@nanobpm/urban 0.20.0 → 0.22.0

package/src/runtime/core/modules/gateway.test.ts

@@ -141,7 +141,7 @@ test("Table.insert throws when the driver reports no lastInsertId", async () =>
     table: (name, pk) => new Table(fake, name, pk),
   };
   const t = fake.table("orders");
-  await assert.rejects(t.insert({ status: "x" } as Record<string, unknown>), /no lastInsertId/);
+  await assert.rejects(t.insert({ status: "x" }), /no lastInsertId/);
 });
 
 test("Table.all ignores a non-finite limit", async () => {
@@ -158,8 +158,8 @@ test("query/exec run raw parameterised SQL", async () => {
   await withGateway(async (src) => {
     const r = await src.exec("INSERT INTO orders (status, total) VALUES (?, ?)", ["raw", 42]);
     assert.equal(r.changed, 1);
-    const rows = await src.query("SELECT total FROM orders WHERE status = ?", ["raw"]);
-    assert.equal(Number((rows[0] as { total: number }).total), 42);
+    const rows = await src.query<{ total: number }>("SELECT total FROM orders WHERE status = ?", ["raw"]);
+    assert.equal(Number(rows[0]?.total), 42);
   });
 });
 
@@ -216,6 +216,7 @@ test("insert throws when every provided value is undefined", async () => {
 test("insert throws a distinct message for a genuinely empty row", async () => {
   await withGateway(async (src) => {
     const orders = src.table<Order>("orders");
-    await assert.rejects(orders.insert({} as Partial<Order>), /empty row/);
+    const empty: Partial<Order> = {};
+    await assert.rejects(orders.insert(empty), /empty row/);
   });
 });

package/src/runtime/core/modules/gateway.ts

@@ -55,7 +55,7 @@ export interface TableMeta {
  * interchangeable. */
 export interface DataSource {
   /** Run a SELECT (or any row-returning statement) and collect the rows. */
-  query(sql: string, params?: unknown[]): Promise<Row[]>;
+  query<T extends object = Row>(sql: string, params?: unknown[]): Promise<T[]>;
   /** Run a non-row statement (INSERT/UPDATE/DELETE/DDL). */
   exec(sql: string, params?: unknown[]): Promise<ExecResult>;
   /** Run `fn` inside a transaction, committing on success and rolling back on throw. The
@@ -77,11 +77,10 @@ export function quoteIdent(name: string): string {
  * yields an empty clause (matches all rows). Takes `object` (not `Row`) so a `Partial<T>` for a
  * generated `interface` row type (which lacks a string index signature) is accepted. */
 function whereClause(where: object): { clause: string; params: unknown[] } {
-  const w = where as Row;
-  const keys = Object.keys(w);
-  if (keys.length === 0) return { clause: "", params: [] };
-  const clause = " WHERE " + keys.map((k) => `${quoteIdent(k)} = ?`).join(" AND ");
-  return { clause, params: keys.map((k) => w[k]) };
+  const entries = Object.entries(where);
+  if (entries.length === 0) return { clause: "", params: [] };
+  const clause = " WHERE " + entries.map(([k]) => `${quoteIdent(k)} = ?`).join(" AND ");
+  return { clause, params: entries.map(([, v]) => v) };
 }
 
 /** A typed gateway over a single table — the record-oriented data object a handler binds to
@@ -105,20 +104,20 @@ export class Table<T extends object = Row> {
    * `DEFAULT`/`NULL` governs — `undefined` means "not provided, let the schema decide", never
    * a bound value. An explicit `null` is preserved (it stores `NULL`). */
   async insert(row: Partial<T>): Promise<number | bigint> {
-    const provided = Object.keys(row);
-    const keys = provided.filter((k) => (row as Row)[k] !== undefined);
-    if (keys.length === 0) {
+    const provided = Object.entries(row);
+    const entries = provided.filter(([, v]) => v !== undefined);
+    if (entries.length === 0) {
       throw new Error(
         provided.length === 0
           ? `Table(${this.name}).insert: no columns to insert (empty row)`
           : `Table(${this.name}).insert: no columns to insert (all values were undefined)`,
       );
     }
-    const cols = keys.map(quoteIdent).join(", ");
-    const ph = keys.map(() => "?").join(", ");
+    const cols = entries.map(([k]) => quoteIdent(k)).join(", ");
+    const ph = entries.map(() => "?").join(", ");
     const r = await this.#src.exec(
       `INSERT INTO ${quoteIdent(this.name)} (${cols}) VALUES (${ph})`,
-      keys.map((k) => (row as Row)[k]),
+      entries.map(([, v]) => v),
     );
     if (r.lastInsertId == null) {
       // The driver reported no rowid — treat as a failed/ambiguous insert rather than
@@ -130,11 +129,11 @@ export class Table<T extends object = Row> {
 
