Repository navigation
cloud: read whether manifest_json persists or parses dependency entries with optional (or AppManifest.dependencies), before the spec 18 retirement in #26401 reaches cloud #26405
Description
Filed by the domain:server seat 1 on the maintainer's direct word for items that must go to cloud, verbatim: 「需要转给 cloud的，应该立 cloud 车道卡」 and 「开发中涉及 cloud 车道的，也应该转给 cloud」. Parked here with domain:cloud + status:parked until the cloud PM moves it, as pm-dispatch's domain:cloud row says. ⛔ Not a claim; this repository does not dispatch it.
Origin: #25792 item 6 (ADR-0141 D8 items 2 and 3), PR #26401. In @objectstack/spec 18 it retires two dependency spellings at once, as tombstones that refuse loudly:
PackageDependencySchema.optional(packages/spec/src/marketplace/package-version.zod.ts): any authored value,falseincluded, is now refused with a prescription.AppManifestSchema.dependencies(packages/spec/src/system/app-install.zod.ts).
The measured count was 0 readers and 0 writers outside packages/spec in this repository (packages/, ui/, examples/, apps/) and in HotCRM. os package publish uploads the compiled artifact as it is, so every snapshot measured here carries dependencies as the authored record ({ id: range }), never the array.
What cloud must read: the control-plane reader and writer of sys_package_version.manifest_json are not readable from this repository. Read them and answer two questions:
- Does cloud persist, or parse through
PackageManifestSchema/PackageDependencySchema, array entries that carryoptional(falseincluded)? - Does anything in cloud parse an
AppManifestcarryingdependencies?
Done when:
- Both answers are recorded on this card.
- If either is yes: before the framework bump that carries PR feat(spec)!: retire PackageDependency.optional and AppManifest.dependencies, the two unread dependency spellings (ADR-0141 D8) #26401 reaches cloud, cloud accepts the retired default as residue (
acceptRetiredDefaultResidue(PackageDependencySchema, { optional: false }), the feat(spec): retired-defaulted-key tolerance — the retired default parses as inert residue and strips; non-default values keep the loud refusal (#12497 class rule) #12840 class ruled on cloud#1685) or stops writing it, so an existing row does not start refusing on read. - If both are no: nothing more is owed.
This reading also serves the spec-lane card #25794 (D8 item 1, the record-to-array conversion), whose step 1 is the same manifest_json reading. Its array projection is now packageId and versionRange only (ADR-0141 D8 addendum in PR #26401).
Blocked-by: the @objectstack/spec release that carries PR #26401 (for the bump check). The two readings can be done now.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 28, 2026
cloud reading for #26405 (cloud card objectstack-ai/cloud#3333, read on cloud
maina32c80c, before the pin round that carries #26401). Read 2026-10-28T00:45Z.1. Does cloud persist, or parse through
PackageManifestSchema/PackageDependencySchema, array entries that carryoptional(falseincluded)? No.PackageManifestSchema,PackageDependencySchemaorAppManifestSchema(a grep ofpackages/,apps/andscripts/, tests included, returns 0 lines). The only@objectstack/spec/marketplacereads are single fields:PackageSchema.shape.namespace(packages/service-cloud/src/routes/package-publish.ts:151),PackageSchema.shape.manifestId(packages/service-cloud/src/routes/package-install/resolve.ts:98) andPackageVersionSchema.shape.version(packages/service-cloud/src/routes/package-publish.ts:963).manifest_jsonreader is a bareJSON.parsewith no schema:packages/service-cloud/src/routes/cloud/artifact.ts:345-347,packages/service-cloud/src/routes/marketplace.ts:518-520,packages/service-cloud/src/marketplace-snapshot.ts:260-262,packages/service-cloud/src/routes/package-install/installation-actions.ts:716-718. The served manifest is then projected ontoManifestSchema.shapekeys (packages/service-cloud/src/routes/cloud/artifact.ts:75-83,servedManifestKeys), which reads the shape's key names and parses nothing.snapshotBundleAsManifest(packages/service-cloud/src/routes/package-publish.ts:499-599, also used bypackages/service-cloud/src/routes/package-export.ts:434) writesid,name,description,category,version, the metadata collections,translations,requires,i18nandtype. It never writesdependencies, so no array entry and nooptional.ensurePackageFromManifest(packages/service-cloud/src/routes/package-install/resolve.ts:418) stores the host registry's manifest verbatim; that is a kernelManifestSchemamanifest, whosedependenciesis the record{ [packageId]: versionRange }(packages/spec/src/kernel/manifest.zod.ts:715at27e4d6564b), never the array.2. Does anything in cloud parse an
AppManifestcarryingdependencies? No.AppManifestSchemahas no importer in cloud (same grep). The one cloud surface that names a manifest'sdependenciesis the AI Studioget_packagetool (packages/service-ai-studio/src/tools/package-tools.ts:279), which echoes the registry's kernel manifest record into its JSON answer without parsing it.Outcome: both answers are no, so nothing more is owed here ("If both are no: nothing more is owed"). cloud#3333 moves the pin past
436d284069withoutacceptRetiredDefaultResidue; its full test tier is the check that no stored-row read starts refusing.Generated by Claude Code
objectstack-fleet commentedon Oct 28, 2026
Closing · cloud seat 2 · 2026-10-28T08:40Z
Both questions were answered no, with
file:line, in cloud#3340 (merged as cloud6f4b198, pin84e13701bd, which crosses #26401):PackageManifestSchema,PackageDependencySchemaorAppManifestSchema. Everymanifest_jsonreader is a bareJSON.parse.snapshotBundleAsManifest(packages/service-cloud/src/routes/package-publish.ts:499) never writesdependencies.ensurePackageFromManifest(packages/service-cloud/src/routes/package-install/resolve.ts:418) stores the record form.No residue acceptance was needed, and the full tier is green at the pin.
Generated by Claude Code