@isi-ui7/bos7-shared 0.2.3 → 0.2.6

package/dist/shell/app-shell-layout.d.ts

@@ -1,4 +1,4 @@
-import { ReactNode } from 'react';
+import { ElementType, ReactNode } from 'react';
 
 export interface AppShellAuthState {
     isAuthenticated: boolean;
@@ -12,7 +12,22 @@ export interface AppShellAuthState {
     login: () => void;
     logout: () => Promise<void> | void;
 }
-export type ShellNavItemLike = any;
+/**
+ * Structural shape of a side-nav item, mirroring ui-shell's `ShellNavItem`.
+ * `label`/`href` are required to stay mutually assignable with `ShellNavItem`:
+ * this type is used both covariantly (`navItems`) and contravariantly
+ * (`markActive`'s parameter), so consumers passing `ShellNavItem`-typed values
+ * would otherwise fail under `strict`. The index signature keeps it permissive
+ * for extra metadata (e.g. `requiredPermission`).
+ */
+export interface ShellNavItemLike {
+    label: string;
+    href: string;
+    isActive?: boolean;
+    icon?: string;
+    children?: ShellNavItemLike[];
+    [key: string]: unknown;
+}
 export interface ShellNotificationLike {
     id?: string;
     read?: boolean;
@@ -43,9 +58,9 @@ export interface AppShellLayoutDeps {
         theme: ThemeLike;
     };
     useNotificationBell: (opts: NotificationBellOptionsLike) => NotificationBellLike;
-    GlobalTheme: any;
-    ModalProvider: any;
-    UiShell: any;
+    GlobalTheme: ElementType;
+    ModalProvider: ElementType;
+    UiShell: ElementType;
     useAuth?: () => AppShellAuthState;
 }
 export interface AppShellLayoutProps {

package/dist/style-contract.d.ts

@@ -1,5 +1,15 @@
 export type Ui7FormDensity = "compact" | "comfortable";
 export type Ui7ThemeDensity = Ui7FormDensity | "normal";
+/**
+ * Desktop form-panel width. Mobile + tablet (<1056px) always release the
+ * cap and stretch to 100% — the modifier only matters at ≥1056px.
+ *
+ *  - "half"        → 50% of page body
+ *  - "two-thirds"  → 66.6667% (default — readable column width on wide
+ *                    monitors, what the contract shipped with originally)
+ *  - "full"        → 100% (forms with many columns or wide tables inside)
+ */
+export type Ui7FormWidth = "half" | "two-thirds" | "full";
 export interface Ui7FormVisualTokens {
     labelSpacing: "6px";
     labelFontSize: "12px";
@@ -38,6 +48,9 @@ export declare const UI7_FORM_VISUAL_CLASSNAMES: {
     readonly scope: "ui7-form-contract";
     readonly densityCompact: "ui7-form-contract--density-compact";
     readonly densityComfortable: "ui7-form-contract--density-comfortable";
+    readonly widthHalf: "ui7-form-contract--width-half";
+    readonly widthTwoThirds: "ui7-form-contract--width-two-thirds";
+    readonly widthFull: "ui7-form-contract--width-full";
     readonly readonly: "ui7-form-contract--readonly";
     readonly row: "ui7-form-row";
     readonly section: "ui7-form-section";
@@ -52,21 +65,23 @@ export declare const UI7_FORM_VISUAL_CLASSNAMES: {
 export declare const UI7_FORM_DENSITY_TOKENS: {
     readonly compact: {
         readonly controlHeight: "2rem";
-        readonly rowGap: "0.75rem";
-        readonly sectionGap: "1rem";
-        readonly columnGap: "0.75rem";
+        readonly rowGap: "1rem";
+        readonly sectionGap: "1.25rem";
+        readonly columnGap: "1rem";
     };
     readonly comfortable: {
         readonly controlHeight: "2.5rem";
-        readonly rowGap: "1rem";
+        readonly rowGap: "1.25rem";
         readonly sectionGap: "1.5rem";
-        readonly columnGap: "1rem";
+        readonly columnGap: "1.25rem";
     };
 };
 export declare function normalizeUi7FormDensity(density?: Ui7ThemeDensity | null, fallback?: Ui7FormDensity): Ui7FormDensity;
 export declare function getUi7FormDensityClassName(density?: Ui7ThemeDensity | null, fallback?: Ui7FormDensity): string;
+export declare function getUi7FormWidthClassName(width?: Ui7FormWidth | null): string;
 export declare function getUi7FormContractClassName(options?: {
     density?: Ui7ThemeDensity | null;
+    width?: Ui7FormWidth | null;
     readonly?: boolean;
     className?: string | null;
 }): string;

