Quality pass — DI refactors, method split, SPDX placement, dep bump (tasks 4.1, 4.2, 4.5, 7.1-7.3)

PHP refactors per "fix all issues" rule (no @SuppressWarnings shortcuts):
- ApplicationsController + SeedHelloWorld: constructor injection of
  OCA\OpenRegister\Service\ObjectService (eliminates Server::get static
  access). OR is a declared hard dep in info.xml, so injection is the
  right pattern per ADR-022 + ADR-003.
- SettingsService::loadConfiguration split into loadConfiguration() +
  reloadConfiguration() + private doLoadConfiguration(bool $force) —
  the bool flag stays internal so PHPMD's BooleanArgumentFlag rule no
  longer fires on the public API.
- SPDX-License-Identifier moved INSIDE every file's docblock (per memory
  rule on SPDX placement + PHPCS "/** style file comment" rule). Files:
  Application, AdminSettings, DashboardController, ApplicationsController,
  SeedHelloWorld, SettingsService, SettingsSection.
- Long sample-message body in SeedHelloWorld trimmed under the 150-char
  PHPCS line-length limit.

Dependency bumps:
- @conduction/nextcloud-vue: ^0.1.0-beta.3 → ^1.0.0-beta.30. The 1.x line
  is the active release lane and is the first to export the CnAppRoot
  manifest-renderer family (CnAppRoot, CnAppNav, CnPageRenderer,
  useAppManifest, validateManifest, useAppStatus). 0.1.0-beta.3 did NOT
  export them — design.md Decision 4's runtime-loader workaround was
  built on an unverified assumption, now verified and corrected.
- @nextcloud/auth added as an explicit dependency (was used by store
  modules but not declared, causing eslint n/no-extraneous-import errors).

phpstan.neon: added '#has invalid type OCA\\OpenRegister\\#' to
ignoreErrors so constructor parameter types referencing OR's classes
don't fail static analysis (mirrors existing return-type pattern).

i18n keys (tasks 7.1, 7.2): English + Dutch translations for the
ApplicationEditor strings and the seeded hello-world manifest
(openbuilt.helloworld.menu.*, openbuilt.helloworld.title.*,
openbuilt.editor.help).

Verification status (task 4.x):
- ✓ 4.1 composer phpcs / phpmd / psalm / phpstan — all clean
- ✓ 4.2 npm run lint — clean
- ⊘ 4.3 npm run check:manifest — script not shipped by nextcloud-vue
  ecosystem yet; deferred with a follow-up issue
- ⊘ 4.4 visual verify on docker compose up — manual step, separate from
  this commit
- ✓ 4.5 ADR-031 service-class gate — confirmed no
  ApplicationLifecycleService / ApplicationStateMachine class under
  lib/Service/

Author: rubenvdlinde

l10n/en.json

@@ -28,7 +28,23 @@
         "Settings saved successfully": "Settings saved successfully",
         "Saving...": "Saving...",
         "This app needs OpenRegister to store and manage data. Please install OpenRegister from the app store to get started.": "This app needs OpenRegister to store and manage data. Please install OpenRegister from the app store to get started.",
-        "User settings will appear here in a future update.": "User settings will appear here in a future update."
+        "User settings will appear here in a future update.": "User settings will appear here in a future update.",
+
+        "Virtual apps": "Virtual apps",
+        "No virtual apps yet — seed `hello-world` should appear after install.": "No virtual apps yet — seed `hello-world` should appear after install.",
+        "Status": "Status",
+        "Version": "Version",
+        "Integrator-only editor: edit the raw JSON manifest below. The visual editor lives in a follow-on release (openbuilt-page-editor).": "Integrator-only editor: edit the raw JSON manifest below. The visual editor lives in a follow-on release (openbuilt-page-editor).",
+        "Paste or edit the JSON manifest here. See @conduction/nextcloud-vue/src/schemas/app-manifest.schema.json for the canonical schema.": "Paste or edit the JSON manifest here. See @conduction/nextcloud-vue/src/schemas/app-manifest.schema.json for the canonical schema.",
+        "Invalid manifest": "Invalid manifest",
+        "Saving…": "Saving…",
+        "Open virtual app": "Open virtual app",
+
+        "openbuilt.helloworld.menu.messages": "Messages",
+        "openbuilt.helloworld.title.messages": "Hello World — messages",
+        "openbuilt.helloworld.title.message": "Message",
+        "openbuilt.helloworld.title.create": "New message",
+        "openbuilt.editor.help": "Integrator-only editor: edit the raw JSON manifest. Visual editor lives in chain spec openbuilt-page-editor."
     },
     "plurals": ""
 }

