@object-ui/app-shell 4.2.1 → 4.4.0

package/dist/layout/InboxPopover.js

@@ -0,0 +1,84 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+/**
+ * InboxPopover
+ *
+ * UX P0-2: a single "inbox" surface that bundles the three things that
+ * used to occupy separate top-bar buttons:
+ *   - Notifications (mentions, assignments, system alerts)
+ *   - Approvals (pending approval requests for the user)
+ *   - Activity (recent activity feed across the org)
+ *
+ * Rendered as a single bell button + popover with a tabbed body. The badge
+ * shows the combined unread count (notifications + approvals) so users
+ * still see at-a-glance pressure.
+ *
+ * @module
+ */
+import { useState } from 'react';
+import { useNavigate, useParams } from 'react-router-dom';
+import { Button, Popover, PopoverContent, PopoverTrigger, Tabs, TabsList, TabsTrigger, TabsContent, } from '@object-ui/components';
+import { Bell, CheckSquare, Activity as ActivityIcon } from 'lucide-react';
+import { useObjectTranslation } from '@object-ui/i18n';
+import { useNavigationContext } from '../context/NavigationContext';
+function timeAgo(iso) {
+    if (!iso)
+        return '';
+    const ms = new Date(iso).getTime();
+    if (Number.isNaN(ms))
+        return '';
+    const diff = (Date.now() - ms) / 1000;
+    if (diff < 60)
+        return `${Math.max(1, Math.floor(diff))}s`;
+    if (diff < 3600)
+        return `${Math.floor(diff / 60)}m`;
+    if (diff < 86400)
+        return `${Math.floor(diff / 3600)}h`;
+    return `${Math.floor(diff / 86400)}d`;
+}
+export function InboxPopover({ notifications, unreadCount, pendingApprovalsCount, activities, onMarkAllRead, onMarkRead, }) {
+    const { t } = useObjectTranslation();
+    const navigate = useNavigate();
+    const params = useParams();
+    const { currentAppName } = useNavigationContext();
+    const [open, setOpen] = useState(false);
+    const [tab, setTab] = useState('notifications');
+    const totalBadge = unreadCount + pendingApprovalsCount;
+    const ariaLabel = t('sidebar.inboxAriaLabel', { defaultValue: 'Open inbox' });
+    const goToApprovals = () => {
+        setOpen(false);
+        const app = currentAppName ?? params.appName;
+        navigate(app ? `/apps/${app}/system/approvals` : '/apps/setup/system/approvals');
+    };
+    const goToAllNotifications = () => {
+        setOpen(false);
+        // Always route through the setup app's sys_notification list view —
+        // it's the canonical full-page inbox and lives outside per-app sidebars.
+        // The `?view=mine` query selects the "Mine" tab so the user sees their
+        // own notifications by default (matching the popover scope).
+        navigate('/apps/setup/sys_notification?view=mine');
+    };
+    const goToAllActivity = () => {
+        setOpen(false);
+        // Mirror of goToAllNotifications: drill from the popover Activity tab
+        // (capped at 20 rows) into the full sys_activity list page. Org-wide
+        // scope — no `?view=` qualifier — to match what the popover already shows.
+        navigate('/apps/setup/sys_activity');
+    };
+    const handleNotificationClick = (n) => {
+        onMarkRead(n.id);
+        if (n.source_object && n.source_id) {
+            setOpen(false);
+            const app = currentAppName ?? params.appName;
+            const target = app
+                ? `/apps/${app}/${n.source_object}/${n.source_id}`
+                : `/objects/${n.source_object}/${n.source_id}`;
+            navigate(target);
+        }
+    };
+    return (_jsxs(Popover, { open: open, onOpenChange: setOpen, children: [_jsx(PopoverTrigger, { asChild: true, children: _jsxs(Button, { variant: "ghost", size: "icon", className: "h-8 w-8 relative shrink-0", "aria-label": ariaLabel, title: t('sidebar.inbox', { defaultValue: 'Inbox' }), children: [_jsx(Bell, { className: "h-4 w-4" }), totalBadge > 0 && (_jsx("span", { className: "absolute -top-0.5 -right-0.5 h-4 min-w-[16px] rounded-full bg-red-500 text-[10px] leading-4 text-white text-center px-1", children: totalBadge > 9 ? '9+' : totalBadge }))] }) }), _jsxs(PopoverContent, { align: "end", sideOffset: 8, className: "w-96 p-0", children: [_jsxs("div", { className: "flex items-center justify-between px-3 pt-3 pb-1", children: [_jsx("div", { className: "text-sm font-semibold", children: t('sidebar.inbox', { defaultValue: 'Inbox' }) }), tab === 'notifications' && unreadCount > 0 && (_jsx("button", { type: "button", onClick: onMarkAllRead, className: "text-xs text-muted-foreground