datagrok-tools 6.7.4 → 6.7.6

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> datagrok-tools@6.7.4 build /home/runner/work/public/public/tools
+> datagrok-tools@6.7.6 build /home/runner/work/public/public/tools
 > node build.js
 
 Successfully compiled 51 files with Babel.

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Datagrok-tools changelog
 
+## v.next
+
+* `grok test --skip-gc` launches the browser without `--expose-gc`, so the test runner skips its garbage collection after every test; a suite of small unit tests runs several times faster (ComputeUtils driver tests: 92 s to 19 s)
+* `grok setup` installs corepack when it is missing instead of asking for it by hand: Node 25 no longer bundles corepack, so every fresh checkout on current Node stopped at that step
+* `grok setup` also removes the `.js`/`.d.ts` files the npm-era tsc emitted beside js-api and library sources: the workspace emits into `dist/`, and a leftover `js-api/grok.js` shadowed the `grok` command in cmd.exe
+* GROK-20753: `domain-schema.schema.json` accepts the `hierarchy` table key (the table is a tree: exactly one ref column targeting itself) — without it `grok api` / `grok check` refused a manifest the server accepts
+* GROK-20753: `grok api --ui` emits typed u2 handles instead of the retired `@datagrok-libraries/domain-ui` sugar: `src/generated/db-ui.ts` is now `get<Schema>Db(): Promise<<Schema>Db>` → `{schema, data: <schema>Db, tables: {<plural>: DomainTable<Row>, ...}}`, every table opened in parallel behind one await and cached per page (presence-persisted as before). `grok add app --domain <schema>.<table>` scaffolds the u2 zero-code tier the way the Stockroom package is built: a three-line `//tags: app` function over `domains.table(...).app()`, `src/app.spec.json` (the same app as a designer-editable `dg-ui/1` spec), a one-table starter `databases/<schema>/schema.json` when the package declares none, the `@datagrok-libraries/u2` workspace dependency and an `rspack.config.js` carrying the `u2core` external (everything else — the css loaders, the tsconfig — comes from `@datagrok/build-config`)
+* GROK-20298: `grok s domains access <schema.table>` replaces `capabilities` — the server's `{can, fields, ...}` access shape
+
+## 6.7.5 (2026-09-17)
+
+* `grok create` works outside the pnpm workspace and new packages use `@datagrok/build-config` 1.x
+
 ## 6.7.4 (2026-09-17)
 
 * `grok create`, `grok publish`, `grok test` and `grok run` work inside the pnpm workspace

package/CLAUDE.md

@@ -207,7 +207,7 @@ Based on `node:22-bookworm-slim`. Pre-installed:
 #### Entrypoint (`entrypoint.sh`)
 
 1. **Repo detection:** checks if `/workspace/repo` is the public repo (has `.git` + `js-api/`) or monorepo (`public/js-api/`)
-2. **Auto-clone:** if workspace is not the public repo, sparse-clones it to `$DG_PUBLIC_DIR` (default `/workspace/datagrok`) — excludes `connectors/`, `docker/`, `environments/`, `python-api/`, etc. for speed. Branch resolved as: `DG_PUBLIC_BRANCH` > `DG_VERSION` mapped to branch > `master` fallback
+2. **Auto-clone:** if workspace is not the public repo, sparse-clones it to `$DG_PUBLIC_DIR` (default `/workspace/datagrok`) — excludes `docker/`, `environments/`, `python-api/`, etc. for speed. Branch resolved as: `DG_PUBLIC_BRANCH` > `DG_VERSION` mapped to branch > `master` fallback
 3. **Workspace linking:** for non-public repos, symlinks `/workspace/repo` into the cloned repo's `packages/` dir and links `.claude`/`CLAUDE.md` at `/workspace/` for context discovery
 4. **Grok config:** auto-creates `~/.grok/config.yaml` pointing to `http://datagrok:8080/api` with key `admin` (only if config doesn't already exist)
 

package/GROK_S.md

@@ -58,7 +58,7 @@ servers:
 
 - `grok login <server>` is the way to add a server: it registers a keypair and writes the
   entry for you. The private key stays in `~/.grok/keys/<alias>.json`.
-  See [keypair authentication](../help/govern/access-control/keypair-authentication.md).
+  See [keypair authentication](https://datagrok.ai/help/govern/access-control/keypair-authentication).
 - `grok config add --alias <name> --server <url> [--key <developer-key>]` writes an entry by
   hand. The developer key is deprecated; omit it when the server is reached with a keypair.
 - Add `--default` to make it the active server.
@@ -336,7 +336,7 @@ grok s domains list grit                            # tables of one schema: secu
 grok s domains get grit                             # the manifest, as JSON (doubles as an export)
 grok s domains get grit.issue                       # the table's columns (--output json: its manifest section)
 grok s domains get grit.issue <row-id>              # one row
-grok s domains capabilities grit.issue              # what the current user may do on the table
+grok s domains access grit.issue                    # can.view/insert/edit/delete/share + editable/readonly column lists
 ```
 
 ### Querying
@@ -533,7 +533,7 @@ Actions the server accepts: `create | get | delete` for `users`, `groups`, `conn
 `functions`, `queries`, `scripts` (`get | delete` for `reports`), `functions.run`
 (`{name, params}`), and `files.list | get | put | delete`. For `files.put`, add
 `"source": "<local-path>"` and the CLI base64-encodes the file into `content` before sending.
-`users.delete` removes the entity record only (see "List / count / get / delete").
+`users.delete` is refused, as is `DELETE /entities/{id}` on a user or its personal group: users are blocked, never deleted (see "List / count / get / delete").
 
 ## Scripting pattern
 
@@ -905,6 +905,9 @@ only ever read from.
   URL, the key, and basic connectivity, and returns per-module status if the server is
   reachable. Fall back to `grok s raw GET /users/current` to isolate auth issues. A `--host`
   URL that is not the API base fails at login with the reason (`should end with /api`).
-- Cross-instance sync (1.28 servers): `grok s sync pairs list`, `sync setups list --pair <id>`,
-  `sync setup get <id>`, `sync run <id>`; on 1.27 the routes do not exist and the commands
-  answer "not found".
+- Cross-instance sync (1.28 servers): `grok s sync pairs list` (`/sync/pairs`),
+  `sync setups list --pair <id>`, `sync setup get <id>` and `sync setup runs <id>`
+  (`/entity_sync_funcs`; a setup is an `EntitySyncFunc`, each run a `FuncCall` whose
+  `options.syncResult` holds the per-item outcome). The server has no run route: runs start
+  from the setup's **Run** button or its schedule. On 1.27 the routes do not exist and the
+  commands answer "not found".

package/bin/commands/add.js

@@ -12,8 +12,14 @@ var utils = _interopRequireWildcard(require("../utils/utils"));
 var color = _interopRequireWildcard(require("../utils/color-utils"));
 var _api = require("./api");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
-/** The domain-ui library version a scaffolded domain app depends on. */
-const domainUiDependency = '^0.1.0';
+/** What a u2 consumer package carries beside the imports (the Grit reference package is the
+ * answer key): u2 is not on npm, so the dependency is the workspace link, and `u2core` is the one
+ * external `@datagrok/build-config` does not know about. The css imports and the tsconfig need
+ * nothing — the shared bundler config carries the loaders and the tsconfig extends the base. */
+const u2Dependency = 'workspace:^';
+const u2DgModule = '@datagrok-libraries/u2/src/dg/index.js';
+const u2RspackExternal = `'datagrok-api/u2core': 'DG.U2'`;
+const u2RspackConfig = [`const {bundler} = require('@datagrok/build-config');`, '', `module.exports = bundler({externals: {${u2RspackExternal}}});`, ''].join('\n');
 function add(args) {
   // `--domain` is the only option any `add` entity takes (`grok add app --domain`).
