@object-ui/app-shell 11.3.0 → 11.5.0

package/dist/views/studio-design/metadataError.d.ts

@@ -0,0 +1,23 @@
+import type { MetadataValidationIssue } from '@object-ui/data-objectstack';
+/** Pull structured validation issues off a caught error (empty if none). */
+export declare function extractIssues(e: unknown): MetadataValidationIssue[];
+/**
+ * Format a caught save/publish error for a banner/toast. When the error carries
+ * spec-validation issues, list them (one field per line) so the user sees the
+ * offending fields; otherwise fall back to the plain message. Rendered with
+ * `whitespace-pre-line` so the lines show as a list.
+ */
+export declare function formatMetadataError(e: unknown): string;
+/** A single failed draft from a publish response's `data.failed[]`. */
+export interface PublishFailure {
+    type: string;
+    name: string;
+    error: string;
+    issues?: MetadataValidationIssue[];
+}
+/**
+ * Format the `failed[]` from a partial publish (the server returns 200 with the
+ * drafts that DIDN'T go live). Each failed draft gets a heading and, when the
+ * failure was a validation error, its field-anchored issues indented below.
+ */
+export declare function formatPublishFailures(failed: PublishFailure[]): string;

package/dist/views/studio-design/metadataError.js

@@ -0,0 +1,44 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// Turn a metadata save/publish failure into a FIELD-ANCHORED message. The
+// framework validates a draft against its spec and returns structured issues
+// (`error.details.issues: [{ path, message }]`, surfaced on `MetadataError.issues`
+// by the client); a publish carries per-draft failures in `data.failed[]`. These
+// helpers render "which field, and why" instead of a single opaque banner line —
+// the point of surfacing validation at the save/publish moment.
+/** Pull structured validation issues off a caught error (empty if none). */
+export function extractIssues(e) {
+    const issues = e?.issues;
+    return Array.isArray(issues) ? issues : [];
+}
+/** One issue → a single field-anchored line: `• fields.amount.type — Required`. */
+function issueLine(i) {
+    return `• ${i.path && i.path.length > 0 ? i.path : '(root)'} — ${i.message}`;
+}
+/**
+ * Format a caught save/publish error for a banner/toast. When the error carries
+ * spec-validation issues, list them (one field per line) so the user sees the
+ * offending fields; otherwise fall back to the plain message. Rendered with
+ * `whitespace-pre-line` so the lines show as a list.
+ */
+export function formatMetadataError(e) {
+    const issues = extractIssues(e);
+    if (issues.length > 0)
+        return issues.map(issueLine).join('\n');
+    const err = e;
+    return err?.message ?? String(e);
+}
+/**
+ * Format the `failed[]` from a partial publish (the server returns 200 with the
+ * drafts that DIDN'T go live). Each failed draft gets a heading and, when the
+ * failure was a validation error, its field-anchored issues indented below.
+ */
+export function formatPublishFailures(failed) {
+    return failed
+        .map((f) => {
+        const head = `${f.type}/${f.name}: ${f.error}`;
+        const issues = Array.isArray(f.issues) ? f.issues : [];
+        return [head, ...issues.map((i) => `  ${issueLine(i)}`)].join('\n');
+    })
+        .join('\n');
+}

