@object-ui/react 15.0.0 → 16.1.0

package/CHANGELOG.md

@@ -1,5 +1,195 @@
 # @object-ui/react
 
+## 16.1.0
+
+### Minor Changes
+
+- 803558e: feat(data): thread the host's authenticated fetch into `provider: 'api'` data sources (#2725)
+
+  `provider: 'api'` view data sources went through a bare `globalThis.fetch`, so
+  custom endpoints (gantt composite trees, report aggregates) carried only
+  same-origin cookies while every native `/api/v1/*` request carried
+  `Authorization: Bearer` — the moment cookie HMAC verification failed (dev
+  restart rotating the fallback auth secret, cookie expiry/rotation in prod)
+  those views 401'd while the rest of the app kept working.
+
+  - **`@object-ui/react`** — `SchemaRendererProvider` accepts an optional
+    `apiFetch`; nested providers inherit it from their parent so re-wrapped
+    subtrees (react pages, preview surfaces) keep the host's authentication.
+    `useViewData` defaults the api-provider adapter's fetch to the context
+    `apiFetch` (explicit `adapterOptions.fetch` still wins).
+  - **`@object-ui/auth`** — `createAuthenticatedFetch` gains a
+    `sameOriginOnly` option: cross-origin URLs pass through to the bare fetch
+    with no `Authorization` / `X-Tenant-ID` / `Accept-Language`, so metadata-
+    supplied third-party URLs never see the platform token.
+  - **`@object-ui/app-shell`** — the console wires
+    `createAuthenticatedFetch({ sameOriginOnly: true })` (settle-signal wrapped)
+    as `apiFetch` on the root `SchemaRendererProvider`.
+  - **`@object-ui/plugin-gantt`** — `ObjectGantt` resolves its api-provider
+    DataSource with the context `apiFetch`, covering reads and write-backs.
+
+  Behaviour is unchanged for hosts that don't provide `apiFetch` (bare fetch +
+  cookies, as before).
+
+- 2e7d7f0: feat(evaluator): route `{ dialect: 'cel' }` component/action predicates to the canonical CEL engine (#2661)
+
+  Component and action `visible` / `disabled` / `hidden` predicates were evaluated
+  by the home-grown JS `ExpressionEvaluator`, while field rules
+  (`visibleWhen`/`readonlyWhen`/`requiredWhen`, via `fieldRules.ts`) and row/list
+  conditionals (via `evalRowPredicate`) already delegate to the canonical
+  `@objectstack/formula` engine. That split meant a `{ dialect: 'cel' }` predicate
+  in a renderer/action surface was executed as **JavaScript** — CEL-only forms
+  (`x in list`, `has()`, typed `==`, the `today()`/`daysFromNow()` catalog) behaved
+  differently from, or faulted against, the server's enforcement.
+
+  This converges the remaining tier onto the same engine:
+
+  - **`@object-ui/core`** — `ExpressionEvaluator.evaluateCondition` now detects a
+    `{ dialect: 'cel', source }` envelope and evaluates it on `@objectstack/formula`
+    (via `evalFieldPredicate`), binding the `record` namespace plus the whole
+    context bag as top-level scope (`record.*`, `features.*`, `user.*`, `app.*`).
+    Fail-soft to visible/enabled to match the legacy default; `throwOnError`
+    callers still fail closed on a _faulting_ predicate (a genuine `false` never
+    throws). This fixes every `SchemaRenderer` visibility/disabled read at once.
+  - **`@object-ui/react`** — `toPredicateInput` preserves a CEL envelope instead of
+    collapsing it to a `${source}` string, and `useCondition` accepts and forwards
+    the envelope (keyed on a stable `(dialect, source)` so it doesn't re-evaluate
+    each render). Action buttons (`action-icon`/`group`/`bar`/`button`) therefore
+    evaluate CEL `visible`/`enabled`/`disabled` on the canonical engine.
+
+  **Back-compat:** bare strings and `${…}` templates stay on the legacy JS path
+  (deprecation window); only an explicit `{ dialect: 'cel' }` envelope is rerouted.
+  `{ dialect: 'template' }` is unaffected.
+
+  Together with the `^15.1.1` alignment (#2662), a renderer CEL predicate now
+  reaches the identical verdict as the server — including the framework's
+  `dateField == today()` equality fix (objectstack-ai/framework#3205) once it
+  lands in a published 15.x. The broader home-grown-vs-canonical divergence
+  motivation is #2661.
+
+### Patch Changes
+
+- 7cf4051: chore(deps): align every `@objectstack/*` dependency to `^16.0.0-rc.0`
+
+  Bumps `@objectstack/spec` / `client` / `formula` / `lint` from `^15.1.1` to the
+  `16.0.0-rc.0` pre-release across the workspace (root + `apps/console` +
+  `apps/site` + all consuming packages). ObjectUI's own packages are already on
+  major 16, so this closes the 15↔16 skew between ObjectUI and the `@objectstack`
+  contract libraries (which publish in lockstep with `spec`).
+
+  This is a dependency alignment, not a behavioral migration: the full workspace
+  build (43/43) and the `@objectstack`-consuming package test suites
+  (`core` / `app-shell` / `data-objectstack` / `plugin-form` / `types`) are green
+  against `16.0.0-rc.0` with no source changes required.
+
+  Practical effect: `@objectstack/client@16.0.0-rc.0` now ships
+  `data.batchTransaction` (framework #3271), so `ObjectStackAdapter`'s feature
+  detect (`typeof client.data.batchTransaction === 'function'`) routes
+  master-detail cross-object saves through the typed SDK method instead of the
+  raw `fetch('/api/v1/batch')` fallback — realizing the "verify SDK path" half of
+  #2694. The raw-fetch branch stays as a defensive fallback (removal tracked in
+  #2694).
+
+- 549c67d: chore(lint): clear the mechanical baseline lint errors so these packages' lint gates protect them again
