From a049397bb05a808e8b25ba058df4e59dd335f119 Mon Sep 17 00:00:00 2001 From: MechaCat02 Date: Mon, 29 Jun 2026 20:53:18 +0200 Subject: [PATCH] =?UTF-8?q?test(cli):=20extension-point=20journeys=20+=20n?= =?UTF-8?q?ode-key=20manifest=20fix=20+=20docs=20(=C2=A75.5=20C5)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Move the manifest `extension_points` from a top-level key to an `[app]`/ `[group]` node key (`ManifestApp`/`ManifestGroup` + a `Manifest::extension_points()` accessor). A bare top-level array placed after the node header was silently re-nested by TOML into that table and dropped; as a node key it parses unambiguously wherever it sits. build_bundle/pull/init updated. - Journeys (live server + Postgres): a group default body resolves for an inheriting app; the app provides its own module and OVERRIDES the EP (the inverse of the Phase 4b sealed import); `extension-points ls` shows the provider; a body-less EP with no provider fails `pic plan`. - Re-bless the schema snapshot (new `extension_points` table). - Docs: §5.5 marked complete (extension points ✅) + CLAUDE.md current-focus. Co-Authored-By: Claude Opus 4.8 (1M context) --- CLAUDE.md | 2 +- crates/manager-core/tests/expected_schema.txt | 22 ++ crates/picloud-cli/src/cmds/init.rs | 2 +- crates/picloud-cli/src/cmds/plan.rs | 2 +- crates/picloud-cli/src/cmds/pull.rs | 2 +- crates/picloud-cli/src/manifest.rs | 30 ++- crates/picloud-cli/tests/cli.rs | 1 + crates/picloud-cli/tests/extension_points.rs | 231 ++++++++++++++++++ docs/design/groups-and-project-tool.md | 18 +- 9 files changed, 295 insertions(+), 15 deletions(-) create mode 100644 crates/picloud-cli/tests/extension_points.rs diff --git a/CLAUDE.md b/CLAUDE.md index 8475cc1..6a5f2a1 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -10,7 +10,7 @@ Authoritative design: [serverless_cloud_blueprint.md](serverless_cloud_blueprint **v1.1.x — SDK foundation + services — is complete.** The SDK shape (handle pattern, `::` namespaces, `Services`/`SdkCallCx`; see [docs/sdk-shape.md](docs/sdk-shape.md), stdlib at [docs/stdlib-reference.md](docs/stdlib-reference.md)) fixed in v1.1.0, then KV, docs, modules, HTTP, cron, files, pub/sub, email, users, and durable queues + `invoke()` filled it in through **v1.1.9** — blueprint §12 has the table. Earlier groundwork: blueprint Phase 3 (admin auth, multi-app scoping, Phase 3.5 capability gating — `manager-core::authz::{can, require, Capability}`, migration `0006_users_authz.sql`). -**Current focus: v1.2 _Hierarchies_ — groups + the declarative project tool** ([docs/design/groups-and-project-tool.md](docs/design/groups-and-project-tool.md)). That doc's §11 uses its own **Phase 1–6 numbering, distinct from the blueprint product-phase numbering above — do not conflate them** (its "Phase 3" = group-inherited config, not admin auth). Implemented on `feat/groups-*` branches: §11 Phase 1 (declarative `pic plan`/`apply`/`prune` + env overlays), Phase 2 (single-parent groups tree + hierarchy-aware RBAC), Phase 3 (group-inherited, env-scoped `vars` + secrets resolved **live** via a recursive CTE — no materialized cache), Phase 4-lite (group-owned **endpoint** scripts: `scripts` polymorphic owner in `0050_group_scripts.sql`, `get_by_name_inherited`/`is_invocable_by_app` chain resolution, inherited `invoke()` + declarative route/trigger binding — all **live**, no body materialization), Phase 5 (the **declarative project tool maps onto the group tree**: the reconcile engine generalized to `ApplyOwner{App|Group}`, a `[group]` manifest kind, and a single atomic **tree apply** — `pic plan/apply --dir` reconciles a whole directory tree of `picloud.toml` nodes in one Postgres