@praxisui/dynamic-form 10.0.0-rc.4 → 10.0.0-rc.41

package/docs/evidence/p1-authoring-20261022/validation.md

@@ -0,0 +1,134 @@
+# P1 form authoring — issues #631, #632 and #633
+
+Classification: public behavior change with cross-library consumers. Canonical owners are Dynamic Form (rules bridge, form client/context and hydration) and Metadata Editor (cascade authoring). No exported type, endpoint, workspace configuration or dependency change.
+
+## Scope and compatibility
+
+- Preserve wizard JSON Logic and both property branches through Apply/Save/reopen. Invalid graphs remain available for repair and cannot silently become unconditional rules.
+- Preserve non-identity cascade filter maps and extraction paths. Table rows own the current edit draft; suggestions fill missing mappings.
+- Give each mounted form its own mutable CRUD client and editor context. This is a breaking beta DI correction; ancestor GenericCrudService replacements must migrate to supported component inputs or component-level test overrides. Shared HTTP infrastructure remains inherited.
+- Make the Quickstart dependency demo a local relationship explorer. Selectors query real resources individually; fields are omitted from domain payloads. Its new document identities avoid inheriting old schema-backed connections.
+- Open field customization from the current canonical materialization, rather than stale selection/render snapshots.
+
+Existing contracts cover these behaviors: already supported but incorrectly materialized. No parallel contract or new authoring vocabulary was introduced.
+
+## Review and gate resolution
+
+The implementation was isolated on main 8da9401a8; unrelated dirty checkout changes and unrelated documentation hunks were excluded. Reviewers different from the authors inspected conversion/diagnostics, cascade editing, DI ownership, demo and both remaining gates.
+
+The old label test conflated a selected snapshot with the current materialization. Regression tests now preserve the Cargo expectation while giving the canonical document/presentation that label, and making selection/cache explicitly obsolete.
+
+The earlier host-test compilation failure involved a nullable assertion in an unrelated dirty test. That test is absent from this main baseline; the demo target is compiled and executed without importing the unrelated changes or altering TypeScript configuration.
+
+Additional review covered deleting the last invalid rule, repairing through the properties panel, diagnostics for conditions outside the graph subset and loading rules without formRulesState. Valid runtime-only conditions must remain intact; invalid conditions must remain blocked. JSON Logic var:'' is a valid root-data reference, not an invalid field path.
+
+## Validation
+
+All selected gates passed on the isolated source tree:
+
+| Gate | Result |
+| --- | --- |
+| Rule converters, configuration editor, diagnostics and isolation | 114 passed |
+| Dynamic Form main/config/editorial/presentation/manifest/hydration/protocol | 334 passed |
+| Cascade service and tab | 17 passed |
+| CRUD dialog host consumer | 50 passed |
+| Additional DI consumers: entity selection, schema recovery, layout tabs, presentation preset and widget editor | 77 passed |
+| Dependency demo host target | 1 passed |
+| Official build helper: Metadata Editor, Dynamic Form, CRUD + dependency closure | Passed |
+| Final Dynamic Form and CRUD builds after gate repairs | Passed |
+| Published documentation assets | Passed, 5 packages |
+| MatSelect content model and diff whitespace | Passed |
+
+The isolated dependency tree was installed using npm ci. No broad full-test-suite
+or release certification is claimed. Counts represent separate lanes, not a
+claim about unique test coverage.
+
+Exact focal spec includes and commands are reproducible from the changed spec
+paths; the main lane also includes first/external hydration, authoring protocol
+and the authoring manifest. Builds use development configuration. Artifact logs
+are retained in the workspace under artifacts/form-p1-fixes-20261022/clean-*.log.
+
+## Final local browser smoke
+
+The isolated checkout was served frozen on official UI4003, with its proxy
+explicitly directed to unavailable local API8088. This smoke exercised the local
+editor only and did not attempt option loading or domain submission.
+
+Through the visible JSON tab of dependency-fields-demo, a malformed condition
+(`{"===": []}`) produced an invalid-condition diagnostic and disabled Apply and
+Save. Correcting the document by removing rule/state through the same JSON tab
+re-enabled both buttons. Drafts were cancelled and tabs closed; nothing was
+saved to the host or remote configuration.
+
+![Invalid condition blocks Apply and Save](final-invalid-blocked.png)
+
+![Corrected document re-enables Apply and Save](final-recovered-enabled.png)
+
+The native confirmation for the visual Remove button could not be accepted by
+the browser-control adapter because its focus command timed out. That attempt
+was abandoned and its tab closed. Visual deletion via that button is not claimed
+as passed; the component regression covers deletion and reopen. The rule list
