@object-ui/app-shell 7.0.0 → 7.2.0

package/CHANGELOG.md

@@ -1,5 +1,565 @@
 # @object-ui/app-shell — Changelog
 
+## 7.2.0
+
+### Minor Changes
+
+- 88a3e39: feat(console): born-with-env eager provisioning for multi-org workspace create
+
+  ObjectStack runs a 1-production-environment-per-organization model: a user who wants
+  another production space creates another organization, and each org is born with its
+  production environment. The self-service "create workspace" flow now delivers that
+  without an onboarding-wizard detour.
+
+  After `createOrganization` succeeds (which already switches the active org),
+  `CreateWorkspaceDialog` eagerly `POST`s `/api/v1/cloud/environments` with the new org as
+  target so its first environment is provisioned as a production env (allowed on every plan,
+  including free), then hands off to the existing switch-and-navigate-home path. The
+  provision is best-effort: on failure the onboarding gate provisions the env lazily on
+  first navigation, so multi-org still works. The `multiOrgEnabled` enable-gate is unchanged
+  (already wired end-to-end via the auth `/config` `features.multiOrgEnabled` flag).
+
+  Adds a gated **"Create workspace"** entry to the org switcher (avatar dropdown) that
+  opens the dialog directly — previously a single-org user could never reach it, because
+  the only path (`/organizations`) auto-skips to home when you belong to exactly one org.
+  The eager provision is idempotent: a control plane that auto-provisions the production
+  env on org create resolves it to "already provisioned" rather than erroring.
+
+  Also removes the unreferenced `apps/console` `CreateWorkspaceDialog` duplicate; the live
+  component is the app-shell copy used by `OrganizationsPage`.
+
+- e301475: feat(console): hide the AI surface at runtime when the server serves no AI agent (Community Edition)
+
+  A self-host Community Edition runtime (framework + this MIT console, without the
+  cloud `@objectstack/service-ai-studio` package) serves no `ask`/`build` agent.
+  The console now hides every AI entry point via runtime, server-pushed gating —
+  no build-time edition flag, no tree-shake.
+
+  Crucially, gating is driven off the **agent catalog** (`GET /api/v1/ai/agents`),
+  not the discovery `services.ai` flag: the open-source framework keeps a headless
+  `@objectstack/service-ai` that still reports `services.ai` as available, so a CE
+  runtime can report AI "available" while serving zero agents. The catalog is the
+  real "is there an agent to answer?" signal.
+
+  - New `useAiSurfaceEnabled()` hook + `RequireAiSurface` route guard (exported).
+  - `/ai*` routes redirect to home when no agent is served; the FAB, top-bar AI
+    link and the metadata designers' "Ask AI" buttons hide; `AiChatPage` shows a
+    graceful "AI unavailable" state instead of an agent-less echo chat.
+  - Fully additive for cloud installs — when an agent is served, every AI surface
+    renders and works as before.
+
+- 616157a: feat(studio): multi-hop relationship fields in the dataset designer (ADR-0071)
+
+  The dataset designer's field catalog and Included-relationships picker now
+  support multi-hop relationship paths (`account.owner.region`), matching the
+  framework's multi-hop join support (ADR-0071 P2):
+
+  - `useDatasetFieldCatalog` walks each included path hop-by-hop, fetching every
+    object along the chain, so `path.field` options surface for fields two–three
+    to-one hops deep (grouped under a chained `Account → Owner → User` heading).
+  - The Included-relationships combo offers one level deeper along each
+    already-included path (drill `account` → `account.owner`), capped at 3 hops.
+  - The author-time "relationship not in Included" warning generalizes to the full
+    relationship path (`account.owner`), with one-click "Add it".
+
+  Single-hop datasets are unchanged.
+
+- 6668759: feat(console): entitlement- & state-aware environment actions
+
+  The `sys_environment` list now presents the right create affordance for the
+  org's state (born-with-env) instead of POST-then-error:
+
+  - **No production env** (historical orgs) → "Set up your production environment";
+    the create POST provisions the org's one production env — this path never errors.
+  - **Has prod env, free plan** → an "Add environment" button that opens a friendly
+    upgrade prompt (CTA to billing) instead of POSTing into a 403.
+  - **Has prod env, paid plan** → "Add development environment" creates a dev env.
+
+  The action runtime's `apiHandler` now also turns the cloud env-create entitlement
+  403s (`DEV_ENV_PLAN_LOCKED` / `DEV_ENV_LIMIT` / `PRODUCTION_ENV_LIMIT`) into a
+  friendly upgrade/limit dialog with a CTA rather than a red error toast — a safety
+  net that covers any path. State is resolved from the new org-scoped
+  `GET /cloud/environment-entitlements` summary, with a row-derived `hasProductionEnv`
+  fallback so the production-setup path works even against an older control plane.
+
+- 41c60c4: Flow builder: variable data-picker for expression / template config fields. Expression and template surfaces (decision Branches, edge Condition, Assignment values, Screen description, CRUD field values / filter, subflow / script inputs) now show a "{x}" picker listing the references in scope at that node — flow variables, upstream node outputs, the trigger record's fields, and any enclosing loop item — resolved graph-aware by walking the flow back from the node. Selecting a reference inserts the correctly-braced token at the cursor (bare CEL in `expression` fields, `{var}` in template fields), handling the ADR-0032 brace-in-CEL trap for the author. Free-text typing is unchanged and an empty scope degrades to a plain input.
+- d23db5c: feat(detail): related-list add-by-picker (generic m2m/junction) + a generic "Assigned Users" management UI on permission sets (assign ai_seat and any role with zero bespoke CRUD; server-side cap errors surface inline).
