feat(spec,metadata-protocol): a page hit kind on GET /api/v1/search — command palette indexes published pages#14249

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
os-support-ai merged 6 commits into from
Sep 1, 2026
Merged

feat(spec,metadata-protocol): a page hit kind on GET /api/v1/search — command palette indexes published pages #14249

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
b79e460
wip: page hit kind on /api/v1/search — spec schema + searchAll page s…
claude Sep 1, 2026
6202063
test(metadata-protocol,rest): page-sweep coverage + fixture surface; …
claude Sep 1, 2026
5258816
chore: repair system-context census line anchors after protocol.ts in…
claude Sep 1, 2026
0ba04d7
chore: keep tracker ids out of runtime/spec prose (doc-authoring gate…
claude Sep 1, 2026
c720566
Merge remote-tracking branch 'origin/main' into claude/issue-13216-se…
claude Sep 1, 2026
88eee83
chore: discharge os-regen deferral — system-context census doc regene…
claude Sep 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 50 additions & 0 deletions .changeset/search-published-pages-hit-kind.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
---
"@objectstack/spec": minor
"@objectstack/metadata-protocol": minor
---

feat(spec,metadata-protocol): a page hit kind on `GET /api/v1/search` — the command palette indexes published pages (#13216)

Direction 3 of #13216, the complement the 2026-08-29 maintainer ruling adopted
beside the landed direction 1 (#13372): a custom page created and published at
runtime rendered perfectly and was absent from the ⌘K palette door alone
(#13100 measured it) — `searchAll` swept object RECORDS and nothing else, so
the artifact an agent grew into a running app was reachable by direct URL only.

**The widened body.** `SearchAllResponseSchema` gains a required `pages`
member — an array of the new `SearchAllPageHitSchema`
(`{ kind: 'page', name, title, snippet?, pageType? }`), declared as produced
like its #11924 siblings. Page hits are deliberately a SIBLING array, never
members of `hits`: every `hits` element is a record with an `object`/`id`
address, and an existing consumer iterating it must not receive an element
whose address vocabulary it predates. `kind: 'page'` is the self-describing
discriminant for clients that flatten both arrays into one palette list. The
blank-query short-circuit carries `pages: []`.

**Zero new authorization surface — the swept set IS the served set.** Pages
reach the sweep through `getMetaItems({ type: 'page' })`, the same verb the
REST `GET /meta/page` list door serves, org-scoped through the same
registry-derived predicate every REST meta read door uses
(`organizationIdForMetaRead`, #9454). Published (`state: 'active'`) items
only — drafts surface exclusively under `previewDrafts`, which the sweep
never passes — and whatever the read door withholds (a disabled package's
pages included) the sweep never saw. A page hit therefore surfaces to a
caller exactly what that caller's own meta read door already answers — name,
label, description — never more; opening the hit goes through the existing
page routes/renderer, where the page's own audience gate
(`assignedProfiles`) applies unchanged. Search is not a second read door,
and no `allowOrgOverride` / `allowRuntimeCreate` flag moves.

**Matching and caps.** AND of terms, OR of fields (name, every locale value
of label/description), case-folded — the record sweep's term semantics,
restated for metadata because there is no engine expansion to delegate to.
Page hits cap at `perObject` (the page store is one more scanned container,
not a competitor for `limit`), titles resolve through the shared
`resolveI18nLabel` chain, and the snippet is cut from the description with
the same excerpt geometry as record hits. A SCOPED sweep (`?objects=…`)
answers `pages: []` — it asks for records of those objects. A failed page
read propagates (#8896's rule): a partial scan must not wear a whole one's
answer.

