@acorex-platform/framework-client 0.0.59 → 0.0.60

package/layout/builder/README.md

@@ -1220,6 +1220,16 @@ export class SignatureComponent {
 
 ---
 
+## Repeater widgets (row isolation)
+
+Sibling rows share leaf names (`applicationId`, `roleIds`). Do not bind triggers to `events.context('*applicationId')` or a bare `applicationId` — that clears **every** row.
+
+- This row only: `events.context('>field')`.
+- Duplicate keys: merge on submit (union), not unique dropdowns with `filter` `not-in`.
+- Details: `libs/framework/client/layout/widget-core/README.md`.
+
+---
+
 ## Best Practices
 
 ### 1. Use Descriptive Names

package/layout/widget-core/README.md

@@ -1,4 +1,48 @@
-# @acorex-platform/framework-client/layout
+# Widget renderer — repeater context isolation
 
-Secondary entry point of `@acorex-platform/framework-client/platform`. It can be used by importing from `@acorex-platform/framework-client/layout`.
-            
+Package: `@acorex-platform/framework-client/layout/widget-core`.
+
+Renderer: `src/lib/widget-renderer.directive.ts`.
+
+Do not “simplify” path matching so that two repeater rows share the same leaf field name. That regression already shipped twice on TM Tenant Users Invite (`applicationRoleRows`).
+
+## What went wrong
+
+Indexed store paths look like:
+
+- `applicationRoleRows[0].applicationId`
+- `applicationRoleRows[1].applicationId`
+
+Last-segment matching (`applicationId`) treats those as the same change. Effects:
+
+- `events.context('>applicationId')` + `widget.setValue([])` on Roles runs on **every** row.
+- `events.context('*applicationId')` does the same by design — never use `*` for row-local reset.
+
+Unresolved `>` (empty `parentPath`) becomes the bare field `applicationId`. That must **not** suffix-match every `*.applicationId`.
+
+## Required matching rules
+
+| Listener | Match |
+|----------|--------|
+| `events.context('>field')` | Exact resolved path for **this** widget row only |
+| `events.context('rows')` | The array and every `rows[n]…` child (list-wide refresh) |
+| Different `rows[i]` vs `rows[j]` | **Never** match via shared suffix |
+
+`repeaterRowIndexConflicts` must stay in front of suffix matching in `contextStorePathDependsOnChangedPath`. `getEventScope` / `hasTriggerDependency` must keep the exact-match branch for `>` — do not OR `>` with suffix matching.
+
+## Duplicate keys in a repeater
+
+Prefer **merge on submit** (union of child values for the same key). TM Tenant Users Invite does this via `normalizeInviteApplicationRoleAssignments` — the same application may appear on two rows; persist one grant with all picked roles.
+
+Do **not** unique the dropdown with widget `filter` `not-in` / `nin`. Empty `not-in` is treated as a pending cascade and disables the select (empty list + not-allowed cursor). If a different screen truly needs unique options, use `excludeIds` (keep the current widget value in `excludeOptionRows`), never `not-in`.
+
+## Layout recipe — row-local Roles reset
+
+```typescript
+triggers: [{
+  event: "{{ events.context('>applicationId') }}",
+  action: '{{ widget.setValue([]); widget.refresh(); }}',
+}]
+```
+
+Reference: `libs/modules/security-management/client/src/lib/commands/invite-user.command.ts` (`buildApplicationRoleRepeaterChildren`).

package/layout/widgets/README.md

@@ -1,3 +1,9 @@
-# @acorex-platform/framework-client/layout/widgets
+# Layout widgets
 
-Secondary entry point of `@acorex-platform/framework-client/platform`. It can be used by importing from `@acorex-platform/framework-client/layout/widgets`.
+Package: `@acorex-platform/framework-client/layout/widgets`.
+
+Select / combo (`select-box-widget-edit.component.ts`):
+
+- Cascade parent empty → `hasPendingCascadeFilter` disables the control. Operators `not-in` / `nin` are **not** cascade.
+- Repeater duplicate keys: merge on submit (see TM invite `normalizeInviteApplicationRoleAssignments`). Do not unique options with `filter` `not-in`.
+- Repeater path matching: `libs/framework/client/layout/widget-core/README.md`.

