@object-ui/core 17.6.0 → 18.0.0

package/dist/actions/TransactionManager.d.ts

@@ -24,8 +24,13 @@ export interface TransactionOperation {
     type: 'create' | 'update' | 'delete';
     /** Target resource name */
     resource: string;
-    /** Record ID (for update/delete) */
-    id?: string | number;
+    /**
+     * Record ID (for update/delete). A `string`, as `@objectstack/spec` declares
+     * every record door and as this type's own sibling `BatchTransactionOperation.id`
+     * already did; the rollback path hands it straight to `DataSource.update`
+     * (objectui#9333).
+     */
+    id?: string;
     /** Data payload */
     data?: Record<string, any>;
     /** Previous state (for rollback) */

package/dist/actions/UndoManager.d.ts

@@ -12,19 +12,14 @@
  * pattern for use from ActionRunner, React hooks, and standalone contexts.
  * Maintains bounded history stacks with subscriber notifications.
  */
-/** Represents a single undoable CRUD operation. */
-export interface UndoableOperation {
-    id: string;
-    type: 'create' | 'update' | 'delete';
-    objectName: string;
-    recordId: string;
-    timestamp: number;
-    description: string;
-    /** Data needed to undo: for create=recordId, for update=previousData, for delete=fullRecord */
-    undoData: Record<string, unknown>;
-    /** Data needed to redo: for create=newData, for update=newData, for delete=recordId */
-    redoData: Record<string, unknown>;
-}
+import type { UndoableOperation } from '@object-ui/types';
+/**
+ * A single undoable CRUD operation — declared once, in `@object-ui/types`
+ * (objectui#6349, batch 4), beside the `ActionResult` whose `undo` member it
+ * types, and re-exported here so an import from `@object-ui/core` keeps
+ * resolving to the same type.
+ */
+export type { UndoableOperation } from '@object-ui/types';
 export interface UndoManagerOptions {
     /** Maximum number of operations to retain in history. @default 50 */
     maxHistory?: number;