No REST handler change — `GET /api/v1/search` relays the producer's return
bare, exactly as before, and no request parameter is added.
2 changes: 1 addition & 1 deletion content/docs/permissions/system-context.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -112,7 +112,7 @@ that silently does not happen.
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:10914` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11076` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:9772` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1741` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1746` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:9809`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5730` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3599`, `:3609`, `:3636` |
Expand Down
Loading
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
feat(spec,metadata-protocol): a page hit kind on GET /api/v1/search — command palette indexes published pages#14249

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

os-support-ai
merged 6 commits into

from

Sep 1, 2026
 Merged


feat(spec,metadata-protocol): a page hit kind on GET /api/v1/search — command palette indexes published pages
#14249
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


6 commits


Select commit
Hold shift + click to select a range
b79e460

wip: page hit kind on /api/v1/search — spec schema + searchAll page s…


claude Sep 1, 2026
6202063

test(metadata-protocol,rest): page-sweep coverage + fixture surface; …


claude Sep 1, 2026
5258816

chore: repair system-context census line anchors after protocol.ts in…


claude Sep 1, 2026
0ba04d7

chore: keep tracker ids out of runtime/spec prose (doc-authoring gate…


claude Sep 1, 2026
c720566

Merge remote-tracking branch 'origin/main' into claude/issue-13216-se…


claude Sep 1, 2026
88eee83

chore: discharge os-regen deferral — system-context census doc regene…


claude Sep 1, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


50 changes: 50 additions & 0 deletions
.changeset/search-published-pages-hit-kind.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
---
"@objectstack/spec": minor
"@objectstack/metadata-protocol": minor
---

feat(spec,metadata-protocol): a page hit kind on `GET /api/v1/search` — the command palette indexes published pages (#13216)

Direction 3 of #13216, the complement the 2026-08-29 maintainer ruling adopted
beside the landed direction 1 (#13372): a custom page created and published at
runtime rendered perfectly and was absent from the ⌘K palette door alone
(#13100 measured it) — `searchAll` swept object RECORDS and nothing else, so
the artifact an agent grew into a running app was reachable by direct URL only.

**The widened body.** `SearchAllResponseSchema` gains a required `pages`
member — an array of the new `SearchAllPageHitSchema`
(`{ kind: 'page', name, title, snippet?, pageType? }`), declared as produced
like its #11924 siblings. Page hits are deliberately a SIBLING array, never
members of `hits`: every `hits` element is a record with an `object`/`id`
address, and an existing consumer iterating it must not receive an element
whose address vocabulary it predates. `kind: 'page'` is the self-describing
discriminant for clients that flatten both arrays into one palette list. The
blank-query short-circuit carries `pages: []`.

**Zero new authorization surface — the swept set IS the served set.** Pages
reach the sweep through `getMetaItems({ type: 'page' })`, the same verb the
REST `GET /meta/page` list door serves, org-scoped through the same
registry-derived predicate every REST meta read door uses
(`organizationIdForMetaRead`, #9454). Published (`state: 'active'`) items
only — drafts surface exclusively under `previewDrafts`, which the sweep
never passes — and whatever the read door withholds (a disabled package's
pages included) the sweep never saw. A page hit therefore surfaces to a
caller exactly what that caller's own meta read door already answers — name,
label, description — never more; opening the hit goes through the existing
page routes/renderer, where the page's own audience gate
(`assignedProfiles`) applies unchanged. Search is not a second read door,
and no `allowOrgOverride` / `allowRuntimeCreate` flag moves.

**Matching and caps.** AND of terms, OR of fields (name, every locale value
of label/description), case-folded — the record sweep's term semantics,
restated for metadata because there is no engine expansion to delegate to.
Page hits cap at `perObject` (the page store is one more scanned container,
not a competitor for `limit`), titles resolve through the shared
`resolveI18nLabel` chain, and the snippet is cut from the description with
the same excerpt geometry as record hits. A SCOPED sweep (`?objects=…`)
answers `pages: []` — it asks for records of those objects. A failed page
read propagates (#8896's rule): a partial scan must not wear a whole one's
answer.

No REST handler change — `GET /api/v1/search` relays the producer's return
bare, exactly as before, and no request parameter is added.

