@nanobpm/urban 0.79.0 → 0.81.0

package/src/runtime/core/modules/surfaces.ts

@@ -8,8 +8,9 @@
 // Surfaces contribute routes to the shared server.
 
 import type { AppApi, RuntimeContext } from "../context.ts";
-import { presentFormIdentifier } from "../host.ts";
-import { html, json, noContent, normalizeRoutePath, type Route } from "../router.ts";
+import { html, json, normalizeRoutePath, type Route } from "../router.ts";
+import { FORMJS_JS } from "./formjs.gen.ts";
+import { completeUserTaskResponse, resolveFormResponse } from "./forms.ts";
 import { mountActions } from "./actions.ts";
 import { mountAgent } from "./agent.ts";
 import { mountApi } from "./api.ts";
@@ -42,13 +43,15 @@ function inboxPage(): string {
 ul{list-style:none;padding:0}li{margin:.4rem 0;display:flex;align-items:center;gap:.5rem}
 code{background:#f4f4f4;padding:.1rem .3rem;border-radius:3px}
 button{font:inherit;padding:.2rem .6rem;cursor:pointer}
-form label{display:block;margin:.6rem 0 .2rem;font-weight:600}
-form .field input,form .field textarea,form .field select{font:inherit;padding:.3rem;width:100%;box-sizing:border-box;max-width:24rem}
-form .field input[type=checkbox],form .field input[type=radio]{width:auto}
+.njf-field label{display:block;margin:.6rem 0 .2rem;font-weight:600}
+.njf-field input,.njf-field textarea,.njf-field select{font:inherit;padding:.3rem;width:100%;box-sizing:border-box;max-width:24rem}
+.njf-field input[type=checkbox],.njf-field input[type=radio]{width:auto}
+.njf-actions{margin-top:.6rem}
 #form{margin-top:1.5rem;border-top:1px solid #ddd;padding-top:1rem}
 .muted{color:#666}</style>
 <h1>Task inbox</h1><ul id="tasks"><li>loading…</li></ul>
 <div id="form"></div>
+<script>${FORMJS_JS}</script>
 <script>
 const BASE=location.pathname.replace(/[/]+$/,'');
 const tasksEl=document.getElementById('tasks');
@@ -83,7 +86,14 @@ function openForm(t){
   api('/api/form?'+q).then(f=>{
     formEl.replaceChildren();
     if(!f||!f.schema){renderNoForm(t);return;}
-    renderForm(t,f.schema);
+    // Reuse the ONE shared form-js renderer (NanoFormJs) — no fork with the pages surface.
+    formEl.appendChild(NanoFormJs.renderForm(f.schema,{
+      heading:'Task '+(t.elementId||t.userTaskKey),
+      submitLabel:'Submit',
+      cancelLabel:'Cancel',
+      onSubmit:(variables)=>complete(t.userTaskKey,variables),
+      onCancel:loadTasks,
+    }));
   }).catch(err=>{formEl.replaceChildren(el('p',{class:'muted'},'Failed to load form: '+err.message));});
 }
 