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@acorex-platform/framework-client",
-  "version": "0.0.59",
+  "version": "0.0.60",
   "peerDependencies": {
-    "@acorex-platform/framework-shared": "0.0.59",
+    "@acorex-platform/framework-shared": "0.0.60",
     "@acorex/cdk": "^21.0.0 || ^22.0.0 || ^22.0.0-next.0 || ^22.1.0-next.0 || ^22.2.0-next.0 || ^22.2.0-next.0",
     "@acorex/charts": "^21.0.0 || ^22.0.0 || ^22.0.0-next.0 || ^22.1.0-next.0 || ^22.2.0-next.0 || ^22.2.0-next.0",
     "@acorex/components": "^21.0.0 || ^22.0.0 || ^22.0.0-next.0 || ^22.1.0-next.0 || ^22.2.0-next.0 || ^22.2.0-next.0",

package/types/acorex-platform-framework-client-auth.d.ts

@@ -351,7 +351,13 @@ declare class AXPSessionService {
     /** In-memory catalog caches — shared by guards and chooser UI (one List* per bind). */
     private tenantsListCache;
     private applicationsListCache;
+    /** Bumps when catalogs must re-fetch (e.g. after tenant-request approve). */
+    private readonly catalogEpoch$;
     private signoutInFlight;
+    /** Coalesces soft-restore → Authorized promotion after connectivity recovers. */
+    private accessPolicyRetryInFlight;
+    private softRestoreOnlineRecoveryAttached;
+    private softRestoreOnlineRecoveryHandler;
     private status;
     readonly status$: Observable<AXPSessionStatus>;
     private isLoading;
@@ -391,6 +397,28 @@ declare class AXPSessionService {
     /** Waits for session restore to finish, then emits whether the session is fully authorized. */
     readonly isAuthorizedWithLoading$: Observable<boolean>;
     restoreSession(): Promise<void>;
+    /**
+     * Trust persisted AXP_SESSION after a non-definitive restore refresh failure.
+     * Keeps identity; promotes to Authorized only when access policy load succeeds.
+     */
+    private softRestoreFromStoredSession;
+    /**
+     * Soft-restore policy load: success = both loaders completed without throw
+     * (empty permission/feature lists still count as a successful load).
+     */
+    private tryLoadAccessPolicyForSoftRestore;
+    /**
+     * Retries access-policy load after a soft restore that stayed Authenticated.
+     * On success with complete workspace, promotes to Authorized (no logout on failure).
+     * Coalesces concurrent callers (refresh / online / successful API).
+     */
+    retryAccessPolicyAuthorization(): Promise<boolean>;
+    /**
+     * Bounded recovery after soft-restore Authenticated: browser `online` once per arm.
+     * Successful token refresh also retries (see {@link refreshToken}).
+     */
+    private armSoftRestorePolicyRecovery;
+    private disarmSoftRestorePolicyRecovery;
     signin(credentials: AXPBaseCredentials): Promise<void>;
     register(credentials: AXPBaseCredentials): Promise<void>;
     private applySignInResult;
@@ -428,6 +456,11 @@ declare class AXPSessionService {
     /** Shared ListApplications — used by guards and {@link applications$}. */
     getApplicationsList(): Promise<AXPApplication[]>;
     private clearCatalogCaches;
+    /**
+     * Drops ListTenants / ListApplications caches and re-emits {@link tenants$}.
+     * Call after membership/tenant availability changes (e.g. approve tenant request).
+     */
+    invalidateCatalogCaches(): void;
     signInComplete(): Promise<void>;
     /** Tenant + application must be bound before menu, permissions, and features are fully valid. */
     private hasCompleteSessionContext;
@@ -715,6 +748,32 @@ declare function storeSessionLimitPendingTenant(tenant: AXPSessionLimitPendingTe
 declare function readSessionLimitPendingTenant(): AXPSessionLimitPendingTenant | null;
 declare function clearSessionLimitPendingTenant(): void;
 