+
+### Patch Changes
+
+- 81ad9aa: feat(studio): package lifecycle UI — Duplicate base, Adopt loose items, structure-only delete (ADR-0070 D4/D5/D6)
+
+  `PackageDetailSheet` gains the user-facing affordances for the package-as-
+  lifecycle-unit work:
+  - **Duplicate** → `POST /packages/:id/duplicate` (clone a base into a new
+    writable package; D4).
+  - **Adopt loose items** → `POST /packages/:id/adopt-orphans` (migrate every
+    package-less orphan into this base; D5).
+  - **Delete** now asks whether to drop records too (`?keepData`) — structure-only
+    vs everything (D4 Q3).
+
+  D6 guardrail test: the scope selector never defaults to the package-less
+  `Local / Custom` sentinel (`writableBaseOptions` excludes it; real bases sort
+  first).
+
+- 4b1cb7a: feat(studio): package-first create flow — prompt or redirect to a writable base (ADR-0070 D3)
+
+  Studio's create entry points no longer let a new metadata item land in a code
+  package or the package-less "Local / Custom" bucket. ResourceListPage's create
+  gate (`handleCreate`) now: opens the create-base dialog when no writable base
+  exists; redirects into the first base when the active scope is Local/none but
+  bases exist; otherwise proceeds normally. Adds package-scope helpers
+  (`isLocalScope` / `writableBaseOptions`) with tests, surfaces the kernel's
+  `writable_package_required` (422) as an actionable error in ResourceEditPage,
+  and exports `CreatePackageDialog` from PackagesPage for reuse.
+
+- 8c2191d: fix(console): polished, localized "Assigned Users" management for permission sets — resolves users to name/email (no raw id), zh/en localized, friendly inline cap message (drops the dev `[Tag]` prefix), people-rows with visible remove + add-via-picker.
+- 6028192: fix(console): gate the AI surface on the access-filtered agent catalog (per-user), not the deployment-wide service-ai capability
+
+  `useAiSurfaceEnabled` keys off `GET /api/v1/ai/agents` again (>= 1 agent → AI shows), reverting objectui#1992. The agent-catalog route is now access-filtered server-side (ADR-0049 / ADR-0068): it returns only the agents the caller may chat, so a user WITHOUT the per-user AI seat (`ai_seat`) gets an empty catalog and the whole AI surface (FAB, `/ai` routes, top-bar + designer "Ask AI") hides for them — instead of showing a control that 403s on click. The discovery `services.ai` flag is deployment-wide and cannot express per-user seating, so it is the wrong signal for the AI-seat gate. Community-Edition gating is unaffected: no service-ai → no agents → empty catalog → hidden.
+
+- e575da0: fix(ai): stop the AI composer placeholder doubling to "Ask Ask…" for the Ask agent
+
+  The composer placeholder is `Ask {agent}…`, which reads fine for most agents
+  ("Ask Build…") but doubles to "Ask Ask…" for the data-query agent whose label is
+  literally "Ask". The Ask agent now uses its purpose-built placeholder
+  (`console.ai.askAnything` → "Ask anything…", already localized) instead. Found
+  dogfooding the AI Ask flow.
+
+- cde7502: fix(form): create/edit record modal now honors the object's default form view
+
+  The "New <object>" modal (and the modal edit form) rendered every field from
+  the raw object schema, in schema order — ignoring the curated sections + field
+  selection/order defined in the object's default FORM VIEW. Customizing the form
+  view (section grouping, field selection/order) had no effect on the create
+  modal; only `tabbed` views were partially honored, while a `simple` view with
+  curated sections was dropped entirely.
+
+  New `resolveFormViewLayout(objectDef)` helper resolves the default form view
+  (`objectDef.form ?? formViews.default`) into the modal's layout props (curated
+  `sections`, `contentLayout: 'tabbed'`, and master-detail `subforms`), mirroring
+  the full-screen `RecordFormPage`. It is wired into:
+
+  - the global New/Edit `ModalForm` in `AppContent` (replacing the tabbed-only
+    inline logic so `simple` sectioned views are honored too), and
+  - `useActionModal` (action-opened forms), which previously passed no
+    `fields`/`sections` and so fell back to the whole object schema.
+
+  When the object declares no form view — or one without sections — the modal
+  keeps its prior flat-field behavior. Frontend-only.
+
+- 0d8dbda: fix(metadata-admin): dataset filter builder ignores incomplete conditions
+
+  `groupToCondition` emitted a condition for any row that had a `field`, even when
+  its value was still blank — producing a silently-wrong filter like
+  `{ organization_id: { $eq: "" } }` (matches only empty → excludes everything)
+  instead of "no filter". Now rows with an empty/`undefined`/`[]` value are skipped
+  (value-less operators like is-empty / is-not-empty are still kept). Applies to both
+  the dataset Scope filter and per-measure filters. Found by dogfooding.
+
+- e8c1c85: fix(metadata-admin): re-base a dataset when its base object changes
+
+  A dataset's joins (`include`), dimensions, measures, and filter all reference the
+  base object's fields. Changing the base object left those referencing the OLD
+  object — stale field refs that silently produce broken/ambiguous queries. Now a
+  real object change clears the object-dependent config (selecting the same object
+  is a no-op), and a heads-up note appears while there is config that a change would
+  clear. Found by dogfooding (G1).
+
+- 0119ff4: Designer derives create defaults from the spec's create seed (/meta/types)
+
+  The metadata create flow now builds a new item's body from the server's authoritative `createSeed` (delivered per type on the `/meta/types` registry entry — the single source of truth in `@objectstack/spec`) instead of the locally hardcoded `createDefaults`, falling back to `createDefaults` when the server provides no seed (older server, or canvas-create types). This closes the drift loop behind the "designer emits a minimal shape the spec rejects → create→save 422" family (dashboard `layout`, action `body`): the structural create defaults now come from the same place the spec validates against, so they cannot diverge. Extracted as the pure, unit-tested `buildCreateModeBody`.
