@object-ui/data-objectstack 17.7.0 → 18.0.0

package/dist/index.cjs

@@ -45,13 +45,12 @@ __export(index_exports, {
   OBJECT_METADATA_TYPE: () => OBJECT_METADATA_TYPE,
   ObjectStackAdapter: () => ObjectStackAdapter,
   ObjectStackError: () => ObjectStackError,
+  PREFERENCE_FAMILY_ROW_LIMIT: () => PREFERENCE_FAMILY_ROW_LIMIT,
   RELATIONSHIP_TYPES_REQUIRING_REFERENCE: () => RELATIONSHIP_TYPES_REQUIRING_REFERENCE,
   UNRECOGNIZED_DROP_REASON: () => UNRECOGNIZED_DROP_REASON,
   UnlowerableAnalyticsFilterError: () => UnlowerableAnalyticsFilterError,
   UnloweredAggregateWhereError: () => UnloweredAggregateWhereError,
-  VIEW_CONFIG_CAPABILITY: () => VIEW_CONFIG_CAPABILITY,
   VIEW_OVERLAY_OWNED_KEYS: () => VIEW_OVERLAY_OWNED_KEYS,
-  ViewConfigPermissionDeniedError: () => ViewConfigPermissionDeniedError,
   assertObjectMetadataWritable: () => assertObjectMetadataWritable,
   classifyAnalyticsFailure: () => classifyAnalyticsFailure,
   classifyImportMappingsFailure: () => classifyImportMappingsFailure,
@@ -59,13 +58,17 @@ __export(index_exports, {
   clearSharedDiscoveryCache: () => clearSharedDiscoveryCache,
   createErrorFromResponse: () => createErrorFromResponse,
   createObjectStackAdapter: () => createObjectStackAdapter,
+  createObjectStackUserPreferenceFamily: () => createObjectStackUserPreferenceFamily,
   createObjectStackUserStateAdapter: () => createObjectStackUserStateAdapter,
   createQuietHttpLogger: () => createQuietHttpLogger,
+  draftChangesUnder: () => draftChangesUnder,
+  dropServedPicklistOptions: () => dropServedPicklistOptions,
   extractDraftBody: () => extractDraftBody,
   formatHttpFailureMessage: () => formatHttpFailureMessage,
   formatMetadataError: () => formatMetadataError,
   formatMetadataIssue: () => formatMetadataIssue,
   getSharedDiscovery: () => getSharedDiscovery,
+  governingDraftChange: () => governingDraftChange,
   is404Error: () => is404Error,
   isAnalyticsNotInstalledError: () => isAnalyticsNotInstalledError,
   isApiAccessDeniedError: () => isApiAccessDeniedError,
@@ -75,9 +78,9 @@ __export(index_exports, {
   isMalformedFilterError: () => isMalformedFilterError,
   isMetaItemAbsentError: () => isMetaItemAbsentError,
   isObjectStackError: () => isObjectStackError,
-  isViewConfigPermissionDeniedError: () => isViewConfigPermissionDeniedError,
   narrowPersonalizationOverlay: () => narrowPersonalizationOverlay,
   normaliseClientError: () => normaliseClientError,
+  readDraftChanges: () => readDraftChanges,
   readSaveAdvisories: () => readSaveAdvisories,
   readTransactionalBatchCapability: () => readTransactionalBatchCapability,
   serializeOrderBy: () => serializeOrderBy,
@@ -89,6 +92,7 @@ var import_ui2 = require("@objectstack/spec/ui");
 var import_data4 = require("@objectstack/spec/data");
 var import_data5 = require("@objectstack/spec/data");
 var import_data6 = require("@objectstack/spec/data");
+var import_api3 = require("@objectstack/spec/api");
 var import_kernel2 = require("@objectstack/spec/kernel");
 
 // src/metadata-client.ts
@@ -133,20 +137,20 @@ function fieldEntries(fields) {
   }
   return [];
 }
-function assertObjectMetadataWritable(type, item, writer) {
+function assertObjectMetadataWritable(type, item, _writer) {
   if (String(type) !== OBJECT_METADATA_TYPE) return;
   if (!item || typeof item !== "object") return;
   const fields = item.fields;
   for (const { name, def } of fieldEntries(fields)) {
     if (CHOICE_TYPES_REQUIRING_OPTIONS.includes(String(def.type)) && !hasOptionSource(def)) {
       throw new Error(
-        `${writer} refused this object metadata write: the field \`${name}\` is a \`${String(def.type)}\` with no options: it carries ${describeOptions(def.options)}, so it offers nothing to choose and nothing to check a stored value against. A choice field needs at least one option or a shared \`picklist\` (objectstack#20827), so this draft stays here until it has one. Add an option, or change the field to a non-choice type.`
+        `The object was not saved: the field \`${name}\` is a \`${String(def.type)}\` with no options: it carries ${describeOptions(def.options)}, so it offers nothing to choose and nothing to check a stored value against. A choice field needs at least one option or a shared \`picklist\`, so this draft stays here until it has one. Add an option, or change the field to a non-choice type.`
       );
     }
     if (!RELATIONSHIP_TYPES_REQUIRING_REFERENCE.includes(String(def.type))) continue;
     if (isUsableTarget(def.reference)) continue;
     throw new Error(
-      `${writer} refused this object metadata write: the field \`${name}\` is a \`${String(def.type)}\` and carries ${describeTarget(def.reference)}, so it names no object to link to. \`@objectstack/spec\` refuses the same document at the server with a 422 on \`fields.${name}.reference\`, and that refusal blocks every later save of this object for as long as the half-filled field rides along in the draft (objectui#7714). Pick the target object, or change the field to a non-relationship type.`
+      `The object was not saved: the field \`${name}\` is a \`${String(def.type)}\` and carries ${describeTarget(def.reference)}, so it names no object to link to. The server refuses the same document with a 422 on \`fields.${name}.reference\`, and that refusal blocks every later save of this object for as long as the half-filled field rides along in the draft. Pick the target object, or change the field to a non-relationship type.`
     );
   }
 }
@@ -162,6 +166,15 @@ function readSaveAdvisories(body) {
     return typeof c.rule === "string" && typeof c.path === "string" && typeof c.where === "string" && typeof c.message === "string" && typeof c.hint === "string" && typeof c.severity === "string";
   });
 }
+function readRegistrations(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const out = {};
+  for (const [name, verdict] of Object.entries(raw)) {
+    const parsed = import_api.FlowRegistrationSchema.safeParse(verdict);
+    if (parsed.success) out[name] = parsed.data;
+  }
+  return out;
+}
 var PROTECTION_ENVELOPE_KEYS = [
   "overlayScope",
   "lock",
@@ -228,6 +241,26 @@ function isMetaItemEnvelope(value) {
   const env = value;
   return typeof env.type === "string" && typeof env.name === "string" && "item" in env;
 }
+var pendingReads = /* @__PURE__ */ new WeakMap();
+function pendingReadsOn(transport) {
+  let reads = pendingReads.get(transport);
+  if (!reads) {
+    reads = /* @__PURE__ */ new Map();
+    pendingReads.set(transport, reads);
+  }
+  return reads;
+}
+function handOut(entry) {
+  entry.waiting += 1;
+  return entry.read.then((value) => {
+    entry.waiting -= 1;
+    return entry.waiting === 0 ? value : ownCopy(value);
+  });
+}
+function ownCopy(value) {
+  if (value === null || typeof value !== "object") return value;
+  return typeof structuredClone === "function" ? structuredClone(value) : JSON.parse(JSON.stringify(value));
+}
 var MetadataClient = class _MetadataClient {
   constructor(config) {
     __publicField(this, "base");
@@ -278,34 +311,102 @@ var MetadataClient = class _MetadataClient {
       ...this.onSaveAdvisory ? { onSaveAdvisory: this.onSaveAdvisory } : {}
     });
   }
+  /**
+   * Share one in-flight GET among the callers asking the same method for the
+   * same URL with the same headers through the same transport (objectui#11797).
+   *
+   * Opening a Studio package mounts several readers that ask the same
+   * question at once, and each one sent its own request. The first call for a
+   * key sends `read()`; a call that arrives while it is pending waits for that
+   * request instead of sending another.
+   *
+   * ⛔ Not a response cache, deliberately — the rules `findOne` keeps on the
+   * data adapter (objectui#11699):
+   *  - the entry goes the moment the read settles, so a call made after an
+   *    answer always reaches the network (there is no reuse window: a client
+   *    cannot see every write that changes metadata, an agent's server-side
+   *    edits among them, and a window would answer the read after such a write
+   *    with the state from before it);
+   *  - a rejection reaches every caller already waiting and is not remembered;
+   *  - a write sent through the same transport drops every pending read when
+   *    it lands (see {@link sendWrite}), so a read asked after a save or a
+   *    publish is never answered by a request sent before it;
+   *  - every caller, the first one included, gets an answer no other caller
+   *    holds (see {@link handOut}).
+   */
+  shareRead(reader, url, read) {
+    const reads = pendingReadsOn(this.fetchImpl);
+    const key = JSON.stringify([reader, url, Object.entries(this.headers).sort(([a], [b]) => a.localeCompare(b))]);
+    let entry = reads.get(key);
+    if (!entry) {
+      const created = { read: read(), waiting: 0 };
+      reads.set(key, created);
+      const settle = () => {
+        if (reads.get(key) === created) reads.delete(key);
+      };
+      created.read.then(settle, settle);
+      entry = created;
+    }
+    return handOut(entry);
+  }
+  /**
+   * Send a write, then drop every read still pending on this transport
+   * (objectui#11797): a read on the wire when the write lands was asked before
+   * it, so a caller asking after the write must not join it. Dropped however
+   * the write ends — a refused or interrupted write may still have changed
+   * something. The callers already holding a pending read keep its answer.
