Migrate from npm to pnpm - #6

…fineInterface

- Export defineInterface from root index.ts (reviewer suggestion)
- Mark ROADMAP Phase A items as complete
- Update ROADMAP metrics (199 test files, 5468 tests, 177 schema files)
- Update Phase 1 deliverables with Interface/content elements
- Add defineInterface() to DX helper list
- Update design doc status from "Proposal" to "Phase A Implemented"
- Mark design doc Phase A checklist items complete
- Add decisions #6-8 to design doc decision log (PageSchema merge, SortItemSchema, branding extend)

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Introduces an opt-in path in ObjectStackProtocolImplementation.saveMetaItem
that writes overlay metadata through SysMetadataRepository.put instead of
the raw engine, so writes append to the change-log and emit HMR seq events.

Behavioural changes (all behind options.useRepositoryWritePath /
OBJECTSTACK_USE_REPOSITORY_WRITE_PATH=1):
- saveMetaItem request gained optional parentVersion (If-Match) and
  actor fields. ConflictError -> 409 metadata_conflict.
- Plural type aliases (views, dashboards, ...) normalized to singular
  before the repo's overlay-allowlist gate (rubber-duck #5).
- Object-registry mutation moved AFTER successful put() so a conflict
  does not leave the in-memory registry stale (rubber-duck #3 invariant
  test added).

Repo/test-fake fixes uncovered by rubber-duck review:
- SysMetadataRepository.put/delete now update/delete by row id because
  the engine's strict .update requires id or multi:true (rubber-duck #1).
- sys_metadata.checksum column widened from 64 -> 71 chars to hold the
  sha256: prefix produced by hashSpec() (rubber-duck #2).
- Three test fake engines extended to support both overlay-tuple and
  id-based where lookups.

333/333 objectql tests pass.

Deferred to PR-10d.4: REST plumbing for parentVersion/actor
(rubber-duck #6), race-window retry for omitted parentVersion
(rubber-duck #4), default flag flip + legacy path removal.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Walking through Studio as a low-code developer surfaced a fundamental
gap: it is a beautiful metadata BROWSER but offers no authoring
affordances. The #1 reflex of every Airtable / Power Apps user — add a
field — has no entry point in our UI.

This change adds two authoring touchpoints to the Object Hub > Fields
panel that respect Prime Directive #6 (no temporary workarounds) and
stay true to metadata-as-code:

1. + Add field button
   A primary CTA in the toolbar opens a guided dialog (AddFieldDialog)
   with a type picker (18 supported field types, each with icon +
   one-line semantics), a derived snake_case machine-name preview, and a
   live snippet preview. Two actions:
     • Copy snippet — pastes a defineField-style literal into the
       clipboard, ready to drop into the fields: { … } block.
     • Open .object.ts in VS Code — vscode:// deep-link via the
       existing vscode-objectstack extension.

   Filesystem writes from the browser are intentionally avoided. When
   the runtime overlay write-path matures (ADR-0005), the dialog can
   swap the snippet flow for a real persist call without changing its
   contract.

2. Click any field row to open a detail drawer
   Rows are now cursor-pointer and trigger a side Sheet
   (FieldDetailDrawer) showing the full normalised field spec — all
   properties, options enumerated, references, formula, validation —
   plus the same VS Code deep-link and a per-field Copy snippet that
   emits just this field's literal. The drawer is read-only; users who
   want to edit follow the VS Code link.

   The previous behaviour (clicking a row did nothing) was the single
   biggest dead-end during the persona walkthrough. The drawer is the
   minimum viable acknowledgement that a field is an interactive object,
   not a static row of text.

Plumbing changes
- ObjectSchemaInspector preserves every property of the field spec
  (spread over the cherry-picked subset) so the drawer has access to
  schema properties beyond the table columns.
- Added a ChevronRight column on the right edge of every row,
  group-hover translate-x for the same drill-in affordance used on
  MetadataListPage compact rows.
- CopyButton stops propagation so the row click does not fire when
  copying the field name.

Build / tests
pnpm --filter @objectstack/studio build — clean.
pnpm --filter @objectstack/studio test — 69/69 tests pass; same 2
pre-existing @object-ui/core/dist/evaluator/ExpressionEvaluator module
resolution failures in playground-plugins / plugin-system suites,
unrelated to this work.

Files
- apps/studio/src/components/FieldDetailDrawer.tsx (new, ~160 lines)
- apps/studio/src/components/AddFieldDialog.tsx (new, ~280 lines)
- apps/studio/src/components/ObjectSchemaInspector.tsx
  · Imports FieldDetailDrawer, AddFieldDialog, Plus, ChevronRight
  · State for selectedField + addOpen
  · Preserves full field spec via spread in fieldEntries
  · Toolbar: + Add field primary CTA
  · TableRow: cursor-pointer, onClick → setSelectedField
  · New chevron column on right; colSpan bumped to 7
  · Drawer + dialog mounted at end of component
  · CopyButton stops click propagation

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…antics

Full hardening of the remaining items from review:

- #5 MySQL/length: key _objectstack_sequences by a single key_hash
  (SHA-256 of object,tenant_id,field,scope) instead of a 4-column natural
  PK. The natural PK exceeded MySQL's utf8mb4 index-length limit (a certain
  CREATE TABLE failure) and bounded how long a {field} scope could be. The
  hash PK keys every dialect uniformly and lets scope be a generous
  non-indexed column. Legacy 3-column and interim {scope}-column tables are
  migrated in place; migration fails safe (fixed-prefix keeps working, a
  per-scope write errors actionably).

