chore: release packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

@object-ui/app-shell@6.3.0

Minor Changes

• c12986e: Add resultDialog + target interpolation for one-shot action reveals

  Some platform actions return values the user MUST copy now because the
  server will not surface them again — 2FA TOTP URI + backup codes, freshly
  minted OAuth client_secret, regenerated recovery codes. Previously these
  had to ship as bespoke pages in apps/account because actions only
  emitted a fire-and-forget toast.

  @object-ui/core — ActionRunner

  • New ActionDef.resultDialog: ResultDialogSpec field. When set on a
    successful action, the runner suppresses the successMessage toast and
    awaits the registered ResultDialogHandler instead. Missing handler is
    non-fatal (logs a warning); rejected handler is treated as acknowledged.
  • New setResultDialogHandler(handler) setter.
  • New types: ResultDialogSpec, ResultDialogFieldSpec,
    ResultDialogHandler.
  • executeUrl and executeAPI now run ${param.X} and ${ctx.X}
    interpolation against target before fetching / navigating. Values are
    encodeURIComponent'd, missing keys resolve to empty string. ctx
    exposes origin, user, org, recordId by default; consumers can
    inject more via context.ctx.

  @object-ui/react

  • ActionProvider and useActionRunner both gained an onResultDialog
    option that wires straight through to the runner.

  @object-ui/app-shell

  • New ActionResultDialog component — promise-based, blocks click-outside
    and Escape (the user MUST click acknowledge), renders five field
    formats: qrcode (client-side via the qrcode package — never sent
    off-device, so 2FA URIs stay secret), code-list, secret, text,
    json. Falls back to json when a value's shape doesn't match its
    declared format.
  • ObjectView and RecordDetailView install the handler and mount the
    dialog automatically, so any action with resultDialog declared in
    metadata now works without code changes.
  • New dependency: qrcode@^1.5.x for client-side QR rendering.

  Pairs with the framework-side Action.resultDialog schema added in
  @objectstack/spec and the sys_two_factor / sys_oauth_application /
  sys_account updates in @objectstack/platform-objects.

• 1c25b56: ADR-0032: author-time condition validation in the flow inspectors.

  Flow node and edge condition editors now flag a malformed predicate as you
  type — most importantly the {record.x} template-brace-in-CEL mistake (#1491),
  which {…} parses as a CEL map literal and silently fails — with the same
  corrective message the build and the validate_expression agent tool emit.
  Client-side check for now (no CEL parser in the browser); swaps to
  @objectstack/formula's shared validateExpression once it is published.

• 30ee761: feat(studio): surface pending drafts on the package detail (ADR-0033)

  After an AI builds an app, its objects/views land as drafts bound to the app package — but Studio's active-only browsers hid them, so the package looked empty and there was no obvious way to find what to review/publish.

  • MetadataClient.listDrafts({ packageId?, type? }) calls the new GET /api/v1/meta/_drafts endpoint, returning pending draft headers (with packageId).
  • The package detail sheet (PackagesPage) now shows a Pending changes section listing each drafted item, each linking to the existing per-item review/diff (?review=1) so the user can publish it. A just-built app package is no longer shown as empty.

• 81c0777: feat(studio): ADR-0033 Phase B — draft review surface (chat → designer → generic diff)

  Closes the AI metadata-authoring loop in Studio. The framework (ADR-0033 Phases A + C) makes the assistant stage every change as a DRAFT; this lets a human see and review those drafts.

  @object-ui/plugin-chatbot

  • mapMessages now detects the framework's draft envelopes — { status:'drafted', type, name, … } (single) and { status:'drafted', drafted:[{type,name}] } (apply_blueprint batch) — and lifts the reviewable targets onto ChatToolInvocation.draftReview (mirrors the existing HITL pendingActionId path; the Vercel {type:'text',value} wrapper is peeled). blueprint_proposed is intentionally not surfaced (no draft yet).
  • ChatbotEnhanced renders a "Review N change(s)" button on drafted tool results, driven by a new onReviewDraft callback prop.

  @object-ui/app-shell

  • assistantBus gains a review channel (requestReview / requestAssistantReview); ConsoleFloatingChatbot wires the chat button to it; a small navigator inside AppContent (which knows the app base) routes to /apps/:appName/metadata/:type/:name?review=1.
  • ResourceEditPage honours ?review=1: it force-reloads the pending draft (covers the case where the AI drafted the item after the page mounted) and opens the review/diff.
  • New DraftReviewPanel — a generic, type-agnostic draft↔published structural diff (added / changed / removed by key), reusing LayeredDiff's computeDiffRows. It gives every metadata type (view, dashboard, flow, …) a real "what will publishing change" review, surfaced as a toolbar affordance + sheet whenever a draft exists. The object designer keeps its richer per-field review.

  Nothing is published by any of this — the human still clicks Publish.

• 672f854: feat(studio): add "Publish app" button to publish all package drafts (ADR-0033)

  The package detail's Pending changes section gains a primary Publish app (N) button that calls POST /api/v1/packages/:id/publish-drafts to promote every drafted item of the app in one shot, then refreshes the pending list. Complements the per-item review/publish links — so after an AI builds an app you can review item-by-item or publish the whole thing at once.

• 5c23088: Wire App.hidden shell hint — App Switcher + avatar dropdown

  Honour the new App.hidden field from @objectstack/spec/ui:

  • AppSwitcher.tsx — filter app.hidden === true out of the top-bar app dropdown so personal-settings-style apps don't appear next to business apps.
  • AppHeader.tsx — render hidden apps as entries in the avatar / user dropdown (immediately after the hardcoded Profile / Settings items). Uses the app's icon + label via the existing getIcon + appLabel utilities, and navigates to /apps/${app.name}.