transaction, groups-before-apps so an app route can bind a group script created in the same tx; the bound token folds in each group's `structure_version`. Multi-repo single-owner/attach-point and per-env approval gating are deferred; groups pre-exist), Phase 4b (group **modules** + the **lexical (sealed-by-default) import resolver**, §5.5: owner-polymorphic `ModuleScript`, origin-rooted `ModuleSource::resolve` walking the importing node's chain, `ExecRequest.script_owner` threaded from every dispatch + `invoke()` site, `_source`-driven lexical chaining in `PicloudModuleResolver` with the compiled-module cache re-keyed by `ScriptId`, group modules/imports allowed, single-node dangling-import `plan` check — an inherited group script's imports **seal to the group**, a leaf can't shadow them). Next: §5.5 **opt-in extension points** (the one deferred §5.5 piece) or §11.6 (group-level collections, v1.3). +**Current focus: v1.2 _Hierarchies_ — groups + the declarative project tool** ([docs/design/groups-and-project-tool.md](docs/design/groups-and-project-tool.md)). That doc's §11 uses its own **Phase 1–6 numbering, distinct from the blueprint product-phase numbering above — do not conflate them** (its "Phase 3" = group-inherited config, not admin auth). Implemented on `feat/groups-*` branches: §11 Phase 1 (declarative `pic plan`/`apply`/`prune` + env overlays), Phase 2 (single-parent groups tree + hierarchy-aware RBAC), Phase 3 (group-inherited, env-scoped `vars` + secrets resolved **live** via a recursive CTE — no materialized cache), Phase 4-lite (group-owned **endpoint** scripts: `scripts` polymorphic owner in `0050_group_scripts.sql`, `get_by_name_inherited`/`is_invocable_by_app` chain resolution, inherited `invoke()` + declarative route/trigger binding — all **live**, no body materialization), Phase 5 (the **declarative project tool maps onto the group tree**: the reconcile engine generalized to `ApplyOwner{App|Group}`, a `[group]` manifest kind, and a single atomic **tree apply** — `pic plan/apply --dir` reconciles a whole directory tree of `picloud.toml` nodes in one Postgres transaction, groups-before-apps so an app route can bind a group script created in the same tx; the bound token folds in each group's `structure_version`. Multi-repo single-owner/attach-point and per-env approval gating are deferred; groups pre-exist), Phase 4b (group **modules** + the **lexical (sealed-by-default) import resolver**, §5.5: owner-polymorphic `ModuleScript`, origin-rooted `ModuleSource::resolve` walking the importing node's chain, `ExecRequest.script_owner` threaded from every dispatch + `invoke()` site, `_source`-driven lexical chaining in `PicloudModuleResolver` with the compiled-module cache re-keyed by `ScriptId`, group modules/imports allowed, single-node dangling-import `plan` check — an inherited group script's imports **seal to the group**, a leaf can't shadow them), §5.5 **extension points** (opt-in polymorphism — **§5.5 now complete**: marker table `0051_extension_points.sql` (owner-polymorphic, CASCADE — structurally a `secrets` name; default body = a co-located `kind=module` script), `ModuleSource::resolve_policy` with **nearest-declaration-kind-wins** — a concrete module resolves lexically, an EP marker resolves **dynamically against the inheriting app** (its override else the default body up-chain), `NoProvider` is a hard error; declarative-only authoring via the `[app]`/`[group]` manifest key `extension_points = [...]