   /** Fetch the row with the given primary key, or `undefined`. */
   async get(id: unknown): Promise<T | undefined> {
-    const rows = await this.#src.query(
+    const rows = await this.#src.query<T>(
       `SELECT * FROM ${quoteIdent(this.name)} WHERE ${quoteIdent(this.pk)} = ? LIMIT 1`,
       [id],
     );
-    return rows[0] as T | undefined;
+    return rows[0];
   }
 
   /** Every row (optionally capped at `limit`). */
@@ -143,38 +142,38 @@ export class Table<T extends object = Row> {
       typeof limit === "number" && Number.isFinite(limit)
         ? ` LIMIT ${Math.max(0, Math.floor(limit))}`
         : "";
-    return (await this.#src.query(`SELECT * FROM ${quoteIdent(this.name)}${lim}`)) as T[];
+    return this.#src.query<T>(`SELECT * FROM ${quoteIdent(this.name)}${lim}`);
   }
 
   /** Rows matching an equality filter (keys ANDed). An empty filter matches all rows. */
   async find(where: Partial<T> = {}): Promise<T[]> {
-    const { clause, params } = whereClause(where as Row);
-    return (await this.#src.query(
+    const { clause, params } = whereClause(where);
+    return this.#src.query<T>(
       `SELECT * FROM ${quoteIdent(this.name)}${clause}`,
       params,
-    )) as T[];
+    );
   }
 
   /** The first row matching an equality filter, or `undefined`. */
   async findOne(where: Partial<T> = {}): Promise<T | undefined> {
-    const { clause, params } = whereClause(where as Row);
-    const rows = await this.#src.query(
+    const { clause, params } = whereClause(where);
+    const rows = await this.#src.query<T>(
       `SELECT * FROM ${quoteIdent(this.name)}${clause} LIMIT 1`,
       params,
     );
-    return rows[0] as T | undefined;
+    return rows[0];
   }
 
   /** Patch the row with the given primary key; returns rows changed. Keys whose value is
    * `undefined` are skipped (that column is left unchanged); an explicit `null` clears the
    * column to `NULL`. A patch with no defined keys is a no-op. */
   async update(id: unknown, patch: Partial<T>): Promise<number> {
-    const keys = Object.keys(patch).filter((k) => (patch as Row)[k] !== undefined);
-    if (keys.length === 0) return 0;
-    const set = keys.map((k) => `${quoteIdent(k)} = ?`).join(", ");
+    const entries = Object.entries(patch).filter(([, v]) => v !== undefined);
+    if (entries.length === 0) return 0;
+    const set = entries.map(([k]) => `${quoteIdent(k)} = ?`).join(", ");
     const r = await this.#src.exec(
       `UPDATE ${quoteIdent(this.name)} SET ${set} WHERE ${quoteIdent(this.pk)} = ?`,
-      [...keys.map((k) => (patch as Row)[k]), id],
+      [...entries.map(([, v]) => v), id],
     );
     return r.changed;
   }
@@ -190,12 +189,12 @@ export class Table<T extends object = Row> {
 
   /** Count rows matching an equality filter (all rows when omitted). */
   async count(where: Partial<T> = {}): Promise<number> {
-    const { clause, params } = whereClause(where as Row);
-    const rows = await this.#src.query(
+    const { clause, params } = whereClause(where);
+    const rows = await this.#src.query<{ n?: unknown }>(
       `SELECT COUNT(*) AS n FROM ${quoteIdent(this.name)}${clause}`,
       params,
     );
-    return Number((rows[0] as Row)?.n ?? 0);
+    return Number(rows[0]?.n ?? 0);
   }
 }
 