2 changes: 1 addition & 1 deletion
content/docs/permissions/system-context.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -112,7 +112,7 @@ that silently does not happen.
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:10914` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11076` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:9772` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1741` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1746` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:9809`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5730` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3599`, `:3609`, `:3636` |
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(spec,metadata-protocol): a page hit kind on GET /api/v1/search — command palette indexes published pages#14249

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

os-support-ai
merged 6 commits into

from

Sep 1, 2026
 Merged


feat(spec,metadata-protocol): a page hit kind on GET /api/v1/search — command palette indexes published pages
#14249
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


6 commits


Select commit
Hold shift + click to select a range
b79e460

wip: page hit kind on /api/v1/search — spec schema + searchAll page s…


claude Sep 1, 2026
6202063

test(metadata-protocol,rest): page-sweep coverage + fixture surface; …


claude Sep 1, 2026
5258816

chore: repair system-context census line anchors after protocol.ts in…


claude Sep 1, 2026
0ba04d7

chore: keep tracker ids out of runtime/spec prose (doc-authoring gate…


claude Sep 1, 2026
c720566

Merge remote-tracking branch 'origin/main' into claude/issue-13216-se…


claude Sep 1, 2026
88eee83

chore: discharge os-regen deferral — system-context census doc regene…


claude Sep 1, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


50 changes: 50 additions & 0 deletions
.changeset/search-published-pages-hit-kind.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
---
"@objectstack/spec": minor
"@objectstack/metadata-protocol": minor
---

feat(spec,metadata-protocol): a page hit kind on `GET /api/v1/search` — the command palette indexes published pages (#13216)

Direction 3 of #13216, the complement the 2026-08-29 maintainer ruling adopted
beside the landed direction 1 (#13372): a custom page created and published at
runtime rendered perfectly and was absent from the ⌘K palette door alone
(#13100 measured it) — `searchAll` swept object RECORDS and nothing else, so
the artifact an agent grew into a running app was reachable by direct URL only.

**The widened body.** `SearchAllResponseSchema` gains a required `pages`
member — an array of the new `SearchAllPageHitSchema`
(`{ kind: 'page', name, title, snippet?, pageType? }`), declared as produced
like its #11924 siblings. Page hits are deliberately a SIBLING array, never
members of `hits`: every `hits` element is a record with an `object`/`id`
address, and an existing consumer iterating it must not receive an element
whose address vocabulary it predates. `kind: 'page'` is the self-describing
discriminant for clients that flatten both arrays into one palette list. The
blank-query short-circuit carries `pages: []`.

**Zero new authorization surface — the swept set IS the served set.** Pages
reach the sweep through `getMetaItems({ type: 'page' })`, the same verb the
REST `GET /meta/page` list door serves, org-scoped through the same
registry-derived predicate every REST meta read door uses
(`organizationIdForMetaRead`, #9454). Published (`state: 'active'`) items
only — drafts surface exclusively under `previewDrafts`, which the sweep
never passes — and whatever the read door withholds (a disabled package's
pages included) the sweep never saw. A page hit therefore surfaces to a
caller exactly what that caller's own meta read door already answers — name,
label, description — never more; opening the hit goes through the existing
page routes/renderer, where the page's own audience gate
(`assignedProfiles`) applies unchanged. Search is not a second read door,
and no `allowOrgOverride` / `allowRuntimeCreate` flag moves.

**Matching and caps.** AND of terms, OR of fields (name, every locale value
of label/description), case-folded — the record sweep's term semantics,
restated for metadata because there is no engine expansion to delegate to.
Page hits cap at `perObject` (the page store is one more scanned container,
not a competitor for `limit`), titles resolve through the shared
`resolveI18nLabel` chain, and the snippet is cut from the description with
the same excerpt geometry as record hits. A SCOPED sweep (`?objects=…`)
answers `pages: []` — it asks for records of those objects. A failed page
read propagates (#8896's rule): a partial scan must not wear a whole one's
answer.

No REST handler change — `GET /api/v1/search` relays the producer's return
bare, exactly as before, and no request parameter is added.