package/dist/views/studio-design/packageSurfaces.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Load the rail entries for one metadata type inside a Studio package pillar:
+ * the PUBLISHED items unioned with the pending DRAFT items, deduped by name.
+ *
+ * Why the union: `client.list(type, { packageId })` only returns
+ * published/active metadata. A freshly-authored item that hasn't been published
+ * yet (or a whole fresh writable-base package whose items are all still drafts)
+ * would therefore render an empty rail even though the author just created it —
+ * and the "N pending changes" counter would show the draft exists while the rail
+ * itself hid it. Merging `client.listDrafts({ packageId, type })` keeps the item
+ * designable between authoring and its first publish.
+ *
+ * This is the canonical form of the merge the Data / Interfaces / Access pillars
+ * already do inline; extracting it (a) fixes the Automations pillar, which was
+ * the sole rail that listed only published items and hid draft-only flows, and
+ * (b) makes the behaviour unit-testable without rendering a heavy pillar tree.
+ *
+ * Draft headers carry no label (they are light rows — no body), so a draft-only
+ * item shows its machine name until the draft body loads on selection, matching
+ * the sibling pillars.
+ */
+/** Minimal structural view of the metadata client this helper needs. */
+export interface PackageSurfaceClient {
+    list(type: string, options?: {
+        packageId?: string;
+    }): Promise<unknown>;
+    listDrafts(options?: {
+        packageId?: string;
+        type?: string;
+    }): Promise<Array<{
+        name?: string | null;
+    }>>;
+}
+/** One rail entry — mirrors the `Surface` shape used by the pillars. */
+export interface PackageSurface {
+    type: string;
+    name: string;
+    label: string;
+}
+/**
+ * Fetch published + pending-draft items of `type` for `packageId` and merge them
+ * into rail entries. Published rows win on name collision (their real label is
+ * kept); draft-only names are appended with the machine name as the label.
+ *
+ * `listDrafts` failures are tolerated (an older server without the drafts
+ * endpoint, or a transient error) — the rail still renders the published set
+ * rather than erroring out, matching the sibling pillars' `.catch(() => [])`.
+ */
+export declare function loadPackageSurfaces(client: PackageSurfaceClient, type: string, packageId: string): Promise<PackageSurface[]>;

package/dist/views/studio-design/packageSurfaces.js

@@ -0,0 +1,34 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+/**
+ * Fetch published + pending-draft items of `type` for `packageId` and merge them
+ * into rail entries. Published rows win on name collision (their real label is
+ * kept); draft-only names are appended with the machine name as the label.
+ *
+ * `listDrafts` failures are tolerated (an older server without the drafts
+ * endpoint, or a transient error) — the rail still renders the published set
+ * rather than erroring out, matching the sibling pillars' `.catch(() => [])`.
+ */
+export async function loadPackageSurfaces(client, type, packageId) {
+    const [published, draftHeaders] = await Promise.all([
+        client.list(type, { packageId }),
+        client
+            .listDrafts({ packageId, type })
+            .catch(() => []),
+    ]);
+    const items = (published || [])
+        .map((o) => ({
+        type,
+        name: String(o.name ?? ''),
+        label: String(o.label ?? o.name ?? ''),
+    }))
+        .filter((o) => o.name);
+    const known = new Set(items.map((o) => o.name));
+    for (const d of draftHeaders || []) {
+        const name = String(d?.name ?? '');
+        if (name && !known.has(name)) {
+            items.push({ type, name, label: name });
+            known.add(name);
+        }
+    }
+    return items;
+}

package/dist/views/studio-design/packages-io.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Package-list helpers shared by the Studio package switcher and the builder
+ * landing page.
+ *
+ * Writability is a DISPLAY heuristic — kernel packages (scope system/cloud)
+ * are hidden, `scope: 'project'` marks a read-only code package (authoring is
+ * refused server-side by the ADR-0070 D4 gate), and a scope-less entry is a
+ * database base package (writable). The gate stays the authority; this only
+ * sets expectations up front.
+ */
+export interface PkgEntry {
+    id: string;
+    name: string;
+    writable: boolean;
+}
+export declare function parsePackages(payload: unknown): PkgEntry[];
+export declare function fetchPackages(): Promise<PkgEntry[]>;
+/** Create a writable base package (POST /packages {id, name}). */
+export declare function createBasePackage(id: string, name: string): Promise<void>;
+/**
+ * Duplicate a package into a NEW writable base (ADR-0070 D4 — the Airtable
+ * "duplicate base" gesture; POST /packages/:id/duplicate). This is how a
+ * read-only code package becomes a customizable starting point: objects are
+ * re-namespaced and intra-package references rewritten server-side.
+ */
+export declare function duplicatePackage(sourceId: string, targetId: string, targetName?: string): Promise<void>;
+export declare const PACKAGE_ID_RE: RegExp;
+/**
+ * Normalize raw package-id keystrokes to the allowed alphabet, and SAY when
+ * something was dropped — the wizard used to strip illegal characters
+ * silently (`bad id!!` → `badid`), which reads as the input eating keys.
+ * The `stripped` flag drives an inline notice; PACKAGE_ID_RE stays the
+ * format authority (reverse-domain, e.g. `com.example.myapp`).
+ */
+export declare function sanitizePackageId(raw: string): {
+    value: string;
+    stripped: boolean;
+};