@@ -207,8 +206,8 @@ class SqliteGateway implements DataSource {
     this.#db = db;
   }
 
-  async query(sql: string, params: unknown[] = []): Promise<Row[]> {
-    return this.#db.all<Row>(sql, params);
+  async query<T extends object = Row>(sql: string, params: unknown[] = []): Promise<T[]> {
+    return this.#db.all<T>(sql, params);
   }
 
   async exec(sql: string, params: unknown[] = []): Promise<ExecResult> {

package/src/runtime/core/modules/llm.test.ts

@@ -21,15 +21,13 @@ function fakeFetch(
   content: string,
   opts: { ok?: boolean; status?: number; capture?: (url: string, init: RequestInit) => void } = {},
 ): typeof fetch {
-  return (async (url: string, init: RequestInit) => {
-    opts.capture?.(String(url), init);
-    return {
-      ok: opts.ok ?? true,
-      status: opts.status ?? 200,
-      json: async () => ({ choices: [{ message: { content } }] }),
-      text: async () => content,
-    };
-  }) as unknown as typeof fetch;
+  return async (url: string | URL | Request, init?: RequestInit) => {
+    opts.capture?.(String(url), init ?? {});
+    return new Response(
+      JSON.stringify({ choices: [{ message: { content } }] }),
+      { status: opts.status ?? 200 },
+    );
+  };
 }
 
 // --- resolveProvider -------------------------------------------------------
@@ -113,8 +111,8 @@ test("callLlm posts to /chat/completions and returns the message content", async
   assert.equal(out, "hello world");
   assert.equal(seen?.url, "http://h/v1/chat/completions");
   assert.equal(seen?.init.method, "POST");
-  const headers = seen?.init.headers as Record<string, string>;
-  assert.equal(headers.authorization, "Bearer k");
+  const headers = new Headers(seen?.init.headers);
+  assert.equal(headers.get("authorization"), "Bearer k");
   const body = JSON.parse(String(seen?.init.body));
   assert.equal(body.model, "m");
   assert.equal(body.response_format, undefined);
@@ -139,7 +137,7 @@ test("callLlm throws on a non-ok provider response", async () => {
 });
 
 test("callLlm throws when the provider returns no content", async () => {
-  const f = (async () => ({ ok: true, status: 200, json: async () => ({ choices: [] }) })) as unknown as typeof fetch;
+  const f: typeof fetch = async () => new Response(JSON.stringify({ choices: [] }));
   await assert.rejects(
     callLlm({ baseUrl: "http://h/v1", model: "m" }, [{ role: "user", content: "hi" }], { fetch: f }),
     /no message content/,

package/src/runtime/core/modules/llm.ts

@@ -22,6 +22,7 @@
 
 import type { LlmBinding } from "../manifest.ts";
 import { expandEnvString } from "../manifest.ts";
+import { isRecord } from "../guards.ts";
 
 /** Job variables/headers default to untyped JSON. */
 export type LlmVars = Record<string, unknown>;
@@ -102,8 +103,8 @@ export function buildMessages(vars: LlmVars): ChatMessage[] {
     if (vars.messages.length === 0) {
       throw new Error("llm worker: 'messages' must not be an empty array");
     }
-    msgs = (vars.messages as unknown[]).map((m, i) => {
-      const o = m as { role?: unknown; content?: unknown };
+    msgs = vars.messages.map((m, i) => {
+      const o = isRecord(m) ? m : {};
       if (
         typeof o.content !== "string" ||
         (o.role !== "user" && o.role !== "assistant" && o.role !== "system")
@@ -150,8 +151,11 @@ export async function callLlm(
     const detail = await res.text().catch(() => "");
     throw new Error(`llm provider returned ${res.status}: ${detail.slice(0, 500)}`);
   }
-  const data = (await res.json()) as { choices?: Array<{ message?: { content?: string } }> };
-  const content = data.choices?.[0]?.message?.content;
+  const data: unknown = await res.json();
+  const choices = isRecord(data) && Array.isArray(data.choices) ? data.choices : [];
+  const firstChoice = choices[0];
+  const message = isRecord(firstChoice) && isRecord(firstChoice.message) ? firstChoice.message : undefined;
+  const content = message?.content;
   if (typeof content !== "string") {
     throw new Error("llm provider returned no message content");
   }
@@ -187,10 +191,10 @@ export async function runLlmJob(
   }
   // response_format asks for a JSON object, but a provider can still return a scalar, array,
   // or null — none of which is a valid variable map (nor valid decision-rails input).
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+  if (!isRecord(parsed)) {
     throw new Error(`llm worker: expected a JSON object output but got: ${text.slice(0, 300)}`);
   }
-  const obj = parsed as Record<string, unknown>;
+  const obj = parsed;
 
