feat(spec)!: 改名 kernel 侧 PackageDependencySchema → ResolvedPackageDependencySchema —— 双源清账 C7,裸名唯一归 ./cloud (#4741) - #4789
Merged
Conversation
…endencySchema —— 双源清账 C7,裸名唯一归 ./cloud (#4741) `PackageDependency` / `PackageDependencySchema` 曾由 `./cloud` 与 `./kernel` 各自 导出一个声明,键集完全不相交(0 个共享属性):cloud 侧 `{packageId, versionRange, optional}` 是作者写进包清单的**声明形**,kernel 侧 `{name, versionConstraint, type, resolvedVersion}` 是解析器在依赖图上走的**解析形**。两边都不是 `.strict()`, 把一侧文档粘到另一侧只会静默剥键而非报错(#4411 陷阱 / ADR-0104 silent-strip)。 两个概念而非两种拼写 ⇒ ADR-0112 D9(a),按维护者裁决改名 kernel 侧;cloud 侧保名。 - `RENAMED_DEFS` 承接 kernel/PackageDependency → kernel/ResolvedPackageDependency (4 keys carry:name / versionConstraint / type / resolvedVersion 全数健在) - 零 tombstone、零 ADR-0087 conversion(无 key 离开契约,已按 #4767 retiredKey() 先例逐条评估后排除);零形状变更、零词表变化、默认值原样并由 parse pin 钉住 - `PluginSecurityProtocol.PackageDependency` → `.ResolvedPackageDependency` - 同前缀近邻 PackageDependencyConflict / PackageDependencyResolutionResult 未动 - dual-source 基线 3 → 1(本簇 2 行经门禁 stale 分支点名自证删除) - 幽灵页 references/cloud/plugin-security.mdx 随 gen:docs 自愈(#4696 语境), cloud 侧 PackageDependency 归位到 package-version.mdx - compiler-API 符号身份 pin(exports map 全 16 入口枚举 + 防空转守卫 + holders 精确相等);S1/S2 sabotage 实证见 PR 三仓 import 级实测:objectstack / cloud / objectui 对 kernel 侧零外部 importer。 major(TS2305)、零元数据迁移。 Claude-Session: https://claude.ai/code/session_0176qgxgCXTJCUv4YFLtusP9 Co-authored-by: Claude <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 1 package(s): 107 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
This was referenced Aug 3, 2026
合并 #4768(C17)/ #4786 / #4780 / #4783(#4634,31 位能力位退役)后重生成。 按 #4535 §7 与「rebase/merge 静默回退」纪律处理三张 ratchet: `dual-source-exports.baseline.json` / `authorable-surface.json` / `json-schema.manifest.json`(+ `api-surface.json`)一律 `git checkout origin/main --` 取 main 版本后全量重跑生成器,只重施本 PR 的一处改动。 其中 json-schema.manifest.json 与 authorable-surface.json 归 os-regen merge driver 管、合并不产生冲突标记,最易静默回退,故以 gen:schema 实跑 输出为准。 逐项确认他人蓄意变更未被回滚(regen 后实测): - #4783 `data/DriverCapabilities:*` 31 行 [RETIRED] + 3 行存活 —— 均在 - C10 `system/EnvironmentArtifact*` 删除 —— 仍为 0 - C17 `studio/ActionLocation` → `studio/ActionContributionLocation` —— 旧 0 新 1 - 本 PR `kernel/PackageDependency` → `kernel/ResolvedPackageDependency` —— 旧 0 新 1 `renamed-defs.ts` 冲突为两条独立改名条目并存(C17 与本簇),按时序保留两条。 dual-source 基线 2 → **0**(entries: []),#4535 第二批收官、双源账目归零。 Claude-Session: https://claude.ai/code/session_0176qgxgCXTJCUv4YFLtusP9 Co-authored-by: Claude <noreply@anthropic.com>
…kage-dependency-dual-source
os-zhuang
marked this pull request as ready for review
August 3, 2026 07:35
os-zhuang
enabled auto-merge
August 3, 2026 07:35
os-zhuang
pushed a commit
that referenced
this pull request
Aug 3, 2026