   const nOptions = Object.keys(args).length - 1 - (args.domain === undefined ? 0 : 1);
@@ -28,6 +34,7 @@ function add(args) {
   const tsPath = _path.default.join(srcDir, 'package.ts');
   const detectorsPath = _path.default.join(curDir, 'detectors.js');
   const webpackConfigPath = _path.default.join(curDir, 'webpack.config.js');
+  const rspackConfigPath = _path.default.join(curDir, 'rspack.config.js');
   const scriptsDir = _path.default.join(curDir, 'scripts');
   const queryDir = _path.default.join(curDir, 'queries');
   const queryPath = _path.default.join(queryDir, 'queries.sql');
@@ -99,22 +106,52 @@ function add(args) {
     return [manifest.name, Object.keys(manifest.tables)];
   }
 
-  /** Adds `import {domains} from '@datagrok-libraries/domain-ui';` to the package
-   * entry file, after its existing imports (which webpack's externals depend on). */
-  function addDomainUiImport() {
+  /** Adds the u2 import and the stylesheet imports to the package entry file, after its
+   * existing imports (which webpack's externals depend on). */
+  function addU2Imports() {
     const contents = _fs.default.readFileSync(packageEntry, 'utf8');
-    if (contents.includes('@datagrok-libraries/domain-ui')) return;
+    if (contents.includes(u2DgModule)) return;
     const eol = contents.includes('\r\n') ? '\r\n' : '\n';
-    const line = `import {domains} from '@datagrok-libraries/domain-ui';`;
+    const imports = _fs.default.readFileSync(_path.default.join(templateDir, 'entity-template', 'domain-app-imports.js'), 'utf8').trimEnd().split(/\r?\n/);
     const lines = contents.split(/\r?\n/);
     let last = -1;
     for (let i = 0; i < lines.length; i++) if (/^(import .*|export .* from .*);\s*$/.test(lines[i])) last = i;
-    lines.splice(last + 1, 0, line);
+    lines.splice(last + 1, 0, ...imports);
     _fs.default.writeFileSync(packageEntry, lines.join(eol), 'utf8');
   }
 
+  /** The u2 wiring of the build: the workspace dependency in package.json and the `u2core`
+   * external in rspack.config.js. Each edit is skipped where the file already carries it. */
+  function addU2Wiring() {
+    const packageObj = JSON.parse(_fs.default.readFileSync(packagePath, 'utf8'));
+    packageObj.dependencies = packageObj.dependencies ?? {};
+    packageObj.dependencies['@datagrok-libraries/u2'] ??= u2Dependency;
+    _fs.default.writeFileSync(packagePath, JSON.stringify(packageObj, null, 2), 'utf8');
+    if (!_fs.default.existsSync(rspackConfigPath)) _fs.default.writeFileSync(rspackConfigPath, u2RspackConfig, 'utf8');else if (!_fs.default.readFileSync(rspackConfigPath, 'utf8').includes('datagrok-api/u2core')) color.warn(`rspack.config.js is already there — add \`externals: {${u2RspackExternal}}\` to it by hand`);
+  }
+
+  /** Declares a one-table starter schema in `databases/<schema>/schema.json` — the fresh-package
+   * case, where the schema is the app's own. */
+  function writeStarterManifest(schema, table) {
+    const target = _path.default.join(curDir, 'databases', schema, 'schema.json');
+    const template = _fs.default.readFileSync(_path.default.join(templateDir, 'entity-template', 'domain-schema.json'), 'utf8');
+    _fs.default.mkdirSync(_path.default.dirname(target), {
+      recursive: true
+    });
+    _fs.default.writeFileSync(target, template.replace(/#{SCHEMA}/g, schema).replace(/#{TABLE}/g, table), 'utf8');
+    console.log(`Declared a starter schema in databases/${schema}/schema.json — ` + `delete it if \`${schema}\` is deployed by another package`);
+  }
+
+  /** The same app as a `dg-ui/1` spec the designer edits, over the first table; kept once written. */
+  function writeAppSpec(schema, table) {
+    const target = _path.default.join(srcDir, 'app.spec.json');
+    if (_fs.default.existsSync(target)) return;
+    const template = _fs.default.readFileSync(_path.default.join(templateDir, 'entity-template', 'domain-app.spec.json'), 'utf8');
+    _fs.default.writeFileSync(target, utils.replacers['DOMAIN_TABLE'](template, `${schema}.${table}`).replace(/#{SOURCE}/g, (0, _api.tableProp)(table)), 'utf8');
+  }
+
   /** `grok add app [name] --domain <schema>[.<table>] | <schema.json path>` — a working
-   * browse/CRUD app per table, from the `domain-ui` defaults alone. */
+   * browse/CRUD app per table, from the u2 defaults alone (`domains.table(...).app()`). */
   function addDomainApp(domainArg, appName) {
     if (typeof domainArg !== 'string' || domainArg === '') return color.error('`--domain` needs `<schema>` or `<schema>.<table>`, ' + 'or a path to a schema.json manifest');
     let schema;
@@ -127,7 +164,10 @@ function add(args) {
       if (!/^[A-Za-z_]\w*(\.[A-Za-z_]\w*)?$/.test(domainArg)) return color.error(`Malformed domain address: ${domainArg}. ` + 'Use `<schema>`, `<schema>.<table>`, or a path to a schema.json manifest');
       const dot = domainArg.indexOf('.');
       schema = dot === -1 ? domainArg : domainArg.slice(0, dot);
-      if (dot !== -1) tables = [domainArg.slice(dot + 1)];else {
+      if (dot !== -1) {
+        tables = [domainArg.slice(dot + 1)];
+        if (!_fs.default.existsSync(_path.default.join(curDir, 'databases', schema, 'schema.json'))) writeStarterManifest(schema, tables[0]);
+      } else {
         // Table names of a whole schema are only known offline from its manifest.
         const manifest = readManifest(_path.default.join(curDir, 'databases', schema, 'schema.json'));
         if (manifest == null) return color.error(`No \`databases/${schema}/schema.json\` in this package: name a table ` + `(\`--domain ${schema}.<table>\`) or pass the path to the schema manifest`);
@@ -154,17 +194,12 @@ function add(args) {
       addedTables.push(`${schema}.${table}`);
     }
     if (added.length === 0) return true;
-    addDomainUiImport();
-    const packageObj = JSON.parse(_fs.default.readFileSync(packagePath, 'utf8'));
-    packageObj.dependencies = packageObj.dependencies ?? {};
-    if (packageObj.dependencies['@datagrok-libraries/domain-ui'] === undefined) {
-      packageObj.dependencies['@datagrok-libraries/domain-ui'] = domainUiDependency;
-      _fs.default.writeFileSync(packagePath, JSON.stringify(packageObj, null, 2), 'utf8');
-    }
+    addU2Imports();
+    addU2Wiring();
+    writeAppSpec(schema, tables[0]);
 
-    // Manifests in the package get typed clients AND the typed UI wrappers the app
-    // code can switch to; a schema deployed by another package has none, and the
-    // reflective app above needs none.
+    // Manifests in the package get typed clients AND the typed u2 handles the app code can
+    // switch to; the reflective app above needs neither.