package/dist/workflow/starter.d.ts

@@ -13,9 +13,22 @@ export type StartWorkflowInput = {
     flowId: string;
     payload: Record<string, unknown>;
     externalRef?: string;
+    /**
+     * Optional override for initiator identity. By default the helper decodes
+     * the full tenant identity (user_id, username, org_id, branch_id, branch_code)
+     * from the access token and uses that. Any field explicitly set here wins.
+     *
+     * Set ONLY when the caller has a verified reason to override (rare). For
+     * normal flow-start paths leave this undefined — letting the helper read
+     * the JWT keeps initiator_context aligned with the auth7 signature.
+     */
     initiatorContext?: {
         user_id?: string;
+        username?: string;
+        org_id?: string;
         branch_id?: string;
+        branch_code?: string;
+        ip?: string;
     };
     /** User access token dari auth7 — diforward ke workflow7 sebagai Bearer. */
     userAccessToken: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isi-ui7/bos7-shared",
-  "version": "0.2.3",
+  "version": "0.2.6",
   "description": "Shared auth7 and layout primitives for bos7 applications.",
   "license": "MIT",
   "repository": {
@@ -72,7 +72,8 @@
     "@carbon/react": "^1.97.0",
     "@carbon/icons-react": "^11.71.0",
     "@isi-ui7/data-table": ">=0.2.0",
-    "@isi-ui7/lookup-input": ">=0.2.0"
+    "@isi-ui7/lookup-input": ">=0.2.0",
+    "@isi-ui7/editable-table": ">=0.2.0"
   },
   "devDependencies": {
     "@eslint/eslintrc": "^3.3.1",
@@ -99,12 +100,13 @@
     "@carbon/react": "^1.97.0",
     "@carbon/icons-react": "^11.71.0",
     "@isi-ui7/i18n": "0.2.0",
-    "@isi-ui7/lookup-input": "0.2.1",
-    "@isi-ui7/data-table": "0.2.1",
-    "@isi-ui7/ui-shell": "0.2.2",
+    "@isi-ui7/corporate-themes": "0.2.4",
+    "@isi-ui7/ui-shell": "0.2.4",
     "@isi-ui7/modal-manager": "0.2.1",
-    "@isi-ui7/corporate-themes": "0.2.2",
-    "@isi-ui7/realtime": "0.2.2"
+    "@isi-ui7/realtime": "0.2.2",
+    "@isi-ui7/data-table": "0.2.2",
+    "@isi-ui7/lookup-input": "0.2.2",
+    "@isi-ui7/editable-table": "0.2.2"
   },
   "dependencies": {
     "@carbon/icons-react": "^11.71.0",
@@ -117,8 +119,9 @@
     "@opentelemetry/sdk-node": "^0.57.0",
     "@opentelemetry/exporter-trace-otlp-http": "^0.57.0",
     "@opentelemetry/auto-instrumentations-node": "^0.57.0",
-    "@isi-ui7/lookup-input": "0.2.1",
-    "@isi-ui7/data-table": "0.2.1"
+    "@isi-ui7/data-table": "0.2.2",
+    "@isi-ui7/lookup-input": "0.2.2",
+    "@isi-ui7/editable-table": "0.2.2"
   },
   "scripts": {
     "build": "vite build",

package/src/auth7/delegated-proxy.ts

@@ -21,11 +21,59 @@ export interface DelegatedProxy {
 	delete<T>(path: string): Promise<{ ok: boolean; data?: T; error?: string }>;
 }
 
