@object-ui/data-objectstack 13.1.0 → 14.0.0

package/CHANGELOG.md

@@ -1,5 +1,87 @@
 # @object-ui/data-objectstack
 
+## 14.0.0
+
+### Minor Changes
+
+- 6a74160: Sharing-rule form: pick, don't type. Three new widget-hint field components make
+  the generic object form render pickers where an admin previously had to type
+  machine data (driven by the framework `widget` hints on `sys_sharing_rule`;
+  generalizes the `capability-multiselect` pattern). All degrade to the underlying
+  `type` renderer when a widget is unregistered.
+
+  - **`object-ref`** — choose a registered object by name (searchable `Combobox`),
+    backed by the new `DataSource.getObjects()` (`ObjectStackAdapter` lists code-
+    and DB-defined objects via `/api/v1/meta/object`), falling back to a
+    `sys_metadata` query. Stores the object's `name`.
+  - **`filter-condition`** — a visual criteria builder (`FilterBuilder`) scoped to
+    the fields of the object chosen in a sibling field (via `getObjectSchema`),
+    round-tripping the stored **MongoDB-style** FilterCondition JSON. Criteria the
+    builder can't represent (or invalid JSON) fall back to a raw-JSON editor, with
+    an always-available "Edit as JSON" toggle — nothing is hidden or lost.
+  - **`recipient-picker`** — a record picker whose target object follows a sibling
+    `recipient_type` (`user`→sys_user, `team`→sys_team, `business_unit`/
+    `unit_and_subordinates`→sys_business_unit, `position`→sys_position), storing the
+    value the evaluator matches on (a record id, or the position **name**). Resets
+    the stored id when the type changes.
+
+  Wiring: the three keys join `DATA_SOURCE_FIELD_TYPES` (form.tsx) so the form
+  threads `dataSource` + `dependentValues` to them, and `INLINE_EXCLUDED_FIELD_TYPES`
+  (they're authored in the record form, not a grid cell). `DataSource.getObjects()`
+  is optional on the interface; the ObjectStack adapter implements it.
+
+### Patch Changes
+
+- Updated dependencies [443360a]
+- Updated dependencies [86c69c3]
+- Updated dependencies [05e56ca]
+- Updated dependencies [6a74160]
+  - @object-ui/core@14.0.0
+  - @object-ui/types@14.0.0
+
+## 13.2.0
+
+### Patch Changes
+
+- e492b9d: Permission sets — pure separation of **design** (Studio) and **assignment**
+  (Setup), per ADR-0056 / epic #2398. A `sys_permission_set` used to render its six
+  authorization facets in Setup as raw `[Object]` / JSON textareas, and only
+  objects+fields were editable in Studio; this reworks both surfaces.
+
+  **Setup (assign + read-only):**
+  - The six facets (`object_permissions`, `field_permissions`, `system_permissions`,
+    `row_level_security`, `tab_permissions`, `admin_scope`) now render read-only on
+    the `sys_permission_set` record page as a compact summary (counts, or capability
+    chips) plus a **“Design in Studio →”** deep-link into the structured editor
+    (`/apps/:appName/metadata/permission/:setName`, env scope). No `[Object]`, no
+    JSON — in the record view, inline edit, and the create/edit form. Implemented as
+    a `permission-facet-link` field widget stamped onto the six fields via the single
+    `ObjectStackAdapter.getObjectSchema` choke point and honored by DetailSection +
+    the record form.
+  - User assignment (add/remove via `sys_user_permission_set`) is surfaced directly
+    on the Setup record page.
+
+  **Studio (design every facet):** the permission matrix editor gains structured
+  editors for the facets that were JSON-only —
+  - **System Capabilities**: a multi-select over the live `sys_capability` registry
+    (scope-grouped, labelled chips).
+  - **Row-Level Security**: per-policy rows (object · operation · enabled) with CEL
+    USING/CHECK.
+  - **Tab Visibility**: per-tab `visible | hidden | default_on | default_off`.
+  - **Delegated Admin Scope**: business-unit + subtree, manage-assignments /
+    -bindings / author-env-sets toggles, and an assignable-permission-sets allowlist.
+    Assignment was moved out of the editor (it is now a Setup act) — the editor is
+    purely a design surface.
+
+  Storage/types are unchanged; editors read/write the draft’s existing parsed
+  fields and tolerate legacy JSON strings on load. Note: env-scope metadata saves of
+  these facets do not yet project onto the queryable `sys_permission_set` data
+  record the Setup summary reads, so a fresh Studio edit isn’t reflected in Setup’s
+  read-only view until the projection refreshes — tracked as a framework follow-up
+  (enforcement reads the authoritative metadata).
+  - @object-ui/types@13.2.0
+  - @object-ui/core@13.2.0
+
 ## 13.1.0
 
