@object-ui/core 11.2.0 → 11.4.0

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # @object-ui/core
 
+## 11.4.0
+
+### Patch Changes
+
+- Updated dependencies [8bf6295]
+- Updated dependencies [1948c5b]
+- Updated dependencies [c38d107]
+  - @object-ui/types@11.4.0
+
+## 11.3.0
+
+### Minor Changes
+
+- d23d6eb: Three-tier AI page authoring: `kind:'html'` and a trusted `kind:'react'` tier.
+
+  - **`@object-ui/react-runtime`** (new) — the trusted runtime-React tier for
+    `kind:'react'` pages (vendored react-runner: Sucrase transpile + scope-eval,
+    no sandbox). Renders real JSX/TSX (any HTML + JS + hooks/useState/map/onClick)
+    in the main React tree with an injected scope (React, the public data blocks,
+    page data) and a built-in error boundary.
+  - **`@object-ui/core`** — new runtime capability gate (`enableCapability` /
+    `disableCapability` / `isCapabilityEnabled`, `CAP_REACT_PAGES`). `react-pages`
+    defaults **ON** (the platform trusts reviewed, draft-gated authors); a
+    deployment turns it OFF server-side (the runtime injects the disable global
+    when `OS_DISABLE_REACT_PAGES` is set). Never controlled from authored metadata.
+  - **`@object-ui/components`** — PageRenderer now routes `kind:'react'`
+    (capability-gated, lazy-loads the runtime) and renders `kind:'html'` (the
+    former `kind:'jsx'`, still accepted as a deprecated alias). The `html` tier
+    now resolves the full safe native HTML tag set (h1–h6, p, a, ul/ol/li, img,
+    blockquote, pre, strong/em, …) so authored HTML lives up to its name.
+
+### Patch Changes
+
+- @object-ui/types@11.3.0
+
 ## 11.2.0
 
 ### Minor Changes

package/dist/index.d.ts

@@ -29,6 +29,7 @@ export * from './utils/merge-views-into-objects.js';
 export * from './utils/freeze-schema.js';
 export * from './protocols/index.js';
 export * from './styling/scoped-styles.js';
+export * from './runtime/capabilities.js';
 /**
  * @deprecated Import `composeStacks` from `@objectstack/spec` instead.
  *
@@ -41,3 +42,4 @@ export * from './utils/date-macros.js';
 export * from './utils/compare-to.js';
 export * from './utils/chart-series.js';
 export * from './utils/dataset-format.js';
+export * from './utils/record-title.js';

package/dist/index.js

@@ -28,6 +28,7 @@ export * from './utils/merge-views-into-objects.js';
 export * from './utils/freeze-schema.js';
 export * from './protocols/index.js';
 export * from './styling/scoped-styles.js';
+export * from './runtime/capabilities.js';
 /**
  * @deprecated Import `composeStacks` from `@objectstack/spec` instead.
  *
@@ -40,3 +41,4 @@ export * from './utils/date-macros.js';
 export * from './utils/compare-to.js';
 export * from './utils/chart-series.js';
 export * from './utils/dataset-format.js';
+export * from './utils/record-title.js';

package/dist/runtime/capabilities.d.ts

@@ -0,0 +1,35 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ *
+ * Runtime capability gates — switches a *host* controls, never authored
+ * metadata. Each capability has a default; a host can flip it explicitly
+ * (`enableCapability`/`disableCapability`) or seed it from globals before any
+ * bundle code runs.
+ *
+ * {@link CAP_REACT_PAGES} (`kind:'react'` — execute author JavaScript in the
+ * main React tree) defaults **ON**: ObjectStack pages are authored by trusted
+ * authors and pass human review (draft-gating, ADR-0033), so the platform
+ * trusts them by default. A deployment that does NOT trust its page authors
+ * turns it off server-side — the ObjectStack runtime injects the disable global
+ * when `OS_PAGE_REACT=off` (see framework cli/utils/console.ts).
+ *
+ * Globals a host/server can set in the page before the bundle runs:
+ *   - `globalThis.__OBJECTUI_CAPABILITIES__`          — string[] to force ON
+ *   - `globalThis.__OBJECTUI_CAPABILITIES_DISABLED__` — string[] to force OFF
+ */
+/** Turn a capability on. Call from the host process only (not from metadata). */
+export declare function enableCapability(name: string): void;
+/** Turn a capability off. */
+export declare function disableCapability(name: string): void;
+/** Whether a capability is enabled. Host/global override wins over the default. */
+export declare function isCapabilityEnabled(name: string): boolean;
+/**
+ * `kind:'react'` — execute trusted author JavaScript (full React: hooks, event
+ * handlers, arbitrary JS) directly in the main React tree. Default ON; a
+ * deployment disables it server-side with `OS_PAGE_REACT=off`.
+ */
+export declare const CAP_REACT_PAGES = "react-pages";