   const decisionId = binding.output?.decision;
   if (decisionId) {
@@ -201,9 +205,7 @@ export async function runLlmJob(
       );
     }
     const out = await rt.evaluateDecision(decisionId, obj);
-    return out !== null && typeof out === "object" && !Array.isArray(out)
-      ? (out as Record<string, unknown>)
-      : { result: out };
+    return isRecord(out) ? out : { result: out };
   }
   return obj;
 }

package/src/runtime/core/modules/pages.test.ts

@@ -27,7 +27,8 @@ interface FakeEngineCalls {
 
 function fakeEngine(): { engine: EngineClient; calls: FakeEngineCalls } {
   const calls: FakeEngineCalls = { created: [], canceled: [], messages: [] };
-  const engine = {
+  const engine: EngineClient = {
+    deployResources: async () => ({ deployed: 0 }),
     async createInstance(input: { processDefinitionId: string; variables?: Record<string, unknown> }) {
       calls.created.push(input);
       return { processInstanceKey: "pi-42" };
@@ -38,7 +39,11 @@ function fakeEngine(): { engine: EngineClient; calls: FakeEngineCalls } {
     async publishMessage(input: { name: string; correlationKey?: string; variables?: Record<string, unknown> }) {
       calls.messages.push(input);
     },
-  } as unknown as EngineClient;
+    async searchUserTasks() { return []; },
+    async completeUserTask() {},
+    async registerWorker(jobType) { return { jobType, unsubscribe: async () => {} }; },
+    async close() {},
+  };
   return { engine, calls };
 }
 
@@ -89,6 +94,22 @@ test("GET /app/runtime.js serves the renderer module", async () => {
   assert.match(res.body ?? "", /pc:refresh/);
 });
 
+test("renderer preserves grid row-detail expansion across refreshes", async () => {
+  // Regression: the 5s poll rebuilds the whole tbody, which used to collapse an open
+  // detail row (e.g. the escalation-answer form). The client now tracks open rowKeys
+  // and reuses their built detail node so expansion (and a half-typed answer) survives.
+  const res = await dispatch("GET", "/app/runtime.js");
+  const js = res.body ?? "";
+  assert.match(js, /const expanded = new Set\(\)/);
+  assert.match(js, /const detailNodes = new Map\(\)/);
+  assert.match(js, /expanded\.add\(key\)/);
+  assert.match(js, /expanded\.delete\(key\)/);
+  // A missing/null rowKey must be treated as keyless (null) rather than coerced to
+  // the string "undefined"/"null", which would collide unrelated rows in the caches.
+  assert.match(js, /rowKeyOf/);
+  assert.match(js, /v == null \? null : String\(v\)/);
+});
+
 test("renderer wires a column's linkField to a new-tab anchor", async () => {
   const res = await dispatch("GET", "/app/runtime.js");
   const js = res.body ?? "";
@@ -102,6 +123,21 @@ test("renderer wires a column's linkField to a new-tab anchor", async () => {
   assert.match(js, /rel: "noopener noreferrer"/);
 });
 
