@object-ui/app-shell 4.0.12 → 4.3.0

package/dist/utils/resolveActionParams.js

@@ -0,0 +1,77 @@
+/** Normalise an options entry (allowing bare strings) into label/value pairs. */
+function normaliseOptions(options, objectName, fieldName, optionLabel) {
+    if (!Array.isArray(options) || options.length === 0)
+        return undefined;
+    return options.map((o) => {
+        const raw = typeof o === 'string' ? { label: o, value: o } : o;
+        const label = optionLabel
+            ? optionLabel(objectName, fieldName, raw.value, raw.label)
+            : raw.label;
+        return { label, value: raw.value };
+    });
+}
+/**
+ * Resolve a single raw param against object metadata. Inline params pass
+ * through (with safe defaults); field-backed params inherit from the
+ * referenced field and accept inline overrides on top.
+ */
+export function resolveActionParam(param, ctx) {
+    /** Row-context default: when `defaultFromRow` and a row is present, the
+     *  param's defaultValue is the row's value at the field key (or `name`). */
+    const rowKey = param.field ?? param.name;
+    const rowDefault = param.defaultFromRow && ctx.row && rowKey != null && Object.prototype.hasOwnProperty.call(ctx.row, rowKey)
+        ? ctx.row[rowKey]
+        : undefined;
+    // Inline param — no field reference, just normalise.
+    if (!param.field) {
+        return {
+            name: param.name ?? '',
+            label: param.label ?? param.name ?? '',
+            type: param.type ?? 'text',
+            required: param.required ?? false,
+            options: param.options,
+            placeholder: param.placeholder,
+            helpText: param.helpText,
+            defaultValue: rowDefault ?? param.defaultValue,
+        };
+    }
+    const ownerName = param.objectOverride ?? ctx.objectName;
+    const owner = ctx.objects.find((o) => o?.name === ownerName);
+    const field = owner?.fields?.[param.field];
+    if (!field) {
+        // Reference target missing — fall back to a plain text input so the
+        // action remains usable in environments where the metadata cache is
+        // partial (e.g. tests).
+        return {
+            name: param.name ?? param.field,
+            label: param.label ?? ctx.fieldLabel(ownerName, param.field, param.field),
+            type: param.type ?? 'text',
+            required: param.required ?? false,
+            options: param.options,
+            placeholder: param.placeholder,
+            helpText: param.helpText,
+            defaultValue: rowDefault ?? param.defaultValue,
+        };
+    }
+    const resolvedType = param.type ?? field.type ?? 'text';
+    const resolvedOptions = param.options
+        ?? normaliseOptions(field.options, ownerName, param.field, ctx.fieldOptionLabel);
+    const resolvedLabel = param.label
+        ?? ctx.fieldLabel(ownerName, param.field, field.label ?? param.field);
+    return {
+        name: param.name ?? param.field,
+        label: resolvedLabel,
+        type: resolvedType,
+        required: param.required ?? field.required ?? false,
+        options: resolvedOptions,
+        placeholder: param.placeholder ?? field.placeholder,
+        helpText: param.helpText ?? field.help ?? field.description,
+        defaultValue: rowDefault ?? param.defaultValue ?? field.defaultValue,
+    };
+}
+/** Resolve an array of raw action params. */
+export function resolveActionParams(params, ctx) {
+    if (!Array.isArray(params))
+        return [];
+    return params.map((p) => resolveActionParam(p, ctx));
+}

package/dist/views/ObjectView.js

@@ -26,6 +26,9 @@ import { MetadataPanel, useMetadataInspector } from './MetadataInspector';
 import { ViewConfigPanel } from './ViewConfigPanel';
 import { CreateViewDialog } from './CreateViewDialog';
 import { PageHeader } from '../layout/PageHeader';
+import { ManagedByBadge } from '../components/ManagedByBadge';
+import { resolveCrudAffordances } from '../utils/crudAffordances';
+import { resolveManagedByEmptyState } from '../utils/managedByEmptyState';
 import { useObjectActions } from '../hooks/useObjectActions';
 import { useObjectTranslation, useObjectLabel } from '@object-ui/i18n';
 import { usePermissions } from '@object-ui/permissions';
@@ -35,6 +38,7 @@ import { ActionProvider, useNavigationOverlay, SchemaRenderer } from '@object-ui
 import { toast } from 'sonner';
 import { ActionConfirmDialog } from './ActionConfirmDialog';
 import { ActionParamDialog } from './ActionParamDialog';
+import { resolveActionParams } from '../utils/resolveActionParams';
 /** Map view types to Lucide icons (Airtable-style) */
 const VIEW_TYPE_ICONS = {
     grid: TableIcon,
@@ -47,6 +51,40 @@ const VIEW_TYPE_ICONS = {
     chart: BarChart3,
 };
 const FALLBACK_USER = { id: 'current-user', name: 'Demo User' };
+/**
+ * Replace built-in tokens (e.g. `{current_user_id}`) inside a filter array
+ * with concrete values. Filters from platform-shipped `listViews` or saved
+ * `sys_view` rows may declare context-sensitive predicates like
+ * `{ field: 'submitter_id', operator: 'equals', value: '{current_user_id}' }`
+ * — those need to be substituted before the query reaches the API.
+ *
+ * Recognised tokens:
+ *   • `{current_user_id}` → the authenticated user's id
+ *
+ * Returns a deep-cloned copy with substitutions applied. Non-array input
+ * is returned unchanged.