+   */
+  async sendWrite(url, init) {
+    try {
+      return await this.fetchImpl(url, init);
+    } finally {
+      pendingReads.get(this.fetchImpl)?.clear();
+    }
+  }
   /** List all registered metadata types (returns the registry rows). */
   async listTypes() {
-    const res = await this.fetchImpl(this.base, { method: "GET", headers: this.headers, cache: "no-store" });
-    if (!res.ok) throw await parseError(res);
-    const data = await res.json();
-    if (Array.isArray(data)) return data;
-    if (data && Array.isArray(data.entries)) return data.entries;
-    if (data && Array.isArray(data.items)) return data.items;
-    if (data && Array.isArray(data.types)) {
-      return data.types.map((t) => ({ type: t }));
-    }
-    return [];
+    return this.shareRead("listTypes", this.base, async () => {
+      const res = await this.fetchImpl(this.base, { method: "GET", headers: this.headers, cache: "no-store" });
+      if (!res.ok) throw await parseError(res);
+      const data = await res.json();
+      if (Array.isArray(data)) return data;
+      if (data && Array.isArray(data.entries)) return data.entries;
+      if (data && Array.isArray(data.items)) return data.items;
+      if (data && Array.isArray(data.types)) {
+        return data.types.map((t) => ({ type: t }));
+      }
+      return [];
+    });
   }
   /** List items of a metadata type (e.g. `object`, `field`, `view`). */
   async list(type, options = {}) {
+    return (await this.listResponse(type, options)).items;
+  }
+  /**
+   * The same list read as {@link list}, with what the server serves beside
+   * the items (objectui#12349): today that is the automation engine's
+   * `registrations` on a `flow` list — see {@link MetadataListAnswer}.
+   *
+   * One request for both methods: `list` is this read with the items picked
+   * out, so a caller asking both at once shares one in-flight GET.
+   */
+  async listResponse(type, options = {}) {
     const params = [];
     if (options.packageId) params.push(`package=${encodeURIComponent(options.packageId)}`);
     if (this.previewDrafts) params.push("preview=draft");
     const qs = params.length ? `?${params.join("&")}` : "";
     const url = `${this.base}/${encodeURIComponent(type)}${qs}`;
-    const res = await this.fetchImpl(url, { method: "GET", headers: this.headers, cache: "no-store" });
-    if (!res.ok) throw await parseError(res);
-    const data = await res.json();
-    if (Array.isArray(data)) return data;
-    if (data && Array.isArray(data.items)) {
-      return data.items;
-    }
-    return [];
+    return this.shareRead("list", url, async () => {
+      const res = await this.fetchImpl(url, { method: "GET", headers: this.headers, cache: "no-store" });
+      if (!res.ok) throw await parseError(res);
+      const data = await res.json();
+      if (Array.isArray(data)) return { items: data };
+      if (data && Array.isArray(data.items)) {
+        const registrations = readRegistrations(data.registrations);
+        return { items: data.items, ...registrations ? { registrations } : {} };
+      }
+      return { items: [] };
+    });
   }
   /**
    * List pending DRAFT items (ADR-0033) — what an AI authored but nobody
@@ -321,11 +422,13 @@ var MetadataClient = class _MetadataClient {
     if (options.type) params.push(`type=${encodeURIComponent(options.type)}`);
     const qs = params.length ? `?${params.join("&")}` : "";
     const url = `${this.base}/_drafts${qs}`;
-    const res = await this.fetchImpl(url, { method: "GET", headers: this.headers, cache: "no-store" });
-    if (!res.ok) throw await parseError(res);
-    const data = await res.json();
-    if (Array.isArray(data)) return data;
-    return data?.drafts ?? data?.data?.drafts ?? [];
+    return this.shareRead("listDrafts", url, async () => {
+      const res = await this.fetchImpl(url, { method: "GET", headers: this.headers, cache: "no-store" });
+      if (!res.ok) throw await parseError(res);
+      const data = await res.json();
+      if (Array.isArray(data)) return data;
+      return data?.drafts ?? data?.data?.drafts ?? [];
+    });
   }
   /**
    * Fetch a single metadata item and return the response body EXACTLY as the
@@ -344,10 +447,12 @@ var MetadataClient = class _MetadataClient {
     if (options.packageId) params.push(`package=${encodeURIComponent(options.packageId)}`);
     const qs = params.length ? `?${params.join("&")}` : "";
     const url = `${this.base}/${encodeURIComponent(type)}/${encodeURIComponent(name)}${qs}`;
-    const res = await this.fetchImpl(url, { method: "GET", headers: this.headers, cache: "no-store" });
-    if (res.status === 404) return null;
-    if (!res.ok) throw await parseError(res);
-    return await res.json();
+    return this.shareRead("readItemResponse", url, async () => {
+      const res = await this.fetchImpl(url, { method: "GET", headers: this.headers, cache: "no-store" });
+      if (res.status === 404) return null;
+      if (!res.ok) throw await parseError(res);
+      return await res.json();
+    });
   }
   /**
    * Get a single metadata item. Returns the unwrapped item CONTENT — the
@@ -403,13 +508,51 @@ var MetadataClient = class _MetadataClient {
    * (app-shell) and `unwrapViewDraft` (this package) read a draft that arrived
    * through {@link get}, which already unwrapped the envelope. They split on
    * which method feeds them, not on what they mean — all three strip.
+   *
+   * objectui#11799 — whether a draft exists is answered by the pending-drafts
+   * ledger first (see {@link draftLedgerMayHold}), and `?state=draft` is sent
+   * only when the ledger lists the name. The item read answers 404 when there
+   * is no draft, so opening every item in Studio used to log one error per
+   * item for an answer the ledger gives with a 200.
    */
   async getDraft(type, name, options = {}) {
+    if (!await this.draftLedgerMayHold(name)) return null;
     return this.readItemResponse(type, name, {
       state: "draft",
       ...options.packageId ? { packageId: options.packageId } : {}
     });
   }
+  /**
+   * Whether the pending-drafts ledger (`GET /meta/_drafts`) may hold a draft
+   * named `name` (objectui#11799).
+   *
+   * Read through {@link listDrafts}, the shared read objectui#11797 made: a
+   * question asked while a ledger read is pending waits for it, and a write
+   * through this transport drops it when the write lands ({@link sendWrite}),
+   * so a draft saved a moment ago is never reported absent by a read sent
+   * before the save.
+   *
+   * The WHOLE ledger, matched by name. The `?state=draft` read finds a row
+   * under either spelling of the type, and, when it names a package, that
+   * package's row or the package-less one. The ledger's `type` and `packageId`
+   * filters are exact, so a filtered ledger could miss a draft the item read
+   * would serve, and the editor would open the published body over a pending
+   * draft. Unfiltered, every miss here is a real absence; a same-name row of
+   * another type or package only costs the item read that was always sent.
+   *
+   * A ledger that cannot be read (403 without an authoring capability, 501 on
+   * a kernel without drafts, a network fault) is UNKNOWN, not empty: the item
+   * read is sent, as before.
+   */
+  async draftLedgerMayHold(name) {
+    let drafts;
+    try {
+      drafts = await this.listDrafts();
+    } catch {
+      return true;
+    }
+    return drafts.some((d) => d?.name === name);
+  }
   /**
    * Report the runtime authoring gate's advisory findings for a write the
    * server has ALREADY committed (#4133 for the save door, #5026 for the
@@ -447,11 +590,17 @@ var MetadataClient = class _MetadataClient {
         `MetadataClient.save: name must be non-empty (type="${type}"). The PUT /meta/:type/:name route requires a name segment.`
       );
     }
+    if (options.ifMatch && options.ifNoneMatch) {
+      throw new Error(
+        `MetadataClient.save: ifMatch and ifNoneMatch are mutually exclusive (type="${type}", name="${name}"). Send ifMatch with the version you read, or ifNoneMatch: "*" when no row is there.`
+      );
+    }
     assertObjectMetadataWritable(type, item, "MetadataClient.save");
     const params = [];
     if (options.force) params.push("force=true");
     if (options.mode === "draft") params.push("mode=draft");
     if (options.packageId) params.push(`package=${encodeURIComponent(options.packageId)}`);
+    if (options.surface) params.push(`surface=${encodeURIComponent(options.surface)}`);
     const qs = params.length ? `?${params.join("&")}` : "";
     const url = `${this.base}/${encodeURIComponent(type)}/${encodeURIComponent(name)}${qs}`;
     const headers = {
@@ -459,7 +608,8 @@ var MetadataClient = class _MetadataClient {
       "Content-Type": "application/json"
     };
     if (options.ifMatch) headers["If-Match"] = options.ifMatch;
-    const res = await this.fetchImpl(url, {
+    if (options.ifNoneMatch) headers["If-None-Match"] = options.ifNoneMatch;
+    const res = await this.sendWrite(url, {
       method: "PUT",
       headers,
       body: JSON.stringify(item)
@@ -540,17 +690,40 @@ var MetadataClient = class _MetadataClient {
    * {@link listDrafts} reads `data?.data?.drafts` because `GET /meta/_drafts`
    * IS a dispatcher route, and `publishHealthFromResponse` unwraps because the
    * batch door really is enveloped. The rule is per-route, not per-file.
+   *
+   * ## The bundle member (objectui#12402)
+   *
+   * Pass `member` to publish one member of a type whose identity is a pair
+   * (today only `email_template`, `(name, locale)`), sent as `?member=` — the
+   * selector the by-name doors read since objectstack `038d4c958`, and the
+   * value a `GET /meta/_drafts` row carries as `member`. A publish that names
+   * none promotes the CANONICAL member's draft, so two languages of one
+   * template drafted outside a package cannot both be published by name
+   * without it. The parameter is OMITTED, never sent empty, when the caller
+   * has no member: the door refuses a blank selector, and refuses any
+   * selector on a type with no members.