+test("the renderer honours numeric actionForm fields", async () => {
+  const res = await dispatch("GET", "/app/runtime.js");
+  const js = res.body ?? "";
+  // Fields declared `type: "number"` render a numeric <input> and their submitted
+  // value is coerced to a real number (blank omitted so the action's default applies).
+  assert.match(js, /f\.type === "number"/);
+  assert.match(js, /Number\.isFinite\(num\)/);
+  // Numeric branch sets inputmode="numeric" so mobile keyboards show a number pad.
+  assert.match(js, /attrs\.inputmode = "numeric"/);
+  // Blank and non-finite numeric values are omitted (continue) rather than sent,
+  // so the action-side default applies and no raw string leaks through as a number.
+  assert.match(js, /if \(t === ""\) continue;/);
+  assert.match(js, /if \(!Number\.isFinite\(num\)\) continue;/);
+});
+
 test("GET /app/pages/<id> returns the page json, 404 for unknown", async () => {
   const ok = await dispatch("GET", "/app/pages/home");
   assert.equal(ok.status, 200);

package/src/runtime/core/modules/pages.ts

@@ -16,6 +16,7 @@
 //   POST /app/actions/message                       → engine.publishMessage
 
 import type { AppApi, RuntimeContext } from "../context.ts";
+import { errorMessage, isRecord } from "../guards.ts";
 import type { EngineClient } from "../host.ts";
 import { html, json, type Route } from "../router.ts";
 import { quoteIdent } from "./gateway.ts";
@@ -197,7 +198,7 @@ export function createPagesRoutes(opts: PagesOptions, deps: PagesDeps): Route[]
         );
         return json({ rows });
       } catch (e) {
-        return json({ error: String((e as Error)?.message ?? e) }, 500);
+        return json({ error: errorMessage(e) }, 500);
       }
     },
   });
@@ -215,12 +216,12 @@ export function createPagesRoutes(opts: PagesOptions, deps: PagesDeps): Route[]
       let variables: Record<string, unknown> = {};
       try {
         const body = JSON.parse((await req.text()) || "{}");
-        if (body && typeof body === "object") {
-          const v = (body as { variables?: unknown }).variables;
+        if (isRecord(body)) {
+          const v = body.variables;
           // Only a plain object is a valid variable map — reject arrays/scalars/null so a
           // malformed body can't reach the engine as bad `variables`.
-          if (v && typeof v === "object" && !Array.isArray(v)) {
-            variables = v as Record<string, unknown>;
+          if (isRecord(v)) {
+            variables = v;
           }
         }
       } catch {
@@ -230,7 +231,7 @@ export function createPagesRoutes(opts: PagesOptions, deps: PagesDeps): Route[]
         const res = await engine.createInstance({ processDefinitionId: process, variables });
         return json({ processInstanceKey: res.processInstanceKey ?? null });
       } catch (e) {
-        return json({ error: String((e as Error)?.message ?? e) }, 502);
+        return json({ error: errorMessage(e) }, 502);
       }
     },
   });
@@ -244,7 +245,7 @@ export function createPagesRoutes(opts: PagesOptions, deps: PagesDeps): Route[]
       let key: string | number | undefined;
       try {
         const body = JSON.parse((await req.text()) || "{}");
-        const k = (body as { processInstanceKey?: unknown })?.processInstanceKey;
+        const k = isRecord(body) ? body.processInstanceKey : undefined;
         if (typeof k === "string" || typeof k === "number") key = k;
       } catch {
         return json({ error: "body must be JSON" }, 400);
@@ -254,7 +255,7 @@ export function createPagesRoutes(opts: PagesOptions, deps: PagesDeps): Route[]
         await engine.cancelInstance({ processInstanceKey: String(key) });
         return json({ ok: true });
       } catch (e) {
-        return json({ error: String((e as Error)?.message ?? e) }, 502);
+        return json({ error: errorMessage(e) }, 502);
       }
     },
   });
@@ -269,18 +270,15 @@ export function createPagesRoutes(opts: PagesOptions, deps: PagesDeps): Route[]
       let correlationKey = "";
       let variables: Record<string, unknown> = {};
       try {