package/dist/actions/actionKeys.d.ts

@@ -18,7 +18,7 @@
  *
  * That asymmetry was the issue. An open key set on a DECLARED METADATA CONTRACT
  * is what lets a typo (`targt`, `exectue`) and a tombstoned key (`execute`) both
- * sail through to a runner that then silently does nothing — the #2169 "Mark
+ * sail through to a runner that then silently does nothing — the objectstack-ai/objectstack#2169 "Mark
  * Done does nothing" shape.
  *
  * This module was step 1 of the staged narrowing: make the key set VISIBLE and
@@ -74,10 +74,12 @@
  * rejection" into a compile error at no cost. Hand-copying would have quietly
  * re-legitimized two dead keys — which is why the types are derived.
  *
- * 17 keys `ActionDef` declares that the spec does not own — `actionType`, `api`,
+ * 16 keys `ActionDef` declares that the spec does not own — `actionType`, `api`,
  * `chain`, `chainMode`, `close`, `condition`, `confirm`, `endpoint`, `modal`,
- * `navigate`, `onClick`, `onFailure`, `onSuccess`, `redirect`, `reload`, `toast`,
- * `actionParams`. Step 2 marked `@deprecated`, with the spec spelling to use
+ * `navigate`, `onClick`, `onFailure`, `redirect`, `reload`, `toast`,
+ * `actionParams`. (`onSuccess` was the 17th until objectui#5934 retired the
+ * runner's chained-callback meaning; the key is now spec-owned and derived,
+ * like the 18 below.) Step 2 marked `@deprecated`, with the spec spelling to use
  * instead, ONLY the four the runner itself proves are aliases: `actionType` (→
  * `type`), `api` and `endpoint` (→ `target`; `executeAPI` resolves
  * `api || endpoint || target`), and `navigate` (→ flat `target`/`openIn`;
@@ -111,7 +113,7 @@
  * classifier a list of anything. `actionKeys.pin.test.ts` re-derives this one
  * from the interface's AST, which is what keeps the data true.
  */
-export declare const ACTION_DEF_KEYS: readonly ["type", "actionType", "name", "label", "description", "confirmText", "confirm", "condition", "disabled", "api", "endpoint", "method", "navigate", "to", "external", "newTab", "replace", "onClick", "reload", "close", "redirect", "toast", "successMessage", "errorMessage", "refreshAfter", "undoable", "params", "actionParams", "resultDialog", "target", "body", "openIn", "modal", "chain", "chainMode", "onSuccess", "onFailure", "opensInNewTab", "newTabUrl", "locations", "visible", "requiredPermissions", "icon", "variant", "order", "component", "objectName", "ai", "aria", "bodyExtra", "bodyShape", "mode", "recordIdField", "recordIdParam", "requiresFeature", "shortcut", "bulkEnabled"];
+export declare const ACTION_DEF_KEYS: readonly ["type", "actionType", "name", "label", "description", "confirmText", "confirm", "condition", "disabled", "api", "endpoint", "method", "navigate", "to", "external", "newTab", "replace", "onClick", "reload", "close", "redirect", "toast", "successMessage", "errorMessage", "refreshAfter", "undoable", "params", "actionParams", "resultDialog", "target", "body", "openIn", "modal", "chain", "chainMode", "onFailure", "opensInNewTab", "newTabUrl", "locations", "visible", "requiredPermissions", "icon", "variant", "order", "component", "objectName", "ai", "bodyExtra", "bodyShape", "operation", "patch", "mode", "recordIdField", "recordIdParam", "requiresFeature", "onSuccess", "outcomeMessages", "shortcut", "bulkEnabled"];
 /**
  * Every property `@objectstack/spec`'s `ActionSchema` declares.
  *
@@ -126,7 +128,7 @@ export declare const ACTION_DEF_KEYS: readonly ["type", "actionType", "name", "l
  * test and wrong in shipped code — `@object-ui/types` made the same call for
  * `ActionComponent`. The pin test does the walk and fails the day this drifts.
  */
-export declare const SPEC_ACTION_KEYS: readonly ["_lock", "_lockDocsUrl", "_lockReason", "_lockSource", "_packageId", "_packageVersion", "_provenance", "ai", "aria", "body", "bodyExtra", "bodyShape", "bulkEnabled", "component", "confirmText", "description", "disabled", "errorMessage", "execute", "icon", "label", "locations", "method", "mode", "name", "newTabUrl", "objectName", "onSuccess", "openIn", "opensInNewTab", "order", "params", "recordIdField", "recordIdParam", "refreshAfter", "requiredPermissions", "requiresFeature", "resultDialog", "shortcut", "successMessage", "target", "type", "undoable", "variant", "visible"];
+export declare const SPEC_ACTION_KEYS: readonly ["_lock", "_lockDocsUrl", "_lockReason", "_lockSource", "_packageId", "_packageVersion", "_provenance", "ai", "aria", "body", "bodyExtra", "bodyShape", "bulkEnabled", "component", "confirmText", "description", "disabled", "errorMessage", "execute", "execution", "icon", "label", "locations", "method", "mode", "name", "newTabUrl", "objectName", "onSuccess", "openIn", "opensInNewTab", "operation", "order", "outcomeMessages", "params", "patch", "recordIdField", "recordIdParam", "refreshAfter", "requiredPermissions", "requiresFeature", "requiresMembershipReach", "resultDialog", "shortcut", "successMessage", "target", "type", "undoable", "variant", "visible"];
 /**
  * The `navigation` alias's own spelling of a target, read off the action itself
  * when no nested `navigate` object is present (`ActionRunner.executeNavigation`).
@@ -227,7 +229,7 @@ export declare function resetActionKeyWarnings(): void;
  * Dev-mode only: name the keys an action carries that no reader will ever look
  * at. Non-breaking by construction — it changes no types and rejects nothing.
  *
- * Silently binding no handler is the #2169 "Mark Done does nothing" shape. The
+ * Silently binding no handler is the objectstack-ai/objectstack#2169 "Mark Done does nothing" shape. The
  * compiler now catches it in action literals AUTHORED IN CODE — objectstack#4075
  * step 3 closed `ActionDef` — but not in the actions that arrive as DATA, which
  * reach the runner unparsed and which no compiler ever looked at. This is the