+/**
+ * Stable server codes for definitive refresh/session death (prefer over message text).
+ * Keep in sync with `AUTH_REFRESH_ERROR_CODES` / `SESSION_MEMBERSHIP_DENIED` on the server.
+ */
+declare const DEFINITIVE_AUTH_REFRESH_CODES: readonly ["REFRESH_MISSING", "REFRESH_EXPIRED", "REFRESH_REVOKED", "REFRESH_REUSE", "SESSION_REVOKED", "USER_NOT_FOUND", "SESSION_MEMBERSHIP_DENIED"];
+/**
+ * True only when refresh failed because the refresh cookie / session family is dead.
+ * Network / 5xx / Redis unavailable / empty transient results → false.
+ */
+declare function isDefinitiveAuthRefreshFailure(error: unknown): boolean;
+
+/**
+ * After soft restore: keep identity without promoting to Authorized when
+ * access policy could not be loaded (transient API/refresh failure).
+ */
+declare function resolveStatusAfterSoftRestore(options: {
+    hasUser: boolean;
+    hasCompleteWorkspace: boolean;
+    policyLoadSucceeded: boolean;
+}): AXPSessionStatus;
+/**
+ * Soft-restore left the session Authenticated (policy unavailable).
+ * Retry access-policy load after connectivity / successful token refresh recovers.
+ */
+declare function shouldRetryAccessPolicyAuthorization(status: AXPSessionStatus): boolean;
+
 /**
  * Best-effort plain string for thrown {@link Error} messages from command results (no i18n lookup).
  */
@@ -1059,5 +1118,5 @@ declare class AXPSignInMethodRegistry {
     static ɵprov: i0.ɵɵInjectableDeclaration<AXPSignInMethodRegistry>;
 }
 