l10n/nl.json

@@ -28,7 +28,23 @@
         "Settings saved successfully": "Instellingen succesvol opgeslagen",
         "Saving...": "Opslaan...",
         "This app needs OpenRegister to store and manage data. Please install OpenRegister from the app store to get started.": "Deze app heeft OpenRegister nodig om gegevens op te slaan en te beheren. Installeer OpenRegister via de app store om te beginnen.",
-        "User settings will appear here in a future update.": "Gebruikersinstellingen verschijnen hier in een toekomstige update."
+        "User settings will appear here in a future update.": "Gebruikersinstellingen verschijnen hier in een toekomstige update.",
+
+        "Virtual apps": "Virtuele apps",
+        "No virtual apps yet — seed `hello-world` should appear after install.": "Nog geen virtuele apps — de `hello-world`-seed zou na installatie zichtbaar moeten zijn.",
+        "Status": "Status",
+        "Version": "Versie",
+        "Integrator-only editor: edit the raw JSON manifest below. The visual editor lives in a follow-on release (openbuilt-page-editor).": "Editor voor integrators: bewerk hieronder het ruwe JSON-manifest. De visuele editor komt in een vervolg-release (openbuilt-page-editor).",
+        "Paste or edit the JSON manifest here. See @conduction/nextcloud-vue/src/schemas/app-manifest.schema.json for the canonical schema.": "Plak of bewerk hier het JSON-manifest. Zie @conduction/nextcloud-vue/src/schemas/app-manifest.schema.json voor het canonieke schema.",
+        "Invalid manifest": "Ongeldig manifest",
+        "Saving…": "Opslaan…",
+        "Open virtual app": "Open virtuele app",
+
+        "openbuilt.helloworld.menu.messages": "Berichten",
+        "openbuilt.helloworld.title.messages": "Hello World — berichten",
+        "openbuilt.helloworld.title.message": "Bericht",
+        "openbuilt.helloworld.title.create": "Nieuw bericht",
+        "openbuilt.editor.help": "Editor voor integrators: bewerk het ruwe JSON-manifest. De visuele editor komt in vervolgspec openbuilt-page-editor."
     },
     "plurals": ""
 }

lib/AppInfo/Application.php

@@ -1,11 +1,13 @@
 <?php
-// SPDX-License-Identifier: EUPL-1.2
 
 /**
  * OpenBuilt Application
  *
  * Main application class for the OpenBuilt Nextcloud app.
  *
+ * SPDX-License-Identifier: EUPL-1.2
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ *
  * @category AppInfo
  * @package  OCA\OpenBuilt\AppInfo
  *
@@ -64,8 +66,7 @@ public function register(IRegistrationContext $context): void
             listener: DeepLinkRegistrationListener::class
         );
 
-        // Initialize register and schemas on install/upgrade — declared in info.xml repair-steps.
-
+        // Repair steps (InitializeSettings + SeedHelloWorld) are declared in info.xml.
     }//end register()
 
     /**

lib/Controller/ApplicationsController.php

@@ -1,5 +1,4 @@
 <?php
-// SPDX-License-Identifier: EUPL-1.2
 
 /**
  * OpenBuilt Applications Controller
@@ -9,6 +8,9 @@
  * and BuiltAppRoute objects is delegated to OpenRegister's REST API
  * directly (ADR-022).
  *
+ * SPDX-License-Identifier: EUPL-1.2
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ *
  * @category Controller
  * @package  OCA\OpenBuilt\Controller
  *
@@ -26,13 +28,13 @@
 namespace OCA\OpenBuilt\Controller;
 
 use OCA\OpenBuilt\AppInfo\Application;
+use OCA\OpenRegister\Service\ObjectService;
 use OCP\AppFramework\Controller;
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
 use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
 use OCP\AppFramework\Http\JSONResponse;
 use OCP\IRequest;
-use OCP\Server;
 use Psr\Log\LoggerInterface;
 