     if (!(0, _api.generateDomainClients)(curDir, {
       ui: true
     })) return false;

package/bin/commands/api.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.api = api;
 exports.generateDomainClients = generateDomainClients;
+exports.tableProp = tableProp;
 var _fs = _interopRequireDefault(require("fs"));
 var _path = _interopRequireDefault(require("path"));
 var _ignoreWalk = _interopRequireDefault(require("ignore-walk"));
@@ -21,23 +22,20 @@ const packageFuncDirs = ['package.ts', 'package.g.ts'];
 const apiFile = 'package-api.ts';
 const dbFile = 'db.ts';
 const dbUiFile = 'db-ui.ts';
-/** What `db-ui.ts` imports from `@datagrok-libraries/domain-ui`. */
-const domainUiImports = ['domainHandler', 'domains', 'DomainAppView', 'DomainAppViewOptions', 'DomainDb', 'DomainDialogOptions', 'DomainEntityAppView', 'DomainEntityAppViewOptions', 'DomainForm', 'DomainFormOptions', 'DomainGrid', 'DomainGridOptions', 'DomainTable', 'EntityListOptions', 'EntityListWidget'];
-/** {@link DomainDb} members a table's camelCase property name must not shadow. */
-const domainDbReservedProps = ['name', 'tables', 'table', 'acquire'];
+/** Where `db-ui.ts` takes the u2 domain stack from — the same specifier Grit and Stockroom use
+ * (u2 is a relative-path dependency without a `dg` subpath export). */
+const u2DgModule = '@datagrok-libraries/u2/src/dg/index.js';
 
 /** Naive English plural of a (snake_case) table name — `issue` → `issues`, `box` →
- * `boxes`, `category` → `categories`. MUST match domain-ui's `pluralizeTableName`:
- * the runtime `DomainDb` assigns its per-table properties with the same rule, so the
- * generated typed interfaces bind to it. */
+ * `boxes`, `category` → `categories`. */
 function pluralizeTableName(name) {
   if (/(s|x|z|ch|sh)$/.test(name)) return name + 'es';
   if (/[^aeiou_]y$/.test(name)) return name.slice(0, -1) + 'ies';
   return name + 's';
 }
 
-/** The camelCase plural property name a table gets on the schema client and the
- * schema UI handle (`issue_label` → `issueLabels`). */
+/** The camelCase plural property name a table gets on the schema client and under the
+ * schema handle's `tables` (`issue_label` → `issueLabels`). */
 function tableProp(tableName) {
   return utils.snakeToCamelCase(pluralizeTableName(tableName), false);
 }
@@ -190,8 +188,8 @@ function checkNameColision(name) {
 
 /** Generates `src/generated/db.ts` with typed clients for the package's domain schemas
  * (`databases/<schema>/schema.json` manifests), and — with [options].ui, or whenever the
- * file is already there — `src/generated/db-ui.ts` with the typed UI sugar over
- * `@datagrok-libraries/domain-ui`. No-op for packages without manifests. */
+ * file is already there — `src/generated/db-ui.ts` with the typed u2 handles
+ * (`get<Schema>Db()` → one `DomainTable<Row>` per table). No-op for packages without manifests. */
 function generateDomainClients(packageDir = curDir, options) {
   const databasesDir = _path.default.join(packageDir, 'databases');
   if (!_fs.default.existsSync(databasesDir)) return true;
@@ -231,7 +229,7 @@ function generateDomainClients(packageDir = curDir, options) {
   _fs.default.writeFileSync(_path.default.join(genDir, dbFile), normEol(content).replace(/\n/g, '\r\n'), 'utf8');
   color.log(`Successfully generated file src/generated/${dbFile}${sep}`, 'success');
   if (ui) {
-    const uiContent = annotationForDbUiFile + `import * as DG from 'datagrok-api/dg';${sep}` + wrapTokens(`import {`, domainUiImports, ', ', `} from '@datagrok-libraries/domain-ui';`) + sep + wrapTokens(`import {`, dbImports, ', ', `} from './${dbFile.replace(/\.ts$/, '')}';`) + sep + sep + uiParts.join(sep);
+    const uiContent = annotationForDbUiFile + `import {domains, DomainTable} from '${u2DgModule}';${sep}` + wrapTokens(`import {`, dbImports, ', ', `} from './${dbFile.replace(/\.ts$/, '')}';`) + sep + sep + uiParts.join(sep);
     _fs.default.writeFileSync(_path.default.join(genDir, dbUiFile), normEol(uiContent).replace(/\n/g, '\r\n'), 'utf8');
     color.log(`Successfully generated file src/generated/${dbUiFile}${sep}`, 'success');
   }
@@ -473,7 +471,7 @@ function generateDomainSchemaCode(manifest, manifestPath, emittedTypes, packageD
       if (fks.length === 1) expandEntries.push(`  'details:${childName}': {${childName}?: ${childType}Row[]};`);else for (const fk of fks) expandEntries.push(`  'details:${childName}.${fk.name}': {${childName}?: ${childType}Row[]};`);
     }
     decls.push(expandEntries.length === 0 ? `export type ${typeName}Expand = {};` : [`/** Expand keys of \`${manifest.name}.${tableName}\` → fields each adds to the row ` + `(consumed by query()/builder). */`, `export type ${typeName}Expand = {`, ...expandEntries, '};'].join(sep));
-    txArms.push(`  {op: 'insert'; table: '${tableName}'; ref?: string; values: DG.DomainTxValues<${typeName}Insert>} |`, `  {op: 'update'; table: '${tableName}'; id: string; ` + `values: DG.DomainTxValues<${relations.length > 0 ? `${typeName}Update` : `Partial<${typeName}Row>`}>; ` + `expectedVersion?: number} |`, `  {op: 'delete'; table: '${tableName}'; id: string} |`);
+    txArms.push(`  {op: 'insert'; table: '${tableName}'; ref?: string; values: DG.DomainTxValues<${typeName}Insert>; ` + `onDuplicate?: 'error'} |`, `  {op: 'update'; table: '${tableName}'; id: string; ` + `values: DG.DomainTxValues<${relations.length > 0 ? `${typeName}Update` : `Partial<${typeName}Row>`}>; ` + `expectedVersion?: number} |`, `  {op: 'delete'; table: '${tableName}'; id: string} |`);
 
     // No datetime config: the client resolves datetime columns from the domain
     // registry itself (the Dayjs typing in <Table>Row stays true for every client).
@@ -489,41 +487,19 @@ function generateDomainSchemaCode(manifest, manifestPath, emittedTypes, packageD
   return decls.join(sep.repeat(2)) + sep;
 }
 
-/** Emits the typed UI sugar of one manifest: per-table option types and a `<table>Ui`
- * wrapper over the reflective `@datagrok-libraries/domain-ui` components, so app code gets
- * this table's columns and row type checked. Collects the names it needs from `db.ts` into
- * [dbImports]. Nothing here is imported by `db.ts` — data-only consumers gain no UI
- * dependency. */
+/** Emits the typed u2 handles of one manifest: a `<Schema>Db` interface — the schema name, the
+ * typed data clients of `db.ts` and one `DomainTable<Row>` per table — and `get<Schema>Db()`,
+ * which opens every table in parallel behind ONE await and caches the promise per page.
+ * Collects the names it needs from `db.ts` into [dbImports]. Nothing here is imported by
+ * `db.ts` — data-only consumers gain no UI dependency. */
 function generateDomainUiCode(manifest, dbImports) {
-  const decls = [];
-  const schemaClient = `${utils.snakeToCamelCase(manifest.name, false)}Db`;
-  dbImports.push(schemaClient);
-  for (const tableName of Object.keys(manifest.tables)) {
-    const type = utils.snakeToCamelCase(tableName);
-    const address = `${manifest.name}.${tableName}`;
-    // The generics of the client and the handle, in DomainTableClient's order. The
-    // fifth — the update payload — exists only for a relation-bearing table, whose
-    // update() also takes the link sets; without relations the `Partial<Row>`
-    // default is it. Emitting four there would make `update(id, {labels: [...]})`
-    // an excess-property error against a payload that has no `labels`.
