Merge remote-tracking branch 'origin/main' into claude/project-thread-8rp5dl

Author: claude

.changeset/27678-objectui-skill-msw-removed.md

@@ -0,0 +1,13 @@
+---
+'@objectstack/skills': patch
+'@object-ui/console': patch
+---
+
+docs(skills): the objectui data-integration guide stops teaching the MSW plugin removed in 12.0
+
+Clause-②: no
+Metadata-protocol: none
+
+- **Before.** `skills/objectui/guides/data-integration.md` taught a frontend-first setup built on the MSW plugin package, removed in 12.0 (its last npm release is 11.0.0, so the install still succeeds and pulls an 11.x plugin into the current stack), and eval 2 of `evals/data-integration.json` rewarded that answer.
+- **Now.** The section "Frontend-first development" names the two supported paths: a static scope with no backend, or the real server run locally with `os dev` behind a Vite `/api` proxy. It states that `os dev` persists to SQLite, that `--fresh` gives a throwaway database, and that the retired in-memory driver is refused. Eval 2 grades `os dev`, `proxy` and `objectstack.config`, and refuses the MSW setup. Net -35 lines in the guide.
+- **Console.** `VITE_USE_MOCK_SERVER`, which no source reads, leaves `.env.development`, `.env.production` and the Vercel build command. The `mockServiceWorker.js` rewrite exclusion and the `vendor-msw` chunk row in `docs/deployment.md` go too. No runtime behaviour changes.

.changeset/27707-promotion-no-draft-before-name-collision.md

@@ -0,0 +1,10 @@
+---
+'@objectstack/metadata-protocol': patch
+---
+
+fix(metadata-protocol): promoting a permission set with no draft answers `NO_DRAFT` before another owner's name collision
+
+Clause-②: no
+Metadata-protocol: none
+
+The draft promotion (`POST /api/v1/meta/permission/:name/publish`, and `publishPackageDrafts`, which promotes through the same step) asked the permission-set name judge (`NAMESPACE_CONFLICT` / 422) even when no draft existed at the address, so a publish with nothing to publish, of a name another package holds, answered the collision instead of `NO_DRAFT` / 404. The name judge now runs only when a draft was read, like the promotion's other draft judges, so the caller is told about its own state first. Refusal for refusal: with no draft the promotion was refused before and is refused now, and with a draft the same refusals run in the same order.

.changeset/studio-flow-problems-read-publish-verdict.md

@@ -0,0 +1,13 @@
+---
+'@object-ui/app-shell': patch
+'@object-ui/i18n': patch
+---
+
+fix(studio): the flow Problems list says what the publish will refuse, and a blank expression reads "This value needs an expression"
+
+Clause-②: no
+Metadata-protocol: none
+
+On the Studio's Automations page, a flow's Problems list judged only the canvas structure, so an Update Records value written as an expression and left blank showed a refusal under the value while Problems said "No problems — this flow is structurally valid", and Publish then refused the flow.
+
+The Problems list now reads the verdict the pending draft's read already carries, the one the step inspectors read and the one Publish enforces, so a value the publish refuses is listed, located by the server's own words naming the step and the field. The value cell and the Problems row say the same thing, in business words: "This value needs an expression. Write one, or switch the value back to text." Any other refusal is shown as before.

.changeset/studio-report-held-edit.md

@@ -0,0 +1,13 @@
+---
+'@object-ui/app-shell': patch
+'@object-ui/i18n': patch
+---
+
+fix(studio): a report's new Order or Blocks item, or a chart type picked before its axes, is held until it is filled in, instead of being autosaved and refused
+
+Clause-②: no
+Metadata-protocol: none
+
+In the Studio's Interfaces pillar, a report's properties used to autosave an unfinished edit: "Add item" under **Order** sent an empty sort key, "Add item" under a joined report's **Blocks** sent an empty block, and picking a **Chart type** before its X and Y axes sent a chart without them. The draft door refused each (422), and every later save of the report carried the same body and was refused too, so an edit made afterwards was lost on reload.
+
+Such a report is now held the way a dashboard's unfinished list item is: nothing is sent while the report's own schema refuses the item, or the chart, only for inputs it leaves unset. A neutral line names what it needs (for example "Order By on item #1 of “Order” needs a value", or "X-Axis (dimension) on the report’s chart needs a value") with a **Show me** that opens the report's properties at that input, and Publish refuses while it is held. Once the input is filled in, the next autosave sends every edit kept meanwhile. An item or a chart refused for a value it holds is not held: it is sent, and the refusal it draws shows as before.

