@object-ui/core 5.1.1 → 5.2.1

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # @object-ui/core
 
+## 5.2.1
+
+### Patch Changes
+
+- @object-ui/types@5.2.1
+
+## 5.2.0
+
+### Minor Changes
+
+- de0c5e6: Add `DataSource.bulkDelete(resource, ids)` as the symmetric counterpart
+  to `bulkUpdate`. Implemented in `data-objectstack` via the client's
+  `deleteMany` primitive with a per-id fallback that emulates
+  `continueOnError` semantics for older clients.
+
+  Extract the bulk-vs-per-row decision into a reusable
+  `executeBulkBatch(input, ops)` helper in `@object-ui/core`:
+  - Single decision tree shared by both update and delete fast paths.
+  - Bulk success → no per-row pass.
+  - Bulk partial-count → aggregate batch error.
+  - Bulk throw → per-row fallback so users still get id-level error detail.
+
+  `useBulkExecutor` in plugin-grid now uses the helper for both `update`
+  and `delete` batches, cutting "delete 500 selected rows" from 500 HTTP
+  requests down to ~3.
+
+### Patch Changes
+
+- d1442e3: test(core): comprehensive security + correctness tests for SafeExpressionParser
+
+  Add a ~50-case suite covering literals, operators, ternary, property
+  access, calls/arrows, and a full security section (blocks
+  `constructor` / `__proto__` / `prototype` / `__defineGetter__` /
+  `__defineSetter__`, denies `eval` / `Function` / `window` / `process`,
+  rejects assignment syntax). No production code changes.
+
+- Updated dependencies [de0c5e6]
+- Updated dependencies [9997cae]
+- Updated dependencies [70b5570]
+  - @object-ui/types@5.2.0
+
 ## 5.1.1
 
 ### Patch Changes

package/dist/actions/bulkFastPath.d.ts

@@ -0,0 +1,85 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Outcome of a single batch execution. Mirrors the fields callers care
+ * about so they can fold these into their own aggregate result.
+ */
+export interface BulkBatchOutcome {
+    succeeded: number;
+    failed: number;
+    errors: Array<{
+        id: string;
+        error: string;
+    }>;
+}
+/**
+ * Pluggable callbacks for the executor. Either of these is wired by the
+ * caller — typically `bulkCall` issues 1 HTTP request and `perRow` is
+ * the per-id fallback used when the bulk endpoint is unavailable or
+ * throws. We never call both for the same batch in the same pass.
+ */
+export interface BulkBatchOps {
+    /**
+     * One server call that mutates every id in the batch with the same
+     * shape. Returns the count of rows the server reports as succeeded.
+     * Throws when the entire request fails (network, 500, auth) — that
+     * signals "fall back to per-row" upstream.
+     */
+    bulkCall?: (ids: string[]) => Promise<number>;
+    /**
+     * Per-row mutation. Called once per id in the batch when bulk is
+     * unavailable, when bulk throws, or when the batch is too small for
+     * bulk to be worth it. Resolve = success; reject = failure with the
+     * reason captured into `errors`.
+     */
+    perRow: (id: string) => Promise<unknown>;
+}
+export interface BulkBatchInput {
+    /**
+     * Stable ids for this batch. Empty strings and nulls must already be
+     * filtered out by the caller — this helper trusts the contract.
+     */
+    ids: string[];
+    /**
+     * Original batch size before id-stripping. Used to attribute "missing
+     * id" failures in the caller's error report.
+     */
+    originalSize: number;
+    /**
+     * Index of the first row of this batch within the run. Used to build
+     * stable aggregate-error ids like `batch_0`, `batch_200` etc.
+     */
+    offset: number;
+    /**
+     * When true, the helper is allowed to issue `bulkCall`. When false
+     * (e.g. single-row batches where bulk is no win) it goes straight to
+     * the per-row path.
+     */
+    allowBulk: boolean;
+    /**
+     * Human-readable operation label folded into aggregate error
+     * messages ("bulk update", "bulk delete"). Defaults to "bulk".
+     */
+    label?: string;
+}
+/**
+ * Execute one batch with bulk-first / per-row-fallback semantics.
+ *
+ * Decision tree:
+ * 1. `allowBulk` AND `ops.bulkCall` provided → call it.
+ *    - returned `n === ids.length` → all good, no per-row pass.
+ *    - returned `n < ids.length`   → aggregate error for the shortfall,
+ *      no per-row pass (the server already accepted the request; calling
+ *      per-row would re-mutate the rows that already succeeded).
+ *    - threw                       → fall through to per-row to recover
+ *      actionable per-id error detail for the user.
+ * 2. Otherwise → per-row via Promise.allSettled.
+ *
+ * Symmetric for update + delete + any future same-shape bulk op.
+ */
+export declare function executeBulkBatch(input: BulkBatchInput, ops: BulkBatchOps): Promise<BulkBatchOutcome>;