+ */
+function substituteFilterTokens(filter, currentUserId) {
+    if (!Array.isArray(filter))
+        return filter;
+    const sub = (v) => {
+        if (typeof v === 'string') {
+            if (v === '{current_user_id}')
+                return currentUserId ?? v;
+            return v;
+        }
+        if (Array.isArray(v))
+            return v.map(sub);
+        if (v && typeof v === 'object') {
+            const out = {};
+            for (const k of Object.keys(v))
+                out[k] = sub(v[k]);
+            return out;
+        }
+        return v;
+    };
+    return filter.map(sub);
+}
 /**
  * Translate a NamedListView spec object (shape: `type`, `label`, `columns`,
  * `filter`, `sort`, `kanban`/`chart`/`gantt`/... sub-blocks, `bulkActions`,
@@ -310,7 +348,7 @@ export function ObjectView({ dataSource, objects, onEdit, externalRefreshKey })
     const [searchParams, setSearchParams] = useSearchParams();
     const { showDebug } = useMetadataInspector();
     const { t } = useObjectTranslation();
-    const { objectLabel, objectDescription: objectDesc, viewLabel, actionLabel, actionConfirm, actionSuccess } = useObjectLabel();
+    const { objectLabel, objectDescription: objectDesc, viewLabel, actionLabel, actionConfirm, actionSuccess, fieldLabel, fieldOptionLabel } = useObjectLabel();
     // Inline view config panel state (Airtable-style right sidebar)
     const [showViewConfigPanel, setShowViewConfigPanel] = useState(false);
     const [viewConfigPanelMode, setViewConfigPanelMode] = useState('edit');
@@ -447,7 +485,7 @@ export function ObjectView({ dataSource, objects, onEdit, externalRefreshKey })
     // Record count tracking for footer
     const [recordCount, setRecordCount] = useState(undefined);
     // Admin users automatically get design tools (no toggle needed)
-    const { user } = useAuth();
+    const { user, activeOrganization } = useAuth();
     const isAdmin = user?.role === 'admin';
     const { can } = usePermissions();
     // Get Object Definition
@@ -457,6 +495,13 @@ export function ObjectView({ dataSource, objects, onEdit, externalRefreshKey })
     }
     // Refresh trigger — bumped after view CRUD or external data mutations.
     const [refreshKey, setRefreshKey] = useState(0);
+    // Resolve which generic CRUD affordances belong in the toolbar for
+    // this object's lifecycle bucket (`managedBy`).  config tables show
+    // New/Edit/Delete but no CSV Import; system / append-only / better-auth
+    // hide the lot — those flows go through purpose-built actions on the
+    // source record (e.g. "Submit for Approval" on an Opportunity creates
+    // an `sys_approval_request`).  Permissions still gate the buttons.
+    const affordances = useMemo(() => resolveCrudAffordances(objectDef), [objectDef]);
     // Propagate externally-triggered refreshes (e.g. global ModalForm submit)
     // into our internal refreshKey so list/data effects re-run.
     useEffect(() => {
@@ -828,11 +873,24 @@ export function ObjectView({ dataSource, objects, onEdit, externalRefreshKey })
             setConfirmState({ open: true, message, options, resolve });
         });
     }, []);
-    const paramCollectionHandler = useCallback((params) => {
+    const paramCollectionHandler = useCallback((params, action) => {
         return new Promise((resolve) => {
-            setParamState({ open: true, params, resolve });
+            // List_item actions stash the row record under params._rowRecord
+            // (see ObjectGrid → onRowAction). Pull it out so resolveActionParams
+            // can pre-fill `defaultFromRow` params from the row's current values.
+            const row = action?.params && !Array.isArray(action.params)
+                ? action.params._rowRecord
+                : undefined;
+            const resolved = resolveActionParams(params, {
+                objectName: objectName || objectDef?.name || '',
+                objects: objects || [],
+                fieldLabel,
+                fieldOptionLabel,
+                row,
+            });
+            setParamState({ open: true, params: resolved, resolve });
         });
-    }, []);
+    }, [objectName, objectDef, objects, fieldLabel, fieldOptionLabel]);
     const handleDeleteView = useCallback(async (vid) => {
         if (!dataSource)
             return;
@@ -1049,10 +1107,78 @@ export function ObjectView({ dataSource, objects, onEdit, externalRefreshKey })
             navigate(url);
         }
     }, [navigate]);
+    // Authenticated fetch for direct backend calls (e.g. flow trigger,
+    // schema actions targeting absolute API paths). Declared before
+    // apiHandler so the latter can close over it.
+    const authFetch = useMemo(() => createAuthenticatedFetch(), []);
     const apiHandler = useCallback(async (action) => {
         try {
             const target = action.target || action.name;
             const params = action.params || {};
+            // Absolute HTTP target (e.g. /api/v1/auth/organization/invite-member,
+            // http://..., https://...) — bypass dataSource and call the API
+            // directly through the authenticated fetch wrapper so:
+            //   - Authorization: Bearer <token> is injected
+            //   - X-Tenant-ID is injected (multi-tenant routing)
+            //   - Same-origin cookies (better-auth.session_token) ride along
+            //
+            // This is the canonical path for schema actions on managed-by
+            // tables (sys_user/invite_user, sys_session/revoke, …) where
+            // generic CRUD does not apply.
+            const targetStr = typeof target === 'string' ? target : '';
+            const isAbsolute = targetStr.startsWith('/') || /^https?:\/\//i.test(targetStr);
+            if (isAbsolute) {
+                const baseUrl = import.meta.env.VITE_SERVER_URL || '';
+                const url = targetStr.startsWith('http') ? targetStr : `${baseUrl}${targetStr}`;
+                // Row context is stashed on params under `_rowRecord` by the
+                // row-action dispatcher (see ObjectGrid → onRowAction). Pull
+                // it out before assembling the request body.