-export { AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE, AXPAuthGuard, AXPAuthModule, AXPAuthStrategy, AXPAuthStrategyRegistryService, AXPFeatureDirective, AXPFeatureEvaluatorScopeProvider, AXPFeatureGuard, AXPLoginChallengeComponentBase, AXPLoginChallengeProvider, AXPPermissionDefinitionBuilder, AXPPermissionDefinitionGroupBuilder, AXPPermissionDefinitionProviderContext, AXPPermissionDefinitionService, AXPPermissionDirective, AXPPermissionEvaluatorScopeProvider, AXPPermissionGuard, AXPPlatformAuthRuntimeService, AXPSessionContext, AXPSessionService, AXPSessionStatus, AXPSignInMethod, AXPSignInMethodRegistry, AXPUnauthenticatedError, AXPUnauthorizedError, AXPUserProfileIdentityService, AXP_ACCESS_POLICY_CACHE_PORT, AXP_APPLICATION_LOADER, AXP_DEFAULT_PLATFORM_OAUTH_CLIENT_ID, AXP_DEFAULT_PLATFORM_OAUTH_SCOPE, AXP_FEATURE_CHECKER, AXP_FEATURE_LOADER, AXP_LOGIN_CHALLENGE_PROVIDER, AXP_OAUTH_PKCE_VERIFIER_KEY, AXP_PERMISSION_CHECKER, AXP_PERMISSION_DEFINITION_PROVIDER, AXP_PERMISSION_LOADER, AXP_PERMISSION_MODULES_RESOLVER, AXP_PLATFORM_OAUTH_CSRF_COOKIE, AXP_TENANT_LOADER, AXP_USER_AVATAR_CACHE_PORT, JwtUtil, MAX_ACTIVE_DEVICE_SESSIONS_CODE, PkceUtil, TimeUtil, asAuthListProvidersResponse, clearOAuthPendingStrategy, clearSessionLimitPendingTenant, commandMessageTextForError, exchangePlatformOAuthAuthorizationCode, fetchPlatformOAuthDiscoveryDocument, findIdentityProvider, getOAuthPendingStrategy, hasLegacyOAuthPkceVerifier, hasOAuthPendingFlow, initPlatformOAuthAuthorization, isMaxActiveDeviceSessionsError, isOAuthRedirectInFlight, platformOAuthSessionUpdateParams, readPlatformOAuthCsrfToken, readSessionLimitPendingTenant, resolvePlatformOAuthAuthorizeEndpoint, resolvePlatformOAuthClientConfig, resolvePlatformOAuthIssuer, resolvePlatformOAuthRedirectUri, resolvePlatformOAuthTokenEndpoint, setOAuthPendingStrategy, shouldPlatformOAuthBindSession, storeSessionLimitPendingTenant, toPlatformOAuthSignInResult, traceAuthAccessPolicy, traceAuthCatalog, traceAuthGuard, traceAuthLifecycle, traceAuthLifecycleError, traceAuthRestore, traceAuthWorkspace, warnAuthAccessPolicy, warnAuthLifecycle, warnAuthWorkspace };
+export { AUTH_SESSION_TRACE_NS, AUTH_SESSION_TRACE_TITLE, AXPAuthGuard, AXPAuthModule, AXPAuthStrategy, AXPAuthStrategyRegistryService, AXPFeatureDirective, AXPFeatureEvaluatorScopeProvider, AXPFeatureGuard, AXPLoginChallengeComponentBase, AXPLoginChallengeProvider, AXPPermissionDefinitionBuilder, AXPPermissionDefinitionGroupBuilder, AXPPermissionDefinitionProviderContext, AXPPermissionDefinitionService, AXPPermissionDirective, AXPPermissionEvaluatorScopeProvider, AXPPermissionGuard, AXPPlatformAuthRuntimeService, AXPSessionContext, AXPSessionService, AXPSessionStatus, AXPSignInMethod, AXPSignInMethodRegistry, AXPUnauthenticatedError, AXPUnauthorizedError, AXPUserProfileIdentityService, AXP_ACCESS_POLICY_CACHE_PORT, AXP_APPLICATION_LOADER, AXP_DEFAULT_PLATFORM_OAUTH_CLIENT_ID, AXP_DEFAULT_PLATFORM_OAUTH_SCOPE, AXP_FEATURE_CHECKER, AXP_FEATURE_LOADER, AXP_LOGIN_CHALLENGE_PROVIDER, AXP_OAUTH_PKCE_VERIFIER_KEY, AXP_PERMISSION_CHECKER, AXP_PERMISSION_DEFINITION_PROVIDER, AXP_PERMISSION_LOADER, AXP_PERMISSION_MODULES_RESOLVER, AXP_PLATFORM_OAUTH_CSRF_COOKIE, AXP_TENANT_LOADER, AXP_USER_AVATAR_CACHE_PORT, DEFINITIVE_AUTH_REFRESH_CODES, JwtUtil, MAX_ACTIVE_DEVICE_SESSIONS_CODE, PkceUtil, TimeUtil, asAuthListProvidersResponse, clearOAuthPendingStrategy, clearSessionLimitPendingTenant, commandMessageTextForError, exchangePlatformOAuthAuthorizationCode, fetchPlatformOAuthDiscoveryDocument, findIdentityProvider, getOAuthPendingStrategy, hasLegacyOAuthPkceVerifier, hasOAuthPendingFlow, initPlatformOAuthAuthorization, isDefinitiveAuthRefreshFailure, isMaxActiveDeviceSessionsError, isOAuthRedirectInFlight, platformOAuthSessionUpdateParams, readPlatformOAuthCsrfToken, readSessionLimitPendingTenant, resolvePlatformOAuthAuthorizeEndpoint, resolvePlatformOAuthClientConfig, resolvePlatformOAuthIssuer, resolvePlatformOAuthRedirectUri, resolvePlatformOAuthTokenEndpoint, resolveStatusAfterSoftRestore, setOAuthPendingStrategy, shouldPlatformOAuthBindSession, shouldRetryAccessPolicyAuthorization, storeSessionLimitPendingTenant, toPlatformOAuthSignInResult, traceAuthAccessPolicy, traceAuthCatalog, traceAuthGuard, traceAuthLifecycle, traceAuthLifecycleError, traceAuthRestore, traceAuthWorkspace, warnAuthAccessPolicy, warnAuthLifecycle, warnAuthWorkspace };
 export type { AXPAccessPolicyCachePort, AXPApplication, AXPApplicationLoader, AXPAuthIdentityProvider, AXPAuthListProvidersResponse, AXPAuthLocalSignInMethod, AXPAuthModuleConfigs, AXPBaseCredentials, AXPChallengeCheckResult, AXPChallengeContentType, AXPEdition, AXPFeature, AXPFeatureChecker, AXPFeatureLoader, AXPLoginChallengeData, AXPPermission, AXPPermissionAddOptions, AXPPermissionChecker, AXPPermissionDefinition, AXPPermissionDefinitionProvider, AXPPermissionGroupAddOptions, AXPPermissionGroupDefinition, AXPPermissionLoader, AXPPermissionModulesResolver, AXPPlatformOAuthClientConfig, AXPPlatformOAuthDiscoveryDocument, AXPSessionData, AXPSessionLimitPendingTenant, AXPSignInMethodDescriptor, AXPSignInMethodProtocol, AXPSignInMethodStartResult, AXPSignInMethodStep, AXPSignInMethodStepKind, AXPSignInResult, AXPTenant, AXPTenantLoader, AXPTokenResult, AXPUser, AXPUserAvatarCachePort, PlatformAuthOwnDeviceSessionDto, PlatformAuthTokenResponseDto, PlatformAuthUpdateSessionInput };