…rename must not ride out on this branch `git merge origin/main` brought in #4789 (kernel PackageDependencySchema -> ResolvedPackageDependencySchema, dual-source C7), which touches the same three generated artifacts this branch does. The merge reported NO conflicts and left NO conflict markers, and it was wrong in all three: api-surface.json re-added `PackageDependency (type)` + `PackageDependencySchema (const)` and dropped `ResolvedPackageDependency(Schema)` authorable-surface.json re-added the 4 `kernel/PackageDependency:*` lines and dropped the 4 `kernel/ResolvedPackageDependency:*` ones json-schema.manifest.json re-added `kernel/PackageDependency` and dropped `kernel/ResolvedPackageDependency` json-schema.manifest.json is routed to the `merge=os-regen` driver, which defers rather than regenerates, so nothing textual signals this — the C17/C10 silent revert, reproduced. `git merge-tree` does not run external merge drivers and so cannot see it either. Resolved the way #4783 did, without any textual merge: reset all three (plus api-surface-signatures.json) to origin/main, re-applied ONLY this PR's own deletion to the two hand-ratcheted files, then re-ran the generators over the merged source. The 22 authorable-surface lines and 4 manifest keys are once again deliberate deletions, now anchored at merge base ffab803, which gen:schema re-proved under #4650 route 3 ("def no longer emitted by this build"). Delta vs origin/main is now pure deletion in all three, with #4789's rename intact: api-surface.json -8 (4 const + 4 type), 0 insertions authorable-surface.json -22 lines, 0 insertions json-schema.manifest.json -4 keys, 0 insertions check:dual-source-exports reports 0 accepted dual-source (#4789's shrink to [] survives; this branch does not carry it back to 2). renamed-defs.ts is byte-identical to main and keeps all 6 entries including #4789's. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #4741
#4535 第二批最后一簇(C7)。落地后 dual-source 基线归零(
entries: [])。为什么是改名而不是收敛
PackageDependency/PackageDependencySchema曾由两个入口各自导出一个声明,键集完全不相交(0 个共享属性):./cloudpackage-version.zod.ts:48packageId/versionRange/optionalPackageManifestSchema.dependencies[]→sys_package_version.manifest_json./kernelplugin-security.zod.ts:310name/versionConstraint/type/resolvedVersionDependencyGraphNodeSchema.dependencies[]+PluginSecurityProtocolResolvedPackageDependency(Schema)两边都不是
.strict(),所以把一侧的文档粘到另一侧不会响亮报错,只会静默剥掉全部外来键(#4411 陷阱 / ADR-0104 silent-strip 类)。两个概念而非两种拼写 ⇒ ADR-0112 D9(a),按 #4741 维护者裁决改名 kernel 侧。PackageDependencyConflict(Schema)与PackageDependencyResolutionResult(Schema)是不同概念,一字未动,并由 pin 显式断言健在(派发单点名的误伤风险)。三仓消费者复核(import 级实测)
PackageDependencyimporterobjectstackDependencyGraphNodeSchema与PluginSecurityProtocol)cloud(HEAD5df2c69)PackageDependency零命中,亦无手拷形状)objectui零 importer 不等于有死侧可删(#4653 判则)—— 两侧各自被真实 schema 嵌入,都活着,故走改名而非删除。
定级论证(#4535 §5,逐条自证,不照抄别簇)