+                const rawParams = { ...params };
+                const rowRecord = rawParams._rowRecord;
+                delete rawParams._rowRecord;
+                // Apply bodyShape: 'flat' (default) keeps user params at top
+                // level; { wrap: 'data' } nests them under that key while
+                // `recordIdParam` / `organizationId` stay flat (better-auth
+                // organization/update semantics).
+                const wrap = action.bodyShape && typeof action.bodyShape === 'object' && action.bodyShape.wrap
+                    ? action.bodyShape.wrap
+                    : undefined;
+                const body = wrap
+                    ? { [wrap]: rawParams }
+                    : { ...rawParams };
+                // Inject row id (or chosen row field) for list_item actions.
+                if (rowRecord && action.recordIdParam) {
+                    const rowField = action.recordIdField || 'id';
+                    const rowValue = rowRecord[rowField];
+                    if (rowValue != null)
+                        body[action.recordIdParam] = rowValue;
+                }
+                // Auto-inject organizationId when the active org is known and
+                // not already set. Most better-auth org-scoped endpoints
+                // accept this shape; harmless for endpoints that ignore it.
+                if (!body.organizationId && activeOrganization?.id) {
+                    body.organizationId = activeOrganization.id;
+                }
+                const res = await authFetch(url, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    credentials: 'include',
+                    body: JSON.stringify(body),
+                });
+                if (!res.ok) {
+                    let detail = `HTTP ${res.status}`;
+                    try {
+                        const j = await res.json();
+                        detail = j?.error || j?.message || detail;
+                    }
+                    catch { /* response body not JSON */ }
+                    return { success: false, error: detail };
+                }
+                const data = await res.json().catch(() => ({}));
+                if (action.refreshAfter !== false)
+                    setRefreshKey(k => k + 1);
+                return { success: true, data, reload: action.refreshAfter !== false };
+            }
             // Generic list-level API handler: update/execute via dataSource
             if (typeof dataSource.execute === 'function') {
                 await dataSource.execute(objectDef.name, target, params);
@@ -1069,9 +1195,7 @@ export function ObjectView({ dataSource, objects, onEdit, externalRefreshKey })
         catch (error) {
             return { success: false, error: error.message };
         }
-    }, [dataSource, objectDef.name]);
-    // Authenticated fetch for direct backend calls (e.g. flow trigger).
-    const authFetch = useMemo(() => createAuthenticatedFetch(), []);
+    }, [dataSource, objectDef.name, authFetch, activeOrganization]);
     // Flow action handler — POST to /api/v1/automation/{name}/trigger.
     // Triggered when an Action with `type: 'flow'` is invoked from list-level
     // locations (list_toolbar, list_item). For list_item the row's recordId is
@@ -1285,9 +1409,10 @@ export function ObjectView({ dataSource, objects, onEdit, externalRefreshKey })
             sort: viewDef.sort ?? listSchema.sort,
             filter: (() => {
                 const base = viewDef.filter ?? listSchema.filter;
+                const substituted = substituteFilterTokens(base, currentUser.id);
                 if (!urlFilters.length)
-                    return base;
-                const baseArr = Array.isArray(base) ? base : [];
+                    return substituted;
+                const baseArr = Array.isArray(substituted) ? substituted : [];
                 return [...baseArr, ...urlFilters];
             })(),
             hiddenFields: viewDef.hiddenFields ?? listSchema.hiddenFields,
@@ -1341,6 +1466,17 @@ export function ObjectView({ dataSource, objects, onEdit, externalRefreshKey })
             filterableFields: viewDef.filterableFields ?? listSchema.filterableFields,
             resizable: viewDef.resizable ?? listSchema.resizable,
             rowActions: viewDef.rowActions ?? listSchema.rowActions,
+            /**
+             * Row-context action definitions derived from `objectDef.actions`
+             * filtered by `locations.includes('list_item')`. These are full
+             * `ActionDef` records (with label/icon/variant/params/recordIdParam
+             * /bodyShape) the row menu renders with i18n-correct labels and
+             * dispatches via the action runner; legacy `rowActions: string[]`
+             * remains for back-compat where the action lives elsewhere.