hover:text-foreground", children: t('notifications.markAllRead', { defaultValue: 'Mark all read' }) }))] }), _jsxs(Tabs, { value: tab, onValueChange: (v) => setTab(v), className: "w-full", children: [_jsxs(TabsList, { className: "w-full justify-start rounded-none border-b bg-transparent px-1 h-9", children: [_jsxs(TabsTrigger, { value: "notifications", className: "text-xs gap-1.5 data-[state=active]:bg-transparent", children: [_jsx(Bell, { className: "h-3.5 w-3.5" }), t('sidebar.notifications', { defaultValue: 'Notifications' }), unreadCount > 0 && (_jsx("span", { className: "ml-0.5 inline-flex h-4 min-w-[16px] items-center justify-center rounded-full bg-red-500 px-1 text-[10px] text-white", children: unreadCount > 9 ? '9+' : unreadCount }))] }), _jsxs(TabsTrigger, { value: "approvals", className: "text-xs gap-1.5 data-[state=active]:bg-transparent", children: [_jsx(CheckSquare, { className: "h-3.5 w-3.5" }), t('sidebar.approvals', { defaultValue: 'Approvals' }), pendingApprovalsCount > 0 && (_jsx("span", { className: "ml-0.5 inline-flex h-4 min-w-[16px] items-center justify-center rounded-full bg-amber-500 px-1 text-[10px] text-white", children: pendingApprovalsCount > 9 ? '9+' : pendingApprovalsCount }))] }), _jsxs(TabsTrigger, { value: "activity", className: "text-xs gap-1.5 data-[state=active]:bg-transparent", children: [_jsx(ActivityIcon, { className: "h-3.5 w-3.5" }), t('sidebar.activityFeed', { defaultValue: 'Activity' })] })] }), _jsxs(TabsContent, { value: "notifications", className: "m-0 max-h-80 overflow-auto", children: [notifications.length === 0 ? (_jsx("div", { className: "px-3 py-8 text-sm text-muted-foreground text-center", children: t('notifications.empty', { defaultValue: 'No notifications' }) })) : (_jsx("ul", { className: "divide-y", children: notifications.map((n) => (_jsx("li", { children: _jsx("button", { type: "button", onClick: () => handleNotificationClick(n), className: `w-full text-left px-3 py-2.5 hover:bg-accent transition-colors ${n.is_read ? '' : 'bg-accent/40'}`, children: _jsxs("div", { className: "flex items-start gap-2", children: [!n.is_read && (_jsx("span", { className: "mt-1.5 h-1.5 w-1.5 shrink-0 rounded-full bg-primary", "aria-hidden": true })), _jsxs("div", { className: "min-w-0 flex-1", children: [_jsx("div", { className: "text-sm font-medium leading-tight truncate", children: n.title }), n.body && (_jsx("div", { className: "text-xs text-muted-foreground line-clamp-2 mt-0.5", children: n.body })), _jsx("div", { className: "text-[10px] text-muted-foreground mt-1", children: timeAgo(n.created_at) })] })] }) }) }, n.id))) })), _jsx("div", { className: "border-t px-3 py-2 text-center", children: _jsx("button", { type: "button", onClick: goToAllNotifications, className: "text-xs text-primary hover:underline", children: t('notifications.viewAll', { defaultValue: 'View all notifications' }) }) })] }), _jsx(TabsContent, { value: "approvals", className: "m-0 max-h-80 overflow-auto", children: _jsx("div", { className: "px-3 py-6 text-center", children: pendingApprovalsCount > 0 ? (_jsxs(_Fragment, { children: [_jsx(CheckSquare, { className: "mx-auto h-6 w-6 text-amber-500" }), _jsx("div", { className: "mt-2 text-sm font-medium", children: t('notifications.approvalsPending', {
+                                                    defaultValue: '{{count}} pending approvals',
+                                                    count: pendingApprovalsCount,
+                                                }) }), _jsx(Button, { size: "sm", className: "mt-3", onClick: goToApprovals, children: t('notifications.viewApprovals', { defaultValue: 'View approvals' }) })] })) : (_jsxs(_Fragment, { children: [_jsx("div", { className: "text-sm text-muted-foreground", children: t('notifications.noPendingApprovals', {
+                                                    defaultValue: 'No pending approvals',