package/dist/runtime/capabilities.js

@@ -0,0 +1,72 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ *
+ * Runtime capability gates — switches a *host* controls, never authored
+ * metadata. Each capability has a default; a host can flip it explicitly
+ * (`enableCapability`/`disableCapability`) or seed it from globals before any
+ * bundle code runs.
+ *
+ * {@link CAP_REACT_PAGES} (`kind:'react'` — execute author JavaScript in the
+ * main React tree) defaults **ON**: ObjectStack pages are authored by trusted
+ * authors and pass human review (draft-gating, ADR-0033), so the platform
+ * trusts them by default. A deployment that does NOT trust its page authors
+ * turns it off server-side — the ObjectStack runtime injects the disable global
+ * when `OS_PAGE_REACT=off` (see framework cli/utils/console.ts).
+ *
+ * Globals a host/server can set in the page before the bundle runs:
+ *   - `globalThis.__OBJECTUI_CAPABILITIES__`          — string[] to force ON
+ *   - `globalThis.__OBJECTUI_CAPABILITIES_DISABLED__` — string[] to force OFF
+ */
+/** Default state per capability when neither the host nor a global overrides it. */
+const DEFAULTS = {
+    'react-pages': true,
+};
+// Explicit host overrides (enable/disable) — win over defaults and globals.
+const overrides = new Map();
+let _seeded = false;
+function seedFromGlobals() {
+    if (_seeded)
+        return;
+    _seeded = true;
+    const g = globalThis;
+    if (Array.isArray(g.__OBJECTUI_CAPABILITIES__)) {
+        for (const c of g.__OBJECTUI_CAPABILITIES__)
+            if (typeof c === 'string' && !overrides.has(c))
+                overrides.set(c, true);
+    }
+    if (Array.isArray(g.__OBJECTUI_CAPABILITIES_DISABLED__)) {
+        // Disable wins: a server that turned something off must not be overridden
+        // by a stale enable-list left in the same page.
+        for (const c of g.__OBJECTUI_CAPABILITIES_DISABLED__)
+            if (typeof c === 'string')
+                overrides.set(c, false);
+    }
+}
+/** Turn a capability on. Call from the host process only (not from metadata). */
+export function enableCapability(name) {
+    seedFromGlobals();
+    overrides.set(name, true);
+}
+/** Turn a capability off. */
+export function disableCapability(name) {
+    seedFromGlobals();
+    overrides.set(name, false);
+}
+/** Whether a capability is enabled. Host/global override wins over the default. */
+export function isCapabilityEnabled(name) {
+    seedFromGlobals();
+    const o = overrides.get(name);
+    if (o !== undefined)
+        return o;
+    return DEFAULTS[name] ?? false;
+}
+/**
+ * `kind:'react'` — execute trusted author JavaScript (full React: hooks, event
+ * handlers, arbitrary JS) directly in the main React tree. Default ON; a
+ * deployment disables it server-side with `OS_PAGE_REACT=off`.
+ */
+export const CAP_REACT_PAGES = 'react-pages';