+
+  Extends the fields/core cleanup from #2709 (objectui#2713). These eight package
+  lints were red at baseline on `main`, so their per-package `lint` gate could not
+  catch new violations of the same class. Cleared every **error** (no behavior
+  change; warnings are out of scope):
+
+  - **`no-useless-catch`** (`data-objectstack`) — unwrapped five try/catch blocks
+    whose `catch` only re-threw; errors still propagate identically.
+  - **`preserve-caught-error`** (`cli`, `data-objectstack`, `react`) — the caught
+    error's message is inlined into the thrown `Error`; a scoped disable with a
+    justifying comment carries each one, because these packages target ES2020
+    whose lib types the 1-arg `Error` constructor only (so `{ cause }` won't
+    compile) — same reasoning as the core case in #2709.
+  - **`prefer-const`** (`plugin-calendar`, `plugin-map`) — `let`→`const` for
+    never-reassigned bindings.
+  - **`no-empty-object-type`** (`plugin-designer`) — empty extend-only interfaces
+    → equivalent `type` aliases.
+  - **`no-useless-assignment`** (`react`) — dropped a dead initializer that both
+    branches overwrite before it is read.
+  - **`no-require-imports`** (`plugin-calendar`, `plugin-timeline` tests) —
+    hoisted `vi.mock` factories now use an `async` factory with
+    `await import('react')` instead of `require('react')`.
+  - **stale `eslint-disable` directive** (`plugin-markdown`) — removed a
+    `react/no-danger` disable whose plugin is not loaded in the flat config (an
+    unknown-rule reference that ESLint v10 reports as an error); the rationale is
+    kept as a plain comment.
+
+- Updated dependencies [0318118]
+- Updated dependencies [1c8935a]
+- Updated dependencies [af1b0db]
+- Updated dependencies [8b8b744]
+- Updated dependencies [7cf4051]
+- Updated dependencies [8c1e415]
+- Updated dependencies [0ea5036]
+- Updated dependencies [2e7d7f0]
+- Updated dependencies [94d4876]
+- Updated dependencies [1100a8b]
+- Updated dependencies [7abe4cd]
+- Updated dependencies [549c67d]
+- Updated dependencies [ebe6494]
+- Updated dependencies [2b17339]
+- Updated dependencies [31b77d4]
+- Updated dependencies [6d4fbe6]
+- Updated dependencies [0a3710b]
+- Updated dependencies [f80aaf2]
+- Updated dependencies [62b9ab5]
+- Updated dependencies [1629313]
+- Updated dependencies [29c6040]
+- Updated dependencies [faebac3]
+- Updated dependencies [2331ac9]
+- Updated dependencies [199fa83]
+- Updated dependencies [eee4ded]
+  - @object-ui/i18n@16.1.0
+  - @object-ui/core@16.1.0
+  - @object-ui/data-objectstack@16.1.0
+  - @object-ui/types@16.1.0
+
+## 16.0.0
+
+### Minor Changes
+
+- d3e19ed: Adapt to framework 15.1: (1) ADR-0067 D2 all-or-nothing publishes — `formatPublishFailures` renders a rolled-back batch as ONE banner anchored on the causal item (`batch_aborted` entries are summarized, not listed as parallel errors); PackagesPage says "rolled back because X" instead of "{n} failed"; the AI chat publish toast surfaces the real reason instead of a bare count. Pre-15.1 partial-publish responses keep their per-item rendering. (2) ADR-0076 D12 honest discovery — `DiscoveryServiceStatus` gains `handlerReady` + `degraded`/`stub` statuses, new backward-tolerant `isServiceUsable()` helper (absent fields keep the pre-15.1 default; `stub`/`handlerReady:false` gate off; `degraded` stays usable), consumed by `isAuthEnabled`/`isAiEnabled` and `ConditionalAuthWrapper`.
+
+### Patch Changes
+
+- 59d4fa9: fix(detail): show the "Locked for approval" band on request-tracked backends (objectui#2618)
+
+  The DetailView approval-lock band keyed only off the record's own
+  `approval_status` field, so it never rendered on backends that track the lock
+  via an open approval request and never materialize that field — even though
+  the lock was real (writes rejected with `RECORD_LOCKED`). The record-level
+  `InlineEditContext` now carries the host's `locked`/`lockedReason` signal
+  (the same dual-source `approvalLocked` that already gates `canEdit` in
+  `RecordDetailView`), and the band renders from it while keeping `DetailView`
+  DataSource-agnostic. Also backfills the approval-lock strings into the detail
+  translation defaults so a bare DetailView shows the label, not the raw i18n key.
+
+- 195a651: refactor(spec-bridge): retire the hand-written `ListViewSpec`/`ListColumn` mirrors in the list-view bridge (#2231 follow-up)
+
+  The SpecBridge's list-view bridge kept a third hand-written copy of the ListView shape
+  (after the zod schema and the TS interface unified in the previous #2231 PR). It now
+  derives its input type from `@objectstack/spec/ui` (`Partial<ListView>`, spec `ListColumn`),
+  so the bridge can no longer drift from the protocol.
+
+  Behavior fix surfaced by the real types: spec `columns` is `string[] | ListColumn[]`, but
+  the old local interface only admitted `ListColumn[]` — a bare field-name column would have
+  produced a broken `{ accessorKey: undefined }` mapping. String columns now map to a default
+  column (`{ accessorKey: field, header: field }`).
+
+- Updated dependencies [210806a]
+- Updated dependencies [b4ef588]
+- Updated dependencies [ca0f5f0]
+- Updated dependencies [5534535]
+- Updated dependencies [9b8f978]
+  - @object-ui/types@16.0.0
+  - @object-ui/i18n@16.0.0
+  - @object-ui/core@16.0.0
+  - @object-ui/data-objectstack@16.0.0
+
 ## 15.0.0
 