+                                                }) }), _jsx("button", { type: "button", onClick: goToApprovals, className: "mt-2 text-xs text-primary hover:underline", children: t('notifications.openApprovalsInbox', { defaultValue: 'Open Approvals Inbox' }) })] })) }) }), _jsxs(TabsContent, { value: "activity", className: "m-0 max-h-80 overflow-auto", children: [activities.length === 0 ? (_jsx("div", { className: "px-3 py-8 text-sm text-muted-foreground text-center", children: t('layout.activityFeed.empty', { defaultValue: 'No recent activity' }) })) : (_jsx("ul", { className: "divide-y", children: activities.slice(0, 20).map((a) => (_jsxs("li", { className: "px-3 py-2.5", children: [_jsxs("div", { className: "text-sm leading-tight truncate", children: [_jsx("span", { className: "font-medium", children: a.user }), ' ', _jsx("span", { className: "text-muted-foreground", children: a.description })] }), _jsxs("div", { className: "text-[10px] text-muted-foreground mt-0.5", children: [timeAgo(a.timestamp), " \u00B7 ", a.objectName] })] }, a.id))) })), _jsx("div", { className: "border-t px-3 py-2 text-center", children: _jsx("button", { type: "button", onClick: goToAllActivity, className: "text-xs text-primary hover:underline", children: t('layout.activityFeed.viewAll', { defaultValue: 'View all activity' }) }) })] })] })] })] }));
+}

package/dist/utils/index.js

@@ -61,7 +61,23 @@ export function formatRecordTitle(titleFormat, record) {
     }
     let anyResolved = false;
     let out = template.replace(/\{([^{}]+)\}/g, (_match, fieldName) => {
-        const value = record[fieldName.trim()];
+        // Support dotted paths (e.g. `{account.name}`) for $expanded lookups.
+        const parts = String(fieldName).trim().split('.');
+        let value = record;
+        for (const p of parts) {
+            if (value == null)
+                break;
+            value = value[p];
+        }
+        // Auto-extract display name from expanded reference objects.
+        if (value && typeof value === 'object') {
+            value =
+                value.name ??
+                    value.label ??
+                    value.display_name ??
+                    value.title ??
+                    null;
+        }
         if (value === null || value === undefined || value === '') {
             return EMPTY_TOKEN;
         }

package/dist/utils/managedByEmptyState.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Derive a context-aware empty-state config for object lists whose
+ * `managedBy` bucket means the user can't create rows directly from
+ * this list view.
+ *
+ * Background: previously the entire affordance story was carried by a
+ * full-width banner pinned to the top of every list/detail/form page.
+ * That violated the principle most enterprise platforms (Salesforce,
+ * ServiceNow, SAP Fiori, Notion, Linear) settled on long ago: hide the
+ * affordance you don't want users to take, and use the *empty state* as
+ * the only place to explain why the list is empty and where new entries
+ * come from.
+ *
+ * This helper returns an `emptyState` payload compatible with the
+ * `ListView` schema (`{ title, message, icon }`). It only fires for the
+ * buckets where the default empty state ("No records yet") would be
+ * misleading; for `platform`/`config` it returns `undefined` so the
+ * caller falls back to the user-defined view-level empty state.
+ *
+ * The bucket → message mapping mirrors `ManagedByBadge` so that the badge
+ * (in the header) and the empty state (in the body) tell a consistent
+ * story without repeating themselves verbatim.
+ */
+export interface ManagedByEmptyState {
+    title: string;
+    message: string;
+    icon: string;
+}
+export declare function resolveManagedByEmptyState(managedBy: string | undefined | null): ManagedByEmptyState | undefined;

package/dist/utils/managedByEmptyState.js

@@ -0,0 +1,24 @@
+export function resolveManagedByEmptyState(managedBy) {
+    switch (managedBy) {
+        case 'system':
+            return {
+                icon: 'Lock',
+                title: 'Nothing here yet',
+                message: 'Entries appear automatically when their source action runs (e.g. Submit for Approval, Share, Invite). Trigger one of those on a source record to create a row.',
+            };
+        case 'append-only':
+            return {
+                icon: 'Archive',
+                title: 'No events recorded',
+                message: 'This is an immutable audit log. Rows are written by the platform when events occur — you can export the history but cannot create entries from here.',
+            };
+        case 'better-auth':
+            return {
+                icon: 'ShieldAlert',
+                title: 'No identity records',
+                message: 'Identity rows are managed by the authentication provider. Use the dedicated identity workflows (Invite User, Reset Password, …) to create new entries.',
+            };
+        default:
+            return undefined;
+    }
+}

package/dist/utils/resolveActionParams.d.ts

@@ -0,0 +1,86 @@
+/**
+ * resolveActionParams — Resolves field-backed action parameters against
+ * runtime object metadata.
