@object-ui/core 17.7.0 → 18.0.0

package/dist/actions/UndoManager.d.ts

@@ -12,19 +12,14 @@
  * pattern for use from ActionRunner, React hooks, and standalone contexts.
  * Maintains bounded history stacks with subscriber notifications.
  */
-/** Represents a single undoable CRUD operation. */
-export interface UndoableOperation {
-    id: string;
-    type: 'create' | 'update' | 'delete';
-    objectName: string;
-    recordId: string;
-    timestamp: number;
-    description: string;
-    /** Data needed to undo: for create=recordId, for update=previousData, for delete=fullRecord */
-    undoData: Record<string, unknown>;
-    /** Data needed to redo: for create=newData, for update=newData, for delete=recordId */
-    redoData: Record<string, unknown>;
-}
+import type { UndoableOperation } from '@object-ui/types';
+/**
+ * A single undoable CRUD operation — declared once, in `@object-ui/types`
+ * (objectui#6349, batch 4), beside the `ActionResult` whose `undo` member it
+ * types, and re-exported here so an import from `@object-ui/core` keeps
+ * resolving to the same type.
+ */
+export type { UndoableOperation } from '@object-ui/types';
 export interface UndoManagerOptions {
     /** Maximum number of operations to retain in history. @default 50 */
     maxHistory?: number;

package/dist/actions/actionKeys.d.ts

@@ -128,7 +128,7 @@ export declare const ACTION_DEF_KEYS: readonly ["type", "actionType", "name", "l
  * test and wrong in shipped code — `@object-ui/types` made the same call for
  * `ActionComponent`. The pin test does the walk and fails the day this drifts.
  */
-export declare const SPEC_ACTION_KEYS: readonly ["_lock", "_lockDocsUrl", "_lockReason", "_lockSource", "_packageId", "_packageVersion", "_provenance", "ai", "aria", "body", "bodyExtra", "bodyShape", "bulkEnabled", "component", "confirmText", "description", "disabled", "errorMessage", "execute", "execution", "icon", "label", "locations", "method", "mode", "name", "newTabUrl", "objectName", "onSuccess", "openIn", "opensInNewTab", "operation", "order", "outcomeMessages", "params", "patch", "recordIdField", "recordIdParam", "refreshAfter", "requiredPermissions", "requiresFeature", "resultDialog", "shortcut", "successMessage", "target", "type", "undoable", "variant", "visible"];
+export declare const SPEC_ACTION_KEYS: readonly ["_lock", "_lockDocsUrl", "_lockReason", "_lockSource", "_packageId", "_packageVersion", "_provenance", "ai", "aria", "body", "bodyExtra", "bodyShape", "bulkEnabled", "component", "confirmText", "description", "disabled", "errorMessage", "execute", "execution", "icon", "label", "locations", "method", "mode", "name", "newTabUrl", "objectName", "onSuccess", "openIn", "opensInNewTab", "operation", "order", "outcomeMessages", "params", "patch", "recordIdField", "recordIdParam", "refreshAfter", "requiredPermissions", "requiresFeature", "requiresMembershipReach", "resultDialog", "shortcut", "successMessage", "target", "type", "undoable", "variant", "visible"];
 /**
  * The `navigation` alias's own spelling of a target, read off the action itself
  * when no nested `navigate` object is present (`ActionRunner.executeNavigation`).

package/dist/actions/actionKeys.js

@@ -296,6 +296,16 @@ export const SPEC_ACTION_KEYS = [
     'refreshAfter',
     'requiredPermissions',
     'requiresFeature',
+    // Added to `ActionSchema` in @objectstack/spec 17.7.0 (objectui#11717): the
+    // organization endpoint (a `MEMBERSHIP_REACH` row) whose membership-grade gate
+    // the action follows, which the spec's parse LOWERS into `visible` over
+    // `current_user.positions` (the same transform that lowers `requiresFeature`
+    // above). Listed for the reason `description` is — this array restates the
+    // spec's declared keys, so an action carrying it is not reported as having an
+    // unknown key. `ActionDef` does NOT declare it and the runner does not read
+    // it; whether it should, beside `requiresFeature`, is not this inventory's
+    // question.
+    'requiresMembershipReach',
     'resultDialog',
     'shortcut',
     'successMessage',