  This is the front-end side of the Account-app split: the account app shipped by @objectstack/platform-objects declares hidden: true and now surfaces through the avatar menu — same pattern as GitHub Settings, Google account chip, and Salesforce Personal Settings.

  No new dependencies; pure metadata-driven wiring.

• 80f9796: Repoint the Console bell to sys_inbox_message + sys_notification_receipt (ADR-0030)

  The notification bell read the legacy sys_notification object's
  recipient_id/is_read/title/body columns. ADR-0030 re-modeled
  sys_notification into the L2 event (no recipient/read-state), so the bell
  returned nothing — every notification the new pipeline produced was invisible.

  The bell now reads the L5 in-app materialization instead:

  • List: sys_inbox_message filtered by user_id (the mine scope), 20
    most-recent, ordered by created_at.
  • Read-state: joins sys_notification_receipt (filtered by user_id +
    channel:'inbox'). A message is unread until its event has a
    read/clicked/dismissed receipt; the unread count drives the badge.
  • Mark-read: UPDATEs the existing delivered receipt to read
    (keyed (notification_id, user_id, channel)), inserting only as a fallback
    when no receipt exists. Replaces the old sys_notification.is_read write.
  • Navigation: follows the materialization's action_url (absolute,
    /apps/..., or app-relative /{object}/{id}), falling back to the legacy
    source_object/source_id pointer.
  • "View all": routes to /apps/setup/sys_inbox_message?view=mine.

  Pairs with the framework ADR-0030 pipeline (@objectstack/service-messaging).
  Verified in-browser (showcase Console): a materialized inbox message + its
  delivered receipt lit the bell badge; the popover rendered the row;
  "mark all read" flipped the receipt to read in place (no duplicate) and
  cleared the badge.

• 1c8f775: Add the External Datasource Federation Studio surface (ADR-0015 P5)

  Federated datasources (schemaMode !== 'managed') now get a dedicated
  panel inside their Studio Preview tab, so connecting a mature external
  database and registering its tables as ObjectStack objects is a
  point-and-click flow instead of a CLI-only one. The panel pairs with the
  framework backend shipped in feat: External Datasource Federation (ADR-0015) — backend (P1–P4, P6) framework#1390
  (registerExternalDatasourceRoutes → /api/v1/datasources/:name/external/*).

  ObjectStack is metadata-driven: datasource is a metadata type, so it is
  browsed and edited through the standard metadata-admin engine
  (metadata:resource) reached from the Studio app's left-side menu —
  not a hand-written page. The Studio app (framework
  packages/platform-objects/src/apps/studio.app.ts, Integration group)
  gains a Datasources nav item pointing at
  metadata:resource?type=datasource; the federation panel is contributed
  to that standard surface via registerMetadataPreview('datasource', …).

  @object-ui/app-shell — views/metadata-admin/external/

  • api.ts — a thin, typed REST client over the four federation routes
    (tables, tables/:remote/draft, refresh-catalog, validate) plus an
    importObjectDraft helper that PUTs a generated draft to /meta/object.
    All calls go through createAuthenticatedFetch() (Bearer + X-Tenant-ID
    • Accept-Language). A 503 external_service_unavailable reply is mapped
      to a typed ExternalServiceUnavailableError so the UI shows a friendly
      "federation not enabled on this server" hint. Contract types are inlined
      (they were added in framework 7.3; objectui pins @objectstack/spec
^7.2.1).
  • SchemaBrowser — lists remote tables (allowedSchemas-filtered server-side)
    with a text filter, on-demand Refresh (never a timer — warehouse
    introspection is expensive), and a per-table Import action.
  • ImportObjectDialog — generates an Object draft, surfaces the
    type-compat matrix's // REVIEW: columns and the generated *.object.ts
    source, then imports it as a real object. Never mutates the remote schema.
  • ValidationPanel — runs validation on demand and renders per-object
    structured schema diffs (missing column, type mismatch, …). Doubles as an
    on-demand drift view.
  • ExternalDatasourcePanel — Tables / Validation tabs plus a header strip
    with "Refresh catalog" and the snapshot timestamp.
  • DatasourcePreview — registered via registerMetadataPreview('datasource', …),
    it renders the panel automatically inside the standard resource edit
    page's Preview tab when the saved datasource is federated
    (schemaMode !== 'managed'), keyed off the item name. This is the only
    wiring needed: no bespoke page, no extra route, no @object-ui/app-shell
    surface to re-export — the metadata-admin engine + left-side nav own the
    navigation. Federated datasources are read-only code artifacts (the
    datasource type forbids runtime create), which the standard list view
    already reflects (no "Create" button).

  Out of scope (blocked on backend follow-ups): the connection wizard
  (driver/credentials/secrets — belongs in System Settings) and a push-based
  drift inbox (needs an event feed). The framework exposes no
  test-connection, secrets, or drift-feed routes yet.

• 4e060b7: Polish the Studio flow-designer canvas visuals

  A refinement pass over the metadata-admin flow designer (FlowCanvas +
  flow-canvas-parts) — purely presentational, no behavioral or API changes,
  theme-aware (light/dark), and still dependency-free.