-    const hasRelations = Object.keys(manifest.tables[tableName].relations ?? {}).length > 0;
-    const generics = `${type}Row, ${type}Insert, ${type}Column, ${type}Expand` + (hasRelations ? `, ${type}Update` : '');
-    const handle = `DomainTable<${generics}>`;
-    dbImports.push(`${type}Column`, `${type}Expand`, `${type}Insert`, `${type}Row`);
-    if (hasRelations) dbImports.push(`${type}Update`);
-    decls.push([`/** Query spec of \`${address}\` — columns and expand keys are compile-checked. */`, `export type ${type}QuerySpec = DG.DomainQuerySpec<${type}Column, keyof ${type}Expand & string>;`].join(sep), [`/** {@link DG.DomainQuery} parameters of \`${address}\` (schema and table are implied). */`, `export interface ${type}QueryParams extends`, `    Omit<DG.DomainQueryParams, 'schema' | 'table' | 'columns'> {`, `  columns?: ${type}Column[];`, '}'].join(sep), [`/** Options of {@link ${type}Ui.form} / {@link ${type}Ui.formDialog}. */`, `export interface ${type}FormOptions extends Omit<DomainFormOptions, 'values'> {`, `  values?: Partial<${type}Insert>;`, '}'].join(sep), [`/** Options of {@link ${type}Ui.grid}. */`, `export interface ${type}GridOptions extends Omit<DomainGridOptions, 'query' | 'defaults'> {`, `  query?: ${type}QuerySpec;`, `  defaults?: Partial<${type}Insert>;`, '}'].join(sep), [`/** Options of {@link ${type}Ui.list}. */`, `export interface ${type}ListOptions extends Omit<EntityListOptions, 'query'> {`, `  query?: ${type}QuerySpec;`, '}'].join(sep), [`/** Options of {@link ${type}Ui.listView} / {@link ${type}Ui.app}. */`, `export interface ${type}AppViewOptions extends Omit<DomainAppViewOptions, 'query'> {`, `  query?: ${type}QuerySpec;`, '}'].join(sep), ['/**', ` * Typed UI over \`${address}\`: the reflective components of`, ' * `@datagrok-libraries/domain-ui`, with this table\'s columns and row type checked at', ` * compile time. Reach it through {@link ${utils.snakeToCamelCase(tableName, false)}Ui}.`, ' */', `export class ${type}Ui {`, `  /** The table address, \`'<schema>.<table>'\`. */`, `  readonly address: string = '${address}';`, '', `  /** The typed client — the same one \`${schemaClient}.${tableProp(tableName)}\` returns. */`, `  get client(): DG.DomainTableClient<${generics}> {`, `    return ${schemaClient}.${tableProp(tableName)};`, '  }', '', `  /** The prefetched handle on \`${address}\` — THE async boundary, typed. Every`, '   * widget factory on it is synchronous, so acquire it ONCE when a page builds', '   * more than one widget; the shortcuts below acquire one of their own. */', `  table(): Promise<${handle}> {`, `    return domains.table<${generics}>(this.client);`, '  }', '', '  /** The handler registered for the table (the reflective default when none is). */', '  handler(): DG.DomainObjectHandler {', '    return domainHandler(this.address);', '  }', '', '  /** The property form of ONE row — a new one by default, an existing one with', '   * `{row}` or `{id}`; the values are this table\'s. */', `  async form(options?: ${type}FormOptions): Promise<DomainForm> {`, '    return (await this.table()).form(options);', '  }', '', '  /** {@link form} in a dialog; resolves to whether a row was saved. */', `  async formDialog(options?: ${type}FormOptions & DomainDialogOptions): Promise<boolean> {`, '    return (await this.table()).formDialog(options);', '  }', '', '  /** The browse/CRUD page: list, search, New, and a deep-linkable query. */', `  async listView(options?: ${type}AppViewOptions): Promise<DomainAppView> {`, '    return (await this.table()).listView(options);', '  }', '', '  /** THE app — {@link listView} under the name that says what it is. */', `  app(options?: ${type}AppViewOptions): Promise<DomainAppView> {`, '    return this.listView(options);', '  }', '', '  /** The row page: form, detail tabs, history. Takes the row or its id. */', '  async entityView(row: string | DG.DomainRow,', '    options?: DomainEntityAppViewOptions): Promise<DomainEntityAppView> {', '    return (await this.table()).entityView(row, options);', '  }', '', '  /** An editable grid: batch editing, one-transaction save. */', `  async grid(options?: ${type}GridOptions): Promise<DomainGrid> {`, '    return (await this.table()).grid(options);', '  }', '', '  /** A list of rows (cards / brief / grid). */', `  async list(options?: ${type}ListOptions): Promise<EntityListWidget> {`, '    return (await this.table()).list(options);', '  }', '', '  /** Opens the platform\'s create dialog, or the edit dialog for [row]. */', '  edit(row?: DG.DomainRow): Promise<boolean> {', '    return this.handler().editRow(row);', '  }', '', '  /** Opens the platform\'s row picker. */', '  pick(): Promise<DG.DomainRow | null> {', '    return this.handler().pickRow();', '  }', '', '  /** Wraps one `query()` row as a {@link DG.DomainRow} — locally, no round trip. */', `  row(values: Partial<${type}Row> | null): DG.DomainRow {`, '    return this.handler().rowFrom(values);', '  }', '', '  /** A serializable query over the table: deep links, saved filters, Open in Table View. */', `  query(params?: ${type}QueryParams): DG.DomainQuery {`, `    return new DG.DomainQuery({...params, schema: '${manifest.name}', table: '${tableName}'});`, '  }', '}'].join(sep), [`/** Typed UI over \`${address}\` (see {@link ${type}Ui}). */`, `export const ${utils.snakeToCamelCase(tableName, false)}Ui = new ${type}Ui();`].join(sep));
-  }
-
-  // The schema-level handle: every table's DomainTable under ONE await, typed
-  // (`const db = await <schema>UiDb(); db.<plural>.form(...)`).
   const schemaType = utils.snakeToCamelCase(manifest.name);
-  const tableProps = Object.keys(manifest.tables).filter(t => !domainDbReservedProps.includes(tableProp(t)));
-  decls.push(['/**', ` * The typed schema handle over \`${manifest.name}\`: one prefetched {@link DomainTable}`, ' * per table, resolved together by {@link ' + utils.snakeToCamelCase(manifest.name, false) + 'UiDb} —', ' * the schema-level async boundary (see `domains.db`).', ' */', `export interface ${schemaType}UiDb extends DomainDb {`, ...tableProps.map(t => {
-    const type = utils.snakeToCamelCase(t);
-    const update = Object.keys(manifest.tables[t].relations ?? {}).length > 0 ? `, ${type}Update` : '';
-    return `  readonly ${tableProp(t)}: ` + `DomainTable<${type}Row, ${type}Insert, ${type}Column, ${type}Expand${update}>;`;
-  }), '}'].join(sep), [`/** Acquires the {@link ${schemaType}UiDb} handle — every table of`, ` * \`${manifest.name}\`, prefetched together (see \`domains.db\`). */`, `export function ${utils.snakeToCamelCase(manifest.name, false)}UiDb(): Promise<${schemaType}UiDb> {`, `  return domains.db('${manifest.name}') as Promise<${schemaType}UiDb>;`, '}'].join(sep));
-  return decls.join(sep.repeat(2)) + sep;
+  const schemaClient = `${utils.snakeToCamelCase(manifest.name, false)}Db`;
+  const getter = `get${schemaType}Db`;
+  const cache = `_${utils.snakeToCamelCase(manifest.name, false)}Db`;
+  const tables = Object.keys(manifest.tables);
+  dbImports.push(schemaClient, ...tables.map(t => `${utils.snakeToCamelCase(t)}Row`));
+  return [['/**', ` * The typed u2 handles over \`${manifest.name}\`: one {@link DomainTable} per table, opened together by`, ` * {@link ${getter}}, beside the typed data clients (\`${schemaClient}\`) — every action, validator,`, ' * renderer and source an app declares on a table is checked against its row type.', ' */', `export interface ${schemaType}Db {`, `  readonly schema: '${manifest.name}';`, `  readonly data: typeof ${schemaClient};`, '  readonly tables: {', ...tables.map(t => `    readonly ${tableProp(t)}: DomainTable<${utils.snakeToCamelCase(t)}Row>;`), '  };', '}'].join(sep), `let ${cache}: Promise<${schemaType}Db> | undefined;`, [`/** Opens every table of \`${manifest.name}\` in parallel — the one await of an app over it; the`, ' * result is cached per page, so every caller shares the same handles (and their registries). */', `export function ${getter}(): Promise<${schemaType}Db> {`, `  return ${cache} ??= Promise.all([`, ...tables.map(t => `    domains.table<${utils.snakeToCamelCase(t)}Row>('${manifest.name}.${t}'),`), wrapTokens('  ]).then(([', tables.map(tableProp), ', ', `]): ${schemaType}Db => ({`, '    '), `    schema: '${manifest.name}',`, `    data: ${schemaClient},`, wrapTokens('    tables: {', tables.map(tableProp), ', ', '},', '      '), '  })).catch((e) => {', `    ${cache} = undefined;`, '    throw e;', '  });', '}'].join(sep)].join(sep.repeat(2)) + sep;
 }
 
 /** Joins [tokens] into `<prefix>t1<sepToken>t2...<suffix>` lines wrapped at the 120-char

package/bin/commands/create.js

@@ -26,6 +26,11 @@ const confTemplate = _jsYaml.default.load(_fs.default.readFileSync(confTemplateD
   encoding: 'utf-8'
 }));
 const dependencies = [];
+function apiVersion() {
+  let dir = _path.default.dirname(require.resolve('datagrok-api/dg'));
+  while (!_fs.default.existsSync(_path.default.join(dir, 'package.json'))) dir = _path.default.dirname(dir);
+  return JSON.parse(_fs.default.readFileSync(_path.default.join(dir, 'package.json'), 'utf8')).version;
+}
 function createDirectoryContents(name, friendlyName, config, templateDir, packageDir, ide = '', ts = true, eslint = false, test = false) {
   const filesToCreate = _fs.default.readdirSync(templateDir);
   filesToCreate.forEach(file => {
@@ -58,7 +63,7 @@ function createDirectoryContents(name, friendlyName, config, templateDir, packag
         // nothing to npm: pin published ranges and bring the toolchain in as a devDependency.