package/dist/actions/index.d.ts

@@ -16,3 +16,4 @@ export * from './actionResponse.js';
 export * from './serverActionHandler.js';
 export * from './recordIdParam.js';
 export * from './recordDelete.js';
+export * from './navigationTarget.js';

package/dist/actions/index.js

@@ -16,3 +16,4 @@ export * from './actionResponse.js';
 export * from './serverActionHandler.js';
 export * from './recordIdParam.js';
 export * from './recordDelete.js';
+export * from './navigationTarget.js';

package/dist/actions/navigationTarget.d.ts

@@ -0,0 +1,41 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * What a click may navigate to, and how.
+ *
+ * This is the one answer, shared by every caller that turns an authored or
+ * served target into a user-click navigation (objectui#12191, ruling A+):
+ *
+ * - the action runner: a `type: 'url'` action, its `navigation` alias (which is
+ *   how an `element:button` CTA reaches it) and `onSuccess.navigate`;
+ * - app-shell's entitlement CTA, `resolveCtaHref`.
+ *
+ * ⛔ No caller keeps a scheme list of its own. A second list is how the runner
+ * came to refuse the `mailto:` target the CTA already admitted, so a mail button
+ * the spec accepts published cleanly and then failed at click.
+ *
+ * The admitted set is closed:
+ *
+ * - `'web'`: `http://` or `https://`. It leaves the app. The caller's `openIn`
+ *   decides the tab.
+ * - `'mail'`: `mailto:`. It leaves the app IN PLACE: never a new tab, and
+ *   `openIn` is not consulted. The mail client opens and the page stays.
+ * - `'path'`: an in-app relative path, `/…` or `./…`.
+ *
+ * Everything else answers `null` and is refused: `javascript:`, `data:`, `tel:`
+ * (not admitted: no measured producer) and every other scheme, and a
+ * protocol-relative `//host`. Two other spellings of `//host` are refused with
+ * it, because the browser's URL parser reads them as `//host`: a backslash in
+ * second place (`/` then a backslash, then `host`), and any target that holds an
+ * ASCII tab, line feed or carriage return, since the parser deletes those three
+ * before it reads anything.
+ *
+ * Scheme names compare case-insensitively, as the URL parser compares them.
+ */
+export type NavigationTargetKind = 'web' | 'mail' | 'path';
+export declare function classifyNavigationTarget(url: unknown): NavigationTargetKind | null;

package/dist/actions/navigationTarget.js

@@ -0,0 +1,20 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+export function classifyNavigationTarget(url) {
+    if (typeof url !== 'string' || /[\t\n\r]/.test(url))
+        return null;
+    if (/^https?:\/\//i.test(url))
+        return 'web';
+    if (/^mailto:/i.test(url))
+        return 'mail';
+    if (url.startsWith('./'))
+        return 'path';
+    if (url.startsWith('/') && url[1] !== '/' && url[1] !== '\\')
+        return 'path';
+    return null;
+}