package/dist/actions/actionKeys.js

@@ -18,7 +18,7 @@
  *
  * That asymmetry was the issue. An open key set on a DECLARED METADATA CONTRACT
  * is what lets a typo (`targt`, `exectue`) and a tombstoned key (`execute`) both
- * sail through to a runner that then silently does nothing — the #2169 "Mark
+ * sail through to a runner that then silently does nothing — the objectstack-ai/objectstack#2169 "Mark
  * Done does nothing" shape.
  *
  * This module was step 1 of the staged narrowing: make the key set VISIBLE and
@@ -74,10 +74,12 @@
  * rejection" into a compile error at no cost. Hand-copying would have quietly
  * re-legitimized two dead keys — which is why the types are derived.
  *
- * 17 keys `ActionDef` declares that the spec does not own — `actionType`, `api`,
+ * 16 keys `ActionDef` declares that the spec does not own — `actionType`, `api`,
  * `chain`, `chainMode`, `close`, `condition`, `confirm`, `endpoint`, `modal`,
- * `navigate`, `onClick`, `onFailure`, `onSuccess`, `redirect`, `reload`, `toast`,
- * `actionParams`. Step 2 marked `@deprecated`, with the spec spelling to use
+ * `navigate`, `onClick`, `onFailure`, `redirect`, `reload`, `toast`,
+ * `actionParams`. (`onSuccess` was the 17th until objectui#5934 retired the
+ * runner's chained-callback meaning; the key is now spec-owned and derived,
+ * like the 18 below.) Step 2 marked `@deprecated`, with the spec spelling to use
  * instead, ONLY the four the runner itself proves are aliases: `actionType` (→
  * `type`), `api` and `endpoint` (→ `target`; `executeAPI` resolves
  * `api || endpoint || target`), and `navigate` (→ flat `target`/`openIn`;
@@ -154,7 +156,6 @@ export const ACTION_DEF_KEYS = [
     'modal',
     'chain',
     'chainMode',
-    'onSuccess',
     'onFailure',
     'opensInNewTab',
     'newTabUrl',
@@ -172,13 +173,30 @@ export const ACTION_DEF_KEYS = [
     'component',
     'objectName',
     'ai',
-    'aria',
+    // `aria` left this list, with its `ActionDef` field, when `@objectstack/spec`
+    // 17.5.0 retired `action.aria` as a `retiredKey()` tombstone (objectui#10929):
+    // the derived type had become `undefined`, so the field mirrored nothing. It
+    // stays in `SPEC_ACTION_KEYS` below, because `ActionSchema` still declares the
+    // tombstone.
     'bodyExtra',
     'bodyShape',
+    // The declarative single-record field write (spec 17.3.0). Promoted from
+    // inventory-only to declared `ActionDef` fields when the runner learned to
+    // read them — the branch that dispatches `operation: 'update'` on the
+    // platform action route, ahead of `type`.
+    'operation',
+    'patch',
     'mode',
     'recordIdField',
     'recordIdParam',
     'requiresFeature',
+    // Moved from the runner-native cluster above by objectui#5934: the legacy
+    // chained-callback meaning is retired and the key's type now derives the
+    // spec's `{ navigate, openIn }` block.
+    'onSuccess',
+    // Spec 17.6.0's success copy per handler outcome (objectui#11344), declared
+    // when the runner learned to read it: the success toast's first rung.
+    'outcomeMessages',
     'shortcut',
     'bulkEnabled',
 ];
@@ -228,6 +246,14 @@ export const SPEC_ACTION_KEYS = [
     'disabled',
     'errorMessage',
     'execute',
+    // Added to `ActionSchema` in @objectstack/spec 17.5.0 (objectui#11073): the
+    // bulk dispatch contract the action's body is written for, in
+    // `bulkActionDefs`' own `'perRecord' | 'aggregate'` vocabulary. Listed for the
+    // reason `description` is — this array restates the spec's declared keys, so
+    // an action carrying it is not reported as having an unknown key. `ActionDef`
+    // does NOT declare it and the runner does not read it: the spec's own
+    // enforcement is `@objectstack/lint`'s authoring-time check.
+    'execution',
     'icon',
     'label',
     'locations',
@@ -237,22 +263,49 @@ export const SPEC_ACTION_KEYS = [
     'newTabUrl',
     'objectName',
     // Declared by `ActionSchema` as of @objectstack/spec 17.1.0 (objectui#5328).
-    // Listing it here is a DIAGNOSTIC statement only — `KNOWN_ACTION_KEYS` feeds