@@ -95,93 +105,6 @@ function renderNoForm(t){
   formEl.appendChild(bar);
 }
 
-function renderForm(t,schema){
-  const form=document.createElement('form');
-  form.appendChild(el('h2',{},'Task '+(t.elementId||t.userTaskKey)));
-  const components=Array.isArray(schema.components)?schema.components:[];
-  const inputs=[];
-  for(const c of components){
-    const built=buildField(c);
-    if(!built)continue;
-    form.appendChild(built.field);
-    if(built.read)inputs.push(built.read);
-  }
-  const submit=btn('Submit',null);submit.type='submit';
-  const bar=el('div',{});bar.appendChild(submit);bar.appendChild(btn('Cancel',loadTasks));
-  form.appendChild(bar);
-  form.addEventListener('submit',e=>{
-    e.preventDefault();
-    // Null-prototype: field keys come from the engine-supplied form schema. A component
-    // keyed '__proto__'/'constructor' must land as a plain own property (and round-trip
-    // through JSON), never mutate a prototype — no prototype pollution in the page runtime.
-    const variables=Object.create(null);
-    for(const read of inputs){const kv=read();if(kv)variables[kv.key]=kv.value;}
-    submit.disabled=true;
-    complete(t.userTaskKey,variables).catch(()=>{submit.disabled=false;});
-  });
-  formEl.appendChild(form);
-}
-
-function buildField(c){
-  const type=c&&c.type;
-  // Static (keyless) components: show text as a paragraph, ignore layout-only ones.
-  if(type==='text'){return {field:el('p',{class:'muted'},typeof c.text==='string'?c.text:'')};}
-  const key=c&&c.key;
-  if(!key)return null;
-  const wrap=el('div',{class:'field'});
-  const label=typeof c.label==='string'&&c.label?c.label:key;
-  if(type==='checkbox'){
-    const input=document.createElement('input');input.type='checkbox';
-    const lab=el('label',{});lab.appendChild(input);lab.appendChild(document.createTextNode(' '+label));
-    wrap.appendChild(lab);
-    return {field:wrap,read:()=>({key,value:input.checked})};
-  }
-  const labelEl=el('label',{},label);
-  wrap.appendChild(labelEl);
-  let input;
-  if(type==='textarea'){input=document.createElement('textarea');}
-  else if(type==='select'){
-    input=document.createElement('select');
-    input.appendChild(el('option',{value:''},'—'));
-    for(const o of (Array.isArray(c.values)?c.values:[])){
-      input.appendChild(el('option',{value:String(o.value)},String(o.label!=null?o.label:o.value)));
-    }
-  }
-  else if(type==='radio'){
-    const name='r'+Math.random().toString(36).slice(2);
-    const group=el('div',{});
-    for(const o of (Array.isArray(c.values)?c.values:[])){
-      const rlab=el('label',{});
-      const r=document.createElement('input');r.type='radio';r.name=name;r.value=String(o.value);
-      rlab.appendChild(r);rlab.appendChild(document.createTextNode(' '+String(o.label!=null?o.label:o.value)));
-      group.appendChild(rlab);
-    }
-    wrap.appendChild(group);
-    return {field:wrap,read:()=>{const sel=group.querySelector('input:checked');return sel?{key,value:sel.value}:null;}};
-  }
-  else{
-    input=document.createElement('input');
-    input.type=(type==='number')?'number':(type==='datetime'?'datetime-local':'text');
-  }
-  // Associate the label with the input (for/id) so screen readers announce it on focus.
-  const fieldId='f'+Math.random().toString(36).slice(2);
-  input.id=fieldId;labelEl.setAttribute('for',fieldId);
-  wrap.appendChild(input);
-  const isNumber=type==='number';
-  return {field:wrap,read:()=>{
-    const raw=input.value;
-    if(raw===''||raw==null)return null;
-    if(isNumber){
-      const n=Number(raw);
-      // A non-numeric value in a number field is only reachable via tampering (the browser
-      // blanks invalid type=number input). Treat it as absent rather than silently submitting
-      // NaN, which JSON.stringify serializes as null — quietly changing the submitted value.
-      return Number.isFinite(n)?{key,value:n}:null;
-    }
-    return {key,value:raw};
-  }};
-}
-
 function complete(userTaskKey,variables){
   return api('/api/complete',{method:'POST',headers:{'content-type':'application/json'},
     body:JSON.stringify({userTaskKey,variables})}).then(loadTasks);
@@ -236,39 +159,14 @@ export function mountSurfaces(ctx: RuntimeContext, app: AppApi): SurfacesHandle
       method: "GET",
       path: `${base}/api/form`,
       source: "surface:taskInbox",
-      handler: async (req) => {
-        const formKey = req.query.get("formKey") ?? undefined;
-        const formId = req.query.get("formId") ?? undefined;
-        // Reject only when *neither* identifier is present. Presence follows getForm's
-        // canonical rule (`presentFormIdentifier`: empty/whitespace = absent) so a
-        // whitespace-only `?formKey=   ` request 400s here instead of slipping past a raw
-        // truthiness check and returning a spurious 204. The raw values are still passed
-        // through unchanged — resolving a blank key to its `formId` fallback is getForm's
-        // single responsibility.
-        if (!presentFormIdentifier(formKey) && !presentFormIdentifier(formId))
-          return json({ error: "formKey or formId required" }, 400);
-        const form = await app.engine.getForm({ formKey, formId });
-        // A task whose form can't be resolved returns 204: the client renders the
-        // no-form fallback rather than erroring.
-        if (!form) return noContent();
-        return json(form);
-      },
+      handler: async (req) =>
+        resolveFormResponse(app.engine, req.query.get("formKey") ?? undefined, req.query.get("formId") ?? undefined),
     });
     routes.push({
       method: "POST",
       path: `${base}/api/complete`,
       source: "surface:taskInbox",
-      handler: async (req) => {
-        let body: { userTaskKey?: string; variables?: Record<string, unknown> };
-        try {
-          body = JSON.parse((await req.text()) || "{}");
-        } catch {
-          return json({ error: "invalid JSON body" }, 400);
-        }
-        if (!body.userTaskKey) return json({ error: "userTaskKey required" }, 400);
-        await app.engine.completeUserTask(body.userTaskKey, body.variables);
-        return json({ ok: true });
-      },
+      handler: async (req) => completeUserTaskResponse(app.engine, await req.text()),
     });
   }
 