         if (!utils.isPnpmWorkspace(packageDir)) {
           const published = {
-            'datagrok-api': `^${require('datagrok-api/package.json').version}`,
+            'datagrok-api': `^${apiVersion()}`,
             '@datagrok-libraries/test': '^1.4.0',
             'rxjs': '^6.5.5',
             'cash-dom': '^8.1.5',
@@ -72,7 +77,7 @@ function createDirectoryContents(name, friendlyName, config, templateDir, packag
             }
           }
           Object.assign(_package.devDependencies, {
-            '@datagrok/build-config': '^0.1.0',
+            '@datagrok/build-config': '^1.0.0',
             'eslint': '^8.57.1',
             '@typescript-eslint/parser': '^8.39.0',
             '@typescript-eslint/eslint-plugin': '^8.39.0',

package/bin/commands/help.js

@@ -96,13 +96,15 @@ grok add tests
 Please note that entity names may only include letters and numbers
 
 --domain scaffolds a working browse/CRUD app over an entity-mapped domain table
-(\`grok.dapi.domains\`) from the \`@datagrok-libraries/domain-ui\` defaults. Give it
-one table (\`--domain grit.issue\`), a whole schema the package declares in
+(\`grok.dapi.domains\`) from the u2 defaults (\`@datagrok-libraries/u2\`): a three-line
+app function, a \`src/app.spec.json\` the designer edits, and — for a schema the package
+does not declare yet — a one-table starter \`databases/<schema>/schema.json\`. Give it
+one table (\`--domain tracker.issue\`), a whole schema the package declares in
 \`databases/<schema>/schema.json\` (one app per table), or the path to a schema
 manifest to copy into the package. A fresh app package is two commands:
 
 grok create MyTracker
-cd MyTracker && grok add app --domain grit.issue
+cd MyTracker && grok add app --domain tracker.issue
 
 Supported languages for scripts:
 javascript, julia, node, octave, python, r
@@ -136,8 +138,9 @@ Options:
 [-v | --verbose] [--ui]
 
 --verbose         Print detailed output
---ui              Also generate \`src/generated/db-ui.ts\` — typed UI wrappers over
-                  \`@datagrok-libraries/domain-ui\` for every domain table. Once the
+--ui              Also generate \`src/generated/db-ui.ts\` — typed u2 handles
+                  (\`get<Schema>Db()\` → a \`DomainTable<Row>\` per table, opened in
+                  parallel behind one await) over \`@datagrok-libraries/u2\`. Once the
                   file exists, plain \`grok api\` keeps it up to date; delete it to
                   opt out again
 `;
@@ -254,6 +257,7 @@ Options:
 --skip-puppeteer    Skip the Puppeteer/DG.Test pass; only run Playwright (for playwright-only test directories)
 --skip-playwright   Skip the Playwright pass; only run Puppeteer/DG.Test
 --skip-node         Skip the Node (browserless) pass; run all tests in the browser
+--skip-gc           Do not collect garbage after each test (faster for suites of small unit tests)
 --node-only         Run only tests annotated {node: true} headless under Node, no browser
 --link  	        Link the package to local utils (no effect in a pnpm workspace checkout)
 --record            Records the test execution process in mp4 format
@@ -352,7 +356,8 @@ Usage: grok setup [--check] [--global]
 
 Gets a public/ checkout (or a fresh worktree) ready to build, and keeps it that way after a pull:
   1. Node 20+ (22 recommended); pnpm through corepack, at the version the workspace pins
-  2. removes per-package node_modules left by the npm era and stray package-lock.json files
+  2. removes per-package node_modules left by the npm era, stray package-lock.json files and the .js/.d.ts
+     files the npm-era tsc emitted beside js-api and library sources
   3. pnpm install at the workspace root
   4. reports a global grok older than the workspace one
 

package/bin/commands/server-domains.js

@@ -38,7 +38,7 @@ const USAGE = `Usage: grok s domains <verb> [args]
   aggregate <schema.table> --json spec.json
   transaction <schema> --json ops.json
   audit <schema> | <schema.table> [<row-id>] [--limit n]
-  capabilities <schema.table>
+  access <schema.table>
   grants <schema> | <schema.table>
   grant <schema> | <schema.table> <group>[,<group>...] [--access View|Edit|Delete|Share|Extend]
   revoke <schema> | <schema.table> <group>[,<group>...] [--access <permission>]
@@ -182,13 +182,13 @@ async function handleDomains(dapi, verb, rest, argv, output) {
         (0, _serverOutput.printOutput)(entries, output);
         return true;
       }
-    case 'capabilities':
+    case 'access':
       {
-        if (!args[0]) return usage('capabilities <schema.table>');
+        if (!args[0]) return usage('access <schema.table>');
         const a = (0, _nodeDapi.parseDomainAddress)(args[0], {
           table: true
         });
-        (0, _serverOutput.printOutput)(flatten(await domains.capabilities(a.schema, a.table)), output);
+        (0, _serverOutput.printOutput)(flatten(await domains.access(a.schema, a.table)), output);
         return true;
       }
     case 'grants':
@@ -357,9 +357,13 @@ function grantRow(g) {
     groupId: g?.group?.id ?? ''
   };
 }
+
+/** The access map as one printable row: `can.*` per right, `fields` as editable/readonly name lists. */
 function flatten(o) {
   const out = {};
-  for (const [k, v] of Object.entries(o ?? {})) out[k] = Array.isArray(v) ? v.join(',') : v;
+  for (const [k, v] of Object.entries(o ?? {})) {
+    if (k === 'can') for (const [right, allowed] of Object.entries(v)) out[`can.${right}`] = allowed;else if (k === 'fields') for (const level of ['editable', 'readonly']) out[level] = Object.keys(v).filter(c => v[c] === level).join(',');else out[k] = Array.isArray(v) ? v.join(',') : v;
+  }
   return out;
 }
 

package/bin/commands/server.js

@@ -506,11 +506,9 @@ async function handleRaw(dapi, method, rest, argv, output) {
   return true;
 }
 async function handleSync(dapi, subject, rest, argv, output) {
-  // `grok s sync` subcommands. Mirrors the API surface in
-  // core/server/datlas/lib/src/routers/sync.dart — pairs / setups /
-  // runs are read-only here; `run` triggers an actual push and prints
-  // the per-item summary. Full reference in
-  // core/docs/plans/instance-sync.md (Phase 7 / operational polish).
+  // Read-only mirror of core/server/datlas/lib/src/routers/sync.dart. A setup is an
+  // EntitySyncFunc (/entity_sync_funcs); the server has no run route, runs come from
+  // the UI or the setup's schedule.