    */
-  async publishDraft(type, name) {
-    const url = `${this.base}/${encodeURIComponent(type)}/${encodeURIComponent(name)}/publish`;
-    const res = await this.fetchImpl(url, {
+  async publishDraft(type, name, options = {}) {
+    const params = [];
+    if (options.member) params.push(`member=${encodeURIComponent(options.member)}`);
+    const qs = params.length ? `?${params.join("&")}` : "";
+    const url = `${this.base}/${encodeURIComponent(type)}/${encodeURIComponent(name)}/publish${qs}`;
+    const res = await this.sendWrite(url, {
       method: "POST",
       headers: { ...this.headers, "Content-Type": "application/json", Accept: "application/json" },
       body: "{}"
     });
     if (!res.ok) throw await parseError(res);
     const body = await res.json().catch(() => ({}));
-    this.emitAdvisories(body, { type, name, door: "publish", mode: "publish" });
+    this.emitAdvisories(body, {
+      type,
+      name,
+      // objectui#12413 — the member this publish named, under the same rule as
+      // the query parameter above: present only when the caller had one.
+      ...options.member ? { member: options.member } : {},
+      door: "publish",
+      mode: "publish"
+    });
     return body;
   }
   /**
@@ -598,22 +771,32 @@ var MetadataClient = class _MetadataClient {
    * says to read `outcome`, not the boolean), and the two callers have their
    * own, different rules for the refusal and rolled-back cases. Deciding that
    * here would change behaviour this card is not about.
+   *
+   * ## The opt-in backfill (objectui#12929)
+   *
+   * `options.backfill` is sent as the body's `backfill` key, as given, and only
+   * when the caller passes one ({@link MetadataPublishPackageDraftsOptions}).
+   * Without it the body is `{}`, byte for byte what every caller sent before,
+   * so a caller that names nothing writes nothing into existing rows. The
+   * receipt is `backfillApplied` on the returned body, unexamined like the rest
+   * of a 2xx: one element per named field with the rows written, and `error`
+   * on a field that stopped short (the publish itself stands).
    */
-  async publishPackageDrafts(packageId) {
+  async publishPackageDrafts(packageId, options = {}) {
     if (!packageId || !String(packageId).trim()) {
       throw new Error(
         "MetadataClient.publishPackageDrafts: packageId must be non-empty. The POST /packages/:id/publish-drafts route requires an id segment."
       );
     }
     const url = `${packagesBaseOf(this.base)}/${encodeURIComponent(packageId)}/publish-drafts`;
-    const res = await this.fetchImpl(url, {
+    const res = await this.sendWrite(url, {
       method: "POST",
       // Both call sites this replaces sent the session cookie, and the client's
       // own fetch adds the console's Bearer token — so the routed call carries a
       // superset of what the bare doors carried, never less.
       credentials: "include",
       headers: { ...this.headers, "Content-Type": "application/json", Accept: "application/json" },
-      body: "{}"
+      body: JSON.stringify(options.backfill !== void 0 ? { backfill: options.backfill } : {})
     });
     if (!res.ok) throw await parseError(res);
     const body = unwrapDispatcherEnvelope(await res.json().catch(() => ({})));
@@ -763,13 +946,22 @@ var MetadataClient = class _MetadataClient {
    * Idempotent: returns the result even when no overlay row existed.
    * Pass `state: 'draft'` to discard the pending draft only (keeps the
    * published overlay intact) — useful for a Studio "Discard draft" button.
+   *
+   * Pass `packageId` to name the package whose row the delete removes, sent
+   * as `?package=`. A delete that names none addresses the one package that
+   * holds the item; when two or more packages hold it the door refuses it
+   * `409 RESOURCE_CONFLICT`, deletes nothing, and names `?package=` as the
+   * remedy. That refusal is thrown like any other {@link MetadataError}.
    */
   async reset(type, name, options = {}) {
-    const qs = options.state === "draft" ? "?state=draft" : "";
+    const params = [];
+    if (options.state === "draft") params.push("state=draft");
+    if (options.packageId) params.push(`package=${encodeURIComponent(options.packageId)}`);
+    const qs = params.length ? `?${params.join("&")}` : "";
     const url = `${this.base}/${encodeURIComponent(type)}/${encodeURIComponent(name)}${qs}`;
     const headers = { ...this.headers };
     if (options.ifMatch) headers["If-Match"] = options.ifMatch;
-    const res = await this.fetchImpl(url, { method: "DELETE", headers });
+    const res = await this.sendWrite(url, { method: "DELETE", headers });
     if (!res.ok) throw await parseError(res);
     return await res.json();
   }
@@ -793,7 +985,7 @@ var MetadataClient = class _MetadataClient {
       ...this.headers,
       "Content-Type": "application/json"
     };
-    const res = await this.fetchImpl(url, {
+    const res = await this.sendWrite(url, {
       method: "POST",
       headers,
       body: JSON.stringify(options.message ? { message: options.message } : {})
@@ -817,7 +1009,7 @@ var MetadataClient = class _MetadataClient {
       ...this.headers,
       "Content-Type": "application/json"
     };
-    const res = await this.fetchImpl(url, {
+    const res = await this.sendWrite(url, {
       method: "POST",
       headers,
       body: JSON.stringify({
@@ -1430,21 +1622,54 @@ var MetadataCache = class {
         this.cache.delete(key);
       }
     }
+    return this.load(key, fetcher);
+  }
+  /**
+   * Join the read in flight for `key`, or start one, and never answer from the
+   * settled entry: a caller of this always gets an answer from a request that
+   * was on the wire when it asked.
+   *
+   * objectui#13044. This is the door for a caller whose own contract is "ask
+   * the server", which should still not put a second identical request on the
+   * wire while one is already there.
+   *
+   * objectui#13057. The landing is stored, exactly as one {@link get} started
+   * would store it, so a later {@link get} for `key` may be answered from it.
+   * The caller asked the server; a reader that may be served what the cache
+   * already holds is served the answer that caller just received.
+   */
+  share(key, fetcher) {
+    return this.load(key, fetcher);
+  }
+  /**
+   * The in-flight half of {@link get} and {@link share}: join the request in
+   * flight for `key`, or start one.
+   *
+   * A landing is stored, and its in-flight entry cleared, only
+   * while it is still the request registered for `key` (objectui#13044). {@link invalidate}
+   * and {@link clear} detach the request in flight, so a request sent before an
+   * invalidation can neither answer a caller who asks after it nor write its
+   * answer over a newer one.
+   */
+  load(key, fetcher) {
     const existing = this.inflight.get(key);
     if (existing) {
       this.stats.coalesced++;
       return existing;
     }
     this.stats.misses++;
-    const promise = (async () => {
+    const self = {};
+    const run = async () => {
       try {
         const data = await fetcher();
-        this.set(key, data);
+        if (this.inflight.get(key) === self.promise) this.set(key, data);
         return data;
       } finally {
-        this.inflight.delete(key);
+        if (this.inflight.get(key) === self.promise) this.inflight.delete(key);
       }
-    })();
+    };
+    const promise = run();
+    self.promise = promise;
     this.inflight.set(key, promise);
     return promise;
   }
@@ -1492,8 +1717,10 @@ var MetadataCache = class {
   invalidate(key) {
     if (key) {
       this.cache.delete(key);
+      this.inflight.delete(key);
     } else {
       this.cache.clear();
+      this.inflight.clear();
     }
   }
   /**
@@ -1563,6 +1790,21 @@ var MetadataCache = class {
   }
 };
 
+// src/metadata-error.ts
+function extractIssues(e) {
+  const issues = e?.issues;
+  return Array.isArray(issues) ? issues : [];
+}
+function formatMetadataIssue(i) {
+  return `\u2022 ${i.path && i.path.length > 0 ? i.path : "(root)"} \u2014 ${i.message}`;
+}
+function formatMetadataError(e) {
+  const issues = extractIssues(e);
+  if (issues.length > 0) return issues.map(formatMetadataIssue).join("\n");
+  const err = e;
+  return err?.message ?? String(e);
+}
+
 // src/errors.ts
 var ObjectStackError = class extends Error {
   /**
@@ -1771,51 +2013,67 @@ function present(value) {
 
 // src/userState.ts
 var DEFAULT_RESOURCE = "sys_user_preference";
-function createObjectStackUserStateAdapter(options) {
-  const {
-    dataSource,
-    userId,
-    key,
-    resource = DEFAULT_RESOURCE,
-    onError = () => {
-    }
-  } = options;
+var PREFERENCE_FAMILY_ROW_LIMIT = 200;
+function preferenceQuery(userId, keys, prefixes = []) {
+  if (prefixes.length === 0) {
+    if (keys.length === 1) {
+      return { $filter: { user_id: userId, key: keys[0] }, $top: 1 };
+    }
+    return { $filter: { user_id: userId, key: { $in: [...keys] } }, $top: keys.length };
+  }
+  const arms = [];
+  if (keys.length === 1) arms.push({ key: keys[0] });
+  else if (keys.length > 1) arms.push({ key: { $in: [...keys] } });
+  for (const prefix of prefixes) arms.push({ key: { $startsWith: prefix } });
+  return {
+    $filter: { user_id: userId, ...arms.length === 1 ? arms[0] : { $or: arms } },
+    $top: keys.length + prefixes.length * PREFERENCE_FAMILY_ROW_LIMIT
+  };
+}
+var openReads = /* @__PURE__ */ new WeakMap();
+function joinSharedRead(dataSource, resource, userId, want) {
+  let scopes = openReads.get(dataSource);
+  if (!scopes) {
+    scopes = /* @__PURE__ */ new Map();
+    openReads.set(dataSource, scopes);
+  }
+  const scope = JSON.stringify([resource, userId]);
+  const open = scopes.get(scope);
+  if (open) {
+    if ("key" in want) open.keys.add(want.key);
+    else open.prefixes.add(want.prefix);
+    return open;
+  }
+  const keys = new Set("key" in want ? [want.key] : []);
+  const prefixes = new Set("prefix" in want ? [want.prefix] : []);
+  const opened = scopes;
+  const read = {
+    keys,
+    prefixes,
+    answer: Promise.resolve().then(async () => {
+      if (opened.get(scope) === read) opened.delete(scope);
+      const query = preferenceQuery(userId, [...keys], [...prefixes]);
+      const result = await dataSource.find(resource, query);
+      const rows = result?.data ?? [];
+      return {
+        rows,
+        saturated: prefixes.size > 0 && rows.length >= (query.$top ?? Infinity)
+      };
+    })
+  };
+  scopes.set(scope, read);
+  return read;
+}
+function createPreferenceRowWriter(dataSource, resource, userId, key, onError) {
   let cachedRowId = null;
-  let saveChain = Promise.resolve();
   const findExisting = async () => {
-    const params = {
-      $filter: {
-        user_id: userId,
-        key
-      },
-      $top: 1
-    };
-    const result = await dataSource.find(resource, params);
-    const rows = result?.data ?? [];
-    const match = rows.find((r) => {
-      if (!r) return false;
-      const userMismatch = r.user_id !== void 0 && r.user_id !== userId;
-      const keyMismatch = r.key !== void 0 && r.key !== key;
-      return !userMismatch && !keyMismatch;
-    });
-    return match ?? null;
+    const result = await dataSource.find(resource, preferenceQuery(userId, [key]));
+    return matchPreferenceRow(result?.data ?? [], userId, key);
   };
-  const decodeValue = (value) => {
-    if (Array.isArray(value)) return value;
-    if (typeof value === "string") {
-      try {
-        const parsed = JSON.parse(value);