+also retained a stale row after JSON replacement while canonical diagnostics
+were empty: the remaining UI coherence work belongs to #635. The screenshots
+record this limit rather than hiding it.
+
+ Tests are unit/component tests using ChromeHeadless, without a database. Dependency builds use the official build-libs helper and its dependency closure. No release workflow, deployment or domain mutation is performed.
+
+## Earlier visual audit evidence
+
+The analyst journeys were repeated in Chrome on the previous shared source snapshot, using official UI4003/API8088 and assigned remote Neon branches with runtime identities/TLS. Those screenshots are historical visual evidence, not proof of this isolated revision. Current revision validation is listed separately above.
+
+- #631: wizard Ativo=true/false controlled Foto visibility and required state; persisted expression and both effects survived reload.
+- #632: Cargo/Departamento non-identity mapping survived explicit Edit, Save, Apply and reload.
+- #633: RH, Base/Equipe/Membro and Ameaça/Missão/Incidente/Indenização chains completed with real filtered option requests; parent replacement/clear emptied descendants; no-result search and sibling-tab independence were checked.
+- CRUD native Add dialog loaded its command schema and was closed without submission.
+
+Limits retained: Foto originally arrived formHidden and required temporary exposure in the visible JSON editor. After reload the target catalog again omitted it, a remaining #635 issue. Structural dotted mapping proof does not certify backend acceptance of that filter. No narrow-screen, screen-reader, adverse-latency, remote ETag/concurrency or latest-release certification is claimed.
+
+Detailed original audit artifacts are retained in the workspace artifacts/form-p1-fixes-20261022 directory and linked from the issue discussions. No credentials/network headers are published.
+
+## Derived artifacts and skills
+
+README/JSON API owner documentation explains DI migration and the explorer; Metadata Editor README explains lossless cascade editing. No public-api, AI operation/path, manifest shape, HTTP corpus or landing-page contract changed, so no parallel derived contract was created. Authoring manifest tests and published documentation asset checks cover the existing surfaces.
+
+Canonical cascade and runtime DI skill updates were previously integrated through praxis-codex-skills#826 and #827 and selectively synchronized. Existing form roundtrip guidance remains adequate: formRulesState is derived, canonical rules are preserved, and runtime discovery does not own persisted semantics. The additional gate repairs enforce that existing guidance.
+
+## Final review before integration — 2026-10-23
+
+A new independent review of cad84dd00 found and corrected three cases before
+integration:
+
+- A missing or targetless rule root was silently dropped, so the new empty-rule
+  branch could delete the last accepted rules. Projection now rejects every
+  referenced invalid root, including a mixed valid/invalid graph. The editor
+  keeps the accepted document and invalid draft and blocks saving; an explicit
+  rootNodes=[] still supports intentional deletion.
+- Blocking diagnostics used a built-in-only JSON Logic instance and rejected a
+  valid host operator. Editor diagnostics and command validation now share the
+  injected runtime service. A real registered operator is tested through runtime
+  evaluation and editor Save/reopen; unknown operators and invalid arity fail.
+- Removing a cascade dependency retained its extraction override record. The
+  save path now removes both mapping and extraction override for removed
+  dependencies; save/reopen/re-add and last-dependency/default cases are covered.
+
+An additional consumer inventory found four test fixtures still providing the
+CRUD mock in the ancestor injector. They now use the documented component-level
+replacement. The entity-selection fixture also supplies the current HttpResponse
+read API while preserving request, error and cancellation assertions. The widget
+editor fixture does not mount Dynamic Form and was intentionally left unchanged.
+
+Before/after evidence: missing-root regressions failed before the fix; the host
+operator regression failed before registry propagation; the extra DI lane had
+19 failures before fixture updates and finished 77/77. Final focused rules lane
+114/114 and cascades 17/17 passed. The 334-test form lane, 50-test CRUD lane and demo lane were also rerun after
+the production repairs and passed. All three owner/consumer builds were rerun after production repairs.
+No database or remote release workflow was required for these review repairs.
+
+The earlier native-dialog/browser and #635 limitations remain unchanged. They
+are not presented as newly validated by these unit/component regressions.
+
+The two narrowly scoped guidance additions were independently reviewed and
+integrated through praxis-codex-skills#829 (merge fb0fb5c). Both affected skills
+were selectively synchronized and audited; the other 787 installed skill files
+remained byte-identical and seven unrelated drifts were preserved. No new skill
+or public contract was introduced.

