[P3] objectui `ActionDef`'s `[key: string]: any` absorbs every retired and misspelled action key — removing a spec key produces no compile error

[os-zhuang]

⚠️ 状态头(2026-08-06 更新——派发者读这里,不要按下文的 staged plan 派单)

• Step 1(构造点清查 + dev-mode 未识别键警告)✅ 已完成:objectui#3032(2026-07-30 合并,@object-ui/core 17.1.0;actionKeys.ts + AST 再派生 pin 测试)
• Step 2(合法键位提升为显式字段)✅ 已完成:objectui#3190(2026-08-02 合并,17.2.0;18 个 spec 键全部提升)
• Step 3(删除索引签名)🟡 已裁决、待上游:维护者 2026-08-06 裁定 visible / disabled 统一收敛为 boolean | string(CEL) | {dialect,source},spec 侧先行(spec: ActionSchema 的 visible / disabled 统一为 boolean | string(CEL) | {dialect,source}（#4075 step 3 前置，维护者 2026-08-06 已裁决） #5970);合并后 objectui 按 spec 派生类型收敛两键、删索引签名、删 DeclaredActionsBar.tsx 的 (action as any).disabled 强转(裁决全文见 2026-08-06 PM 裁决评论,分析见验收评论 5156971051)。
• 本单曾两次被按下文 staged plan 误派 step 1(2026-08-02、2026-08-06,均由 premise 检查拦下)——下文正文是立单时的计划,不再是现状,以本状态头为准。

Blocked-by: #5970

---

Split out of #3856 / objectui#2990, which hit this directly and documented it rather than working around it silently.

The mechanism

ActionDef (packages/core/src/actions/ActionRunner.ts:277, interface at :78) ends with:

 /** Any additional properties */
 [key: string]: any;

at ActionRunner.ts:185. So ActionDef accepts any key of any type. Concretely, in objectui#2990:

• deleting ActionDef.execute produced zero compile errors, even though the field had just been removed from the interface;
• stale metadata still authoring execute: 'markDone' continues to type-check today;
• the same deletion on @object-ui/types' ActionSchema — which has no index signature — correctly produced TS2353 at the authoring site.

That asymmetry is the whole issue: one of the two readers is capable of catching a retired key, the other is structurally incapable.

Because the compiler couldn't help, objectui#2990 had to add a runtime branch to keep the removal audible — executeScript now returns the rename prescription when it finds only the retired key, rather than a bare "No script provided". That branch exists solely to compensate for this index signature. Binding no handler silently is the #2169 "Mark Done does nothing" shape, so the compensation was necessary — but it is compensation.

Not the same as ActionContext's

ActionContext has an index signature too (ActionRunner.ts:53) and it should keep it: it is a runtime data bag whose keys are genuinely open (data, record, pageVariables, user, plus whatever a host passes). ActionDef is the opposite — it is a declared metadata contract that mirrors @objectstack/spec's ActionSchema. An open key set on a contract is what lets a typo (targt, exectue) and a tombstoned key (execute) both sail through to a runner that then silently does nothing.

Why it can't just be deleted

The runner deliberately accepts shapes wider than current spec, and ActionDef already enumerates a lot of them explicitly (actionType "legacy action type field", api as string | ApiConfig, onClick "legacy", navigate?: any). Some callers likely pass keys not declared anywhere. A bare removal would surface as a wall of TS2353 across components / plugin-* / host apps, some legitimate.

Staged narrowing is the realistic path:

1. Inventory what is actually passed — grep the repo's ActionDef construction sites and any action[...] dynamic reads, and add a dev-mode warning on unrecognized keys (the "declared, warned, lintable shim" form AGENTS.md PD Add comprehensive test suite for Zod schema validation #12 asks for, instead of a bare open type).
2. Promote every legitimate key found into an explicit optional field, keeping the legacy ones marked @deprecated.
3. Remove the index signature. At that point tsc catches both typos and retired spec keys, and Security: attachment blob download has no record-level RLS — bytes served by fileId with only a committed-status check (IDOR) #2990's runtime prescription branch can eventually retire with it.

Step 1 is independently useful and non-breaking: it turns an invisible failure into a warning without changing types.

Relation to #3903

#3903 established that the spec contract stops at authored source — stored sys_metadata rows are rehydrated unparsed. This is the same "declared ≠ enforced" pattern on the type channel rather than the parse channel: @object-ui/core is the reader that consumes those unparsed rows (runner(action)), and its type accepts anything they contain. The two issues bound the same gap from opposite ends; fixing #3903 alone would still leave a reader that cannot describe what it accepts.

Refs #3856 (objectui#2990), #3903, #2169, #3855, #3883, AGENTS.md PD #12.

[os-zhuang]

Step 1 landed in objectui#3032 (62311b6) — non-breaking, no type changes, as scoped.