   const verb = rest[0];
   // a 1.27 server has no /sync routes at all: report that as "not found", not as a failure
   const callSync = async (method, path, body) => {
@@ -533,7 +531,7 @@ async function handleSync(dapi, subject, rest, argv, output) {
       (0, _serverOutput.printError)(new Error('Usage: grok s sync setups list --pair <pair-id>'));
       return false;
     }
-    const setups = await callSync('GET', `/sync/pairs/${encodeURIComponent(pairId)}/setups`);
+    const setups = await callSync('GET', `/entity_sync_funcs?pairId=${encodeURIComponent(pairId)}`);
     (0, _serverOutput.printOutput)(setups, output);
     return true;
   }
@@ -543,43 +541,21 @@ async function handleSync(dapi, subject, rest, argv, output) {
       (0, _serverOutput.printError)(new Error('Usage: grok s sync setup get <setup-id>'));
       return false;
     }
-    const setup = await callSync('GET', `/sync/setups/${encodeURIComponent(id)}`);
+    const setup = await callSync('GET', `/entity_sync_funcs/${encodeURIComponent(id)}`);
     (0, _serverOutput.printOutput)(setup, output);
     return true;
   }
-  if (subject === 'run') {
-    // grok s sync run <setup-id>
-    const id = rest[1] ?? verb;
+  if (subject === 'setup' && verb === 'runs') {
+    const id = rest[1];
     if (!id) {
-      (0, _serverOutput.printError)(new Error('Usage: grok s sync run <setup-id>'));
-      return false;
-    }
-    const result = await callSync('POST', `/sync/setups/${encodeURIComponent(id)}/run`, {});
-    if (output === 'json' || output === 'csv') {
-      (0, _serverOutput.printOutput)(result, output);
-      return true;
-    }
-    if (output === 'quiet') {
-      console.log(result?.runId ?? '');
-      return true;
-    }
-    if (!result) {
-      (0, _serverOutput.printError)(new Error(`Sync setup ${id} not found, or server has no /sync routes.`));
+      (0, _serverOutput.printError)(new Error('Usage: grok s sync setup runs <setup-id>'));
       return false;
     }
-    console.log(`Run ${result?.runId} → ${result?.remoteUrl} (${result?.status})`);
-    if (result?.counts) {
-      const cs = Object.keys(result.counts).filter(k => (result.counts[k] ?? 0) > 0).map(k => `${result.counts[k]} ${k}`).join(', ');
-      if (cs) console.log(`  ${cs}`);
-    }
-    const items = Array.isArray(result?.items) ? result.items : [];
-    if (items.length) {
-      console.log('\nItems:');
-      (0, _serverOutput.printOutput)(items, 'table');
-    }
+    const runs = await callSync('GET', `/entity_sync_funcs/${encodeURIComponent(id)}/runs`);
+    (0, _serverOutput.printOutput)(runs, output);
     return true;
   }
-  (0, _serverOutput.printError)(new Error('Usage:\n' + '  grok s sync pairs list [--status active|pending|revoked]\n' + '  grok s sync setups list --pair <pair-id>\n' + '  grok s sync setup get <setup-id>\n' + '  grok s sync run <setup-id>'));
+  (0, _serverOutput.printError)(new Error('Usage:\n' + '  grok s sync pairs list [--status active|pending|revoked]\n' + '  grok s sync setups list --pair <pair-id>\n' + '  grok s sync setup get <setup-id>\n' + '  grok s sync setup runs <setup-id>'));
   return false;
 }
 async function handleHealthcheck(dapi, argv, output) {
@@ -1002,7 +978,7 @@ Special commands:
   grok s domains aggregate <schema.table> --measures 'count,sum(x) as t' [--group-by a,b] [--filter <expr>]
   grok s domains transaction <schema> --json ops.json  Ordered insert/update/delete ops, atomically
   grok s domains audit <schema>|<schema.table> [<id>] [--limit n]
-  grok s domains capabilities <schema.table>          What the current user may do on the table
+  grok s domains access <schema.table>                What the current user may do on the table, per field
   grok s domains grants <schema>|<schema.table>       Direct permission grants on a schema or table
   grok s domains grant <schema>|<schema.table> <group>[,...] [--access View|Edit|Delete|Share|Extend]
   grok s domains revoke <schema>|<schema.table> <group>[,...] [--access <permission>]
@@ -1013,8 +989,8 @@ Special commands:
   grok s batch manifest.json                          Run a workflow manifest
   grok s sync pairs list [--status <s>]               List cross-instance sync pairs (status: active|pending|revoked)
   grok s sync setups list --pair <pair-id>            List the named sync setups under a pair
-  grok s sync setup get <setup-id>                    Inspect a setup (selections, direction, last run)
-  grok s sync run <setup-id>                          Trigger a push run; prints per-item outcome
+  grok s sync setup get <setup-id>                    Inspect a setup (entries, direction, last run)
+  grok s sync setup runs <setup-id>                   A setup's past runs (per-item outcome in options.syncResult)
 
 Pull / push / migrate options:
   --out <dir>           Bundle directory to write (pull; merges into an existing bundle)

package/bin/commands/setup.js

@@ -14,7 +14,8 @@ function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r
 /**
  * `grok setup`: one command to get (or keep) a public/ checkout ready to build.
  *   1. Node 20+ (22 recommended); pnpm through corepack, at the version package.json pins.
- *   2. Removes per-package node_modules left by the npm era and stray package-lock.json files.
+ *   2. Removes per-package node_modules left by the npm era, stray package-lock.json files and the .js/.d.ts
+ *      files the npm-era tsc emitted beside js-api and library sources.
  *   3. `pnpm install` at the workspace root.
  *   4. Reports a global `grok` older than the workspace one (`--global` updates it).
  * `--check` only reports.
@@ -41,7 +42,14 @@ async function setup(args) {
   if (pnpmVersion !== pinnedPnpm) {
     color.warn(`pnpm ${pnpmVersion || 'not found'}; the workspace pins ${pinnedPnpm}.`);
     if (!check) {
-      if (run('corepack', ['--version']) === null) color.warn('corepack not found: `npm install -g corepack`, then rerun `grok setup`.');else {
+      if (run('corepack', ['--version']) === null) {
+        color.warn('corepack not found (Node 25 no longer bundles it): installing');
+        (0, _child_process.spawnSync)('npm', ['install', '-g', 'corepack'], {
+          stdio: 'inherit',
+          shell: true
+        });
+      }
+      if (run('corepack', ['--version']) === null) color.warn('could not install corepack: `npm install -g corepack` by hand, then rerun `grok setup`.');else {
         (0, _child_process.spawnSync)('corepack', ['enable'], {
           stdio: 'inherit',
           shell: true
@@ -58,19 +66,17 @@ async function setup(args) {
 
   // 2. leftovers from the npm era
   const projectDirs = ['js-api', 'tools', 'build-config'].map(d => _path.default.join(root, d));
-  for (const group of ['packages', 'libraries']) for (const d of _fs.default.readdirSync(_path.default.join(root, group))) projectDirs.push(_path.default.join(root, group, d));
+  for (const group of ['packages', 'libraries']) for (const d of _fs.default.readdirSync(_path.default.join(root, group), {
+    withFileTypes: true
+  }).filter(e => e.isDirectory())) projectDirs.push(_path.default.join(root, group, d.name));
   const staleModules = projectDirs.filter(d => isLegacyNodeModules(_path.default.join(d, 'node_modules')));
   const staleLocks = projectDirs.map(d => _path.default.join(d, 'package-lock.json')).filter(f => _fs.default.existsSync(f));
-  if (staleModules.length || staleLocks.length) {
-    color.warn(`${staleModules.length} per-package node_modules from npm and ${staleLocks.length} package-lock.json file(s)` + (check ? ' would be removed' : ': removing'));
+  const staleEmits = projectDirs.filter(d => d === _path.default.join(root, 'js-api') || _path.default.dirname(d) === _path.default.join(root, 'libraries')).flatMap(inPlaceEmits);
+  if (staleModules.length || staleLocks.length || staleEmits.length) {
+    color.warn(`${staleModules.length} per-package node_modules from npm, ${staleLocks.length} package-lock.json file(s) and ` + `${staleEmits.length} .js/.d.ts file(s) emitted beside their .ts sources` + (check ? ' would be removed' : ': removing'));
     if (!check) {
-      for (const d of staleModules) _fs.default.rmSync(_path.default.join(d, 'node_modules'), {
-        recursive: true,
-        force: true
-      });
-      for (const f of staleLocks) _fs.default.rmSync(f, {
-        force: true
-      });
+      const leftovers = [...staleModules.map(d => _path.default.join(d, 'node_modules')), ...staleLocks, ...staleEmits].filter(p => !tryRemove(p));
+      if (leftovers.length) color.warn(`could not remove ${leftovers.length} item(s) (locked by an editor, watcher or antivirus?), delete by hand:\n  ${leftovers.join('\n  ')}`);
     }
   } else color.info('no npm-era leftovers');
 
@@ -130,6 +136,46 @@ function isLegacyNodeModules(dir) {
   }
   return false;
 }
+
+/**
+ * The npm-era tsc emitted next to the sources; the workspace emits into dist/, so a .js/.d.ts beside its .ts is stale
+ * (js-api/grok.js even shadows the `grok` command in cmd.exe). js-api/datagrok.js is still bundled in place and stays.