package/docs/governed-page-widget-adapter.md

@@ -0,0 +1,58 @@
+# Dynamic Form em páginas governadas
+
+O adapter do owner mantém `definition.inputs.config` como a única fonte de configuração do filho.
+A página guarda autoria; o documento nativo é reconstruído a partir desses inputs. A projeção de
+execução é transitória e nunca deve ser gravada de volta no documento da página.
+
+O perfil inicial vem do contrato P0 `page-publication-p0` de `praxis-config-starter` (PR #506).
+Core valida estrutura, referências, limites e exige validators dos owners. Este adapter valida o
+perfil nativo local; não autoriza uma fonte, registra uma seed ou substitui a admissão no servidor.
+
+`decodeDynamicFormPageInputs` reconstrói `praxis.dynamic-form.editor` v1:
+config, bindings presentes (`mode`, `emptyState`, `presentationModeGlobal`) e contexto presente
+(`backConfig`, `presentation`, `schemaPrefs`). Schema prefs só existe se algum dos três inputs
+`notifyIfOutdated`, `snoozeMs`, `autoOpenSettingsOnOutdated` estiver presente. Ausência, `false`,
+zero, objeto vazio admitido e `null` são preservados. Null em objetos mesclados de config é negado;
+null dentro de arrays atômicos permanece autoria. `layoutScope` não cabe neste perfil.
+
+Os cinco modos nativos são `create`, `edit`, `view`, `presentation` e `dossier`. O editor visual
+continua preferindo os três modos de operação com `presentationModeGlobal` separado. Abrir um
+documento nativo dos demais modos não deve convertê-lo. Filter Form mantém somente seus três modos.
+
+`encodeDynamicFormPageInputs` é a projeção inversa sem defaults. Campos fora do perfil,
+blocos vazios sem representação nos inputs, identidade/storage e dados de execução recebem
+diagnóstico. O adapter não filtra silenciosamente autoria incompatível.
+
+`projectDynamicFormPageEditorChanges(authoredInputs, editorBaseline, editorValue)` aplica apenas
+deltas explícitos sobre a autoria original usando o reconciliador nativo do owner. Capture o
+baseline após a normalização/montagem do editor e preserve-o durante aquela sessão. Alterar
+bindings ou contexto do mesmo widget retorna `seed.replacement-required`; a página precisa
+substituir o widget com nova key e nova fonte admitida. A API de projeção altera somente o draft
+que o chamador recebe; ela não salva preferências nem persiste a página.
+
+`materializeDynamicFormPageRuntimeInputs(inputs, pageId, widgetKey)` usa o helper canônico Core para
+identidades `page:<pageId>:widget:<widgetKey>`, projeta `configPersistenceStrategy: 'volatile'`
+e desabilita customização/copiloto independentes no filho. Submit e dados continuam nos contratos
+de domínio existentes. Não existe input runtime `authoringDocument`.
+
+A estratégia `volatile` impede leitura, gravação e limpeza de preferências próprias e conexão
+persistida. O Form preserva identidade operacional para montar o formulário, mas as trilhas de
+config/bindings/contexto/schema preferences ficam sem I/O de storage.
+Defaults visuais/materializações transitórias permanecem internos ao runtime e ao editor.
+
+Limites: JSON lossless, 256 KiB UTF-8 e profundidade 64 pelo helper Core compartilhado; o documento
+integral da página também tem o mesmo orçamento. Não há host publicado, endpoint de publicação,
+fonte admitida, banco ou release novos neste incremento. A integração Page Builder/host governado
+é trabalho posterior; os wrappers comuns continuam atendendo os fluxos não governados existentes.
+
+`volatile` também exclui overlays pessoais de configuração global nos defaults/estado de autoria
+que o owner consome. A instância compartilhada `GlobalConfigService` pode ler sua chave global;
+isso não é prova de zero leitura na aplicação. Tenant, cache, locale e CSP continuam infraestrutura
+do host. O gate comprova ausência de I/O nas chaves do filho e ausência de influência da autoria
+pessoal sobre a configuração publicada. Em Table, `TableDefaultsProvider.getDefaults(id,
+{ includeGlobal: false })` preserva defaults nativos sem duplicá-los; mudanças globais e reset
+seguem a mesma política, inclusive o fallback de timezone usado em regras JSON Logic.
+
+Respostas e filas de preferências capturam a geração, a identidade e a estratégia do filho. Trocar identidade, documento ou estratégia (inclusive A → volatile → A), ou destruir a instância, invalida a continuação antiga antes do próximo I/O ou da materialização. Uma requisição já enviada não é cancelada retroativamente. Respostas tardias de erro também passam pelo mesmo fence.
+
+O fence segue a chave do recurso: conexão, inputs e schema preferences usam identidade do owner e geração do host; apresentação acrescenta a chave `form-pres:<id>:<mode>`. Hidratar mode/path das próprias preferências iniciais não troca o owner. Eventos de inputs do host invalidam a geração e iniciam uma resolução atual. Schema, config e escritas também capturam os bindings de runtime.

package/docs/hot-metadata-updates.md

@@ -95,6 +95,22 @@ Regra operacional:
 - se o loader da coluna for localizado, apenas ele e atualizado;
 - se o loader nao puder ser localizado, o runtime usa fallback seguro de rebuild do form.
 
+## Saved configuration after request schema removal
+
+When reconciling saved configuration with the current request schema, Core retains
+removed schema-backed fields for authored layout continuity, but marks them hidden,
+disabled and `submitPolicy: "omit"`. A required orphan with a null value therefore
+does not invalidate the group, and a value still returned by the read projection
+cannot reenter the request payload through `getRawValue()`.
+
+A field whose `source` is absent is schema-backed for this reconciliation. Explicit
+`source: "local"` fields preserve existing local/transient policies and may opt into
+submission with `submitPolicy: "include"`. Hidden fields still present in the request
+schema remain submit-eligible; do not turn all hidden controls into omitted fields.
+If the server publishes a retained field again, current server validation, visibility,
+enabled state and submit semantics replace the orphan state. No host payload strip,
+new flag or layout deletion is needed.
+
 ## Melhorias no DynamicFieldLoader
 
 O guard de rerender do loader passou a incluir no snapshot: