Merge branch 'main' into claude/issue-10021-legend-swatch-custom-property

Author: os-project-manager

.changeset/10069-kanban-lanes-match-by-id-only.md

@@ -0,0 +1,42 @@
+---
+'@object-ui/plugin-kanban': minor
+---
+
+fix(plugin-kanban): a kanban lane matches records by its `id` only, never by its `title`
+
+⚠️ Behaviour change (narrowing), declared `minor` under this repo's fixed-group
+versioning. Executes maintainer ruling A on objectui#10069.
+
+A kanban board decides which lane a record belongs to by comparing the record's
+stored `groupBy` value with each lane's `id` — the picklist option value. Until
+now `bucketCardsIntoColumns` also lowercased every lane `title` into that lookup,
+so the title was a second, undeclared bucketing key. That had three
+user-visible effects, and all three are gone:
+
+- renaming a lane in authored `columns` moved records between lanes;
+- relabelling a picklist option moved records too, because lanes derived from
+  the `groupBy` field's options take `title: opt.label`;
+- membership depended on the viewer's locale, because lane titles are
+  translated: a record storing the English label bucketed into its lane in one
+  locale and into "Uncategorized" in another.
+
+The lane `title` is now presentation only. The id comparison keeps its existing
+case folding (`IN_PROGRESS` still matches a lane `in_progress`).
+
+A record whose value matches no lane id still surfaces in the trailing
+"Uncategorized" lane (#2792), and the board now also names it on the console:
+one `console.warn` per distinct raw value per bucketing pass, giving the
+`groupBy` field, the raw value, the number of records carrying it and the
+available lane ids. An empty group value is not warned about.
+
+**Migration.** Records whose group field stores an option's LABEL (for example
+`'In Progress'`) instead of its VALUE (`'in_progress'`) used to reach their lane
+through the retired title match; they now appear under "Uncategorized", and the
+console warning names each such value. Fix the data, not the board: update each
+record to store the option value. A drag from "Uncategorized" into the right lane
+writes the lane id and so repairs one record at a time; for a bulk repair, find
+the affected records with a filter that selects values outside the field's
+option values, e.g. `['and', ['status', 'nin', ['in_progress', 'done']],
+['status', '!=', null], ['status', '!=', '']]`, and update each to the value
+whose option label it stores. ⛔ Do not add the label as a lane `id` to make the
+records reappear: that re-teaches the label as a second value for the same state.

.changeset/10145-row-cap-admits-only-numbers.md

@@ -0,0 +1,31 @@
+---
+'@object-ui/plugin-detail': minor
+---
+
+feat(plugin-detail): row caps on `record:activity`, `record:history`, `record:chatter` and `record:discussion` admit only a positive integer number, and a refused one warns
+
+`@objectstack/spec` declares `limit` on `RecordActivityProps` (which is also
+`RecordChatterProps.feed`) and on `RecordHistoryProps` as
+`z.number().int().positive()`, and refuses a string, a boolean or an array
+outright. The renderers used to run `Number(value)` before their integer check,
+so they also read `'5'` as 5, `' 5 '` as 5, `'0x10'` as 16, `true` as 1 and `[7]`
+as 7: a second accepted set, wider than the contract (objectui#10145, ruled
+STOP).
+
+Both resolvers (`normalizeLimit`, shared by activity, chatter and discussion,
+and `normalizeHistoryLimit`) now admit only a value whose type is `number` and
+which is a positive integer. Every other authored value falls back to the
+block's default (20 for activity, chatter and discussion; 50 for history). The
+renderer then logs one `console.warn` that names the block and spells the raw
+value with its type (for example `declared limit: "5" (string)`). The warning
+also fires for the fractional, zero, negative, `NaN` and infinite values these
+blocks already refused silently. That matches the "always warn" ruling on
+objectui#10097 and the three objectui#9925 read points. An absent `limit` is not
+a refusal and stays silent.
+
+**Migration.** Stored metadata that spells a row cap as a string (for example
+`limit: '5'`, or `feed: { limit: '5' }` on a chatter or discussion block) now
+drops to the block's default and warns in the console, where it used to be read
+as 5. Write the number instead (`limit: 5`). Publishing such metadata was
+already refused by the spec, so this affects only bodies stored before that
+check, or written around it.