-    // `warnOnUnknownActionKeys`, so without this row an author writing the key the
-    // spec now accepts would be warned it is unknown. It says nothing about the
-    // key being forwarded: the four declared action surfaces still drop it before
-    // the runner, tracked as KNOWN_GAPS in check-action-forward-parity.mjs and
-    // filed as objectui#5493.
+    // All four declared action surfaces forward it since objectui#5493/#6304, and
+    // `ActionDef` derives its type from the spec since objectui#5934 retired the
+    // runner's legacy chained-callback meaning for the same key.
     'onSuccess',
     'openIn',
     'opensInNewTab',
+    // Added to `ActionSchema` in @objectstack/spec 17.3.0 (objectui#7122), the
+    // declarative single-record field write that mirrors a list view's
+    // `bulkActionDefs`: `operation: 'update'` applies `patch` (merged UNDER the
+    // collected `params`) to the current record on the data plane AS THE CALLER.
+    //
+    // Both keys were inventory-ONLY when that bump landed, under the maintainer's
+    // 2026-09-05 ruling on it ("record both as justified omissions now; forward
+    // only the key a runtime actually reads, once its semantics are read from
+    // upstream — no speculative forwarding"). That condition is now met: the
+    // runner reads both (`executeUpdateOperation`, dispatched ahead of `type`),
+    // `ActionDef` declares both, and every action surface forwards them — which
+    // is what `check:action-forward-parity` now requires rather than excuses.
+    'operation',
     'order',
+    // Added to `ActionSchema` in @objectstack/spec 17.6.0 (objectstack#21095,
+    // objectui#11344): success copy per handler outcome, keyed by the snake_case
+    // `outcome` the handler returns. `ActionDef` declares it (derived) and the
+    // runner reads it as the success toast's first rung, ahead of
+    // `successMessage`.
+    'outcomeMessages',
     'params',
+    'patch',
     'recordIdField',
     'recordIdParam',
     'refreshAfter',
     'requiredPermissions',
     'requiresFeature',
+    // Added to `ActionSchema` in @objectstack/spec 17.7.0 (objectui#11717): the
+    // organization endpoint (a `MEMBERSHIP_REACH` row) whose membership-grade gate
+    // the action follows, which the spec's parse LOWERS into `visible` over
+    // `current_user.positions` (the same transform that lowers `requiresFeature`
+    // above). Listed for the reason `description` is — this array restates the
+    // spec's declared keys, so an action carrying it is not reported as having an
+    // unknown key. `ActionDef` does NOT declare it and the runner does not read
+    // it; whether it should, beside `requiresFeature`, is not this inventory's
+    // question.
+    'requiresMembershipReach',
     'resultDialog',
     'shortcut',
     'successMessage',
@@ -340,7 +393,7 @@ export const HOST_DISPATCH_ACTION_KEYS = ['overrideNotice'];
  * a tombstone the spec keeps only in order to reject it by name.
  */
 export const RETIRED_ACTION_KEYS = {
-    execute: '`execute` was removed in @objectstack/spec 17 (#3855) — rename the key to `target`. ' +
+    execute: '`execute` was removed in @objectstack/spec 17 (objectstack-ai/objectstack#3855) — rename the key to `target`. ' +
         'The value (a script name or expression) is unchanged. ' +
         'Run `os migrate meta --from 16` to rewrite it automatically.',
 };
@@ -393,7 +446,7 @@ const isDev = () => globalThis.process?.env?.NODE_ENV !==
  * Dev-mode only: name the keys an action carries that no reader will ever look
  * at. Non-breaking by construction — it changes no types and rejects nothing.
  *
- * Silently binding no handler is the #2169 "Mark Done does nothing" shape. The
+ * Silently binding no handler is the objectstack-ai/objectstack#2169 "Mark Done does nothing" shape. The
  * compiler now catches it in action literals AUTHORED IN CODE — objectstack#4075
  * step 3 closed `ActionDef` — but not in the actions that arrive as DATA, which
  * reach the runner unparsed and which no compiler ever looked at. This is the