+/**
+ * Tenant identity headers forwarded to the upstream service. Header names
+ * match lib7-service-go v0.9.0 `middleware.HeaderActor*` constants so the
+ * VerifyAuditSignature middleware (and any audit logger) reads them via the
+ * same keys regardless of caller (BFF or workflow7).
+ *
+ * These five headers duplicate information already inside the delegated JWT
+ * claims, so they are NOT individually signed: the JWT's RS256 signature
+ * covers the underlying identity. They exist so downstream services (and
+ * audit log enrichers) don't have to JWT-decode just to enrich a log line
+ * with a human-readable username or branch_code.
+ */
+interface ActorHeaders {
+	'X-Actor-UserID': string;
+	'X-Actor-Username': string;
+	'X-Actor-OrgID': string;
+	'X-Actor-BranchID': string;
+	'X-Actor-BranchCode': string;
+}
+
+/**
+ * Decode a JWT payload without verifying. Safe for tokens that originate
+ * from the current trusted session — used purely to forward identity
+ * downstream. Returns an empty object on malformed input rather than throw.
+ */
+function decodeJwtPayloadUnsafe(token: string): Record<string, unknown> {
+	const parts = token.split('.');
+	if (parts.length < 2) return {};
+	try {
+		return JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8')) as Record<string, unknown>;
+	} catch {
+		return {};
+	}
+}
+
+function actorHeadersFromToken(userToken: string): ActorHeaders {
+	const p = decodeJwtPayloadUnsafe(userToken);
+	const str = (v: unknown): string => (typeof v === 'string' ? v : '');
+	return {
+		'X-Actor-UserID': str(p.sub),
+		'X-Actor-Username': str(p.preferred_username),
+		'X-Actor-OrgID': str(p.org_id),
+		'X-Actor-BranchID': str(p.branch_id),
+		'X-Actor-BranchCode': str(p.branch_code),
+	};
+}
+
 async function proxyRequest<T>(
 	method: string,
 	path: string,
 	delegatedToken: string,
 	baseUrl: string,
+	actorHeaders: ActorHeaders,
 	options: { query?: Record<string, string>; body?: unknown } = {},
 ): Promise<{ ok: boolean; data?: T; error?: string }> {
 	let url = `${baseUrl}${path}`;
@@ -37,6 +85,7 @@ async function proxyRequest<T>(
 		headers: {
 			'Content-Type': 'application/json',
 			Authorization: `Bearer ${delegatedToken}`,
+			...actorHeaders,
 		},
 		...(options.body !== undefined ? { body: JSON.stringify(options.body) } : {}),
 	});
@@ -58,7 +107,14 @@ async function proxyRequest<T>(
 /**
  * Exchange the user's access token for a delegated service token (RFC 8693),
  * then return a typed proxy client for backend calls.
- * The exchanged token is cached per (userToken, audience) — see token-exchange.ts.
+ *
+ * Identity headers are derived from the ORIGINAL user token (the source of
+ * truth for who initiated the request), not from the exchanged delegated
+ * token (whose `sub` may be remapped to a client_id depending on the auth7
+ * exchange policy).
+ *
+ * The exchanged token is cached per (userToken, audience) — see
+ * token-exchange.ts.
  */
 export async function createDelegatedProxy(
 	userToken: string,
@@ -67,14 +123,15 @@ export async function createDelegatedProxy(
 ): Promise<DelegatedProxy> {
 	const { backendUrl = BACKEND_URL, ...exchangeOpts } = options;
 	const { accessToken: delegatedToken } = await exchangeUserToken(userToken, audience, undefined, exchangeOpts);
+	const actorHeaders = actorHeadersFromToken(userToken);
 	return {
 		get: <T>(path: string, query?: Record<string, string>) =>
-			proxyRequest<T>('GET', path, delegatedToken, backendUrl, { query }),
+			proxyRequest<T>('GET', path, delegatedToken, backendUrl, actorHeaders, { query }),
 		post: <T>(path: string, body: unknown) =>
-			proxyRequest<T>('POST', path, delegatedToken, backendUrl, { body }),
+			proxyRequest<T>('POST', path, delegatedToken, backendUrl, actorHeaders, { body }),
 		put: <T>(path: string, body: unknown) =>
-			proxyRequest<T>('PUT', path, delegatedToken, backendUrl, { body }),
+			proxyRequest<T>('PUT', path, delegatedToken, backendUrl, actorHeaders, { body }),
 		delete: <T>(path: string) =>
-			proxyRequest<T>('DELETE', path, delegatedToken, backendUrl),
+			proxyRequest<T>('DELETE', path, delegatedToken, backendUrl, actorHeaders),
 	};
 }