package/dist/views/studio-design/packages-io.js

@@ -0,0 +1,73 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+export function parsePackages(payload) {
+    const root = payload?.data ?? payload;
+    const raw = Array.isArray(root) ? root : (root?.packages ?? []);
+    const out = [];
+    for (const p of raw) {
+        if (!p || typeof p !== 'object')
+            continue;
+        const m = (p.manifest ?? {});
+        const id = String(m.id ?? p.id ?? '');
+        if (!id)
+            continue;
+        const scope = typeof m.scope === 'string' ? m.scope : '';
+        if (scope === 'system' || scope === 'cloud')
+            continue; // kernel — not app packages
+        out.push({ id, name: String(m.name ?? id), writable: scope !== 'project' });
+    }
+    return out;
+}
+export async function fetchPackages() {
+    const res = await fetch('/api/v1/packages', {
+        credentials: 'include',
+        headers: { Accept: 'application/json' },
+        cache: 'no-store',
+    });
+    if (!res.ok)
+        throw new Error(`HTTP ${res.status}`);
+    return parsePackages(await res.json());
+}
+/** Create a writable base package (POST /packages {id, name}). */
+export async function createBasePackage(id, name) {
+    const res = await fetch('/api/v1/packages', {
+        method: 'POST',
+        credentials: 'include',
+        headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+        body: JSON.stringify({ id, name }),
+    });
+    const payload = (await res.json().catch(() => null));
+    if (!res.ok || payload?.success === false) {
+        throw new Error(payload?.error?.message || `HTTP ${res.status}`);
+    }
+}
+/**
+ * Duplicate a package into a NEW writable base (ADR-0070 D4 — the Airtable
+ * "duplicate base" gesture; POST /packages/:id/duplicate). This is how a
+ * read-only code package becomes a customizable starting point: objects are
+ * re-namespaced and intra-package references rewritten server-side.
+ */
+export async function duplicatePackage(sourceId, targetId, targetName) {
+    const res = await fetch(`/api/v1/packages/${encodeURIComponent(sourceId)}/duplicate`, {
+        method: 'POST',
+        credentials: 'include',
+        headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+        body: JSON.stringify({ targetPackageId: targetId, ...(targetName ? { targetName } : {}) }),
+    });
+    const payload = (await res.json().catch(() => null));
+    if (!res.ok || payload?.success === false) {
+        throw new Error(payload?.error?.message || `HTTP ${res.status}`);
+    }
+}
+export const PACKAGE_ID_RE = /^[a-z][a-z0-9_.-]*(\.[a-z0-9_-]+)+$/;
+/**
+ * Normalize raw package-id keystrokes to the allowed alphabet, and SAY when
+ * something was dropped — the wizard used to strip illegal characters
+ * silently (`bad id!!` → `badid`), which reads as the input eating keys.
+ * The `stripped` flag drives an inline notice; PACKAGE_ID_RE stays the
+ * format authority (reverse-domain, e.g. `com.example.myapp`).
+ */
+export function sanitizePackageId(raw) {
+    const value = raw.toLowerCase().replace(/[^a-z0-9_.-]/g, '');
+    // Lowercasing is benign normalization; only actually-dropped characters warrant the notice.
+    return { value, stripped: value.length !== raw.length };
+}