2 changes: 1 addition & 1 deletion
content/docs/permissions/system-context.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -112,7 +112,7 @@ that silently does not happen.
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:10914` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11076` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:9772` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1741` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1746` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:9809`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5730` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3599`, `:3609`, `:3636` |
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(spec,metadata-protocol): a page hit kind on GET /api/v1/search — command palette indexes published pages#14249

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

os-support-ai
merged 6 commits into

from

Sep 1, 2026
 Merged


feat(spec,metadata-protocol): a page hit kind on GET /api/v1/search — command palette indexes published pages
#14249
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


6 commits


Select commit
Hold shift + click to select a range
b79e460

wip: page hit kind on /api/v1/search — spec schema + searchAll page s…


claude Sep 1, 2026
6202063

test(metadata-protocol,rest): page-sweep coverage + fixture surface; …


claude Sep 1, 2026
5258816

chore: repair system-context census line anchors after protocol.ts in…


claude Sep 1, 2026
0ba04d7

chore: keep tracker ids out of runtime/spec prose (doc-authoring gate…


claude Sep 1, 2026
c720566

Merge remote-tracking branch 'origin/main' into claude/issue-13216-se…


claude Sep 1, 2026
88eee83

chore: discharge os-regen deferral — system-context census doc regene…


claude Sep 1, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


50 changes: 50 additions & 0 deletions
.changeset/search-published-pages-hit-kind.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
---
"@objectstack/spec": minor
"@objectstack/metadata-protocol": minor
---

feat(spec,metadata-protocol): a page hit kind on `GET /api/v1/search` — the command palette indexes published pages (#13216)

Direction 3 of #13216, the complement the 2026-08-29 maintainer ruling adopted
beside the landed direction 1 (#13372): a custom page created and published at
runtime rendered perfectly and was absent from the ⌘K palette door alone
(#13100 measured it) — `searchAll` swept object RECORDS and nothing else, so
the artifact an agent grew into a running app was reachable by direct URL only.

**The widened body.** `SearchAllResponseSchema` gains a required `pages`
member — an array of the new `SearchAllPageHitSchema`
(`{ kind: 'page', name, title, snippet?, pageType? }`), declared as produced
like its #11924 siblings. Page hits are deliberately a SIBLING array, never
members of `hits`: every `hits` element is a record with an `object`/`id`
address, and an existing consumer iterating it must not receive an element
whose address vocabulary it predates. `kind: 'page'` is the self-describing
discriminant for clients that flatten both arrays into one palette list. The
blank-query short-circuit carries `pages: []`.

**Zero new authorization surface — the swept set IS the served set.** Pages
reach the sweep through `getMetaItems({ type: 'page' })`, the same verb the
REST `GET /meta/page` list door serves, org-scoped through the same
registry-derived predicate every REST meta read door uses
(`organizationIdForMetaRead`, #9454). Published (`state: 'active'`) items
only — drafts surface exclusively under `previewDrafts`, which the sweep
never passes — and whatever the read door withholds (a disabled package's
pages included) the sweep never saw. A page hit therefore surfaces to a
caller exactly what that caller's own meta read door already answers — name,
label, description — never more; opening the hit goes through the existing
page routes/renderer, where the page's own audience gate
(`assignedProfiles`) applies unchanged. Search is not a second read door,
and no `allowOrgOverride` / `allowRuntimeCreate` flag moves.

**Matching and caps.** AND of terms, OR of fields (name, every locale value
of label/description), case-folded — the record sweep's term semantics,
restated for metadata because there is no engine expansion to delegate to.
Page hits cap at `perObject` (the page store is one more scanned container,
not a competitor for `limit`), titles resolve through the shared
`resolveI18nLabel` chain, and the snippet is cut from the description with
the same excerpt geometry as record hits. A SCOPED sweep (`?objects=…`)
answers `pages: []` — it asks for records of those objects. A failed page
read propagates (#8896's rule): a partial scan must not wear a whole one's
answer.

No REST handler change — `GET /api/v1/search` relays the producer's return
bare, exactly as before, and no request parameter is added.