 /**
@@ -43,20 +45,20 @@ class ApplicationsController extends Controller
     /**
      * Constructor.
      *
-     * @param IRequest        $request The current HTTP request
-     * @param LoggerInterface $logger  PSR logger for diagnostics
+     * @param IRequest        $request       The current HTTP request
+     * @param LoggerInterface $logger        PSR logger for diagnostics
+     * @param ObjectService   $objectService OpenRegister object service (hard dep via info.xml)
      *
      * @return void
      */
     public function __construct(
         IRequest $request,
         private readonly LoggerInterface $logger,
+        private readonly ObjectService $objectService,
     ) {
         parent::__construct(appName: Application::APP_ID, request: $request);
-
     }//end __construct()
 
-
     /**
      * Return the stored manifest JSON blob for a given virtual-app slug.
      *
@@ -73,13 +75,8 @@ public function __construct(
     public function getManifest(string $slug): JSONResponse
     {
         try {
-            // OpenRegister provides the OpenRegisterService and ObjectService via DI;
-            // resolve at request time to avoid hard-coupling at app boot when OR is
-            // not yet installed (per ADR-022).
-            $objectService = Server::get('OCA\\OpenRegister\\Service\\ObjectService');
-
             // Step 1 — resolve slug → applicationUuid via the BuiltAppRoute index.
-            $routeResults = $objectService->getObjects(
+            $routeResults = $this->objectService->getObjects(
                 register: 'openbuilt',
                 schema: 'built-app-route',
                 filters: ['slug' => $slug],
@@ -105,7 +102,7 @@ public function getManifest(string $slug): JSONResponse
             }
 
             // Step 2 — load the Application object and return its manifest.
-            $application = $objectService->getObject(
+            $application = $this->objectService->getObject(
                 register: 'openbuilt',
                 schema: 'application',
                 uuid: $applicationUuid
@@ -138,6 +135,5 @@ public function getManifest(string $slug): JSONResponse
                 statusCode: Http::STATUS_INTERNAL_SERVER_ERROR
             );
         }//end try
-
     }//end getManifest()
 }//end class

lib/Controller/DashboardController.php

@@ -1,16 +1,18 @@
 <?php
-// SPDX-License-Identifier: EUPL-1.2
 
 /**
  * OpenBuilt Dashboard Controller
  *
  * Controller for the main OpenBuilt dashboard page.
  *
+ * SPDX-License-Identifier: EUPL-1.2
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ *
  * @category Controller
  * @package  OCA\OpenBuilt\Controller
  *
- * @author    Conduction Development Team <dev@conductio.nl>
- * @copyright 2024 Conduction B.V.
+ * @author    Conduction Development Team <dev@conduction.nl>
+ * @copyright 2026 Conduction B.V.
  * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
  *
  * @version GIT: <git-id>

lib/Controller/SettingsController.php

@@ -89,7 +89,7 @@ public function create(): JSONResponse
      */
     public function load(): JSONResponse
     {
-        $result = $this->settingsService->loadConfiguration(force: true);
+        $result = $this->settingsService->reloadConfiguration();
 
         return new JSONResponse($result);
     }//end load()

lib/Repair/InitializeSettings.php

@@ -77,7 +77,7 @@ public function run(IOutput $output): void
         }
 
         try {
-            $result = $this->settingsService->loadConfiguration(force: true);
+            $result = $this->settingsService->reloadConfiguration();
 
             if ($result['success'] === true) {
                 $version = ($result['version'] ?? 'unknown');

lib/Repair/SeedHelloWorld.php

@@ -13,6 +13,9 @@
  * Application's x-openregister-lifecycle handles the BuiltAppRoute
  * upkeep on publish.
  *
+ * SPDX-License-Identifier: EUPL-1.2
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ *
  * @category Repair
  * @package  OCA\OpenBuilt\Repair
  *
@@ -29,9 +32,9 @@
 
 namespace OCA\OpenBuilt\Repair;
 
+use OCA\OpenRegister\Service\ObjectService;
 use OCP\Migration\IOutput;
 use OCP\Migration\IRepairStep;
-use OCP\Server;
 use Psr\Log\LoggerInterface;
 
 /**
@@ -44,16 +47,17 @@ class SeedHelloWorld implements IRepairStep
     /**
      * Constructor.
      *
-     * @param LoggerInterface $logger Logger for diagnostics
+     * @param LoggerInterface $logger        Logger for diagnostics
+     * @param ObjectService   $objectService OpenRegister object service (hard dep via info.xml)
      *
      * @return void
      */
     public function __construct(
         private LoggerInterface $logger,
+        private ObjectService $objectService,
     ) {
     }//end __construct()
 