.changeset/10280-slider-tooltip-single-or-list.md

@@ -0,0 +1,29 @@
+---
+'@object-ui/types': minor
+---
+
+feat(types): `slider` and `tooltip` single-or-list keys follow their read sites (objectui#10280, objectui#7759 group B)
+
+Three keys that `@objectstack/spec` does not declare, where the zod mirror accepted a
+spelling the TypeScript declaration refused. Each now matches what its renderer reads.
+
+- **`SliderSchema.defaultValue` is now `number | number[]` (wider).** The `slider`
+  renderer turns a single number into a one-item list, so both spellings render. The
+  mirror already accepted both, and the TypeScript declaration now does too. Code that
+  writes the key keeps compiling. Code that reads it must now handle a single number; the
+  in-repo renderer already does.
+- **BREAKING (authoring): `SliderSchema.value` is retired on both faces.** No renderer
+  reads it: the `slider` renderer reads `defaultValue`, `max`, `min` and `step`, and the
+  form-control DOM whitelist drops `value` from the props it passes on. An authored `value`
+  rendered nothing. The mirror now refuses it by name with a message that points at
+  `defaultValue`, and the TypeScript member is `value?: never`. To migrate, write the
+  initial position as `defaultValue`.
+- **BREAKING (authoring): `TooltipSchema.content` no longer accepts a list.** The renderer
+  puts `content` straight into a React child position without rendering it through
+  `renderChildren`, so a list of nodes failed to render with "Objects are not valid as a
+  React child". The mirror now accepts `string | SchemaNode`, the same as the declaration,
+  which has not changed. To migrate, put a list under `children`, which the renderer does
+  render as a list.
+
+Marked `minor` under this repo's version-alignment rule (`major` is reserved for
+following an `@objectstack` major); the breaking authoring changes are named above.

.changeset/10287-navigation-designer-doc-type.md

@@ -0,0 +1,21 @@
+---
+'@object-ui/plugin-designer': patch
+'@object-ui/i18n': patch
+---
+
+fix(plugin-designer): the Navigation Designer has an entry for the spec's `doc` navigation item type
+
+objectstack#19789 added a `doc` member to the spec's navigation item union (an
+item that targets a book and/or a doc). `NAV_TYPE_META` in `NavigationDesigner`
+is keyed by that spec-derived union, so objectui stopped compiling against
+`@objectstack/spec` built from objectstack `main`, and every row reads its badge,
+colour and icon from that map. The map now has a `doc` entry (a `BookOpen` icon,
+its own colour and the `appDesigner.navTypeDoc` label key). The key has an
+English fallback in the designer's defaults and a translation in all ten locale
+packs.
+
+The map is typed `Record<NavigationItemType | 'doc', ...>` so it compiles both
+against the pinned `@objectstack/spec`, which predates `doc`, and against
+objectstack `main`. The `| 'doc'` goes away at the pin bump that ships `doc`.
+`doc` is not added to the quick-add buttons: an empty `doc` item fails the spec's
+book-or-doc requirement, and authoring one is objectui#10188.

.changeset/7924-named-list-view-retire.md

@@ -0,0 +1,56 @@
+---
+'@object-ui/types': minor
+---
+
+**BREAKING** — `NamedListView` (one entry of `ObjectViewSchema.listViews`) retires
+sixteen members on its TypeScript authoring face (objectui#7924). Each is now a
+`?: never` tombstone: a TypeScript author who writes one gets a compile error at that
+key, and the member's docblock names the key to write instead.
+
+**The eight legacy `show*` spellings** (bucket ② of the director-seat ruling on
+objectui#7924, letter **A**). None is a protocol key on a view; the protocol's
+`userActions` and `appearance` blocks are the canonical home, and `NamedListView`
+already declares both (objectui#8980), so objectui is not narrower than the protocol
+on any of the toggles.
+
+| retired | author instead |
+| --- | --- |
+| `showSearch` | `userActions.search` |
+| `showSort` | `userActions.sort` |
+| `showFilters` | `userActions.filter` |
+| `showHideFields` | `userActions.hideFields` |
+| `showGroup` | `userActions.group` |
+| `showColor` | `userActions.rowColor` |
+| `showDensity` | `userActions.rowHeight` |
+| `showDescription` | `appearance.showDescription` |
+
+```ts
+// before
+const all: NamedListView = { label: 'All', showSearch: false, showDescription: true };
+// after
+const all: NamedListView = { label: 'All', userActions: { search: false }, appearance: { showDescription: true } };
+```
+
+**Eight members the protocol declares nowhere and no renderer acts on** (bucket ③):
+`addDeleteRecordsInline`, `addRecordViaForm`, `clickIntoRecordDetails`,
+`collapseAllByDefault`, `color`, `fieldTextColor`, `prefixField`, `wrapHeaders`. Two
+tombstones point at a likely intent, with no alias mapping behind either: `color` at the
+row-colour configuration `rowColor: { field }`, and `addRecordViaForm` at the
+`userActions.addRecordForm` toggle.
+
+**Two bucket-③ members are NOT retired, because each is read:** `allowExport` gates
+`ListView`'s export control when the Console relays it off the active named view, and
+`densityMode` is folded onto `rowHeight` by `normalizeListViewSchema`. They stay
+declared as they were.
+
+**Only the authoring face changes.** Stored view documents that still carry a legacy
+spelling keep loading: `normalizeListViewSchema` (`@object-ui/core`) still folds the eight
+`show*` flags onto `userActions` / `appearance` at runtime, and hosts that read a stored
+view through a loose type are unaffected.
+
+**ADR-0087 disposition:** the eight `show*` spellings are a **D2** conversion. Stored
+documents are accepted and converted at load by the existing runtime fold, and the TS
+face refuses the old spelling at authoring time. The eight bucket-③ members have **no
+conversion**, because the protocol has no equivalent to convert them to. The refusal is
+loud and by name on the TS face, and a stored document carrying one stays as inert as
+it was before this change.