+ *
+ * Action params (`packages/spec/src/ui/action.zod.ts ActionParamSchema`) may
+ * either be declared inline (`{ name, label, type, ... }`) or reference an
+ * existing object field via `{ field, objectOverride? }`. Field-backed
+ * params inherit label (i18n via `fieldLabel()`), type, options, validation,
+ * placeholder, and help text from the object's field definition. Inline
+ * properties on a field-backed param act as overrides.
+ *
+ * The resolver flattens each param to the runtime `ActionParamDef` shape
+ * expected by `ActionParamDialog`, so the dialog itself stays agnostic to
+ * field references.
+ */
+import type { ActionParamDef } from '@object-ui/core';
+/**
+ * `ActionParamDialog` switches on raw `FieldType` values
+ * (`text` / `email` / `select` / `textarea` / `number` / `url` / `date` / …),
+ * matching the `FieldType` enum in `@objectstack/spec`. **Do not** route
+ * through `mapFieldTypeToFormType()` here — that helper translates into the
+ * FormField widget vocabulary (`field:select`, …) which the dialog does not
+ * understand.
+ */
+/** Raw param as authored on a schema action (post-zod). */
+export interface RawActionParam {
+    name?: string;
+    field?: string;
+    objectOverride?: string;
+    label?: string;
+    type?: string;
+    required?: boolean;
+    options?: Array<{
+        label: string;
+        value: string;
+    }>;
+    placeholder?: string;
+    helpText?: string;
+    defaultValue?: unknown;
+    /** When true, seed defaultValue from the row record using the field name. */
+    defaultFromRow?: boolean;
+}
+/** Field metadata as exposed by `useMetadata().objects[].fields`. */
+interface RuntimeField {
+    type?: string;
+    label?: string;
+    required?: boolean;
+    placeholder?: string;
+    help?: string;
+    description?: string;
+    options?: Array<{
+        label: string;
+        value: string;
+    } | string>;
+    multiple?: boolean;
+    defaultValue?: unknown;
+}
+interface RuntimeObject {
+    name?: string;
+    fields?: Record<string, RuntimeField>;
+}
+export interface ResolveActionParamsContext {
+    /** Default object name when a param's `objectOverride` is absent. */
+    objectName: string;
+    /** All known runtime objects (`useMetadata().objects`). */
+    objects: RuntimeObject[];
+    /** i18n resolver — `useObjectLabel().fieldLabel`. */
+    fieldLabel: (objectName: string, fieldName: string, fallback: string) => string;
+    /** Optional option-label translator — `useObjectLabel().fieldOptionLabel`. */
+    fieldOptionLabel?: (objectName: string, fieldName: string, optionValue: string, fallback: string) => string;
+    /**
+     * Row record providing default values for params with `defaultFromRow` set.
+     * Used by list_item actions (edit/delete dialogs) so the dialog opens with
+     * the row's current values pre-filled.
+     */
+    row?: Record<string, unknown>;
+}
+/**
+ * Resolve a single raw param against object metadata. Inline params pass
+ * through (with safe defaults); field-backed params inherit from the
+ * referenced field and accept inline overrides on top.
+ */
+export declare function resolveActionParam(param: RawActionParam, ctx: ResolveActionParamsContext): ActionParamDef;
+/** Resolve an array of raw action params. */
+export declare function resolveActionParams(params: RawActionParam[] | undefined, ctx: ResolveActionParamsContext): ActionParamDef[];
+export {};

package/dist/utils/resolveActionParams.js

@@ -0,0 +1,77 @@
+/** Normalise an options entry (allowing bare strings) into label/value pairs. */
+function normaliseOptions(options, objectName, fieldName, optionLabel) {
+    if (!Array.isArray(options) || options.length === 0)
+        return undefined;
+    return options.map((o) => {
+        const raw = typeof o === 'string' ? { label: o, value: o } : o;
+        const label = optionLabel
+            ? optionLabel(objectName, fieldName, raw.value, raw.label)
+            : raw.label;
+        return { label, value: raw.value };
+    });
+}
+/**
+ * Resolve a single raw param against object metadata. Inline params pass
+ * through (with safe defaults); field-backed params inherit from the
+ * referenced field and accept inline overrides on top.
+ */
+export function resolveActionParam(param, ctx) {
+    /** Row-context default: when `defaultFromRow` and a row is present, the
+     *  param's defaultValue is the row's value at the field key (or `name`). */
+    const rowKey = param.field ?? param.name;
+    const rowDefault = param.defaultFromRow && ctx.row && rowKey != null && Object.prototype.hasOwnProperty.call(ctx.row, rowKey)
+        ? ctx.row[rowKey]
+        : undefined;
+    // Inline param — no field reference, just normalise.