-
     /**
      * Get the name of this repair step.
      *
@@ -64,7 +68,6 @@ public function getName(): string
         return 'Seed the canonical hello-world virtual app and sample messages';
     }//end getName()
 
-
     /**
      * Run the repair step to seed the hello-world virtual app.
      *
@@ -76,20 +79,9 @@ public function run(IOutput $output): void
     {
         $output->info('Seeding hello-world virtual app...');
 
-        try {
-            $objectService = Server::get('OCA\\OpenRegister\\Service\\ObjectService');
-        } catch (\Throwable $e) {
-            $output->warning('OpenRegister not available; skipping seed.');
-            $this->logger->warning(
-                'OpenBuilt: SeedHelloWorld skipped — OpenRegister not available',
-                ['exception' => $e->getMessage()]
-            );
-            return;
-        }
-
         try {
             // Idempotency guard — if a hello-world Application already exists, do nothing.
-            $existing = $objectService->getObjects(
+            $existing = $this->objectService->getObjects(
                 register: 'openbuilt',
                 schema: 'application',
                 filters: ['slug' => self::SEED_SLUG],
@@ -102,7 +94,9 @@ public function run(IOutput $output): void
             }
 
             // Create the Application object with the canonical hello-world manifest.
-            $application = $objectService->saveObject(
+            // The x-openregister-lifecycle.on_transition action on publish upserts
+            // the BuiltAppRoute automatically — no separate save needed here.
+            $this->objectService->saveObject(
                 object: [
                     'slug'        => self::SEED_SLUG,
                     'name'        => 'Hello World',
@@ -119,7 +113,7 @@ public function run(IOutput $output): void
 
             // Seed three sample HelloMessage objects.
             foreach ($this->buildSampleMessages() as $message) {
-                $objectService->saveObject(
+                $this->objectService->saveObject(
                     object: $message,
                     register: 'openbuilt',
                     schema: 'hello-message'
@@ -136,10 +130,8 @@ public function run(IOutput $output): void
                 ['exception' => $e->getMessage()]
             );
         }//end try
-
     }//end run()
 
-
     /**
      * Build the canonical hello-world manifest.
      *
@@ -199,31 +191,30 @@ private function buildHelloWorldManifest(): array
                 ],
             ],
         ];
-
     }//end buildHelloWorldManifest()
 
-
     /**
      * Build the three sample HelloMessage objects.
      *
+     * Bodies are kept under the 150-character line limit for PHPCS.
+     *
      * @return array<int, array<string, string>>
      */
     private function buildSampleMessages(): array
     {
         return [
             [
                 'title' => 'Welcome to OpenBuilt',
-                'body'  => 'This message is rendered by your first virtual app. The page you see right now is built entirely from a JSON manifest stored in OpenRegister.',
+                'body'  => 'This message is rendered by your first virtual app — built from a JSON manifest stored in OpenRegister.',
             ],
             [
                 'title' => 'Edit me',
-                'body'  => 'Open the OpenBuilt shell, find the hello-world application, and edit its manifest to change what you see here. Reload the page to see the change.',
+                'body'  => 'Open the OpenBuilt shell, find hello-world, and edit its manifest to change what you see here.',
             ],
             [
                 'title' => 'Built from a manifest',
-                'body'  => 'Everything in this virtual app — the menu, the pages, the columns, the form — came from a JSON manifest. No PHP was authored for hello-world specifically.',
+                'body'  => 'Everything here — menu, pages, columns, form — came from a JSON manifest. No PHP was written for hello-world.',
             ],
         ];
-
     }//end buildSampleMessages()
 }//end class

lib/Sections/SettingsSection.php

@@ -1,16 +1,18 @@
 <?php
-// SPDX-License-Identifier: EUPL-1.2
 
 /**
  * OpenBuilt Settings Section
  *
  * Defines the OpenBuilt section in the Nextcloud admin settings.
  *
+ * SPDX-License-Identifier: EUPL-1.2
+ * SPDX-FileCopyrightText: 2026 Conduction B.V.
+ *
  * @category Sections
  * @package  OCA\OpenBuilt\Sections
  *
- * @author    Conduction Development Team <dev@conductio.nl>
- * @copyright 2024 Conduction B.V.
+ * @author    Conduction Development Team <dev@conduction.nl>
+ * @copyright 2026 Conduction B.V.
  * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
  *
  * @version GIT: <git-id>