 ### Patch Changes

package/dist/index.cjs

@@ -2432,6 +2432,7 @@ var ObjectStackAdapter = class {
         objectName,
         () => this.fetchObjectSchemaFresh(objectName)
       );
+      this.applyFieldWidgetOverrides(objectName, schema);
       return schema;
     } catch (error) {
       const errorObj = error;
@@ -2444,6 +2445,44 @@ var ObjectStackAdapter = class {
       throw createErrorFromResponse(errorObj, `getObjectSchema(${objectName})`);
     }
   }
+  /**
+   * ADR-0056 P2 (epic #2398) — stamp structured-widget hints onto platform
+   * fields whose framework type is a storage primitive (e.g. `textarea`) but
+   * whose authoring UX should be a structured editor. Only the render `widget`
+   * is added; the field's `type` (the storage contract) is untouched. Applied
+   * idempotently to the cached schema so form + detail both honor it. Widget
+   * components are registered as `field:<widget>` in `@object-ui/fields`.
+   */
+  applyFieldWidgetOverrides(objectName, schema) {
+    const OVERRIDES = {
+      // ADR-0056 pure model — a permission set's six authorization facets are
+      // *designed* in Studio's structured editors and only *assigned* (to
+      // users) in Setup. In Setup they render read-only as a summary + a
+      // "Design in Studio →" deep-link (the `permission-facet-link` widget),
+      // never as raw [Object]/JSON. The capability *editor* itself lives in
+      // Studio (epic #2398 P2).
+      sys_permission_set: {
+        object_permissions: "permission-facet-link",
+        field_permissions: "permission-facet-link",
+        system_permissions: "permission-facet-link",
+        row_level_security: "permission-facet-link",
+        tab_permissions: "permission-facet-link",
+        admin_scope: "permission-facet-link"
+      }
+    };
+    const overrides = OVERRIDES[objectName];
+    const fields = schema && typeof schema === "object" ? schema.fields : null;
+    if (!overrides || !fields) return;
+    for (const [fname, widget] of Object.entries(overrides)) {
+      if (Array.isArray(fields)) {
+        const f = fields.find((x) => x?.name === fname);
+        if (f && !f.widget) f.widget = widget;
+      } else {
+        const f = fields[fname];
+        if (f && !f.widget) f.widget = widget;
+      }
+    }
+  }
   /**
    * Fetch a single object's schema while always revalidating the browser cache.
    *
@@ -2486,6 +2525,35 @@ var ObjectStackAdapter = class {
     const data = body && typeof body === "object" && "success" in body && "data" in body ? body.data : body;
     return data && typeof data === "object" && "item" in data ? data.item : data;
   }
+  /**
+   * List every registered object (code- and DB-defined) from the metadata
+   * registry — `GET /api/v1/meta/object`. Returns lightweight `{ name, label }`
+   * headers for object-picker widgets (e.g. the sharing-rule `object-ref`
+   * field). The list endpoint is uncached server-side, so no cache-busting
+   * dance is needed. Returns `[]` on any failure so callers degrade gracefully.
+   */
+  async getObjects() {
+    try {
+      await this.connect();
+      const baseUrl = (this.baseUrl || "").replace(/\/$/, "");
+      const hasApiVersionSuffix = /\/api\/v\d+$/i.test(baseUrl);
+      const metaPath = hasApiVersionSuffix ? "/meta" : "/api/v1/meta";
+      const url = `${baseUrl}${metaPath}/object`;
+      const headers = { "Content-Type": "application/json" };
+      if (this.token) headers["Authorization"] = `Bearer ${this.token}`;
+      const res = await this.fetchImpl(url, { method: "GET", headers });
+      if (!res.ok) return [];
+      const body = await res.json();
+      const data = body && typeof body === "object" && "success" in body && "data" in body ? body.data : body;
+      const items = Array.isArray(data) ? data : Array.isArray(data?.items) ? data.items : [];
+      return items.map((it) => ({
+        name: String(it?.name ?? ""),
+        label: it?.label != null ? String(it.label) : void 0
+      })).filter((it) => it.name);
+    } catch {
+      return [];
+    }
+  }
   /**
    * Get access to the underlying ObjectStack client for advanced operations.
    */