package/dist/actions/recordDelete.d.ts

@@ -17,8 +17,9 @@
  * `object-view` renderer (`plugin-view`) had no delete at all — its grid
  * handlers only refreshed — and the first repair COPIED those steps into a
  * second flow. The copy already diverged on consent: it asked every row the
- * plain "delete this record?" question, while the console asks a package-owned
- * permission set the honest reset question. One operation with two
+ * plain "delete this record?" question, while the console asked a package-owned
+ * permission set the reset question (that question went with the catalog
+ * objects, ADR-0131). One operation with two
  * implementations drifts on exactly the part that matters, so the rule is: the
  * side with the governance keeps it, the other side re-binds to it, and there
  * is one copy. This module is that copy, and both hosts call it.
@@ -26,20 +27,20 @@
  * `@object-ui/core` is the lowest package both hosts already depend on. The
  * host-specific pieces are INJECTED — the translator, the toast sink, the data
  * source and the refresh — so this package gains no i18n or toast dependency.
- * The host keeps its own confirm UI (`app-shell` runs the question through the
- * action runner's confirm handler; `plugin-view` renders it in its own
- * AlertDialog); the QUESTION comes from {@link recordDelete}.confirmText.
+ * The host keeps its own confirm UI (`app-shell` hands the copy to the console's
+ * confirm handler; `plugin-view` renders it in its own AlertDialog); the COPY —
+ * title, body and confirm-button label — comes from
+ * {@link recordDelete}.confirmCopy, whose body for one record is
+ * {@link recordDelete}.confirmText.
  *
- * ## ADR-0094 — a package-owned permission set is RESET, not deleted
+ * ## The confirmation names what it deletes (objectui#11695)
  *
- * "Deleting" a `sys_permission_set` row whose `managed_by` is `'package'` does
- * not remove it: the backend drops the environment overlay and resets the set
- * to its shipped baseline. So the confirm asks the reset question and the
- * success toast says "reset" — a promise of an irreversible delete the user can
- * then see did not happen would be the dishonest copy. The row passed in is
- * read first; when the caller has only an id (an SDUI header delete), the row
- * is looked up with `findOne`, best-effort — a failed lookup falls back to the
- * generic copy rather than blocking the delete.
+ * A generic "Confirm Action" / "Continue" dialog never said WHICH record was
+ * about to go, nor that the click is a delete. The title names the record by
+ * the ONE ADR-0079 display-name resolver ({@link getRecordDisplayName}, the
+ * resolver the record header and lookups use), and the object label — or, for
+ * a batch, the count. The confirm button reads as the deletion it is; every
+ * host paints it in the destructive button style.
  *
  * ## The result shape is the action runner's, on purpose
  *
@@ -66,7 +67,6 @@ interface RecordDeleteDeps {
     label: string;
     dataSource: {
         delete(resource: string, id: string): Promise<unknown>;
-        findOne(resource: string, id: string): Promise<unknown>;
     };
     /** The host's toast sink (sonner's `toast` in both hosts today). */
     toast: {
@@ -92,25 +92,61 @@ interface RecordDeleteRequest {
     };
     recordId?: unknown;
 }
+/**
+ * The copy of a delete confirmation — everything a host's confirm dialog shows,
+ * from {@link recordDelete}.confirmCopy (objectui#11695).
+ */
+export interface RecordDeleteConfirmCopy {
+    /** The dialog title: names the record and its object, or the batch size. */
+    title: string;
+    /** The dialog body: the delete question, or the batch question. */
+    message: string;
+    /** The confirm button's label: a deletion verb, painted destructive by the host. */
+    confirmText: string;
+}
+/**
+ * What a delete confirmation is about: ONE record (its row — at least its
+ * `id`, so a nameless row still reads by the resolver's `Record #id` floor) or
+ * a batch (how many).
+ */
+export type RecordDeleteConfirmTarget = {
+    record: Row | null | undefined;
+} | {
+    count: number;
+};
 /**
  * The record-delete core: `confirmText` is the question to ask before deleting
  * one record, `run` performs the delete (one record, or several settled
- * together) and reports it. See the module docblock for objectui#10383 and
- * ADR-0094.
+ * together) and reports it. See the module docblock for objectui#10383.
  */
 export declare const recordDelete: Readonly<{
     /**
-     * The question to ask before deleting ONE record: the reset question for a
-     * package-owned permission set (ADR-0094), the plain delete question
-     * otherwise. Reads only the row it is handed — no lookup.
+     * The question to ask before deleting ONE record — the body of
+     * {@link recordDelete}.confirmCopy.
+     */
+    confirmText(deps: Pick<RecordDeleteDeps, "t">): string;
+    /**
+     * The whole delete confirmation — title, body and confirm-button label — for
+     * ONE record or a batch (objectui#11695). Every host's delete dialog shows
+     * this copy, so the list's row Delete, its bulk Delete and the record page's
+     * Delete say the same thing.
+     *
+     * One record: the title names it — the object label plus the record's
+     * display name from {@link getRecordDisplayName}, reading `objectDef`'s
+     * declared name field when the host has the definition — and the body is
+     * {@link recordDelete}.confirmText. A batch: the title counts it. The confirm
+     * button is the delete verb in both, which the host paints destructive.
      */
-    confirmText(deps: Pick<RecordDeleteDeps, "objectName" | "t">, record?: Row | null): string;
+    confirmCopy(deps: Pick<RecordDeleteDeps, "objectName" | "t" | "label"> & {
+        /** The object definition, so the name follows its declared `nameField`. */
+        objectDef?: unknown;
+    }, target: RecordDeleteConfirmTarget): RecordDeleteConfirmCopy;
     /**
      * Delete, refresh and report. Several records (`params.records`, more than
      * one with an `id`) are deleted one call each and settled together, then the
      * list refreshes and ONE summary toast reports the batch. Otherwise one
-     * record is deleted; on success the list refreshes and a success toast shows
-     * (the reset copy for a package-owned permission set), on failure an error
+     * record is deleted; on success the list refreshes and a success toast shows,
+     * on failure an error
      * toast carries the error message and the list is left as it is.
      */
     run(deps: RecordDeleteDeps, request: RecordDeleteRequest): Promise<ActionResult>;