+             */
+            rowActionDefs: (Array.isArray(objectDef?.actions)
+                ? objectDef.actions.filter((a) => Array.isArray(a?.locations) && a.locations.includes('list_item'))
+                : []),
             bulkActions: viewDef.bulkActions ?? listSchema.bulkActions,
             sharing: viewDef.sharing ?? listSchema.sharing,
             addRecord: viewDef.addRecord ?? listSchema.addRecord,
@@ -1350,7 +1486,9 @@ export function ObjectView({ dataSource, objects, onEdit, externalRefreshKey })
             showRecordCount: viewDef.showRecordCount ?? listSchema.showRecordCount,
             allowPrinting: viewDef.allowPrinting ?? listSchema.allowPrinting,
             virtualScroll: viewDef.virtualScroll ?? listSchema.virtualScroll,
-            emptyState: viewDef.emptyState ?? listSchema.emptyState,
+            emptyState: viewDef.emptyState
+                ?? listSchema.emptyState
+                ?? resolveManagedByEmptyState(objectDef?.managedBy),
             aria: viewDef.aria ?? listSchema.aria,
             tabs: listSchema.tabs,
             // Propagate filter/sort as default filters/sort for data flow
@@ -1359,7 +1497,8 @@ export function ObjectView({ dataSource, objects, onEdit, externalRefreshKey })
                     ...(Array.isArray(viewDef.filter) ? viewDef.filter : []),
                     ...urlFilters,
                 ];
-                return combined.length ? { filters: combined } : {};
+                const substituted = substituteFilterTokens(combined, currentUser.id);
+                return Array.isArray(substituted) && substituted.length ? { filters: substituted } : {};
             })()),
             ...(viewDef.sort?.length ? { sort: viewDef.sort } : {}),
             options: {
@@ -1489,7 +1628,15 @@ export function ObjectView({ dataSource, objects, onEdit, externalRefreshKey })
             }
         },
     }), [objectDef.name, onEdit, activeView?.showSearch, activeView?.showFilters, activeView?.showSort, navigate, viewId, isAdmin]);
-    return (_jsxs(ActionProvider, { context: { objectName: objectDef.name, user: currentUser }, onConfirm: confirmHandler, onToast: toastHandler, onNavigate: navigateHandler, onParamCollection: paramCollectionHandler, handlers: { api: apiHandler, flow: flowHandler, script: serverActionHandler, modal: serverActionHandler }, children: [_jsxs("div", { className: "h-full flex flex-col bg-background min-w-0 overflow-hidden", children: [_jsx(PageHeader, { title: objectLabel(objectDef), description: objectDef.description ? objectDesc(objectDef) : undefined, icon: (() => { const I = getIcon(objectDef?.icon); return _jsx(I, { className: "h-4 w-4" }); })(), actions: _jsxs(_Fragment, { children: [can(objectDef.name, 'create') && (_jsxs(Button, { size: "sm", onClick: actions.create, className: "shadow-none gap-1.5 sm:gap-2 h-8 sm:h-9", children: [_jsx(Plus, { className: "h-4 w-4" }), _jsx("span", { className: "hidden sm:inline", children: t('console.objectView.new') })] })), can(objectDef.name, 'create') && (_jsxs(Button, { size: "sm", variant: "outline", onClick: () => setShowImport(true), className: "shadow-none gap-1.5 sm:gap-2 h-8 sm:h-9", title: t('console.objectView.importTitle'), "data-testid": "object-view-import-button", children: [_jsx(Upload, { className: "h-4 w-4" }), _jsx("span", { className: "hidden sm:inline", children: t('console.objectView.import') })] })), objectDef.actions?.some((a) => a.locations?.includes('list_toolbar')) && (_jsx(SchemaRenderer, { schema: {
+    return (_jsxs(ActionProvider, { context: {
+            objectName: objectDef.name,
+            user: currentUser,
+            // Expose active org so `type: 'url'` actions can template
+            // `/organizations/${activeOrganization.slug}/...` etc.
+            activeOrganization: activeOrganization
+                ? { id: activeOrganization.id, slug: activeOrganization.slug, name: activeOrganization.name }
+                : null,
+        }, onConfirm: confirmHandler, onToast: toastHandler, onNavigate: navigateHandler, onParamCollection: paramCollectionHandler, handlers: { api: apiHandler, flow: flowHandler, script: serverActionHandler, modal: serverActionHandler }, children: [_jsxs("div", { className: "h-full flex flex-col bg-background min-w-0 overflow-hidden", children: [_jsx(PageHeader, { title: _jsxs("span", { className: "inline-flex items-center gap-2", children: [_jsx("span", { className: "truncate", children: objectLabel(objectDef) }), _jsx(ManagedByBadge, { managedBy: objectDef?.managedBy })] }), description: objectDef.description ? objectDesc(objectDef) : undefined, icon: (() => { const I = getIcon(objectDef?.icon); return _jsx(I, { className: "h-4 w-4" }); })(), actions: _jsxs(_Fragment, { children: [affordances.create && can(objectDef.name, 'create') && (_jsxs(Button, { size: "sm", onClick: actions.create, className: "shadow-none gap-1.5 sm:gap-2 h-8 sm:h-9", children: [_jsx(Plus, { className: "h-4 w-4" }), _jsx("span", { className: "hidden sm:inline", children: t('console.objectView.new') })] })), affordances.import && can(objectDef.name, 'create') && (_jsxs(Button, { size: "sm", variant: "outline", onClick: () => setShowImport(true), className: "shadow-none gap-1.5 sm:gap-2 h-8 sm:h-9", title: t('console.objectView.importTitle'), "data-testid": "object-view-import-button", children: [_jsx(Upload, { className: "h-4 w-4" }), _jsx("span", { className: "hidden sm:inline", children: t('console.objectView.import') })] })), objectDef.actions?.some((a) => a.locations?.includes('list_toolbar')) && (_jsx(SchemaRenderer, { schema: {
                                         type: 'action:bar',
                                         location: 'list_toolbar',
                                         actions: (objectDef.actions || []).map((a) => ({

package/dist/views/RecordDetailView.js

@@ -17,17 +17,22 @@ import { toast } from 'sonner';
 import { Database, Users } from 'lucide-react';
 import { MetadataPanel, useMetadataInspector } from './MetadataInspector';
 import { SkeletonDetail } from '../skeletons';
+import { ManagedByBadge } from '../components/ManagedByBadge';
+import { resolveCrudAffordances } from '../utils/crudAffordances';
 import { ActionConfirmDialog } from './ActionConfirmDialog';
 import { ActionParamDialog } from './ActionParamDialog';
+import { resolveActionParams } from '../utils/resolveActionParams';
 import { useRecordBreadcrumbTitle } from '../context/NavigationContext';
 import { getRecordDisplayName } from '../utils';
 const FALLBACK_USER = { id: 'current-user', name: 'Demo User' };
 /**
  * Audit field names auto-injected by the framework's `applySystemFields`.