package/dist/actions/bulkFastPath.js

@@ -0,0 +1,59 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Execute one batch with bulk-first / per-row-fallback semantics.
+ *
+ * Decision tree:
+ * 1. `allowBulk` AND `ops.bulkCall` provided → call it.
+ *    - returned `n === ids.length` → all good, no per-row pass.
+ *    - returned `n < ids.length`   → aggregate error for the shortfall,
+ *      no per-row pass (the server already accepted the request; calling
+ *      per-row would re-mutate the rows that already succeeded).
+ *    - threw                       → fall through to per-row to recover
+ *      actionable per-id error detail for the user.
+ * 2. Otherwise → per-row via Promise.allSettled.
+ *
+ * Symmetric for update + delete + any future same-shape bulk op.
+ */
+export async function executeBulkBatch(input, ops) {
+    const { ids, allowBulk, offset, label = 'bulk' } = input;
+    const outcome = { succeeded: 0, failed: 0, errors: [] };
+    if (allowBulk && typeof ops.bulkCall === 'function') {
+        try {
+            const n = await ops.bulkCall(ids);
+            const bulkSucceeded = Math.max(0, Math.min(n, ids.length));
+            outcome.succeeded += bulkSucceeded;
+            const bulkFailed = ids.length - bulkSucceeded;
+            if (bulkFailed > 0) {
+                outcome.failed += bulkFailed;
+                outcome.errors.push({
+                    id: `batch_${offset}`,
+                    error: `${bulkFailed} record${bulkFailed === 1 ? '' : 's'} failed in ${label}`,
+                });
+            }
+            return outcome;
+        }
+        catch {
+            // Fall through to per-row — gives the user actionable detail.
+        }
+    }
+    const settled = await Promise.allSettled(ids.map((id) => ops.perRow(id)));
+    settled.forEach((res, idx) => {
+        if (res.status === 'fulfilled') {
+            outcome.succeeded += 1;
+        }
+        else {
+            outcome.failed += 1;
+            outcome.errors.push({
+                id: ids[idx],
+                error: res.reason instanceof Error ? res.reason.message : String(res.reason),
+            });
+        }
+    });
+    return outcome;
+}

package/dist/actions/index.d.ts

@@ -9,3 +9,4 @@ export * from './ActionRunner.js';
 export * from './ActionEngine.js';
 export * from './TransactionManager.js';
 export * from './UndoManager.js';
+export * from './bulkFastPath.js';

package/dist/actions/index.js

@@ -9,3 +9,4 @@ export * from './ActionRunner.js';
 export * from './ActionEngine.js';
 export * from './TransactionManager.js';
 export * from './UndoManager.js';
+export * from './bulkFastPath.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/core",
-  "version": "5.1.1",
+  "version": "5.2.1",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",
@@ -28,7 +28,7 @@
     "@objectstack/spec": "^4.0.5",
     "lodash": "^4.18.1",
     "zod": "^4.4.3",
-    "@object-ui/types": "5.1.1"
+    "@object-ui/types": "5.2.1"
   },
   "devDependencies": {
     "typescript": "^6.0.3",