package/dist/actions/recordDelete.js

@@ -5,38 +5,57 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  */
-const PERMISSION_SET_OBJECT = 'sys_permission_set';
-/** ADR-0094: is this permission-set row owned by an installed package? */
-function isPackageOwned(row) {
-    return row?.managed_by === 'package';
-}
+import { getRecordDisplayName } from '../utils/record-title.js';
 /**
  * The record-delete core: `confirmText` is the question to ask before deleting
  * one record, `run` performs the delete (one record, or several settled
- * together) and reports it. See the module docblock for objectui#10383 and
- * ADR-0094.
+ * together) and reports it. See the module docblock for objectui#10383.
  */
 export const recordDelete = Object.freeze({
     /**
-     * The question to ask before deleting ONE record: the reset question for a
-     * package-owned permission set (ADR-0094), the plain delete question
-     * otherwise. Reads only the row it is handed — no lookup.
+     * The question to ask before deleting ONE record — the body of
+     * {@link recordDelete}.confirmCopy.
      */
-    confirmText(deps, record) {
-        const { objectName, t } = deps;
-        return objectName === PERMISSION_SET_OBJECT && isPackageOwned(record)
-            ? t('objectActions.resetPackageSetConfirm', {
-                defaultValue: 'This permission set ships with an installed package and cannot be removed. ' +
-                    'Deleting resets it to the shipped baseline and discards your environment customization. Continue?',
-            })
-            : t('objectActions.deleteConfirm');
+    confirmText(deps) {
+        return deps.t('objectActions.deleteConfirm');
+    },
+    /**
+     * The whole delete confirmation — title, body and confirm-button label — for
+     * ONE record or a batch (objectui#11695). Every host's delete dialog shows
+     * this copy, so the list's row Delete, its bulk Delete and the record page's
+     * Delete say the same thing.
+     *
+     * One record: the title names it — the object label plus the record's
+     * display name from {@link getRecordDisplayName}, reading `objectDef`'s
+     * declared name field when the host has the definition — and the body is
+     * {@link recordDelete}.confirmText. A batch: the title counts it. The confirm
+     * button is the delete verb in both, which the host paints destructive.
+     */
+    confirmCopy(deps, target) {
+        const { t, label } = deps;
+        const confirmText = t('objectActions.deleteConfirmButton');
+        if ('count' in target) {
+            return {
+                title: t('objectActions.bulkDeleteConfirmTitle', { count: target.count, label }),
+                message: t('console.objectView.bulkDeleteConfirm', { count: target.count }),
+                confirmText,
+            };
+        }
+        return {
+            title: t('objectActions.deleteConfirmTitle', {
+                label,
+                name: getRecordDisplayName(deps.objectDef, target.record),
+            }),
+            message: recordDelete.confirmText(deps),
+            confirmText,
+        };
     },
     /**
      * Delete, refresh and report. Several records (`params.records`, more than
      * one with an `id`) are deleted one call each and settled together, then the
      * list refreshes and ONE summary toast reports the batch. Otherwise one
-     * record is deleted; on success the list refreshes and a success toast shows
-     * (the reset copy for a package-owned permission set), on failure an error
+     * record is deleted; on success the list refreshes and a success toast shows,
+     * on failure an error
      * toast carries the error message and the list is left as it is.
      */
     async run(deps, request) {
@@ -73,31 +92,10 @@ export const recordDelete = Object.freeze({
         const recordId = params?.recordId ?? params?.record?.id ?? records?.[0]?.id ?? request.recordId;
         if (!recordId)
             return { success: false, error: t('objectActions.noRecordId') };
-        // [ADR-0094] Detect the reset BEFORE the delete (the row still exists), so
-        // the success toast tells the truth. A caller that passed the row spares
-        // the lookup.
-        let packagedSetReset = false;
-        if (objectName === PERMISSION_SET_OBJECT) {
-            try {
-                const row = params?.record?.managed_by !== undefined
-                    ? params.record
-                    : await dataSource.findOne(objectName, recordId);
-                packagedSetReset = isPackageOwned(row);
-            }
-            catch { /* best-effort — fall back to the generic delete copy */ }
-        }
         try {
             await dataSource.delete(objectName, recordId);
             onRefresh?.();
-            toast.success(packagedSetReset
-                // No `label` argument, unlike `deleteSuccess` below: this sentence
-                // names the permission set by kind rather than by label, so none of
-                // the ten packs has a `{{label}}` hole and i18next would drop the
-                // argument in silence (objectui#3845).
-                ? t('objectActions.resetPackageSetSuccess', {
-                    defaultValue: 'Permission set reset to its shipped baseline',
-                })
-                : t('objectActions.deleteSuccess', { label }));
+            toast.success(t('objectActions.deleteSuccess', { label }));
             return { success: true, reload: true, silent: true };
         }
         catch (err) {