package/types/acorex-platform-framework-client-common.d.ts

@@ -820,15 +820,17 @@ declare class AXPKeyboardShortcutsHelpComponent {
 
 declare class AXPKeyboardShortcutsHelpService {
     private readonly popupService;
-    private readonly dialogOpener;
     private readonly translationService;
     private readonly shortcutRegistry;
     private readonly document;
+    /** In-flight help popup session (open until the popup closes). */
+    private activeShow;
     constructor();
     /**
      * Opens the keyboard shortcuts help popup, or no-ops when it is already open.
      */
     show(): Promise<void>;
+    private openHelpPopup;
     static ɵfac: i0.ɵɵFactoryDeclaration<AXPKeyboardShortcutsHelpService, never>;
     static ɵprov: i0.ɵɵInjectableDeclaration<AXPKeyboardShortcutsHelpService>;
 }
@@ -4152,7 +4154,6 @@ declare function downloadGraphicFromElement(container: HTMLElement, options: AXP
 
 declare class AXPExportService {
     popupService: AXPopupService;
-    private readonly dialogOpener;
     generateBlobFromElement(element: HTMLElement, blobOptions?: AXPDomToImageOptions): Promise<Blob>;
     download(blob: Blob, filename: string): void;
     static ɵfac: i0.ɵɵFactoryDeclaration<AXPExportService, never>;