+
+- 8e7c1da: fix(preview): draft-preview bar no longer demands a redundant Publish when nothing is pending
+
+  Under the auto-publish posture an AI build leaves zero pending drafts, yet opening a
+  draft preview still showed "Draft preview — Nothing here is live until you publish."
+  alongside "Changes (0)" and a Publish button — a self-contradicting, no-op call to
+  action. `DraftPreviewBar` now reflects the real pending-draft count: when it is
+  known to be zero the bar softens to a neutral preview indicator and drops the
+  Publish/Changes affordances; an unknown count (still loading / fetch failed) keeps
+  the publish path. `HomePage` (count-gated) and `RuntimeDraftBar` (draft-gated)
+  already behaved this way — this aligns the third surface.
+
+- 522a54c: feat(studio): make the flow-canvas error banner clickable
+
+  The inline structural-error banner (ADR-0044 cycle surfacing) is now driven by
+  the unified `problems` list, and each row with a concrete target is clickable —
+  clicking it selects and pans-to-reveal the offending node/edge (the same reveal
+  the Problems panel performs). So the always-visible banner is actionable without
+  opening the panel. Drops the now-redundant `validationErrors` string prop: the
+  banner, the Problems panel, and the on-canvas badges all share one source.
+
+- cdc6246: Flow builder (#1934): expression problems — ADR-0032 brace/shape errors and scope-aware "unknown reference" warnings — now also surface in the flow **Problems panel** and as on-canvas **node/edge badges** (#1972), not just inline in the inspector. A `{record.x}` brace-in-CEL mistake or a typo'd variable is now visible at the flow level without opening each node. The start node's bare trigger-record fields are excluded from the ref check to avoid false positives (the inline inspector check still covers them).
+- 7fe2735: Flow builder data-picker (#1934): the cursor-insertion math is extracted into a pure `insertToken` helper with unit tests (alongside `formatToken`) — bare CEL vs `{var}` template insertion, append / mid-string / selection-replace, and clamping a reversed or out-of-range selection. Pure refactor, no behavior change.
+- 3f529a8: refactor(studio): derive the flow red-error highlight from the unified problem list (one validateFlowDraft pass)
+
+  Follow-up to #1972 (Problems panel + badges) and #1976 (clickable banner). The
+  flow preview still ran `validateFlowDraft` twice per render — once in
+  `buildFlowProblems` (badges / banner / panel) and again in a separate memo that
+  derived the red node/edge ring/stroke — with the cycle-highlight logic duplicated
+  between them.
+
+  `buildFlowProblems` is now the single validation pass: a new
+  `deriveInvalidElements(problems)` produces the red error set (errors only; a
+  cycle paints its whole loop via a per-problem `highlight` set while its badge +
+  reveal stay on the closing edge). The preview drops its second `validateFlowDraft`
+  call. The clickable banner (#1976), badges, and panel are unchanged — all four
+  surfaces now derive from one list, so they cannot drift.
+
+- 0b9c96c: Flow builder data-picker follow-ups (#1934): (1) a scope-aware "unknown reference" warning pairs the picker with inline validation — a typed reference whose root isn't in scope at the node is flagged with a nearest-match "did you mean?" hint (conservative: root-only, skips function calls / string literals / runtime globals; non-blocking amber). (2) Assignment values authored in the array form `[{ variable, value }]` now render in the key/value editor (and get the picker) instead of falling back to Advanced JSON; the editor reads both the object-map and array shapes and preserves whichever was authored. (3) A script `code` body (JS/TS, not a `{var}` template) now inserts bare references via a `refMode` field override — `{x}` is a syntax error in a script.
+- 47537fe: Flow builder data-picker (#1934): inline validation now also shows on the repeater surfaces that carry the picker — decision **Branches** expressions, screen field **"visible when"**, and key/value **values** — not just single fields. Each shows the ADR-0032 brace error (red) or a scope-aware "unknown reference" warning (amber) via a shared `FlowExprIssue` line. The trigger-record picker also offers `previous.<field>` references on update / change / before-update triggers.
+- 17ba30d: feat(studio): on-canvas validation badges + a Problems panel for the flow builder
+
+  Flow validation only surfaced as a top banner ("…N error(s)") that didn't point
+  to the offending element — in a non-trivial flow you couldn't tell _which_ node
+  or edge was wrong. The simulator's `validateFlowDraft` already detected the
+  structural problems (no resolvable entry, unreachable nodes, a decision with no
+  default branch, duplicate node ids, dangling edges, un-declared cycles); they
+  just weren't shown on the canvas. This was a surfacing gap, not a detection one.
+
+  The flow preview now:
+
+  - renders an error / warning **badge** on each offending node and edge, with the
+    issue message(s) as its tooltip;
+  - adds a **Problems panel** listing every issue (structural + the server
+    `_diagnostics` already attached to the layered record); clicking a row selects
+    and reveals (pans to) the node/edge;
+  - clears badges + rows as issues are resolved (everything derives from the live
+    draft).
+
+  `validateFlowDraft` now tags dangling-edge errors with their endpoints so they
+  key to the offending connection, and a new `flow-problems` module maps both
+  sources onto concrete canvas elements (node id / stable edge key). Server
+  diagnostics reach the preview through a new optional `diagnostics` prop on
+  `MetadataPreviewProps`.