- * Surfaced as a dedicated, collapsed "System Information" section on the
- * record detail page so they don't clutter the primary content but remain
- * discoverable. The inline-edit drawer keeps filtering them out via
- * `DEFAULT_SYSTEM_FIELDS` in `@object-ui/plugin-detail/RecordDetailDrawer`.
+ * Filtered out of the auto-generated body sections — they are rendered
+ * separately as a single subtle one-line `<RecordMetaFooter>` (see
+ * `@object-ui/plugin-detail`) so provenance stays discoverable without a
+ * heavy "System Information" panel. The inline-edit drawer also hides
+ * them via `DEFAULT_SYSTEM_FIELDS` in
+ * `@object-ui/plugin-detail/RecordDetailDrawer`.
  */
 const AUDIT_FIELD_NAMES = new Set(['created_at', 'created_by', 'updated_at', 'updated_by']);
 export function RecordDetailView({ dataSource, objects, onEdit }) {
@@ -36,7 +41,7 @@ export function RecordDetailView({ dataSource, objects, onEdit }) {
     const { user } = useAuth();
     const navigate = useNavigate();
     const { t } = useObjectTranslation();
-    const { objectLabel, viewLabel: _vLabel, sectionLabel, actionLabel, actionConfirm, actionSuccess } = useObjectLabel();
+    const { objectLabel, viewLabel: _vLabel, sectionLabel, actionLabel, actionConfirm, actionSuccess, fieldLabel, fieldOptionLabel } = useObjectLabel();
     const [isLoading, setIsLoading] = useState(true);
     const [feedItems, setFeedItems] = useState([]);
     const [recordViewers, setRecordViewers] = useState([]);
@@ -63,9 +68,15 @@ export function RecordDetailView({ dataSource, objects, onEdit }) {
     }, []);
     const paramCollectionHandler = useCallback((params) => {
         return new Promise((resolve) => {
-            setParamState({ open: true, params, resolve });
+            const resolved = resolveActionParams(params, {
+                objectName: objectName || objectDef?.name || '',
+                objects: objects || [],
+                fieldLabel,
+                fieldOptionLabel,
+            });
+            setParamState({ open: true, params: resolved, resolve });
         });
-    }, []);
+    }, [objectName, objectDef, objects, fieldLabel, fieldOptionLabel]);
     const toastHandler = useCallback((message, options) => {
         if (options?.type === 'error')
             toast.error(message);
@@ -561,32 +572,12 @@ export function RecordDetailView({ dataSource, objects, onEdit }) {
                     }),
                 },
             ];
-        // Append a dedicated, collapsed "System Information" section listing
-        // audit fields (created/updated at/by) when the schema declares them
-        // and no author-defined section has already surfaced them. The framework
-        // auto-injects these as `system: true, readonly: true` via
-        // `applySystemFields`; rendering them here gives users visibility into
-        // record provenance without polluting the primary content area.
-        const fieldsAlreadyShown = new Set(sections.flatMap((s) => (s.fields || []).map((f) => f.name)));
-        const auditFieldsToShow = Array.from(AUDIT_FIELD_NAMES).filter(name => objectDef.fields?.[name] && !fieldsAlreadyShown.has(name));
-        if (auditFieldsToShow.length > 0) {
-            sections.push({
-                title: sectionLabel(objectDef.name, 'system_info', 'System Information'),
-                collapsible: true,
-                defaultCollapsed: true,
-                fields: auditFieldsToShow.map(key => {
-                    const fieldDef = objectDef.fields[key];
-                    const refTarget = fieldDef.reference_to || fieldDef.reference;
-                    return {
-                        name: key,
-                        label: fieldDef.label || key,
-                        type: fieldDef.type || 'text',
-                        readonly: true,
-                        ...(refTarget && { reference_to: refTarget }),
-                    };
-                }),
-            });
-        }
+        // Audit fields (created_at/created_by/updated_at/updated_by) are NOT
+        // appended as a section here — they are surfaced by `<RecordMetaFooter>`
+        // (rendered by DetailView) as a single subtle line below the content,
+        // replacing the old card-style "System Information" panel. The inline-edit
+        // drawer continues to hide them via `DEFAULT_SYSTEM_FIELDS` in
+        // `@object-ui/plugin-detail/RecordDetailDrawer`.
         // Filter actions for record_header location and deduplicate by name
         const recordHeaderActions = (() => {
             const seen = new Set();
@@ -701,13 +692,19 @@ export function RecordDetailView({ dataSource, objects, onEdit }) {
                 onRowDelete,
             };
         });
+        const affordances = resolveCrudAffordances(objectDef);
         return {
             type: 'detail-view',
             objectName: objectDef.name,
             resourceId: pureRecordId,
             showBack: true,
             onBack: 'history',
-            showEdit: true,
+            // Hide the Edit button for objects whose lifecycle isn't user-managed
+            // (approval requests, audit logs, better-auth tables, …).  The
+            // underlying form is also disabled when `managedBy !== 'platform'`
+            // (see plugin-form/ObjectForm), so even if a stray Edit URL is
+            // visited the inputs render read-only.
