feat(spec): declare publicPicker on FormFieldSchema (#7467) - #7487
Merged
Conversation
The REST public-lookup route (GET /forms/:slug/lookup/:field) has always gated the anonymous picker on a publicPicker block that no schema declared: FormFieldSchema is strict (ADR-0089 D3a), so every authoring path refused a form carrying one and the capability was unreachable — ADR-0049's 'declared ≠ enforced' in the mirror direction. Per the maintainer ruling on the card (declare, option 1), FormFieldSchema now carries an optional publicPicker block mirroring exactly the route's four reads: - displayFields (≤5, the route's projection cap; omitted → ['name']) - maxResults (int 1..50, encoding the route's hard ceiling; default 20) - filter (ViewFilterRuleSchema[], the dialect the route composes) - object (referenced-object override) An unknown subkey stays a loud unrecognized_keys error; picker.sort — a fifth route read outside the ruling's enumeration — stays deliberately undeclared and pinned as such (follow-up filed from #7467). Also: ADR-0049 liveness ledger (view.json sections row + viewschema audit), the owner_id pin rebuilt through the real schema, a stored-row e2e proving a spec-valid form with a picker gets a real lookup answer, docs for the lookup route, regen artifacts, minor changeset. Closes #7467 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CnMk7vfrt2zW7xvwLS3JDf
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
Contributor
📓 Docs Drift CheckThis PR changes 1 package(s): 106 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
⛔ 7 release-owned page(s) also reference the affected code. These are read-only:
|
github-actions
Bot
added
documentation
…the dispatch predicates (#7467) check:engine-double-contract flagged the new stub: a fake looser than ObjectQL's update/delete is how #4434 shipped a dead route green. Both verbs now open with assertEngineUpdateDispatch/assertEngineDeleteDispatch from @objectstack/metadata-core (#5619). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CnMk7vfrt2zW7xvwLS3JDf
This was referenced Aug 11, 2026
… debt (#7467) The rest TEST_DEBT ledger is a 155-error ratchet; the new file added a TS2835 (extensionless relative import under NodeNext) and a TS7006 (implicit-any callback). Explicit .js extension + typed callback — raw tsc over the test layer measures 155 again. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CnMk7vfrt2zW7xvwLS3JDf
…lare-public-picker
…ow answers (#7467) PR #7468 landed the stored-row fold with a 'BOUNDARY: STILL 403' case annotated to be revisited the day publicPicker became declarable. This is the revisit: the same real saveMetaItem persists a groups-authored form whose field carries a spec-valid publicPicker, and the same real route handler answers 200 with projected data. The picker-less 403 half stays pinned in public-form-lookup-picker.test.ts. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CnMk7vfrt2zW7xvwLS3JDf
os-zhuang
marked this pull request as ready for review
August 11, 2026 03:08
This was referenced Aug 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #7467
The ruling, and what lands
Maintainer ruling on the card, verbatim: 「宣告」 — option 1 of the card's fork: declare
publicPickerinpackages/spec. The retirement direction is closed, and the route's picker branch is untouched (packages/restcarries test-only changes).GET /forms/:slug/lookup/:fieldhas always gated the anonymous public-form picker on apublicPickerblock that no schema declared.FormFieldSchemais strict (ADR-0089 D3a), soViewMetadataSchemarefused any form carrying one (unrecognized_keys→ 422 atsaveMetaItem; code-authored forms hit the same wall atFormViewSchema.parse). The route's whole picker branch was live code no spec-valid form could turn on — ADR-0049's "declared ≠ enforced" in the mirror direction.The schema mirrors the route's reads exactly, and nothing wider
Every key and constraint of the new
FormFieldPublicPickerSchemais derived from the lookup handler's actual reads inpackages/rest/src/rest-server.ts— this block opens an unauthenticated search surface, so the schema admits nothing the route does not enforce, and the route's hard bounds are encoded instead of left to silent request-time adjustment:displayFieldsslice(0, 5), fallback['name'], first entry is thecontainssearch targetz.array(z.string()).min(1).max(5).optional()— a 6th entry (or[], which the route treats as absent) is a parse error, not a silent rewritemaxResultsMath.min(Math.max(1, Number(v) || 20), 50)z.number().int().min(1).max(50).optional()—51,0, negatives, fractions refused at authoring timefilterArray.isArray→ spread into the same filters list as the route's own{ field, operator: 'contains', value: q }rowz.array(ViewFilterRuleSchema).optional()— the repo's one filter-rule dialect, #6227 shape coupling includedobjectreferenceTo = picker.object(preferred before the field-def fallback)z.string().optional()An unknown subkey is still a loud