`, reconcile mirrors `secrets`, single-node no-provider `plan` check, read-only `pic extension-points ls` + `pull` round-trip — the app can **override** a group default, the deliberate inverse of the Phase 4b sealed import). Next: §11.6 (group-level collections, v1.3) or multi-node cluster mode. **Data-model invariant:** app-owned data-plane tables (KV, docs, files, …) start with `app_id UUID NOT NULL REFERENCES apps(id) ON DELETE CASCADE`; the group-inheritable tables — _config_ (`vars`, `secrets`) and now group-owned _code_ (`scripts`, `0050`) — instead carry a **polymorphic owner**: nullable `group_id` and `app_id` with an exactly-one CHECK and per-owner partial-unique indexes (config is `ON DELETE CASCADE`, scripts `RESTRICT` — code is not data). Inheritance resolves **live** down `apps.group_id → groups.parent_id` via `CHAIN_LEVELS_CTE` (no materialized view); nearest-owner-wins with an app's own row shadowing the inherited one (CoW). Every Rhai SDK call resolves its app from `cx.app_id`, never a script-passed arg, and a group script always runs under the *inheriting* app's `cx.app_id` (the cross-app isolation boundary). diff --git a/crates/manager-core/tests/expected_schema.txt b/crates/manager-core/tests/expected_schema.txt index a1bdbba..03e2392 100644 --- a/crates/manager-core/tests/expected_schema.txt +++ b/crates/manager-core/tests/expected_schema.txt @@ -198,6 +198,14 @@ table: execution_logs app_id: uuid NOT NULL source: text NOT NULL default='http'::text +table: extension_points + id: uuid NOT NULL default=gen_random_uuid() + group_id: uuid NULL + app_id: uuid NULL + name: text NOT NULL + created_at: timestamp with time zone NOT NULL default=now() + updated_at: timestamp with time zone NOT NULL default=now() + table: files app_id: uuid NOT NULL collection: text NOT NULL @@ -463,6 +471,13 @@ indexes on execution_logs: execution_logs_pkey: public.execution_logs USING btree (id) execution_logs_script_id_created_at_idx: public.execution_logs USING btree (script_id, created_at DESC) +indexes on extension_points: + extension_points_app_id_idx: public.extension_points USING btree (app_id) WHERE (app_id IS NOT NULL) + extension_points_app_uidx: public.extension_points USING btree (app_id, lower(name)) WHERE (app_id IS NOT NULL) + extension_points_group_id_idx: public.extension_points USING btree (group_id) WHERE (group_id IS NOT NULL) + extension_points_group_uidx: public.extension_points USING btree (group_id, lower(name)) WHERE (group_id IS NOT NULL) + extension_points_pkey: public.extension_points USING btree (id) + indexes on files: files_pkey: public.files USING btree (app_id, collection, id) idx_files_app_collection: public.files USING btree (app_id, collection) @@ -656,6 +671,12 @@ constraints on execution_logs: [FOREIGN KEY] execution_logs_script_id_fkey: FOREIGN KEY (script_id) REFERENCES scripts(id) ON DELETE SET NULL [PRIMARY KEY] execution_logs_pkey: PRIMARY KEY (id) +constraints on extension_points: + [CHECK] extension_points_owner_exactly_one: CHECK (((group_id IS NULL) <> (app_id IS NULL))) + [FOREIGN KEY] extension_points_app_id_fkey: FOREIGN KEY (app_id) REFERENCES apps(id) ON DELETE CASCADE + [FOREIGN KEY] extension_points_group_id_fkey: FOREIGN KEY (group_id) REFERENCES groups(id) ON DELETE CASCADE + [PRIMARY KEY] extension_points_pkey: PRIMARY KEY (id) + constraints on files: [FOREIGN KEY] files_app_id_fkey: FOREIGN KEY (app_id) REFERENCES apps(id) ON DELETE CASCADE [PRIMARY KEY] files_pkey: PRIMARY KEY (app_id, collection, id) @@ -800,3 +821,4 @@ constraints on vars: 0048: vars 0049: group secrets 0050: group scripts + 0051: extension points diff --git a/crates/picloud-cli/src/cmds/init.rs b/crates/picloud-cli/src/cmds/init.rs index dad5a20..8751356 100644 --- a/crates/picloud-cli/src/cmds/init.rs +++ b/crates/picloud-cli/src/cmds/init.rs @@ -113,6 +113,7 @@ fn scaffold_manifest(slug: &str, name: &str) -> Manifest { slug: slug.to_string(), name: name.to_string(), description: None, + extension_points: Vec::new(), }), group: None, scripts: vec![ManifestScript { @@ -139,7 +140,6 @@ fn scaffold_manifest(slug: &str, name: &str) -> Manifest { triggers: crate::manifest::ManifestTriggers::default(), secrets: crate::manifest::ManifestSecrets::default(), vars: std::collections::BTreeMap::new(), - extension_points: Vec::new(), } } diff --git a/crates/picloud-cli/src/cmds/plan.rs b/crates/picloud-cli/src/cmds/plan.rs index 1c52647..04facd3 100644 --- a/crates/picloud-cli/src/cmds/plan.rs +++ b/crates/picloud-cli/src/cmds/plan.rs @@ -161,7 +161,7 @@ pub fn build_bundle(manifest: &Manifest, base_dir: &Path) -> Result { "triggers": triggers, "secrets": manifest.secrets.names, "vars": vars, - "extension_points": manifest.extension_points, + "extension_points": manifest.extension_points(), })) } diff --git a/crates/picloud-cli/src/cmds/pull.rs b/crates/picloud-cli/src/cmds/pull.rs index 007950d..a1b3c6c 100644 --- a/crates/picloud-cli/src/cmds/pull.rs +++ b/crates/picloud-cli/src/cmds/pull.rs @@ -224,6 +224,7 @@ pub async fn run(app_ident: &str, dir: &Path, force: bool, mode: OutputMode) -> slug: app.app.slug.clone(), name: app.app.name.clone(), description: app.app.description.clone(), + extension_points, }), group: None, scripts: manifest_scripts, @@ -233,7 +234,6 @@ pub async fn run(app_ident: &str, dir: &Path, force: bool, mode: OutputMode) -> names: secrets.iter().map(|s| s.name.clone()).collect(), }, vars: manifest_vars, - extension_points, }; std::fs::write(&manifest_path, manifest.to_toml()?) diff --git a/crates/picloud-cli/src/manifest.rs b/crates/picloud-cli/src/manifest.rs index e46cb36..c05e7f9 100644 --- a/crates/picloud-cli/src/manifest.rs +++ b/crates/picloud-cli/src/manifest.rs @@ -49,12 +49,6 @@ pub struct Manifest { /// The overlay merges per-env, last-write-wins by key. #[serde(default, skip_serializing_if = "BTreeMap::is_empty")] pub vars: BTreeMap, - /// `extension_points = ["theme", …]` (§5.5) — module names this node marks - /// as provided/overridable by descendants. Name-only, like `[secrets]`; the - /// optional default body is a co-located `[[scripts]]` module of the same - /// name. Allowed on app and group nodes. - #[serde(default, skip_serializing_if = "Vec::is_empty")] - pub extension_points: Vec, } impl Manifest { @@ -105,6 +99,17 @@ impl Manifest { self.group.is_some() } + /// This node's declared extension-point names (§5.5), from whichever of + /// `[app]` / `[group]` is present. + #[must_use] + pub fn extension_points(&self) -> &[String] { + match (&self.app, &self.group) { + (Some(a), _) => &a.extension_points, + (_, Some(g)) => &g.extension_points, + _ => &[], + } + } + /// Load and parse the manifest at `path`. pub fn load(path: &Path) -> Result { let body = @@ -209,6 +214,12 @@ pub struct ManifestApp { pub name: String, #[serde(default, skip_serializing_if = "Option::is_none")] pub description: Option, + /// `extension_points = ["theme", …]` (§5.5) — module names this node marks + /// as provided/overridable by descendants. Name-only, like `[secrets]`; the + /// optional default body is a co-located `[[scripts]]` module of the same + /// name. A key of the `[app]` table so TOML can't mis-nest it. + #[serde(default, skip_serializing_if = "Vec::is_empty")] + pub extension_points: Vec, } /// A `[group]` node (Phase 5): a group's own declarative content — its scripts @@ -221,6 +232,9 @@ pub struct ManifestGroup { pub name: String, #[serde(default, skip_serializing_if = "Option::is_none")] pub description: Option, + /// See [`ManifestApp::extension_points`]. A key of the `[group]` table. + #[serde(default, skip_serializing_if = "Vec::is_empty")] + pub extension_points: Vec, } #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)] @@ -432,6 +446,7 @@ mod tests { slug: "blog".into(), name: "My Blog".into(), description: Some("demo".into()), + extension_points: vec!