 ### Patch Changes

package/README.md

@@ -81,6 +81,30 @@ function App() {
 }
 ```
 
+### SchemaRendererProvider
+
+Injects the host's data source (and optional capabilities) into every renderer
+below it:
+
+```tsx
+import { SchemaRendererProvider } from '@object-ui/react'
+
+<SchemaRendererProvider
+  dataSource={adapter}
+  // Optional: host-authenticated fetch used by `provider: 'api'` view data
+  // sources, so custom endpoints carry the same credentials (Authorization,
+  // tenant, locale headers) as the native data channel. When omitted,
+  // ApiDataSource falls back to the bare global fetch (cookies only).
+  apiFetch={authenticatedFetch}
+>
+  <SchemaRenderer schema={schema} />
+</SchemaRendererProvider>
+```
+
+Nested providers inherit `apiFetch` from their parent when they don't supply
+their own, so re-wrapped subtrees (embedded pages, preview surfaces) keep the
+host's authentication.
+
 ## Hooks
 
 ### useSchemaContext

package/dist/context/InlineEditContext.d.ts

@@ -31,6 +31,24 @@ export interface InlineEditContextValue {
      * is a no-op and consumers must not surface the edit affordance.
      */
     canEdit: boolean;
+    /**
+     * Whether this record is *approval-locked* — a pending approval request has
+     * the record locked for writes (the backend rejects updates with
+     * `RECORD_LOCKED`). This is a DISTINCT signal from `!canEdit`: a record can
+     * be non-editable for many reasons (no permission, wrong lifecycle stage),
+     * but only an approval lock warrants the "Locked for approval" band + recall
+     * affordance. The host computes it (objectui#2618) — typically from the
+     * record's `approval_status` field OR an open request in the approvals API —
+     * so the band renders from the same signal that gated `canEdit`, keeping the
+     * renderer DataSource-agnostic. Defaults to `false`.
+     */
+    locked: boolean;
+    /**
+     * Human-readable reason for the approval lock, surfaced as the band's
+     * tooltip. Optional — consumers fall back to their own localized default
+     * when omitted.
+     */
+    lockedReason?: string;
     /**
      * Draft of user-edited values. Holds ONLY the keys the user actually
      * changed, so the save path never writes computed / read-only / untouched
@@ -63,6 +81,15 @@ export interface InlineEditProviderProps {
      * a single source. Defaults to `true`.
      */
     canEdit?: boolean;
+    /**
+     * Whether the record is approval-locked (objectui#2618). Surfaced verbatim
+     * on the context so lock-aware consumers (the DetailView "Locked for
+     * approval" band) render from the host's signal instead of re-deriving it
+     * from a record field the backend may not materialize. Defaults to `false`.
+     */
+    locked?: boolean;
+    /** Optional human-readable lock reason, surfaced as the band tooltip. */
+    lockedReason?: string;
     children: React.ReactNode;
 }
 export declare const InlineEditProvider: React.FC<InlineEditProviderProps>;

package/dist/context/InlineEditContext.js

@@ -24,7 +24,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
  */
 import React from 'react';
 const InlineEditContext = React.createContext(null);
-export const InlineEditProvider = ({ canEdit = true, children, }) => {
+export const InlineEditProvider = ({ canEdit = true, locked = false, lockedReason, children, }) => {
     const [editing, setEditing] = React.useState(false);
     const [draft, setDraft] = React.useState({});
     const [autoFocusField, setAutoFocusField] = React.useState(null);
@@ -56,6 +56,8 @@ export const InlineEditProvider = ({ canEdit = true, children, }) => {
     const value = React.useMemo(() => ({
         editing,
         canEdit,
+        locked,
+        lockedReason,
         draft,
         autoFocusField,
         saving,
@@ -66,7 +68,7 @@ export const InlineEditProvider = ({ canEdit = true, children, }) => {
         reset: teardown,
         setSaving,
         setError,
-    }), [editing, canEdit, draft, autoFocusField, saving, error, enter, setField, teardown]);
+    }), [editing, canEdit, locked, lockedReason, draft, autoFocusField, saving, error, enter, setField, teardown]);
     return _jsx(InlineEditContext.Provider, { value: value, children: children });
 };
 /**

package/dist/context/SchemaRendererContext.d.ts

@@ -1,17 +1,26 @@
 import React from 'react';
 import type { DebugFlags } from '@object-ui/core';
+/**
+ * Host-provided fetch used for `provider: 'api'` view data sources so custom
+ * endpoints carry the same credentials (Authorization, tenant, locale headers)
+ * as the native data channel. Optional — when absent, ApiDataSource falls back
+ * to the bare global fetch (cookies only).
+ */
+export type ApiFetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
 interface SchemaRendererContextType {