package/dist/actions/actionResponse.js

@@ -59,7 +59,7 @@ import { actionErrorDetail } from './actionErrorDetail.js';
 export function readActionPayload(envelope) {
     // objectstack#3962 servers single-wrap: `body.data` IS the handler value,
     // so most of the time this is the identity function. Only the exact LEGACY
-    // action envelope (pre-#3962: a boolean `success` and no keys beyond the
+    // action envelope (pre-objectstack-ai/objectstack#3962: a boolean `success` and no keys beyond the
     // envelope's own) is unwrapped one more level — a handler value that
     // merely contains a `success` key passes through untouched.
     if (isLegacyActionEnvelope(envelope)) {
@@ -82,7 +82,7 @@ export function isLegacyActionEnvelope(v) {
  */
 export function interpretActionResponse(res, json, label) {
     const envelope = json?.data;
-    // Pre-#3962 servers reported a rejection as HTTP 200 with the inner
+    // Pre-objectstack-ai/objectstack#3962 servers reported a rejection as HTTP 200 with the inner
     // `{success:false, error}`; current servers answer a real status, which
     // `res.ok` catches first. Detected narrowly so a handler value that merely
     // contains `success: false` is not misread as a failure.

package/dist/actions/index.d.ts

@@ -15,3 +15,5 @@ export * from './actionErrorDetail.js';
 export * from './actionResponse.js';
 export * from './serverActionHandler.js';
 export * from './recordIdParam.js';
+export * from './recordDelete.js';
+export * from './navigationTarget.js';

package/dist/actions/index.js

@@ -15,3 +15,5 @@ export * from './actionErrorDetail.js';
 export * from './actionResponse.js';
 export * from './serverActionHandler.js';
 export * from './recordIdParam.js';
+export * from './recordDelete.js';
+export * from './navigationTarget.js';

package/dist/actions/navigationTarget.d.ts

@@ -0,0 +1,41 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * What a click may navigate to, and how.
+ *
+ * This is the one answer, shared by every caller that turns an authored or
+ * served target into a user-click navigation (objectui#12191, ruling A+):
+ *
+ * - the action runner: a `type: 'url'` action, its `navigation` alias (which is
+ *   how an `element:button` CTA reaches it) and `onSuccess.navigate`;
+ * - app-shell's entitlement CTA, `resolveCtaHref`.
+ *
+ * ⛔ No caller keeps a scheme list of its own. A second list is how the runner
+ * came to refuse the `mailto:` target the CTA already admitted, so a mail button
+ * the spec accepts published cleanly and then failed at click.
+ *
+ * The admitted set is closed:
+ *
+ * - `'web'`: `http://` or `https://`. It leaves the app. The caller's `openIn`
+ *   decides the tab.
+ * - `'mail'`: `mailto:`. It leaves the app IN PLACE: never a new tab, and
+ *   `openIn` is not consulted. The mail client opens and the page stays.
+ * - `'path'`: an in-app relative path, `/…` or `./…`.
+ *
+ * Everything else answers `null` and is refused: `javascript:`, `data:`, `tel:`
+ * (not admitted: no measured producer) and every other scheme, and a
+ * protocol-relative `//host`. Two other spellings of `//host` are refused with
+ * it, because the browser's URL parser reads them as `//host`: a backslash in
+ * second place (`/` then a backslash, then `host`), and any target that holds an
+ * ASCII tab, line feed or carriage return, since the parser deletes those three
+ * before it reads anything.
+ *
+ * Scheme names compare case-insensitively, as the URL parser compares them.
+ */
+export type NavigationTargetKind = 'web' | 'mail' | 'path';
+export declare function classifyNavigationTarget(url: unknown): NavigationTargetKind | null;

package/dist/actions/navigationTarget.js

@@ -0,0 +1,20 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+export function classifyNavigationTarget(url) {
+    if (typeof url !== 'string' || /[\t\n\r]/.test(url))
+        return null;
+    if (/^https?:\/\//i.test(url))
+        return 'web';
+    if (/^mailto:/i.test(url))
+        return 'mail';
+    if (url.startsWith('./'))
+        return 'path';
+    if (url.startsWith('/') && url[1] !== '/' && url[1] !== '\\')
+        return 'path';
+    return null;
+}

