fix(examples): typecheck example apps clean + gate in CI (#2023)

The example apps failed their own `tsc --noEmit`. Root cause: app-crm
imported types from the root `@objectstack/spec`, which intentionally
exports no types — those imports resolved to `any` and silently
suppressed all object-literal type checking, masking ~30 real errors.
tsup builds the apps without a full typecheck, so nothing caught it.

- Repoint app-crm type imports to canonical subpaths
  (`@objectstack/spec/data`, `/ui`, `/security`, ...).
- Type authored literals with input types: add the missing `*Input`
  aliases to @objectstack/spec (following the existing FieldInput/
  ActionInput/ReportInput/PortalInput convention) so `.default()`
  fields stay optional and CEL fields accept string shorthands.
- Fix genuine content drift: drop unsupported `description` on
  agent/Action/PermissionSet; `parentRole` -> `parent` on roles.
- app-todo: drop unmodeled `Field.color` options, guard
  `input.subject.includes` on an `unknown` value, add the `vitest`
  devDep its `src/` test needs.
- CI (lint.yml): build workspace packages, then typecheck every
  example via the path filter `./examples/*` (the `@objectstack/example-*`
  scope glob silently skips `@example/app-todo`).

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

.changeset/example-apps-spec-input-types.md

@@ -0,0 +1,5 @@
+---
+"@objectstack/spec": patch
+---
+
+Add `*Input` authoring-type aliases (`DatasourceInput`, `ConnectorInput`, `SharingRuleInput`, `JobInput`, `WebhookInput`, `EmailTemplateDefinitionInput`, `RoleInput`, `PermissionSetInput`, `ObjectExtensionInput`) alongside the existing `FieldInput`/`ActionInput`/`ReportInput`/`PortalInput` convention. These are `z.input<typeof XSchema>` aliases so authored literals keep `.default()` fields optional and accept CEL/Expression string shorthands — matching how `defineX()` helpers already accept input. No runtime change.

.github/workflows/lint.yml

@@ -46,5 +46,16 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Type check
+      - name: Type check (@objectstack/spec)
         run: pnpm --filter @objectstack/spec exec tsc --noEmit
+
+      # Example apps are AI-authoring reference templates; a red typecheck is a
+      # bad signal to copy from. tsup transpiles them without a full typecheck,
+      # so build alone will not catch type drift — typecheck them explicitly.
+      # They import from built workspace packages, so the packages must be built
+      # first for cross-package type resolution to succeed.
+      - name: Build workspace packages
+        run: pnpm exec turbo run build --filter='./packages/*'
+
+      - name: Type check example apps
+        run: pnpm --filter './examples/*' run typecheck

examples/app-crm/src/actions/convert-lead.action.ts

@@ -1,15 +1,14 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
-import type { UI } from '@objectstack/spec';
+import type * as UI from '@objectstack/spec/ui';
 
 /**
  * Row-level action on crm_lead — launches the Convert Lead screen flow wizard.
  * Shown as a button in the lead list row menu and in the lead record header.
  */
-export const ConvertLeadAction: UI.Action = {
+export const ConvertLeadAction: UI.ActionInput = {
   name: 'crm_convert_lead',
   label: 'Convert Lead',
-  description: 'Open the Convert Lead wizard to create an Opportunity from this Lead.',
   icon: 'ArrowRightCircle',
   objectName: 'crm_lead',
   type: 'flow',

examples/app-crm/src/actions/park-lead.action.ts

@@ -1,6 +1,6 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
-import type { UI } from '@objectstack/spec';
+import type * as UI from '@objectstack/spec/ui';
 
 /**
  * Row-level action on crm_lead — reassign the lead's owner.
@@ -11,10 +11,9 @@ import type { UI } from '@objectstack/spec';
  * UndoManager — Ctrl+Z works too). Prompts for the new owner via one param
  * (pre-filled with "Triage Queue").
  */
-export const ParkLeadAction: UI.Action = {
+export const ParkLeadAction: UI.ActionInput = {
   name: 'crm_park_lead',
   label: 'Reassign Lead',
-  description: 'Reassign this lead to a new owner (undoable).',
   icon: 'UserPlus',
   objectName: 'crm_lead',
   // `type: 'api'` with a non-URL target routes to the console runtime's generic

examples/app-crm/src/agents/sales-assistant.agent.ts

@@ -42,7 +42,6 @@ export const DealManagementSkill = defineSkill({
 export const SalesAssistantAgent = defineAgent({
   name: 'crm_sales_assistant',
   label: 'Sales Assistant',
-  description: 'AI assistant that helps sales reps manage their pipeline.',
   role: 'You are a helpful sales operations assistant for a CRM system.',
   instructions:
     'Help sales reps find contacts, update opportunities, and summarise their pipeline. Always be concise and ask before making destructive changes.',

examples/app-crm/src/analytics/crm.cube.ts

@@ -1,6 +1,6 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
-import type { Cube } from '@objectstack/spec';
+import type { Cube } from '@objectstack/spec/data';
 
 /**
  * Opportunity Pipeline Cube — revenue metrics broken down by stage,

examples/app-crm/src/api/crm-endpoints.ts

@@ -1,6 +1,6 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
-import type { ApiEndpoint } from '@objectstack/spec';
+import type { ApiEndpoint } from '@objectstack/spec/api';
 
 /**
  * Custom REST endpoint — exposes pipeline summary metrics.

examples/app-crm/src/connectors/crm-connectors.ts

@@ -1,12 +1,12 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
-import type { Connector } from '@objectstack/spec';
+import type { ConnectorInput } from '@objectstack/spec/integration';
 
 /**
  * HubSpot connector — sync contacts and deals bi-directionally.
  * Uses OAuth2 for authentication; actual credentials come from environment.
  */
-export const HubSpotConnector: Connector = {
+export const HubSpotConnector: ConnectorInput = {
   name: 'hubspot_crm',
   label: 'HubSpot CRM',
   type: 'saas',
@@ -91,7 +91,7 @@ export const HubSpotConnector: Connector = {
 /**
  * Slack connector — post notifications to channels.
  */
-export const SlackConnector: Connector = {
+export const SlackConnector: ConnectorInput = {
   name: 'slack_notifications',
   label: 'Slack',
   type: 'api',

examples/app-crm/src/data/crm-mappings.ts

@@ -1,6 +1,6 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
-import type { Mapping } from '@objectstack/spec';
+import type { Mapping } from '@objectstack/spec/data';
 
 /**
  * CSV import mapping for bulk lead upload.

examples/app-crm/src/datasources/crm.datasource.ts

@@ -1,12 +1,12 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
-import type { Datasource } from '@objectstack/spec';
+import type { DatasourceInput } from '@objectstack/spec/data';
 
 /**
  * Primary CRM datasource — in-memory SQLite for the example.
  * In production, swap `driver` to 'postgres' and supply real `config`.
  */
-export const CrmDatasource: Datasource = {
+export const CrmDatasource: DatasourceInput = {
   name: 'crm_primary',
   label: 'CRM Primary Database',
   driver: 'sqlite',
@@ -23,7 +23,7 @@ export const CrmDatasource: Datasource = {
 /**
  * Read-replica for analytics queries — demonstrates datasource routing.
  */
-export const CrmAnalyticsDatasource: Datasource = {
+export const CrmAnalyticsDatasource: DatasourceInput = {
   name: 'crm_analytics',
   label: 'CRM Analytics Read Replica',
   driver: 'sqlite',