+ */
+function inPlaceEmits(dir) {
+  const out = [];
+  const walk = (d, recurse) => {
+    for (const e of _fs.default.readdirSync(d, {
+      withFileTypes: true
+    })) {
+      const p = _path.default.join(d, e.name);
+      if (e.isDirectory()) {
+        if (recurse && e.name !== 'node_modules' && e.name !== 'dist') walk(p, true);
+      } else if (e.name.endsWith('.ts') && !e.name.endsWith('.d.ts')) {
+        const base = p.slice(0, -3);
+        for (const ext of ['.js', '.js.map', '.d.ts', '.d.ts.map']) if (_fs.default.existsSync(base + ext) && !(d === dir && e.name === 'datagrok.ts' && ext.startsWith('.js'))) out.push(base + ext);
+      }
+    }
+  };
+  walk(dir, false);
+  if (_fs.default.existsSync(_path.default.join(dir, 'src'))) walk(_path.default.join(dir, 'src'), true);
+  return out;
+}
+
+/** Windows reports a directory as busy/non-empty while a handle is still open on it; retry, then give up on this one only. */
+function tryRemove(p) {
+  try {
+    _fs.default.rmSync(p, {
+      recursive: true,
+      force: true,
+      maxRetries: 5,
+      retryDelay: 200
+    });
+    return !_fs.default.existsSync(p);
+  } catch (e) {
+    color.warn(`${p}: ${e.code || e}`);
+    return false;
+  }
+}
 function run(cmd, args) {
   const r = (0, _child_process.spawnSync)(cmd, args, {
     encoding: 'utf8',

package/bin/commands/test.js

@@ -30,7 +30,7 @@ const execFileAsync = (0, _util.promisify)(_child_process.execFile);
 // are discarded (they live in the page until a pass completes). CI runners on
 // loaded agents can exceed the 1h default — override via env.
 const testInvocationTimeout = parseInt(process.env['GROK_TEST_INVOCATION_TIMEOUT_MS'] ?? '', 10) || 3600000;
-const availableCommandOptions = ['host', 'package', 'csv', 'gui', 'catchUnhandled', 'platform', 'core', 'report', 'skip-build', 'skip-publish', 'path', 'record', 'verbose', 'benchmark', 'category', 'test', 'stress-test', 'link', 'tag', 'ci-cd', 'debug', 'no-retry', 'dartium', 'f', 'params', 'logfailed', 'skip-playwright', 'skip-puppeteer', 'skip-node', 'node-only'];
+const availableCommandOptions = ['host', 'package', 'csv', 'gui', 'catchUnhandled', 'platform', 'core', 'report', 'skip-build', 'skip-publish', 'path', 'record', 'verbose', 'benchmark', 'category', 'test', 'stress-test', 'link', 'tag', 'ci-cd', 'debug', 'no-retry', 'dartium', 'f', 'params', 'logfailed', 'skip-playwright', 'skip-puppeteer', 'skip-node', 'node-only', 'skip-gc'];
 const curDir = process.cwd();
 
 /** Expands camelCase to space-separated lowercase: "dataManipulation" → "data manipulation" */
@@ -193,6 +193,7 @@ async function test(args) {
       if (args.debug) cmdArgs.push('--debug');
       if (args['ci-cd']) cmdArgs.push('--ci-cd');
       if (args['no-retry']) cmdArgs.push('--no-retry');
+      if (args['skip-gc']) cmdArgs.push('--skip-gc');
       if (!args['skip-publish']) {
         const isDevToolsOnServer = await testUtils.isPackageOnServer(args.host ?? '', 'DevTools');
         if (isDevToolsOnServer) {
@@ -403,7 +404,8 @@ async function runTesting(args, excludeNodeTests = false) {
         skipToCategory: currentSkipToCategory,
         skipToTest: currentSkipToTest,
         keepBrowserOpen: useRetry,
-        urlParams: args.params
+        urlParams: args.params,
+        skipGc: args['skip-gc'] ?? false
       }, browserId, testInvocationTimeout, browserSession);
 
       // Store browser session for potential reuse

package/bin/utils/ent-helpers.js

@@ -12,13 +12,15 @@ const domainApp = (appNames, tables) => `
 The application${appNames.length > 1 ? 's' : ''} ${appNames.join(', ')} ` + `(over ${tables.join(', ')}) ${appNames.length > 1 ? 'have' : 'has'} been added successfully
 
 Next steps:
-  npm install                     install @datagrok-libraries/domain-ui
-  npm run build && grok publish   publish the package and open the app from the browse tree
+  pnpm install                   link @datagrok-libraries/u2 (a workspace dependency)
+  grok build && grok publish     publish the package and open the app from the browse tree
 
-The app is the domain-ui defaults alone — list, search, entity page, editing,
-permissions and deep links. Customize through the options of the handle's factories
-(domains.table(...).app({actions: ...})), or register a DG.DomainObjectHandler for
-the table to change how its rows render.
+The app is the u2 defaults alone — list, search, filters, entity page with children
+and history, editing under one session, permissions and deep links. src/app.spec.json
+is the same app as a designer-editable spec. To go further, run \`grok api --ui\` for
+typed handles (get<Schema>Db()) and declare on a table: actions.add(...),
+validators.add(column, ...), renderer, and app({app: <a DomainApp subclass>}) for
+presets and shortcuts — the Grit package is the reference.
 Read more at https://datagrok.ai/help/develop/how-to/build-an-app`;
 const connection = connectionName => `
 The connection ${connectionName} has been added successfully

package/bin/utils/node-dapi.js

@@ -1004,8 +1004,10 @@ class NodeDomainsDataSource {
       permission
     })}`);
   }
-  capabilities(schema, table) {
-    return this.client.get(`${this.rows(schema, table)}/capabilities`);
+
+  /** `{can: {view, insert, edit, delete, share}, fields: {<column>: 'editable' | 'readonly'}, ...}`. */
+  access(schema, table) {
+    return this.client.get(`${this.rows(schema, table)}/access`);
   }
 
   /** JSON rows; spec = {filter, sort, columns, expand, limit, offset} (10k row cap). */

package/bin/utils/test-utils.js

@@ -806,6 +806,7 @@ async function runBrowser(testExecutionData, browserOptions, browsersId, testInv
         devtools: browserOptions.debug
       }, defaultLaunchParameters);
       if (browserOptions.gui) params['headless'] = false;
+      if (browserOptions.skipGc) params.args = params.args.filter(arg => arg !== '--js-flags=--expose-gc');
       const out = await getBrowserPage(_puppeteer.default, params, browserOptions.urlParams);
       browser = out.browser;
       page = out.page;

package/bin/utils/utils.js

@@ -219,8 +219,8 @@ const propertyTypes = exports.propertyTypes = ['bool', 'int', 'double', 'string'
 const headerTags = exports.headerTags = ['name', 'description', 'help-url', 'input', 'output', 'tags', 'sample', 'language', 'returns', 'test', 'sidebar', 'condition', 'top-menu', 'environment', 'require', 'editor-for', 'schedule', 'reference', 'editor', 'meta', 'connection', 'friendlyName'];
 const fileParamRegex = exports.fileParamRegex = {
   py: new RegExp(`^#\\s*(?!\\s*#)([^:]+):\\s+([^\\s\\[\\{]+) ?([^\\s\\[\\{]+)?`),
-  ts: new RegExp(`^//\\s*(?!\\s*//)([^:]+):\\s+([^\\s\\[\\{]+) ?([^\\s\\[\\{]+)?`),
-  js: new RegExp(`^//\\s*(?!\\s*//)([^:]+):\\s+([^\\s\\[\\{]+) ?([^\\s\\[\\{]+)?`),
+  ts: new RegExp(`^//\\s*(?!\\s*/)([^:]+):\\s+([^\\s\\[\\{]+) ?([^\\s\\[\\{]+)?`),
+  js: new RegExp(`^//\\s*(?!\\s*/)([^:]+):\\s+([^\\s\\[\\{]+) ?([^\\s\\[\\{]+)?`),
   sql: new RegExp(`^--\\s*([^:]+):\\s+([^\\s\\[\\{]+) ?([^\\s\\[\\{]+)?`)
 };
 const nameAnnRegex = exports.nameAnnRegex = /\s*(name[^:]*): ([^\n\r\[\{]+)/;

package/domain-schema.schema.json

@@ -94,6 +94,11 @@
           "default": true,
           "description": "Per-table in-transaction audit trail (before/after diffs, history, restore)."
         },
+        "hierarchy": {
+          "type": "boolean",
+          "default": false,
+          "description": "The table is a tree: it must declare exactly one ref column targeting itself, which becomes its parent column. Enables the ancestor path endpoint and the 'under' subtree filter term."
