#2026)

Scope consistency with the other example apps (@objectstack/example-crm,
@objectstack/example-showcase). The inconsistent scope meant a
`--filter @objectstack/example-*` glob silently skipped app-todo — the
follow-up noted in #2023.

Updates the package name, the root `dev:todo` script, current docs
(root + app-todo READMEs) and the `// Run via:` comments in the test
files. CHANGELOGs are left untouched (historical record).

No lockfile churn — pnpm keys importers by path, not name. Package is
private (not published), so no changeset.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

…2029)

The repo had an ESLint flat config whose only rule — no-restricted-imports
banning `@objectstack/spec` root namespace imports (the ~1.2GB RSS
regression vector) — was never enforced: eslint wasn't even a devDep, no
`lint` script existed, and the `lint.yml` workflow only ran tsc. The
config's own comment said "To enable: pnpm add -DW eslint". So the guard
that should have caught the root-import drift fixed in #2023 was dormant.

- Add `eslint` + `@typescript-eslint/parser` devDeps; wire the parser into
  the flat config so .ts files parse.
- Add root `lint` script (`eslint . --no-inline-config`). The flag ignores
  orphaned `eslint-disable` directives left over from a richer rule set
  this minimal config no longer registers; the sole active rule should
  never be opted out locally anyway.
- Add a fast `lint` job to lint.yml (syntactic only, no build needed).

Complements the example-app typecheck gate from #2023: typecheck catches
concrete-type root imports, ESLint catches the namespace-name imports and
gives a faster signal.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

…ritable domains (#2035) (#2088)

* feat(spec): defineX factories + XInput aliases for the 16 remaining writable domains (#2035)

Adds one type-safe authoring entry per writable domain — defineDatasource,
defineConnector, definePolicy, defineSharingRule, defineRole, definePermissionSet,
defineEmailTemplateDefinition, defineReport, defineWebhook, defineObjectExtension,
defineCube, defineMapping, defineTheme, defineTranslationBundle, definePage,
defineAction — mirroring the 19 existing factories (XSchema.parse(z.input)).

Each factory is a *value* export: a broken import hard-errors instead of silently
degrading to `any` (the #2023 failure mode), and authoring errors surface at
.parse() time with field-level messages. Also backfills the six missing input
aliases: PolicyInput, CubeInput, MappingInput, ThemeInput, TranslationBundleInput,
PageInput. Purely additive — no existing exports change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* refactor(examples): author metadata via defineX factories (#2035)

Migrates every example authoring file across crm/showcase/todo from bare
output-type literals (`: Page`, `: UI.ActionInput`, …) to the corresponding
defineX factory. The factory accepts input-shape config and validates each
definition at module load, so a malformed metadata object now fails loudly at
authoring time instead of silently passing as `any` (#2023).

Covers 36 files / 16 domains — including files the *.{domain}.ts filename scan
missed (reports/index.ts, actions/index.ts, security/sales-roles.ts, …), which
the new lint guard surfaced.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(lint): guard examples against bare metadata literals (#2035)

Adds an AST-only no-restricted-syntax rule that flags exported consts in
examples/** annotated with a spec domain type (simple `Page` or qualified
`UI.Page`) instead of being wrapped in the defineX factory. Turns the authoring
convention into an invariant so the "pick by history" pattern cannot creep back
into the reference corpus AI learns from — it already caught 15 unmigrated
authoring files in this change. No type info required.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

…2035) (#2089)

Adds `@objectstack/downstream-contract` — a frozen, representative third-party
consumer of `@objectstack/spec`, and the CI gate that runs it.

Why: every other spec consumer the framework tests (example apps,
`@objectstack/dogfood`) lives in this repo and co-evolves with the spec in the
same commit, so none can catch a change that breaks a *real* third party (e.g.
hotcrm) pinned to a published release. This fixture is authored the way an
external project does — builder + `defineX` factories + bare metadata literals
(the pre-#2035 pattern) — and is FROZEN: a spec change that requires editing it
to stay green is, by definition, breaking.

Two signals, both wired into existing CI jobs (no new workflow):
  • typecheck — fixtures are typed with real spec types (`ActionInput`,
    `ReportInput`, `PageInput`, …); a removed/narrowed export fails (the #2023
    class). Added to lint.yml's TypeScript Type Check job.
  • test — each bare-literal fixture is run through its schema's `.parse()`, and
    everything is assembled via `defineStack` (schema + cross-reference
    validation, the metadata core of `objectstack validate`). Rides
    `turbo run test` (Test Core).

Verified locally: typecheck + test green; confirmed the schema parse has teeth
(rejects a broken action `type`). README documents the freeze contract.

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

…ft (#2035) (#2092)

For a metadata-driven platform the spec package IS the third-party API surface.
A removed/renamed/kind-changed export silently breaks every consumer pinned to a
published release the moment they upgrade (the #2023 class) — and no in-repo
consumer catches it, because they all co-evolve with the spec in the same commit.

`scripts/build-api-surface.ts` enumerates every exported `name (kind)` from the
built `.d.ts` of each public entry point (`.`, `./ui`, `./data`, … 16 entries,
4251 exports), resolving re-export aliases to their real kind. The result is
committed at `packages/spec/api-surface.json`.

  pnpm --filter @objectstack/spec gen:api-surface     # regenerate + write
  pnpm --filter @objectstack/spec check:api-surface   # CI: fail on any drift

Wired into lint.yml's TypeScript Type Check job (after the build step). A
REMOVED export fails as breaking (bump major); an ADDED export still requires
regenerating the snapshot, so every change to the public surface is deliberate,
never silent. Complements the downstream-contract gate: that proves exercised
exports still ACCEPT real third-party metadata (depth); this proves the whole
export set still EXISTS (breadth).

Dev tooling only — the script and snapshot are not in the package `files`, so
nothing ships to consumers. Sort is code-unit (not locale) for cross-platform
determinism; verified the check passes clean and rejects a simulated removal.

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>