@object-ui/core 17.6.0 → 18.0.0

package/dist/actions/ActionRunner.js

@@ -10,6 +10,56 @@ import { hasDeclaredPredicate } from '../evaluator/declaredPredicate.js';
 import { globalUndoManager } from './UndoManager.js';
 import { warnOnDeprecatedObjectParams, warnOnUnknownActionKeys } from './actionKeys.js';
 import { readActionPayload } from './actionResponse.js';
+import { classifyNavigationTarget } from './navigationTarget.js';
+import { toPredicateRecord } from '../utils/predicate-record.js';
+/**
+ * What a navigation target outside `classifyNavigationTarget`'s admitted set
+ * answers (objectui#12191). It names the admitted set, so the author learns the
+ * fix from the refusal. ⚠️ Nothing derives this text from the classifier: a
+ * change to the set changes this sentence by hand.
+ * `navigationTarget.mailto-12191.test.ts` pins that it names each admitted kind.
+ */
+const NAVIGATION_TARGET_REFUSAL = 'Invalid URL scheme. Only http://, https://, mailto: and in-app relative paths (/path, ./path) are allowed.';
+/**
+ * The text the runner writes itself, and so the only text
+ * {@link ActionRunner.setTranslator}'s translator is asked for. In each entry
+ * `key` names the locale-pack entry (`@object-ui/i18n`'s packs define it) and
+ * `defaultValue` is the English source, which is also what shows when no
+ * translator is installed.
+ *
+ * - `completedSuccessfully` — the success toast when the author supplied no
+ *   copy for it: no `outcomeMessages` entry for the answer's `outcome` and no
+ *   `successMessage` (objectui#10900, objectui#11344).
+ * - `failed` — the error toast when the error that reached the toast carries
+ *   no readable message, and a parallel chain's result when its last action
+ *   rejected (objectui#10969).
+ * - `parallelFailed` — a parallel chain's error when no failed action reported
+ *   one of its own (objectui#10969).
+ * - `undo` — the label the runner hands the toast handler for an undoable
+ *   success toast's Undo affordance (objectui#10969).
+ *
+ * An author's `outcomeMessages` / `successMessage` / `errorMessage` and an
+ * action's own error are never in this table: the host localizes authored copy
+ * before dispatch, and the runner only fills in its `${result.*}` tokens.
+ */
+const RUNNER_TEXT = {
+    completedSuccessfully: {
+        key: 'actions.completedSuccessfully',
+        defaultValue: 'Action completed successfully',
+    },
+    failed: {
+        key: 'actions.failed',
+        defaultValue: 'Action failed',
+    },
+    parallelFailed: {
+        key: 'actions.parallelFailed',
+        defaultValue: 'One or more parallel actions failed',
+    },
+    undo: {
+        key: 'actions.undo',
+        defaultValue: 'Undo',
+    },
+};
 /**
  * Bind the server-CEL-parity `os.user` identity alias into an action context
  * (#2358 trap 1). `@objectstack/spec` documents the canonical CEL identity
@@ -80,6 +130,79 @@ function readContextObjectName(context) {
     const name = context.objectName;
     return typeof name === 'string' && name.trim() !== '' ? name.trim() : undefined;
 }
+/**
+ * The field definitions the host published for `objectName`, or `undefined`
+ * (objectui#11122).
+ *
+ * A host publishes `objectFields` BESIDE `objectName` (`useConsoleActionRuntime`
+ * and `RecordDetailView` both do), so the pair names one object and its fields.
+ * They are answered only for THAT object: an action that retargets another
+ * object (a related-list row on the record page carries the child's
+ * `objectName`) gets no field map rather than the host object's, because
+ * reading one object's field types against another object's row would decide
+ * which of its fields are relations by the wrong schema.
+ */
+function readContextObjectFields(context, objectName) {
+    if (readContextObjectName(context) !== objectName)
+        return undefined;
+    const fields = context.objectFields;
+    return fields && typeof fields === 'object' ? fields : undefined;
+}
+/**
+ * The declared actions the host published for `objectName`, or `undefined`
+ * (objectui#13022).
+ *
+ * A host publishes `objectActions` (the object's `actions` list, the
+ * declarations the platform action route resolves an action's `name` against)
+ * beside `objectName` and `objectFields`; `useConsoleActionRuntime` and
+ * `RecordDetailView` both do. Answered only for THAT object, for the reason
+ * {@link readContextObjectFields} gives: a dispatch that retargets another
+ * object names a declaration this list does not hold.
+ */
+function readContextObjectActions(context, objectName) {
+    if (!objectName || readContextObjectName(context) !== objectName)
+        return undefined;
+    const actions = context.objectActions;
+    return Array.isArray(actions) ? actions : undefined;
+}
+/** A `patch` as the route reads one: a plain object's own members, else none. */
+function patchMembers(patch) {
+    return patch && typeof patch === 'object' && !Array.isArray(patch)
+        ? { ...patch }
+        : {};
+}
+/**
+ * The static values the platform action route writes for an
+ * `operation: 'update'` dispatch: the `patch` of the DECLARATION the action's
+ * `name` names (objectui#13022).
+ *
+ * The route resolves that declaration by the dispatch's object and the
+ * action's `name`, and writes its `patch` under the params it is sent
+ * (`declarativeUpdateWrite`). A page action row's own `patch` is never that
+ * write: `@objectstack/spec` 18 retires the key on `action:button`,
+ * `action:icon` and the `action:group` / `action:menu` member, and none of
+ * those renderers forwards it. So the declaration is read from one of two
+ * places, and no third:
+ *
+ *  1. The declarations the host published for the dispatch's object
+ *     ({@link readContextObjectActions}), when they name this action: the
+ *     lookup the route performs. A declaration with no `patch` writes the
+ *     collected params alone.
+ *  2. Otherwise the def itself. A host that dispatches an object's action whole
+ *     (`ObjectGrid`'s rows, `DeclaredActionsBar`, `RelatedRecordActionsBridge`,
+ *     `page:header`) hands the runner the declaration, `patch` included. A page
+ *     row reaches the runner through a renderer, which forwards no `patch`, so
+ *     this reads nothing for one.
+ *
+ * Read for the Undo snapshot only; ⛔ never sent (objectui#12941).
+ */
+function declaredUpdatePatch(action, context, objectName) {
+    const name = typeof action.name === 'string' && action.name !== '' ? action.name : undefined;
+    const declared = name === undefined
+        ? undefined
+        : readContextObjectActions(context, objectName)?.find((candidate) => !!candidate && typeof candidate === 'object' && candidate.name === name);
+    return patchMembers(declared ? declared.patch : action.patch);
+}
 /**
  * Whether opening FormView `viewName` from a record of `contextObject` would
  * cross an object boundary (objectui#4292).