package/dist/actions/recordDelete.d.ts

@@ -0,0 +1,154 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * The ONE record-delete core — the confirm question and the delete itself —
+ * that every host's list Delete binds to (objectui#10383).
+ *
+ * ## Why this lives here, and why there is only one
+ *
+ * The console's object list deleted through `useObjectActions` (`app-shell`):
+ * the confirm question, the single delete with its ADR-0094 detection, the bulk
+ * delete and their toasts were written inline in that hook. The registered
+ * `object-view` renderer (`plugin-view`) had no delete at all — its grid
+ * handlers only refreshed — and the first repair COPIED those steps into a
+ * second flow. The copy already diverged on consent: it asked every row the
+ * plain "delete this record?" question, while the console asked a package-owned
+ * permission set the reset question (that question went with the catalog
+ * objects, ADR-0131). One operation with two
+ * implementations drifts on exactly the part that matters, so the rule is: the
+ * side with the governance keeps it, the other side re-binds to it, and there
+ * is one copy. This module is that copy, and both hosts call it.
+ *
+ * `@object-ui/core` is the lowest package both hosts already depend on. The
+ * host-specific pieces are INJECTED — the translator, the toast sink, the data
+ * source and the refresh — so this package gains no i18n or toast dependency.
+ * The host keeps its own confirm UI (`app-shell` hands the copy to the console's
+ * confirm handler; `plugin-view` renders it in its own AlertDialog); the COPY —
+ * title, body and confirm-button label — comes from
+ * {@link recordDelete}.confirmCopy, whose body for one record is
+ * {@link recordDelete}.confirmText.
+ *
+ * ## The confirmation names what it deletes (objectui#11695)
+ *
+ * A generic "Confirm Action" / "Continue" dialog never said WHICH record was
+ * about to go, nor that the click is a delete. The title names the record by
+ * the ONE ADR-0079 display-name resolver ({@link getRecordDisplayName}, the
+ * resolver the record header and lookups use), and the object label — or, for
+ * a batch, the count. The confirm button reads as the deletion it is; every
+ * host paints it in the destructive button style.
+ *
+ * ## The result shape is the action runner's, on purpose
+ *
+ * `run` returns what a registered `delete` handler returns, because the console
+ * registers it as exactly that. The toasts here are the AUTHORITATIVE feedback,
+ * so every path returns WITHOUT an `error` key (and success returns `silent`) —
+ * otherwise the runner's post-execution hook, which has its own toast handler,
+ * would toast the same outcome a second time. The single exception is a
+ * request with no record id at all, which toasts nothing here and returns the
+ * `error` for the runner to report.
+ *
+ * Record ids are forwarded exactly as the caller supplied them; nothing here
+ * converts them.
+ */
+import type { ActionResult } from './ActionRunner.js';
+type Row = Record<string, unknown>;
+/** Translate a key — the host's `t`, injected so core takes no i18n dependency. */
+type Translate = (key: string, options?: Record<string, unknown>) => string;
+/** Everything `run` needs from its host. `confirmText` needs only the first two. */
+interface RecordDeleteDeps {
+    objectName: string;
+    t: Translate;
+    /** The object's display label, used by the toasts. */
+    label: string;
+    dataSource: {
+        delete(resource: string, id: string): Promise<unknown>;
+    };