package/dist/index.d.cts

@@ -1530,6 +1530,15 @@ declare class ObjectStackAdapter<T = unknown> implements DataSource<T> {
      * @returns Promise resolving to the object schema
      */
     getObjectSchema(objectName: string): Promise<unknown>;
+    /**
+     * ADR-0056 P2 (epic #2398) — stamp structured-widget hints onto platform
+     * fields whose framework type is a storage primitive (e.g. `textarea`) but
+     * whose authoring UX should be a structured editor. Only the render `widget`
+     * is added; the field's `type` (the storage contract) is untouched. Applied
+     * idempotently to the cached schema so form + detail both honor it. Widget
+     * components are registered as `field:<widget>` in `@object-ui/fields`.
+     */
+    private applyFieldWidgetOverrides;
     /**
      * Fetch a single object's schema while always revalidating the browser cache.
      *
@@ -1548,6 +1557,17 @@ declare class ObjectStackAdapter<T = unknown> implements DataSource<T> {
      * not expose the request cache mode.
      */
     private fetchObjectSchemaFresh;
+    /**
+     * List every registered object (code- and DB-defined) from the metadata
+     * registry — `GET /api/v1/meta/object`. Returns lightweight `{ name, label }`
+     * headers for object-picker widgets (e.g. the sharing-rule `object-ref`
+     * field). The list endpoint is uncached server-side, so no cache-busting
+     * dance is needed. Returns `[]` on any failure so callers degrade gracefully.
+     */
+    getObjects(): Promise<Array<{
+        name: string;
+        label?: string;
+    }>>;
     /**
      * Get access to the underlying ObjectStack client for advanced operations.
      */

package/dist/index.d.ts

@@ -1530,6 +1530,15 @@ declare class ObjectStackAdapter<T = unknown> implements DataSource<T> {
      * @returns Promise resolving to the object schema
      */
     getObjectSchema(objectName: string): Promise<unknown>;
+    /**
+     * ADR-0056 P2 (epic #2398) — stamp structured-widget hints onto platform
+     * fields whose framework type is a storage primitive (e.g. `textarea`) but
+     * whose authoring UX should be a structured editor. Only the render `widget`
+     * is added; the field's `type` (the storage contract) is untouched. Applied
+     * idempotently to the cached schema so form + detail both honor it. Widget
+     * components are registered as `field:<widget>` in `@object-ui/fields`.
+     */
+    private applyFieldWidgetOverrides;
     /**
      * Fetch a single object's schema while always revalidating the browser cache.
      *
@@ -1548,6 +1557,17 @@ declare class ObjectStackAdapter<T = unknown> implements DataSource<T> {
      * not expose the request cache mode.
      */
     private fetchObjectSchemaFresh;
+    /**
+     * List every registered object (code- and DB-defined) from the metadata
+     * registry — `GET /api/v1/meta/object`. Returns lightweight `{ name, label }`
+     * headers for object-picker widgets (e.g. the sharing-rule `object-ref`
+     * field). The list endpoint is uncached server-side, so no cache-busting
+     * dance is needed. Returns `[]` on any failure so callers degrade gracefully.
+     */
+    getObjects(): Promise<Array<{
+        name: string;
+        label?: string;
+    }>>;
     /**
      * Get access to the underlying ObjectStack client for advanced operations.
      */