     dataSource: any;
     debug?: boolean;
     debugFlags?: DebugFlags;
+    apiFetch?: ApiFetch;
 }
 declare const SchemaRendererContext: React.Context<SchemaRendererContextType | null>;
 export { SchemaRendererContext };
-export declare const SchemaRendererProvider: ({ children, dataSource, debug, debugFlags, }: {
+export declare const SchemaRendererProvider: ({ children, dataSource, debug, debugFlags, apiFetch, }: {
     children: React.ReactNode;
     dataSource: any;
     debug?: boolean;
     debugFlags?: DebugFlags;
+    apiFetch?: ApiFetch;
 }) => React.JSX.Element;
 export declare const useSchemaContext: () => SchemaRendererContextType;
 export declare const useDataScope: (path?: string) => any;

package/dist/context/SchemaRendererContext.js

@@ -2,8 +2,13 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { createContext, useContext, useMemo } from 'react';
 const SchemaRendererContext = createContext(null);
 export { SchemaRendererContext };
-export const SchemaRendererProvider = ({ children, dataSource, debug, debugFlags, }) => {
-    const value = useMemo(() => ({ dataSource, debug, debugFlags }), [dataSource, debug, debugFlags]);
+export const SchemaRendererProvider = ({ children, dataSource, debug, debugFlags, apiFetch, }) => {
+    // Nested providers (react-page, studio preview surfaces) re-wrap with their
+    // own dataSource but rarely know about the host's authenticated fetch —
+    // inherit it from the parent context so provider:'api' auth survives nesting.
+    const parent = useContext(SchemaRendererContext);
+    const effectiveApiFetch = apiFetch ?? parent?.apiFetch;
+    const value = useMemo(() => ({ dataSource, debug, debugFlags, apiFetch: effectiveApiFetch }), [dataSource, debug, debugFlags, effectiveApiFetch]);
     return (_jsx(SchemaRendererContext.Provider, { value: value, children: children }));
 };
 export const useSchemaContext = () => {

package/dist/hooks/useDiscovery.d.ts

@@ -9,6 +9,33 @@
  * Discovery service information structure.
  * Represents server capabilities and service status.
  */
+/**
+ * Per-service availability entry (framework 15.1+, ADR-0076 D12 "honest
+ * capabilities"): discovery no longer hardcodes every registered service as
+ * `available` — a dev fake reports `stub`, a serving fallback reports
+ * `degraded`, and `handlerReady` says whether a real handler backs the route.
+ * Older servers omit `handlerReady` and only ever report
+ * `available`/`unavailable`, so consumers must treat the new fields as
+ * OPT-IN signals (see {@link isServiceUsable}), never require them.
+ */
+export interface DiscoveryServiceStatus {
+    enabled: boolean;
+    status?: 'available' | 'degraded' | 'stub' | 'unavailable';
+    handlerReady?: boolean;
+}
+/**
+ * The backward-compatible "can I actually use this service?" check
+ * (ADR-0076 D12 console slice):
+ *
+ * - absent entry / absent fields → usable (pre-15.1 servers say nothing —
+ *   keep their historical default);
+ * - `enabled: false` or `handlerReady: false` → not usable;
+ * - `status: 'stub'` → not usable (a dev fake must not be treated as the
+ *   real service — the exact dishonesty D12 removed);
+ * - `status: 'degraded'` → USABLE (a fallback that keeps serving; callers
+ *   may surface a warning but must not turn the feature off).
+ */
+export declare function isServiceUsable(svc: DiscoveryServiceStatus | undefined | null): boolean;
 export interface DiscoveryInfo {
     /** Server name and version */
     name?: string;
@@ -27,25 +54,15 @@ export interface DiscoveryInfo {
     /** Service availability status */
     services?: {
         /** Authentication service status */
-        auth?: {
-            enabled: boolean;
-            status?: 'available' | 'unavailable';
+        auth?: DiscoveryServiceStatus & {
             message?: string;
         };
         /** Data access service status */
-        data?: {
-            enabled: boolean;
-            status?: 'available' | 'unavailable';
-        };
+        data?: DiscoveryServiceStatus;
         /** Metadata service status */
-        metadata?: {
-            enabled: boolean;
-            status?: 'available' | 'unavailable';
-        };
+        metadata?: DiscoveryServiceStatus;
         /** AI service configuration */
-        ai?: {
-            enabled: boolean;
-            status?: 'available' | 'unavailable';
+        ai?: DiscoveryServiceStatus & {
             /** AI service endpoint route (e.g. '/api/v1/ai') */
             route?: string;
         };
@@ -89,13 +106,16 @@ export declare function useDiscovery(): {
     isLoading: boolean;
     error: Error | null;
     /**
-     * Check if authentication is enabled on the server.
-     * Defaults to true if discovery data is not available.
+     * Check if authentication is enabled AND actually backed by a real