+
+- 104d181: fix(studio): flow wait-node inspector tolerates the loose `config` shape
+
+  The wait-node property form read only the spec-canonical
+  `waitEventConfig.{eventType,signalName,…}`, but the engine also accepts a looser
+  `config.{eventType,…}` shape — which the canonical `showcase_budget_approval`
+  (and AI-authored flows) use. So a showcase-shaped wait node opened in the
+  designer showed blank "Wait for" / "Signal name" fields.
+
+  Flow config fields gain an optional `fallbackPath`: reads fall back to it (so
+  loose-shape wait nodes display, and dependent fields reveal), writes target the
+  canonical path and prune the fallback (migrate-on-edit), and the fallback's
+  config key is suppressed from the Advanced block. The `wait` fields now fall
+  back to `config.*`, so the designer matches the engine's tolerance. Pairs with
+  the ADR-0044 revise-loop authoring (#1954).
+
+- 1fa5982: fix(studio): preview joined reports in the report editor (was "design blind")
+
+  Found dogfooding report design in Studio as a business user. The report editor's
+  live preview only rendered single dataset-bound reports — a `joined` report
+  (which carries its data on `blocks`, with no top-level `dataset`) fell through to
+  the "Bind a dataset to preview this report" empty state, so an author building a
+  joined report saw nothing and designed blind.
+
+  `ReportPreview` now renders a joined report (≥1 dataset-bound block) through the
+  same runtime `ReportRenderer` (→ `DatasetReportRenderer`, which already stacks
+  the blocks), keeping the preview pixel-equal with the runtime, and shows a
+  joined-aware empty state ("Add a block…") when no block is bound yet.
+
+- Updated dependencies [8e7c1da]
+- Updated dependencies [cf746c9]
+- Updated dependencies [d23db5c]
+  - @object-ui/i18n@7.2.0
+  - @object-ui/auth@7.2.0
+  - @object-ui/types@7.2.0
+  - @object-ui/components@7.2.0
+  - @object-ui/fields@7.2.0
+  - @object-ui/react@7.2.0
+  - @object-ui/collaboration@7.2.0
+  - @object-ui/core@7.2.0
+  - @object-ui/data-objectstack@7.2.0
+  - @object-ui/layout@7.2.0
+  - @object-ui/permissions@7.2.0
+  - @object-ui/plugin-editor@7.2.0
+  - @object-ui/providers@7.2.0
+
+## 7.1.0
+
+### Minor Changes
+
+- 7b5d0f0: Build-history timeline + revert UI for AI builds (ADR-0067)
+
+  The unpublished-app banner gains a **History** button that opens a commit timeline (`GET /packages/:id/commits`): every change an AI build/edit landed, newest-first, with **Revert** per apply commit (`POST /packages/:id/commits/:cid/revert`). The history-not-confirm model — review the timeline and revert, instead of approving each publish.
+
+  - `commitHistory.ts` — `fetchCommits` / `revertCommit` helpers.
+  - `CommitTimeline.tsx` — slide-over panel (sibling of `DraftChangesPanel`).
+  - `UnpublishedAppBar` — History button + timeline mount (package-scoped).
+
+- 7cd950e: feat(metadata-admin): dataset create opens the rich designer + dual-axis preview
+
+  - **Create → rich designer.** `dataset` joins `object` / `report` in
+    `CREATE_MODE_CANVAS_TYPES`, so "New dataset" opens the structured designer
+    (base-object picker, joins, dimension/measure editors, live preview) instead
+    of the degraded generic SchemaForm. `DatasetDefaultInspector` gains a
+    create-mode **Name** field that auto-derives a snake_case identifier from the
+    label until edited (mirrors `ReportDefaultInspector` / `ObjectDefaultInspector`),
+    so a dataset created through the canvas saves with a valid identity instead of
+    dead-ending.
+  - **Mixed-scale preview.** When a dataset preview mixes a ratio/percent measure
+    (e.g. `utilization`, `0.0%`) with magnitude measures (currency in the
+    hundred-thousands), the ratio measures now plot as a line on a secondary
+    (right) Y axis via the existing `combo` chart — they're no longer crushed to an
+    invisible sliver beside the large bars. Same-scale selections stay a plain bar
+    chart.
+
+- fccebfe: feat(metadata-admin): visual filter authoring in the dataset designer
+
+  The dataset designer gains a visual filter editor (reusing the shared
+  `FilterBuilder`) for both the dataset-level **Scope filter** (`dataset.filter`)
+  and per-measure **Filter** (`measure.filter`) — previously only settable via the
+  raw Source/JSON tab. Both are backed by real runtime: the analytics executor ANDs
+  the scope filter into every query and runs measure-scoped filters as supplementary
+  grouped queries, so e.g. `won_amount = sum(amount) where stage = won` and an
+  "exclude archived" dataset scope are now authorable without hand-writing JSON.
+
+  A small, unit-tested converter bridges the builder's flat `{field, op, value}`
+  group ⇄ the spec `FilterCondition` (Mongo-style `$and` / `$op`). Conditions it
+  can't faithfully round-trip (nested groups, `$or`, multi-operator objects) are
+  detected and shown as "edit in Source" rather than being silently rewritten.
+
+- 0acf0c8: feat(metadata-admin): friendlier + safer dataset measure authoring
+
+  The `dataset` designer's measure editor gets three improvements so a business
+  user can author measures without spec knowledge and without saving a broken
+  dataset:
+
+  - **Display-format picker** — replaces the raw `format` / `currency` numeral
+    text inputs with a structured Kind (Raw / Number / Currency / Percent) +
+    Decimals + Currency selection and a live sample (e.g. `US$1,234.50`). Parses
+    an existing format string back into the picker, so editing an existing measure
+    round-trips.
+  - **Auto-name from field** — picking a dimension/measure field when the row is
+    still unnamed defaults the name to the field's leaf (`account.region` →
+    `region`).