+    if (!param.field) {
+        return {
+            name: param.name ?? '',
+            label: param.label ?? param.name ?? '',
+            type: param.type ?? 'text',
+            required: param.required ?? false,
+            options: param.options,
+            placeholder: param.placeholder,
+            helpText: param.helpText,
+            defaultValue: rowDefault ?? param.defaultValue,
+        };
+    }
+    const ownerName = param.objectOverride ?? ctx.objectName;
+    const owner = ctx.objects.find((o) => o?.name === ownerName);
+    const field = owner?.fields?.[param.field];
+    if (!field) {
+        // Reference target missing — fall back to a plain text input so the
+        // action remains usable in environments where the metadata cache is
+        // partial (e.g. tests).
+        return {
+            name: param.name ?? param.field,
+            label: param.label ?? ctx.fieldLabel(ownerName, param.field, param.field),
+            type: param.type ?? 'text',
+            required: param.required ?? false,
+            options: param.options,
+            placeholder: param.placeholder,
+            helpText: param.helpText,
+            defaultValue: rowDefault ?? param.defaultValue,
+        };
+    }
+    const resolvedType = param.type ?? field.type ?? 'text';
+    const resolvedOptions = param.options
+        ?? normaliseOptions(field.options, ownerName, param.field, ctx.fieldOptionLabel);
+    const resolvedLabel = param.label
+        ?? ctx.fieldLabel(ownerName, param.field, field.label ?? param.field);
+    return {
+        name: param.name ?? param.field,
+        label: resolvedLabel,
+        type: resolvedType,
+        required: param.required ?? field.required ?? false,
+        options: resolvedOptions,
+        placeholder: param.placeholder ?? field.placeholder,
+        helpText: param.helpText ?? field.help ?? field.description,
+        defaultValue: rowDefault ?? param.defaultValue ?? field.defaultValue,
+    };
+}
+/** Resolve an array of raw action params. */
+export function resolveActionParams(params, ctx) {
+    if (!Array.isArray(params))
+        return [];
+    return params.map((p) => resolveActionParam(p, ctx));
+}

package/dist/views/ObjectView.js

@@ -26,8 +26,9 @@ import { MetadataPanel, useMetadataInspector } from './MetadataInspector';
 import { ViewConfigPanel } from './ViewConfigPanel';
 import { CreateViewDialog } from './CreateViewDialog';
 import { PageHeader } from '../layout/PageHeader';
-import { ManagedByBanner } from '../components/ManagedByBanner';
+import { ManagedByBadge } from '../components/ManagedByBadge';
 import { resolveCrudAffordances } from '../utils/crudAffordances';
+import { resolveManagedByEmptyState } from '../utils/managedByEmptyState';
 import { useObjectActions } from '../hooks/useObjectActions';
 import { useObjectTranslation, useObjectLabel } from '@object-ui/i18n';
 import { usePermissions } from '@object-ui/permissions';
@@ -37,6 +38,7 @@ import { ActionProvider, useNavigationOverlay, SchemaRenderer } from '@object-ui
 import { toast } from 'sonner';
 import { ActionConfirmDialog } from './ActionConfirmDialog';
 import { ActionParamDialog } from './ActionParamDialog';
+import { resolveActionParams } from '../utils/resolveActionParams';
 /** Map view types to Lucide icons (Airtable-style) */
 const VIEW_TYPE_ICONS = {
     grid: TableIcon,
@@ -112,7 +114,7 @@ function toSysViewPayload(config, objectName, opts = {}) {
         }
     }
     const EXTRA_CONFIG_KEYS = [
-        'bulkActions', 'rowActions', 'pagination', 'navigation',
+        'bulkActions', 'bulkActionDefs', 'rowActions', 'pagination', 'navigation',
         'emptyState', 'exportOptions', 'rowHeight',
         'isPinned', 'isDefault', 'visibility', 'sortOrder',
         'showSort',
@@ -346,7 +348,7 @@ export function ObjectView({ dataSource, objects, onEdit, externalRefreshKey })
     const [searchParams, setSearchParams] = useSearchParams();
     const { showDebug } = useMetadataInspector();
     const { t } = useObjectTranslation();
-    const { objectLabel, objectDescription: objectDesc, viewLabel, actionLabel, actionConfirm, actionSuccess } = useObjectLabel();
+    const { objectLabel, objectDescription: objectDesc, viewLabel, actionLabel, actionConfirm, actionSuccess, fieldLabel, fieldOptionLabel } = useObjectLabel();
     // Inline view config panel state (Airtable-style right sidebar)
     const [showViewConfigPanel, setShowViewConfigPanel] = useState(false);
     const [viewConfigPanelMode, setViewConfigPanelMode] = useState('edit');
@@ -483,7 +485,7 @@ export function ObjectView({ dataSource, objects, onEdit, externalRefreshKey })
     // Record count tracking for footer
     const [recordCount, setRecordCount] = useState(undefined);
     // Admin users automatically get design tools (no toggle needed)
-    const { user } = useAuth();
+    const { user, activeOrganization } = useAuth();
     const isAdmin = user?.role === 'admin';
     const { can } = usePermissions();
     // Get Object Definition
@@ -871,11 +873,24 @@ export function ObjectView({ dataSource, objects, onEdit, externalRefreshKey })
             setConfirmState({ open: true, message, options, resolve });
         });
     }, []);
-    const paramCollectionHandler = useCallback((params) => {
+    const paramCollectionHandler = useCallback((params, action) => {
         return new Promise((resolve) => {
-            setParamState({ open: true, params, resolve });
+            // List_item actions stash the row record under params._rowRecord
+            // (see ObjectGrid → onRowAction). Pull it out so resolveActionParams
+            // can pre-fill `defaultFromRow` params from the row's current values.