-        return Array.isArray(parsed) ? parsed : [];
-      } catch {
-        return [];
-      }
-    }
-    return [];
-  };
-  const upsert = async (items) => {
+  const upsert = async (value) => {
     if (cachedRowId !== null) {
       try {
-        await dataSource.update(resource, cachedRowId, { value: items });
+        await dataSource.update(resource, cachedRowId, { value });
         return;
       } catch (updateError) {
         cachedRowId = null;
@@ -1825,14 +2083,14 @@ function createObjectStackUserStateAdapter(options) {
     const existing = await findExisting();
     if (existing && existing.id !== void 0 && existing.id !== null) {
       cachedRowId = existing.id;
-      await dataSource.update(resource, existing.id, { value: items });
+      await dataSource.update(resource, existing.id, { value });
       return;
     }
     try {
       const created = await dataSource.create(resource, {
         user_id: userId,
         key,
-        value: items
+        value
       });
       const newId = created?.id;
       if (newId !== void 0 && newId !== null) cachedRowId = newId;
@@ -1840,21 +2098,74 @@ function createObjectStackUserStateAdapter(options) {
       const recovered = await findExisting();
       if (recovered && recovered.id !== void 0 && recovered.id !== null) {
         cachedRowId = recovered.id;
-        await dataSource.update(resource, recovered.id, { value: items });
+        await dataSource.update(resource, recovered.id, { value });
         return;
       }
       throw createError;
     }
   };
+  return {
+    remember(id) {
+      cachedRowId = id;
+    },
+    upsert,
+    find: findExisting
+  };
+}
+function matchPreferenceRow(rows, userId, key) {
+  const match = rows.find((r) => {
+    if (!r) return false;
+    const userMismatch = r.user_id !== void 0 && r.user_id !== userId;
+    const keyMismatch = r.key !== void 0 && r.key !== key;
+    return !userMismatch && !keyMismatch;
+  });
+  return match ?? null;
+}
+function createObjectStackUserStateAdapter(options) {
+  const {
+    dataSource,
+    userId,
+    key,
+    resource = DEFAULT_RESOURCE,
+    onError = () => {
+    }
+  } = options;
+  const writer = createPreferenceRowWriter(dataSource, resource, userId, key, onError);
+  let saveChain = Promise.resolve();
+  const loadExisting = async () => {
+    const read = joinSharedRead(dataSource, resource, userId, { key });
+    const { rows, saturated } = await read.answer;
+    if (read.keys.size === 1 && read.prefixes.size === 0) {
+      return matchPreferenceRow(rows, userId, key);
+    }
+    const own = rows.find(
+      (r) => r && r.key === key && (r.user_id === void 0 || r.user_id === userId)
+    );
+    if (own) return own;
+    if (saturated || rows.some((r) => r && r.key === void 0)) return writer.find();
+    return null;
+  };
+  const decodeValue = (value) => {
+    if (Array.isArray(value)) return value;
+    if (typeof value === "string") {
+      try {
+        const parsed = JSON.parse(value);
+        return Array.isArray(parsed) ? parsed : [];
+      } catch {
+        return [];
+      }
+    }
+    return [];
+  };
   return {
     async load() {
       try {
-        const row = await findExisting();
+        const row = await loadExisting();
         if (!row) {
-          cachedRowId = null;
+          writer.remember(null);
           return [];
         }
-        if (row.id !== void 0 && row.id !== null) cachedRowId = row.id;
+        if (row.id !== void 0 && row.id !== null) writer.remember(row.id);
         return decodeValue(row.value);
       } catch (error) {
         onError("load", error);
@@ -1862,7 +2173,7 @@ function createObjectStackUserStateAdapter(options) {
       }
     },
     async save(items) {
-      const run = saveChain.then(() => upsert(items)).catch((error) => {
+      const run = saveChain.then(() => writer.upsert(items)).catch((error) => {
         onError("save", error);
       });
       saveChain = run;
@@ -1870,6 +2181,69 @@ function createObjectStackUserStateAdapter(options) {
     }
   };
 }
+function createObjectStackUserPreferenceFamily(options) {
+  const {
+    dataSource,
+    userId,
+    prefix,
+    resource = DEFAULT_RESOURCE,
+    onError = () => {
+    }
+  } = options;
+  const writers = /* @__PURE__ */ new Map();
+  const chains = /* @__PURE__ */ new Map();
+  const writerFor = (key) => {
+    let writer = writers.get(key);
+    if (!writer) {
+      writer = createPreferenceRowWriter(dataSource, resource, userId, key, onError);
+      writers.set(key, writer);
+    }
+    return writer;
+  };
+  const decodeValue = (value) => {
+    let parsed = value;
+    if (typeof value === "string") {
+      try {
+        parsed = JSON.parse(value);
+      } catch {
+        return void 0;
+      }
+    }
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
+  };
+  return {
+    prefix,
+    async load() {
+      try {
+        const read = joinSharedRead(dataSource, resource, userId, { prefix });
+        const { rows } = await read.answer;
+        const out = {};
+        for (const row of rows) {
+          if (!row || typeof row.key !== "string" || !row.key.startsWith(prefix)) continue;
+          if (row.user_id !== void 0 && row.user_id !== userId) continue;
+          if (row.id !== void 0 && row.id !== null) writerFor(row.key).remember(row.id);
+          const value = decodeValue(row.value);
+          if (value !== void 0) out[row.key] = value;
+        }
+        return out;
+      } catch (error) {
+        onError("load", error);
+        return {};
+      }
+    },
+    async save(key, value) {
+      if (!key.startsWith(prefix) || key.length === prefix.length) {
+        onError("save", new Error(`key "${key}" is not in the family "${prefix}"`));
+        return;
+      }
+      const run = (chains.get(key) ?? Promise.resolve()).then(() => writerFor(key).upsert(value)).catch((error) => {
+        onError("save", error);
+      });
+      chains.set(key, run);
+      return run;
+    }
+  };
+}
 
 // src/draft-envelope.ts
 var import_kernel = require("@objectstack/spec/kernel");
@@ -1882,20 +2256,61 @@ function extractDraftBody(resp) {
   if (Object.keys(body).length === 0) return null;
   return (0, import_kernel.stripReadDecorations)(body);
 }
-
-// src/metadata-error.ts
-function extractIssues(e) {
-  const issues = e?.issues;
-  return Array.isArray(issues) ? issues : [];
+function readDraftChanges(resp) {
+  if (!resp || typeof resp !== "object") return null;
+  const changes = resp.draftChanges;
+  return Array.isArray(changes) ? changes : null;
 }
-function formatMetadataIssue(i) {
-  return `\u2022 ${i.path && i.path.length > 0 ? i.path : "(root)"} \u2014 ${i.message}`;
+function isPathPrefix(prefix, path) {
+  if (prefix.length > path.length) return false;
+  for (let i = 0; i < prefix.length; i++) if (prefix[i] !== path[i]) return false;
+  return true;
 }
-function formatMetadataError(e) {
-  const issues = extractIssues(e);
-  if (issues.length > 0) return issues.map(formatMetadataIssue).join("\n");
-  const err = e;
-  return err?.message ?? String(e);
+function governingDraftChange(changes, path) {
+  let best = null;
+  for (const change of changes ?? []) {
+    if (!isPathPrefix(change.path, path)) continue;
+    if (!best || change.path.length > best.path.length) best = change;
+  }
+  return best;
+}
+function draftChangesUnder(changes, path) {
+  return (changes ?? []).filter((change) => change.path.length > path.length && isPathPrefix(path, change.path));
+}
+
+// src/picklist-binding.ts
+function dropServedPicklistOptions(body) {
+  if (!body || typeof body !== "object") return body;
+  const fields = body.fields;
+  if (Array.isArray(fields)) {
+    let changed = false;
+    const next = fields.map((def) => {
+      const stripped = withoutServedOptions(def);
+      if (stripped !== def) changed = true;
+      return stripped;
+    });
+    return changed ? { ...body, fields: next } : body;
+  }
+  if (fields && typeof fields === "object") {
+    let changed = false;
+    const next = Object.fromEntries(
+      Object.entries(fields).map(([name, def]) => {
+        const stripped = withoutServedOptions(def);
+        if (stripped !== def) changed = true;
+        return [name, stripped];
+      })
+    );
+    return changed ? { ...body, fields: next } : body;
+  }
+  return body;
+}
+function withoutServedOptions(def) {
+  if (!def || typeof def !== "object" || Array.isArray(def)) return def;
+  const record = def;
+  if (record.picklist === void 0) return def;
+  if (!Object.prototype.hasOwnProperty.call(record, "options")) return def;
+  const { options: _served, ...authored } = record;
+  return authored;
 }
 
 // src/index.ts
@@ -2173,6 +2588,7 @@ function serializeOrderBy(orderby) {
   }
   return void 0;
 }
+var VIEW_LIST_KEY = "list:view";
 var discoveryCache = /* @__PURE__ */ new Map();
 async function getSharedDiscovery(baseUrl, fetcher) {
   const key = baseUrl || "<default>";
@@ -2226,29 +2642,6 @@ function metaEnvelopeCarriesItem(envelope) {
   if (envelope == null || typeof envelope !== "object") return false;
   return envelope.item != null;
 }
-var VIEW_CONFIG_CAPABILITY = "manage_metadata";
-var ViewConfigPermissionDeniedError = class extends Error {
-  constructor(objectName, viewId) {
-    super(
-      `View configuration is shared: changing "${viewId}" changes it for everyone who uses this view. That requires the "${VIEW_CONFIG_CAPABILITY}" capability, which this session does not hold.`
-    );
-    __publicField(this, "code", "VIEW_CONFIG_PERMISSION_DENIED");
-    /** The capability that was required and not held. */
-    __publicField(this, "capability", VIEW_CONFIG_CAPABILITY);
-    /** The object whose view configuration the refused write targeted. */
-    __publicField(this, "objectName");
-    /** The view id the refused write targeted. */
-    __publicField(this, "viewId");
-    this.name = "ViewConfigPermissionDeniedError";
-    this.objectName = objectName;
-    this.viewId = viewId;
-  }
-};
-function isViewConfigPermissionDeniedError(error) {
-  if (!error || typeof error !== "object") return false;
-  const e = error;
-  return e.code === "VIEW_CONFIG_PERMISSION_DENIED" || e.name === "ViewConfigPermissionDeniedError";
-}
 var AnalyticsNotInstalledError = class extends Error {
   constructor(surface, detail, serverCode) {
     super(
@@ -2614,6 +3007,16 @@ function sameWireValue(a, b) {
   if (aEmpty || bEmpty) return aEmpty && bEmpty;
   return stableStringify(a) === stableStringify(b);
 }
+function readWriteWarnings(result) {
+  const raw = result?.warnings;
+  if (!Array.isArray(raw) || raw.length === 0) return [];
+  const out = [];
+  for (const entry of raw) {
+    const parsed = import_api3.ValidateDataIssueSchema.safeParse(entry);
+    if (parsed.success) out.push(parsed.data);
+  }
+  return out;
+}
 function withoutNoOpDrops(droppedFields, sent, stored) {
   if (!sent || !stored || typeof sent !== "object" || typeof stored !== "object") {
     return droppedFields;
@@ -2694,6 +3097,10 @@ function mergeViewPatch(current, partial, viewName, objectName) {
     object: current?.object || current?.data?.object || objectName
   };
 }
+function isCallerAbort(error, init) {
+  if (init?.signal?.aborted) return true;
+  return error?.name === "AbortError";
+}
 var ObjectStackAdapter = class {
   constructor(config) {
     __publicField(this, "client");
@@ -2717,6 +3124,13 @@ var ObjectStackAdapter = class {
     // multiple sibling components requesting the same dataset on first paint)
     // into a single network round trip.