+  - **Author-time validation** — a `relationship.field` dimension/measure whose
+    relationship isn't in `include` now shows an inline warning with a one-click
+    "Add it", catching at design time the "relationship not declared in include"
+    error that previously only surfaced when the live preview query ran. A derived
+    measure with too few operands is flagged too.
+
+- 3e1fcf5: feat(chatbot): reveal the Build/Ask switcher in the app floating assistant when AI dev is unlocked
+
+  The bottom-right FAB assistant bound each app to a single agent and hid the
+  agent picker unless `VITE_AI_SHOW_AGENT_PICKER` was set, so a user on an
+  AI-unlocked environment could not switch from `ask` (read-only data/query) to
+  `build` (authoring) without leaving for the full `/ai` page.
+
+  The picker now auto-reveals when AI development is unlocked for the viewer — the
+  live agent catalog serves BOTH an `ask` and a `build` agent (alias-aware, so
+  legacy `data_chat`/`metadata_assistant` count) AND authoring isn't
+  deployment-disabled (`aiStudio`). Pure end-user apps (only `ask`) stay clean and
+  never see a picker. An explicit `showAgentPicker` prop or
+  `VITE_AI_SHOW_AGENT_PICKER` still forces it on.
+
+- e2b0072: Flow builder: live preview for Screen nodes (#1944)
+
+  Screen-flow nodes were authored blind — there was no way to see the form an end user would get, and the Debug simulator showed only `paused` when it reached a screen. Add a live preview that renders the screen exactly as it runs.
+
+  The runtime `FlowRunner`'s screen body (flat input fields + object-form mode) is extracted into a shared `ScreenView`, so the preview reuses the **same** renderer as runtime and can't drift (the design↔runtime divergence #1927 fixed). A new `ScreenPreview` builds a `ScreenSpec` from the node's authored `config` and feeds it to `ScreenView`.
+
+  - Reflects `title`, `description` (with `{var}` interpolation), input `fields`, and object-form mode (`objectName` / `mode` / `defaults`, rendered via `plugin-form`'s `ObjectForm`).
+  - Updates live as the node config changes.
+  - Two homes: the **flow node inspector** (interpolates against the flow's declared variable defaults) and the **Debug simulator** when paused at a screen (interpolates against the live simulated run state, replacing the bare `paused`).
+
+- 780cabc: feat(studio): add a "Local / Custom (this env)" scope to the package selector
+
+  In a self-hosted, metadata-customizable environment (single-tenant — no org
+  dimension), the package selector only listed code packages, so metadata authored
+  at runtime (`package_id = null` / `sys_metadata` provenance) was filtered out of
+  every code-package view and became un-navigable — opening such an item redirected
+  to "new". This complements framework #2252 + objectui #1937, which stop runtime
+  metadata from being stamped into a loaded code package and keep it editable.
+
+  - Surface a stable, always-present "Local / Custom (this env)" entry in the
+    Studio package context-selector (`ContextSelectors`), mapped to the
+    `sys_metadata` scope the metadata list/get API already understands.
+  - Accept that scope in the metadata-admin pages (`StudioHomePage`,
+    `DirectoryPage`, `ResourceListPage`) via a shared `buildPackageScopeOptions`
+    helper, so it no longer redirects, and the list shows this environment's
+    runtime-authored items (`package_id = null`).
+  - On the Studio home grid, the Local scope shows every runtime-creatable type so
+    the user can start authoring locally even with zero items yet.
+
+- 93cf2b1: feat(studio): preview record pages against a real sample record
+
+  The Studio page editor's Preview tab rendered a `type: 'record'` page's
+  `record:*` blocks (details / highlights / path / alert / quick_actions) as the
+  "bind a record to preview" placeholder — the metadata editor has no record
+  route, so the author designed blind.
+
+  The preview now fetches a handful of real records of the bound object (with
+  lookup / master_detail fields `$expand`ed so they show display names, not raw
+  foreign-key IDs), auto-binds the first one, and wraps the canvas in a
+  `<RecordContextProvider>` — mirroring the runtime `RecordDetailView`. A
+  "Preview record" dropdown lets the author switch records, so `visible` CEL
+  expressions (e.g. `record.status == 'in_review'`) and per-record field values
+  re-render live.
+
+### Patch Changes
+
+- 68d82ae: New script action seeds a valid body; add create-roundtrip conformance guard
+
+  A new action defaults to `type: 'script'`, which the spec requires to carry an executable `body` or `target` — the create form seeded neither, so "New action → Save" failed validation (422). Seed a no-op L2 body in `createDefaults` so the default create round-trips. Adds a conformance guard that asserts every authorable type's default create-form output passes spec validation (catches the "designer minimal shape ≠ spec required" family before it ships).
+
+- aae8791: Flow Screen preview: render inline master-detail subforms (follow-up to #1944)
+
+  The object-form mode of the Screen-node preview now renders inline master-detail
+  child grids, matching runtime. `ScreenPreview` feeds the SAME enriched object
+  list the runtime `FlowRunner` uses (`useMetadata().objects`, which derives
+  `form.subforms` from `inlineEdit` relationships via `attachInlineSubforms`), so
+  e.g. a `showcase_invoice` object-form step previews its **Line Items** grid
+  (with live Subtotal/Tax/Total) — only fetched in object-form mode.
+
+  To keep the preview non-persisting — consistent with the flat-field preview
+  (disabled Submit) and the simple object-form preview (no Save) — `MasterDetailForm`
+  now honours a `showSubmit` flag (default shown; backward-compatible) that
+  `ObjectForm` forwards, so the preview hides the master-detail Save bar. Also drops
+  a dead `e = formData` assignment in `ObjectForm` (lint `no-useless-assignment`).