@@ -102,6 +225,99 @@ function crossesObjectBoundary(viewName, contextObject) {
         return false;
     return !viewName.startsWith(`${contextObject}.`);
 }
+/**
+ * Is this the declarative single-record field write?
+ *
+ * Asks the AUTHORED key, not `type`: the spec materializes `type: 'script'`
+ * here and refuses every other explicit spelling, so `type` cannot answer the
+ * question — see the dispatch comment in {@link ActionRunner.execute}.
+ *
+ * `'update'` is the only member the spec declares (`'delete'` and `'custom'`
+ * have no row-level form), and an unrecognized spelling is a parse rejection
+ * upstream. This reads the ONE member rather than "any truthy `operation`" so a
+ * future member cannot silently inherit the update write path — the dispatch
+ * table's own guard reasoning, applied to this key.
+ */
+function isUpdateOperationAction(action) {
+    return action.operation === 'update';
+}
+/**
+ * Whether the action declares its own success copy, read the way
+ * `composeSuccessMessage` reads its `successMessage` rung: a non-empty string.
+ * A navigation toasts only then (objectui#12755).
+ */
+function declaresSuccessMessage(action) {
+    return typeof action.successMessage === 'string' && action.successMessage.trim() !== '';
+}
+/**
+ * The fields an `operation: 'update'` action writes, and their prior values.
+ *
+ * `undoable` promises to restore EXACTLY the fields the action wrote, so the
+ * captured set is the effective payload — `patch` merged under the collected
+ * `params` — and never `patch` alone: a param-collected field left out of the
+ * capture would make Undo restore SOME of the edit and report a full one, which
+ * is worse than offering no Undo at all.
+ *
+ * Prior values come from the row record the invoking surface stashed under
+ * `params._rowRecord` (the same client-side stash the record-id dance reads).
+ * A field the row carries as `null` is captured as `null`: it was empty, and
+ * clearing it back to empty is what restoring it means on the data plane.
+ *
+ * ⛔ A field the row does not CARRY is never captured as `null`
+ * (objectui#10404). Absent is not empty: a list row is projected by `$select`,
+ * and a written field no column shows is missing from the row while the server
+ * holds a real value for it. Recording `null` there made Undo write `null` over
+ * the value it existed to restore. The list harvest (`listViewPredicates`) now
+ * asks for the written fields of an `undoable` action, so a projected row
+ * carries them; this is the backstop for the ones it cannot ask for (a field
+ * the object does not declare or the principal may not read, a row no harvest
+ * shaped). "Carries" means an own key whose value is not `undefined`: JSON
+ * cannot send `undefined`, so such a value says nothing about what is stored.
+ *
+ * Answers `undefined` when any written field is not carried, and the caller
+ * then offers no Undo at all. Capturing only the carried fields is not an
+ * option, for the reason above: a partial restore reported as a full one is
+ * worse than no Undo.
+ *
+ * ⛔ A relation's prior value is its STORED id, never the record `$expand`
+ * put in its place (objectui#11122). Surfaces read rows with `$expand` on the
+ * relations they show (a grid, its visible and grouping columns; the record
+ * page, every relation the reader may read), and the server replaces the id
+ * in place with the related record. Copied verbatim, that record became the
+ * Undo value and Undo wrote it into the reference slot, which stores an id:
+ * refused under a strict value-shape posture, stored as corruption under the
+ * lenient one. So each carried value goes through `toPredicateRecord`, the one
+ * rule that binds a fetched record the way the server stores it: a field the
+ * object DECLARES relational (`EXPANDABLE_FIELD_TYPES`, the set that decides
+ * what is expanded in the first place) collapses to its id, element-wise for a
+ * `multiple` relation, and every other field is left exactly as the row
+ * carries it. It is read from `fields`, never from the value's shape: a `json`
+ * field may hold an object with an `id`, and that object is its stored value.
+ *
+ * `fields` is the written object's field definitions (`objectSchema.fields`,
+ * either served shape), and it is REQUIRED so that a caller without them has
+ * to say so: `undefined` collapses nothing, because a caller that cannot name
+ * the relations must not guess them.
+ *
+ * Exported (objectui#11082) because it is THE rule, not this runner's: every
+ * surface that builds an `update` Undo snapshot itself calls it rather than
+ * restating it. Today that is the console runtime's `api` handler
+ * (`useConsoleActionRuntime`) and the record page's own `api` handler
+ * (`RecordDetailView`), which reads prior values off the page's loaded record;
+ * that record lacks a written field when field-level security hides it from
+ * the reader. To name the fields that blocked a capture, ask per field:
+ * `captureUpdateUndoData([field], rowRecord, fields) === undefined`.
+ */
+export function captureUpdateUndoData(writtenFields, rowRecord, fields) {
+    if (!writtenFields.every((field) => rowCarries(rowRecord, field)))
+        return undefined;
+    const stored = toPredicateRecord(rowRecord, fields);
+    return Object.fromEntries(writtenFields.map((field) => [field, stored[field]]));
+}
+/** Whether the row CARRIES `field`: an own key whose value is not `undefined`. */
+function rowCarries(rowRecord, field) {
+    return Object.prototype.hasOwnProperty.call(rowRecord, field) && rowRecord[field] !== undefined;
+}
 /*
  * ## The two predicate gates in `execute`, and the one question they ask first
  *
@@ -129,8 +345,10 @@ function crossesObjectBoundary(viewName, contextObject) {
  * Both read {@link hasDeclaredPredicate} — the repo's one definition of that
  * question, in `evaluator/declaredPredicate.ts` beside the normalizer it is
  * derived from, with the scope objectui#3850 ruled on (`''` / whitespace-only /
- * empty-`source` envelope / non-predicate junk are NOT declared; a declared
- * `false` IS). This gate arrived here first as a module-private helper with a
+ * empty-`source` envelope are NOT declared; a declared `false` IS) and the
+ * third state objectui#11358 added (a present value with no evaluable `source`
+ * — `0`, `{}`, an array, an `ast`-only envelope — IS declared, and faults).
+ * This gate arrived here first as a module-private helper with a
  * scope note saying it stayed private until that ruling landed; it has, so the
  * definition moved down a layer and the renderer side reads the same one
  * (`components/renderers/action/visibility-gate.ts` re-exports it as
@@ -164,9 +382,15 @@ function crossesObjectBoundary(viewName, contextObject) {
  * historical `Boolean(raw)` coercion, so `0` there meant "hidden" — fail-CLOSED
  * on junk, the opposite of what this module committed to for `disabled`
  * (`catch { isDisabled = false }`). That filter now reads
- * {@link hasDeclaredPredicate} too (objectui#3957), so a value that is not a
- * predicate at all decides nothing on either key, at either entry: `0` / `{}` are
- * "no gate" here, in the engine filter, and in the shared definition.