     __publicField(this, "inflightFinds", /* @__PURE__ */ new Map());
+    // In-flight findOne() reads keyed by resource + record id + serialized
+    // params, shared the same way (objectui#11699). Opening one record page
+    // asked for the same record twice at once: `record:details`' DetailView
+    // re-runs its load effect while its first read is still on the wire. A
+    // write to a resource drops that resource's entries (see `emitMutation`),
+    // so a read asked after a save is never answered by one sent before it.
+    __publicField(this, "inflightFindOnes", /* @__PURE__ */ new Map());
     // Resources that have responded 404 at least once (collection not installed
     // on this backend). Subsequent find() calls short-circuit to an empty result
     // so optional collections like sys_presence don't hammer the server with
@@ -2759,68 +3173,78 @@ var ObjectStackAdapter = class {
     // the opposite direction — those two describe a write that succeeded, this
     // one a read that did not happen.
     __publicField(this, "metadataReadWarningListeners", /* @__PURE__ */ new Set());
-    // [ADR-0066] The session's REPORTED system capabilities, pushed in by the
-    // host (see `setSystemCapabilities`). `undefined` means NO answer was ever
-    // reported — which is NOT the same as a reported-empty grant, and the two
-    // are treated differently by `maySetViewConfig` below.
-    __publicField(this, "systemCapabilities");
-    this.client = new import_client.ObjectStackClient({ ...config, logger: createQuietHttpLogger() });
+    const transport = config.fetch || globalThis.fetch.bind(globalThis);
+    this.fetchImpl = (input, init) => this.observeServerAnswer(() => transport(input, init), init);
+    this.client = new import_client.ObjectStackClient({
+      ...config,
+      fetch: this.fetchImpl,
+      logger: createQuietHttpLogger()
+    });
     this.installSaveAdvisoryInterceptor();
     this.metadataCache = new MetadataCache(config.cache);
+    this.installViewListShare();
     this.autoReconnect = config.autoReconnect ?? true;
     this.maxReconnectAttempts = config.maxReconnectAttempts ?? 3;
     this.reconnectDelay = config.reconnectDelay ?? 1e3;
     this.baseUrl = config.baseUrl;
     this.token = config.token;
-    this.systemCapabilities = config.systemCapabilities;
-    this.fetchImpl = config.fetch || globalThis.fetch.bind(globalThis);
   }
   /**
    * Ensure the client is connected to the server.
    * Call this before making requests or it will auto-connect on first request.
+   *
+   * With `autoReconnect`, a failed discovery read is retried up to
+   * `maxReconnectAttempts` times with exponential backoff. The promise resolves
+   * once discovery answers and rejects with the last `ConnectionError` once the
+   * retries are spent (objectui#12318).
    */
   async connect() {
     if (this.connected) return;
     if (this.connectPromise) return this.connectPromise;
     this.setConnectionState("connecting");
-    this.connectPromise = (async () => {
-      try {
-        const baseUrl = this.baseUrl || "";
-        const discoveryUrl = baseUrl ? `${baseUrl.replace(/\/$/, "")}/api/v1/discovery` : "/api/v1/discovery";
-        const data = await getSharedDiscovery(baseUrl, async () => {
-          const res = await this.fetchImpl(discoveryUrl, {
-            method: "GET",
-            headers: this.token ? { Authorization: `Bearer ${this.token}` } : void 0
-          });
-          if (!res.ok) {
-            throw new Error(`discovery ${res.status} ${res.statusText}`);
-          }
-          const body = await res.json();
-          return body && typeof body.success === "boolean" && "data" in body ? body.data : body;
+    this.connectPromise = this.attemptConnect().finally(() => {
+      this.connectPromise = null;
+    });
+    return this.connectPromise;
+  }
+  /**
+   * One discovery attempt, and the retry that follows it when it fails with
+   * budget left. Runs inside the promise {@link connect} hands every caller.
+   */
+  async attemptConnect() {
+    try {
+      const baseUrl = this.baseUrl || "";
+      const discoveryUrl = baseUrl ? `${baseUrl.replace(/\/$/, "")}/api/v1/discovery` : "/api/v1/discovery";
+      const data = await getSharedDiscovery(baseUrl, async () => {
+        const res = await this.fetchImpl(discoveryUrl, {
+          method: "GET",
+          headers: this.token ? { Authorization: `Bearer ${this.token}` } : void 0
         });
-        this.client.discoveryInfo = data;
-        this.atomicBatchCapability = readTransactionalBatchCapability(data);
-        this.connected = true;
-        this.reconnectAttempts = 0;
-        this.setConnectionState("connected");
-      } catch (error) {
-        const errorMessage = error instanceof Error ? error.message : "Failed to connect to ObjectStack server";
-        const connectionError = new ConnectionError(
-          errorMessage,
-          void 0,
-          { originalError: error }
-        );
-        this.setConnectionState("error", connectionError);
-        if (this.autoReconnect && this.reconnectAttempts < this.maxReconnectAttempts) {
-          await this.attemptReconnect();
-        } else {
-          throw connectionError;
+        if (!res.ok) {
+          throw new Error(`discovery ${res.status} ${res.statusText}`);
         }
-      } finally {
-        this.connectPromise = null;
+        const body = await res.json();
+        return body && typeof body.success === "boolean" && "data" in body ? body.data : body;
+      });
+      this.client.discoveryInfo = data;
+      this.atomicBatchCapability = readTransactionalBatchCapability(data);
+      this.connected = true;
+      this.reconnectAttempts = 0;
+      this.setConnectionState("connected");
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : "Failed to connect to ObjectStack server";
+      const connectionError = new ConnectionError(
+        errorMessage,
+        void 0,
+        { originalError: error }
+      );
+      this.setConnectionState("error", connectionError);
+      if (this.autoReconnect && this.reconnectAttempts < this.maxReconnectAttempts) {
+        await this.attemptReconnect();
+      } else {
+        throw connectionError;
       }
-    })();
-    return this.connectPromise;
+    }
   }
   /**
    * Attempt to reconnect to the server with exponential backoff
@@ -2830,8 +3254,7 @@ var ObjectStackAdapter = class {
     this.setConnectionState("reconnecting");
     const delay = this.reconnectDelay * Math.pow(2, this.reconnectAttempts - 1);
     await new Promise((resolve) => setTimeout(resolve, delay));
-    this.connected = false;
-    await this.connect();
+    await this.attemptConnect();
   }
   /**
    * Get the current connection state
@@ -2887,6 +3310,63 @@ var ObjectStackAdapter = class {
       }
     });
   }
+  /**
+   * Run one request through the adapter's fetch and let its outcome move the
+   * connection state (objectui#12295). Before the first successful
+   * {@link connect} this records nothing: `connect()` owns the state until
+   * then, and its own discovery read passes through here too.
+   *
+   * - **Answered** — the fetch resolved with a Response, whatever its status.
+   *   A 4xx or 5xx is an answer: the server is reachable, so it counts the
+   *   same as a 200 and ends any outage.
+   * - **Not answered** — the fetch rejected: no HTTP answer at all (refused,
+   *   reset, DNS, an offline browser). A rejection the caller asked for by
+   *   aborting is not evidence about the server and records nothing.
+   *
+   * The rejection or the Response reaches the caller unchanged.