+            showEdit: affordances.edit,
             title: objectDef.label,
             primaryField,
             sections,
@@ -732,7 +729,7 @@ export function RecordDetailView({ dataSource, objects, onEdit }) {
     if (!objectDef) {
         return (_jsx("div", { className: "flex h-full items-center justify-center p-4", children: _jsxs(Empty, { children: [_jsx("div", { className: "mx-auto mb-4 flex h-12 w-12 items-center justify-center rounded-full bg-muted", children: _jsx(Database, { className: "h-6 w-6 text-muted-foreground" }) }), _jsx(EmptyTitle, { children: t('empty.objectNotFound') }), _jsx(EmptyDescription, { children: t('empty.objectNotFoundDescription', { name: objectName }) })] }) }));
     }
-    return (_jsxs("div", { className: "h-full bg-background overflow-hidden flex flex-col relative", children: [_jsx("div", { className: "absolute top-2 sm:top-4 right-2 sm:right-4 z-50 flex items-center gap-2", children: recordViewers.length > 0 && (_jsxs("div", { className: "flex items-center gap-1.5", title: t('recordDetail.viewersTooltip'), children: [_jsx(Users, { className: "h-3.5 w-3.5 text-muted-foreground" }), _jsx(PresenceAvatars, { users: recordViewers, size: "sm", maxVisible: 4, showStatus: true })] })) }), _jsxs("div", { className: "flex-1 overflow-hidden flex flex-row", children: [_jsx("div", { className: "flex-1 overflow-auto p-3 sm:p-4 lg:p-6 scroll-pb-48", children: _jsx(ActionProvider, { context: { record: {}, objectName, user: currentUser }, onConfirm: confirmHandler, onToast: toastHandler, onNavigate: navigateHandler, onParamCollection: paramCollectionHandler, handlers: { api: apiHandler, flow: flowHandler, script: serverActionHandler, modal: serverActionHandler }, children: _jsx(DetailView, { schema: detailSchema, dataSource: dataSource, objectLabel: objectLabel({ name: objectDef.name, label: objectDef.label }), onDataLoaded: (record) => {
+    return (_jsxs("div", { className: "h-full bg-background overflow-hidden flex flex-col relative", children: [_jsxs("div", { className: "absolute top-2 sm:top-4 right-2 sm:right-4 z-50 flex items-center gap-2", children: [_jsx(ManagedByBadge, { managedBy: objectDef?.managedBy }), recordViewers.length > 0 && (_jsxs("div", { className: "flex items-center gap-1.5", title: t('recordDetail.viewersTooltip'), children: [_jsx(Users, { className: "h-3.5 w-3.5 text-muted-foreground" }), _jsx(PresenceAvatars, { users: recordViewers, size: "sm", maxVisible: 4, showStatus: true })] }))] }), _jsxs("div", { className: "flex-1 overflow-hidden flex flex-row", children: [_jsx("div", { className: "flex-1 overflow-auto p-3 sm:p-4 lg:p-6 scroll-pb-48", children: _jsx(ActionProvider, { context: { record: {}, objectName, user: currentUser }, onConfirm: confirmHandler, onToast: toastHandler, onNavigate: navigateHandler, onParamCollection: paramCollectionHandler, handlers: { api: apiHandler, flow: flowHandler, script: serverActionHandler, modal: serverActionHandler }, children: _jsx(DetailView, { schema: detailSchema, dataSource: dataSource, objectLabel: objectLabel({ name: objectDef.name, label: objectDef.label }), onDataLoaded: (record) => {
                                     if (!record || typeof record !== 'object')
                                         return;
                                     // Resolve the same way DetailView's header does, so the

package/dist/views/RecordFormPage.js

@@ -39,6 +39,7 @@ import { useMetadata } from '../providers/MetadataProvider';
 import { useAdapter } from '../providers/AdapterProvider';
 import { ExpressionProvider, evaluateVisibility } from '../providers/ExpressionProvider';
 import { SkeletonDetail } from '../skeletons';
+import { ManagedByBadge } from '../components/ManagedByBadge';
 import { useAuth } from '@object-ui/auth';
 import { ExpressionEvaluator } from '@object-ui/core';
 /**
@@ -161,7 +162,7 @@ export function RecordFormPage({ mode }) {
     if (!objectDef) {
         return (_jsx("div", { className: "flex h-full items-center justify-center p-4", children: _jsxs(Empty, { children: [_jsx("div", { className: "mx-auto mb-4 flex h-12 w-12 items-center justify-center rounded-full bg-muted", children: _jsx(Database, { className: "h-6 w-6 text-muted-foreground" }) }), _jsx(EmptyTitle, { children: t('empty.objectNotFound') }), _jsx(EmptyDescription, { children: t('empty.objectNotFoundDescription', { name: objectName }) }), _jsx("div", { className: "mt-4", children: _jsxs(Button, { variant: "outline", onClick: () => navigate(baseUrl), children: [_jsx(ArrowLeft, { className: "mr-2 h-4 w-4" }), t('empty.back')] }) })] }) }));
     }
-    return (_jsx(ExpressionProvider, { user: expressionUser, app: { name: appName }, data: {}, children: _jsxs("div", { className: "flex flex-col h-full overflow-hidden bg-background", "data-testid": "record-form-page", "data-mode": mode, children: [_jsxs("header", { className: "sticky top-0 z-10 flex items-center gap-3 border-b bg-background px-4 py-3 sm:px-6", children: [_jsx(Button, { variant: "ghost", size: "sm", onClick: goBack, "data-testid": "record-form-page-back", "aria-label": t('common.back', { defaultValue: 'Back' }), children: _jsx(ArrowLeft, { className: "h-4 w-4" }) }), _jsxs("nav", { "aria-label": "Breadcrumb", className: "flex items-center gap-2 text-sm text-muted-foreground", children: [_jsx(Link, { to: objectListUrl, className: "hover:text-foreground transition-colors", children: label }), _jsx("span", { "aria-hidden": "true", children: "/" }), _jsx("span", { className: "text-foreground font-medium", "data-testid": "record-form-page-title", children: pageTitle })] })] }), _jsx("div", { className: "flex-1 overflow-auto p-4 sm:p-6", children: _jsx("div", { className: "mx-auto max-w-4xl", children: _jsx(ObjectForm, { schema: {