+ * {@link hasDeclaredPredicate} too (objectui#3957), so the two entries answer
+ * a value that is not a predicate at all the same way. Since objectui#11358
+ * that answer is "declared, and faulting" rather than "no gate": `0` / `{}` /
+ * an `ast`-only envelope reach `evaluateCondition`, which reports them and
+ * answers its fail-soft `true` — so `disabled` refuses the action (its closed
+ * direction, as for any faulting `disabled`) and `condition` lets it run (the
+ * direction a faulting `condition` has always taken), and the engine filter
+ * hides it (`throwOnError`). Pinned in `ActionRunner.disabledGate.test.ts` /
+ * `ActionRunner.conditionGate.test.ts`.
  */
 export class ActionRunner {
     constructor(context = {}) {
@@ -230,6 +454,12 @@ export class ActionRunner {
             writable: true,
             value: void 0
         });
+        Object.defineProperty(this, "translate", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         /**
          * Built-in dispatch, one entry per runnable action type.
          *
@@ -267,6 +497,21 @@ export class ActionRunner {
         this.navigationHandler = null;
         this.paramCollectionHandler = null;
         this.resultDialogHandler = null;
+        this.translate = null;
+    }
+    /**
+     * Set the translator for the text the runner supplies itself — the host's
+     * `t`, injected so this package takes no i18n dependency. That text is the
+     * `RUNNER_TEXT` table in this file: the generic success toast shown when an
+     * action declares neither an `outcomeMessages` entry for the answer nor a
+     * `successMessage`, the error fallbacks when no readable error message
+     * reached the runner, and the Undo label of an undoable success toast. An
+     * author's `outcomeMessages` / `successMessage` / `errorMessage` and an
+     * action's own error never go through this translator: the host localizes
+     * authored copy before dispatch. With no translator the text stays English.
+     */
+    setTranslator(translate) {
+        this.translate = translate;
     }
     /**
      * Set a custom confirmation handler (e.g., Shadcn AlertDialog).
@@ -325,14 +570,33 @@ export class ActionRunner {
     unregisterScript(scriptName) {
         this.scripts.delete(scriptName);
     }
-    async execute(action) {
+    /**
+     * Run `action`; with `callContext`, run it against that context for this
+     * one dispatch (objectui#13063).
+     *
+     * The runner's context names the PAGE: its `record` and its `objectName`.
+     * A dispatch that runs against some other record, such as a related-list
+     * row on a record page, which is a record of the CHILD object, hands that
+     * record here as `{ record, objectName }`. Every executor then reads it as
+     * the record the action runs against, the way a dispatch from that record's
+     * own page does: `executeForm` forwards its id and object, and its
+     * boundary check compares the target view against the child object instead
+     * of the page's.
+     *
+     * The runner's own context is not touched: the dispatch runs on a one-shot
+     * runner over the merged context that shares this runner's handlers (see
+     * {@link ActionRunner.scopedTo}).
+     */
+    async execute(action, callContext) {
+        if (callContext)
+            return this.scopedTo(callContext).execute(action);
         try {
             // `ActionDef` accepts any key of any type, so a typo (`targt`) and a
             // retired key (`execute`) both reach here having type-checked. Neither
-            // binds a handler, and binding no handler silently is the #2169 "Mark Done
-            // does nothing" shape. Dev-only, warn-once, changes nothing (#4075 step 1).
+            // binds a handler, and binding no handler silently is the objectstack-ai/objectstack#2169 "Mark Done
+            // does nothing" shape. Dev-only, warn-once, changes nothing (objectstack-ai/objectstack#4075 step 1).
             warnOnUnknownActionKeys(action);
-            // The compat window for the object-form `params` payload (#5777, maintainer
+            // The compat window for the object-form `params` payload (objectstack-ai/objectstack#5777, maintainer
             // ruling 2026-08-06 direction A). Checked HERE, before the param-collection
             // block below rewrites `action.params` into a values map — after that point
             // an action that authored a legitimate ActionParam[] DEFINITION array also
@@ -376,9 +640,16 @@ export class ActionRunner {
                 // code only evaluated the STRING form and treated any object as truthy,
                 // so an envelope-disabled action was ALWAYS "disabled" — silently
                 // blocking every execution (param dialog never opened, handler never
-                // ran). `evaluateCondition` already handles boolean/string/envelope;
-                // and the renderers are authoritative for the visual disabled state, so
-                // any eval failure here defaults to NOT-disabled (don't false-block).
+                // ran). `evaluateCondition` already handles boolean/string/envelope.
+                //
+                // A predicate that FAULTS — an unbound root, a misspelled field,
+                // `current_user.can(…)` before the permissions payload has loaded — does
+                // NOT reach the `catch` below: `evaluateCondition` handles its own
+                // faults and answers its fail-soft `true`, which on this key means
+                // DISABLED, so the action is refused ("Action is disabled"). That is the
+                // closed direction every `disabled` leg takes (objectui#11212,
+                // objectui#11242). The `catch` only covers a throw from outside that
+                // fault handling, and leaves such an action not disabled.
                 let isDisabled = false;
                 try {
                     isDisabled = this.evaluator.evaluateCondition(action.disabled);
@@ -395,8 +666,14 @@ export class ActionRunner {
             // structured `confirm.message` read that used to OUTRANK it is retired
             // (objectui#4314): it had zero producers and no bundle key, so a dialog
             // authored that way silently lost localization.
+            //
+            // Read through `templateEvaluatorFor`, not the runner's own evaluator:
+            // a row dispatch binds no `record` in the runner's context, so a
+            // `${record.*}` hole the record header fills was shown raw from a list
+            // row (objectui#12967).
+            const templates = this.templateEvaluatorFor(action);
             if (action.confirmText) {
-                const confirmed = await this.confirmHandler(this.evaluator.evaluate(action.confirmText));
+                const confirmed = await this.confirmHandler(templates.evaluate(action.confirmText));
                 if (!confirmed) {
                     return { success: false, error: 'Action cancelled by user' };
                 }
@@ -411,49 +688,69 @@ export class ActionRunner {
                 : (Array.isArray(action.params) ? action.params : undefined);
             if (paramDefs && paramDefs.length > 0) {
                 if (this.paramCollectionHandler) {
-                    const collected = await this.paramCollectionHandler(paramDefs, action);
-                    if (collected === null) {
-                        return { success: false, error: 'Action cancelled by user (params)' };
-                    }
                     // Merge collected params into action.params as a values map for downstream consumers.
                     // Preserve any pre-attached row context (`_rowRecord`) used by list_item
                     // actions so downstream handlers (apiHandler) can inject the row id.
+                    // Read ONCE, before any run: a second `run` after a refusal merges
+                    // its values over the same base, not over the first run's values.
                     const priorParams = Array.isArray(action.params) ? {} : (action.params || {});
                     const rowRecord = priorParams._rowRecord;
-                    action.params = { ...priorParams, ...collected };
-                    if (rowRecord !== undefined)
-                        action.params._rowRecord = rowRecord;
+                    const applyCollected = (collected) => {
+                        action.params = { ...priorParams, ...collected };
+                        if (rowRecord !== undefined)
+                            action.params._rowRecord = rowRecord;
+                    };
+                    const cancelled = { success: false, error: 'Action cancelled by user (params)' };
+                    // The handler-driven session (objectui#13161) — see `ParamCollectionHandler`.