2 changes: 1 addition & 1 deletion
content/docs/permissions/system-context.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -112,7 +112,7 @@ that silently does not happen.
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:10914` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11076` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:9772` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1741` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1746` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:9809`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5730` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3599`, `:3609`, `:3636` |
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
feat(spec,metadata-protocol): a page hit kind on GET /api/v1/search — command palette indexes published pages#14249

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

os-support-ai
merged 6 commits into

from

Sep 1, 2026
 Merged


feat(spec,metadata-protocol): a page hit kind on GET /api/v1/search — command palette indexes published pages
#14249
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


6 commits


Select commit
Hold shift + click to select a range
b79e460

wip: page hit kind on /api/v1/search — spec schema + searchAll page s…


claude Sep 1, 2026
6202063

test(metadata-protocol,rest): page-sweep coverage + fixture surface; …


claude Sep 1, 2026
5258816

chore: repair system-context census line anchors after protocol.ts in…


claude Sep 1, 2026
0ba04d7

chore: keep tracker ids out of runtime/spec prose (doc-authoring gate…


claude Sep 1, 2026
c720566

Merge remote-tracking branch 'origin/main' into claude/issue-13216-se…


claude Sep 1, 2026
88eee83

chore: discharge os-regen deferral — system-context census doc regene…


claude Sep 1, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


50 changes: 50 additions & 0 deletions
.changeset/search-published-pages-hit-kind.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
---
"@objectstack/spec": minor
"@objectstack/metadata-protocol": minor
---

feat(spec,metadata-protocol): a page hit kind on `GET /api/v1/search` — the command palette indexes published pages (#13216)

Direction 3 of #13216, the complement the 2026-08-29 maintainer ruling adopted
beside the landed direction 1 (#13372): a custom page created and published at
runtime rendered perfectly and was absent from the ⌘K palette door alone
(#13100 measured it) — `searchAll` swept object RECORDS and nothing else, so
the artifact an agent grew into a running app was reachable by direct URL only.

**The widened body.** `SearchAllResponseSchema` gains a required `pages`
member — an array of the new `SearchAllPageHitSchema`
(`{ kind: 'page', name, title, snippet?, pageType? }`), declared as produced
like its #11924 siblings. Page hits are deliberately a SIBLING array, never
members of `hits`: every `hits` element is a record with an `object`/`id`
address, and an existing consumer iterating it must not receive an element
whose address vocabulary it predates. `kind: 'page'` is the self-describing
discriminant for clients that flatten both arrays into one palette list. The
blank-query short-circuit carries `pages: []`.

**Zero new authorization surface — the swept set IS the served set.** Pages
reach the sweep through `getMetaItems({ type: 'page' })`, the same verb the
REST `GET /meta/page` list door serves, org-scoped through the same
registry-derived predicate every REST meta read door uses
(`organizationIdForMetaRead`, #9454). Published (`state: 'active'`) items
only — drafts surface exclusively under `previewDrafts`, which the sweep
never passes — and whatever the read door withholds (a disabled package's
pages included) the sweep never saw. A page hit therefore surfaces to a
caller exactly what that caller's own meta read door already answers — name,
label, description — never more; opening the hit goes through the existing
page routes/renderer, where the page's own audience gate
(`assignedProfiles`) applies unchanged. Search is not a second read door,
and no `allowOrgOverride` / `allowRuntimeCreate` flag moves.

**Matching and caps.** AND of terms, OR of fields (name, every locale value
of label/description), case-folded — the record sweep's term semantics,
restated for metadata because there is no engine expansion to delegate to.
Page hits cap at `perObject` (the page store is one more scanned container,
not a competitor for `limit`), titles resolve through the shared
`resolveI18nLabel` chain, and the snippet is cut from the description with
the same excerpt geometry as record hits. A SCOPED sweep (`?objects=…`)
answers `pages: []` — it asks for records of those objects. A failed page
read propagates (#8896's rule): a partial scan must not wear a whole one's
answer.

No REST handler change — `GET /api/v1/search` relays the producer's return
bare, exactly as before, and no request parameter is added.