+   */
+  async observeServerAnswer(send, init) {
+    let response;
+    try {
+      response = await send();
+    } catch (error) {
+      if (!isCallerAbort(error, init)) this.noteServerUnanswered(error);
+      throw error;
+    }
+    this.noteServerAnswered();
+    return response;
+  }
+  /** An answered request after the first connect: the server is reachable. */
+  noteServerAnswered() {
+    if (!this.connected) return;
+    this.reconnectAttempts = 0;
+    if (this.connectionState !== "connected") this.setConnectionState("connected");
+  }
+  /**
+   * An unanswered request after the first connect. It spends the adapter's own
+   * retry window — the `autoReconnect` / `maxReconnectAttempts` budget that
+   * {@link connect} grants a failed discovery — counted in the requests the
+   * host already makes rather than in timed probes: while the budget lasts the
+   * state is `reconnecting`, and the first unanswered request past it moves the
+   * state to `error`. No timer and no request of the adapter's own is involved;
+   * the next answered request, whenever it comes, restores `connected`.
+   */
+  noteServerUnanswered(error) {
+    if (!this.connected || this.connectionState === "error") return;
+    if (this.autoReconnect && this.reconnectAttempts < this.maxReconnectAttempts) {
+      this.reconnectAttempts++;
+      if (this.connectionState !== "reconnecting") this.setConnectionState("reconnecting");
+      return;
+    }
+    this.setConnectionState(
+      "error",
+      new ConnectionError(
+        error instanceof Error ? error.message : "ObjectStack server did not answer",
+        void 0,
+        { originalError: error }
+      )
+    );
+  }
   /**
    * Emit batch progress event to listeners
    */
@@ -2908,9 +3388,7 @@ var ObjectStackAdapter = class {
       return { data: [], total: 0 };
     }
     const key = `${resource}::${stableStringify(params)}`;
-    const existing = this.inflightFinds.get(key);
-    if (existing) return existing;
-    const promise = (async () => {
+    return this.shareInFlight(this.inflightFinds, key, async () => {
       await this.connect();
       if (params?.$expand && params.$expand.length > 0 || params?.$search != null && String(params.$search).trim() !== "") {
         const result = await this.rawFindWithPopulate(resource, params);
@@ -2927,11 +3405,25 @@ var ObjectStackAdapter = class {
         }
         throw err;
       }
-    })();
-    this.inflightFinds.set(key, promise);
+    });
+  }
+  /**
+   * Share one in-flight read among concurrent callers asking the same
+   * question: the first call for `key` issues `read()`, every call that
+   * arrives while it is still pending gets that same promise, and the entry is
+   * dropped the moment it settles — so nothing is cached past the round trip,
+   * a rejection reaches every caller that shared it and is not remembered, and
+   * the next call after settle issues a fresh read. Used by `find` and
+   * `findOne` (objectui#11699).
+   */
+  shareInFlight(inflight, key, read) {
+    const existing = inflight.get(key);
+    if (existing) return existing;
+    const promise = read();
+    inflight.set(key, promise);
     const cleanup = () => {
-      if (this.inflightFinds.get(key) === promise) {
-        this.inflightFinds.delete(key);
+      if (inflight.get(key) === promise) {
+        inflight.delete(key);
       }
     };
     promise.then(cleanup, cleanup);
@@ -3010,8 +3502,16 @@ var ObjectStackAdapter = class {
   }
   /**
    * Find a single record by ID.
+   *
+   * Concurrent calls for the same resource, id and params share one request,
+   * exactly as `find` does (objectui#11699); see {@link shareInFlight}.
    */
   async findOne(resource, id, params) {
+    const key = `${resource}::${JSON.stringify(String(id))}::${stableStringify(params)}`;
+    return this.shareInFlight(this.inflightFindOnes, key, () => this.readOne(resource, id, params));
+  }
+  /** The one round trip behind {@link findOne}, unshared. */
+  async readOne(resource, id, params) {
     await this.connect();
     if (params?.$expand && params.$expand.length > 0) {
       try {
@@ -3051,6 +3551,10 @@ var ObjectStackAdapter = class {
    * mutation or starve the other subscribers, so each is isolated.
    */
   emitMutation(event) {
+    const prefix = `${event.resource}::`;
+    for (const key of Array.from(this.inflightFindOnes.keys())) {
+      if (key.startsWith(prefix)) this.inflightFindOnes.delete(key);
+    }
     for (const listener of this.mutationListeners) {
       try {
         listener(event);
@@ -3095,15 +3599,28 @@ var ObjectStackAdapter = class {
    * reason routed to the skew arm, a non-string field element refused, a missing
    * `object` healed from `resource` — never asserted into the union, and the
    * entry itself never dropped for them (objectui#4934, `f75810e7c`).
+   *
+   * The same answer's `warnings` (objectui#12107) rides this one event: it is
+   * emitted when either list is non-empty, so a write whose only news is an
+   * advisory rule hit still reaches the subscriber, with `droppedFields: []`.
    */
   notifyDroppedFields(operation, resource, result, id, sent) {
     const dropped = result?.droppedFields;
-    if (!Array.isArray(dropped) || dropped.length === 0) return;
-    const valid = dropped.filter(isWireDroppedFieldsEntry).map((e) => asDroppedFieldsNotice(e, resource));
-    const stored = result?.record;
-    const droppedFields = withoutNoOpDrops(valid, sent, stored);
-    if (droppedFields.length === 0) return;
-    this.emitWriteWarning({ operation, resource, ...id !== void 0 ? { id } : {}, droppedFields });
+    let droppedFields = [];
+    if (Array.isArray(dropped) && dropped.length > 0) {
+      const valid = dropped.filter(isWireDroppedFieldsEntry).map((e) => asDroppedFieldsNotice(e, resource));
+      const stored = result?.record;
+      droppedFields = withoutNoOpDrops(valid, sent, stored);
+    }
+    const warnings = readWriteWarnings(result);
+    if (droppedFields.length === 0 && warnings.length === 0) return;
+    this.emitWriteWarning({
+      operation,
+      resource,
+      ...id !== void 0 ? { id } : {},
+      droppedFields,
+      ...warnings.length > 0 ? { warnings } : {}
+    });
   }
   /**
    * Same, for the cross-object transactional batch (objectstack-ai/objectstack#3794). Its
@@ -3241,8 +3758,8 @@ var ObjectStackAdapter = class {
    *
    * `ObjectStackClient.meta.saveItem` is the second client class that writes
    * through `PUT /api/v1/meta/:type/:name`, and every one of its callers reaches
-   * it through an adapter this class constructed — the four inside this file
-   * (`updateViewConfig`, the two view paths, `updateDashboard`) via
+   * it through an adapter this class constructed — the three inside this file
+   * (the two view paths, `updateDashboard`) via
    * `this.client`, and every caller outside it via {@link getClient}, which
    * hands back this same instance: `MetadataService` (app-shell, five saves),
    * `useNavigationSync`, and plugin-designer's Create/EditAppPage. Wrapping the
@@ -3271,20 +3788,30 @@ var ObjectStackAdapter = class {
    *
    * Drafts are NEVER gated: the framework returns at its D1 early-return
    * (`if (args.state !== 'active') return null`) before running a rule, so a
-   * draft save produces no findings to withhold. This client class has no draft
-   * door at all to worry about — the SDK's `saveItem(type, name, item)` takes no
-   * mode and always writes the active door, which is exactly why the gate DOES
-   * run for its callers. `mode` on the emitted event is therefore derived from
-   * the response's own `state` rather than from a request-side flag that does
-   * not exist here: `'draft'` when the server says the row landed as a draft,
-   * `'publish'` otherwise. That keeps the event truthful about which door it
-   * came through instead of hard-coding one.
+   * draft save produces no findings to withhold. `mode` on the emitted event is
+   * derived from the response's own `state`, not from the caller's options:
+   * `'draft'` when the server says the row landed as a draft, `'publish'`
+   * otherwise. The server's answer is the one that says which door the write
+   * took, so the event cannot claim a door the request only asked for.
+   *
+   * ## Every argument is forwarded (objectui#12300)
+   *
+   * The SDK's `saveItem(type, name, item, options?)` carries the write's scope
+   * in its fourth argument, `SaveMetaItemOptions`: `packageId` (`?package=`),
+   * `force`, `mode` and `ifMatch`. This wrapper used to name three parameters
+   * and call the original with three, so that bag was dropped before the SDK
+   * saw it. Every caller reaching the SDK through {@link getClient} got a bare
+   * `PUT` whatever it passed, while the declared signature still accepted the
+   * bag, so nothing at the call site could tell. The wrapper now takes and
+   * passes the original's own parameter list, so it forwards whatever the SDK
+   * declares, today's bag and any later member, without naming one.
    */
   installSaveAdvisoryInterceptor() {
     const meta = this.client.meta;
     const original = meta.saveItem.bind(meta);
-    meta.saveItem = async (type, name, item) => {
-      const result = await original(type, name, item);
+    meta.saveItem = async (...args) => {
+      const [type, name] = args;
+      const result = await original(...args);
       try {
         const advisories = readSaveAdvisories(result);
         if (advisories.length > 0) {
@@ -3307,6 +3834,61 @@ var ObjectStackAdapter = class {
       return result;
     };
   }
+  /**
+   * Route this adapter's client's published view-list read through the one
+   * {@link VIEW_LIST_KEY} (objectui#13044).
+   *
+   * The app-shell `MetadataProvider` reads `client.meta.getItems('view')`
+   * through {@link getClient}; {@link listViews} and {@link listViewOverrides}
+   * read the same `GET /api/v1/meta/view`. Each used to put its own request on
+   * the wire, so one list-page open asked the server three times for one URL.
+   *
+   * A caller of the client keeps its contract, "ask the server": it is never
+   * answered from a settled entry. It joins a request already in flight for
+   * the same URL instead of sending a second one, and its answer is stored
+   * under {@link VIEW_LIST_KEY} (see {@link MetadataCache.share}), which is
+   * what {@link readViewList} answers this adapter's own readers from
+   * (objectui#13057). Only the bare call is routed: any argument after the
+   * type changes the URL, so such a call goes straight to the SDK.
