objectstack-ai
diff --git a/‎.changeset/field-type-refused-at-registration-door.md‎
Lines changed: 38 additions & 0 deletions b/‎.changeset/field-type-refused-at-registration-door.md‎
Lines changed: 38 additions & 0 deletions
diff --git a/‎packages/cli/src/commands/generate-16319-field-type-refusal.pin.test.ts‎
Lines changed: 129 additions & 0 deletions b/‎packages/cli/src/commands/generate-16319-field-type-refusal.pin.test.ts‎
Lines changed: 129 additions & 0 deletions
@@ -0,0 +1,38 @@
+---
+"@objectstack/metadata-core": minor
+"@objectstack/objectql": minor
+"@objectstack/metadata-protocol": minor
+"@objectstack/driver-sql": minor
+"@objectstack/cli": minor
+---
+
+fix(objectql)!: a field whose `type` is absent or is not a `FieldType` member is refused at the registration door, and every downstream family default becomes a refusal (#16319)
+
+<!-- adr-0087: not-required (no-migration-prescription) nothing an author can write is removed or renamed, and no conversion could repair these bodies: a field with no `type` carries no statement of intent for a conversion to rewrite, which is exactly the finding — the platform cannot know whether the author meant a bounded VARCHAR or an unbounded TEXT, and the two producers guessed differently. The remedy is a human decision per field, so it is prescribed in prose and in the refusal text rather than registered as a mechanical rewrite. -->
+
+**BREAKING** for stored metadata only: an object whose declaration carries a field with no `type`, or with a `type` that is not a `FieldType` member, **no longer loads**. Shipped as `minor` under the repo's launch-window convention. Maintainer ruling, 2026-09-10, verbatim: 「16319 一个没写 type(或拼错)的字段 应该禁止加载。这个才是合理的吧?其他同意」.
+
+**What you have to do.** Nothing, unless a `sys_metadata` row in your deployment carries such a field. If one does, the startup log names it at `error` level — object, field and reason — and the row is left untouched and still reachable: open it in Studio and give the field a real `FieldType` member, or delete it (`DELETE /api/v1/metadata/object/NAME`). Nothing that passes `FieldSchema` is affected: it has always required `type` and always refused a non-member, so only the doors that skip Zod could ever deliver one.
+
+## What was wrong
+
+One declaration produced two different columns. Measured on live PostgreSQL 16.13, driving all three producers from one object:
+
+| declaration | driver | `os generate migration --format sql` | `--format ts` |
+|:---|:---|:---|:---|
+| `{ maxLength: 100 }`, no `type` | `character varying(100)` | `TEXT` | `TEXT` |
+| `{ type: 'this_is_not_a_field_type', maxLength: 100 }` | `character varying(255)` | `TEXT` | `TEXT` |
+
+`SqlDriver.createColumn` read `field.type || 'string'`, which heads its STRING-family arm and sizes the column from the declared `maxLength` (knex's 255 without one). All four generator loops in `os generate` read `String(fieldDef.type || 'text')`, which heads the TEXT family — unbounded unless the column is keyed. Both directions of harm are in the first row: the platform refuses a 101-character value that both generated tables accept, and a table generated from the same object accepts values the platform will not store.
+
+## What it does now
+
+- **One point of closure, at the registration door.** `SchemaRegistry.registerObject` refuses the WHOLE object declaration, with the ADR-0112 envelope (`INVALID_METADATA` + `422`), naming the object, the field and the reason — and offering the spec's own "did you mean?" for a mis-spelling. ⛔ The offending field is never dropped on its own: an object loaded one field short reports success at every authoring surface while the column is never created and every read of it answers `undefined`. Every door goes through this one — declared stacks, package and plugin manifests, `saveMetaItem`, the `sys_metadata` boot rehydration, and raw `registerObject` calls — and all three contributor kinds (`own`, `overlay`, `extend`) are judged, because `ObjectSchema.fields` and `ObjectExtensionSchema.fields` are both `z.record(z.string(), FieldSchema)`.