+                    // The dialog that collected the values stays open until it hears
+                    // how the run went, so a refusal lands beside what the user typed
+                    // instead of on a closed dialog.
+                    let lastRun;
+                    let inFlight = false;
+                    const run = (values) => {
+                        if (inFlight && lastRun)
+                            return lastRun;
+                        inFlight = true;
+                        lastRun = (async () => {
+                            try {
+                                let attempt;
+                                try {
+                                    applyCollected(values);
+                                    attempt = await this.dispatchCollected(action, actionType);
+                                }
+                                catch (error) {
+                                    // A dispatch that throws is a refused run, exactly as the
+                                    // `catch` at the end of `execute` reports one.
+                                    attempt = { success: false, error: error.message };
+                                }
+                                // A refused attempt gets its post-execution now, as a lone run
+                                // would; a successful one waits for the session to end below.
+                                if (!attempt.success)
+                                    await this.handlePostExecution(action, attempt);
+                                return attempt;
+                            }
+                            finally {
+                                inFlight = false;
+                            }
+                        })();
+                        return lastRun;
+                    };
+                    const collected = await this.paramCollectionHandler(paramDefs, action, (text) => String(templates.evaluate(text) ?? ''), run);
+                    if (lastRun) {
+                        const last = await lastRun;
+                        if (last.success) {
+                            await this.handlePostExecution(action, last);
+                            return last;
+                        }
+                        return collected === null ? cancelled : last;
+                    }
+                    if (collected === null) {
+                        return cancelled;
+                    }
+                    applyCollected(collected);
                 }
             }
-            // Check for a registered custom handler first
-            if (actionType && this.handlers.has(actionType)) {
-                const handler = this.handlers.get(actionType);
-                const result = await handler(action, this.context);
-                await this.handlePostExecution(action, result);
-                return result;
-            }
-            // Built-in action execution by type.
-            let result;
-            const builtin = actionType
-                ? this.builtinExecutors[actionType]
-                : undefined;
-            if (builtin) {
-                result = await builtin(action);
-            }
-            else if (action.navigate) {
-                // Legacy fallback: check for navigate, api, or onClick
-                result = await this.executeNavigation(action);
-            }
-            else if (action.api || action.endpoint) {
-                result = await this.executeAPI(action);
-            }
-            else if (action.onClick) {
-                await action.onClick();
-                result = { success: true };
-            }
-            else {
-                result = await this.executeActionSchema(action);
-            }
+            const result = await this.dispatchCollected(action, actionType);
             await this.handlePostExecution(action, result);
             return result;
         }
@@ -463,6 +760,66 @@ export class ActionRunner {
             return result;
         }
     }
+    /**
+     * Dispatch an action whose params are collected, and answer what it
+     * returned — WITHOUT post-execution, which each caller runs itself:
+     * `execute` right after a lone run, and the param-collection session
+     * (`ParamCollectionHandler`'s `run`, objectui#13161) once per refused attempt
+     * and once for the successful one when the session ends.
+     */
+    async dispatchCollected(action, actionType) {
+        // ── `operation` is read BEFORE `type`, and this is the only order that
+        // can work ────────────────────────────────────────────────────────────
+        //
+        // `operation: 'update'` is a PARALLEL key beside `type`, not a member of
+        // it: `@objectstack/spec` materializes `type: 'script'` on such an action
+        // (the platform action route is the script type's own route) and refuses
+        // any other explicit `type`. `ActionType` therefore did not gain a
+        // member, which is why `builtinExecutors` — a `Record<RunnableActionType,
+        // …>` — still compiles unchanged across the bump that added this key.
+        //
+        // The cost of that design is paid here: by the time `actionType` is
+        // consulted, an update action is indistinguishable from every other
+        // script action. Dispatched on `type` it would reach the registered
+        // `script` handler as a plain script action: the route still writes the
+        // declared `patch` (it applies it from the declaration, never from the
+        // request — objectui#12941), but no Undo snapshot of the written fields
+        // would be taken, and with no `script` handler registered the action
+        // would end at `executeScript`'s "No script provided" instead of the
+        // update path's refusal naming the remedy. Worse, a row rehydrated from
+        // `sys_metadata` UNPARSED (objectui#3903) carries no materialized `type`
+        // at all, so `actionType` falls back to the action's NAME, matches no
+        // executor, and the action lands in `executeActionSchema`, reported on
+        // and never run. Reading `operation` first is what makes all of those
+        // impossible.
+        if (isUpdateOperationAction(action)) {
+            return this.executeUpdateOperation(action);
+        }
+        // Check for a registered custom handler first
+        if (actionType && this.handlers.has(actionType)) {
+            const handler = this.handlers.get(actionType);
+            return handler(action, this.context);
+        }
+        // Built-in action execution by type.
+        const builtin = actionType
+            ? this.builtinExecutors[actionType]
+            : undefined;
+        if (builtin) {
+            return builtin(action);
+        }
+        else if (action.navigate) {
+            // Legacy fallback: check for navigate, api, or onClick
+            return this.executeNavigation(action);
+        }
+        else if (action.api || action.endpoint) {
+            return this.executeAPI(action);
+        }
+        else if (action.onClick) {
+            await action.onClick();
+            return { success: true };
+        }
+        return this.executeActionSchema(action);
+    }
     /**
      * Execute multiple actions in sequence or parallel.
      */
@@ -477,13 +834,13 @@ export class ActionRunner {
                 const firstFail = results.find(r => r.status === 'fulfilled' && !r.value.success);
                 return {
                     success: false,
-                    error: firstFail?.value?.error || 'One or more parallel actions failed',
+                    error: firstFail?.value?.error || this.runnerText(RUNNER_TEXT.parallelFailed),
                 };
             }
             const lastResult = results[results.length - 1];
             return lastResult.status === 'fulfilled'
                 ? lastResult.value
-                : { success: false, error: 'Action failed' };
+                : { success: false, error: this.runnerText(RUNNER_TEXT.failed) };
         }
         // Sequential execution — stop on first failure
         let lastResult = { success: true };
@@ -495,6 +852,61 @@ export class ActionRunner {
         }
         return lastResult;
     }
+    /**
+     * One entry of `RUNNER_TEXT`, in the installed translator's language. An
+     * empty answer from the translator falls back to the English source rather
+     * than raising an empty toast or an empty label.