Step 2's worklist, from the inventory:

18 keys the spec owns that ActionDef never declared	visible, locations, icon, variant, order, component, bulkEnabled, requiredPermissions, ai, aria, bodyExtra, bodyShape, mode, objectName, recordIdField, recordIdParam, requiresFeature, shortcut
17 keys ActionDef declares that the spec doesn't own	actionType, api, chain, chainMode, close, condition, confirm, endpoint, modal, navigate, onClick, onFailure, onSuccess, redirect, reload, toast, actionParams

ActionEngine already reads two of the first group through casts — (ra.action as any).visible, (action as any).locations. Those casts exist only because the field is undeclared, so step 2 deletes them as a side effect rather than as separate cleanup.

Two corrections to this issue's framing, both found by building the inventory:

• execute is not simply gone from the spec. It's a live tombstone — still present in ActionSchema so the parser can reject it by name and hand back the rename prescription (verified by parsing, not by reading). So the warning treats it separately and more loudly than an unknown key: an unknown key is probably a typo, a retired key is metadata that used to work. This also means objectui#2990's runtime branch has a counterpart on the spec side, and the two should retire together.
• to / external / newTab / replace are a real objectui dialect, not undeclared drift — they're the navigation alias's own spelling, read off the action when no nested navigate object is present. Declared rather than left to trip the warning, with a tripwire test that fails if the spec ever adopts one of the names.

Why the lists are data. TS types don't survive to runtime, and keyof ActionDef can't substitute — the index signature widens it to string | number, which is the problem itself. actionKeys.pin.test.ts re-derives each list from its real source (the interface via the AST, the spec via its schema), so the hand-maintained lists can't drift from what they mirror.

One pin is deliberately inverted: the suite asserts the index signature is still there. The day that test fails, step 3 has landed, tsc catches unknown keys itself, and this warning plus executeScript's rename branch retire together — which makes the pin the issue's own completion check.

Steps 2 and 3 remain; step 2 is non-breaking and independently landable.

---

Generated by Claude Code

[os-zhuang]

认领:PM 循环第 4 轮(补编,代码落地仓库:objectui)
分支:claude/issue-4075-actiondef-key-inventory(objectui 仓库)
Worktree:objectui-issue-4075
分诊决定(PM 自决):本次只做 issue 分阶段路线的第 1 步(构造点/动态读盘点 + 未识别键 dev 警告 shim,非破坏、独立有用);盘点结果回帖本 issue,作为第 2/3 步(显式化合法键 → 删除索引签名)的输入。PR 不关闭本 issue。

---

Generated by Claude Code

[os-zhuang]

分诊更正 + 第 2 步认领:上一条认领评论(第 1 步)作废——核实第 1 步已由 objectui#3032 于 2026-07-30 完整落地(actionKeys.ts 盘点五组键集 + warnOnUnknownActionKeys dev shim + 12 条钉子测试全绿 + 本 issue 的盘点评论 5130984472),派发前未读既有评论是 PM 的分诊失误,已记入判据(读正文必须连评论一起读)。

现按分阶段路线转派第 2 步:
分支:claude/issue-4075-actiondef-step2-explicit-keys(objectui 仓库)
范围:依据第 1 步盘点,把 18 个 spec-owned 键提升为 ActionDef 显式可选字段;删除 ActionEngine 里 (ra.action as any).visible / (action as any).locations 类强转;objectui 方言键标 @deprecated。非破坏(索引签名保留至第 3 步);「索引签名仍在」的反向钉子须保持绿。PR 用 Refs 不关闭本 issue。

---

Generated by Claude Code

[os-zhuang]

PM 验收(第 2 步):ACCEPT → objectui#3190(已转正并启用 merge-when-ready,CI 全绿自动入队;本 issue 保持开放待第 3 步)。

18 个 spec-owned 键已显式化,类型全部从 spec 派生(SpecActionInput['…'],不可漂移);ActionEngine 的 as any 9→3(剩余 3 处属 ActionContext 开放数据袋,按 issue 判定正确保留);类型级测试用编译器 API + 「同一批坏赋值对纯索引签名接口必须全过」的判别力对照,revert-proof 实测。两处派发偏离经复核采纳:(a) navigation 别名四键不标弃用(第 1 步盘点已判定其合法,派发指令有误);(b) changeset 记 minor(墓碑键 shortcut/bulkEnabled 从可编译变编译错误,按版本政策属破坏)。

第 3 步(删除索引签名)的两项前置输入,记录在案:

1. visible 的 boolean 臂是 objectui 超出 spec 的容忍(有既有测试钉住)——第 3 步需决定 spec 采纳 boolean 或 objectui 放弃;
2. disabled 声明为 string | boolean 而 spec 是 boolean | {dialect,source}——信封形未声明导致 DeclaredActionsBar.tsx 仍有 (action as any).disabled 强转,同类缺陷落在重叠键上,第 3 步应一并收敛。

---

Generated by Claude Code