import { PackageDependencySchema } from '@objectstack/spec/kernel'编译期起失败 ⇒ major。RENAMED_DEFS承接到新 def 名下,一个都没离开契约。type的.default('required')与 cloud 侧optional的.default(false)原样保留,并由 pin 用parse实测钉住(spec 门禁盲区:可作者化 key 的「默认值 / 约束」变更不被任何 gate、tombstone 或 conversion 记录(#4650 / #4659 同族) #4666 默认值盲区的自卫)。retiredKey()先例逐条评估后排除,非沉默跳过:tombstone 的前提是有 key 退役,本次 4 键全承接;伪造 tombstone 会污染 ADR-0087 登记(renamed-defs.ts头注明列的第 2 种错误处置)。check:strictness-ledger—— 实跑结论为不动台账(✓ 66 file(s) across 5 triaged director(ies) — site counts match),与 C12/C17「纯改名不动 site 数」先例一致;未反射式修改。基线删行自证(#4650 三路径门禁)—— 2 → 0
同步 main 后重新实跑(基线取 main 版本,未手编),门禁 stale 分支点名要求删除的正是这 2 行:
经
--update规范形重写(非手编)后:dual-source-exports.baseline.json现为"entries": []—— #4535 双源账目归零,第二批收官。RENAMED_DEFS承接(4 keys carry),authorable-surface.json逐行位移、净零:合并 main 的静默回退防护(#4535 §7)
三张 ratchet(
dual-source-exports.baseline.json/authorable-surface.json/json-schema.manifest.json,加api-surface.json)一律git checkout origin/main --取 main 版本后全量重跑生成器,只重施本 PR 的一处改动 —— 其中后两张归os-regenmerge driver 管、合并不产生冲突标记,最易静默回退。重生成后逐项实测确认他人蓄意变更未被回滚:
data/DriverCapabilities:*31 行[RETIRED]+ 3 行存活system/EnvironmentArtifact*整族删除studio/ActionLocation→studio/ActionContributionLocationkernel/PackageDependency→kernel/ResolvedPackageDependencyrenamed-defs.ts的冲突是 C17 与本簇两条独立改名条目,按时序并存保留(非二选一)。最终git diff origin/main恰为本 PR 的 13 个文件,其余逐字节等同 main。Sabotage 实证(2 组,均实跑)
S1 —— 复活被删声明(在 kernel 重新声明旧名的 4 键 schema)。两层独立拦截:
S2 —— 禁止路线:在
./kernelre-export cloud 声明顶裸名。这是对 dual-source 门禁全绿但语义说谎的那条路(一个声明、多个入口 = 良性 re-export)。用含 S2 的源码重新构建 dist 后实跑门禁,确认其结构性盲区:173 → 175,多出的 2 个「良性 re-export」正是这条谎报。门禁看不见,而 pin 与承接表各自独立拦下:
(与 C17 同一实证:承接表不变式 3 能在 build 阶段拦下对 dual-source 门禁不可见的语义谎报路线。)
Sabotage 后已还原源码并全量重建 + 重跑全部生成器,复验全绿。
回归 pin(#4535 §4 形态)
新增
packages/spec/src/kernel/package-dependency-dual-source.test.ts—— TypeScript compiler API 在src/上做符号身份解析:package.jsonexports map 枚举全部 16 个入口(未来新入口无法逃逸);./kernel表面非平凡(> 40 个导出)、近邻健在;toEqual(['./cloud']),而非子集包含 —— 这才拦得住 S2;PluginSecurityProtocol键改名 +parse默认值钉子);safeParse均失败 —— 若将来有人让两侧键集重叠,#4741「两个概念」的前提立即报红需重新论证。验证清单(合并 main 后全量重跑,全绿)
check:dual-source-exports0 accepted dual-source (baseline)check:generatedcheck:exported-any/check:liveness/check:empty-state/check:variant-docs/check:react-declaration-parity/check:skill-examples/check:strictness-ledger294 files / 7380 tests passedtsc --noEmit无输出turbo run typecheck→122 successful, 122 total其他
content/docs/releases/;user-visible ⇒ 已加.changeset/package-dependency-dual-source-c7.md(major)。references/cloud/plugin-security.mdx随gen:docs自愈(build-docs.ts 的 schema→页面索引按「裸名字」全局建表,同名跨 category 的 schema 会被归到错误的页面 #4696 语境:build-docs 按裸 schema 名做全局索引,改名后碰撞消失),cloud 侧PackageDependency归位到package-version.mdx,cloud/meta.json同步删行。./cloud+./kernel;未碰 data / studio / api / system / automation / integration / ui。git merge origin/main(AGENTS.md 禁 force-push),push 为 fast-forward。