+     * handler (ADR-0076 D12 — a `stub`/`handlerReady:false` auth service is
+     * not treated as real auth). Defaults to true when discovery data is not
+     * available (pre-15.1 servers report nothing).
      */
     isAuthEnabled: boolean;
     /**
      * Check if AI service is enabled and available on the server.
-     * Defaults to false if discovery data is not available.
+     * Defaults to false if discovery data is not available; `degraded`
+     * still counts as available (it serves), `stub` never does.
      */
     isAiEnabled: boolean;
 };

package/dist/hooks/useDiscovery.js

@@ -7,6 +7,29 @@
  */
 import { useState, useEffect, useContext } from 'react';
 import { SchemaRendererContext } from '../context/SchemaRendererContext';
+/**
+ * The backward-compatible "can I actually use this service?" check
+ * (ADR-0076 D12 console slice):
+ *
+ * - absent entry / absent fields → usable (pre-15.1 servers say nothing —
+ *   keep their historical default);
+ * - `enabled: false` or `handlerReady: false` → not usable;
+ * - `status: 'stub'` → not usable (a dev fake must not be treated as the
+ *   real service — the exact dishonesty D12 removed);
+ * - `status: 'degraded'` → USABLE (a fallback that keeps serving; callers
+ *   may surface a warning but must not turn the feature off).
+ */
+export function isServiceUsable(svc) {
+    if (!svc)
+        return true;
+    if (svc.enabled === false)
+        return false;
+    if (svc.handlerReady === false)
+        return false;
+    if (svc.status === 'stub' || svc.status === 'unavailable')
+        return false;
+    return true;
+}
 /**
  * Hook to access discovery information from the ObjectStack server.
  *
@@ -88,15 +111,19 @@ export function useDiscovery() {
         isLoading,
         error,
         /**
-         * Check if authentication is enabled on the server.
-         * Defaults to true if discovery data is not available.
+         * Check if authentication is enabled AND actually backed by a real
+         * handler (ADR-0076 D12 — a `stub`/`handlerReady:false` auth service is
+         * not treated as real auth). Defaults to true when discovery data is not
+         * available (pre-15.1 servers report nothing).
          */
-        isAuthEnabled: discovery?.services?.auth?.enabled ?? true,
+        isAuthEnabled: isServiceUsable(discovery?.services?.auth),
         /**
          * Check if AI service is enabled and available on the server.
-         * Defaults to false if discovery data is not available.
+         * Defaults to false if discovery data is not available; `degraded`
+         * still counts as available (it serves), `stub` never does.
          */
         isAiEnabled: discovery?.services?.ai?.enabled === true &&
-            discovery?.services?.ai?.status === 'available',
+            (discovery?.services?.ai?.status === 'available' || discovery?.services?.ai?.status === 'degraded') &&
+            discovery?.services?.ai?.handlerReady !== false,
     };
 }

package/dist/hooks/useETagCache.js

@@ -222,6 +222,10 @@ export function useETagCache(userConfig = {}) {
             catch (e) {
                 if (e instanceof Error && e.message.startsWith('Unsupported'))
                     throw e;
+                // Any other parse failure collapses to a generic message; we can't
+                // attach `e` as the `Error` `cause` because this package targets
+                // ES2020, whose lib types the 1-arg `Error` constructor only.
+                // eslint-disable-next-line preserve-caught-error
                 throw new Error('Invalid URL');
             }
         }

package/dist/hooks/useExpression.d.ts

@@ -40,7 +40,10 @@ export declare function usePredicateScope(): Record<string, any>;
  * This is the canonical helper to use in renderers so we never end up with
  * `${[object Object]}` after JS template-literal interpolation.
  */
-export declare function toPredicateInput(value: unknown): string | boolean | undefined;
+export declare function toPredicateInput(value: unknown): string | boolean | {
+    dialect: 'cel';
+    source: string;
+} | undefined;
 /**
  * Hook for evaluating expressions with dynamic context
  *
@@ -51,7 +54,10 @@ export declare function toPredicateInput(value: unknown): string | boolean | und
  * ```
  */
 export declare function useExpression(expression: string | boolean | number | null | undefined, context?: Record<string, any>): any;
-export declare function useCondition(condition: string | boolean | undefined, context?: Record<string, any>, options?: {
+export declare function useCondition(condition: string | boolean | undefined | {
+    dialect?: string;
+    source?: string;
+}, context?: Record<string, any>, options?: {
     throwOnError?: boolean;
     label?: string;
 }): boolean;

