DO NOT MERGE — verification run for #25697: PR A + the ui/ subtree import of objectui main cd70b7818d

patches/@radix-ui__react-focus-scope.patch

@@ -0,0 +1,50 @@
+diff --git a/dist/index.js b/dist/index.js
+index e8906db3b1e87bfc568b75d72b7ed3d8d1d3c09a..7a05e0e4cffba466301ba1fb67067c0861af0a4d 100644
+--- a/dist/index.js
++++ b/dist/index.js
+@@ -110,6 +110,10 @@ var FocusScope = /* @__PURE__ */ React.forwardRef(
+     }, [trapped, container, focusScope.paused]);
+     React.useEffect(() => {
+       if (container) {
++        if (focusScope.__pendingStackRemove !== void 0) {
++          clearTimeout(focusScope.__pendingStackRemove);
++          focusScope.__pendingStackRemove = void 0;
++        }
+         focusScopesStack.add(focusScope);
+         const previouslyFocusedElement = document.activeElement;
+         const hasFocusedCandidate = container.contains(previouslyFocusedElement);
+@@ -126,7 +130,8 @@ var FocusScope = /* @__PURE__ */ React.forwardRef(
+         }
+         return () => {
+           container.removeEventListener(AUTOFOCUS_ON_MOUNT, onMountAutoFocus);
+-          setTimeout(() => {
++          focusScope.__pendingStackRemove = setTimeout(() => {
++            focusScope.__pendingStackRemove = void 0;
+             const unmountEvent = new CustomEvent(AUTOFOCUS_ON_UNMOUNT, EVENT_OPTIONS);
+             container.addEventListener(AUTOFOCUS_ON_UNMOUNT, onUnmountAutoFocus);
+             container.dispatchEvent(unmountEvent);
+diff --git a/dist/index.mjs b/dist/index.mjs
+index 030ff1a4d2383c9a0a1ba850aa4591890f028784..3dd39a90db9886bc495014a6e4136773e3548448 100644
+--- a/dist/index.mjs
++++ b/dist/index.mjs
+@@ -75,6 +75,10 @@ var FocusScope = /* @__PURE__ */ React.forwardRef(
+     }, [trapped, container, focusScope.paused]);
+     React.useEffect(() => {
+       if (container) {
++        if (focusScope.__pendingStackRemove !== void 0) {
++          clearTimeout(focusScope.__pendingStackRemove);
++          focusScope.__pendingStackRemove = void 0;
++        }
+         focusScopesStack.add(focusScope);
+         const previouslyFocusedElement = document.activeElement;
+         const hasFocusedCandidate = container.contains(previouslyFocusedElement);
+@@ -91,7 +95,8 @@ var FocusScope = /* @__PURE__ */ React.forwardRef(
+         }
+         return () => {
+           container.removeEventListener(AUTOFOCUS_ON_MOUNT, onMountAutoFocus);
+-          setTimeout(() => {
++          focusScope.__pendingStackRemove = setTimeout(() => {
++            focusScope.__pendingStackRemove = void 0;
+             const unmountEvent = new CustomEvent(AUTOFOCUS_ON_UNMOUNT, EVENT_OPTIONS);
+             container.addEventListener(AUTOFOCUS_ON_UNMOUNT, onUnmountAutoFocus);
+             container.dispatchEvent(unmountEvent);

pnpm-workspace.yaml

@@ -75,6 +75,9 @@ onlyBuiltDependencies:
 patchedDependencies:
   tsup@8.5.1: patches/tsup@8.5.1.patch
   tsx@4.23.15: patches/tsx@4.23.15.patch
+  # objectui's focus-scope patch (verification branch for objectstack#25697);
+  # it was keyed unversioned in ui/package.json's ignored `pnpm` field.
+  '@radix-ui/react-focus-scope@1.1.16': patches/@radix-ui__react-focus-scope.patch
 