package/types/acorex-platform-framework-client-layout-components.d.ts

@@ -2990,6 +2990,8 @@ declare class AXPRepeaterRowsLayoutComponent {
     disabled: _angular_core.InputSignal<boolean>;
     hasControls: _angular_core.InputSignal<boolean>;
     allowReorder: _angular_core.InputSignal<boolean>;
+    /** Opt-in: put Add next to last-row Remove. Default keeps footer Add Item for other repeaters. */
+    inlineAddControl: _angular_core.InputSignal<boolean>;
     rowTemplate: _angular_core.InputSignal<TemplateRef<{
         index: number;
     }>>;
@@ -3007,7 +3009,7 @@ declare class AXPRepeaterRowsLayoutComponent {
     protected onAddClick(): void;
     protected onRemoveClick(index: number): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AXPRepeaterRowsLayoutComponent, never>;
-    static ɵcmp: _angular_core.ɵɵComponentDeclaration<AXPRepeaterRowsLayoutComponent, "axp-repeater-rows-layout", never, { "count": { "alias": "count"; "required": true; "isSignal": true; }; "disabled": { "alias": "disabled"; "required": false; "isSignal": true; }; "hasControls": { "alias": "hasControls"; "required": false; "isSignal": true; }; "allowReorder": { "alias": "allowReorder"; "required": false; "isSignal": true; }; "rowTemplate": { "alias": "rowTemplate"; "required": true; "isSignal": true; }; "addItemLabelKey": { "alias": "addItemLabelKey"; "required": false; "isSignal": true; }; "emptyTitleKey": { "alias": "emptyTitleKey"; "required": false; "isSignal": true; }; "emptyDescriptionKey": { "alias": "emptyDescriptionKey"; "required": false; "isSignal": true; }; "addFirstItemLabelKey": { "alias": "addFirstItemLabelKey"; "required": false; "isSignal": true; }; }, { "addClick": "addClick"; "removeClick": "removeClick"; "drop": "drop"; }, never, never, true, never>;
+    static ɵcmp: _angular_core.ɵɵComponentDeclaration<AXPRepeaterRowsLayoutComponent, "axp-repeater-rows-layout", never, { "count": { "alias": "count"; "required": true; "isSignal": true; }; "disabled": { "alias": "disabled"; "required": false; "isSignal": true; }; "hasControls": { "alias": "hasControls"; "required": false; "isSignal": true; }; "allowReorder": { "alias": "allowReorder"; "required": false; "isSignal": true; }; "inlineAddControl": { "alias": "inlineAddControl"; "required": false; "isSignal": true; }; "rowTemplate": { "alias": "rowTemplate"; "required": true; "isSignal": true; }; "addItemLabelKey": { "alias": "addItemLabelKey"; "required": false; "isSignal": true; }; "emptyTitleKey": { "alias": "emptyTitleKey"; "required": false; "isSignal": true; }; "emptyDescriptionKey": { "alias": "emptyDescriptionKey"; "required": false; "isSignal": true; }; "addFirstItemLabelKey": { "alias": "addFirstItemLabelKey"; "required": false; "isSignal": true; }; }, { "addClick": "addClick"; "removeClick": "removeClick"; "drop": "drop"; }, never, never, true, never>;
 }
 
 /** Scheduler appointment with optional provider tag for context menu routing. */

package/types/acorex-platform-framework-client-layout-entity.d.ts

@@ -1633,6 +1633,11 @@ declare class AXPEntityMasterListViewModel {
         title: string;
     } | null>;
     parentKey: _angular_core.Signal<string | undefined>;
+    /**
+     * Tree column only while the list is unfiltered roots.
+     * An active filter returns a flat page; keeping parentField would drop child rows and page by the flat total.
+     */
+    gridParentField: _angular_core.Signal<string | undefined>;
     hasSelectedItems: _angular_core.Signal<boolean>;
     clearSelection(): void;
     /**
@@ -1649,6 +1654,7 @@ declare class AXPEntityMasterListViewModel {
      */
     categoryListFilters: _angular_core.WritableSignal<AXPFilterQuery[]>;
     setCategoryListFilters(filters: AXPFilterQuery[]): void;
+    private hasActiveListFilter;
     title: _angular_core.Signal<string>;
     description: _angular_core.Signal<string | null>;
     filterDefinitions: _angular_core.WritableSignal<AXPEntityListFilterDefinition[]>;
@@ -2553,7 +2559,8 @@ interface AXPEntityDeletePerformInput {
     meta?: unknown;
 }
 /**
- * Deletes one or more entity records via the server filter-only bulk command API.
+ * Deletes one or more entity records.
+ * A custom `commands.delete.execute` runs once per id. The crud default stays on the bulk API.
  */
 declare class AXPEntityDeletePerformService {
     private readonly entityRegistry;