+
+- 4014bc9: Flow Screen preview: gate fields by `visibleWhen` (follow-up to #1944)
+
+  The Screen-node preview now evaluates each input field's `visibleWhen` against
+  the active variables — reusing the simulator's own condition evaluator
+  (`evalCondition`), normalising `{var}` placeholders to bare identifiers — so it
+  hides/shows conditional fields exactly as the runtime `screen` executor does
+  (which filters server-side before emitting the `ScreenSpec`).
+
+  - Debug simulator (live run state): gates faithfully, e.g. a screen whose
+    `opportunityName`/`opportunityAmount` are `visibleWhen: "{createOpportunity} == true"`
+    hides them while `createOpportunity` is false.
+  - Inspector (no run state): fails open — an unparseable or not-yet-decidable
+    condition keeps the field visible, so configured fields are never hidden on
+    missing data — and a footnote reports how many fields are gated out.
+
+- d27f045: fix(metadata-admin): remove the unwired "Certified" measure toggle from the dataset designer
+
+  `measure.certified` is dead in the spec liveness ledger (declared but read by
+  nothing — no certifier authority, no provenance, not surfaced at point-of-use).
+  A self-asserted checkbox the dataset author flips on their own work isn't
+  certification — it's a fake trust signal. Drop the toggle (and the create
+  default) until real metric governance exists (separate `dataset.certify`
+  authority + `certifiedBy`/`certifiedAt` + a badge where reports pick measures).
+  The spec field stays (dormant, liveness=dead) so existing data is untouched.
+
+- d23ed60: feat(studio): author the approval revise loop in the flow designer (ADR-0044)
+
+  The ADR-0044 send-back-for-revision loop — an approval node's `revise` out-edge to a wait point, closed by a declared `type: 'back'` edge re-entering the approval (round N+1) — was previously reachable only by hand-editing flow JSON. The flow designer now authors it visually:
+
+  - **Revise branch** — an approval out-edge offers `approve` / `reject` / `revise` via a new Approval-branch picker in the edge inspector; `maxRevisions` surfaces on the approval node's property form (from the engine's published configSchema when online, with a hardcoded fallback offline).
+  - **Back-edge authoring** — a new Connection-type select marks an edge as `back` (also `fault` / `conditional`). A back-edge renders distinctly on the canvas as a dashed amber return arc and is excluded from the layered auto-layout (exactly as the engine excludes it from DAG validation), so the loop reads top-to-bottom instead of dragging its target node below the wait point.
+  - **Client-side DAG validation** — the simulator's preflight now flags an UNmarked cycle as an error (the graph minus declared back-edges must be a DAG, mirroring `registerFlow`), while a declared revise loop passes and a self-loop is caught.
+  - **One-click "add revision loop"** — an amber affordance on an approval node drops the signal `wait` node + the `revise` edge + the declared `back` edge in a single gesture, reproducing the canonical `showcase_budget_approval` shape.
+
+  Refs framework#1770. Follows the flow-builder work in #1927 and #1930.
+
+- 47c6e25: fix(studio/flow): wire decision branches to edges, expand screen config, align simulator with engine
+
+  Four fixes for the Studio Flow Builder, found dogfooding it as a business user:
+
+  - **Decision branches now route.** The "Branches" editor wrote `node.config.conditions`
+    but never the outgoing edges, so a decision built entirely in Studio left every
+    out-edge unconditional — the engine and simulator (which branch on `edge.condition`)
+    ran _all_ branches. Branches now mirror onto the node's out-edges (by order):
+    `FlowCanvas.addNode` carries the matching branch onto a newly-connected edge, and
+    `FlowNodeInspector` re-syncs existing edges when branches are edited (a `true`
+    expression marks the default/else edge).
+  - **Screen node config expanded.** The form exposed only `fields`; it now also edits
+    `title`, `description` (interpolates `{var}`), `waitForInput`, and the object-form
+    keys (`objectName`, `idVariable`, `mode`, `defaults`) — so a message screen or an
+    object-form wizard step no longer requires dropping to Advanced JSON.
+  - **Simulator applies assignment nodes.** Assignment was a no-op pass-through, so a
+    Debug run never reflected `Set variables`. It now normalizes the same shapes the
+    engine accepts (`assignments` map/array + flat) and interpolates `{var}`.
+  - **Simulator screen-pause parity.** The simulator paused on every screen; it now
+    pauses only when the screen collects input (`fields`) or sets `waitForInput`,
+    matching the engine's `shouldPause` — a field-less screen passes through.
+  - **Palette HTTP de-duplicated.** The base palette hardcoded the deprecated
+    `http_request` alias while the engine publishes the canonical `http`, showing
+    two HTTP entries. The base now uses `http` (merging into one), aliased to the
+    `http_request` config form so the inspector is unchanged.
+
+- 4c2f910: feat(studio): surface flow validation errors inline on the canvas
+
+  The flow designer's structural validation (an un-declared cycle, missing entry node, duplicate ids, dangling edges, …) was only visible in the Debug panel. It now surfaces **inline on the canvas**: an un-declared cycle paints its offending edges + nodes red — using the same `validateFlowDraft` the simulator preflight runs — and an error banner lists the messages, so the author sees a broken graph without opening Debug. Each edge that closes the cycle carries a tooltip pointing at the fix ("mark the edge that closes the loop as a back-edge"). A declared revise loop (ADR-0044 back-edge) is excluded from cycle detection and stays un-flagged.
+
+  Follows #1954 (revise-loop authoring) and #1955 (simulating approval decisions).