+            const row = action?.params && !Array.isArray(action.params)
+                ? action.params._rowRecord
+                : undefined;
+            const resolved = resolveActionParams(params, {
+                objectName: objectName || objectDef?.name || '',
+                objects: objects || [],
+                fieldLabel,
+                fieldOptionLabel,
+                row,
+            });
+            setParamState({ open: true, params: resolved, resolve });
         });
-    }, []);
+    }, [objectName, objectDef, objects, fieldLabel, fieldOptionLabel]);
     const handleDeleteView = useCallback(async (vid) => {
         if (!dataSource)
             return;
@@ -1092,10 +1107,103 @@ export function ObjectView({ dataSource, objects, onEdit, externalRefreshKey })
             navigate(url);
         }
     }, [navigate]);
+    // Authenticated fetch for direct backend calls (e.g. flow trigger,
+    // schema actions targeting absolute API paths). Declared before
+    // apiHandler so the latter can close over it.
+    const authFetch = useMemo(() => createAuthenticatedFetch(), []);
     const apiHandler = useCallback(async (action) => {
         try {
             const target = action.target || action.name;
             const params = action.params || {};
+            // Absolute HTTP target (e.g. /api/v1/auth/organization/invite-member,
+            // http://..., https://...) — bypass dataSource and call the API
+            // directly through the authenticated fetch wrapper so:
+            //   - Authorization: Bearer <token> is injected
+            //   - X-Tenant-ID is injected (multi-tenant routing)
+            //   - Same-origin cookies (better-auth.session_token) ride along
+            //
+            // This is the canonical path for schema actions on managed-by
+            // tables (sys_user/invite_user, sys_session/revoke, …) where
+            // generic CRUD does not apply.
+            const targetStr = typeof target === 'string' ? target : '';
+            const isAbsolute = targetStr.startsWith('/') || /^https?:\/\//i.test(targetStr);
+            if (isAbsolute) {
+                const baseUrl = import.meta.env.VITE_SERVER_URL || '';
+                // Row context is stashed on params under `_rowRecord` by the
+                // row-action dispatcher (see ObjectGrid → onRowAction). Pull
+                // it out before assembling the request body.
+                const rawParams = { ...params };
+                const rowRecord = rawParams._rowRecord;
+                delete rawParams._rowRecord;
+                // Interpolate `{field}` tokens in the target URL from the
+                // row record. Lets actions hit data-API endpoints like
+                // `PATCH /api/v1/sys_api_key/{id}` without bespoke wiring.
+                let resolvedTarget = targetStr;
+                if (rowRecord && /\{[a-z_][a-z0-9_]*\}/i.test(resolvedTarget)) {
+                    resolvedTarget = resolvedTarget.replace(/\{([a-z_][a-z0-9_]*)\}/gi, (_, k) => {
+                        const v = rowRecord[k];
+                        return v == null ? '' : encodeURIComponent(String(v));
+                    });
+                }
+                const url = resolvedTarget.startsWith('http') ? resolvedTarget : `${baseUrl}${resolvedTarget}`;
+                // Apply bodyShape: 'flat' (default) keeps user params at top
+                // level; { wrap: 'data' } nests them under that key while
+                // `recordIdParam` / `organizationId` stay flat (better-auth
+                // organization/update semantics).
+                const wrap = action.bodyShape && typeof action.bodyShape === 'object' && action.bodyShape.wrap
+                    ? action.bodyShape.wrap
+                    : undefined;
+                const body = wrap
+                    ? { [wrap]: rawParams }
+                    : { ...rawParams };
+                // Inject row id (or chosen row field) for list_item actions.