+     */
+    runnerText({ key, defaultValue }) {
+        return this.translate?.(key, { defaultValue }) || defaultValue;
+    }
+    /**
+     * The success toast's text, by the contract's three rungs
+     * (`ActionSchema.outcomeMessages`, objectui#11344):
+     *
+     * 1. `outcomeMessages[outcome]`, where `outcome` is the top-level `outcome`
+     *    of the handler's return value — the payload `${result.*}` reads, so it
+     *    is the same fact an author writes as `${result.outcome}`;
+     * 2. `successMessage`;
+     * 3. the runner's own default text, in its translator's language.
+     *
+     * Rungs 1 and 2 are the author's copy. Both arrive already localized — the
+     * host's localizer resolves the bundle entry or the inline `I18nLabel` map
+     * before dispatch — and both have their `${result.*}` tokens filled in here,
+     * through the one token grammar and scope `onSuccess.navigate` reads
+     * (`substituteScopeTokens` over `readActionPayload(result.data)`). Only the
+     * sink differs: a toast is text, so a value is inserted as-is, where a URL
+     * position percent-encodes it.
+     *
+     * ⛔ `result.data.message` is not a rung. It used to outrank both rungs of
+     * author copy, which put whatever language the server happened to write in
+     * front of the user's locale; the contract names no server-message rung, and
+     * an author who wants the server's sentence can still write
+     * `${result.message}` as the copy.
+     *
+     * A rung counts only when it is a non-empty string. An `I18nLabel` map that
+     * reached the runner without passing through a localizer has no language to
+     * resolve against here, so it is skipped rather than handed to the toast as
+     * an object — the React #31 crash the error branch below guards against.
+     */
+    composeSuccessMessage(action, result) {
+        const payload = readActionPayload(result.data);
+        const outcome = payload && typeof payload === 'object'
+            ? payload.outcome
+            : undefined;
+        const outcomeMessages = action.outcomeMessages;
+        const outcomeCopy = typeof outcome === 'string'
+            && outcomeMessages && typeof outcomeMessages === 'object'
+            && Object.prototype.hasOwnProperty.call(outcomeMessages, outcome)
+            ? outcomeMessages[outcome]
+            : undefined;
+        for (const copy of [outcomeCopy, action.successMessage]) {
+            if (typeof copy === 'string' && copy.trim() !== '') {
+                return substituteScopeTokens(copy, { result: payload }, (value) => value);
+            }
+        }
+        return this.runnerText(RUNNER_TEXT.completedSuccessfully);
+    }
     /**
      * Post-execution: emit toast notifications, handle chaining, callbacks.
      */
@@ -510,27 +922,25 @@ export class ActionRunner {
             const showToast = action.toast ?? { showOnSuccess: true, showOnError: true };
             const duration = action.toast?.duration;
             if (result.success && !hasResultDialog && !result.silent && showToast.showOnSuccess !== false) {
-                // Prefer a DYNAMIC message the server returned (result.data.message)
-                // over the static action.successMessage. Server-driven actions like
-                // check_app_updates / publish / install compute a real outcome
-                // ("2 app updates available: CRM 1.0.0→1.0.1", "Published v1.2.0")
-                // that the static label can't express; without this the user only ever
-                // sees a generic "Done". Falls back to the static label, then a default.
-                const dyn = (result.data && typeof result.data === 'object'
-                    && typeof result.data.message === 'string')
-                    ? String(result.data.message).trim()
-                    : '';
-                const message = dyn || action.successMessage || 'Action completed successfully';
+                // The server returns FACTS and the console writes the sentence
+                // (ruling A on objectstack-ai/cloud#2315) — see `composeSuccessMessage`.
+                const message = this.composeSuccessMessage(action, result);
                 // Undoable action: register the captured operation on the global
                 // UndoManager and surface an "Undo" affordance on the toast (the
-                // consumer's toast handler wires the button to UndoManager).
+                // consumer's toast handler wires the button to UndoManager). The
+                // button's label is the runner's own text, so it is translated here
+                // rather than left to each handler's English default (objectui#10969).
                 if (result.undo) {
                     try {
                         globalUndoManager.push(result.undo);
                     }
                     catch { /* non-fatal */ }
                 }
-                this.toastHandler(message, { type: 'success', duration, undo: result.undo ? {} : undefined });
+                this.toastHandler(message, {
+                    type: 'success',
+                    duration,
+                    undo: result.undo ? { label: this.runnerText(RUNNER_TEXT.undo) } : undefined,
+                });
             }
             if (!result.success && showToast.showOnError !== false && result.error) {
                 // `result.error` is typed as a string, but a handler bug can leak an
@@ -543,7 +953,7 @@ export class ActionRunner {
                     ? raw
                     : (raw && typeof raw.message === 'string')
                         ? raw.message
-                        : 'Action failed';
+                        : this.runnerText(RUNNER_TEXT.failed);
                 this.toastHandler(message, { type: 'error', duration });
             }
         }
@@ -586,34 +996,28 @@ export class ActionRunner {
         }
         // ── ActionSchema.onSuccess — post-success navigation ────────────────────
         //
-        // objectui#5221, the console half of objectstack#9566/#9474. The spec
+        // `053fdc8f9`, the console half of objectstack#9566/#9474. The spec
         // declares `onSuccess` as a CLOSED STRICT object
         // `{ navigate: string, openIn: 'self' | 'newTab' }`, refine-scoped to
         // `type: 'api'` and `type: 'script'` — the two types whose success event
         // carries a server response for `${result.*}` to read.
         //
-        // This runner's OWN `ActionDef.onSuccess` predates that key and means
-        // something else entirely: `ActionDef | ActionDef[]`, chained callbacks.
-        // The two are told apart by the spec's own declaration — a non-array object
-        // whose `navigate` is a STRING is the spec block and nothing else can be:
-        // `navigate` on a callback ActionDef is the deprecated nested navigation
-        // ENVELOPE (`executeNavigation` reads `navigate.to`), so a string there has
-        // never been runnable. This is a NARROWING to the declared contract, not a
-        // lenient fallback: a shape the spec refuses gets no new reading here.
+        // That declared meaning is the key's ONLY meaning. The runner's older
+        // chained-callback channel (`onSuccess?: ActionDef | ActionDef[]`,
+        // dispatched through `executeChain`) was retired by objectui#5934
+        // (maintainer ruling 2026-08-31): the spec strict-refuses a callback shape
+        // at parse, so no validated metadata could ever reach it, and the census
+        // found zero producers outside the channel's own pins.
         //
-        // Before this branch existed, the ruled shape fell into the callback path,
-        // dispatched `{ navigate: '<string>' }` as an action, and failed inside
-        // `executeNavigation` with "No URL provided for navigation action" — the
-        // author got a red toast and no hop.