packages/metadata-protocol/src/protocol.permission-set-name-cross-package.test.ts

@@ -524,6 +524,20 @@ describe('the draft promotion refuses a permission-set draft whose name another
         ]);
     });
 
+    it('with no draft at the address, the caller is told about its own state first: the repository\'s NO_DRAFT (404), not the collision another owner\'s name would raise', async () => {
+        const h = makeProtocol();
+        // B holds the active name; A has no draft of it at all.
+        await h.protocol.saveMetaItem({ type: 'permission', name: SET, item: perm(SET), packageId: OWNER_B });
+        h.saveDoor.mockClear();
+
+        const { error } = await attempt(() => h.protocol.publishMetaItem({ type: 'permission', name: SET, packageId: OWNER_A }));
+
+        expect(error).toBeInstanceOf(Error);
+        expect(error.code).toBe('NO_DRAFT');
+        expect(error.status).toBe(404);
+        expect(storedSets(h)).toEqual([{ row: SET, state: 'active', binding: OWNER_B }]);
+    });
+
     it('CONTROL: the owning package publishes its own first set, and later re-publishes its own draft of it', async () => {
         const h = makeProtocol();
         await h.protocol.saveMetaItem({ type: 'permission', name: SET, item: perm(SET), packageId: OWNER_B, mode: 'draft' });

packages/metadata-protocol/src/protocol.ts

@@ -23062,7 +23062,10 @@ export class ObjectStackProtocolImplementation implements
         // binding the active row is written under), before `repo.promoteDraft`
         // writes — so a batch publish aborts on it as it aborts on the owner
         // refusal above. See {@link permissionSetNameCollisionRefusal}.
-        {
+        // Asked only when a draft was read, like its siblings: with none at
+        // the address the caller is told `repo.promoteDraft`'s `NO_DRAFT`
+        // first, the fact about its own state, rather than another owner's.
+        if (draftForGate) {
             const nameCollision = await this.permissionSetNameCollisionRefusal(
                 singularType, request.name, promoteInto, 'publish',
             );

packages/objectql/src/registry.ts

@@ -3499,6 +3499,11 @@ export class SchemaRegistry {
    * {@link securityCatalogPackageHolders}'s answer, the one predicate. Built-in
    * names are skipped, as the cold boot skips them (see the method above).
    * Sorted by type in that list's order, then name.
+   *
+   * Also read BY NAME from `@objectstack/metadata-protocol`
+   * (`protocol-save-door-refusals.ts`, `registryPackageHoldersOf`): renaming
+   * this member means updating that caller and
+   * `protocol-permission-set-name-registry-reading.test.ts`.
    */
   private packageHeldSecurityCatalogNames(): Array<{ catalogType: SecurityCatalogType; name: string; packageIds: string[] }> {
     const held: Array<{ catalogType: SecurityCatalogType; name: string; packageIds: string[] }> = [];

skills/objectui/evals/data-integration.json

@@ -21,18 +21,18 @@
     },
     {
       "id": 2,
-      "prompt": "Set up MSW mock data for my ObjectUI app so I can develop the frontend without a running backend. I have a Todo object with title, completed, and dueDate fields.",
-      "expected_output": "Provides MSW browser setup using ObjectKernel + InMemoryDriver + MSWPlugin, objectstack.config with the Todo schema, and main.tsx bootstrap pattern.",
+      "prompt": "I want to build my ObjectUI frontend before the backend is deployed. I have a Todo object with title, completed, and dueDate fields. How do I get a working API locally?",
+      "expected_output": "Runs the real server locally with os dev (the Todo object in objectstack.config) and proxies /api to it from the Vite dev server; no MSW plugin.",
       "files": [],
       "assertions": {
         "must_contain": [
-          "ObjectKernel",
-          "InMemoryDriver",
-          "MSWPlugin",
+          "os dev",
+          "proxy",
           "objectstack.config"
         ],
         "must_not_contain": [
-          "msw rest.get('/api/todos'"
+          "enableBrowser",
+          "setupWorker"
         ]
       }
     },

skills/objectui/guides/data-integration.md

@@ -351,65 +351,33 @@ function MyPlugin() {
 }
 ```
 
-## MSW mock setup (frontend-first development)
+## Frontend-first development
 
-For developing the UI without a running backend, use Mock Service Worker with ObjectStack's in-browser kernel.
+There is no mock-server plugin: the MSW plugin was removed in 12.0, and npm
+still serves its stale 11.x build — ⛔ do not install it. Two supported paths:
 
-### Browser mock server
+- **No backend:** publish static values as a scope ("Static data (no backend)" above).
+- **Real API, locally:** run `os dev` in the ObjectStack app whose
+  `objectstack.config.ts` declares your objects. In a project that runs Vite
+  itself (not `objectui dev`), proxy `/api` to it so page and API share one origin:
 
-```typescript
-// src/mocks/browser.ts
-import { ObjectKernel, DriverPlugin, AppPlugin } from '@objectstack/runtime';
-import { ObjectQLPlugin } from '@objectstack/objectql';
-import { InMemoryDriver } from '@objectstack/driver-memory';
-import { MSWPlugin } from '@objectstack/plugin-msw';
-
-export async function startMockServer(appConfig: any) {
-  const kernel = new ObjectKernel({ skipSystemValidation: true });
-
-  await kernel.use(new ObjectQLPlugin());
-
-  const driver = new InMemoryDriver();
-  await kernel.use(new DriverPlugin(driver, 'memory'));
-  await kernel.use(new AppPlugin(appConfig));
-  await kernel.use(new MSWPlugin({
-    enableBrowser: true,
-    baseUrl: '/api/v1',
-    logRequests: true,
-  }));
-
-  await kernel.bootstrap();
-
-  // Seed initial data
-  if (appConfig.manifest?.data) {
-    for (const dataset of appConfig.manifest.data) {
-      for (const record of dataset.records) {
-        await driver.create(dataset.object, record);
-      }
-    }
-  }
-}
+```bash
+os dev          # http://localhost:3000; if busy, the banner names the port taken
+os dev --fresh  # throwaway database, deleted on exit
 ```
 
-### App entry with MSW
-
 ```typescript
-// src/main.tsx
-import { startMockServer } from './mocks/browser';
-import appConfig from '../objectstack.config';
-
-async function bootstrap() {
-  if (import.meta.env.DEV) {
-    await startMockServer(appConfig);
-  }
-
-  const root = ReactDOM.createRoot(document.getElementById('root')!);
-  root.render(<App />);
-}
-
-bootstrap();
+// vite.config.ts
+export default defineConfig({
+  server: { proxy: { '/api': { target: 'http://localhost:3000', changeOrigin: true } } },
+});
 ```
 
+By default `os dev` persists to a SQLite file and seeds a dev admin
+(`admin@objectos.ai` / `admin123`) on an empty database. It has no in-memory
+driver (`--database-driver memory` is refused); `--database :memory:` is
+SQLite's in-memory database. Commands and flags: the `objectstack-platform` skill.
+
 ### Test DataSource helper
 
 <!-- os:check -->
@@ -507,8 +475,6 @@ unsubscribe?.();
 
 - Spelling `QueryParams` options without the `$` prefix (`limit`, `filter`, `sort`): the index signature accepts them, nothing reads them, and a dropped `$top` fetches the whole table.
 - Importing `fetch` directly in components instead of using DataSource from context.
-- Forgetting to await `startMockServer()` before rendering — MSW intercepts aren't ready.
-- Mismatched `baseUrl` between MSW plugin and ObjectStackAdapter — requests bypass mocks.
 - Not providing `getObjectSchema()` — plugins that need field metadata will fail.
 - Passing a DataSource adapter instance where a static object is expected (or vice versa).
 - Not handling loading/error states in components that fetch data.

ui/apps/console/.env.development

@@ -17,4 +17,3 @@
 # Setting VITE_SERVER_URL to an absolute origin still works, but it opts this
 # app back out of same-origin and into CORS + the 401 above.
 VITE_SERVER_URL=
-VITE_USE_MOCK_SERVER=false