package/types/acorex-platform-framework-client-layout-widget-core.d.ts

@@ -229,6 +229,12 @@ declare abstract class AXPValueWidgetComponent<T = any | null, TOptions extends
     /** Applies schema default without marking the form as user-edited. */
     protected applyDefaultValue(value: T | null | undefined): void;
     setValue(value: T | null | undefined): void;
+    /**
+     * Repeater clones pass the row index onto every descendant. Attach that index
+     * to the ancestor array path (`rows[0].field`), not after the leaf (`rows.field.[0]`).
+     * Lodash paths need `rows[0].field` — a dotted `.[0].` segment is a literal key.
+     */
+    private joinIndexedWidgetPath;
     protected detectFullPath(): void;
     protected handleValueChanged(e: AXValueChangedEvent<T>): void;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AXPValueWidgetComponent<any, any>, never>;
@@ -243,6 +249,8 @@ declare abstract class AXPDataListWidgetComponent extends AXPValueWidgetComponen
     protected valueField: _angular_core.Signal<string>;
     protected textTemplate: _angular_core.Signal<string | undefined>;
     protected dataSource: _angular_core.WritableSignal<AXDataSource<any>>;
+    /** AXDataSource instance from options that the isolated widget copy was built from. */
+    private boundRemoteDataSource;
     /** Query key from options, when options.dataSource is a string or `{ id }` object. */
     protected queryDataSourceName: _angular_core.Signal<string | null>;
     selectedItems: _angular_core.WritableSignal<any[]>;
@@ -911,15 +919,35 @@ declare class AXPWidgetRendererDirective {
     /**
      * True when a context store path used in an expression (`context.eval`, `context.options`) is
      * affected by `changedPath`.
+     *
+     * Do not drop `repeaterRowIndexConflicts` or re-enable last-segment matching across rows.
+     * `applicationRoleRows[0].applicationId` and `applicationRoleRows[1].applicationId` share the
+     * suffix `applicationId`; treating that as a match clears sibling repeater fields (roles).
+     * Canonical: `libs/framework/client/layout/widget-core/README.md` (repeater context isolation).
      */
     private contextStorePathDependsOnChangedPath;
+    /**
+     * Different indexed rows of the same array must not share context events.
+     * `rows[0].applicationId` must not match `rows[1].applicationId` via suffix (`applicationId`).
+     * Bare `rows` (no `[n]`) still matches every indexed child so list-wide expressions can refresh.
+     * Do not remove this gate or “simplify” it back to suffix-only matching.
+     */
+    private repeaterRowIndexConflicts;
     /**
      * Whether an expression template string reads context store paths affected by `changedPath`.
+     *
+     * Unresolved `>field` (parentPath empty) is `field` only — never suffix-match every `*.field`.
+     * Do not fold `>` back into generic suffix matching.
      */
     private expressionTextDependsOnContextPath;
     private hasExpressionDependency;
     private isPathAlias;
     private getExpressionValueFromNode;
+    /**
+     * `events.context('>field')` is this row only (exact resolved path).
+     * Do not use `*field` / suffix matching for row-local reset triggers — that fires on every
+     * repeater row that has a field of the same name.
+     */
     private hasTriggerDependency;
     private hasVisibilityDependency;
     ngOnChanges(changes: SimpleChanges): void;
@@ -934,8 +962,19 @@ declare class AXPWidgetRendererDirective {
     private show;
     private hide;
     private evaluateExpression;
+    /**
+     * Repeater-relative paths (`>applicationId`) resolve against this widget's parent
+     * row (`applicationRoleRows[0].applicationId`), not every field with the same name.
+     * When `parentPath` is empty the result is the bare field — callers must not treat that
+     * as “any `*.applicationId`”.
+     */
+    private resolveRowRelativeContextPath;
     private buildExpressionScope;
     private getContextScope;
+    /**
+     * `events.context('>…')` is exact row path only. Do not OR it with
+     * `contextStorePathDependsOnChangedPath` — that suffix-matches sibling rows.
+     */
     private getEventScope;
     private getWidgetScope;
     private getFunctionScope;

package/types/acorex-platform-framework-client-layout-widgets.d.ts

@@ -1616,16 +1616,25 @@ interface AXPRichTextWidgetOptions {
     column: AXPRichTextWidgetColumnOptions;
 }
 