package/src/auth7/index.ts

@@ -12,3 +12,5 @@ export * from './types';
 export * from './client';
 export { requireScope, scopeFromRequest } from './scope-guard';
 export type { ScopeLevel } from './scope-guard';
+export { handleSwitchBranchRequest } from './switch-branch-bff';
+export type { SwitchBranchBffOptions } from './switch-branch-bff';

package/src/auth7/switch-branch-bff.test.ts

@@ -0,0 +1,121 @@
+import { handleSwitchBranchRequest } from './switch-branch-bff';
+
+type CookieJar = Map<string, string>;
+
+function mockRequest(opts: {
+  cookies?: Record<string, string>;
+  body?: unknown;
+  host?: string;
+}): import('next/server').NextRequest {
+  const cookies = opts.cookies ?? {};
+  const host = opts.host ?? 'app.bank.co.id';
+  return {
+    cookies: {
+      get: (name: string) =>
+        cookies[name] !== undefined ? { value: cookies[name] } : undefined,
+    },
+    headers: {
+      get: (h: string) => (h.toLowerCase() === 'host' ? host : null),
+    },
+    json: async () => opts.body ?? {},
+  } as unknown as import('next/server').NextRequest;
+}
+
+function readSetCookies(res: Response): CookieJar {
+  const jar: CookieJar = new Map();
+  const raw = res.headers.get('set-cookie') ?? '';
+  // Next's mocked Response joins multiple Set-Cookie with comma — split conservatively.
+  for (const part of raw.split(/,(?=\s*[A-Za-z0-9_-]+=)/)) {
+    const [pair] = part.split(';');
+    const [name, value] = pair.split('=');
+    if (name && value !== undefined) jar.set(name.trim(), decodeURIComponent(value));
+  }
+  return jar;
+}
+
+describe('handleSwitchBranchRequest', () => {
+  const originalFetch = global.fetch;
+  afterEach(() => {
+    global.fetch = originalFetch;
+  });
+
+  it('returns 401 when access_token cookie is missing', async () => {
+    const req = mockRequest({ body: { branch_id: 'b1' } });
+    const res = await handleSwitchBranchRequest(req, { auth7ApiUrl: 'http://auth7' });
+    expect(res.status).toBe(401);
+  });
+
+  it('persists access_token, refresh_token, and session_id from the response', async () => {
+    global.fetch = async () =>
+      new Response(
+        JSON.stringify({
+          access_token: 'new-access',
+          refresh_token: 'new-refresh',
+          token_type: 'Bearer',
+          expires_in: 900,
+          session_id: 'sess-xyz',
+          branch_id: 'b1',
+          branch_code: 'BR01',
+          switched_at: '2026-06-01T00:00:00Z',
+        }),
+        { status: 200, headers: { 'Content-Type': 'application/json' } }
+      );
+
+    const req = mockRequest({
+      cookies: { access_token: 'old-access' },
+      body: { branch_id: 'b1' },
+    });
+    const res = await handleSwitchBranchRequest(req, { auth7ApiUrl: 'http://auth7' });
+    expect(res.status).toBe(200);
+
+    const cookies = readSetCookies(res);
+    expect(cookies.get('access_token')).toBe('new-access');
+    expect(cookies.get('refresh_token')).toBe('new-refresh');
+    expect(cookies.get('session_id')).toBe('sess-xyz');
+    expect(cookies.get('bos7_branch')).toBe('b1');
+    expect(cookies.has('token_expires_at')).toBe(true);
+  });
+
+  it('does not set any cookies when upstream rejects', async () => {
+    global.fetch = async () =>
+      new Response(JSON.stringify({ error: 'forbidden' }), {
+        status: 403,
+        headers: { 'Content-Type': 'application/json' },
+      });
+
+    const req = mockRequest({
+      cookies: { access_token: 'old-access' },
+      body: { branch_id: 'b1' },
+    });
+    const res = await handleSwitchBranchRequest(req, { auth7ApiUrl: 'http://auth7' });
+    expect(res.status).toBe(403);
+    const cookies = readSetCookies(res);
+    expect(cookies.has('access_token')).toBe(false);
+    expect(cookies.has('refresh_token')).toBe(false);
+    expect(cookies.has('session_id')).toBe(false);
+  });
+
+  it('skips bos7_branch cookie for localhost host', async () => {
+    global.fetch = async () =>
+      new Response(
+        JSON.stringify({
+          access_token: 'a',
+          refresh_token: 'r',
+          expires_in: 900,
+          session_id: 's',
+          branch_id: 'b1',
+        }),
+        { status: 200, headers: { 'Content-Type': 'application/json' } }
+      );
+
+    const req = mockRequest({
+      cookies: { access_token: 'old' },
+      body: { branch_id: 'b1' },
+      host: 'localhost:3000',
+    });
+    const res = await handleSwitchBranchRequest(req, { auth7ApiUrl: 'http://auth7' });
+    const cookies = readSetCookies(res);
+    expect(cookies.has('bos7_branch')).toBe(false);
+    expect(cookies.get('access_token')).toBe('a');
+  });
+});