package/dist/adapters/ApiDataSource.d.ts

@@ -5,8 +5,11 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  *
- * A DataSource adapter for the `provider: 'api'` ViewData mode.
- * Makes raw HTTP requests using the HttpRequest configs from ViewData.
+ * A DataSource adapter over raw HTTP, built in code from an
+ * `ApiDataSourceConfig` (e.g. the console's approvals inbox). It is not a
+ * `ViewData` mode: the view-level `provider: 'api'` is retired in
+ * `@objectstack/spec` (objectstack#23082), and `resolveDataSource` builds no
+ * `ApiDataSource` (objectui#12325).
  */
 import type { DataSource, BatchTransactionOperation, QueryParams, QueryResult, HttpRequest, AggregateParams, AggregateResult } from '@object-ui/types';
 export interface ApiDataSourceConfig {
@@ -22,8 +25,9 @@ export interface ApiDataSourceConfig {
 /**
  * ApiDataSource — a DataSource adapter for raw HTTP APIs.
  *
- * Used when `ViewData.provider === 'api'`. The read and write HttpRequest
- * configs define the endpoints; all CRUD methods map onto HTTP verbs.
+ * Constructed in code — never resolved from a `ViewData` block (see the file
+ * header). The read and write HttpRequest configs define the endpoints; all
+ * CRUD methods map onto HTTP verbs.
  *
  * Read operations use the `read` config, write operations use the `write` config.
  * Both fall back to each other when one is not provided.