-declare class AXPSelectBoxWidgetColumnComponent extends AXPColumnWidgetComponent<any> {
+declare class AXPSelectBoxWidgetColumnComponent extends AXPColumnWidgetComponent<unknown> implements OnInit {
+    private readonly queryService;
+    private readonly localStore;
+    private readonly destroyRef;
+    private readonly activeTextField;
+    private readonly activeValueField;
     protected textField: _angular_core.Signal<string>;
     protected valueField: _angular_core.Signal<string>;
     protected cssClassField: _angular_core.Signal<string | undefined>;
     protected badgeClass: _angular_core.Signal<string | undefined>;
-    protected dataSource: _angular_core.Signal<unknown[]>;
+    private readonly displayRows;
+    private destroyed;
     protected internalValue: _angular_core.Signal<Record<string, unknown>[]>;
+    ngOnInit(): void;
     protected resolveBadgeClasses(item: unknown): string;
     protected getItemLabel(item: unknown): string | Record<string, string>;
-    private extractItem;
+    private loadRows;
+    private resolveSlots;
+    private readLocalItems;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<AXPSelectBoxWidgetColumnComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<AXPSelectBoxWidgetColumnComponent, "axp-select-box-widget-column", never, { "rawValue": { "alias": "rawValue"; "required": false; }; "rowData": { "alias": "rowData"; "required": false; }; }, {}, never, never, true, never>;
 }
@@ -1674,6 +1683,8 @@ declare class AXPSelectBoxWidgetEditComponent extends AXPDataListWidgetComponent
     /**
      * True when a cascade/parent filter is configured but required values are still empty
      * (e.g. state select before country is chosen).
+     * `not-in` / `nin` are not cascade — treating them as pending disables the control
+     * (not-allowed cursor, empty list). Hide already-picked options with `excludeIds`, not `filter`.
      */
     protected hasPendingCascadeFilter: _angular_core.Signal<boolean>;
     /** Only swap datasource when cascade parent is missing. */
@@ -1721,6 +1732,12 @@ declare class AXPSelectBoxWidgetEditComponent extends AXPDataListWidgetComponent
      */
     private syncExposePathsToSavedBaseline;
     private remapComboItems;
+    /**
+     * Drop ids in `excludeIds` except this widget's current value so the selected item stays visible.
+     * Do not filter out the current row's own id — the dropdown would go empty after pick.
+     */
+    private excludeOptionRows;
+    private applyArrayWidgetFilter;
     /**
      * Patches lookup `load` so widget/cascade filters are AND-ed with lookup search,
      * and so a pending cascade parent returns an empty page.
@@ -4314,6 +4331,7 @@ declare class AXPRepeaterWidgetEditComponent extends AXPValueWidgetComponent<any
     protected disabled: _angular_core.Signal<boolean>;
     protected hasControls: _angular_core.Signal<boolean>;
     protected allowReorder: _angular_core.Signal<boolean>;
+    protected inlineAddControl: _angular_core.Signal<boolean>;
     protected rows: _angular_core.Signal<any[]>;
     onDrop(e: AXDropListDroppedEvent): void;
     protected handleAddItemClick(): void;
@@ -4350,6 +4368,8 @@ interface AXPRepeaterWidgetEditOptions {
     disabled?: boolean;
     hasControls?: boolean;
     allowReorder?: boolean;
+    /** When true, Add sits on the last row (opt-in). Default keeps footer Add Item. */
+    inlineAddControl?: boolean;
     /** Cloned into each new row. Missing `id` values are generated. */
     defaultItem?: Record<string, unknown>;
 }
@@ -5274,9 +5294,9 @@ declare class AXPFlexOptionsWidgetEditComponent extends AXPValueWidgetComponent<
     protected flexDirectionIsColumn: _angular_core.Signal<boolean | undefined>;
     protected flexDirectionIsReverse: _angular_core.Signal<boolean | undefined>;
     protected flexDirectionWithoutReverse: _angular_core.Signal<string | undefined>;
-    protected gapMode: _angular_core.WritableSignal<"single" | "both">;
+    protected gapMode: _angular_core.WritableSignal<"both" | "single">;
     protected gapUnit: _angular_core.WritableSignal<string>;
-    protected gap: _angular_core.WritableSignal<Record<"x" | "y" | "both", number>>;
+    protected gap: _angular_core.WritableSignal<Record<"both" | "x" | "y", number>>;
     protected lastGap: _angular_core.WritableSignal<number>;
     protected selectedJustify: _angular_core.WritableSignal<AXPFlexBoxOption>;
     protected selectedAlign: _angular_core.WritableSignal<AXPFlexBoxOption>;