package/dist/views/studio-design/skeletons.d.ts

@@ -0,0 +1,16 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+export declare function buildObjectSkeleton(name: string, label: string, nameFieldLabel: string): Record<string, unknown>;
+export declare function buildFlowSkeleton(name: string, label: string, startLabel: string, endLabel: string): Record<string, unknown>;
+/** An object to seed a new app's navigation with (one menu item per object). */
+export interface AppNavSeed {
+    name: string;
+    label: string;
+}
+export declare function buildAppSkeleton(name: string, label: string, navObjects?: AppNavSeed[]): Record<string, unknown>;
+export declare function buildPermissionSkeleton(name: string, label: string): Record<string, unknown>;

package/dist/views/studio-design/skeletons.js

@@ -0,0 +1,51 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+// Minimal-valid draft skeletons for the Studio's INLINE "New X" creators
+// (Data → object, Automations → flow, Interfaces → app, Access → permission).
+//
+// These bypass the metadata-admin registry, so `createConformance.test.ts`'s
+// registry-driven gate does NOT cover them — a future edit to one of these
+// shapes could make its "New" button a silent dead-end (create→save 422s). They
+// live here, pure and exported, so BOTH the pillars and the conformance gate
+// consume the SAME source: the test can't drift from what the designer emits.
+//
+// Label strings are parameters (the pillars pass localized `t(...)` values); the
+// gate passes any placeholder — the labels don't affect spec validity.
+export function buildObjectSkeleton(name, label, nameFieldLabel) {
+    return {
+        name,
+        label,
+        fields: { name: { type: 'text', label: nameFieldLabel } },
+    };
+}
+export function buildFlowSkeleton(name, label, startLabel, endLabel) {
+    return {
+        name,
+        label,
+        type: 'autolaunched',
+        nodes: [
+            { id: 'start', type: 'start', label: startLabel },
+            { id: 'end', type: 'end', label: endLabel },
+        ],
+        edges: [{ id: 'e1', source: 'start', target: 'end' }],
+    };
+}
+export function buildAppSkeleton(name, label, navObjects = []) {
+    return {
+        name,
+        label,
+        active: true,
+        // Seeding nav from the package's objects closes the create-app dead-end:
+        // a fresh app otherwise ships zero menu items and every object must be
+        // wired by hand in the Interfaces pillar (objectui#2262).
+        navigation: navObjects.map((o) => ({ id: `nav_${o.name}`, type: 'object', label: o.label, objectName: o.name })),
+    };
+}
+export function buildPermissionSkeleton(name, label) {
+    return { name, label, objects: {}, fields: {} };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/app-shell",
-  "version": "11.3.0",
+  "version": "11.5.0",
   "type": "module",
   "license": "MIT",
   "description": "Minimal application shell for ObjectUI - framework-agnostic rendering engine",
@@ -25,44 +25,47 @@
     "./styles.css": "./src/styles.css"
   },
   "dependencies": {
+    "@dnd-kit/core": "^6.3.1",
+    "@dnd-kit/sortable": "^10.0.0",
+    "@dnd-kit/utilities": "^3.2.2",
     "@monaco-editor/react": "^4.7.0",
-    "@objectstack/spec": "^11.2.0",
+    "@objectstack/spec": "^11.7.0",
     "@sentry/react": "^10.62.0",
     "jsonc-parser": "^3.3.1",
     "lucide-react": "^1.22.0",
     "qrcode": "^1.5.4",