package/src/runtime/core/read-model.test.ts

@@ -25,6 +25,8 @@ import {
   ProjectionRegistry,
   projectionRegistry,
   ReadModelRegistry,
+  isReservedObjectName,
+  RESERVED_OBJECT_PREFIXES,
   when,
 } from "./read-model.ts";
 import type { ReadModel } from "./read-model.ts";
@@ -82,6 +84,19 @@ const EXPECTED: Record<string, { display_status: string; is_high_priority: numbe
   t3: { display_status: "active", is_high_priority: 1 },
 };
 
+test("isReservedObjectName flags every reserved prefix, case-insensitively, and clears domain names", () => {
+  // Single source of truth for the prefixes the datasource surface hides (gateway.schema()) and the
+  // provenance recorder skips (datasource.ts). SQLite folds ASCII object names, so a cased reserved
+  // name must not slip through.
+  assert.deepEqual([...RESERVED_OBJECT_PREFIXES], ["_urban_", "_nano_", "sqlite_"]);
+  for (const name of ["_urban_x", "_URBAN_x", "_nano_y", "sqlite_master", "SQLITE_stat1"]) {
+    assert.ok(isReservedObjectName(name), `expected "${name}" reserved`);
+  }
+  for (const name of ["orders", "plans__tracking", "urban_things", "nano", "sqlitely"]) {
+    assert.ok(!isReservedObjectName(name), `expected "${name}" NOT reserved`);
+  }
+});
+
 test("(i) the read model with CASE + EXISTS compiles to a SQLite VIEW returning the expected values", async () => {
   await withDb((db) => {
     seedFixtures(db);
@@ -219,6 +234,60 @@ test("both backends agree on NULL inputs: SQL NULL propagation is COALESCE'd to
   });
 });
 