package/dist/hooks/useExpression.js

@@ -63,7 +63,15 @@ export function toPredicateInput(value) {
         return `\${${value}}`;
     if (typeof value === 'object' && typeof value.source === 'string') {
         const src = value.source;
-        return src ? `\${${src}}` : undefined;
+        if (!src)
+            return undefined;
+        // #2661 — preserve a CEL-dialect envelope so `useCondition` routes it to the
+        // canonical `@objectstack/formula` engine (identical verdict to the server),
+        // instead of collapsing it to a `${source}` string on the legacy JS path.
+        // Every other dialect (template / unset) keeps the legacy `${…}` behavior.
+        if (value.dialect === 'cel')
+            return { dialect: 'cel', source: src };
+        return `\${${src}}`;
     }
     return undefined;
 }

package/dist/hooks/useRecordSearch.js

@@ -83,7 +83,8 @@ export function useRecordSearch(opts) {
     const candidates = useMemo(() => {
         if (!Array.isArray(objects) || objects.length === 0)
             return [];
-        let pool = objects;
+        // Assigned in both branches below before it's read; no dead initializer.
+        let pool;
         if (Array.isArray(objectNames) && objectNames.length > 0) {
             const byName = new Map();
             for (const obj of objects) {

package/dist/hooks/useViewData.js

@@ -44,18 +44,26 @@ import { SchemaRendererContext } from '../context/SchemaRendererContext';
  */
 export function useViewData(options) {
     const { viewData, resource = '', params, dataSource: explicitDataSource, adapterOptions, skip = false, } = options;
-    // Get context DataSource
+    // Get context DataSource + host-authenticated fetch
     const context = useContext(SchemaRendererContext);
     const contextDataSource = context?.dataSource ?? null;
+    const contextApiFetch = context?.apiFetch;
     // Resolve the DataSource — memoize to prevent re-creation on every render.
     // We key on the viewData provider + config identity.
     const resolvedDataSource = useMemo(() => {
         if (explicitDataSource)
             return explicitDataSource;
-        return resolveDataSource(viewData, contextDataSource, adapterOptions);
+        // Default the 'api' provider's fetch to the host's authenticated fetch
+        // (SchemaRendererContext.apiFetch) so custom endpoints carry the same
+        // credentials as native requests; explicit adapterOptions still win.
+        return resolveDataSource(viewData, contextDataSource, {
+            fetch: contextApiFetch,
+            ...adapterOptions,
+        });
         // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [
         explicitDataSource,
+        contextApiFetch,
         viewData?.provider,
         // For 'api' provider, key on read/write URLs
         viewData?.provider === 'api' ? viewData.read?.url : undefined,

package/dist/index.d.ts

@@ -12,4 +12,5 @@ export * from './LazyPluginLoader';
 export * from './spec-bridge';
 export * from './data-invalidation';
 export { resolveI18nLabel } from './utils/i18n';
-export { I18nProvider, useObjectTranslation, useObjectLabel, useSafeFieldLabel, useI18nContext, createI18n, getDirection, getAvailableLanguages, formatDate, formatDateTime, formatRelativeTime, formatCurrency, formatNumber, type I18nConfig, type I18nProviderProps, type TranslationKeys, type DateFormatOptions, type CurrencyFormatOptions, type NumberFormatOptions, } from '@object-ui/i18n';
+export { extractWriteErrorMessage, isPermissionError } from './utils/error-message';
+export { I18nProvider, useObjectTranslation, useSafeTranslate, useObjectLabel, useSafeFieldLabel, useI18nContext, createI18n, getDirection, getAvailableLanguages, formatDate, formatDateTime, formatRelativeTime, formatCurrency, formatNumber, type I18nConfig, type I18nProviderProps, type TranslationKeys, type DateFormatOptions, type CurrencyFormatOptions, type NumberFormatOptions, } from '@object-ui/i18n';