-        const body = JSON.parse((await req.text()) || "{}") as {
-          name?: unknown;
-          correlationKey?: unknown;
-          variables?: unknown;
-        };
+        const parsed: unknown = JSON.parse((await req.text()) || "{}");
+        const body = isRecord(parsed) ? parsed : {};
         if (typeof body?.name === "string") name = body.name;
         if (typeof body?.correlationKey === "string" || typeof body?.correlationKey === "number") {
           correlationKey = String(body.correlationKey);
         }
         const v = body?.variables;
-        if (v && typeof v === "object" && !Array.isArray(v)) {
-          variables = v as Record<string, unknown>;
+        if (isRecord(v)) {
+          variables = v;
         }
       } catch {
         return json({ error: "body must be JSON" }, 400);
@@ -291,7 +289,7 @@ export function createPagesRoutes(opts: PagesOptions, deps: PagesDeps): Route[]
         await engine.publishMessage({ name, correlationKey, variables });
         return json({ ok: true });
       } catch (e) {
-        return json({ error: String((e as Error)?.message ?? e) }, 502);
+        return json({ error: errorMessage(e) }, 502);
       }
     },
   });
@@ -452,24 +450,49 @@ function renderActionForm(node) {
   const p = node.props;
   const card = el("section", { class: "pc-card" });
   if (p.title) card.append(el("h2", {}, p.title));
-  const inputs = {};
+  // Map/null-proto stores so a schema field keyed __proto__/constructor can't
+  // pollute Object.prototype or shadow inherited props (prototype-pollution class).
+  const inputs = new Map();
+  const fieldTypes = new Map();
   for (const f of p.fields || []) {
-    const input = el("input", { type: "text", placeholder: f.label || f.key });
-    inputs[f.key] = input;
+    const kind = f.type === "number" ? "number" : "text";
+    fieldTypes.set(f.key, kind);
+    const attrs = { type: kind, placeholder: f.label || f.key };
+    if (kind === "number") {
+      attrs.inputmode = "numeric";
+      if (f.min != null) attrs.min = String(f.min);
+      if (f.max != null) attrs.max = String(f.max);
+      attrs.step = f.step != null ? String(f.step) : "1";
+    }
+    const input = el("input", attrs);
+    inputs.set(f.key, input);
     card.append(el("div", { class: "pc-field" }, el("label", {}, f.label || f.key), input));
   }
   const msg = el("p", { class: "pc-msg" });
   const btn = el("button", { class: "pc-btn" }, p.submitLabel || "Submit");
   btn.addEventListener("click", async () => {
-    const variables = {};
-    for (const [k, input] of Object.entries(inputs)) variables[k] = input.value;
+    const variables = Object.create(null);
+    for (const [k, input] of inputs) {
+      if (fieldTypes.get(k) === "number") {
+        const t = String(input.value).trim();
+        // Blank → omit so the action-side default applies; a non-finite parse
+        // (NaN/Infinity) is also omitted rather than smuggling a raw string
+        // process variable through, which would defeat the numeric coercion.
+        if (t === "") continue;
+        const num = Number(t);
+        if (!Number.isFinite(num)) continue;
+        variables[k] = num;
+      } else {
+        variables[k] = input.value;
+      }
+    }
     btn.disabled = true; msg.className = "pc-msg"; msg.textContent = "Submitting…";
     try {
       const res = await getJSON("/app/actions/start/" + encodeURIComponent(p.action.process),
         { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ variables }) });
       msg.className = "pc-msg ok";
       msg.textContent = "Started (instance " + (res.processInstanceKey ?? "?") + ")";
-      for (const input of Object.values(inputs)) input.value = "";
+      for (const input of inputs.values()) input.value = "";
       document.dispatchEvent(new CustomEvent("pc:refresh"));
     } catch (e) {
       msg.className = "pc-msg err"; msg.textContent = String(e.message || e);
@@ -514,6 +537,23 @@ function renderDataGrid(node) {
   card.append(table);
   const span = String((cols.length || 1) + (hasExtra ? 1 : 0));
 