  • Node cards: the flat 3px left-accent stripe is replaced by a tinted,
    color-coded icon chip (the card's primary category cue), with a bolder
    label, refined uppercase type caption, layered hover elevation
    (-translate-y-0.5 + soft shadow), and clearer selected / run-state rings.
    Per-category chip tone tokens (soft bg + inset ring) added alongside the
    existing icon/accent/label tones. Added distinct tones for loop (sky),
    screen/user_task (pink) and assignment (purple) — previously they fell
    back to the generic slate "task" tone, so every node type now reads as a
    distinct color in the canvas.
  • Readable labels: node width 188→240 and the per-node summary moved from a
    right-hand column onto a second line, so the label now gets the full card
    width (it was badly truncated — "Manager Re…", "Budget Ab…"). A native title
    tooltip surfaces the full text on the rare remaining truncation.
  • No overlap on add: adding a connected node no longer pins it directly below
    its parent (which stacked every sibling on the same spot) — it's left to the
    layered auto-layout, which slots it beside its siblings.
  • Canvas surface: the dot grid now tracks pan and zoom (it moves with
    the diagram instead of floating behind a static texture), plus a subtle inset
    vignette for depth.
  • Edges: rounded line caps, slightly stronger default stroke, and
    pill-shaped (rounded-full, frosted) branch/condition labels.
  • Toolbar + add-node palette: frosted, rounded controls with a primary
    hover affordance; the palette gains an "Add node" header and matching tinted
    icon chips per row.

  Verified in-browser (Studio → flow → designer) in both light and dark themes.

• e02aedd: Group the flow add-node palette by category, and offer every node type

  The quick-add palette listed 12 node types as a flat list; assignment,
  screen, delete_record and the parallel gateways could only be reached by
  adding a node and switching its type in the inspector. Building flows, that's a
  real friction point.

  • Complete: the palette now offers Delete record, Set variables
    (assignment), Screen, Parallel split and Parallel join too — so every common
    node type is one click away.
  • Grouped: items are organised into Data / Logic / Human / Integration /
    Flow sections with headers and dividers, so the (now longer) list stays
    scannable. A new nodeCategory(type) helper drives the grouping and gives
    engine-only / plugin-contributed node types a sensible section; mergePalette
    preserves a base item's category and infers one for engine-only types.

  Verified in-browser: the grouped palette renders all sections with tinted icon
  chips, and the newly-offered types add to the canvas with the correct icon/tone
  and no overlap.

• 7130d4e: Add FlowRunner — render & resume interactive screen-flows

  A type: 'flow' action whose run pauses at a screen node now opens a
  FlowRunner modal that renders the screen's fields, submits the values to the
  framework resume endpoint (POST /api/v1/automation/{flow}/runs/{runId}/resume),
  and advances to the next screen or closes + refreshes on completion. Previously
  such flows launched server-side but the screen was never rendered, so the input
  was never collected.

  • New FlowRunner component (fields → form → resume loop).
  • ObjectView + RecordDetailView flow handlers detect a paused-screen launch
    response ({ status:'paused', runId, screen }) and open the runner; for
    list_item actions the row's id (_rowRecord.id) flows in as the flow's
    recordId.

  Pairs with the framework screen-flow runtime (@objectstack/service-automation

  • @objectstack/runtime). Verified in-browser: showcase task row → "Reassign…"
    → form → submit → the task is reassigned.

• 652f9b2: feat(packages): "Discard changes" and "Delete app" buttons in the package detail sheet

  Adds two one-click package-lifecycle actions next to the existing "Publish app", mirroring the new backend endpoints:

  • Discard changes (N) — next to "Publish app" in the Pending changes block. Drops every pending draft via POST /packages/:id/discard-drafts, reverting the app to its last published baseline. Non-destructive (published metadata + data untouched), then refreshes the pending list.
  • Delete app — in the Actions row. Removes the whole package via DELETE /packages/:id (active + draft metadata + drops each object's table). Confirms first ("this cannot be undone"); closes the sheet on success, keeps it open and shows the error on failure.

  Together with "Publish app", this gives the full AI-build review loop a UI: publish to preview → keep, discard all changes, or delete the app.

Patch Changes

• fe69471: Flow designer: start a new flow with a trigger, and stop the edge "+" overlapping branch labels

  Two more dogfooding fixes for the Studio flow designer:

  • Empty flow → Start node. An empty editable flow's "Add node" inserted a
    generic task node; it now seeds a start (trigger) node — the canonical
    entry point every flow needs — so the canvas opens on the trigger and the
    author builds forward from there.
  • Edge insert handle no longer collides with the branch label. The "insert
    node" + button and the branch/condition label pill were both centered on the
    edge midpoint, so on a labeled edge (approve, if …) the + sat on top of
    the label. The + now slides to the right of the label when one is present
    (unlabeled edges keep the centered +).

  Verified in-browser: labeled edges show the label and a clear, separate insert
  handle; tsc --noEmit clean.

• 18d0339: Relabel metadata-driven UI on a language switch without a page refresh (chore: release packages #1319)

  Switching the UI language left server-resolved metadata labels (object/field/
  view labels, action-dialog text) in the old language until a hard refresh,
  because renderers cache those labels by object name and never refetch on a
  language change.

  @object-ui/auth — createAuthenticatedFetch now folds the active
  <html lang> into Accept-Language on API calls (never clobbering an explicit
  header), so a switch carries the new locale on every subsequent request.

  @object-ui/app-shell — ConnectedShellInner drops the adapter's
  locale-blind metadata cache in the render phase and remounts the metadata
  subtree via key={language}, so every renderer refetches in the new locale.
  The adapter and its connection sit above the key and are preserved — an in-app
  relabel, not a reconnect.

  @object-ui/i18n — dev-mode missing-key warnings: createI18n gains
  warnMissingKeys (default on outside production) wiring a deduped i18next
  missingKeyHandler. useObjectLabel's convention-key probes are flagged so
  their intentional misses (which fall back to server metadata) stay silent.

  Pairs with the framework-side locale-aware metadata changes in
  @objectstack/client / @objectstack/objectql / @objectstack/rest.

• 3cc38fe: perf(detail/header): lazy + dedupe related-list fan-out, coalesce header polls

  Opening a record detail fired ~50 concurrent /api/v1 requests that
  head-of-line-blocked one another on a single control-plane container.