package/dist/index.js

@@ -2384,6 +2384,7 @@ var ObjectStackAdapter = class {
         objectName,
         () => this.fetchObjectSchemaFresh(objectName)
       );
+      this.applyFieldWidgetOverrides(objectName, schema);
       return schema;
     } catch (error) {
       const errorObj = error;
@@ -2396,6 +2397,44 @@ var ObjectStackAdapter = class {
       throw createErrorFromResponse(errorObj, `getObjectSchema(${objectName})`);
     }
   }
+  /**
+   * ADR-0056 P2 (epic #2398) — stamp structured-widget hints onto platform
+   * fields whose framework type is a storage primitive (e.g. `textarea`) but
+   * whose authoring UX should be a structured editor. Only the render `widget`
+   * is added; the field's `type` (the storage contract) is untouched. Applied
+   * idempotently to the cached schema so form + detail both honor it. Widget
+   * components are registered as `field:<widget>` in `@object-ui/fields`.
+   */
+  applyFieldWidgetOverrides(objectName, schema) {
+    const OVERRIDES = {
+      // ADR-0056 pure model — a permission set's six authorization facets are
+      // *designed* in Studio's structured editors and only *assigned* (to
+      // users) in Setup. In Setup they render read-only as a summary + a
+      // "Design in Studio →" deep-link (the `permission-facet-link` widget),
+      // never as raw [Object]/JSON. The capability *editor* itself lives in
+      // Studio (epic #2398 P2).
+      sys_permission_set: {
+        object_permissions: "permission-facet-link",
+        field_permissions: "permission-facet-link",
+        system_permissions: "permission-facet-link",
+        row_level_security: "permission-facet-link",
+        tab_permissions: "permission-facet-link",
+        admin_scope: "permission-facet-link"
+      }
+    };
+    const overrides = OVERRIDES[objectName];
+    const fields = schema && typeof schema === "object" ? schema.fields : null;
+    if (!overrides || !fields) return;
+    for (const [fname, widget] of Object.entries(overrides)) {
+      if (Array.isArray(fields)) {
+        const f = fields.find((x) => x?.name === fname);
+        if (f && !f.widget) f.widget = widget;
+      } else {
+        const f = fields[fname];
+        if (f && !f.widget) f.widget = widget;
+      }
+    }
+  }
   /**
    * Fetch a single object's schema while always revalidating the browser cache.
    *
@@ -2438,6 +2477,35 @@ var ObjectStackAdapter = class {
     const data = body && typeof body === "object" && "success" in body && "data" in body ? body.data : body;
     return data && typeof data === "object" && "item" in data ? data.item : data;
   }
+  /**
+   * List every registered object (code- and DB-defined) from the metadata
+   * registry — `GET /api/v1/meta/object`. Returns lightweight `{ name, label }`
+   * headers for object-picker widgets (e.g. the sharing-rule `object-ref`
+   * field). The list endpoint is uncached server-side, so no cache-busting
+   * dance is needed. Returns `[]` on any failure so callers degrade gracefully.
+   */
+  async getObjects() {
+    try {
+      await this.connect();
+      const baseUrl = (this.baseUrl || "").replace(/\/$/, "");
+      const hasApiVersionSuffix = /\/api\/v\d+$/i.test(baseUrl);
+      const metaPath = hasApiVersionSuffix ? "/meta" : "/api/v1/meta";
+      const url = `${baseUrl}${metaPath}/object`;
+      const headers = { "Content-Type": "application/json" };
+      if (this.token) headers["Authorization"] = `Bearer ${this.token}`;
+      const res = await this.fetchImpl(url, { method: "GET", headers });
+      if (!res.ok) return [];
+      const body = await res.json();
+      const data = body && typeof body === "object" && "success" in body && "data" in body ? body.data : body;
+      const items = Array.isArray(data) ? data : Array.isArray(data?.items) ? data.items : [];
+      return items.map((it) => ({
+        name: String(it?.name ?? ""),
+        label: it?.label != null ? String(it.label) : void 0
+      })).filter((it) => it.name);
+    } catch {
+      return [];
+    }
+  }
   /**
    * Get access to the underlying ObjectStack client for advanced operations.
    */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/data-objectstack",
-  "version": "13.1.0",
+  "version": "14.0.0",
   "description": "ObjectStack Data Adapter for Object UI",
   "license": "MIT",
   "type": "module",
@@ -22,9 +22,9 @@
     "LICENSE"
   ],
   "dependencies": {
-    "@objectstack/client": "^12.3.0",
-    "@object-ui/core": "13.1.0",
-    "@object-ui/types": "13.1.0"
+    "@objectstack/client": "^14.6.0",
+    "@object-ui/core": "14.0.0",
+    "@object-ui/types": "14.0.0"
   },
   "devDependencies": {
     "tsup": "^8.5.1",

package/src/index.ts

@@ -1608,7 +1608,13 @@ export class ObjectStackAdapter<T = unknown> implements DataSource<T> {
       const schema = await this.metadataCache.get(objectName, () =>
         this.fetchObjectSchemaFresh(objectName),
       );
-      
+
+      // ADR-0056 P2 (epic #2398): stamp structured-widget hints onto specific
+      // platform fields. This is the single choke point both the record form
+      // (ObjectForm) and the detail view (DetailView/DetailSection) read the
+      // schema through, so one pass here reaches every edit surface.
+      this.applyFieldWidgetOverrides(objectName, schema);
+
       return schema;
     } catch (error: unknown) {
       // Check if it's a 404 error
@@ -1626,6 +1632,46 @@ export class ObjectStackAdapter<T = unknown> implements DataSource<T> {
     }
   }
 