+        // `readOnSuccessNavigation` stays as the shape guard, not as a
+        // discriminator: stored rows are rehydrated UNPARSED (objectstack-ai/objectstack#3903), so the value
+        // is still read as data, and a shape the spec refuses gets no reading —
+        // no navigation, no callback dispatch, no lenient fallback.
         if (result.success && action.onSuccess) {
             const navigation = readOnSuccessNavigation(action.onSuccess);
             if (navigation) {
                 this.navigateOnSuccess(navigation, action, result);
             }
-            else {
-                const callbacks = Array.isArray(action.onSuccess) ? action.onSuccess : [action.onSuccess];
-                await this.executeChain(callbacks, 'sequential');
-            }
         }
         if (!result.success && action.onFailure) {
             const callbacks = Array.isArray(action.onFailure) ? action.onFailure : [action.onFailure];
@@ -628,7 +1032,9 @@ export class ActionRunner {
      * react-router's `navigate` — so `openIn: 'self'` is a real SPA route hop,
      * in place, immune to popup blocking. No `window.location` / `window.open`
      * mechanism is introduced here; the no-handler fallback is the same
-     * `result.redirect` hand-off `navigateTo` already uses.
+     * `result.redirect` hand-off `navigateTo` already uses. The one exception is
+     * shared with `navigateTo`: a `mailto:` target is not a route, so it is a
+     * full-page navigation in place (objectui#12191).
      *
      * **No default is written here.** `openIn` is a materialised
      * `.default('self')` in the spec, so parse output always carries a resolved
@@ -652,15 +1058,21 @@ export class ActionRunner {
         const url = this.interpolateTarget(block.navigate, action, readActionPayload(result.data));
         // `navigate` is author-supplied metadata and lands in a URL position, so
         // it goes through the same scheme guard as every other navigator here.
-        if (!this.isValidUrl(url)) {
-            console.warn('[ActionRunner] onSuccess.navigate resolved to a URL this runner refuses to open '
-                + '(only http://, https:// and relative URLs are allowed) — no navigation performed.', { action: action.name, navigate: block.navigate, resolved: url });
+        const kind = classifyNavigationTarget(url);
+        if (kind === null) {
+            console.warn(`[ActionRunner] onSuccess.navigate resolved to a URL this runner refuses to open — no navigation performed. ${NAVIGATION_TARGET_REFUSAL}`, { action: action.name, navigate: block.navigate, resolved: url });
+            return;
+        }
+        // `mailto:` hands off to the mail client in place, whatever `openIn` says,
+        // and never through the host's router (see `navigateTo`).
+        if (kind === 'mail') {
+            window.location.href = url;
             return;
         }
         const newTab = block.openIn === 'newTab';
         // Same external-URL convention `navigateTo` hands the handler; `newTab`
         // stays the declared choice alone, never `?? isExternal`.
-        const external = url.startsWith('http://') || url.startsWith('https://');
+        const external = kind === 'web';
         if (this.navigationHandler) {
             this.navigationHandler(url, { external, newTab });
             return;
@@ -672,15 +1084,149 @@ export class ActionRunner {
             result.redirect = url;
         }
     }
+    /**
+     * `operation: 'update'` — the declarative single-record field write.
+     *
+     * ## The write is the ROUTE's, never this client's
+     *
+     * This method composes a request and hands it to the registered `script`
+     * dispatch; it does not touch a `DataSource`. That is a security boundary,
+     * not an implementation preference. `POST /api/v1/actions/{object}/{action}`
+     * runs the write AS THE CALLER — the caller's permissions, the object's hooks
+     * and its validations all fire as for a user edit — while a client-side
+     * `dataSource.update()` reaches the data plane having consulted none of them.
+     * The spec says the same thing from its end by refusing `target`, `body`,
+     * `method` and `bodyExtra` beside this key and pinning `type` to `'script'`:
+     * there is exactly one execution surface for an update action, and it is the
+     * route.
+     *
+     * Consequently, a consumer that has registered NO server-action dispatch gets
+     * a loud refusal naming the remedy. The two silent alternatives were both
+     * available and both wrong: falling through to `executeScript` ends at "No
+     * script provided" (an update action declares no `target` — the author is
+     * sent hunting for a field they were right not to write), and falling through
+     * to `executeActionSchema` reports on an action that never ran.
+     *
+     * ## `patch` is the route's: it never rides on the wire (objectui#12941)
+     *
+     * The request carries the values collected for the action's declared
+     * `params`, plus the transport keys the dispatch reads (`recordId`, and the
+     * `_rowRecord` stash it strips before POSTing) — and NOTHING from `patch`.
+     * The route applies the declared `patch` itself, from the declaration it
+     * resolves by the action's name (`@objectstack/runtime`'s
+     * `declarativeUpdateWrite`, which writes `{ ...patch, ...params }`). The
+     * patch keys are not params the action declares, so posting them makes every
+     * declarative-update button a request carrying undeclared params — the very
+     * request the ADR-0104 D2 param contract refuses (objectstack#24268). A
+     * client copy of `patch` on the wire also adds nothing: the server never
+     * reads it.
+     *
+     * The spec's words for the merge the route performs: static field values
+     * "merged UNDER the user-supplied `params` so a fixed value can be declared
+     * without exposing it in the dialog". So a collected param of the same name
+     * WINS — the author declared a default, and the user answered it. This
+     * runner still computes that same merge, but only to know what the route
+     * WROTE, which is what an Undo snapshot must cover; it is never sent.
+     *
+     * ## The `patch` in that merge is the DECLARATION's (objectui#13022)
+     *
+     * The route writes the `patch` of the declaration the action's `name` names,
+     * so that is the `patch` the snapshot covers: read by
+     * {@link declaredUpdatePatch} from the declarations the host published, else
+     * off a def that is the declaration itself. A page action row's own `patch`
+     * is never written (`@objectstack/spec` 18 retires it) and never covered.
+     */
+    async executeUpdateOperation(action) {
+        const dispatch = this.handlers.get('script');
+        if (!dispatch) {
+            return {
+                success: false,
+                error: 'An `operation: "update"` action is written by the platform action route, which this ' +
+                    'client runner cannot reach: no `script` handler is registered. The write is never ' +
+                    'performed client-side — a direct data-plane update bypasses the route\'s permission ' +
+                    'floor, the object\'s hooks and its validations. Register a handler that POSTs to ' +
+                    '/api/v1/actions/{object}/{action} — build one with createServerActionHandler from ' +
+                    '@object-ui/core.',
+            };
+        }
+        const collected = (action.params && !Array.isArray(action.params))
+            ? { ...action.params }
+            : {};
+        // The object the write lands on: the action's own, else the host's.
+        const objectName = action.objectName || readContextObjectName(this.context);
+        // What the route WRITES: the DECLARATION's `patch` UNDER the collected
+        // params, the route's own merge (see the doc above), never a page row's
+        // own `patch` (objectui#13022). Read for the Undo snapshot only — ⛔ never
+        // the request: the route applies `patch` from its declaration.
+        const patch = declaredUpdatePatch(action, this.context, objectName);
+        const written = { ...patch, ...collected };
+        // The row stash and the record selector are transport mechanics, not
+        // written fields: the dispatch strips `_rowRecord` before POSTing and reads
+        // `recordId` as the record's address.