+   *
+   * Every caller gets its own copy of the answer. Before this, every reader
+   * got its own parsed response, so a reader that changed what it was handed
+   * changed nothing anyone else read; a shared answer must not change that.
+   *
+   * Same wrap shape and the same bound as `installSaveAdvisoryInterceptor`:
+   * `meta` is an own property of a client this adapter built and never shares.
+   */
+  installViewListShare() {
+    const meta = this.client.meta;
+    const original = meta.getItems.bind(meta);
+    meta.getItems = ((...args) => {
+      if (args[0] !== "view" || args.length > 1) return original(...args);
+      return this.metadataCache.share(VIEW_LIST_KEY, () => original(...args)).then((answer) => structuredClone(answer));
+    });
+    for (const door of ["saveItem", "deleteItem", "publishItem", "rollbackItem"]) {
+      const write = meta[door];
+      if (typeof write !== "function") continue;
+      const bound = write.bind(meta);
+      meta[door] = (...args) => {
+        if (args[0] !== "view") return bound(...args);
+        return bound(...args).finally(() => this.metadataCache.invalidate?.(VIEW_LIST_KEY));
+      };
+    }
+  }
+  /**
+   * The published view list for this adapter's own readers
+   * ({@link listViews}, {@link listViewOverrides}): the answer stored under
+   * {@link VIEW_LIST_KEY} while it holds one (objectui#13057), else the
+   * client's read, which joins the request in flight for that key or starts
+   * one, and stores its answer (objectui#13044). Always a copy the caller may
+   * keep. Every path that should see a fresh list drops the key first; the
+   * list is in {@link VIEW_LIST_KEY}'s doc.
+   */
+  readViewList() {
+    const settled = this.metadataCache.getCachedSync(VIEW_LIST_KEY);
+    if (settled !== void 0) return Promise.resolve(structuredClone(settled));
+    return this.client.meta.getItems("view");
+  }
   async create(resource, data) {
     await this.connect();
     try {
@@ -4064,7 +4646,6 @@ var ObjectStackAdapter = class {
         () => this.fetchObjectSchemaFresh(objectName)
       );
       normalizeSchemaReferenceKeys(schema);
-      this.applyFieldWidgetOverrides(objectName, schema);
       return schema;
     } catch (error) {
       const errorObj = error;
@@ -4077,44 +4658,6 @@ var ObjectStackAdapter = class {
       throw createErrorFromResponse(errorObj, `getObjectSchema(${objectName})`);
     }
   }
-  /**
-   * ADR-0056 P2 (epic #2398) — stamp structured-widget hints onto platform
-   * fields whose framework type is a storage primitive (e.g. `textarea`) but
-   * whose authoring UX should be a structured editor. Only the render `widget`
-   * is added; the field's `type` (the storage contract) is untouched. Applied
-   * idempotently to the cached schema so form + detail both honor it. Widget
-   * components are registered as `field:<widget>` in `@object-ui/fields`.
-   */
-  applyFieldWidgetOverrides(objectName, schema) {
-    const OVERRIDES = {
-      // ADR-0056 pure model — a permission set's six authorization facets are
-      // *designed* in Studio's structured editors and only *assigned* (to
-      // users) in Setup. In Setup they render read-only as a summary + a
-      // "Design in Studio →" deep-link (the `permission-facet-link` widget),
-      // never as raw [Object]/JSON. The capability *editor* itself lives in
-      // Studio (epic #2398 P2).
-      sys_permission_set: {
-        object_permissions: "permission-facet-link",
-        field_permissions: "permission-facet-link",
-        system_permissions: "permission-facet-link",
-        row_level_security: "permission-facet-link",
-        tab_permissions: "permission-facet-link",
-        admin_scope: "permission-facet-link"
-      }
-    };
-    const overrides = OVERRIDES[objectName];
-    const fields = schema && typeof schema === "object" ? schema.fields : null;
-    if (!overrides || !fields) return;
-    for (const [fname, widget] of Object.entries(overrides)) {
-      if (Array.isArray(fields)) {
-        const f = fields.find((x) => x?.name === fname);
-        if (f && !f.widget) f.widget = widget;
-      } else {
-        const f = fields[fname];
-        if (f && !f.widget) f.widget = widget;
-      }
-    }
-  }
   /**
    * Fetch a single object's schema while always revalidating the browser cache.
    *
@@ -4189,6 +4732,38 @@ var ObjectStackAdapter = class {
       return [];
     }
   }
+  /**
+   * List the items one metadata registry type declares —
+   * `GET /api/v1/meta/:type`, through the client's `meta.getItems` — as
+   * `{ name, label }` headers for the `position-ref` / `permission-ref` field
+   * widgets (objectui#7611).
+   *
+   * Unlike {@link getObjects}, a failure REJECTS (the `DataSource` contract):
+   * the transport's own error propagates, and an answer without the spec's
+   * `items` list is refused rather than read as an empty registry, so a
+   * failed load can never reach the widget as "this registry declares
+   * nothing". Uncached, like `getObjects`: an item authored in Studio is
+   * listed on the next form that opens.
+   *
+   * An item without a string `name` is not listed (the widget stores the
+   * name, so there is nothing to store); a `label` that is not a string is
+   * left off rather than coerced.
+   */
+  async listMetadataItems(type) {
+    await this.connect();
+    const result = await this.client.meta.getItems(type);
+    if (!Array.isArray(result?.items)) {
+      throw new Error(`GET /meta/${type} answered without an items list`);
+    }
+    const out = [];
+    for (const it of result.items) {
+      const name = it?.name;
+      if (typeof name !== "string" || !name) continue;
+      const label = it.label;
+      out.push(typeof label === "string" && label ? { name, label } : { name });
+    }
+    return out;
+  }
   /**
    * Get access to the underlying ObjectStack client for advanced operations.
    */
@@ -4255,14 +4830,16 @@ var ObjectStackAdapter = class {
   invalidateViewKeys(objectName, viewName) {
     this.metadataCache.invalidate?.(`view:${objectName}:${viewName}`);
     this.metadataCache.invalidate?.(`view-overrides:${objectName}`);
+    this.metadataCache.invalidate?.(VIEW_LIST_KEY);
   }
   /**
    * Batch-fetch all persisted view overrides for an object.
    *
    * Per-view runtime overrides (density, column widths, sort, hidden
-   * columns, inlineEdit …) live in the SAME metadata namespace the
-   * write path uses: `type='view'`, `name=<viewId>` (see
-   * {@link updateViewConfig}). Loading them per-view fires N HTTP GETs
+   * columns, inlineEdit …) live in the SAME metadata namespace the view
+   * writes use: `type='view'`, `name=<viewId>` (see {@link createView} /
+   * {@link updateView}; the toolbar's `updateViewConfig` wrote overlays there
+   * until objectui#12504 retired it). Loading them per-view fires N HTTP GETs
    * that 404 for every view the user never customized — console noise on
    * every page load. This batch method performs a single
    * `GET /api/v1/meta/view` (returns `{type, items}`) and narrows the
@@ -4286,9 +4863,9 @@ var ObjectStackAdapter = class {
    *
    * Result is cached identically to {@link getView}, and EVERY view write —
    * on this adapter and above it — invalidates it through the one seam,
-   * {@link invalidateViewKeys}. For a long time only {@link updateViewConfig}
-   * did (objectui#4363), which left the other three adapter paths stale
-   * for the cache's 5-minute TTL. That gap does not self-heal: the consumer
+   * {@link invalidateViewKeys}. For a long time only `updateViewConfig` (since
+   * retired, objectui#12504) did (objectui#4363), which left the other three
+   * adapter paths stale for the cache's 5-minute TTL. That gap does not self-heal: the consumer
    * (`loadViewOverrides`, app-shell `ObjectView`) treats a RESOLVED map as
    * authoritative and deliberately does not re-probe per view — objectui#3774,
    * and correct, since re-probing reinstates the 404 flurry the batch read
@@ -4304,7 +4881,7 @@ var ObjectStackAdapter = class {
     await this.connect();
     const cacheKey = `view-overrides:${objectName}`;
     return await this.metadataCache.get(cacheKey, async () => {
-      const result = await this.client.meta.getItems("view");
+      const result = await this.readViewList();
       const items = Array.isArray(result?.items) ? result.items : Array.isArray(result) ? result : [];
       const out = {};
       for (const it of items) {
@@ -4339,104 +4916,6 @@ var ObjectStackAdapter = class {
       return null;
     }
   }
-  /**
-   * Persist a toolbar-driven view config patch — density, column widths,
-   * sort, hidden columns, inline edit. Symmetric counterpart to
-   * {@link getView}: writes the row to the server metadata store via
-   * `client.meta.saveItem`, then invalidates the matching cache entry so the
-   * next {@link getView} reflects the new payload. Returns the persisted item
-   * when the server echoes it, otherwise undefined.
-   *
-   * Called from exactly ONE production site — `ObjectView`'s
-   * `persistViewPatch`, for the toolbar toggle — but that ONE call site
-   * fires for BOTH kinds of active tab: a code-defined **system** view (no
-   * row of its own yet) and a genuinely user-created **saved** view (already
-   * has a row — the toggle is editing ITS OWN definition, not laying an
-   * overlay on top of it). Which one a given call means is NOT re-derived
-   * here from the write's shape (objectui#4227's own lesson: shape inference
-   * on this namespace is exactly what let a system view masquerade as
-   * saved) — the caller already knows, via the same `isSavedViewId`
-   * classification that gates the switcher's readonly flag and its five
-   * mutating handlers, and passes it as {@link opts.isSavedView}.
-   *
-   * - `isSavedView` false/omitted (system-view target, the common case and
-   *   the default for backward compatibility): stamps
-   *   {@link VIEW_OVERLAY_MARKER} so {@link listViews} excludes the row —
-   *   the original objectui#4227 fix.
-   * - `isSavedView` true: the marker is withheld. Stamping it here would
-   *   flag the saved view's OWN row as a personalization overlay, and
-   *   `listViews()` would exclude it on the very next read — the user's own
-   *   view would vanish from the switcher the moment they toggled its
-   *   density (objectui#4227 follow-up, PM review on PR #4713, measured:
-   *   `persistViewPatch` has no gate on which kind of tab is active, and
-   *   this method writes to the exact same `(type='view', name=viewId)` key
-   *   {@link createView}/the ADR-0034 `viewEnvelope` seam already used for
-   *   that view, so the write is an upsert onto the saved view's row, not a
-   *   new one).