+  /**
+   * ADR-0056 P2 (epic #2398) — stamp structured-widget hints onto platform
+   * fields whose framework type is a storage primitive (e.g. `textarea`) but
+   * whose authoring UX should be a structured editor. Only the render `widget`
+   * is added; the field's `type` (the storage contract) is untouched. Applied
+   * idempotently to the cached schema so form + detail both honor it. Widget
+   * components are registered as `field:<widget>` in `@object-ui/fields`.
+   */
+  private applyFieldWidgetOverrides(objectName: string, schema: unknown): void {
+    const OVERRIDES: Record<string, Record<string, string>> = {
+      // ADR-0056 pure model — a permission set's six authorization facets are
+      // *designed* in Studio's structured editors and only *assigned* (to
+      // users) in Setup. In Setup they render read-only as a summary + a
+      // "Design in Studio →" deep-link (the `permission-facet-link` widget),
+      // never as raw [Object]/JSON. The capability *editor* itself lives in
+      // Studio (epic #2398 P2).
+      sys_permission_set: {
+        object_permissions: 'permission-facet-link',
+        field_permissions: 'permission-facet-link',
+        system_permissions: 'permission-facet-link',
+        row_level_security: 'permission-facet-link',
+        tab_permissions: 'permission-facet-link',
+        admin_scope: 'permission-facet-link',
+      },
+    };
+    const overrides = OVERRIDES[objectName];
+    const fields =
+      schema && typeof schema === 'object' ? (schema as { fields?: unknown }).fields : null;
+    if (!overrides || !fields) return;
+    for (const [fname, widget] of Object.entries(overrides)) {
+      if (Array.isArray(fields)) {
+        const f = fields.find((x: any) => x?.name === fname);
+        if (f && !f.widget) f.widget = widget;
+      } else {
+        const f = (fields as Record<string, any>)[fname];
+        if (f && !f.widget) f.widget = widget;
+      }
+    }
+  }
+
   /**
    * Fetch a single object's schema while always revalidating the browser cache.
    *
@@ -1679,6 +1725,49 @@ export class ObjectStackAdapter<T = unknown> implements DataSource<T> {
     return data && typeof data === 'object' && 'item' in data ? data.item : data;
   }
 
+  /**
+   * List every registered object (code- and DB-defined) from the metadata
+   * registry — `GET /api/v1/meta/object`. Returns lightweight `{ name, label }`
+   * headers for object-picker widgets (e.g. the sharing-rule `object-ref`
+   * field). The list endpoint is uncached server-side, so no cache-busting
+   * dance is needed. Returns `[]` on any failure so callers degrade gracefully.
+   */
+  async getObjects(): Promise<Array<{ name: string; label?: string }>> {
+    try {
+      await this.connect();
+      const baseUrl = (this.baseUrl || '').replace(/\/$/, '');
+      // Avoid doubling /api/v1 when baseUrl already carries the version suffix
+      // (mirrors fetchObjectSchemaFresh).
+      const hasApiVersionSuffix = /\/api\/v\d+$/i.test(baseUrl);
+      const metaPath = hasApiVersionSuffix ? '/meta' : '/api/v1/meta';
+      const url = `${baseUrl}${metaPath}/object`;
+
+      const headers: Record<string, string> = { 'Content-Type': 'application/json' };
+      if (this.token) headers['Authorization'] = `Bearer ${this.token}`;
+
+      const res = await this.fetchImpl(url, { method: 'GET', headers });
+      if (!res.ok) return [];
+      const body: any = await res.json();
+      // Unwrap the `{ success, data }` envelope, the `{ type, items }` list
+      // shape, or a bare array.
+      const data =
+        body && typeof body === 'object' && 'success' in body && 'data' in body ? body.data : body;
+      const items: any[] = Array.isArray(data)
+        ? data
+        : Array.isArray(data?.items)
+          ? data.items
+          : [];
+      return items
+        .map((it: any) => ({
+          name: String(it?.name ?? ''),
+          label: it?.label != null ? String(it.label) : undefined,
+        }))
+        .filter((it) => it.name);
+    } catch {
+      return [];
+    }
+  }
+
   /**
    * Get access to the underlying ObjectStack client for advanced operations.
    */