["theme".into()], }), group: None, scripts: vec![ @@ -494,7 +509,6 @@ mod tests { ("region".to_string(), toml::Value::String("eu".into())), ("max-retries".to_string(), toml::Value::Integer(3)), ]), - extension_points: vec!["theme".into()], } } @@ -591,6 +605,7 @@ mod tests { slug: "x".into(), name: "X".into(), description: None, + extension_points: vec![], }), group: None, scripts: vec![], @@ -598,7 +613,6 @@ mod tests { triggers: ManifestTriggers::default(), secrets: ManifestSecrets::default(), vars: BTreeMap::new(), - extension_points: vec![], }; let text = m.to_toml().unwrap(); assert!(!text.contains("[[scripts]]"), "got:\n{text}"); diff --git a/crates/picloud-cli/tests/cli.rs b/crates/picloud-cli/tests/cli.rs index 00d007c..9782905 100644 --- a/crates/picloud-cli/tests/cli.rs +++ b/crates/picloud-cli/tests/cli.rs @@ -23,6 +23,7 @@ mod dead_letters; mod email_queue; mod enabled; mod env_overlay; +mod extension_points; mod group_modules; mod group_scripts; mod group_secrets; diff --git a/crates/picloud-cli/tests/extension_points.rs b/crates/picloud-cli/tests/extension_points.rs new file mode 100644 index 0000000..2c85108 --- /dev/null +++ b/crates/picloud-cli/tests/extension_points.rs @@ -0,0 +1,231 @@ +//! §5.5 opt-in extension points, end to end via `pic`: +//! * a group marks a module `theme` an extension point (default body) and an +//! endpoint `render` imports it; an app inherits → uses the DEFAULT, +//! * the app provides its OWN `theme` module → `render` now binds the app's +//! (DYNAMIC override — the inverse of the Phase 4b sealed/lexical import), +//! * `pic extension-points ls --app` shows the resolved provider, +//! * an inherited extension point with NO provider is a `pic plan` error. + +use std::fs; + +use tempfile::TempDir; + +use crate::common; +use crate::common::cleanup::{AppGuard, GroupGuard, ScriptGuard}; + +fn manifest_dir() -> TempDir { + let dir = TempDir::new().expect("tempdir"); + fs::create_dir_all(dir.path().join("scripts")).expect("scripts dir"); + dir +} + +#[ignore = "needs DATABASE_URL pointing at a running Postgres"] +#[test] +fn extension_point_default_then_app_override() { + let Some(fx) = common::fixture_or_skip() else { + return; + }; + let env = common::admin_env(fx); + let group = common::unique_slug("ep-grp"); + let child = common::unique_slug("ep-child"); + + let _g = GroupGuard::new(&env.url, &env.token, &group); + common::pic_as(&env) + .args(["groups", "create", &group]) + .assert() + .success(); + + let dir = manifest_dir(); + // Group default `theme` module + a `render` endpoint importing it. + fs::write( + dir.path().join("scripts/theme.rhai"), + r#"fn color() { "blue" }"#, + ) + .unwrap(); + common::pic_as(&env) + .args(["scripts", "deploy"]) + .arg(dir.path().join("scripts/theme.rhai")) + .args(["--group", &group, "--name", "theme", "--kind", "module"]) + .assert() + .success(); + fs::write( + dir.path().join("scripts/render.rhai"), + r#"import "theme" as t; t::color()"#, + ) + .unwrap(); + common::pic_as(&env) + .args(["scripts", "deploy"]) + .arg(dir.path().join("scripts/render.rhai")) + .args(["--group", &group, "--name", "render"]) + .assert() + .success(); + let _gt = ScriptGuard::new( + &env.url, + &env.token, + &group_script_id(&env, &group, "theme"), + ); + let _gr = ScriptGuard::new( + &env.url, + &env.token, + &group_script_id(&env, &group, "render"), + ); + + // Mark `theme` an extension point at the group (declarative apply). + let gmanifest = + format!