+test("compileToFn resolves col/pcol identifiers case-insensitively (SQLite identifier folding)", () => {
+  // SQLite folds identifier case even for quoted identifiers, so `col("Status")` in the VIEW binds to a
+  // column DECLARED `status`. The TS backend must fold too — a case-sensitive `row["Status"]` returns
+  // null and silently diverges from the VIEW on the no-edge fallback and on keyField correlation.
+  assert.equal(compileToFn(col("Status"))({ status: "abandoned" }), "abandoned"); // folds to declared column
+  assert.equal(compileToFn(col("status"))({ status: "abandoned" }), "abandoned"); // exact match still works
+  assert.equal(compileToFn(col("Missing"))({ status: "x" }), null); // a truly-absent column → null (not a fold)
+  // pcol inside EXISTS folds too, so keyField correlation matches the VIEW's join.
+  const corr = compileToFn(exists("p", eq(pcol("Process_Instance_Key"), col("Key"))));
+  assert.equal(corr({ key: "pi-1" }, { p: [{ process_instance_key: "pi-1" }] }), true);
+  assert.equal(corr({ key: "pi-1" }, { p: [{ process_instance_key: "pi-2" }] }), false);
+});
+
+test("mixed-case col/pcol identifiers: the VIEW and TS backends agree (VIEW/TS parity on the no-edge fallback)", async () => {
+  // End-to-end guard for the case-fold fix: author a model with mixed-case identifiers over lowercase
+  // columns and confirm the SQLite VIEW and the TS backend derive the SAME value — including the
+  // parity-critical no-edge fallback that passes the stored status through.
+  const mixed: ReadModel = defineReadModel({
+    name: "mixed_case_display",
+    baseTable: "widgets",
+    derive: {
+      effective: caseWhen(
+        [
+          when(
+            exists("urban_open_user_tasks", eq(pcol("Process_Instance_Key"), col("Process_Key"))),
+            lit("awaiting_operator"),
+          ),
+        ],
+        col("Status"), // no-edge fallback → the stored status, read via a mixed-case identifier
+      ),
+    },
+  });
+  await withDb((db) => {
+    db.exec(`CREATE TABLE widgets (id TEXT, process_key TEXT, status TEXT);`);
+    db.exec(`CREATE TABLE urban_open_user_tasks (process_instance_key TEXT);`);
+    db.exec(mixed.viewDdl());
+    db.run(`INSERT INTO widgets VALUES (?, ?, ?)`, ["w1", "pi-1", "dispatched"]); // no open task → fallback
+    db.run(`INSERT INTO widgets VALUES (?, ?, ?)`, ["w2", "pi-2", "dispatched"]);
+    db.run(`INSERT INTO urban_open_user_tasks VALUES (?)`, ["pi-2"]); // w2 waiting on a human
+    // SQL backend: the VIEW resolves the mixed-case identifiers against the lowercase columns.
+    const sqlRows = db
+      .all<{ id: string; effective: string }>(`SELECT id, effective FROM mixed_case_display ORDER BY id`)
+      .map((r) => ({ ...r }));
+    assert.deepEqual(sqlRows, [
+      { id: "w1", effective: "dispatched" }, // no-edge fallback → stored status (the parity-critical path)
+      { id: "w2", effective: "awaiting_operator" },
+    ]);
+    // TS backend: base/projection rows arrive keyed as SQLite stored them (lowercase).
+    const projections = { urban_open_user_tasks: [{ process_instance_key: "pi-2" }] };
+    assert.equal(mixed.evaluate({ id: "w1", process_key: "pi-1", status: "dispatched" }, projections).effective, "dispatched");
+    assert.equal(mixed.evaluate({ id: "w2", process_key: "pi-2", status: "dispatched" }, projections).effective, "awaiting_operator");
+  });
+});
+
 test("EXISTS references a projection by name; the projection registry resolves the physical table", () => {
   const reg = new ProjectionRegistry();
   reg.register({ name: "urban_instance_state", sqlTable: "_urban_instance_state" });

package/src/runtime/core/read-model.ts

@@ -261,14 +261,37 @@ function resolveBaseAlias(alias: string | undefined): string {
   return assertSqlIdentifier("base alias", alias ?? DEFAULT_BASE_ALIAS);
 }
 