+                if (rowRecord && action.recordIdParam) {
+                    const rowField = action.recordIdField || 'id';
+                    const rowValue = rowRecord[rowField];
+                    if (rowValue != null)
+                        body[action.recordIdParam] = rowValue;
+                }
+                // Auto-inject organizationId only for better-auth org-scoped
+                // endpoints. Data-API endpoints (/api/v1/{object}/{id}) must
+                // NOT receive a stray organizationId field — that would try
+                // to overwrite the row's tenant column.
+                const isAuthOrgEndpoint = /\/api\/v1\/auth\//.test(resolvedTarget);
+                if (isAuthOrgEndpoint && !body.organizationId && activeOrganization?.id) {
+                    body.organizationId = activeOrganization.id;
+                }
+                // Merge static body fragment last so constants override any
+                // user-collected values (e.g. resend:true on resend-invite,
+                // revoked:true on revoke-api-key).
+                if (action.bodyExtra && typeof action.bodyExtra === 'object') {
+                    Object.assign(body, action.bodyExtra);
+                }
+                const method = (action.method || 'POST').toUpperCase();
+                const init = {
+                    method,
+                    headers: { 'Content-Type': 'application/json' },
+                    credentials: 'include',
+                };
+                // GET/DELETE conventionally have no body; for everything else
+                // we serialize. (We don't expect GET here today, but keep the
+                // guard for safety.)
+                if (method !== 'GET' && method !== 'DELETE') {
+                    init.body = JSON.stringify(body);
+                }
+                const res = await authFetch(url, init);
+                if (!res.ok) {
+                    let detail = `HTTP ${res.status}`;
+                    try {
+                        const j = await res.json();
+                        detail = j?.error || j?.message || detail;
+                    }
+                    catch { /* response body not JSON */ }
+                    return { success: false, error: detail };
+                }
+                const data = await res.json().catch(() => ({}));
+                if (action.refreshAfter !== false)
+                    setRefreshKey(k => k + 1);
+                return { success: true, data, reload: action.refreshAfter !== false };
+            }
             // Generic list-level API handler: update/execute via dataSource
             if (typeof dataSource.execute === 'function') {
                 await dataSource.execute(objectDef.name, target, params);
@@ -1112,9 +1220,7 @@ export function ObjectView({ dataSource, objects, onEdit, externalRefreshKey })
         catch (error) {
             return { success: false, error: error.message };
         }
-    }, [dataSource, objectDef.name]);
-    // Authenticated fetch for direct backend calls (e.g. flow trigger).
-    const authFetch = useMemo(() => createAuthenticatedFetch(), []);
+    }, [dataSource, objectDef.name, authFetch, activeOrganization]);
     // Flow action handler — POST to /api/v1/automation/{name}/trigger.
     // Triggered when an Action with `type: 'flow'` is invoked from list-level
     // locations (list_toolbar, list_item). For list_item the row's recordId is
@@ -1385,7 +1491,19 @@ export function ObjectView({ dataSource, objects, onEdit, externalRefreshKey })
             filterableFields: viewDef.filterableFields ?? listSchema.filterableFields,
             resizable: viewDef.resizable ?? listSchema.resizable,
             rowActions: viewDef.rowActions ?? listSchema.rowActions,
+            /**
+             * Row-context action definitions derived from `objectDef.actions`
+             * filtered by `locations.includes('list_item')`. These are full
+             * `ActionDef` records (with label/icon/variant/params/recordIdParam
+             * /bodyShape) the row menu renders with i18n-correct labels and
+             * dispatches via the action runner; legacy `rowActions: string[]`
+             * remains for back-compat where the action lives elsewhere.