2 changes: 1 addition & 1 deletion
content/docs/permissions/system-context.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -112,7 +112,7 @@ that silently does not happen.
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:10914` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11076` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:9772` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1741` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1746` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:9809`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5730` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3599`, `:3609`, `:3636` |
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(spec,metadata-protocol): a page hit kind on GET /api/v1/search — command palette indexes published pages#14249

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

os-support-ai
merged 6 commits into

from

Sep 1, 2026
 Merged


feat(spec,metadata-protocol): a page hit kind on GET /api/v1/search — command palette indexes published pages
#14249
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


6 commits


Select commit
Hold shift + click to select a range
b79e460

wip: page hit kind on /api/v1/search — spec schema + searchAll page s…


claude Sep 1, 2026
6202063

test(metadata-protocol,rest): page-sweep coverage + fixture surface; …


claude Sep 1, 2026
5258816

chore: repair system-context census line anchors after protocol.ts in…


claude Sep 1, 2026
0ba04d7

chore: keep tracker ids out of runtime/spec prose (doc-authoring gate…


claude Sep 1, 2026
c720566

Merge remote-tracking branch 'origin/main' into claude/issue-13216-se…


claude Sep 1, 2026
88eee83

chore: discharge os-regen deferral — system-context census doc regene…


claude Sep 1, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


50 changes: 50 additions & 0 deletions
.changeset/search-published-pages-hit-kind.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
---
"@objectstack/spec": minor
"@objectstack/metadata-protocol": minor
---

feat(spec,metadata-protocol): a page hit kind on `GET /api/v1/search` — the command palette indexes published pages (#13216)

Direction 3 of #13216, the complement the 2026-08-29 maintainer ruling adopted
beside the landed direction 1 (#13372): a custom page created and published at
runtime rendered perfectly and was absent from the ⌘K palette door alone
(#13100 measured it) — `searchAll` swept object RECORDS and nothing else, so
the artifact an agent grew into a running app was reachable by direct URL only.

**The widened body.** `SearchAllResponseSchema` gains a required `pages`
member — an array of the new `SearchAllPageHitSchema`
(`{ kind: 'page', name, title, snippet?, pageType? }`), declared as produced
like its #11924 siblings. Page hits are deliberately a SIBLING array, never
members of `hits`: every `hits` element is a record with an `object`/`id`
address, and an existing consumer iterating it must not receive an element
whose address vocabulary it predates. `kind: 'page'` is the self-describing
discriminant for clients that flatten both arrays into one palette list. The
blank-query short-circuit carries `pages: []`.

**Zero new authorization surface — the swept set IS the served set.** Pages
reach the sweep through `getMetaItems({ type: 'page' })`, the same verb the
REST `GET /meta/page` list door serves, org-scoped through the same
registry-derived predicate every REST meta read door uses
(`organizationIdForMetaRead`, #9454). Published (`state: 'active'`) items
only — drafts surface exclusively under `previewDrafts`, which the sweep
never passes — and whatever the read door withholds (a disabled package's
pages included) the sweep never saw. A page hit therefore surfaces to a
caller exactly what that caller's own meta read door already answers — name,
label, description — never more; opening the hit goes through the existing
page routes/renderer, where the page's own audience gate
(`assignedProfiles`) applies unchanged. Search is not a second read door,
and no `allowOrgOverride` / `allowRuntimeCreate` flag moves.

**Matching and caps.** AND of terms, OR of fields (name, every locale value
of label/description), case-folded — the record sweep's term semantics,
restated for metadata because there is no engine expansion to delegate to.
Page hits cap at `perObject` (the page store is one more scanned container,
not a competitor for `limit`), titles resolve through the shared
`resolveI18nLabel` chain, and the snippet is cut from the description with
the same excerpt geometry as record hits. A SCOPED sweep (`?objects=…`)
answers `pages: []` — it asks for records of those objects. A failed page
read propagates (#8896's rule): a partial scan must not wear a whole one's
answer.

No REST handler change — `GET /api/v1/search` relays the producer's return
bare, exactly as before, and no request parameter is added.