package/src/auth7/switch-branch-bff.ts

@@ -0,0 +1,119 @@
+// switch-branch-bff.ts — Shared BFF handler for POST /api/auth/switch-branch
+//
+// Owns cookie persistence for the new session that auth7 issues on branch
+// switch. Before W17 (auth7 commit b74c3a1) the endpoint returned only an
+// access token; the old session+refresh stayed valid. Post-W17, auth7
+// revokes the previous session and re-issues access_token + refresh_token +
+// session_id together. The BFF must persist the new pair atomically,
+// otherwise silent refresh at the 15-min mark uses a revoked refresh_token
+// and forces re-login.
+
+import type { NextRequest } from 'next/server';
+import { NextResponse } from 'next/server';
+
+export interface SwitchBranchBffOptions {
+  auth7ApiUrl: string;
+  branchCookieDomain?: (host: string) => string | undefined;
+}
+
+function defaultBranchCookieDomain(host: string): string | undefined {
+  const h = host.split(':')[0];
+  const parts = h.split('.');
+  if (parts.length < 2 || h === 'localhost') return undefined;
+  return '.' + parts.slice(-2).join('.');
+}
+
+export async function handleSwitchBranchRequest(
+  request: NextRequest,
+  options: SwitchBranchBffOptions
+): Promise<NextResponse> {
+  const accessToken = request.cookies.get('access_token')?.value;
+  if (!accessToken) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+  }
+
+  let body: { branch_id?: string };
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: 'Invalid request body' }, { status: 400 });
+  }
+
+  let res: Response;
+  try {
+    res = await fetch(`${options.auth7ApiUrl}/auth/switch-branch`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Authorization: `Bearer ${accessToken}`,
+      },
+      body: JSON.stringify(body),
+    });
+  } catch {
+    return NextResponse.json({ error: 'Failed to switch branch' }, { status: 502 });
+  }
+
+  const data = await res.json().catch(() => ({}));
+  const nextRes = NextResponse.json(data, { status: res.status });
+
+  if (!data || typeof data !== 'object' || !data.access_token) {
+    return nextRes;
+  }
+
+  const secure = process.env.NODE_ENV === 'production';
+  const expiresIn: number = data.expires_in ?? 3600;
+  const newExpiresAt = Date.now() + expiresIn * 1000;
+
+  nextRes.cookies.set('access_token', data.access_token, {
+    httpOnly: true,
+    secure,
+    sameSite: 'lax',
+    maxAge: expiresIn,
+    path: '/',
+  });
+  nextRes.cookies.set('token_expires_at', newExpiresAt.toString(), {
+    httpOnly: true,
+    secure,
+    sameSite: 'lax',
+    maxAge: expiresIn,
+    path: '/',
+  });
+
+  if (data.refresh_token) {
+    nextRes.cookies.set('refresh_token', data.refresh_token, {
+      httpOnly: true,
+      secure,
+      sameSite: 'lax',
+      maxAge: 8 * 3600,
+      path: '/',
+    });
+  }
+
+  if (data.session_id) {
+    nextRes.cookies.set('session_id', data.session_id, {
+      httpOnly: true,
+      secure,
+      sameSite: 'lax',
+      maxAge: 8 * 3600,
+      path: '/',
+    });
+  }
+
+  const branchId = (body.branch_id as string | undefined) ?? data.branch_id;
+  if (branchId) {
+    const domainFn = options.branchCookieDomain ?? defaultBranchCookieDomain;
+    const rootDomain = domainFn(request.headers.get('host') || '');
+    if (rootDomain) {
+      nextRes.cookies.set('bos7_branch', branchId, {
+        httpOnly: false,
+        secure,
+        sameSite: 'lax',
+        maxAge: 8 * 3600,
+        path: '/',
+        domain: rootDomain,
+      });
+    }
+  }
+
+  return nextRes;
+}