 # Transitive-dependency version pins. pnpm v10 reads `overrides` from THIS file
 # — the `pnpm.overrides` block in package.json is silently ignored — so all
@@ -233,6 +236,18 @@ patchedDependencies:
 #     legacy agent chain; force the patched 2.0.1 line.
 overrides:
   esbuild: '>=0.28.1'
+  # objectui's security floors, from ui/package.json's ignored `pnpm` field
+  # (verification branch for objectstack#25697; dompurify is already pinned).
+  'qs@<6.15.2': '^6.15.2'
+  'shell-quote@<1.8.4': '^1.8.4'
+  'tmp@<0.2.6': '^0.2.6'
+  'uuid@<11.1.1': '^11.1.1'
+  # objectui's single react line (verification branch for objectstack#25697):
+  # objectui pins 19.3.0 exactly; objectstack manifests still carry ^19.2.x ranges.
+  react: 19.3.0
+  react-dom: 19.3.0
+  '@types/react': 19.3.0
+  '@types/react-dom': 19.3.0
   'minimatch@<11.0.0': '^10.2.3'
   'tar@>=2.0.0 <8.0.0': '^7.5.11'
   'form-data@<5.0.0': '>=4.0.6'
@@ -364,7 +379,9 @@ overrides:
   # installs, so a consumer's own brace-expansion copy is theirs to lift.
   'brace-expansion@>=5.0.0 <6.0.0': '^5.0.12'
   'sharp@>=0.34.0 <0.36.0': '^0.35.5'
-  'react-router@<8.3.0': '^8.3.0'
+  # react-router GHSA-qwww-vcr4-c8h2: still floors the whole 8.x line below 8.3.0; the 7.x line
+  # (objectui's react-router-dom 7.18 pins its own react-router) has no fix to force onto.
+  'react-router@>=8.0.0 <8.3.0': '^8.3.0'
   '@sveltejs/kit@<2.69.1': '^2.69.1'
   '@hono/node-server@<3.0.0': '^2.0.10'
   # OSV batch 2026-08 (#5032) — all three name a fixed version, so they are

scripts/ui-import/README.md

@@ -0,0 +1,34 @@
+# ui-import — dependency-neutral lockfile for the `ui/` subtree
+
+Importing objectui under `ui/` must not change which dependency versions objectui's
+code runs on. Deleting objectui's lockfile and running `pnpm install` re-resolves every
+`ui/*` dependency from its range and moves dozens of them; `splice-lockfile.mjs` instead
+carries objectui's own resolutions into the root `pnpm-lock.yaml`. The script header is
+the authority on what it writes and refuses.
+
+## Procedure (cutover, from the repository root)
+
+1. `git subtree add --prefix ui <objectui> <sha>`, then the adaptation commits: ui
+   manifests take `workspace:^` for every `@objectstack/*`, objectui's `pnpm` field
+   (react pins, security floors, the focus-scope patch) moves to the root
+   `pnpm-workspace.yaml`.
+2. Keep objectui's lockfile for the splice, then delete it from the tree:
+   `git show <sha>:pnpm-lock.yaml > /tmp/objectui-lock.yaml && git rm ui/pnpm-lock.yaml`.
+3. Splice:
+   `node scripts/ui-import/splice-lockfile.mjs --base pnpm-lock.yaml --import /tmp/objectui-lock.yaml --prefix ui --out pnpm-lock.yaml`
+   It must end with `moved 0`.
+4. Reconcile with pnpm: `pnpm install --lockfile-only`. pnpm applies the root
+   `overrides` (security floors) to the imported subgraph and re-resolves peer
+   suffixes; nothing else. Run it a second time: the file must not change.
+5. `pnpm install --frozen-lockfile` must pass.
+6. Re-measure the reconciled file:
+   `node scripts/ui-import/splice-lockfile.mjs --measure pnpm-lock.yaml --import /tmp/objectui-lock.yaml --prefix ui`. Every row still moved must be an override the root
+   `pnpm-workspace.yaml` keeps on purpose, named in its comment block.
+7. Regenerate nothing. With the ui importers on objectui's versions no generated file
+   (for example `ui/packages/components/src/lib/lucide-record-icon-names.ts`) changes;
+   if a `check:` gate asks for a regeneration, a dependency moved, and step 6 says which.
+
+An override that would move a dependency objectui pins onto another major, or split one
+line (react-router under react-router-dom), is scoped in `pnpm-workspace.yaml` with a
+comment naming the advisory range it still covers; dependency upgrades for objectui are
+their own changes after the cutover.