     "sonner": "^2.0.7",
     "zod": "^4.4.3",
-    "@object-ui/auth": "11.3.0",
-    "@object-ui/collaboration": "11.3.0",
-    "@object-ui/components": "11.3.0",
-    "@object-ui/core": "11.3.0",
-    "@object-ui/data-objectstack": "11.3.0",
-    "@object-ui/fields": "11.3.0",
-    "@object-ui/i18n": "11.3.0",
-    "@object-ui/layout": "11.3.0",
-    "@object-ui/permissions": "11.3.0",
-    "@object-ui/plugin-editor": "11.3.0",
-    "@object-ui/providers": "11.3.0",
-    "@object-ui/react": "11.3.0",
-    "@object-ui/types": "11.3.0"
+    "@object-ui/auth": "11.5.0",
+    "@object-ui/collaboration": "11.5.0",
+    "@object-ui/components": "11.5.0",
+    "@object-ui/core": "11.5.0",
+    "@object-ui/data-objectstack": "11.5.0",
+    "@object-ui/fields": "11.5.0",
+    "@object-ui/i18n": "11.5.0",
+    "@object-ui/layout": "11.5.0",
+    "@object-ui/permissions": "11.5.0",
+    "@object-ui/plugin-editor": "11.5.0",
+    "@object-ui/providers": "11.5.0",
+    "@object-ui/react": "11.5.0",
+    "@object-ui/types": "11.5.0"
   },
   "peerDependencies": {
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
     "react-router-dom": "^6.0.0 || ^7.0.0",
-    "@object-ui/plugin-calendar": "^11.3.0",
-    "@object-ui/plugin-charts": "^11.3.0",
-    "@object-ui/plugin-chatbot": "^11.3.0",
-    "@object-ui/plugin-dashboard": "^11.3.0",
-    "@object-ui/plugin-designer": "^11.3.0",
-    "@object-ui/plugin-detail": "^11.3.0",
-    "@object-ui/plugin-form": "^11.3.0",
-    "@object-ui/plugin-grid": "^11.3.0",
-    "@object-ui/plugin-kanban": "^11.3.0",
-    "@object-ui/plugin-list": "^11.3.0",
-    "@object-ui/plugin-report": "^11.3.0",
-    "@object-ui/plugin-view": "^11.3.0"
+    "@object-ui/plugin-calendar": "^11.5.0",
+    "@object-ui/plugin-charts": "^11.5.0",
+    "@object-ui/plugin-chatbot": "^11.5.0",
+    "@object-ui/plugin-dashboard": "^11.5.0",
+    "@object-ui/plugin-designer": "^11.5.0",
+    "@object-ui/plugin-detail": "^11.5.0",
+    "@object-ui/plugin-form": "^11.5.0",
+    "@object-ui/plugin-grid": "^11.5.0",
+    "@object-ui/plugin-kanban": "^11.5.0",
+    "@object-ui/plugin-list": "^11.5.0",
+    "@object-ui/plugin-report": "^11.5.0",
+    "@object-ui/plugin-view": "^11.5.0"
   },
   "devDependencies": {
     "@types/node": "^26.0.1",
@@ -75,18 +78,18 @@
     "sonner": "^2.0.7",
     "typescript": "^6.0.3",
     "vite": "^8.1.0",
-    "@object-ui/plugin-calendar": "11.3.0",
-    "@object-ui/plugin-charts": "11.3.0",
-    "@object-ui/plugin-chatbot": "11.3.0",
-    "@object-ui/plugin-dashboard": "11.3.0",
-    "@object-ui/plugin-designer": "11.3.0",
-    "@object-ui/plugin-detail": "11.3.0",
-    "@object-ui/plugin-form": "11.3.0",
-    "@object-ui/plugin-grid": "11.3.0",
-    "@object-ui/plugin-kanban": "11.3.0",
-    "@object-ui/plugin-list": "11.3.0",
-    "@object-ui/plugin-report": "11.3.0",
-    "@object-ui/plugin-view": "11.3.0"
+    "@object-ui/plugin-calendar": "11.5.0",
+    "@object-ui/plugin-charts": "11.5.0",
+    "@object-ui/plugin-chatbot": "11.5.0",
+    "@object-ui/plugin-dashboard": "11.5.0",
+    "@object-ui/plugin-designer": "11.5.0",
+    "@object-ui/plugin-detail": "11.5.0",
+    "@object-ui/plugin-form": "11.5.0",
+    "@object-ui/plugin-grid": "11.5.0",
+    "@object-ui/plugin-kanban": "11.5.0",
+    "@object-ui/plugin-list": "11.5.0",
+    "@object-ui/plugin-report": "11.5.0",
+    "@object-ui/plugin-view": "11.5.0"
   },
   "keywords": [
     "objectui",