package/dist/adapters/ApiDataSource.js

@@ -5,8 +5,11 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  *
- * A DataSource adapter for the `provider: 'api'` ViewData mode.
- * Makes raw HTTP requests using the HttpRequest configs from ViewData.
+ * A DataSource adapter over raw HTTP, built in code from an
+ * `ApiDataSourceConfig` (e.g. the console's approvals inbox). It is not a
+ * `ViewData` mode: the view-level `provider: 'api'` is retired in
+ * `@objectstack/spec` (objectstack#23082), and `resolveDataSource` builds no
+ * `ApiDataSource` (objectui#12325).
  */
 import { emulateBatchTransaction } from './batchTransaction.js';
 // ---------------------------------------------------------------------------
@@ -91,8 +94,9 @@ function mergeHeaders(base, override) {
 /**
  * ApiDataSource — a DataSource adapter for raw HTTP APIs.
  *
- * Used when `ViewData.provider === 'api'`. The read and write HttpRequest
- * configs define the endpoints; all CRUD methods map onto HTTP verbs.
+ * Constructed in code — never resolved from a `ViewData` block (see the file
+ * header). The read and write HttpRequest configs define the endpoints; all
+ * CRUD methods map onto HTTP verbs.
  *
  * Read operations use the `read` config, write operations use the `write` config.
  * Both fall back to each other when one is not provided.
@@ -144,7 +148,7 @@ export class ApiDataSource {
     async request(base, options = {}) {
         if (!base) {
             throw new Error('ApiDataSource: No HTTP configuration provided for this operation. ' +
-                'Ensure the ViewData has read/write configs.');
+                'Ensure the ApiDataSourceConfig has read/write configs.');
         }
         const method = options.method ?? base.method ?? 'GET';
         // Merge query params: base.params + extra queryParams
@@ -213,8 +217,16 @@ export class ApiDataSource {
             });
             return raw ?? null;
         }
-        catch {
-            return null;
+        catch (err) {
+            // `null` is "not found", and only a 404 says that. Every other failure
+            // (a refusal, a 5xx, a transport error) rejects, as `ObjectStackAdapter`
+            // does, so a record page can tell "no access" and "could not load" from
+            // "not found" (objectui#11902, objectui#12032). The status is read from
+            // the message `request` above composes ("ApiDataSource: HTTP 404 …").
+            if (err instanceof Error && /^ApiDataSource: HTTP 404\b/.test(err.message)) {
+                return null;
+            }
+            throw err;
         }
     }
     async create(_resource, data) {

package/dist/adapters/resolveDataSource.d.ts

@@ -9,10 +9,6 @@
  */
 import type { DataSource, ViewData } from '@object-ui/types';
 export interface ResolveDataSourceOptions {
-    /** Custom fetch implementation passed to ApiDataSource */
-    fetch?: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
-    /** Default headers for API requests */
-    defaultHeaders?: Record<string, string>;
     /** Custom ID field for ValueDataSource */
     idField?: string;
 }
@@ -20,9 +16,16 @@ export interface ResolveDataSourceOptions {
  * Resolve a ViewData configuration into a concrete DataSource instance.
  *
  * - `provider: 'object'` → returns `fallback` (the context DataSource — typically ObjectStackAdapter)
- * - `provider: 'api'`    → returns a new `ApiDataSource`
  * - `provider: 'value'`  → returns a new `ValueDataSource`
  *
+ * There is no `provider: 'api'` arm. The view-level `api` data source is
+ * retired in `@objectstack/spec` (objectstack#23082, ADR-0049): a view binds
+ * its object or static rows, and a metadata-declared API call is the page
+ * element's `dataSource` binding. A view block that still says `api` is an
+ * unknown provider here and gets the same answer as one, so no request is
+ * ever built from its `read` / `write` (objectui#12325). Code that needs raw
+ * HTTP constructs `ApiDataSource` itself, from an `ApiDataSourceConfig`.
+ *
  * @param viewData - The ViewData configuration from the schema
  * @param fallback - The default DataSource from context (for `provider: 'object'`)
  * @param options  - Additional options for adapter construction
@@ -31,7 +34,7 @@ export interface ResolveDataSourceOptions {
  * @example
  * ```ts
  * const ds = resolveDataSource(
- *   { provider: 'api', read: { url: '/api/users' } },
+ *   { provider: 'value', items: [{ id: '1', name: 'Ada' }] },
  *   contextDataSource,
  * );
  * const result = await ds.find('users');

package/dist/adapters/resolveDataSource.js

@@ -7,15 +7,21 @@
  *
  * Factory function to create the right DataSource from a ViewData config.
  */
-import { ApiDataSource } from './ApiDataSource.js';
 import { ValueDataSource } from './ValueDataSource.js';
 /**
  * Resolve a ViewData configuration into a concrete DataSource instance.
  *
  * - `provider: 'object'` → returns `fallback` (the context DataSource — typically ObjectStackAdapter)
- * - `provider: 'api'`    → returns a new `ApiDataSource`
  * - `provider: 'value'`  → returns a new `ValueDataSource`
  *
+ * There is no `provider: 'api'` arm. The view-level `api` data source is
+ * retired in `@objectstack/spec` (objectstack#23082, ADR-0049): a view binds
+ * its object or static rows, and a metadata-declared API call is the page
+ * element's `dataSource` binding. A view block that still says `api` is an
+ * unknown provider here and gets the same answer as one, so no request is
+ * ever built from its `read` / `write` (objectui#12325). Code that needs raw
+ * HTTP constructs `ApiDataSource` itself, from an `ApiDataSourceConfig`.
+ *
  * @param viewData - The ViewData configuration from the schema
  * @param fallback - The default DataSource from context (for `provider: 'object'`)
  * @param options  - Additional options for adapter construction
@@ -24,7 +30,7 @@ import { ValueDataSource } from './ValueDataSource.js';
  * @example
  * ```ts
  * const ds = resolveDataSource(
- *   { provider: 'api', read: { url: '/api/users' } },
+ *   { provider: 'value', items: [{ id: '1', name: 'Ada' }] },
  *   contextDataSource,
  * );
  * const result = await ds.find('users');
@@ -38,15 +44,6 @@ export function resolveDataSource(viewData, fallback, options) {
         case 'object':
             // Delegate to the context DataSource (ObjectStackAdapter, etc.)
             return fallback ?? null;
-        case 'api': {
-            const config = {
-                read: viewData.read,
-                write: viewData.write,
-                fetch: options?.fetch,
-                defaultHeaders: options?.defaultHeaders,
-            };
-            return new ApiDataSource(config);
-        }
         case 'value':
             return new ValueDataSource({
                 items: (viewData.items ?? []),