  • RecordDetailView no longer eager-preloads reverse-reference children
    when the reference rail renders them (that data was discarded while the
    rail re-fetched the same collections).
  • record:reference_rail now gates fetching on visibility
    (IntersectionObserver; the rail is hidden xl:flex), caps concurrency
    at 3, and fetches once per (parentId + entries) via a signature guard,
    applying results through a mounted ref.
  • AppHeader inbox/notification, approvals, and activity pollers gained
    in-flight guards so bootstrap effect re-runs coalesce to one request; the
    approvals poll now sends one request with all identities comma-joined
    instead of one per identity.

  Measured locally: opening an environment detail dropped from ~52 to ~17
  requests, related collections from ×3–5 each to ×1, approvals from ×9 to ≤3.

• 053a164: fix(metadata): keep form-family views out of the runtime list-view switcher

  The backend now exposes each view as an independent ViewItem (ADR-0017,
  "Object has-many View"): { name: '<object>.<key>', object, viewKind: 'list' | 'form', config }. The Studio preview was already taught this shape,
  but the runtime console path was not — MetadataProvider.mergeViewsIntoObjects
  only understood the legacy aggregated container ({ list, form, listViews, formViews }) and ignored viewKind entirely. As a result a form-family view
  (e.g. crm_activity.default, expanded from formViews.default) was neither
  recognized nor excluded: navigating to its /view/<name> URL silently fell
  back to the default grid list instead of being treated as a record form.

  mergeViewsIntoObjects now recognizes the ViewItem shape and routes by
  viewKind — 'list' → objectDef.listViews, 'form' → objectDef.formViews
  — so FORM-family views never enter the list-view switcher (which reads only
  listViews). Each item's config body is flattened to the renderer shape so
  type/columns/calendar/… survive, the canonical <object>.<key> name is
  used as the view id (so /view/<name> resolves), and the legacy container is
  skipped for any object that already has expanded ViewItems (no double-listing).
  Objects served only as a legacy container are unaffected.

• 2f31406: Refine Studio package-scoped navigation and home overview.

  Studio now treats the selected package as the home overview scope, flattens the root Overview sidebar group, hides the duplicate all-metadata sidebar entry, redirects the invalid package metadata route to package management, preserves the selected package across package-management navigation, and adds a localized package-management sidebar label.

• 8d1195d: Fix type: 'url' actions so they actually reach the backend in split-origin dev setups, and so reveal-once result dialogs render.

  • ActionRunner.executeUrl: when context provides apiBase, relative /api/..., /_auth/..., and /_account/... URLs are now promoted to absolute (${apiBase}${path}) before navigation. Same-origin API paths (with or without apiBase) trigger a full-page window.location.href rather than React-Router push — this is required for server-side OAuth redirect dances (e.g. better-auth /sign-in/social) that React Router would otherwise swallow into the SPA's fallback route.
  • ActionRunner.buildInterpolationContext: surfaces ctx.apiBase for action targets that want to template it explicitly.
  • ObjectView: passes apiBase: import.meta.env.VITE_SERVER_URL into the toolbar ActionProvider context so the above resolves.
  • action-button and action-menu renderers now forward resultDialog when invoking the runner. Previously this field was silently dropped by an explicit whitelist, breaking every "show once, then hide" flow (2FA QR/backup codes, OAuth client_secret, regenerated tokens).

• Updated dependencies [c12986e]

• Updated dependencies [30ee761]

• Updated dependencies [a58c6b8]

• Updated dependencies [bd398df]

• Updated dependencies [18d0339]

• Updated dependencies [abe8ebc]

• Updated dependencies [2f31406]

• Updated dependencies [8d1195d]

  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/data-objectstack@6.3.0
  • @object-ui/fields@6.3.0
  • @object-ui/i18n@6.3.0
  • @object-ui/auth@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/layout@6.3.0
  • @object-ui/plugin-editor@6.3.0
  • @object-ui/types@6.3.0
  • @object-ui/permissions@6.3.0
  • @object-ui/collaboration@6.3.0
  • @object-ui/providers@6.3.0

@object-ui/auth@6.3.0

Minor Changes

• 18d0339: Relabel metadata-driven UI on a language switch without a page refresh (chore: release packages #1319)

  Switching the UI language left server-resolved metadata labels (object/field/
  view labels, action-dialog text) in the old language until a hard refresh,
  because renderers cache those labels by object name and never refetch on a
  language change.

  @object-ui/auth — createAuthenticatedFetch now folds the active
  <html lang> into Accept-Language on API calls (never clobbering an explicit
  header), so a switch carries the new locale on every subsequent request.

  @object-ui/app-shell — ConnectedShellInner drops the adapter's
  locale-blind metadata cache in the render phase and remounts the metadata
  subtree via key={language}, so every renderer refetches in the new locale.
  The adapter and its connection sit above the key and are preserved — an in-app
  relabel, not a reconnect.

  @object-ui/i18n — dev-mode missing-key warnings: createI18n gains
  warnMissingKeys (default on outside production) wiring a deduped i18next
  missingKeyHandler. useObjectLabel's convention-key probes are flagged so
  their intentional misses (which fall back to server metadata) stay silent.

  Pairs with the framework-side locale-aware metadata changes in
  @objectstack/client / @objectstack/objectql / @objectstack/rest.

Patch Changes

• @object-ui/types@6.3.0

@object-ui/core@6.3.0

Minor Changes

• c12986e: Add resultDialog + target interpolation for one-shot action reveals

  Some platform actions return values the user MUST copy now because the
  server will not surface them again — 2FA TOTP URI + backup codes, freshly
  minted OAuth client_secret, regenerated recovery codes. Previously these
  had to ship as bespoke pages in apps/account because actions only
  emitted a fire-and-forget toast.