+    return (_jsx(ExpressionProvider, { user: expressionUser, app: { name: appName }, data: {}, children: _jsxs("div", { className: "flex flex-col h-full overflow-hidden bg-background", "data-testid": "record-form-page", "data-mode": mode, children: [_jsxs("header", { className: "sticky top-0 z-10 flex items-center gap-3 border-b bg-background px-4 py-3 sm:px-6", children: [_jsx(Button, { variant: "ghost", size: "sm", onClick: goBack, "data-testid": "record-form-page-back", "aria-label": t('common.back', { defaultValue: 'Back' }), children: _jsx(ArrowLeft, { className: "h-4 w-4" }) }), _jsxs("nav", { "aria-label": "Breadcrumb", className: "flex items-center gap-2 text-sm text-muted-foreground", children: [_jsx(Link, { to: objectListUrl, className: "hover:text-foreground transition-colors", children: label }), _jsx("span", { "aria-hidden": "true", children: "/" }), _jsx("span", { className: "text-foreground font-medium", "data-testid": "record-form-page-title", children: pageTitle }), _jsx(ManagedByBadge, { managedBy: objectDef?.managedBy, className: "ml-1" })] })] }), _jsx("div", { className: "flex-1 overflow-auto p-4 sm:p-6", children: _jsx("div", { className: "mx-auto max-w-4xl", children: _jsx(ObjectForm, { schema: {
                                 type: 'object-form',
                                 formType: 'simple',
                                 objectName: objectDef.name,

package/dist/views/ReportView.js

@@ -2,6 +2,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useState, useEffect, useCallback, useMemo, lazy, Suspense } from 'react';
 import { useParams } from 'react-router-dom';
 const ReportViewer = lazy(() => import('@object-ui/plugin-report').then((m) => ({ default: m.ReportViewer })));
+const ReportRenderer = lazy(() => import('@object-ui/plugin-report').then((m) => ({ default: m.ReportRenderer })));
 const ReportConfigPanel = lazy(() => import('@object-ui/plugin-report').then((m) => ({ default: m.ReportConfigPanel })));
 import { Empty, EmptyTitle, EmptyDescription } from '@object-ui/components';
 import { Pencil, BarChart3, Loader2 } from 'lucide-react';
@@ -37,29 +38,31 @@ export function ReportView({ dataSource }) {
     // State for report runtime data
     const [reportRuntimeData, setReportRuntimeData] = useState([]);
     const [dataLoading, setDataLoading] = useState(false);
+    const getFieldsForObject = useCallback((objName) => {
+        if (!objName || !objects?.length)
+            return undefined;
+        const objDef = objects.find((o) => o.name === objName);
+        if (!objDef?.fields)
+            return undefined;
+        const fields = objDef.fields;
+        if (Array.isArray(fields)) {
+            return fields.map((f) => typeof f === 'string'
+                ? { value: f, label: f, type: 'text' }
+                : { value: f.name, label: f.label || f.name, type: f.type || 'text' });
+        }
+        return Object.entries(fields).map(([name, def]) => ({
+            value: name,
+            label: def.label || name,
+            type: def.type || 'text',
+        }));
+    }, [objects]);
     // Derive available fields from object schema for filter/sort editors
     // Uses live editSchema when available to respond to objectName changes
     const availableFields = useMemo(() => {
         const liveReport = editSchema || reportData;
         const objName = liveReport?.objectName || liveReport?.dataSource?.object || liveReport?.dataSource?.resource;
-        if (objName && objects?.length) {
-            const objDef = objects.find((o) => o.name === objName);
-            if (objDef?.fields) {
-                const fields = objDef.fields;
-                if (Array.isArray(fields)) {
-                    return fields.map((f) => typeof f === 'string'
-                        ? { value: f, label: f, type: 'text' }
-                        : { value: f.name, label: f.label || f.name, type: f.type || 'text' });
-                }
-                return Object.entries(fields).map(([name, def]) => ({
-                    value: name,
-                    label: def.label || name,
-                    type: def.type || 'text',
-                }));
-            }
-        }
-        return FALLBACK_FIELDS;
-    }, [editSchema, reportData, objects]);
+        return getFieldsForObject(objName) ?? FALLBACK_FIELDS;
+    }, [editSchema, reportData, getFieldsForObject]);
     // ---- Save helper --------------------------------------------------------
     const saveSchema = useCallback(async (schema) => {
         try {
@@ -326,6 +329,20 @@ export function ReportView({ dataSource }) {
     };
     // Use live-edited schema for preview (persists after closing panel until metadata refreshes)
     const previewReport = editSchema || reportData;
+    // Route any object-backed spec report (matrix/joined/tabular/summary) through
+    // the spec ReportRenderer dispatcher. It handles aggregation, charts, KPIs
+    // and drill protocol end-to-end. The legacy ReportViewer is only used as a
+    // last resort for fully-legacy schemas that lack `objectName` (e.g. inline
+    // `fields` + `data` arrays from older app code).