-   *
-   * Per objectstack#7494's ruling, the overlay this writes (system-view
-   * case) is ORG-WIDE shared view settings, not a per-user preference — a
-   * true per-user scope is a parked v18 direction on the platform side.
-   *
-   * @param objectName - Object name (e.g. 'lead')
-   * @param viewId - View identifier (e.g. 'all_leads')
-   * @param config - Full view definition to persist
-   * @param opts.isSavedView - Whether `viewId` already names a saved view
-   *   (vs. a system view being personalized for the first time). Omit /
-   *   `false` for the default overlay-marking behavior.
-   */
-  /**
-   * [ADR-0066] Tell this adapter which system capabilities the session holds.
-   *
-   * Pass `undefined` for "no answer was reported" (a backend predating
-   * ADR-0066, or no permission provider mounted). Pass `[]` for a real,
-   * reported, empty grant — {@link maySetViewConfig} treats those two
-   * differently and callers must not collapse them, which is the same
-   * distinction `MePermissionsProvider` preserves natively (objectui#4656).
-   */
-  setSystemCapabilities(capabilities) {
-    this.systemCapabilities = capabilities ? [...capabilities] : void 0;
-  }
-  /**
-   * May this session write ORG-WIDE view configuration?
-   *
-   * **Unknown fails OPEN**, deliberately, and this is the one judgement in the
-   * gate worth reading twice. It is the doctrine `PermissionContextValue`
-   * .`hasCapabilities` states for every ADR-0066 gate in this repo
-   * (objectui#4656, framework#3923): the server enforces `manage_metadata` on
-   * the metadata door regardless of what the client believes, so a client-side
-   * denial on MISSING DATA cannot protect anything the server was not already
-   * protecting — it can only break a permitted user. Failing closed here would
-   * have refused the write on every deployment predating ADR-0066 and every
-   * host with no permission provider, which is "break the write for everyone"
-   * wearing the costume of a security fix.
-   *
-   * A REPORTED empty array gates strictly: "holds nothing" is a real answer.
-   */
-  maySetViewConfig() {
-    if (this.systemCapabilities === void 0) return true;
-    return this.systemCapabilities.includes(VIEW_CONFIG_CAPABILITY);
-  }
-  async updateViewConfig(objectName, viewId, config, opts) {
-    if (!this.maySetViewConfig()) {
-      throw new ViewConfigPermissionDeniedError(objectName, viewId);
-    }
-    await this.connect();
-    const merged = {
-      ...config || {},
-      object: config?.object || objectName,
-      name: viewId,
-      ...opts?.isSavedView ? {} : { [VIEW_OVERLAY_MARKER]: true }
-    };
-    const result = await this.client.meta.saveItem(
-      "view",
-      viewId,
-      merged
-    );
-    this.invalidateViewKeys(objectName, viewId);
-    if (result && result.item) return result.item;
-    return result ?? void 0;
-  }
   /**
    * List user-created views for a given object via the metadata overlay
    * API (ADR-0005). Replaces the legacy `find('sys_view', {...})` path
@@ -4493,7 +4972,7 @@ var ObjectStackAdapter = class {
         const draftItems = await this.metadataClient().withPreviewDrafts(true).list("view");
         items = Array.isArray(draftItems) ? draftItems : [];
       } else {
-        const result = await this.client.meta.getItems("view");
+        const result = await this.readViewList();
         items = Array.isArray(result?.items) ? result.items : Array.isArray(result) ? result : [];
       }
       const FORM_FAMILY = /* @__PURE__ */ new Set(["form", "detail"]);
@@ -4782,6 +5261,10 @@ var ObjectStackAdapter = class {
    *   the PUBLISHED half after the draft was discarded carries the partial
    *   state on the error's `outcome` — "draft gone, overlay left" is exactly
    *   what the old `{ deleted: boolean }` could not express.
+   *   Its message is the adapter's "NOT fully removed" sentence followed, on
+   *   the next line, by the server's own reason (objectui#12416), so
+   *   `formatMetadataError(err)` shows the remedy a refusal names; the
+   *   original error stays on `cause`.
    *
    * Invalidates through {@link invalidateViewKeys}: the deleted row leaves the
    * batch override map too, and a ghost entry there is what the object page
@@ -4807,9 +5290,12 @@ var ObjectStackAdapter = class {
           draft,
           published: { removed: false }
         };
+        const status = err?.status;
+        const refused = typeof status === "number" && status >= 400 && status < 500;
         throw Object.assign(
           new Error(
-            `deleteView: view "${viewName}" on object "${objectName}" is NOT fully removed \u2014 the draft home was ${draft.removed ? "discarded" : "already absent"}, but deleting the published overlay failed. The published row is still serving the view; retry the delete.`
+            `deleteView: view "${viewName}" on object "${objectName}" is NOT fully removed \u2014 the draft home was ${draft.removed ? "discarded" : "already absent"}, but deleting the published overlay failed. The published row is still serving the view${refused ? "." : "; retry the delete."}
+` + formatMetadataError(err)
           ),
           { cause: err, outcome }
         );
@@ -4909,14 +5395,41 @@ var ObjectStackAdapter = class {
    * @param appName - the app name as it appears in the URL segment
    */
   async probeAppAccess(appName) {
-    if (!appName) return "unknown";
+    return (await this.probeMetaItemAccess("app", appName)).verdict;
+  }
+  /**
+   * {@link probeAppAccess} for any metadata type whose by-name read refuses a
+   * caller (objectui#12112): why `name` is not in this session's list of
+   * `type`, plus the server's own sentence when it refused.
+   *
+   * Since objectstack#22731 a dashboard and a list view carry the app's gate:
+   * `GET /api/v1/meta/dashboard` and `/meta/view` list only what the caller may
+   * open, so a withheld item and a missing one are the same absence there, and
+   * the by-name read of one the caller does not hold answers `403`
+   * `PERMISSION_DENIED`, "the app arm's whole refusal (same emitter, same
+   * envelope)". The verdicts are therefore read exactly as for an app.
+   *
+   * `message` is the refusal's `message`, as the server wrote it: the one
+   * sentence that names the item and says it was refused. Only on `denied`.
+   *
+   * Nothing here throws, and nothing is cached: a verdict about the CALLER
+   * must not outlive a grant.
+   *
+   * @param type - the singular metadata type (`app`, `dashboard`, `view`)
+   * @param name - the item's name, as the by-name route addresses it
+   */
+  async probeMetaItemAccess(type, name) {
+    if (!type || !name) return { verdict: "unknown" };
     try {
-      const envelope = await this.client.meta.getItem("app", appName);
-      return metaEnvelopeCarriesItem(envelope) ? "granted" : "not_found";
+      const envelope = await this.client.meta.getItem(type, name);
+      return { verdict: metaEnvelopeCarriesItem(envelope) ? "granted" : "not_found" };
     } catch (err) {
-      if (isAppPermissionDeniedError(err)) return "denied";
-      if (isMetaItemAbsentError(err)) return "not_found";
-      return "unreachable";
+      if (isAppPermissionDeniedError(err)) {
+        const message = err?.message;
+        return typeof message === "string" && message.trim() ? { verdict: "denied", message } : { verdict: "denied" };
+      }
+      if (isMetaItemAbsentError(err)) return { verdict: "not_found" };
+      return { verdict: "unreachable" };
     }
   }
   /**
@@ -5004,12 +5517,9 @@ var ObjectStackAdapter = class {
         throw new AnalyticsResultShapeError(resource, contractResult);
       }
       const rawRows = contractResult.rows;
-      const measureMissing = rawRows.length > 0 && rawRows.every((row) => {
-        if (row == null) return true;
-        if (measureName in row && row[measureName] != null) return false;
-        if (valueKey in row && row[valueKey] != null) return false;
-        return true;
-      });
+      const measureMissing = rawRows.length > 0 && rawRows.every(
+        (row) => row == null || !(measureName in row) && !(valueKey in row)
+      );
       if (measureMissing) {
         return await this.aggregateViaFind(resource, params);
       }
@@ -5461,13 +5971,12 @@ function createObjectStackAdapter(config) {
   OBJECT_METADATA_TYPE,
   ObjectStackAdapter,
   ObjectStackError,
+  PREFERENCE_FAMILY_ROW_LIMIT,
   RELATIONSHIP_TYPES_REQUIRING_REFERENCE,
   UNRECOGNIZED_DROP_REASON,
   UnlowerableAnalyticsFilterError,
   UnloweredAggregateWhereError,
-  VIEW_CONFIG_CAPABILITY,
   VIEW_OVERLAY_OWNED_KEYS,
-  ViewConfigPermissionDeniedError,
   assertObjectMetadataWritable,
   classifyAnalyticsFailure,
   classifyImportMappingsFailure,
@@ -5475,13 +5984,17 @@ function createObjectStackAdapter(config) {
   clearSharedDiscoveryCache,
   createErrorFromResponse,
   createObjectStackAdapter,
+  createObjectStackUserPreferenceFamily,
   createObjectStackUserStateAdapter,
   createQuietHttpLogger,
+  draftChangesUnder,
+  dropServedPicklistOptions,
   extractDraftBody,
   formatHttpFailureMessage,
   formatMetadataError,
   formatMetadataIssue,
   getSharedDiscovery,
+  governingDraftChange,
   is404Error,
   isAnalyticsNotInstalledError,
   isApiAccessDeniedError,
@@ -5491,9 +6004,9 @@ function createObjectStackAdapter(config) {
   isMalformedFilterError,
   isMetaItemAbsentError,
   isObjectStackError,
-  isViewConfigPermissionDeniedError,
   narrowPersonalizationOverlay,
   normaliseClientError,
+  readDraftChanges,
   readSaveAdvisories,
   readTransactionalBatchCapability,
   serializeOrderBy,