+    /** The host's toast sink (sonner's `toast` in both hosts today). */
+    toast: {
+        success(message: string): unknown;
+        error(message: string, data?: {
+            description?: string;
+        }): unknown;
+    };
+    /** Re-read the list after a delete. */
+    onRefresh?: () => void;
+}
+/**
+ * The request, in the action runner's `delete` shape — the console registers
+ * `run` as its `delete` handler, so the runner's action arrives here verbatim:
+ * `params.records` (several), `params.recordId` + optional `params.record`
+ * (one), and the legacy top-level `recordId`.
+ */
+interface RecordDeleteRequest {
+    params?: {
+        records?: unknown;
+        recordId?: unknown;
+        record?: Row | null;
+    };
+    recordId?: unknown;
+}
+/**
+ * The copy of a delete confirmation — everything a host's confirm dialog shows,
+ * from {@link recordDelete}.confirmCopy (objectui#11695).
+ */
+export interface RecordDeleteConfirmCopy {
+    /** The dialog title: names the record and its object, or the batch size. */
+    title: string;
+    /** The dialog body: the delete question, or the batch question. */
+    message: string;
+    /** The confirm button's label: a deletion verb, painted destructive by the host. */
+    confirmText: string;
+}
+/**
+ * What a delete confirmation is about: ONE record (its row — at least its
+ * `id`, so a nameless row still reads by the resolver's `Record #id` floor) or
+ * a batch (how many).
+ */
+export type RecordDeleteConfirmTarget = {
+    record: Row | null | undefined;
+} | {
+    count: number;
+};
+/**
+ * The record-delete core: `confirmText` is the question to ask before deleting
+ * one record, `run` performs the delete (one record, or several settled
+ * together) and reports it. See the module docblock for objectui#10383.
+ */
+export declare const recordDelete: Readonly<{
+    /**
+     * The question to ask before deleting ONE record — the body of
+     * {@link recordDelete}.confirmCopy.
+     */
+    confirmText(deps: Pick<RecordDeleteDeps, "t">): string;
+    /**
+     * The whole delete confirmation — title, body and confirm-button label — for
+     * ONE record or a batch (objectui#11695). Every host's delete dialog shows
+     * this copy, so the list's row Delete, its bulk Delete and the record page's
+     * Delete say the same thing.
+     *
+     * One record: the title names it — the object label plus the record's
+     * display name from {@link getRecordDisplayName}, reading `objectDef`'s
+     * declared name field when the host has the definition — and the body is
+     * {@link recordDelete}.confirmText. A batch: the title counts it. The confirm
+     * button is the delete verb in both, which the host paints destructive.
+     */
+    confirmCopy(deps: Pick<RecordDeleteDeps, "objectName" | "t" | "label"> & {
+        /** The object definition, so the name follows its declared `nameField`. */
+        objectDef?: unknown;
+    }, target: RecordDeleteConfirmTarget): RecordDeleteConfirmCopy;
+    /**
+     * Delete, refresh and report. Several records (`params.records`, more than
+     * one with an `id`) are deleted one call each and settled together, then the
+     * list refreshes and ONE summary toast reports the batch. Otherwise one
+     * record is deleted; on success the list refreshes and a success toast shows,
+     * on failure an error
+     * toast carries the error message and the list is left as it is.
+     */
+    run(deps: RecordDeleteDeps, request: RecordDeleteRequest): Promise<ActionResult>;
+}>;
+export {};