-/** A conservative SQL identifier guard — we interpolate names directly into DDL/SQL. */
-const SQL_IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** A conservative SQL identifier guard — we interpolate names directly into DDL/SQL. This is the
+ *  single source of truth for "is this a legal identifier"; the manifest validator imports it (rather
+ *  than re-declaring the regex) so a name accepted at author time is accepted at VIEW provisioning too
+ *  (No Drift Surfaces — a divergence would let a manifest validate but fail at boot). */
+export const SQL_IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** True iff `name` is a legal SQL identifier per {@link SQL_IDENT}. The boolean twin of
+ *  {@link assertSqlIdentifier}, for callers (e.g. the manifest validator) that collect issues rather
+ *  than throw. */
+export function isSqlIdentifier(name: string): boolean {
+  return SQL_IDENT.test(name);
+}
 export function assertSqlIdentifier(kind: string, name: string): string {
   if (!SQL_IDENT.test(name)) {
     throw new Error(`invalid ${kind} "${name}": must match ${SQL_IDENT.source}`);
   }
   return name;
 }
+/** Object-name prefixes reserved for engine/runtime internals. Tables and views whose names begin
+ *  with one of these are Nano bookkeeping (`_urban_*` / `_nano_*`) or SQLite internals (`sqlite_*`):
+ *  the provenance recorder skips them (`modules/datasource.ts`) and the datasource `schema()` surface
+ *  filters them out (`modules/gateway.ts`), so they are invisible to `/app/data`, DB Manager, and forms.
+ *  This is the single source of truth for that prefix set (No Drift Surfaces — a manifest that provisions
+ *  a `_urban_*` VIEW would otherwise validate yet be unreadable by the documented pages surface). */
+export const RESERVED_OBJECT_PREFIXES = ["_urban_", "_nano_", "sqlite_"] as const;
+/** True iff `name` begins with a {@link RESERVED_OBJECT_PREFIXES} prefix. Case-insensitive, matching
+ *  SQLite's ASCII identifier folding (a `_URBAN_x` table resolves to the same reserved object as
+ *  `_urban_x`), so a reserved name cannot slip through by casing. */
+export function isReservedObjectName(name: string): boolean {
+  const folded = name.toLowerCase();
+  return RESERVED_OBJECT_PREFIXES.some((p) => folded.startsWith(p));
+}
 function quoteIdent(name: string): string {
   return `"${name.replace(/"/g, '""')}"`;
 }
@@ -491,10 +514,10 @@ export function compileToFn(expr: Expr): DerivationFn {
       case "lit":
         return node.value;
       case "col":
-        return baseRow[node.name] ?? null;
+        return lookupColumn(baseRow, node.name);
       case "pcol":
         if (!projRow) throw new Error(`pcol("${node.name}") evaluated outside an EXISTS projection context`);
-        return projRow[node.name] ?? null;
+        return lookupColumn(projRow, node.name);
       case "compare":
         return compareValues(
           node.op,
@@ -524,6 +547,22 @@ export function compileToFn(expr: Expr): DerivationFn {
   return (baseRow, projections = {}) => evalNode(expr, baseRow, projections);
 }
 
+/** Resolve a column value the way SQLite resolves an identifier: an exact-key match first, then a
+ *  case-insensitive fallback. SQLite folds ASCII identifier case even for quoted identifiers, so the
+ *  VIEW's `col("Status")` binds to a table declared with column `status`; a plain case-sensitive JS
+ *  `row["Status"]` would miss it and return null, breaking VIEW/TS parity on the no-edge fallback and on
+ *  `keyField` correlation. Fold here so both backends read the same column. (A table cannot declare two
+ *  columns differing only in case, so the fallback is unambiguous.) Returns `null` for a missing column,
+ *  preserving the previous `?? null` contract. */
+export function lookupColumn(row: Record<string, unknown>, name: string): unknown {
+  if (Object.hasOwn(row, name)) return row[name] ?? null;
+  const folded = name.toLowerCase();
+  for (const key of Object.keys(row)) {
+    if (key.toLowerCase() === folded) return row[key] ?? null;
+  }
+  return null;
+}
+
 // ───────────────────────────────────────── defineReadModel ───────────────────────────────────────
 
 /** The declarative read-model input passed to {@link defineReadModel}. */