  @object-ui/core — ActionRunner

  • New ActionDef.resultDialog: ResultDialogSpec field. When set on a
    successful action, the runner suppresses the successMessage toast and
    awaits the registered ResultDialogHandler instead. Missing handler is
    non-fatal (logs a warning); rejected handler is treated as acknowledged.
  • New setResultDialogHandler(handler) setter.
  • New types: ResultDialogSpec, ResultDialogFieldSpec,
    ResultDialogHandler.
  • executeUrl and executeAPI now run ${param.X} and ${ctx.X}
    interpolation against target before fetching / navigating. Values are
    encodeURIComponent'd, missing keys resolve to empty string. ctx
    exposes origin, user, org, recordId by default; consumers can
    inject more via context.ctx.

  @object-ui/react

  • ActionProvider and useActionRunner both gained an onResultDialog
    option that wires straight through to the runner.

  @object-ui/app-shell

  • New ActionResultDialog component — promise-based, blocks click-outside
    and Escape (the user MUST click acknowledge), renders five field
    formats: qrcode (client-side via the qrcode package — never sent
    off-device, so 2FA URIs stay secret), code-list, secret, text,
    json. Falls back to json when a value's shape doesn't match its
    declared format.
  • ObjectView and RecordDetailView install the handler and mount the
    dialog automatically, so any action with resultDialog declared in
    metadata now works without code changes.
  • New dependency: qrcode@^1.5.x for client-side QR rendering.

  Pairs with the framework-side Action.resultDialog schema added in
  @objectstack/spec and the sys_two_factor / sys_oauth_application /
  sys_account updates in @objectstack/platform-objects.

Patch Changes

• 8d1195d: Fix type: 'url' actions so they actually reach the backend in split-origin dev setups, and so reveal-once result dialogs render.
  • ActionRunner.executeUrl: when context provides apiBase, relative /api/..., /_auth/..., and /_account/... URLs are now promoted to absolute (${apiBase}${path}) before navigation. Same-origin API paths (with or without apiBase) trigger a full-page window.location.href rather than React-Router push — this is required for server-side OAuth redirect dances (e.g. better-auth /sign-in/social) that React Router would otherwise swallow into the SPA's fallback route.
  • ActionRunner.buildInterpolationContext: surfaces ctx.apiBase for action targets that want to template it explicitly.
  • ObjectView: passes apiBase: import.meta.env.VITE_SERVER_URL into the toolbar ActionProvider context so the above resolves.
  • action-button and action-menu renderers now forward resultDialog when invoking the runner. Previously this field was silently dropped by an explicit whitelist, breaking every "show once, then hide" flow (2FA QR/backup codes, OAuth client_secret, regenerated tokens).
  • @object-ui/types@6.3.0

@object-ui/data-objectstack@6.3.0

Minor Changes

• 30ee761: feat(studio): surface pending drafts on the package detail (ADR-0033)

  After an AI builds an app, its objects/views land as drafts bound to the app package — but Studio's active-only browsers hid them, so the package looked empty and there was no obvious way to find what to review/publish.

  • MetadataClient.listDrafts({ packageId?, type? }) calls the new GET /api/v1/meta/_drafts endpoint, returning pending draft headers (with packageId).
  • The package detail sheet (PackagesPage) now shows a Pending changes section listing each drafted item, each linking to the existing per-item review/diff (?review=1) so the user can publish it. A just-built app package is no longer shown as empty.

Patch Changes

• a58c6b8: fix(datasource): exclude form-family views from listViews()

  OBJECTSTACKDataSource.listViews(objectName) feeds the object list-view
  switcher (ObjectView → ViewTabBar), but returned every view bound to
  the object — including form-family ones. With the backend now exposing each
  view as an independent ViewItem carrying a viewKind discriminant
  (ADR-0017, "Object has-many View"), a form view such as crm_activity.default
  (expanded from formViews.default) leaked in as a spurious switcher tab and,
  when opened, fell back to the default grid.

  listViews() now filters out viewKind form/detail items so only
  list-family views reach the switcher. Bare view specs without a viewKind
  (legacy artifacts and user-saved views) are still treated as list views.

• Updated dependencies [c12986e]

• Updated dependencies [8d1195d]

  • @object-ui/core@6.3.0
  • @object-ui/types@6.3.0

@object-ui/i18n@6.3.0

Minor Changes

• 18d0339: Relabel metadata-driven UI on a language switch without a page refresh (chore: release packages #1319)

  Switching the UI language left server-resolved metadata labels (object/field/
  view labels, action-dialog text) in the old language until a hard refresh,
  because renderers cache those labels by object name and never refetch on a
  language change.

  @object-ui/auth — createAuthenticatedFetch now folds the active
  <html lang> into Accept-Language on API calls (never clobbering an explicit
  header), so a switch carries the new locale on every subsequent request.

  @object-ui/app-shell — ConnectedShellInner drops the adapter's
  locale-blind metadata cache in the render phase and remounts the metadata
  subtree via key={language}, so every renderer refetches in the new locale.
  The adapter and its connection sit above the key and are preserved — an in-app
  relabel, not a reconnect.

  @object-ui/i18n — dev-mode missing-key warnings: createI18n gains
  warnMissingKeys (default on outside production) wiring a deduped i18next
  missingKeyHandler. useObjectLabel's convention-key probes are flagged so
  their intentional misses (which fall back to server metadata) stay silent.

  Pairs with the framework-side locale-aware metadata changes in
  @objectstack/client / @objectstack/objectql / @objectstack/rest.

Patch Changes

• 2f31406: Refine Studio package-scoped navigation and home overview.