+        const rowRecord = (collected._rowRecord && typeof collected._rowRecord === 'object')
+            ? collected._rowRecord
+            : undefined;
+        const writtenFields = Object.keys(written).filter((k) => k !== '_rowRecord' && k !== 'recordId');
+        // What the request CARRIES: the collected values alone, as a copy of its
+        // own so a dispatch that edits its bag cannot reach the reads below.
+        const wire = { ...collected };
+        const result = await dispatch({ ...action, params: wire }, this.context);
+        // A refusal is returned exactly as the dispatch reported it. The route's
+        // envelope rule (`interpretActionResponse`) has already turned a 4xx/5xx
+        // AND a 200-with-`success:false` business rejection into `error`, and
+        // `handlePostExecution` surfaces that as the failure toast. Re-labelling it
+        // here, or answering success because the POST itself completed, is the
+        // objectui#2960 shape this branch exists to prevent.
+        if (!result.success)
+            return result;
+        // Undo: prior values of exactly the fields this action wrote. Needs a row
+        // record to read them from — without one there is nothing to restore, so
+        // the affordance is correctly not offered rather than offered empty. The
+        // same holds when the row lacks a written field (objectui#10404): no Undo,
+        // never one that writes `null` over the stored value. A relation the row
+        // carries expanded is captured as its stored id, read against the field
+        // map the host published for this object (objectui#11122).
+        if (action.undoable && rowRecord && writtenFields.length > 0) {
+            const recordId = collected.recordId ?? rowRecord.id;
+            if (objectName && recordId != null) {
+                const undoData = captureUpdateUndoData(writtenFields, rowRecord, readContextObjectFields(this.context, objectName));
+                if (undoData) {
+                    result.undo = {
+                        id: `undo-${objectName}-${String(recordId)}-${Date.now()}`,
+                        type: 'update',
+                        objectName,
+                        recordId: String(recordId),
+                        timestamp: Date.now(),
+                        // objectui#11080 — no English verb here. The toast that reports the
+                        // Undo / Redo already says which one it is, from a pack key, so an
+                        // action that declared no label is named by the object it acted on.
+                        description: action.label || objectName,
+                        undoData,
+                        redoData: Object.fromEntries(writtenFields.map((k) => [k, written[k]])),
+                    };
+                }
+                else {
+                    // The success toast then carries no Undo button, which is how the
+                    // user learns this one cannot be undone; this names the cause for
+                    // the author.
+                    console.warn('[ActionRunner] `undoable` update succeeded but offers no Undo: the row it ran on does not '
+                        + 'carry every field it wrote, so their prior values are unknown and an Undo would overwrite '
+                        + 'stored data. A list row carries a written field when the object declares it and the '
+                        + 'principal may read it.', { action: action.name, missing: writtenFields.filter((k) => !rowCarries(rowRecord, k)) });
+                }
+            }
+        }
+        return result;
+    }
     /**
      * Execute script action — evaluates client-side expression via ExpressionEvaluator.
      * Supports ${} template expressions referencing data, record, user context.
      */
     async executeScript(action) {
         // `target` is the only handler slot. The `execute` alias was removed in
-        // @objectstack/spec 17 (#3855), which rejects an authored `execute` at parse
+        // @objectstack/spec 17 (objectstack-ai/objectstack#3855), which rejects an authored `execute` at parse
         // with the rename prescription — so parsed metadata cannot carry it and a
-        // `target || execute` fallback could only ever evaluate to `target` (#3856).
+        // `target || execute` fallback could only ever evaluate to `target` (objectstack-ai/objectstack#3856).
         const script = action.target;
         if (!script) {
             // A spec `body` IS a script — this runner just cannot run one (see the
@@ -703,11 +1249,11 @@ export class ActionRunner {
             // `ActionDef` no longer declares `execute` — nor any open index signature
             // — so `tsc` now catches the retired key at every site that AUTHORS an
             // action literal in code. That is the half of the problem the type can
-            // reach. It is not this half: #3903 established that stored
+            // reach. It is not this half: objectstack-ai/objectstack#3903 established that stored
             // `sys_metadata` rows are rehydrated UNPARSED, so metadata written before
             // spec 17 arrives here as a plain object the compiler never saw, still
             // carrying `execute`. Declaring the key to make this read compile would
-            // re-legitimize a tombstone (#3855 removed it; the spec keeps it only to
+            // re-legitimize a tombstone (objectstack-ai/objectstack#3855 removed it; the spec keeps it only to
             // reject it BY NAME), and deleting the branch would send those rows back
             // to a bare "no script provided" — which reads as "you forgot a field" to
             // an author who did write one, the objectstack#2169 shape.
@@ -761,7 +1307,29 @@ export class ActionRunner {
         if (!rawUrl) {
             return { success: false, error: 'No URL provided for url action' };
         }
-        return this.navigateTo(action, rawUrl, action);
+        return this.announceNavigation(action, await this.navigateTo(action, rawUrl, action));
+    }
+    /**
+     * A navigation announces nothing unless its action declares the copy
+     * (objectui#12755).
+     *
+     * `type: 'url'`, its `navigation` alias and `type: 'form'` only change the
+     * route: nothing was written, so there is nothing to confirm. Their
+     * `{ success: true }` used to reach `handlePostExecution` like a write's, and
+     * the generic `completedSuccessfully` toast ("操作已成功完成") told the user an
+     * operation had completed when a page had merely opened (objectstack-ai/cloud#2909:
+     * an "invite member" button that only navigated read as "invitation sent").
+     *
+     * The result keeps `success: true` (callers read it as "the navigation
+     * happened") and is marked `silent`, the flag that already means "no success
+     * toast for this result". An author who wants a toast after the navigation
+     * declares `successMessage`, and that copy still shows: the declaration is the
+     * only signal, so there is no separate switch to forget.
+     */
+    announceNavigation(action, result) {
+        if (!result.success || declaresSuccessMessage(action))
+            return result;
+        return { ...result, silent: true };
     }
     /**
      * The one navigator behind `type: 'url'` and its `navigation` alias.
@@ -785,11 +1353,19 @@ export class ActionRunner {
         // like `?provider=foo+bar`).
         const interpolated = this.interpolateTarget(rawUrl, action);
         let url = this.evaluator.evaluate(interpolated);
-        if (!this.isValidUrl(url)) {
-            return {
-                success: false,
-                error: 'Invalid URL scheme. Only http://, https://, and relative URLs are allowed.',
-            };
+        const kind = classifyNavigationTarget(url);
+        if (kind === null) {
+            return { success: false, error: NAVIGATION_TARGET_REFUSAL };
+        }
+        // A `mailto:` target opens the mail client IN PLACE (objectui#12191): it
+        // never opens a new tab, so `openIn` is not consulted. It does not go to
+        // the host's navigation handler either. The console's handler opens every
+        // `external` URL in a new tab and hands the rest to react-router, which
+        // resolves `mailto:a@b.com` as a path under the current route. So this is
+        // a full-page navigation here, the same mechanism as the `/api/` case below.