("[group]\nslug = \"{group}\"\nname = \"EP\"\n\nextension_points = [\"theme\"]\n"); + let gpath = dir.path().join("group.toml"); + fs::write(&gpath, &gmanifest).unwrap(); + common::pic_as(&env) + .args(["apply", "--file"]) + .arg(&gpath) + .assert() + .success(); + + // App under the group; a `caller` invokes the inherited `render`. + let _child = AppGuard::new(&env.url, &env.token, &child); + common::pic_as(&env) + .args(["apps", "create", &child, "--group", &group]) + .assert() + .success(); + fs::write( + dir.path().join("scripts/caller.rhai"), + r#"invoke("render", #{})"#, + ) + .unwrap(); + common::pic_as(&env) + .args(["scripts", "deploy"]) + .arg(dir.path().join("scripts/caller.rhai")) + .args(["--app", &child, "--name", "caller"]) + .assert() + .success(); + let caller_id = app_script_id(&env, &child, "caller"); + + // Default: with no app override, `render`'s EP import falls back to the + // group's default body → "blue". + assert_eq!( + invoke_body(&env, &caller_id), + serde_json::json!("blue"), + "an inherited extension point resolves the group's default body" + ); + + // DYNAMIC OVERRIDE: the app provides its own `theme`. Because `theme` is an + // extension point, the group endpoint's import now binds the APP's module — + // the exact inverse of a Phase 4b lexical (sealed) import. + fs::write( + dir.path().join("scripts/apptheme.rhai"), + r#"fn color() { "red" }"#, + ) + .unwrap(); + common::pic_as(&env) + .args(["scripts", "deploy"]) + .arg(dir.path().join("scripts/apptheme.rhai")) + .args(["--app", &child, "--name", "theme", "--kind", "module"]) + .assert() + .success(); + assert_eq!( + invoke_body(&env, &caller_id), + serde_json::json!("red"), + "the app must override an extension point the group declared" + ); + + // `extension-points ls --app` shows the resolved provider. + let ls = String::from_utf8( + common::pic_as(&env) + .args(["extension-points", "ls", "--app", &child]) + .output() + .unwrap() + .stdout, + ) + .unwrap(); + assert!( + ls.contains("theme") && ls.contains("app override"), + "ls should report the app override:\n{ls}" + ); +} + +#[ignore = "needs DATABASE_URL pointing at a running Postgres"] +#[test] +fn extension_point_without_provider_is_rejected_by_plan() { + let Some(fx) = common::fixture_or_skip() else { + return; + }; + let env = common::admin_env(fx); + let group = common::unique_slug("epn-grp"); + let child = common::unique_slug("epn-child"); + + let _g = GroupGuard::new(&env.url, &env.token, &group); + common::pic_as(&env) + .args(["groups", "create", &group]) + .assert() + .success(); + + // Group declares an EP `ghost` with NO default body (body-less). + let dir = manifest_dir(); + let gmanifest = + format!("[group]\nslug = \"{group}\"\nname = \"EPN\"\n\nextension_points = [\"ghost\"]\n"); + let gpath = dir.path().join("group.toml"); + fs::write(&gpath, &gmanifest).unwrap(); + common::pic_as(&env) + .args(["apply", "--file"]) + .arg(&gpath) + .assert() + .success(); + + // App under the group provides no `ghost` → any plan for it is refused. + let _child = AppGuard::new(&env.url, &env.token, &child); + common::pic_as(&env) + .args(["apps", "create", &child, "--group", &group]) + .assert() + .success(); + let amanifest = format!("[app]\nslug = \"{child}\"\nname = \"EPN child\"\n"); + let apath = dir.path().join("picloud.toml"); + fs::write(&apath, &amanifest).unwrap(); + let out = common::pic_as(&env) + .args(["plan", "--file"]) + .arg(&apath) + .output() + .expect("plan"); + assert!( + !out.status.success(), + "an inherited extension point with no provider must fail plan" + ); + let stderr = String::from_utf8_lossy(&out.stderr).to_lowercase(); + assert!