+        },
         "extensible": {
           "type": "boolean",
           "default": false,
@@ -140,27 +145,50 @@
         },
         "constraints": {
           "type": "object",
-          "description": "Table-level CHECK constraints keyed by constraint name. The expression may reference this table's relational columns, literals, comparison/arithmetic operators and a whitelist of keywords and immutable functions; it is normalized before it reaches the DDL.",
+          "description": "Table-level CHECK constraints keyed by constraint name. {\"check\": <sql>} references this table's relational columns, literals, comparison/arithmetic operators and a whitelist of keywords and immutable functions, normalized before it reaches the DDL. {\"expr\": <filter>, \"message\"?} is the platform filter grammar over this table's relational columns (literals, lists, null, a bare column name on the right of a comparison) — compiled to the same CHECK, and validated client-side by forms before the write, with the message shown on violation.",
           "propertyNames": {"$ref": "#/definitions/identifier"},
           "additionalProperties": {
             "type": "object",
-            "required": ["check"],
-            "additionalProperties": false,
-            "properties": {
-              "check": {"type": "string"}
-            }
+            "oneOf": [
+              {
+                "required": ["check"],
+                "additionalProperties": false,
+                "properties": {"check": {"type": "string"}}
+              },
+              {
+                "required": ["expr"],
+                "additionalProperties": false,
+                "properties": {"expr": {"type": "string"}, "message": {"type": "string"}}
+              }
+            ]
           }
         },
         "grants": {
           "type": "object",
-          "description": "Permissions granted on the table entity at deploy time, keyed by group name (a platform group such as 'All users' or 'Developers'); each lists the permissions to grant.",
+          "description": "Permissions granted on the table entity at deploy time, keyed by group name (a platform group such as 'All users' or 'Developers'); each lists the permissions to grant: view, edit, delete, or a custom permission this table declares.",
           "minProperties": 1,
           "additionalProperties": {
             "type": "array",
             "minItems": 1,
-            "items": {"enum": ["view", "edit", "delete"]}
+            "items": {"$ref": "#/definitions/identifier"}
           }
         },
+        "permissions": {
+          "description": "Custom permissions an app gates its actions on, grantable on the table entity next to View/Edit/Delete/Share and answered as access.can.<name> and the per-row ~can_<name> column: a list of names, or name -> {description?}. Names are identifiers of at most 32 characters; view, edit, delete, share and extend are reserved.",
+          "oneOf": [
+            {"type": "array", "minItems": 1, "items": {"$ref": "#/definitions/identifier"}},
+            {
+              "type": "object",
+              "minProperties": 1,
+              "propertyNames": {"$ref": "#/definitions/identifier"},
+              "additionalProperties": {
+                "type": "object",
+                "additionalProperties": false,
+                "properties": {"description": {"type": "string"}}
+              }
+            }
+          ]
+        },
         "relations": {
           "type": "object",
           "description": "Many-to-many relations of this table keyed by relation name: each links the table to a target table through a junction table. The name shares one namespace with the columns (it is what expand and filter paths address), so it may not collide with a column of this table. Declaration order is preserved and is the order every UI surface lays the relations out in.",
@@ -297,7 +325,19 @@
         "default": {
           "description": "Default value for new rows / UI inputs."
         },
-        "format": {"type": "string"}
+        "format": {"type": "string"},
+        "editor": {
+          "enum": ["textarea", "switch", "slider", "color", "tags", "markdown"],
+          "description": "Input editor hint for forms and dialogs (lower-case; stored as the platform InputType name on the column's property; markdown renders as a text area until the platform bridges its markdown input)."
+        },
+        "searchable": {
+          "type": "boolean",
+          "description": "The query `search` key matches this column (string only); a table declaring none searches its name column."
+        },
+        "filter": {
+          "type": "string",
+          "description": "Ref columns only: a filter-grammar expression over the target table that narrows the picker's candidates; `$name` binds to the owning row's column of that name (a dependent picker), e.g. \"country_id = $country_id\"."
+        }
       }
     }
   }

package/entity-template/domain-app-imports.js

@@ -0,0 +1,4 @@
+import {domains} from '@datagrok-libraries/u2/src/dg/index.js';
+
+// the skins of everything the u2 domain stack renders
+import '@datagrok-libraries/u2/src/dg/domain/styles.js';

package/entity-template/domain-app.js

@@ -1,11 +1,8 @@
 
 //name: #{NAME}
 //description: Browse and edit #{DOMAIN_TABLE} rows
-//meta.role: app
-//input: string path {meta.url: true; optional: true}
+//tags: app
 //output: view result
 export async function #{NAME}() {
-  // The declared `path` input is what makes the app URL-addressable; the page
-  // reads the deep link itself (restoreFromUrl), so the function takes no parameter.
   return (await domains.table('#{DOMAIN_TABLE}')).app();
 }

package/entity-template/domain-app.spec.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "dg-ui/1",
+  "root": {
+    "tag": "u2-panel",
+    "name": "app",
+    "children": [
+      {"tag": "u2-domain-source", "name": "#{SOURCE}", "props": {"table": "#{DOMAIN_TABLE}", "pageSize": 50}},
+      {"tag": "u2-splitter", "name": "layout", "props": {"direction": "horizontal", "sizes": [0.35, 0.65]}, "children": [
+        {"tag": "u2-panel", "name": "left", "children": [
+          {"tag": "u2-domain-search", "name": "search", "bind": {"source": "$.#{SOURCE}.source"}},
+          {"tag": "u2-domain-filters", "name": "filters", "bind": {"source": "$.#{SOURCE}.source"}},
+          {"tag": "u2-domain-list", "name": "list", "bind": {"source": "$.#{SOURCE}.source"}, "props": {"mode": "cards"}}
+        ]},
+        {"tag": "u2-panel", "name": "right", "children": [
+          {"tag": "u2-domain-form", "name": "form", "bind": {"source": "$.#{SOURCE}.source"}},
+          {"tag": "u2-domain-children", "name": "children", "bind": {"source": "$.#{SOURCE}.source"}, "props": {"mode": "list"}},
+          {"tag": "u2-domain-history", "name": "history", "bind": {"source": "$.#{SOURCE}.source"}},
+          {"tag": "u2-button", "name": "newButton", "props": {"text": "New"}, "on": {"click": "cmd:#{SOURCE}.newRow"}},
+          {"tag": "u2-button", "name": "saveButton", "props": {"text": "Save", "primary": true}, "on": {"click": "cmd:#{SOURCE}.save"}},
+          {"tag": "u2-button", "name": "discardButton", "props": {"text": "Discard"}, "on": {"click": "cmd:#{SOURCE}.discard"}}
+        ]}
+      ]}
+    ]
+  }
+}

package/entity-template/domain-app.ts

@@ -1,11 +1,8 @@
 
 //name: #{NAME}
 //description: Browse and edit #{DOMAIN_TABLE} rows
-//meta.role: app
-//input: string path {meta.url: true; optional: true}
+//tags: app
 //output: view result
 export async function #{NAME}(): Promise<DG.ViewBase> {
-  // The declared `path` input is what makes the app URL-addressable; the page
-  // reads the deep link itself (restoreFromUrl), so the function takes no parameter.
   return (await domains.table('#{DOMAIN_TABLE}')).app();
 }

package/entity-template/domain-schema.json

@@ -0,0 +1,12 @@
+{
+  "name": "#{SCHEMA}",
+  "version": "1.0.0",
+  "tables": {
+    "#{TABLE}": {
+      "columns": {
+        "name": {"type": "string", "required": true, "isName": true, "searchable": true},
+        "description": {"type": "string", "editor": "textarea"}
+      }
+    }
+  }
+}

package/package.json

@@ -4,7 +4,7 @@
     "type": "git",
     "url": "https://github.com/datagrok-ai/public.git"
   },
-  "version": "6.7.4",
+  "version": "6.7.6",
   "description": "Utility to upload and publish packages to Datagrok",
   "homepage": "https://github.com/datagrok-ai/public/tree/master/tools#readme",
   "dependencies": {
@@ -27,7 +27,7 @@
     "puppeteer": "^24.15.0",
     "ts-morph": "^28.0.0",
     "@babel/generator": "^7.29.0",
-    "datagrok-api": "^1.27.11"
+    "datagrok-api": "^1.27.12"
   },
   "bin": {
     "datagrok-upload": "./bin/_deprecated/upload.js",