package/dist/data-scope/ViewDataProvider.d.ts

@@ -9,11 +9,14 @@
  * @object-ui/core - View Data Provider
  *
  * Resolves @objectstack/spec ViewData discriminated union into
- * a unified data access interface. Supports three data modes:
+ * a unified data access interface. Supports two data modes:
  *
  * 1. 'object' — Metadata-driven via ObjectStack API (object name → fields/records)
- * 2. 'api' — Custom REST API endpoints (read/write URLs)
- * 3. 'value' — Static data (pre-loaded items array)
+ * 2. 'value' — Static data (pre-loaded items array)
+ *
+ * The view-level `'api'` mode is retired in `@objectstack/spec`
+ * (objectstack#23082, ADR-0049) and has no arm here (objectui#12325): a
+ * config that still names it resolves as an unknown provider, with an error.
  *
  * @module data-scope
  * @packageDocumentation
@@ -23,18 +26,6 @@ import { type ElementDataSourceConfig, type ElementSavedView } from './element-d
 export type ViewDataConfig = {
     provider: 'object';
     object: string;
-} | {
-    provider: 'api';
-    read: {
-        url: string;
-        method?: string;
-        headers?: Record<string, string>;
-    };
-    write?: {
-        url: string;
-        method?: string;
-        headers?: Record<string, string>;
-    };
 } | {
     provider: 'value';
     items: any[];
@@ -72,12 +63,6 @@ export interface DataFetcher {
             required?: boolean;
         }>;
     }>;
-    /** Fetch from a custom API URL */
-    fetchUrl?(url: string, options?: {
-        method?: string;
-        headers?: Record<string, string>;
-        body?: any;
-    }): Promise<any>;
     /**
      * Fetch the object's saved views, so an `ElementDataSource.view` name can be
      * resolved to real columns / filter / sort (objectstack#5576).
@@ -110,7 +95,7 @@ export interface ResolvedData {
         }>;
     };
     /** Provider type */
-    provider: 'object' | 'api' | 'value';
+    provider: 'object' | 'value';
     /** Loading state */
     loading: boolean;
     /** Error */
@@ -143,8 +128,6 @@ export declare class ViewDataProvider {
     }): Promise<ResolvedData>;
     /** Resolve static value data */
     private resolveValue;
-    /** Resolve API-based data */
-    private resolveApi;
     /** Resolve object-based data (metadata-driven) */
     private resolveObject;
     /**