unrecognized_keys(ADR-0089 D3a). An empty block{}parses — the route treats any truthy picker as the opt-in and supplies its own defaults.The route's fifth read. The handler also reads
picker.sort(fallback: first display field, ascending). That key is outside the ruling's four-key enumeration, so it stays deliberately undeclared — pinned as intentional inview-public-picker.test.ts— and is filed as its own decision card, #7485. A second route-side finding from implementation: the field-def fallback for the picker target reads only legacy spellings (referenceTo/target/options.objectName), never the canonicalreference, makingpublicPicker.objectde-facto required today — filed as #7486.The two pins the card names
public-form-routes.test.ts'refuses a publicPicker declared on owner_id'— rebuilt through the schema. The fixture now parses through the realViewMetadataSchemafirst (asserted spec-valid — before this PR that assertion is red), so the pin finally says what it meant: the anchor refusal is the ROUTE's own boundary, not a side effect of the schema refusing the form.public-form-routes.stored-row.test.tsBOUNDARY: … STILL 403—groups→sectionsfold reaches the stored row (#7134) #7468 (A Studio-saved form authored withgroupsstill degrades on the REST public-form routes — the producer fold does not reach stored rows #7134), which is still open; it does not exist onmain, so there is nothing to flip in this PR's base. The flip's content lands here instead as a new file,public-form-lookup-picker.test.ts: the realsaveMetaItem(stub engine) persists a spec-valid form carrying a picker — the exact save that was a 422 before — and the real route handler answers with projected data (request composition pinned key-for-key: object override, limit,['id', ...displayFields]select, declared filter rows ahead of the search predicate, offset 0), plus the picker-less GUARD (still 403). If fix(metadata-protocol): thegroups→sectionsfold reaches the stored row (#7134) #7468 merges while this PR is open, I will mergemainand rewrite its BOUNDARY case; note its fixture carries no picker, so it stays mechanically green either way — the "goes red" lives in its comment's revisit instruction.ADR-0049 liveness ledger
packages/spec/liveness/view.jsonform.children.sections— the row carrying the blanket verdict for the FormField subtree (undrilled inheritance, the instrument's declared granularity) — re-verified 2026-08-11, cross-repo, with the lookup route cited as the measured reader for the four new keys and thesortexception recorded. The seeding audit doc (docs/audits/2026-06-viewschema-property-liveness.md) gets the matching post-audit entry.Generated artifacts (four-step os-regen)
pnpm --filter @objectstack/spec buildFIRST (#7122 — one probe build withOS_SKIP_DTS=1was caught by the generator's own stale-DTS refusal and redone full), thengen:api-surface,gen:export-origins,gen:docs,gen:strictness-ledger→check:generatedall 13 green;check:authorable-surfaceandcheck:livenessgreen. No generated file hand-edited.Docs
content/docs/ui/forms.mdxdocuments the lookup endpoint (the page covered the two sibling routes only): thepublicPickertable, response shape, error table, and the lookup route's own auth context. Nocontent/docs/releases/ordocs/adr/**touched.Changeset
.changeset/declare-public-picker.md—@objectstack/specminor: a new authorable property on the public acceptance surface (metadata that yesterday was a 422 parses today); precedent #7387 per #3405/#5583. Nothing previously accepted changes shape.Reverse verification (predictions written before running)
publicPickerkey wiringui/FormField:publicPicker disappeared from the contract, so a dist without the key cannot even be produced; the REST e2e red is therefore enforced upstream of the test layer (same parse door, proven directly by the spec-layer probes).max(51)maxResults: 51case reddisplayFieldsto.max(6)public-form-lookup-picker.test.ts)Gates run locally
@objectstack/specsuite@objectstack/restsuite@objectstack/spectypecheck (src + scripts + test layer)@objectstack/resttypecheckcheck:generatedcheck:authorable-surface/check:livenesscheck:doc-authoring🤖 Generated with Claude Code
https://claude.ai/code/session_01CnMk7vfrt2zW7xvwLS3JDf
Generated by Claude Code