2 changes: 1 addition & 1 deletion
content/docs/permissions/system-context.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -112,7 +112,7 @@ that silently does not happen.
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:10914` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11076` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:9772` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1741` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1746` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:9809`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5730` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3599`, `:3609`, `:3636` |
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(spec,metadata-protocol): a page hit kind on GET /api/v1/search — command palette indexes published pages#14249

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

os-support-ai
merged 6 commits into

from

Sep 1, 2026
 Merged


feat(spec,metadata-protocol): a page hit kind on GET /api/v1/search — command palette indexes published pages
#14249
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


6 commits


Select commit
Hold shift + click to select a range
b79e460

wip: page hit kind on /api/v1/search — spec schema + searchAll page s…


claude Sep 1, 2026
6202063

test(metadata-protocol,rest): page-sweep coverage + fixture surface; …


claude Sep 1, 2026
5258816

chore: repair system-context census line anchors after protocol.ts in…


claude Sep 1, 2026
0ba04d7

chore: keep tracker ids out of runtime/spec prose (doc-authoring gate…


claude Sep 1, 2026
c720566

Merge remote-tracking branch 'origin/main' into claude/issue-13216-se…


claude Sep 1, 2026
88eee83

chore: discharge os-regen deferral — system-context census doc regene…


claude Sep 1, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


50 changes: 50 additions & 0 deletions
.changeset/search-published-pages-hit-kind.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
---
"@objectstack/spec": minor
"@objectstack/metadata-protocol": minor
---

feat(spec,metadata-protocol): a page hit kind on `GET /api/v1/search` — the command palette indexes published pages (#13216)

Direction 3 of #13216, the complement the 2026-08-29 maintainer ruling adopted
beside the landed direction 1 (#13372): a custom page created and published at
runtime rendered perfectly and was absent from the ⌘K palette door alone
(#13100 measured it) — `searchAll` swept object RECORDS and nothing else, so
the artifact an agent grew into a running app was reachable by direct URL only.

**The widened body.** `SearchAllResponseSchema` gains a required `pages`
member — an array of the new `SearchAllPageHitSchema`
(`{ kind: 'page', name, title, snippet?, pageType? }`), declared as produced
like its #11924 siblings. Page hits are deliberately a SIBLING array, never
members of `hits`: every `hits` element is a record with an `object`/`id`
address, and an existing consumer iterating it must not receive an element
whose address vocabulary it predates. `kind: 'page'` is the self-describing
discriminant for clients that flatten both arrays into one palette list. The
blank-query short-circuit carries `pages: []`.

**Zero new authorization surface — the swept set IS the served set.** Pages
reach the sweep through `getMetaItems({ type: 'page' })`, the same verb the
REST `GET /meta/page` list door serves, org-scoped through the same
registry-derived predicate every REST meta read door uses
(`organizationIdForMetaRead`, #9454). Published (`state: 'active'`) items
only — drafts surface exclusively under `previewDrafts`, which the sweep
never passes — and whatever the read door withholds (a disabled package's
pages included) the sweep never saw. A page hit therefore surfaces to a
caller exactly what that caller's own meta read door already answers — name,
label, description — never more; opening the hit goes through the existing
page routes/renderer, where the page's own audience gate
(`assignedProfiles`) applies unchanged. Search is not a second read door,
and no `allowOrgOverride` / `allowRuntimeCreate` flag moves.

**Matching and caps.** AND of terms, OR of fields (name, every locale value
of label/description), case-folded — the record sweep's term semantics,
restated for metadata because there is no engine expansion to delegate to.
Page hits cap at `perObject` (the page store is one more scanned container,
not a competitor for `limit`), titles resolve through the shared
`resolveI18nLabel` chain, and the snippet is cut from the description with
the same excerpt geometry as record hits. A SCOPED sweep (`?objects=…`)
answers `pages: []` — it asks for records of those objects. A failed page
read propagates (#8896's rule): a partial scan must not wear a whole one's
answer.

No REST handler change — `GET /api/v1/search` relays the producer's return
bare, exactly as before, and no request parameter is added.