package/dist/utils/record-title.d.ts

@@ -0,0 +1,98 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Render a record title from a `titleFormat` pattern.
+ *
+ * Accepts either a legacy string template or an Expression envelope
+ * (`{ dialect: 'template', source: string }`) emitted by `@objectstack/spec`'s
+ * normalized templates. Both single-brace (`{field}`) and double-brace
+ * (`{{field}}`, the handlebars-style some authoring paths emit) placeholders are
+ * supported. Dotted paths (`{account.name}`) walk `$expanded` lookup objects; a
+ * placeholder that resolves to a whole object is reduced to its display name.
+ *
+ * Empty placeholders (missing / null / empty fields) are stripped along with
+ * any orphan separator they leave behind, so `"{full_name} - {company}"`
+ * evaluated against `{ company: "Acme" }` yields `"Acme"`, not `" - Acme"`.
+ * Returns an empty string when no placeholder resolved.
+ */
+export declare function formatTitleTemplate(titleFormat: string | {
+    source?: string;
+} | undefined | null, record: any): string;
+/**
+ * Decide whether a field definition can serve as a record title. Excludes the
+ * {@link NON_TITLE_TYPES} (dates, numbers, pickers, lookups, binary, …); a
+ * `formula` is eligible only when it returns text. A field with no declared
+ * type is treated as eligible (text-by-default), so loosely-typed metadata
+ * still produces a name rather than falling through to `Record #…`.
+ */
+export declare function isTitleEligibleField(def: any): boolean;
+/**
+ * Type-aware derivation (precedence step 4): pick the best title-eligible field
+ * name from `objectDef.fields`, ranked:
+ *
+ *   1. name-ish exact   — `name`,`title`,`subject`,`label`,`full_name`,
+ *                         `display_name` (case-insensitive)
+ *   2. name-ish affix   — `*_name`, `*_title`, `name_*` (case-insensitive)
+ *   3. declaration order — first remaining title-eligible field
+ *
+ * Returns the field name, or undefined when `fields` is absent/empty or holds
+ * no title-eligible field.
+ *
+ * Memoized per `objectDef` identity (see {@link deriveTitleFieldCache}): the
+ * field scan runs once per object definition, not once per record. The result is
+ * byte-identical to the uncached computation — only the scan is cached, and only
+ * when `objectDef` is a non-null object (the WeakMap key requirement).
+ */
+export declare function deriveTitleField(objectDef: any): string | undefined;
+export interface RecordDisplayNameOptions {
+    /**
+     * Optional explicit title field (e.g. a view's `titleField` / gallery
+     * `titleField` / kanban `cardTitle`). When set and it yields a non-empty
+     * value on the record, it wins over everything — preserving each view's
+     * author-chosen field. Pass nothing to use the object-level precedence only.
+     */
+    titleField?: string;
+    /** Floor when the record has no id at all. Defaults to `'Untitled'`. */
+    fallback?: string;
+    /**
+     * Whether to probe standard name-ish keys (`name`/`title`/…) directly on the
+     * record when `objectDef.fields` is absent (precedence step 3b). Defaults to
+     * `true`. Callers that have a better generic fallback to interleave (e.g. the
+     * detail header prefers `schema.title`, the object label, over a guessed
+     * record key) pass `false` so this step is skipped and the resolver returns
+     * its `Record #<id>` floor instead — letting the caller decide.
+     */
+    deriveFromRecordKeys?: boolean;
+}
+/**
+ * THE unified record display-name resolver (ADR-0079).
+ *
+ * Precedence (ADR-0079 Phase 2 makes the object's declared field canonical and
+ * de-prioritizes the legacy `titleFormat` template):
+ *   0. `options.titleField`, then `objectDef.titleField` (when provided &
+ *      non-empty on the record) — lets a view / object keep its author-chosen
+ *      title field.
+ *   1. `objectDef.nameField` — the NEW canonical record-title pointer
+ *      (ADR-0079). A field name the server can return and query.
+ *   2. `objectDef.displayNameField` / `objectDef.NAME_FIELD_KEY` — the
+ *      deprecated alias of `nameField`, kept for back-compat.
+ *   3. `objectDef.titleFormat` (rendered template) — LEGACY, render-only, kept
+ *      for back-compat only; an explicitly-declared field (1/2) now wins over
+ *      it. See the deprecation note on the branch below.
+ *   4. type-aware derivation from `objectDef.fields` ({@link deriveTitleField}).
+ *   4b. standard name-ish keys probed directly on the record
+ *      ({@link NAME_ISH_RECORD_KEYS}) — the safety net for when `fields` is
+ *      absent so derivation can't run.
+ *   5. `Record #<id>` (using `record.id ?? record._id`), else `options.fallback`
+ *      (default `'Untitled'`) for a truly id-less record.
+ *
+ * @param objectDef Object definition (may be `any`/partial — every field is
+ *                  read defensively).
+ * @param record    The record data.
+ */
+export declare function getRecordDisplayName(objectDef: any, record: any, options?: RecordDisplayNameOptions): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/core",
-  "version": "11.2.0",
+  "version": "11.4.0",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",
@@ -25,11 +25,11 @@
     }
   },
   "dependencies": {
-    "@objectstack/formula": "^11.0.0",
-    "@objectstack/spec": "^11.0.0",
+    "@objectstack/formula": "^11.5.0",
+    "@objectstack/spec": "^11.7.0",
     "lodash": "^4.18.1",
     "zod": "^4.4.3",
-    "@object-ui/types": "11.2.0"
+    "@object-ui/types": "11.4.0"
   },
   "devDependencies": {
     "typescript": "^6.0.3",