+- **The startup policy is revised for this class.** `loadMetaFromDb`'s 「Registered anyway so it stays serveable and fixable」 no longer applies to it. The row does not register; the startup log states the consequence and the fix once, at `error`. The row itself is untouched, and the metadata API's raw-row path still lists it, still serves it with the offending field visible, still accepts a corrected write, and still deletes it — pinned, because a refused row that vanished from Studio would be unfixable.
+- **Downstream guesses become refusals.** `createColumn` refuses a field that declares no `type` instead of building `varchar(255)` for it. All four `os generate` loops — both migration formats and both `os generate types` loops — refuse an absent or non-member `type` and generate nothing for that object, rather than emitting a table one column short. `fieldTypeToSql`'s docblock is rewritten in the same stroke: its `TEXT` miss branch is now dead residue of a total table, ⛔ not a family default to route anything new to.
+
+## Scope, stated rather than left to be inferred
+
+`SqlDriver.createColumn` refuses `type` ABSENCE, not `FieldType` MEMBERSHIP. Membership is refused for the whole object at the registration door, which fronts every route into `syncSchema`, so a non-member cannot reach the driver from a runtime at all. `driver-sql`'s own test corpus declares 388 non-member spellings across ~100 files that drive `initObjects` directly, and `'string'` is a declared `case` arm of that switch whose column shape differs from every member's — so closing that half is a corpus migration with column consequences, deliberately not folded into this change. A pin holds the boundary in both directions.
+
+ONE fixture in that corpus is migrated here, because it is the one that crosses the door. `CROSS_FIELD_OBJECT_FIELDS` — exported from this package's root, so a published export and not only a local literal — declared `stage` and `owner` as `'string'`. Four of its five consumers hand it to `driver.initObjects`, which the paragraph above leaves alone; the fifth hands it to `ql.registerObject`, which now refuses the whole object. Both fields are re-spelled `'text'`. That is not a re-typing: `canonicalizeSqlType('varchar(255)')` is `'text'` and `suggestFieldTypeForSqlType('varchar(255)')` is `'text'`, both pinned in `spec/data/type-compat.test.ts`, so `'text'` is the spelling of the column `'string'` was already producing. It does move the emitted column from `varchar(255)` to `TEXT` (measured on sqlite-wasm: `stage varchar(255)` becomes `stage text`), which is inert for this fixture — no index keys either column, `initObjects` is passed no indexes, and the corpus's longest value in them is four characters.
@@ -0,0 +1,129 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * #16319 — no generator in this file guesses a field's column family any more.
+ *
+ * MAINTAINER RULING, 2026-09-10 (director seat batch #111 item 2), verbatim:
+ * 「16319 一个没写 type(或拼错)的字段 应该禁止加载。这个才是合理的吧?其他同意」
+ * — item 3: 「下游默认值全部改拒绝: … 两个迁移生成器与 `os generate types` 的
+ * `|| 'text'` 一律改为响亮拒绝 … ⛔ 不再猜族」.
+ *
+ * ## What the retired default cost
+ *
+ * All four loops read `String(fieldDef.type || 'text')`. That put a typeless
+ * field in the TEXT family while `SqlDriver.createColumn`'s own `field.type ||
+ * 'string'` put the SAME declaration in the STRING family. Measured on the card
+ * against live PostgreSQL 16.13:
+ *
+ * ```
+ *                                driver                  sql gen   ts gen
+ *   { maxLength: 100 }           character varying(100)  text      text
+ *   { type: 'this_is_not_a_
+ *     field_type', maxLength:100} character varying(255)  text      text
+ * ```
+ *
+ * Both directions of harm are in the first row: the platform refuses a
+ * 101-character value that both generated tables accept.
+ *
+ * ## Why the generators refuse BOTH shapes and the driver refuses one
+ *
+ * A generator reads a config FILE and never touches the registry, so here the
+ * refusal is the only door there is. `SqlDriver.createColumn` sits behind
+ * `SchemaRegistry.registerObject`, which refuses a non-member for the whole
+ * object — the ruling's single point of closure, and what its acceptance list
+ * means by 「驱动永远到不了」.