+             */
+            rowActionDefs: (Array.isArray(objectDef?.actions)
+                ? objectDef.actions.filter((a) => Array.isArray(a?.locations) && a.locations.includes('list_item'))
+                : []),
             bulkActions: viewDef.bulkActions ?? listSchema.bulkActions,
+            bulkActionDefs: viewDef.bulkActionDefs ?? listSchema.bulkActionDefs,
             sharing: viewDef.sharing ?? listSchema.sharing,
             addRecord: viewDef.addRecord ?? listSchema.addRecord,
             conditionalFormatting: viewDef.conditionalFormatting ?? listSchema.conditionalFormatting,
@@ -1394,7 +1512,9 @@ export function ObjectView({ dataSource, objects, onEdit, externalRefreshKey })
             showRecordCount: viewDef.showRecordCount ?? listSchema.showRecordCount,
             allowPrinting: viewDef.allowPrinting ?? listSchema.allowPrinting,
             virtualScroll: viewDef.virtualScroll ?? listSchema.virtualScroll,
-            emptyState: viewDef.emptyState ?? listSchema.emptyState,
+            emptyState: viewDef.emptyState
+                ?? listSchema.emptyState
+                ?? resolveManagedByEmptyState(objectDef?.managedBy),
             aria: viewDef.aria ?? listSchema.aria,
             tabs: listSchema.tabs,
             // Propagate filter/sort as default filters/sort for data flow
@@ -1534,7 +1654,15 @@ export function ObjectView({ dataSource, objects, onEdit, externalRefreshKey })
             }
         },
     }), [objectDef.name, onEdit, activeView?.showSearch, activeView?.showFilters, activeView?.showSort, navigate, viewId, isAdmin]);
-    return (_jsxs(ActionProvider, { context: { objectName: objectDef.name, user: currentUser }, onConfirm: confirmHandler, onToast: toastHandler, onNavigate: navigateHandler, onParamCollection: paramCollectionHandler, handlers: { api: apiHandler, flow: flowHandler, script: serverActionHandler, modal: serverActionHandler }, children: [_jsxs("div", { className: "h-full flex flex-col bg-background min-w-0 overflow-hidden", children: [_jsx(ManagedByBanner, { managedBy: objectDef?.managedBy }), _jsx(PageHeader, { title: objectLabel(objectDef), description: objectDef.description ? objectDesc(objectDef) : undefined, icon: (() => { const I = getIcon(objectDef?.icon); return _jsx(I, { className: "h-4 w-4" }); })(), actions: _jsxs(_Fragment, { children: [affordances.create && can(objectDef.name, 'create') && (_jsxs(Button, { size: "sm", onClick: actions.create, className: "shadow-none gap-1.5 sm:gap-2 h-8 sm:h-9", children: [_jsx(Plus, { className: "h-4 w-4" }), _jsx("span", { className: "hidden sm:inline", children: t('console.objectView.new') })] })), affordances.import && can(objectDef.name, 'create') && (_jsxs(Button, { size: "sm", variant: "outline", onClick: () => setShowImport(true), className: "shadow-none gap-1.5 sm:gap-2 h-8 sm:h-9", title: t('console.objectView.importTitle'), "data-testid": "object-view-import-button", children: [_jsx(Upload, { className: "h-4 w-4" }), _jsx("span", { className: "hidden sm:inline", children: t('console.objectView.import') })] })), objectDef.actions?.some((a) => a.locations?.includes('list_toolbar')) && (_jsx(SchemaRenderer, { schema: {
+    return (_jsxs(ActionProvider, { context: {
+            objectName: objectDef.name,
+            user: currentUser,
+            // Expose active org so `type: 'url'` actions can template
+            // `/organizations/${activeOrganization.slug}/...` etc.
+            activeOrganization: activeOrganization
+                ? { id: activeOrganization.id, slug: activeOrganization.slug, name: activeOrganization.name }
+                : null,
+        }, onConfirm: confirmHandler, onToast: toastHandler, onNavigate: navigateHandler, onParamCollection: paramCollectionHandler, handlers: { api: apiHandler, flow: flowHandler, script: serverActionHandler, modal: serverActionHandler }, children: [_jsxs("div", { className: "h-full flex flex-col bg-background min-w-0 overflow-hidden", children: [_jsx(PageHeader, { title: _jsxs("span", { className: "inline-flex items-center gap-2", children: [_jsx("span", { className: "truncate", children: objectLabel(objectDef) }), _jsx(ManagedByBadge, { managedBy: objectDef?.managedBy })] }), description: objectDef.description ? objectDesc(objectDef) : undefined, icon: (() => { const I = getIcon(objectDef?.icon); return _jsx(I, { className: "h-4 w-4" }); })(), actions: _jsxs(_Fragment, { children: [affordances.create && can(objectDef.name, 'create') && (_jsxs(Button, { size: "sm", onClick: actions.create, className: "shadow-none gap-1.5 sm:gap-2 h-8 sm:h-9", children: [_jsx(Plus, { className: "h-4 w-4" }), _jsx("span", { className: "hidden sm:inline", children: t('console.objectView.new') })] })), affordances.import && can(objectDef.name, 'create') && (_jsxs(Button, { size: "sm", variant: "outline", onClick: () => setShowImport(true), className: "shadow-none gap-1.5 sm:gap-2 h-8 sm:h-9", title: t('console.objectView.importTitle'), "data-testid": "object-view-import-button", children: [_jsx(Upload, { className: "h-4 w-4" }), _jsx("span", { className: "hidden sm:inline", children: t('console.objectView.import') })] })), objectDef.actions?.some((a) => a.locations?.includes('list_toolbar')) && (_jsx(SchemaRenderer, { schema: {
                                         type: 'action:bar',
                                         location: 'list_toolbar',
                                         actions: (objectDef.actions || []).map((a) => ({