package/dist/index.js

@@ -13,5 +13,8 @@ export * from './spec-bridge';
 export * from './data-invalidation';
 // i18n utilities
 export { resolveI18nLabel } from './utils/i18n';
+// Write-error surfacing utilities (shared by drag-write plugins so a failed
+// PATCH — e.g. an RLS 403 — is never silently swallowed).
+export { extractWriteErrorMessage, isPermissionError } from './utils/error-message';
 // Built-in i18n support
-export { I18nProvider, useObjectTranslation, useObjectLabel, useSafeFieldLabel, useI18nContext, createI18n, getDirection, getAvailableLanguages, formatDate, formatDateTime, formatRelativeTime, formatCurrency, formatNumber, } from '@object-ui/i18n';
+export { I18nProvider, useObjectTranslation, useSafeTranslate, useObjectLabel, useSafeFieldLabel, useI18nContext, createI18n, getDirection, getAvailableLanguages, formatDate, formatDateTime, formatRelativeTime, formatCurrency, formatNumber, } from '@object-ui/i18n';

package/dist/spec-bridge/bridges/list-view.d.ts

@@ -6,79 +6,15 @@
  * LICENSE file in the root directory of this source tree.
  */
 import type { BridgeFn } from '../types';
-import type { ListViewGalleryConfig, ListViewTimelineConfig } from '@object-ui/types';
-interface ListColumn {
-    field: string;
-    label?: string;
-    width?: number;
-    align?: string;
-    hidden?: boolean;
-    sortable?: boolean;
-    resizable?: boolean;
-    wrap?: boolean;
-    type?: string;
-    pinned?: string;
-    summary?: any;
-    link?: any;
-    action?: any;
-}
-interface ListViewSpec {
-    name?: string;
-    label?: string;
-    type?: string;
-    data?: any;
-    columns?: ListColumn[];
-    filter?: any;
-    sort?: any;
-    searchableFields?: string[];
-    filterableFields?: string[];
-    selection?: any;
-    pagination?: any;
-    rowHeight?: string;
-    resizable?: boolean;
-    striped?: boolean;
-    bordered?: boolean;
-    grouping?: any;
-    rowColor?: any;
-    navigation?: any;
-    kanban?: any;
-    calendar?: any;
-    gantt?: any;
-    gallery?: ListViewGalleryConfig;
-    timeline?: ListViewTimelineConfig;
-    rowActions?: string[];
-    bulkActions?: string[];
-    bulkActionDefs?: any[];
-    virtualScroll?: boolean;
-    conditionalFormatting?: Array<{
-        condition: string;
-        style: Record<string, string>;
-    }>;
-    inlineEdit?: boolean;
-    exportOptions?: any;
-    emptyState?: {
-        title?: string;
-        message?: string;
-        icon?: string;
-    };
-    userActions?: any;
-    appearance?: any;
-    /** UX-only hint: collapse appearance/grouping cluster into a single popover. */
-    compactToolbar?: boolean;
-    tabs?: any[];
-    addRecord?: any;
-    showRecordCount?: boolean;
-    allowPrinting?: boolean;
-    aria?: {
-        ariaLabel?: string;
-        ariaDescribedBy?: string;
-        role?: string;
-    };
-    sharing?: any;
-    hiddenFields?: string[];
-    fieldOrder?: string[];
-    description?: string;
-}
+import type { ListView } from '@objectstack/spec/ui';
+/**
+ * Bridge input: the spec-canonical ListView (#2231 — the former hand-written
+ * `ListViewSpec`/`ListColumn` mirrors are retired; the shape now derives from
+ * `@objectstack/spec/ui` and can no longer drift). Relaxed to `Partial` because
+ * hosts routinely hand the bridge fragmentary view-configs (every field was
+ * optional in the old mirror too, including spec-required `columns`).
+ */
+type ListViewSpec = Partial<ListView>;
 /** Transforms a ListView spec into a DataTable SchemaNode */
 export declare const bridgeListView: BridgeFn<ListViewSpec>;
 export {};

package/dist/spec-bridge/bridges/list-view.js

@@ -6,6 +6,10 @@
  * LICENSE file in the root directory of this source tree.
  */
 function mapColumn(col) {
+    // Spec-legacy shorthand: a bare field name stands for a default column.
+    if (typeof col === 'string') {
+        return { accessorKey: col, header: col };
+    }
     const mapped = {
         accessorKey: col.field,
         header: col.label ?? col.field,