  Studio now treats the selected package as the home overview scope, flattens the root Overview sidebar group, hides the duplicate all-metadata sidebar entry, redirects the invalid package metadata route to package management, preserves the selected package across package-management navigation, and adds a localized package-management sidebar label.

@object-ui/plugin-chatbot@6.3.0

Minor Changes

• 81c0777: feat(studio): ADR-0033 Phase B — draft review surface (chat → designer → generic diff)

  Closes the AI metadata-authoring loop in Studio. The framework (ADR-0033 Phases A + C) makes the assistant stage every change as a DRAFT; this lets a human see and review those drafts.

  @object-ui/plugin-chatbot

  • mapMessages now detects the framework's draft envelopes — { status:'drafted', type, name, … } (single) and { status:'drafted', drafted:[{type,name}] } (apply_blueprint batch) — and lifts the reviewable targets onto ChatToolInvocation.draftReview (mirrors the existing HITL pendingActionId path; the Vercel {type:'text',value} wrapper is peeled). blueprint_proposed is intentionally not surfaced (no draft yet).
  • ChatbotEnhanced renders a "Review N change(s)" button on drafted tool results, driven by a new onReviewDraft callback prop.

  @object-ui/app-shell

  • assistantBus gains a review channel (requestReview / requestAssistantReview); ConsoleFloatingChatbot wires the chat button to it; a small navigator inside AppContent (which knows the app base) routes to /apps/:appName/metadata/:type/:name?review=1.
  • ResourceEditPage honours ?review=1: it force-reloads the pending draft (covers the case where the AI drafted the item after the page mounted) and opens the review/diff.
  • New DraftReviewPanel — a generic, type-agnostic draft↔published structural diff (added / changed / removed by key), reusing LayeredDiff's computeDiffRows. It gives every metadata type (view, dashboard, flow, …) a real "what will publishing change" review, surfaced as a toolbar affordance + sheet whenever a draft exists. The object designer keeps its richer per-field review.

  Nothing is published by any of this — the human still clicks Publish.

Patch Changes

• Updated dependencies [c12986e]
• Updated dependencies [abe8ebc]
• Updated dependencies [8d1195d]
  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/types@6.3.0

@object-ui/react@6.3.0

Minor Changes

• c12986e: Add resultDialog + target interpolation for one-shot action reveals

  Some platform actions return values the user MUST copy now because the
  server will not surface them again — 2FA TOTP URI + backup codes, freshly
  minted OAuth client_secret, regenerated recovery codes. Previously these
  had to ship as bespoke pages in apps/account because actions only
  emitted a fire-and-forget toast.

  @object-ui/core — ActionRunner

  • New ActionDef.resultDialog: ResultDialogSpec field. When set on a
    successful action, the runner suppresses the successMessage toast and
    awaits the registered ResultDialogHandler instead. Missing handler is
    non-fatal (logs a warning); rejected handler is treated as acknowledged.
  • New setResultDialogHandler(handler) setter.
  • New types: ResultDialogSpec, ResultDialogFieldSpec,
    ResultDialogHandler.
  • executeUrl and executeAPI now run ${param.X} and ${ctx.X}
    interpolation against target before fetching / navigating. Values are
    encodeURIComponent'd, missing keys resolve to empty string. ctx
    exposes origin, user, org, recordId by default; consumers can
    inject more via context.ctx.

  @object-ui/react

  • ActionProvider and useActionRunner both gained an onResultDialog
    option that wires straight through to the runner.

  @object-ui/app-shell

  • New ActionResultDialog component — promise-based, blocks click-outside
    and Escape (the user MUST click acknowledge), renders five field
    formats: qrcode (client-side via the qrcode package — never sent
    off-device, so 2FA URIs stay secret), code-list, secret, text,
    json. Falls back to json when a value's shape doesn't match its
    declared format.
  • ObjectView and RecordDetailView install the handler and mount the
    dialog automatically, so any action with resultDialog declared in
    metadata now works without code changes.
  • New dependency: qrcode@^1.5.x for client-side QR rendering.

  Pairs with the framework-side Action.resultDialog schema added in
  @objectstack/spec and the sys_two_factor / sys_oauth_application /
  sys_account updates in @objectstack/platform-objects.

Patch Changes

• abe8ebc: Repoint useClientNotifications to the ADR-0030 @objectstack/client surface

  The useClientNotifications bridge hook called client.notifications.* with
  signatures that no longer exist on @objectstack/client@7.x:

  • registerDevice(token, platform) → the SDK takes a single
    RegisterDeviceRequest object ({ token, platform }).
  • markAsRead(id) → there is no single-id method; the SDK exposes
    markRead(ids: string[]). The hook keeps its friendly single-id API and
    adapts to the batch call.

  These helpers are the stable transport contract for ADR-0030 (Notification
  Convergence): server-side they route to the L5 sys_inbox_message
  materialization and the sys_notification_receipt read-state spine — the
  re-modeled sys_notification L2 event no longer carries recipient/read
  columns. (The Console bell itself reads the inbox + receipts directly via the
  generic data API; see the @object-ui/app-shell bell cut-over.)

  Cut-over sequence (operational — run in this order)

  The Console UI repoint must land together with the framework pipeline and
  the data migration so the bell is never blank and read-state is never lost:

  1. Deploy the framework ADR-0030 change (objects + emit() + producers). New
     notifications now land in sys_inbox_message + sys_notification_receipt.
  2. Run the data migration once to carry existing notifications across —
     migrateSysNotificationToEvent({ driver, data }) from
     @objectstack/metadata/migrations. It splits each legacy sys_notification
     inbox row into a sys_inbox_message + receipt, rewrites the row to the event
     shape, and clears the legacy columns. It is idempotent and reports
     not_applicable on fresh installs. This runs against the ObjectStack
     server/data engine — it is not a Console (frontend) step.
  3. Deploy the objectui repoint (this change + the @object-ui/app-shell bell
     cut-over).