.changeset/9736-twins-spec-by-reference.md

@@ -0,0 +1,40 @@
+---
+'@object-ui/types': minor
+---
+
+feat(types): `AppComponentSchema`, `DashboardComponentSchema` and `PageNodeSchema` take the spec by reference, like their zod mirrors
+
+The three published zod mirrors have long taken `@objectstack/spec`'s `App` / `Dashboard` /
+`Page` surface by reference (`BaseSchema.extend(SpecXFields.shape)`), while their hand-written
+TypeScript twins restated only the members the renderers read. So the published validator
+admitted keys the published type did not declare: the package-lock envelope (`_lock`,
+`_lockReason`, `_lockSource`, `_provenance`, `_packageId`, `_packageVersion`, `_lockDocsUrl`,
+written by the packaging pipeline), `protection`, the app's `isDefault` / `_unpublished` /
+`defaultAgent` / `contextSelectors`, and the page's `source` / `interfaceConfig` / `requires`.
+The spec's retirement tombstones reached the type only as `any`, through `BaseSchema`'s index
+signature.
+
+Each twin now extends `Omit` over the spec's exported input type, and that `Omit` reads the same
+`as const` exclusion array the mirror's `specFieldsExcept` call reads. The two faces therefore
+project one spec surface, and a later spec bump moves both of them together:
+
+- **Admitted keys are declared** with the spec's own member types. A reader of a served document
+  can read `app.protection`, `page.requires` or the envelope without a cast.
+- **Tombstones refuse at compile time.** `version`, `homePageId`, `objects`, `apis`, `sharing`,
+  `embed`, `mobileNavigation` and `aria` on an app, and `aria`, `refreshInterval` and
+  `performance` on a dashboard, are now optional members typed `undefined`. Authoring a value is
+  a TypeScript error, which is the verdict the validator already gave at parse. ⚠️ This is the
+  one breaking edge: code that wrote one of these keys used to compile against the index
+  signature and was refused at parse. It is now refused by `tsc`, before it runs.
+- `DashboardComponentSchema.header` and `PageNodeSchema.slots` keep their own hand-written types.
+  Both are withheld from the spec projection on the type side only, because neither type is
+  assignable to the spec's member. The drift is already recorded in the parity ledgers.
+  `PageNodeSchema.assignedProfiles` is withheld the same way, but for forward compatibility:
+  objectstack `main` retires the key, and the hand-written `string[]` member (unchanged) would
+  otherwise stop compiling at the next spec bump. Its retirement is tracked separately.
+
+Why this is a minor bump: the published type surface gains members, and one authoring
+spelling moves from a parse-time refusal to a compile-time refusal. This repo marks breaking
+semantics `minor` rather than `major`.
+
+This change affects types only. It changes no runtime code and narrows no mirror.