2 changes: 1 addition & 1 deletion
content/docs/permissions/system-context.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -112,7 +112,7 @@ that silently does not happen.
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:10914` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11076` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:9772` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1741` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1746` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:9809`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5730` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3599`, `:3609`, `:3636` |
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
feat(spec,metadata-protocol): a page hit kind on GET /api/v1/search — command palette indexes published pages#14249

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

os-support-ai
merged 6 commits into

from

Sep 1, 2026
 Merged


feat(spec,metadata-protocol): a page hit kind on GET /api/v1/search — command palette indexes published pages
#14249
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


6 commits


Select commit
Hold shift + click to select a range
b79e460

wip: page hit kind on /api/v1/search — spec schema + searchAll page s…


claude Sep 1, 2026
6202063

test(metadata-protocol,rest): page-sweep coverage + fixture surface; …


claude Sep 1, 2026
5258816

chore: repair system-context census line anchors after protocol.ts in…


claude Sep 1, 2026
0ba04d7

chore: keep tracker ids out of runtime/spec prose (doc-authoring gate…


claude Sep 1, 2026
c720566

Merge remote-tracking branch 'origin/main' into claude/issue-13216-se…


claude Sep 1, 2026
88eee83

chore: discharge os-regen deferral — system-context census doc regene…


claude Sep 1, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


50 changes: 50 additions & 0 deletions
.changeset/search-published-pages-hit-kind.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
---
"@objectstack/spec": minor
"@objectstack/metadata-protocol": minor
---

feat(spec,metadata-protocol): a page hit kind on `GET /api/v1/search` — the command palette indexes published pages (#13216)

Direction 3 of #13216, the complement the 2026-08-29 maintainer ruling adopted
beside the landed direction 1 (#13372): a custom page created and published at
runtime rendered perfectly and was absent from the ⌘K palette door alone
(#13100 measured it) — `searchAll` swept object RECORDS and nothing else, so
the artifact an agent grew into a running app was reachable by direct URL only.

**The widened body.** `SearchAllResponseSchema` gains a required `pages`
member — an array of the new `SearchAllPageHitSchema`
(`{ kind: 'page', name, title, snippet?, pageType? }`), declared as produced
like its #11924 siblings. Page hits are deliberately a SIBLING array, never
members of `hits`: every `hits` element is a record with an `object`/`id`
address, and an existing consumer iterating it must not receive an element
whose address vocabulary it predates. `kind: 'page'` is the self-describing
discriminant for clients that flatten both arrays into one palette list. The
blank-query short-circuit carries `pages: []`.

**Zero new authorization surface — the swept set IS the served set.** Pages
reach the sweep through `getMetaItems({ type: 'page' })`, the same verb the
REST `GET /meta/page` list door serves, org-scoped through the same
registry-derived predicate every REST meta read door uses
(`organizationIdForMetaRead`, #9454). Published (`state: 'active'`) items
only — drafts surface exclusively under `previewDrafts`, which the sweep
never passes — and whatever the read door withholds (a disabled package's
pages included) the sweep never saw. A page hit therefore surfaces to a
caller exactly what that caller's own meta read door already answers — name,
label, description — never more; opening the hit goes through the existing
page routes/renderer, where the page's own audience gate
(`assignedProfiles`) applies unchanged. Search is not a second read door,
and no `allowOrgOverride` / `allowRuntimeCreate` flag moves.

**Matching and caps.** AND of terms, OR of fields (name, every locale value
of label/description), case-folded — the record sweep's term semantics,
restated for metadata because there is no engine expansion to delegate to.
Page hits cap at `perObject` (the page store is one more scanned container,
not a competitor for `limit`), titles resolve through the shared
`resolveI18nLabel` chain, and the snippet is cut from the description with
the same excerpt geometry as record hits. A SCOPED sweep (`?objects=…`)
answers `pages: []` — it asks for records of those objects. A failed page
read propagates (#8896's rule): a partial scan must not wear a whole one's
answer.

No REST handler change — `GET /api/v1/search` relays the producer's return
bare, exactly as before, and no request parameter is added.

2 changes: 1 addition & 1 deletion
content/docs/permissions/system-context.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -112,7 +112,7 @@ that silently does not happen.
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:10914` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11076` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:9772` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1741` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1746` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:9809`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5730` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3599`, `:3609`, `:3636` |
Expand Down
Loading
Loading