package/dist/utils/error-message.d.ts

@@ -0,0 +1,21 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Pull a clean, human-readable message out of a failed write. Strips noisy
+ * backend prefixes (`[Security] `, `PERMISSION_DENIED: `) so it reads well in a
+ * toast — mirrors `plugin-detail`'s `cleanError`. Returns `null` when nothing
+ * usable can be extracted, so callers fall back to a generic localized string.
+ */
+export declare function extractWriteErrorMessage(err: unknown): string | null;
+/**
+ * True when a failed write was rejected for authorization reasons (HTTP 403 /
+ * `PERMISSION_DENIED` / `FORBIDDEN` / a row-level-security denial). Lets a
+ * caller show a friendly "you don't have permission" toast rather than dumping
+ * the raw server text.
+ */
+export declare function isPermissionError(err: unknown): boolean;

package/dist/utils/error-message.js

@@ -0,0 +1,89 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Helpers for turning a failed data-source write into user-facing feedback.
+ *
+ * Different DataSource adapters throw differently shaped errors:
+ *   - the ObjectStack adapter (`@object-ui/data-objectstack`) decorates the
+ *     thrown Error with `httpStatus` + a machine-readable `code` and puts the
+ *     server text on `.message` (sometimes also a parsed body on `.details`);
+ *   - `ApiDataSource` appends the raw JSON response body as a tail on the
+ *     message string (`… — {"error":…,"code":…}`).
+ *
+ * These helpers normalise across both so a caller's `catch` can surface the
+ * real reason (e.g. a row-level-security denial) instead of swallowing it.
+ */
+function firstString(...vals) {
+    for (const v of vals) {
+        if (typeof v === 'string' && v.trim())
+            return v;
+    }
+    return null;
+}
+/**
+ * Pull a clean, human-readable message out of a failed write. Strips noisy
+ * backend prefixes (`[Security] `, `PERMISSION_DENIED: `) so it reads well in a
+ * toast — mirrors `plugin-detail`'s `cleanError`. Returns `null` when nothing
+ * usable can be extracted, so callers fall back to a generic localized string.
+ */
+export function extractWriteErrorMessage(err) {
+    const e = err;
+    // 1) Structured server body, when the adapter attaches one.
+    let msg = e && typeof e === 'object'
+        ? firstString(e.details?.error, e.details?.message, e.error)
+        : null;
+    // 2) Otherwise the Error message itself. ApiDataSource embeds the raw JSON
+    //    response body as a tail — parse it out when present.
+    if (!msg) {
+        const raw = err instanceof Error
+            ? err.message
+            : typeof err === 'string'
+                ? err
+                : typeof e?.message === 'string'
+                    ? e.message
+                    : '';
+        const brace = raw.indexOf('{');
+        if (brace >= 0) {
+            try {
+                const body = JSON.parse(raw.slice(brace));
+                msg = firstString(body?.error, body?.message);
+            }
+            catch {
+                /* tail wasn't JSON — fall through to the raw message */
+            }
+        }
+        if (!msg && raw.trim())
+            msg = raw;
+    }
+    if (!msg)
+        return null;
+    const clean = msg
+        .replace(/^\[[^\]]+\]\s*/, '')
+        .replace(/^[A-Z][A-Z0-9_]+:\s*/, '')
+        .trim();
+    return clean || null;
+}
+/**
+ * True when a failed write was rejected for authorization reasons (HTTP 403 /
+ * `PERMISSION_DENIED` / `FORBIDDEN` / a row-level-security denial). Lets a
+ * caller show a friendly "you don't have permission" toast rather than dumping
+ * the raw server text.
+ */
+export function isPermissionError(err) {
+    const e = err;
+    if (!e || typeof e !== 'object')
+        return false;
+    const status = e.httpStatus ?? e.status ?? e.statusCode;
+    if (status === 403)
+        return true;
+    const code = firstString(e.code, e.details?.code) ?? '';
+    if (code === 'PERMISSION_DENIED' || code === 'FORBIDDEN')
+        return true;
+    const text = `${typeof e.message === 'string' ? e.message : ''} ${e.details?.error ?? e.error ?? ''}`;
+    return /row-level security|access denied|permission denied|not permitted/i.test(text);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/react",
-  "version": "15.0.0",
+  "version": "16.1.0",
   "type": "module",
   "license": "MIT",
   "description": "React bindings and SchemaRenderer component for Object UI",
@@ -24,12 +24,12 @@
     }
   },
   "dependencies": {
-    "@objectstack/spec": "^14.6.0",
-    "react-hook-form": "^7.81.0",
-    "@object-ui/core": "15.0.0",
-    "@object-ui/data-objectstack": "15.0.0",
-    "@object-ui/i18n": "15.0.0",
-    "@object-ui/types": "15.0.0"
+    "@objectstack/spec": "^16.0.0-rc.0",
+    "react-hook-form": "^7.82.0",
+    "@object-ui/core": "16.1.0",
+    "@object-ui/data-objectstack": "16.1.0",
+    "@object-ui/i18n": "16.1.0",
+    "@object-ui/types": "16.1.0"
   },
   "peerDependencies": {
     "react": "^18.0.0 || ^19.0.0",