+ *
+ * ⛔ The file, not the field: emitting a table one column short is the same
+ * silent loss the ruling refuses at the registration door, one artifact left.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  generateTypesFromConfig,
+  generateMigrationSql,
+  generateMigrationTs,
+} from './generate.js';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+const configWith = (probe: Record<string, unknown>) => ({
+  objects: {
+    probe_object: {
+      name: 'probe_object',
+      label: 'Probe',
+      fields: {
+        title: { type: 'text', label: 'Title' },
+        probe: { label: 'Probe', ...probe },
+      },
+    },
+  },
+});
+
+const NO_TYPE = { maxLength: 100 };
+const BAD_TYPE = { type: 'this_is_not_a_field_type', maxLength: 100 };
+const CONTROL = { type: 'email', maxLength: 100 };
+
+const GENERATORS: Array<[string, (c: Record<string, unknown>) => string]> = [
+  ['os generate types', generateTypesFromConfig],
+  ['os generate migration --format sql', generateMigrationSql],
+  ['os generate migration --format ts', generateMigrationTs],
+];
+
+describe('#16319 — every exported generator refuses an undeclarable field `type`', () => {
+  for (const [label, generate] of GENERATORS) {
+    it(`${label} refuses a field with NO \`type\`, naming object + field + reason`, () => {
+      let thrown: any;
+      try { generate(configWith(NO_TYPE) as any); } catch (e) { thrown = e; }
+      expect(thrown, `${label} must refuse`).toBeDefined();
+      expect(thrown.message).toContain("object 'probe_object'");
+      expect(thrown.message).toContain("field 'probe'");
+      expect(thrown.message).toContain('declares no `type`');
+      expect(thrown.message).toContain('Nothing is generated for this object');
+    });
+
+    it(`${label} refuses a NON-MEMBER \`type\` the same way`, () => {
+      let thrown: any;
+      try { generate(configWith(BAD_TYPE) as any); } catch (e) { thrown = e; }
+      expect(thrown, `${label} must refuse`).toBeDefined();
+      expect(thrown.message).toContain("'this_is_not_a_field_type'");
+      expect(thrown.message).toContain('is not a member of `FieldType`');
+    });
+
+    it(`POSITIVE CONTROL — ${label} still emits for the same object with a \`FieldType\` member`, () => {
+      const out = generate(configWith(CONTROL) as any);
+      // ⛔ Not merely "did not throw": the probe column has to be IN the output,
+      // or a generator that silently dropped the field would pass this control.
+      expect(out).toContain('probe');
+      expect(out).toContain('title');
+    });
+  }
+
+  it('⛔ refuses the FILE, not the field — no partial artifact is produced', () => {
+    // Every generator throws before returning, so there is no half-written
+    // artifact to inspect: the assertion is that nothing comes back at all.
+    for (const [, generate] of GENERATORS) {
+      expect(() => generate(configWith(NO_TYPE) as any)).toThrow();
+    }
+  });
+
+  it('SOURCE PIN — all FOUR loops read `declaredFieldType`, and no `|| \'text\'` default survives', () => {
+    // The fourth loop (`generateClientFromConfig`) is not exported, so its call
+    // site is pinned here rather than driven. Reading this package's OWN source
+    // through an `import.meta.url` seed — the spelling
+    // `pnpm check:cross-package-test-inputs` recognises.
+    const src = readFileSync(resolve(HERE, 'generate.ts'), 'utf8');
+    const callSites = src.match(/const fType = declaredFieldType\(/g) ?? [];
+    expect(callSites.length).toBe(4);
+    // The retired default, gone from every executable line. Occurrences that
+    // remain are prose in comments — the control below proves the probe can see
+    // a real one, so the zero is a reading and not an empty walk.
+    const executable = src
+      .split('\n')
+      .filter((l) => !l.trimStart().startsWith('//') && !l.trimStart().startsWith('*'));
+    expect(executable.filter((l) => l.includes("|| 'text'")).length).toBe(0);
+    expect(executable.filter((l) => l.includes('declaredFieldType(')).length).toBeGreaterThan(0);
+  });
+});