+
+- 1b3ccd1: feat(studio): simulate approval decisions in the flow debugger
+
+  The designer-time flow simulator treated an `approval` node as a pass-through that fanned out to every out-edge at once — so an ADR-0044 revise loop couldn't be debugged: it walked approve / reject / revise simultaneously and hit the step ceiling on the back-edge.
+
+  The simulator now models an approval as a durable pause (like `wait` / `screen`): it suspends at the node, and the Debug panel offers the node's out-edge labels (`approve` / `reject` / `revise`) as decision buttons. Resuming routes down ONLY the chosen branch — mirroring how the engine resumes a suspended approval by branch label — so a full revise loop is now walkable in the debugger: revise → wait → resubmit (back-edge) → round 2 → approve. An unmatched decision falls back to fanning out (mirroring the engine's label-fallback), logged so the author notices.
+
+  Follows #1954 (ADR-0044 revise-loop authoring).
+
+- 05584aa: feat(studio/flow): context-aware Start trigger fields + explicit decision-branch binding
+
+  Two flow-builder UX improvements (follow-ups to the decision/screen/simulator fixes in #1927):
+
+  - **Start node trigger fields are now context-aware.** The Start node showed `Object`
+    and `Entry condition` (record-trigger config) even on screen / manual flows where
+    they don't apply. They're now gated by the chosen `triggerType` — shown for record /
+    schedule / webhook / event triggers, hidden for manual / unset (screen wizards). A
+    field that already holds a value is never hidden, so existing flows are unaffected.
+  - **Decision branches can be bound to edges explicitly.** Selecting a decision out-edge
+    now shows a **Branch** picker listing the source decision's branches (label · condition,
+    or "· default"). Picking one writes that branch's expression / label (or marks the
+    default) onto the edge — so routing stays correct even when edges are connected out of
+    branch order, instead of relying solely on the implicit by-order auto-wire. A
+    "— Custom —" option preserves manual editing.
+
+  Adds `flow-node-config.test.ts` covering the trigger-field gating.
+
+- 44d4582: fix(studio): localize lookup picker config + keep published org objects editable
+
+  - The lookup field's "Picker config" sub-panel (display/description field,
+    selectable-records filters, depends-on, page size, quick-create) was
+    hard-coded English in an otherwise-Chinese designer. Routed every literal
+    through `t()`/`tFormat()` with new `designer.field.lookup.*` keys (en + zh).
+  - A freshly-published org object read back as read-only: after publish its
+    active version surfaces in the layered `code` slot tagged with the
+    `sys_metadata` provenance sentinel, and `ResourceEditPage` treated any
+    non-null `code` as a packaged artifact (needs `allowOrgOverride`, which the
+    `object` type lacks). Mirror the server's `isArtifactBacked` — which excludes
+    `_packageId === 'sys_metadata'` — so org-authored items stay editable.
+
+- b419a7c: fix(studio): enable report authoring (create flow, chart render, dataset-aware inspector)
+
+  Found dogfooding report design in Studio as a business user — you could not create a report at all, plus several follow-on gaps.
+
+  - **Report create now uses the canvas + `ReportDefaultInspector`.** Only `object` was in `CREATE_MODE_CANVAS_TYPES`, so report-create fell back to a stale name-first form whose create-config (`objectName`, `columns: []`) predates the ADR-0021 dataset-bound model — saving failed server validation (_"a report needs `dataset` + `values`"_) with no field to fix it. Add `'report'` to the canvas set; the inspector exposes an auto-derived snake_case Name in create mode; fix the create-config (drop `objectName`/`columns`, seed `type: 'summary'` + `drilldown: true`).
+  - **Preserve `?package=` on post-create navigation** — it was dropped, so the editor reloaded a blank draft in the user's default package.
+  - **Render a report's embedded `chart`** in `DatasetReportRenderer` (authorable in Studio but never rendered) via the lazily-registered generic chart component; requests a non-animated render for export/background-tab safety.
+  - **Dedicated Chart panel in the inspector** — chart type + dataset-aware X-Axis (dimension) / Y-Axis (measure) dropdowns + title, replacing free-text axis fields and the vague "Chart: Required text value" validation.
+
+- 15f140d: Validation messages name the offending widget + field
+
+  A nested Zod issue (e.g. `widgets.2.layout`) was shown as just its head field label — "Widgets: Invalid input" — so an author couldn't tell which widget or sub-field was at fault. `labelForIssuePath` now appends a readable trail, resolving each array index to the item's stable identity (id/name/title, incl. I18nLabel objects) from the draft: "Widgets → priority_split → layout". Single-segment paths are unchanged.