package/dist/actions/recordDelete.js

@@ -0,0 +1,110 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+import { getRecordDisplayName } from '../utils/record-title.js';
+/**
+ * The record-delete core: `confirmText` is the question to ask before deleting
+ * one record, `run` performs the delete (one record, or several settled
+ * together) and reports it. See the module docblock for objectui#10383.
+ */
+export const recordDelete = Object.freeze({
+    /**
+     * The question to ask before deleting ONE record — the body of
+     * {@link recordDelete}.confirmCopy.
+     */
+    confirmText(deps) {
+        return deps.t('objectActions.deleteConfirm');
+    },
+    /**
+     * The whole delete confirmation — title, body and confirm-button label — for
+     * ONE record or a batch (objectui#11695). Every host's delete dialog shows
+     * this copy, so the list's row Delete, its bulk Delete and the record page's
+     * Delete say the same thing.
+     *
+     * One record: the title names it — the object label plus the record's
+     * display name from {@link getRecordDisplayName}, reading `objectDef`'s
+     * declared name field when the host has the definition — and the body is
+     * {@link recordDelete}.confirmText. A batch: the title counts it. The confirm
+     * button is the delete verb in both, which the host paints destructive.
+     */
+    confirmCopy(deps, target) {
+        const { t, label } = deps;
+        const confirmText = t('objectActions.deleteConfirmButton');
+        if ('count' in target) {
+            return {
+                title: t('objectActions.bulkDeleteConfirmTitle', { count: target.count, label }),
+                message: t('console.objectView.bulkDeleteConfirm', { count: target.count }),
+                confirmText,
+            };
+        }
+        return {
+            title: t('objectActions.deleteConfirmTitle', {
+                label,
+                name: getRecordDisplayName(deps.objectDef, target.record),
+            }),
+            message: recordDelete.confirmText(deps),
+            confirmText,
+        };
+    },
+    /**
+     * Delete, refresh and report. Several records (`params.records`, more than
+     * one with an `id`) are deleted one call each and settled together, then the
+     * list refreshes and ONE summary toast reports the batch. Otherwise one
+     * record is deleted; on success the list refreshes and a success toast shows,
+     * on failure an error
+     * toast carries the error message and the list is left as it is.
+     */
+    async run(deps, request) {
+        const { objectName, t, label, dataSource, toast, onRefresh } = deps;
+        const params = request.params;
+        const records = Array.isArray(params?.records)
+            ? params.records.filter((r) => r?.id != null)
+            : null;
+        // Bulk path — delete every record in parallel and report a summary.
+        if (records && records.length > 1) {
+            const results = await Promise.allSettled(records.map((r) => dataSource.delete(objectName, r.id)));
+            const failed = results.filter((r) => r.status === 'rejected').length;
+            const succeeded = results.length - failed;
+            onRefresh?.();
+            if (failed === 0) {
+                toast.success(t('objectActions.bulkDeleteSuccess', {
+                    count: succeeded,
+                    label,
+                    defaultValue: `Deleted ${succeeded} ${label} records`,
+                }));
+                // `silent`: the summary above is the feedback — without it the runner's
+                // post-execution hook adds a second, generic success toast.
+                return { success: true, reload: true, silent: true };
+            }
+            toast.error(t('objectActions.bulkDeletePartial', {
+                succeeded,
+                failed,
+                defaultValue: `${succeeded} deleted, ${failed} failed`,
+            }));
+            // The summary above is authoritative; returning WITHOUT `error` keeps the
+            // runner from toasting the failure a second time.
+            return { success: false };
+        }
+        const recordId = params?.recordId ?? params?.record?.id ?? records?.[0]?.id ?? request.recordId;
+        if (!recordId)
+            return { success: false, error: t('objectActions.noRecordId') };
+        try {
+            await dataSource.delete(objectName, recordId);
+            onRefresh?.();
+            toast.success(t('objectActions.deleteSuccess', { label }));
+            return { success: true, reload: true, silent: true };
+        }
+        catch (err) {
+            toast.error(t('objectActions.deleteFailed', { label }), {
+                description: err.message,
+            });
+            // The toast above (label + error message) is the feedback; returning
+            // WITHOUT `error` keeps the runner from toasting the raw message again.
+            return { success: false };
+        }
+    },
+});

package/dist/adapters/ApiDataSource.d.ts

@@ -5,8 +5,11 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  *
- * A DataSource adapter for the `provider: 'api'` ViewData mode.
- * Makes raw HTTP requests using the HttpRequest configs from ViewData.
+ * A DataSource adapter over raw HTTP, built in code from an
+ * `ApiDataSourceConfig` (e.g. the console's approvals inbox). It is not a
+ * `ViewData` mode: the view-level `provider: 'api'` is retired in
+ * `@objectstack/spec` (objectstack#23082), and `resolveDataSource` builds no
+ * `ApiDataSource` (objectui#12325).
  */
 import type { DataSource, BatchTransactionOperation, QueryParams, QueryResult, HttpRequest, AggregateParams, AggregateResult } from '@object-ui/types';
 export interface ApiDataSourceConfig {
@@ -22,8 +25,9 @@ export interface ApiDataSourceConfig {
 /**
  * ApiDataSource — a DataSource adapter for raw HTTP APIs.
  *
- * Used when `ViewData.provider === 'api'`. The read and write HttpRequest
- * configs define the endpoints; all CRUD methods map onto HTTP verbs.
+ * Constructed in code — never resolved from a `ViewData` block (see the file
+ * header). The read and write HttpRequest configs define the endpoints; all
+ * CRUD methods map onto HTTP verbs.
  *
  * Read operations use the `read` config, write operations use the `write` config.
  * Both fall back to each other when one is not provided.