+    const useSpecRenderer = Boolean(previewReport &&
+        previewReport.objectName &&
+        (previewReport.type === 'matrix' ||
+            previewReport.type === 'joined' ||
+            previewReport.type === 'summary' ||
+            previewReport.type === 'tabular' ||
+            previewReport.type === undefined ||
+            (Array.isArray(previewReport.groupingsAcross) && previewReport.groupingsAcross.length > 0) ||
+            Array.isArray(previewReport.columns)));
     const reportForViewer = mapReportForViewer(previewReport);
     const viewerSchema = {
         type: 'report-viewer',
@@ -335,5 +352,5 @@ export function ReportView({ dataSource }) {
         allowExport: true,
         loading: dataLoading, // Loading state for data fetching
     };
-    return (_jsxs("div", { className: "flex flex-col h-full overflow-hidden bg-background", children: [_jsxs("div", { className: "flex flex-col sm:flex-row justify-between sm:items-center gap-3 sm:gap-4 p-4 sm:p-6 border-b shrink-0", children: [_jsxs("div", { className: "min-w-0 flex-1", children: [_jsx("h1", { className: "text-lg sm:text-xl md:text-2xl font-bold tracking-tight truncate", children: previewReport.title || previewReport.label || 'Report Viewer' }), previewReport.description && (_jsx("p", { className: "text-sm text-muted-foreground mt-1 line-clamp-2", children: previewReport.description }))] }), _jsx("div", { className: "shrink-0 flex items-center gap-1.5", children: _jsxs("button", { type: "button", onClick: handleOpenConfigPanel, className: "inline-flex items-center gap-1.5 rounded-md border border-input bg-background px-2.5 py-1.5 text-xs font-medium text-muted-foreground shadow-sm hover:bg-accent hover:text-accent-foreground", "data-testid": "report-edit-button", children: [_jsx(Pencil, { className: "h-3.5 w-3.5" }), "Edit"] }) })] }), _jsxs("div", { className: "flex-1 overflow-hidden flex flex-col sm:flex-row relative", children: [_jsx("div", { className: "flex-1 min-w-0 overflow-auto p-4 sm:p-6 lg:p-8 bg-muted/5", children: _jsx("div", { className: "max-w-5xl mx-auto shadow-sm border rounded-lg sm:rounded-xl bg-background overflow-hidden min-h-150", children: _jsx(Suspense, { fallback: _jsx("div", { className: "p-8 text-sm text-muted-foreground", children: "Loading report\u2026" }), children: _jsx(ReportViewer, { schema: viewerSchema }) }) }) }), _jsx(Suspense, { fallback: null, children: _jsx(ReportConfigPanel, { open: configPanelOpen, onClose: handleCloseConfigPanel, config: reportConfig, onSave: handleReportConfigSave, onFieldChange: handleReportFieldChange, availableFields: availableFields }) }), _jsx(MetadataPanel, { open: showDebug, sections: [{ title: 'Report Configuration', data: previewReport }] })] })] }));
+    return (_jsxs("div", { className: "flex flex-col h-full overflow-hidden bg-background", children: [_jsxs("div", { className: "flex flex-col sm:flex-row justify-between sm:items-center gap-3 sm:gap-4 p-4 sm:p-6 border-b shrink-0", children: [_jsxs("div", { className: "min-w-0 flex-1", children: [_jsx("h1", { className: "text-lg sm:text-xl md:text-2xl font-bold tracking-tight truncate", children: previewReport.title || previewReport.label || 'Report Viewer' }), previewReport.description && (_jsx("p", { className: "text-sm text-muted-foreground mt-1 line-clamp-2", children: previewReport.description }))] }), _jsx("div", { className: "shrink-0 flex items-center gap-1.5", children: _jsxs("button", { type: "button", onClick: handleOpenConfigPanel, className: "inline-flex items-center gap-1.5 rounded-md border border-input bg-background px-2.5 py-1.5 text-xs font-medium text-muted-foreground shadow-sm hover:bg-accent hover:text-accent-foreground", "data-testid": "report-edit-button", children: [_jsx(Pencil, { className: "h-3.5 w-3.5" }), "Edit"] }) })] }), _jsxs("div", { className: "flex-1 overflow-hidden flex flex-col sm:flex-row relative", children: [_jsx("div", { className: "flex-1 min-w-0 overflow-auto p-4 sm:p-6 lg:p-8 bg-muted/5", children: _jsx("div", { className: "w-full shadow-sm border rounded-lg sm:rounded-xl bg-background overflow-hidden min-h-150", children: _jsx(Suspense, { fallback: _jsx("div", { className: "p-8 text-sm text-muted-foreground", children: "Loading report\u2026" }), children: useSpecRenderer ? (_jsx("div", { className: "p-4 sm:p-6", children: _jsx(ReportRenderer, { schema: previewReport, dataSource: dataSource }) })) : (_jsx(ReportViewer, { schema: viewerSchema })) }) }) }), _jsx(Suspense, { fallback: null, children: _jsx(ReportConfigPanel, { open: configPanelOpen, onClose: handleCloseConfigPanel, config: reportConfig, onSave: handleReportConfigSave, onFieldChange: handleReportFieldChange, availableFields: availableFields, getFieldsForObject: getFieldsForObject }) }), _jsx(MetadataPanel, { open: showDebug, sections: [{ title: 'Report Configuration', data: previewReport }] })] })] }));
 }