+  // Expansion state has to outlive the poll: refresh() rebuilds the whole tbody
+  // every refreshMs, so without this an open detail row (where you answer an
+  // escalation) would collapse on the next tick. We remember which rowKeys are
+  // open, and reuse the already-built detail <tr> for them across refreshes so a
+  // half-typed answer survives too. Keyed by p.rowKey; grids without one keep the
+  // old (collapse-on-refresh) behavior.
+  const expanded = new Set();
+  const detailNodes = new Map();
+  // A row only participates in expansion/detail-node caching if it has a real
+  // (non-null) rowKey. Coercing a missing key through String() would yield the
+  // literal "undefined"/"null" and collide unrelated rows, so treat it as keyless.
+  const rowKeyOf = (row) => {
+    if (!p.rowKey) return null;
+    const v = row[p.rowKey];
+    return v == null ? null : String(v);
+  };
+
   function dataUrl(source, tbl, filters, order) {
     let u = "/app/data/" + encodeURIComponent(source) + "/" + encodeURIComponent(tbl);
     const qs = [];
@@ -663,6 +703,7 @@ function renderDataGrid(node) {
 
   function renderRow(row) {
     const cells = cols.map((c) => gridCell(c, row));
+    const key = rowKeyOf(row);
     let toggle = null;
     if (hasExtra) {
       const actionCell = el("td", { class: "pc-row-actions" });
@@ -679,16 +720,29 @@ function renderDataGrid(node) {
     const tr = el("tr", {}, ...cells);
     tbody.append(tr);
     if (detail && toggle) {
-      const dtr = el("tr", { hidden: "" }, el("td", { colspan: span }));
-      let built = false;
+      const isOpen = key != null && expanded.has(key);
+      // Reuse an already-built detail row for an open PR across refreshes so its
+      // expanded state — and any half-typed escalation answer in the form — survives
+      // the poll. A closed (or keyless) row always gets a fresh, lazily-built panel.
+      let entry = key != null ? detailNodes.get(key) : null;
+      if (!(isOpen && entry && entry.built)) {
+        const dtr = el("tr", { hidden: isOpen ? null : "" }, el("td", { colspan: span }));
+        entry = { dtr, built: false };
+        if (key != null) detailNodes.set(key, entry);
+        if (isOpen) { entry.built = true; dtr.firstChild.append(detailPanel(row)); }
+      }
+      const dtr = entry.dtr;
+      toggle.textContent = dtr.hidden ? "▸" : "▾";
       toggle.addEventListener("click", (ev) => {
         ev.stopPropagation();
         const open = dtr.hidden;
         dtr.hidden = !open;
         toggle.textContent = open ? "▾" : "▸";
-        if (open && !built) {
-          built = true;
-          dtr.firstChild.append(detailPanel(row));
+        if (open) {
+          if (key != null) expanded.add(key);
+          if (!entry.built) { entry.built = true; dtr.firstChild.append(detailPanel(row)); }
+        } else if (key != null) {
+          expanded.delete(key);
         }
       });
       tbody.append(dtr);
@@ -698,6 +752,14 @@ function renderDataGrid(node) {
   async function refresh() {
     try {
       const { rows } = await getJSON(dataUrl(p.data.source, p.data.table, activeFilter, p.data.orderBy));
+      // Forget expansion / cached detail nodes for rows no longer present so the maps
+      // don't grow without bound and a stale answer can't resurface on a key reuse.
+      if (p.rowKey) {
+        const live = new Set();
+        for (const r of rows) { const k = rowKeyOf(r); if (k != null) live.add(k); }
+        for (const k of [...detailNodes.keys()]) if (!live.has(k)) detailNodes.delete(k);
+        for (const k of [...expanded]) if (!live.has(k)) expanded.delete(k);
+      }
       tbody.replaceChildren();
       for (const row of rows) renderRow(row);
       if (!rows.length) tbody.append(el("tr", {}, el("td", { colspan: span }, "No rows")));

package/src/runtime/core/modules/security.ts

@@ -27,19 +27,11 @@ function matchRule(rules: Record<string, string[]> | undefined, key: string): st
 }
 
 export function mountSecurity(ctx: RuntimeContext): SecurityPolicy {
-  const sec = (ctx.manifest.security ?? {}) as {
-    mode?: string;
-    roles?: string[];
-    rules?: {
-      actions?: Record<string, string[]>;
-      surfaces?: Record<string, string[]>;
-      data?: Record<string, unknown>;
-    };
-  };
-  const mode = sec.mode ?? "local";
-  const roles = sec.roles ?? [];
-  const surfaces = sec.rules?.surfaces;
-  const actions = sec.rules?.actions;
+  const sec = ctx.manifest.security;
+  const mode = typeof sec?.mode === "string" ? sec.mode : "local";
+  const roles = Array.isArray(sec?.roles) ? sec.roles.filter((role) => typeof role === "string") : [];
+  const surfaces = sec?.rules?.surfaces;
+  const actions = sec?.rules?.actions;
 
   ctx.host.log("info", "security policy loaded", { mode, roles });