+
+- Updated dependencies [677f7ed]
+- Updated dependencies [08c47da]
+- Updated dependencies [a71be60]
+- Updated dependencies [cb03bc3]
+  - @object-ui/types@7.1.0
+  - @object-ui/core@7.1.0
+  - @object-ui/react@7.1.0
+  - @object-ui/auth@7.1.0
+  - @object-ui/collaboration@7.1.0
+  - @object-ui/components@7.1.0
+  - @object-ui/data-objectstack@7.1.0
+  - @object-ui/fields@7.1.0
+  - @object-ui/layout@7.1.0
+  - @object-ui/permissions@7.1.0
+  - @object-ui/plugin-editor@7.1.0
+  - @object-ui/providers@7.1.0
+  - @object-ui/i18n@7.1.0
+
 ## 7.0.0
 
 ### Minor Changes

package/dist/console/AppContent.js

@@ -23,7 +23,7 @@ import { usePreviewDrafts } from '../preview/PreviewModeContext';
 import { PreviewDraftEmptyState } from '../preview/PreviewDraftEmptyState';
 import { ExpressionProvider, evaluateVisibility } from '../providers/ExpressionProvider';
 import { useTrackRouteAsRecent } from '../hooks/useTrackRouteAsRecent';
-import { resolveRecordFormTarget, resolveNavigateCreateUrl, resolveNavigateEditUrl } from '../utils/recordFormNavigation';
+import { resolveRecordFormTarget, resolveFormViewLayout, resolveNavigateCreateUrl, resolveNavigateEditUrl } from '../utils/recordFormNavigation';
 import { matchAppBySegment } from '../utils/appRoute';
 import { resolveHref } from '@object-ui/layout';
 import { ExpressionEvaluator } from '@object-ui/core';
@@ -373,8 +373,20 @@ export function AppContent({ extraRoutes, extraRoutesNoApp } = {}) {
         return (_jsx(Suspense, { fallback: _jsx(LoadingScreen, {}), children: _jsxs(Routes, { children: [_jsx(Route, { path: "create-app", element: _jsx(CreateAppPage, {}) }), _jsx(Route, { path: "system/marketplace", element: _jsx(MarketplacePage, {}) }), _jsx(Route, { path: "system/marketplace/installed", element: _jsx(MarketplaceInstalledPage, {}) }), _jsx(Route, { path: "system/marketplace/:packageId", element: _jsx(MarketplacePackagePage, {}) }), _jsx(Route, { path: "metadata", element: _jsx(MetadataDirectoryPage, {}) }), _jsx(Route, { path: "metadata/_diagnostics", element: _jsx(MetadataDiagnosticsPage, {}) }), _jsx(Route, { path: "metadata/:type", element: _jsx(MetadataResourceListPage, {}) }), _jsx(Route, { path: "metadata/:type/new", element: _jsx(MetadataResourceEditPage, { createMode: true }) }), _jsx(Route, { path: "metadata/:type/:name", element: _jsx(MetadataResourceEditPage, {}) }), _jsx(Route, { path: "metadata/:type/:name/history", element: _jsx(MetadataResourceHistoryPage, {}) }), extraRoutesNoApp] }) }));
     }
     const expressionUser = user
-        ? { name: user.name, email: user.email, role: user.role ?? 'user' }
-        : { name: 'Anonymous', email: '', role: 'guest' };
+        ? {
+            id: user.id,
+            name: user.name,
+            email: user.email,
+            role: user.role ?? 'user',
+            roles: user.roles,
+            // Surface the platform-admin flag so action `visible` CEL predicates
+            // gated on `ctx.user.isPlatformAdmin == true` (e.g. sys_environment
+            // "Change Plan (admin)") evaluate correctly. Previously only
+            // name/email/role were forwarded → isPlatformAdmin-gated actions were
+            // hidden even for platform admins.
+            isPlatformAdmin: user.isPlatformAdmin ?? false,
+        }
+        : { name: 'Anonymous', email: '', role: 'guest', isPlatformAdmin: false };
     return (_jsxs(ExpressionProvider, { user: expressionUser, app: activeApp, data: {}, features: features, children: [_jsx(NavigationSyncEffect, {}), _jsxs(ConsoleLayout, { activeAppName: activeApp.name, activeApp: activeApp, onAppChange: handleAppChange, objects: allObjects, connectionState: connectionState, userId: user?.id, children: [_jsx(CommandPalette, { apps: apps, activeApp: activeApp, objects: allObjects, onAppChange: handleAppChange, dataSource: dataSource }), _jsx(KeyboardShortcutsDialog, {}), _jsx(OnboardingWalkthrough, {}), _jsx(DraftReviewNavigator, { appName: appName }), _jsx(ErrorBoundary, { children: _jsx(Suspense, { fallback: _jsx(LoadingScreen, {}), children: _jsx(RouteFader, { className: "h-full", children: _jsxs(Routes, { children: [_jsx(Route, { path: "/", element: (() => {
                                                 // When the app declares a landing target (home page or
                                                 // first nav route) honour it; otherwise — e.g. the
@@ -389,20 +401,14 @@ export function AppContent({ extraRoutes, extraRoutesNoApp } = {}) {
                             objectName: currentObjectDef.name,
                             mode: editingRecord ? 'edit' : 'create',
                             recordId: editingRecord?.id,
-                            // Master-detail by config: if the object's form view declares
-                            // inline child collections, the standard New/Edit modal renders
-                            // them as an atomic master-detail form (no bespoke page).
-                            subforms: currentObjectDef.form?.subforms
-                                ?? currentObjectDef.formViews?.default?.subforms,
-                            // ADR-0050 (#1890): forward the default form view's layout so the
-                            // New/Edit modal can be tabbed (not just a flat stack). `formType`
-                            // stays 'modal' (the container); `contentLayout` carries the layout.
-                            ...(() => {
-                                const fd = currentObjectDef.form ?? currentObjectDef.formViews?.default;
-                                return fd?.type === 'tabbed' && Array.isArray(fd?.sections)
-                                    ? { contentLayout: 'tabbed', sections: fd.sections }
-                                    : {};
-                            })(),
+                            // Honor the object's DEFAULT FORM VIEW: curated sections (field
+                            // selection + order + grouping), `contentLayout: 'tabbed'` when the
+                            // view is tabbed, and inline child collections (master-detail).
+                            // When the view declares sections they drive the modal layout and
+                            // win over the flat `fields` list below; otherwise this resolves to
+                            // {} and `fields` (every field, raw schema order) is used as before.
+                            // `formType` stays 'modal' (the container). (#1890 / ADR-0050.)
+                            ...resolveFormViewLayout(currentObjectDef),
                             title: editingRecord
                                 ? t('form.editTitle', { object: objectLabel(currentObjectDef) })
                                 : t('form.createTitle', { object: objectLabel(currentObjectDef) }),