( + stderr.contains("ghost") || stderr.contains("no provider") || stderr.contains("extension"), + "plan error should name the unprovided extension point:\n{stderr}" + ); +} + +/// Id of the named script in a group (`pic scripts ls --group `). +fn group_script_id(env: &common::TestEnv, group: &str, name: &str) -> String { + named_id(env, &["scripts", "ls", "--group", group], name) +} + +/// Id of the named script in an app (`pic scripts ls --app `). +fn app_script_id(env: &common::TestEnv, app: &str, name: &str) -> String { + named_id(env, &["scripts", "ls", "--app", app], name) +} + +fn named_id(env: &common::TestEnv, args: &[&str], name: &str) -> String { + let ls = common::pic_as(env).args(args).output().expect("scripts ls"); + let table = String::from_utf8(ls.stdout).unwrap(); + table + .lines() + .map(common::cells) + .find(|c| c.get(2) == Some(&name)) + .and_then(|c| c.first().map(|s| (*s).to_string())) + .unwrap_or_else(|| panic!("script `{name}` not found:\n{table}")) +} + +fn invoke_body(env: &common::TestEnv, id: &str) -> serde_json::Value { + let out = common::pic_as(env) + .args(["scripts", "invoke", id]) + .output() + .expect("scripts invoke"); + assert!( + out.status.success(), + "invoke failed: {}", + String::from_utf8_lossy(&out.stderr) + ); + serde_json::from_slice(&out.stdout).expect("invoke body is JSON") +} diff --git a/docs/design/groups-and-project-tool.md b/docs/design/groups-and-project-tool.md index 8e7ca65..0e43cbc 100644 --- a/docs/design/groups-and-project-tool.md +++ b/docs/design/groups-and-project-tool.md @@ -552,9 +552,21 @@ trust inversion). The rule: > site; the `PicloudModuleResolver` reads the importing node from Rhai's `_source` (set to each module's > owner via `AST::set_source(encode(owner))` before `eval_ast_as_new` — the lexical chaining), and the > cache is re-keyed by resolved `ScriptId`. Group modules + group-script imports are now allowed -> (`group_scripts_api`), and the single-node apply runs the §5.5 dangling-import `plan` check. **Opt-in -> extension points** (the dynamic-resolution branch + `[extension_points]` manifest declaration) remain -> the one deferred piece of §5.5 — a clean additive follow-up on top of the now-origin-aware resolver. +> (`group_scripts_api`), and the single-node apply runs the §5.5 dangling-import `plan` check. + +> **Resolved (extension points ✅) — §5.5 is complete.** Opt-in polymorphism shipped: an extension +> point is a **pure marker** `(owner, name)` (migration 0051 `extension_points`, owner-polymorphic + +> CASCADE — structurally a `secrets` name), authored declaratively as an `[app]`/`[group]` manifest key +> `extension_points = [...]` (a *node key*, so TOML can't mis-nest it); the optional **default body is a +> co-located `kind=module` script**. The resolver's `ModuleSource::resolve_policy(origin, app, name)` +> applies **nearest-declaration-kind-wins** over the importing node's chain (one query: min EP depth vs +> min module depth, EP wins a tie): a concrete module → lexical; an EP marker → **dynamic**, resolved +> against the inheriting app (its override, else the default body up-chain) — `NoProvider` is a hard +> error. Reconcile mirrors `secrets` (name-only diff/prune/state-token); the single-node apply adds the +> **no-provider `plan` check** (every EP visible to an app must have a provider); read-only +> `pic extension-points ls` + `pull` round-trip complete the surface. **Authoring is declarative only** +> (no imperative `add/rm`). Verified e2e: a group default resolves for an inheriting app, and the app +> can **override** it — the deliberate inverse of the Phase 4b sealed/lexical import. ### 5.6 Tree lifecycle: delete, reparent, rename