package/src/crud-components.tsx

@@ -15,6 +15,7 @@ import {
   ToastNotification,
 } from "@carbon/react";
 import { ServerDataTable } from "@isi-ui7/data-table";
+import type { I_DataTblColumn } from "@isi-ui7/data-table";
 import type { CrudCustomActionSchema, CrudDeleteSchema, CrudListSchema } from "./crud-types";
 import type { CrudForm, FormMode } from "./form-types";
 import type { Ui7FormDensity } from "./style-contract";
@@ -25,6 +26,24 @@ import { useCrudForm } from "./workflow/use-crud-form";
 import { useWorkflowTracker } from "./workflow/use-workflow-tracker";
 import { useBosSharedI18n } from "./i18n";
 
+// Re-export the value_schema → form adapter so category pages (bos7-enterprise)
+// can compose: [scopeSection(t), ...buildValueSections(schema, t).sections].
+export {
+  buildValueSections,
+  buildXRulesValidator,
+} from "./form-value-schema";
+export type {
+  JSONSchema,
+  XUi,
+  XUiRoot,
+  XUiNumeric,
+  XUiOption,
+  XUiWidget,
+  XRule,
+  XRuleOp,
+  ValueValidatorFn,
+} from "./form-value-schema";
+
 // ── List page (bare) ──────────────────────────────────────────────────────────
 
 export function SharedCrudListPage({
@@ -46,10 +65,10 @@ export function SharedCrudListPage({
         <ServerDataTable
           key={tableKey}
           apiPath={schema.apiPath}
-          columns={schema.columns as any}
+          columns={schema.columns as Record<string, I_DataTblColumn>}
           showSearch={schema.showSearch ?? true}
           showSort={schema.showSort ?? true}
-          popupMenu={{ src: "local", items: schema.popupMenuItems as any, onClick: onPopupClick }}
+          popupMenu={{ src: "local", items: schema.popupMenuItems, onClick: onPopupClick }}
           toolbarActions={
             <Button renderIcon={Add} size="sm" onClick={onAdd}>
               {schema.addButtonLabel || labels.next}
@@ -307,6 +326,9 @@ export function CrudSchemaPage<TData extends Record<string, unknown>>({
 }) {
   const labels = useBosSharedI18n();
   const density = densityProp ?? schema.density ?? "compact";
+  // Width default lives in the renderer — passing undefined here keeps
+  // the contract function's "two-thirds" fallback as the single source.
+  const width = schema.width;
   const {
     form,
     setForm,
@@ -379,6 +401,7 @@ export function CrudSchemaPage<TData extends Record<string, unknown>>({
             disabled={saving}
             onChange={setForm}
             density={density}
+            width={width}
           />
         </PageBody>
       );
@@ -437,6 +460,7 @@ export function CrudSchemaPage<TData extends Record<string, unknown>>({
                   disabled={saving}
                   onChange={setForm}
                   density={density}
+                  width={width}
                 />
               </div>
             ))}
@@ -463,6 +487,7 @@ export function CrudSchemaPage<TData extends Record<string, unknown>>({
             disabled={saving}
             onChange={setForm}
             density={density}
+            width={width}
           />
         ) : null}
       </PageBody>

package/src/crud-hooks.ts

@@ -9,9 +9,12 @@ export async function runCrudHook<TData extends Record<string, unknown>, TResult
   return hook(data, context);
 }
 
-export function applyCrudFieldOverrides<TField extends { key: string; readonly?: boolean; required?: boolean; helperText?: unknown }>(
+export function applyCrudFieldOverrides<
+  TField extends { key: string; readonly?: boolean; required?: boolean; helperText?: unknown },
+  TData extends Record<string, unknown> = Record<string, unknown>,
+>(
   fields: TField[],
-  hooks?: CrudActionOverrideHooks<Record<string, unknown>> | CrudActionOverrideHooks<any>,
+  hooks?: CrudActionOverrideHooks<TData>,
 ): TField[] {
   if (!hooks?.fieldOverrides) return fields;