312.
• client SDK organizations.* family: bind the 19 return res.json() methods (organizations 11 · invitations 3 · teams 5) to their better-auth wire shapes — #12104 family card 3 of 3 #14314 (organizations, THIRD) — pm:blocked, Blocked-by: #14313.

Each Blocked-by: clears when the card above it closes, which for this family means when its PR merges — the release condition the ruling names.

⇒ This is the one of the three that can be dispatched. Do not start the other two.

needs:contract-review applied to the issue as well as the PR, per the family's own "double carrier" instruction — Clause-② is yes on all three (each narrows a published return type).

---

Generated by Claude Code