- #1 scope ambiguity: confirmed NOT fixable by separating adjacent token
  boundaries — when two records render the same prefix they render the same
  visible number, so they MUST share a counter to stay unique (a separator
  would mint duplicates). Documented the semantics + the remedy (delimiter
  literal in the format), backed by tests. The compile lint already nudges
  authors toward unambiguous formats.

- #6 width overflow: confirmed by-design — the pad width is a MINIMUM, the
  counter grows past it and never wraps (mainstream autonumber semantics).
  Documented + regression test, no throw (throwing would break legitimate
  high-count sequences).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…ber formats (#2043)

* feat(autonumber): date, {field} and per-scope counter reset for formats

Tokenize autonumberFormat via a shared pure renderer in @objectstack/spec
(parseAutonumberFormat / renderAutonumber) that both the engine fallback and
the SQL driver call, so they emit byte-identical numbers (#1603 parity):

- date tokens {YYYY}{YY}{MM}{DD}{YYYYMMDD} resolve the calendar day in the
  request's business timezone (ExecutionContext.timezone, ADR-0053; UTC
  fallback), threaded through new DriverOptions.timezone
- {field} interpolation substitutes record values into the prefix
- counter scope = rendered prefix before the sequence slot, so AD{YYYYMMDD}{0000}
  resets daily, {section}{island_zone}{000} numbers per group, {plan_no}{000}
  numbers per parent — one mechanism, no separate reset config

Fixed-prefix formats (CASE-{0000}) render an empty scope and keep their single
global counter. _objectstack_sequences gains a scope column (PK widened to
object,tenant_id,field,scope); legacy 3-column tables migrate in place on first
use, carrying existing counters to scope=''.

* fix(autonumber): drop backtracking lookahead in seed scan (ReDoS)

The empty-prefix legacy branch used /(\d+)(?!.*\d)/ to grab the last digit
run, whose negative lookahead is a polynomial-ReDoS sink on stored values
with many repeated zeros (CodeQL js/polynomial-redos, high). Replace both
branches with the linear /\d+/g, preserving the last-digit-run semantics.

* fix(autonumber): guard {field} interpolation footguns

Add three guardrails on top of the {field}/date/per-scope autonumber work:

- Empty interpolated {field} now throws (shared missingFieldValues helper)
  in both the SQL driver and the engine fallback, instead of silently
  collapsing the record into the wrong counter scope.
- Build-time lint (objectstack compile): unknown / self-referencing {field}
  fails the build; an optional {field} warns to mark it required.
- Legacy _objectstack_sequences PK-widen failure fails safe — fixed-prefix
  sequences keep working and a per-scope write raises an actionable error
  rather than an opaque DB primary-key violation at insert time.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(autonumber): hash-keyed sequence table; clarify scope & width semantics

Full hardening of the remaining items from review:

- #5 MySQL/length: key _objectstack_sequences by a single key_hash
  (SHA-256 of object,tenant_id,field,scope) instead of a 4-column natural
  PK. The natural PK exceeded MySQL's utf8mb4 index-length limit (a certain
  CREATE TABLE failure) and bounded how long a {field} scope could be. The
  hash PK keys every dialect uniformly and lets scope be a generous
  non-indexed column. Legacy 3-column and interim {scope}-column tables are
  migrated in place; migration fails safe (fixed-prefix keeps working, a
  per-scope write errors actionably).

- #1 scope ambiguity: confirmed NOT fixable by separating adjacent token
  boundaries — when two records render the same prefix they render the same
  visible number, so they MUST share a counter to stay unique (a separator
  would mint duplicates). Documented the semantics + the remedy (delimiter
  literal in the format), backed by tests. The compile lint already nudges
  authors toward unambiguous formats.

- #6 width overflow: confirmed by-design — the pad width is a MINIMUM, the
  counter grows past it and never wraps (mainstream autonumber semantics).
  Documented + regression test, no throw (throwing would break legitimate
  high-count sequences).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: os-zhuang <jack@objectstack.ai>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

…02, B-03, C-01)

Nine findings, all the same shape: a rule the file already states, or prose
re-teaching what the CLI prints for itself.

- E-04/E-05 §3.5 becomes a 3-row outcome -> evidence table; the re-quoted error
  block was already available verbatim from the install. The new probe rule is
  the E-05 fix: `os validate` loads WITHOUT authoredSource (validate.ts:159;
  config.ts:224 "Set by `os migrate meta` only"), so a probe calling `define*`
  throws inside the load and never reaches the gate the recipe is proving.
- D-03 the data-gate table is printed by the run itself (meta.ts:106-141,
  measured: the two `unlocks` strings, the deployment scoping and the dry-run
  sentence are all emitted). Only the non-CLI half survives -- carry each
  printed gate into the report as pending, by name.
- D-07 the three-layers preamble and Layer table; the section headings and the
  pipeline line already are the construct.
- B-02 the Guardrails section: 4 of 6 restated the boundary verbatim and #6
  restated the data-gate rule. The one non-duplicate (one conversionId per
  commit) moves into the boundary; #6 now lives where the gates are printed.
- D-04 the AST-is-lossy rationale, D-05 the 2nd of five statements of
  "replay from the target major", D-06 two bullets restating the paragraph
  above them, D-08 a justification of a template row already in the template,
  B-03 the 3rd copy of the [REMOVED] grep, C-01 routing owned by README and by
  the domain skills' own frontmatter.

B-03 left the .upgrade/ workspace listing a file nothing writes any more; that
list now names retired-names.txt, which 2.6 actually produces.

Ratchet: 7799 -> 6944 (ceiling 8333).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1