• Updated dependencies [c12986e]

• Updated dependencies [30ee761]

• Updated dependencies [a58c6b8]

• Updated dependencies [18d0339]

• Updated dependencies [2f31406]

• Updated dependencies [8d1195d]

  • @object-ui/core@6.3.0
  • @object-ui/data-objectstack@6.3.0
  • @object-ui/i18n@6.3.0
  • @object-ui/types@6.3.0

@object-ui/cli@6.3.0

Patch Changes

• Updated dependencies [c12986e]
• Updated dependencies [abe8ebc]
• Updated dependencies [8d1195d]
  • @object-ui/react@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/types@6.3.0

@object-ui/collaboration@6.3.0

Patch Changes

• @object-ui/types@6.3.0

@object-ui/components@6.3.0

Patch Changes

• 8d1195d: Fix type: 'url' actions so they actually reach the backend in split-origin dev setups, and so reveal-once result dialogs render.

  • ActionRunner.executeUrl: when context provides apiBase, relative /api/..., /_auth/..., and /_account/... URLs are now promoted to absolute (${apiBase}${path}) before navigation. Same-origin API paths (with or without apiBase) trigger a full-page window.location.href rather than React-Router push — this is required for server-side OAuth redirect dances (e.g. better-auth /sign-in/social) that React Router would otherwise swallow into the SPA's fallback route.
  • ActionRunner.buildInterpolationContext: surfaces ctx.apiBase for action targets that want to template it explicitly.
  • ObjectView: passes apiBase: import.meta.env.VITE_SERVER_URL into the toolbar ActionProvider context so the above resolves.
  • action-button and action-menu renderers now forward resultDialog when invoking the runner. Previously this field was silently dropped by an explicit whitelist, breaking every "show once, then hide" flow (2FA QR/backup codes, OAuth client_secret, regenerated tokens).

• Updated dependencies [c12986e]

• Updated dependencies [18d0339]

• Updated dependencies [abe8ebc]

• Updated dependencies [2f31406]

• Updated dependencies [8d1195d]

  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/i18n@6.3.0
  • @object-ui/types@6.3.0

@object-ui/fields@6.3.0

Patch Changes

• bd398df: Render reference/lookup cells as labels, not raw JSON

  A lookup / master_detail value can arrive as a JSON-encoded object string —
  e.g. an unresolved external-id reference {"externalId":"Website Relaunch"}.
  LookupCellRenderer treated the whole JSON string as an opaque id, failed to
  resolve it, and fell through to String(value), leaking raw JSON into the grid
  cell (and detail/kanban surfaces).

  • LookupCellRenderer now parses a JSON-object-looking string value and renders
    a human label (name → label → externalId → id).
  • coerceToSafeValue (the shared safe-render helper used by 8 cell renderers)
    gains the same JSON-string parsing, and externalId is added to the
    reference-label precedence for plain object values and arrays.

  Verified in the browser (showcase task grid: Project column shows "Website
  Relaunch" instead of {"externalId":"Website Relaunch"}) and by unit tests.

• Updated dependencies [c12986e]

• Updated dependencies [18d0339]

• Updated dependencies [abe8ebc]

• Updated dependencies [2f31406]

• Updated dependencies [8d1195d]

  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/i18n@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/types@6.3.0
  • @object-ui/providers@6.3.0

@object-ui/layout@6.3.0

Patch Changes

• Updated dependencies [c12986e]
• Updated dependencies [abe8ebc]
• Updated dependencies [8d1195d]
  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/types@6.3.0

@object-ui/mobile@6.3.0

Patch Changes

• @object-ui/types@6.3.0

@object-ui/permissions@6.3.0

Patch Changes

• @object-ui/types@6.3.0

@object-ui/plugin-ai@6.3.0

Patch Changes

• Updated dependencies [c12986e]
• Updated dependencies [abe8ebc]
• Updated dependencies [8d1195d]
  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/types@6.3.0

@object-ui/plugin-calendar@6.3.0

Patch Changes

• Updated dependencies [c12986e]
• Updated dependencies [bd398df]
• Updated dependencies [18d0339]
• Updated dependencies [abe8ebc]
• Updated dependencies [3cc38fe]
• Updated dependencies [2f31406]
• Updated dependencies [8d1195d]
  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/fields@6.3.0
  • @object-ui/i18n@6.3.0
  • @object-ui/plugin-detail@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/types@6.3.0
  • @object-ui/mobile@6.3.0

@object-ui/plugin-charts@6.3.0

Patch Changes

• Updated dependencies [c12986e]
• Updated dependencies [18d0339]
• Updated dependencies [abe8ebc]
• Updated dependencies [2f31406]
• Updated dependencies [8d1195d]
  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/i18n@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/types@6.3.0

@object-ui/plugin-dashboard@6.3.0

Patch Changes

• Updated dependencies [c12986e]
• Updated dependencies [bd398df]
• Updated dependencies [18d0339]
• Updated dependencies [abe8ebc]
• Updated dependencies [2f31406]
• Updated dependencies [8d1195d]
  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/fields@6.3.0
  • @object-ui/i18n@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/types@6.3.0

@object-ui/plugin-designer@6.3.0

Patch Changes

• Updated dependencies [c12986e]
• Updated dependencies [30ee761]
• Updated dependencies [a58c6b8]
• Updated dependencies [bd398df]
• Updated dependencies [18d0339]
• Updated dependencies [abe8ebc]
• Updated dependencies [2f31406]
• Updated dependencies [8d1195d]
  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/data-objectstack@6.3.0
  • @object-ui/fields@6.3.0
  • @object-ui/i18n@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/plugin-form@6.3.0
  • @object-ui/plugin-grid@6.3.0
  • @object-ui/types@6.3.0

@object-ui/plugin-detail@6.3.0

Patch Changes

• 3cc38fe: perf(detail/header): lazy + dedupe related-list fan-out, coalesce header polls

  Opening a record detail fired ~50 concurrent /api/v1 requests that
  head-of-line-blocked one another on a single control-plane container.