apps/console/src/__tests__/registry-inputs-spec-parity.test.ts

@@ -2424,7 +2424,7 @@ const MEMBER_PINS: Record<string, MemberPin> = {
   },
   'object-kanban.columns': {
     file: 'packages/plugin-kanban/src/__tests__/objectKanbanColumnMembers-8071.test.tsx',
-    pins: 'The SWIMLANE element\'s six members, each at its OWN sink and none assumed to behave like its neighbour, driven through the real renderer on a real adapter. `id` decides which records land in the lane (`groups[col.id]`) and names the heading, with an unmatched record swept into the trailing lane rather than dropped (objectui#2792) as the control. ⭐ `title` is read TWICE with two unrelated meanings — as the lane\'s accessible name, and as a BUCKETING ALIAS (`labelToColumnId[String(col.title).toLowerCase()] = col.id`), so a record whose stored group value is the lane\'s TITLE lands in that lane as surely as one carrying its id: nothing on the authoring surface says so, and renaming a lane therefore MOVES RECORDS. `cards` is a UNION and not a replacement — static lane cards survive the fetch, come first, and are not de-duplicated against it. `limit` is displayed beside the count and flags the lane, and ⛔ never truncates: the over-limit row asserts every card still renders, so a pin watching only the badge could not stay green under a renderer that dropped the overflow. `className` reaches that lane\'s container and no other. `collapsed` withholds that lane\'s cards while its neighbour keeps them — the member-set row only, because `columnCollapsedHonoured-9628.test.tsx` owns that member whole. The set itself is asserted as a WHITELIST: an undeclared lane member reaches no sink, with a `className` marker on the same lane in the same render as the lit control. ⚠️ The DECLARATION half is a different file and deliberately not duplicated here: `packages/types/src/__tests__/object-kanban-columns-declared-8913.test.ts` (objectui#8913/#8989) parses lane bags against both published faces, and every assertion in it is a `safeParse` — it cannot say what the board DOES with a member it admitted, which is objectui#8068\'s criterion. Read end to end before being cited. New file (objectui#8071 slice 16).',
+    pins: 'The SWIMLANE element\'s six members, each at its OWN sink and none assumed to behave like its neighbour, driven through the real renderer on a real adapter. `id` decides which records land in the lane (`groups[col.id]`) and names the heading, with an unmatched record swept into the trailing lane rather than dropped (objectui#2792) as the control. ⭐ `title` is the lane\'s accessible name and ⛔ NOT a bucketing key: it used to be a second, undeclared BUCKETING ALIAS, so renaming a lane moved records; objectui#10069 (ruling A) retired it and FLIPPED that row, so a record whose stored group value is the lane\'s TITLE is now swept into the trailing lane with a console warn. `cards` is a UNION and not a replacement — static lane cards survive the fetch, come first, and are not de-duplicated against it. `limit` is displayed beside the count and flags the lane, and ⛔ never truncates: the over-limit row asserts every card still renders, so a pin watching only the badge could not stay green under a renderer that dropped the overflow. `className` reaches that lane\'s container and no other. `collapsed` withholds that lane\'s cards while its neighbour keeps them — the member-set row only, because `columnCollapsedHonoured-9628.test.tsx` owns that member whole. The set itself is asserted as a WHITELIST: an undeclared lane member reaches no sink, with a `className` marker on the same lane in the same render as the lit control. ⚠️ The DECLARATION half is a different file and deliberately not duplicated here: `packages/types/src/__tests__/object-kanban-columns-declared-8913.test.ts` (objectui#8913/#8989) parses lane bags against both published faces, and every assertion in it is a `safeParse` — it cannot say what the board DOES with a member it admitted, which is objectui#8068\'s criterion. Read end to end before being cited. New file (objectui#8071 slice 16).',
   },
   'object-kanban.conditionalFormatting': {
     file: 'packages/plugin-kanban/src/__tests__/ObjectKanban.structuredMembersReachTheirSinks-8313.test.tsx',

content/docs/api/schema-reference.md

@@ -935,7 +935,7 @@ A drag-and-drop Kanban board. The `object-kanban` type key validates the shape t
 |----------|------|-------------|
 | `objectName` | `string` | Object to fetch records from. |
 | `groupBy` | `string` | Field whose values become the lanes (maps to column ids). **Optional** since objectui#8990, matching `@objectstack/spec`. A board that omits it draws whatever lanes `columns` declares — and holds **no cards**, because records are only distributed once a lane key exists. |
-| `columns` | `string[] \| KanbanLane[]` | Swimlane definitions — an array of `{ id, title }` lanes (one per `groupBy` value), **or** an array of bare value strings; never a mix. **Not** a field projection (that is `cardFields`). A lane's `cards` is optional: an object-bound board buckets records into the lane by `groupBy`, and only a static board writes a lane's cards itself. |
+| `columns` | `string[] \| KanbanLane[]` | Swimlane definitions — an array of `{ id, title }` lanes (one per `groupBy` value), **or** an array of bare value strings; never a mix. **Not** a field projection (that is `cardFields`). A lane's `cards` is optional: an object-bound board buckets records into the lane by `groupBy`, and only a static board writes a lane's cards itself. A record lands in a lane when its stored `groupBy` value equals the lane **`id`** (the option value, compared case-insensitively); the lane `title` is display only and never decides membership (objectui#10069). A record matching no lane id is shown in a trailing *Uncategorized* lane and named in a console warning. |
 | `titleField` | `string` | Field used as the card title. |
 | `cardFields` | `string[]` | Fields rendered on each card. |
 | `filter` | `any[]` | Query filter, forwarded verbatim as `$filter`. |