  • RecordDetailView no longer eager-preloads reverse-reference children
    when the reference rail renders them (that data was discarded while the
    rail re-fetched the same collections).
  • record:reference_rail now gates fetching on visibility
    (IntersectionObserver; the rail is hidden xl:flex), caps concurrency
    at 3, and fetches once per (parentId + entries) via a signature guard,
    applying results through a mounted ref.
  • AppHeader inbox/notification, approvals, and activity pollers gained
    in-flight guards so bootstrap effect re-runs coalesce to one request; the
    approvals poll now sends one request with all identities comma-joined
    instead of one per identity.

  Measured locally: opening an environment detail dropped from ~52 to ~17
  requests, related collections from ×3–5 each to ×1, approvals from ×9 to ≤3.

@object-ui/plugin-editor@6.3.0

Patch Changes

• Updated dependencies [c12986e]
• Updated dependencies [abe8ebc]
• Updated dependencies [8d1195d]
  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/types@6.3.0

@object-ui/plugin-form@6.3.0

Patch Changes

• Updated dependencies [c12986e]
• Updated dependencies [bd398df]
• Updated dependencies [abe8ebc]
• Updated dependencies [8d1195d]
  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/fields@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/types@6.3.0
  • @object-ui/permissions@6.3.0

@object-ui/plugin-gantt@6.3.0

Patch Changes

• Updated dependencies [c12986e]
• Updated dependencies [bd398df]
• Updated dependencies [abe8ebc]
• Updated dependencies [3cc38fe]
• Updated dependencies [8d1195d]
  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/fields@6.3.0
  • @object-ui/plugin-detail@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/types@6.3.0

@object-ui/plugin-grid@6.3.0

Patch Changes

• Updated dependencies [c12986e]
• Updated dependencies [bd398df]
• Updated dependencies [abe8ebc]
• Updated dependencies [8d1195d]
  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/fields@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/types@6.3.0
  • @object-ui/mobile@6.3.0

@object-ui/plugin-kanban@6.3.0

Patch Changes

• Updated dependencies [c12986e]
• Updated dependencies [bd398df]
• Updated dependencies [18d0339]
• Updated dependencies [abe8ebc]
• Updated dependencies [3cc38fe]
• Updated dependencies [2f31406]
• Updated dependencies [8d1195d]
  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/fields@6.3.0
  • @object-ui/i18n@6.3.0
  • @object-ui/plugin-detail@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/types@6.3.0

@object-ui/plugin-map@6.3.0

Patch Changes

• Updated dependencies [c12986e]
• Updated dependencies [abe8ebc]
• Updated dependencies [8d1195d]
  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/types@6.3.0

@object-ui/plugin-markdown@6.3.0

Patch Changes

• Updated dependencies [c12986e]
• Updated dependencies [abe8ebc]
• Updated dependencies [8d1195d]
  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/types@6.3.0

@object-ui/plugin-report@6.3.0

Patch Changes

• Updated dependencies [c12986e]
• Updated dependencies [bd398df]
• Updated dependencies [18d0339]
• Updated dependencies [abe8ebc]
• Updated dependencies [2f31406]
• Updated dependencies [8d1195d]
  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/fields@6.3.0
  • @object-ui/i18n@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/plugin-grid@6.3.0
  • @object-ui/types@6.3.0

@object-ui/plugin-timeline@6.3.0

Patch Changes

• Updated dependencies [c12986e]
• Updated dependencies [abe8ebc]
• Updated dependencies [8d1195d]
  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/types@6.3.0
  • @object-ui/mobile@6.3.0

@object-ui/plugin-view@6.3.0

Patch Changes

• Updated dependencies [c12986e]
• Updated dependencies [abe8ebc]
• Updated dependencies [8d1195d]
  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/plugin-form@6.3.0
  • @object-ui/plugin-grid@6.3.0
  • @object-ui/types@6.3.0

@object-ui/plugin-workflow@6.3.0

Patch Changes

• Updated dependencies [c12986e]
• Updated dependencies [abe8ebc]
• Updated dependencies [8d1195d]
  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/types@6.3.0

@object-ui/providers@6.3.0

Patch Changes

• @object-ui/types@6.3.0

@object-ui/runner@6.3.0

Patch Changes

• Updated dependencies [c12986e]
• Updated dependencies [abe8ebc]
• Updated dependencies [8d1195d]
  • @object-ui/core@6.3.0
  • @object-ui/react@6.3.0
  • @object-ui/components@6.3.0
  • @object-ui/plugin-charts@6.3.0
  • @object-ui/plugin-kanban@6.3.0
  • @object-ui/types@6.3.0

@object-ui/tenant@6.3.0

Patch Changes

• @object-ui/types@6.3.0

@object-ui/console@6.3.0

@object-ui/create-plugin@6.3.0

@object-ui/plugin-list@6.3.0

@object-ui/types@6.3.0

object-ui@6.3.0

Patch Changes

• Updated dependencies [c12986e]
• Updated dependencies [8d1195d]
  • @object-ui/core@6.3.0
  • @object-ui/types@6.3.0

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectui	Ignored		Jun 5, 2026 1:34am