+        if (kind === 'mail') {
+            window.location.href = url;
+            return { success: true };
         }
         // Promote same-origin-style `/api/...` paths to absolute when an
         // `apiBase` is provided in context (typical of split SPA + backend
@@ -803,7 +1379,7 @@ export class ActionRunner {
         }
         // `source.external` is the `navigation` shape's explicit override; the
         // scheme heuristic covers every other case.
-        const isExternal = Boolean(source.external) || url.startsWith('http://') || url.startsWith('https://');
+        const isExternal = Boolean(source.external) || classifyNavigationTarget(url) === 'web';
         // Same-origin API endpoints (most commonly the auth provider's
         // `/api/v1/auth/sign-in/social` redirect dance) issue server-side
         // 302s that must be followed by the *browser*, not the SPA router.
@@ -994,9 +1570,9 @@ export class ActionRunner {
                     : '');
         if (this.navigationHandler) {
             this.navigationHandler(to, { external: false });
-            return { success: true };
+            return this.announceNavigation(action, { success: true });
         }
-        return { success: true, redirect: to };
+        return this.announceNavigation(action, { success: true, redirect: to });
     }
     /**
      * `navigation` — objectui's alias of the spec's `url` (`ObjectUiLocalActionType`).
@@ -1014,7 +1590,7 @@ export class ActionRunner {
         if (!rawUrl) {
             return { success: false, error: 'No URL provided for navigation action' };
         }
-        return this.navigateTo(action, rawUrl, nav);
+        return this.announceNavigation(action, await this.navigateTo(action, rawUrl, nav));
     }
     /**
      * Assemble the request body for the runner's OWN `executeAPI` — the path taken
@@ -1029,7 +1605,7 @@ export class ActionRunner {
      * old object-form `params` page — POSTed an empty body here.
      *
      * `params` contributes only in its DEPRECATED non-array form (the compat window
-     * #5777 opened; see `warnOnDeprecatedObjectParams`). An ARRAY `params` is a
+     * objectstack-ai/objectstack#5777 opened; see `warnOnDeprecatedObjectParams`). An ARRAY `params` is a
      * parameter DEFINITION list, not a payload: it reaches this method unconsumed
      * only when no `paramCollectionHandler` is mounted, and POSTing the definitions
      * as the request body was never a payload any endpoint wanted. It now falls
@@ -1138,15 +1714,6 @@ export class ActionRunner {
             return { success: false, error: error.message };
         }
     }
-    /**
-     * Validate URL to prevent javascript: or data: protocol injection.
-     */
-    isValidUrl(url) {
-        return typeof url === 'string' && (url.startsWith('http://') ||
-            url.startsWith('https://') ||
-            url.startsWith('/') ||
-            url.startsWith('./'));
-    }
     /**
      * Substitute `${param.X}` and `${ctx.X}` tokens in an action target.
      *
@@ -1220,16 +1787,15 @@ export class ActionRunner {
         // BEFORE the request, so there is no result to read; admitting `${result.*}`
         // there would widen the authorable surface with nothing behind it and
         // silently blank the token instead of leaving the author's mistake visible.
+        //
+        // The success toast's copy is the one other caller of the grammar, through
+        // `substituteScopeTokens` directly (`composeSuccessMessage`): `result` only,
+        // because that is the one scope the contract declares for the copy, and no
+        // encoding, because a toast is text.
         const scopes = { param: params, ctx: this.buildInterpolationContext() };
         if (resultScope !== undefined)
             scopes.result = resultScope;
-        const pattern = new RegExp(`\\$\\{(${Object.keys(scopes).join('|')})\\.([\\w.]+)\\}`, 'g');
-        return target.replace(pattern, (_match, scope, path) => {
-            const value = readPath(scopes[scope], path);
-            if (value == null)
-                return '';
-            return encodeURIComponent(String(value));
-        });
+        return substituteScopeTokens(target, scopes, encodeURIComponent);
     }
     /**
      * Assemble the `ctx` namespace exposed to target interpolation.
@@ -1271,6 +1837,36 @@ export class ActionRunner {
         }
         return ctx;
     }
+    /**
+     * The evaluator a dispatch's authored copy is read through: `confirmText`,
+     * and the param dialog's `description` / `helpText` via the handler's
+     * `interpolate` argument.
+     *
+     * One rule for every door (objectui#12967): the record the action runs
+     * against is `record`. The record header binds it in the runner's context
+     * (`RecordDetailView`'s `ActionProvider`). A row surface does not — it
+     * stashes the clicked row under `params._rowRecord` (ObjectGrid's row
+     * actions, a related list's row actions, `DeclaredActionsBar`, a page
+     * header, `action:button`'s update write) and fires through the shared
+     * runner, whose context names the page, not the row. So when the dispatch
+     * carries a row, the row is bound as `record` for this dispatch's templates,
+     * and it wins over a page-level `record` (a related-list row on a record page
+     * is the child, not the page's record). Nothing else in the scope changes,
+     * and the runner's own context is not touched.
+     *
+     * A hole naming a field the record does not carry degrades the way the
+     * header's always has: the evaluator reads `undefined` and the hole prints
+     * empty.
+     */
+    templateEvaluatorFor(action) {
+        const params = action.params;
+        const row = params && typeof params === 'object' && !Array.isArray(params)
+            ? params._rowRecord
+            : undefined;
+        if (!row || typeof row !== 'object' || Array.isArray(row))
+            return this.evaluator;
+        return new ExpressionEvaluator({ ...this.context, record: row });
+    }
     updateContext(newContext) {
         this.context = withIdentityAlias({ ...this.context, ...newContext });
         // Feed the merged (re-aliased) context so a refreshed `user` also
@@ -1280,6 +1876,56 @@ export class ActionRunner {
     getContext() {
         return this.context;
     }
+    /**
+     * A one-shot runner for {@link ActionRunner.execute}'s `callContext`
+     * (objectui#13063): this runner's context with `callContext` merged over it,
+     * and this runner's handlers, translator and registries, shared rather than
+     * copied, so the dispatch confirms, collects params, toasts and navigates
+     * exactly as this runner does.
+     *
+     * Two keys follow the merge rather than the base:
+     *
+     *  - `ctx`, the `ctx.*` mirror `ActionProvider` publishes beside the flat
+     *    keys. A `${ctx.record.…}` hole has to read the same record as a
+     *    `${record.…}` one.
+     *  - `objectFields` / `objectActions`. A host publishes them BESIDE
+     *    `objectName`, so the pair names one object (objectui#11122,
+     *    objectui#13022). When `callContext` names another object and brings no
+     *    definitions of its own, the base's are dropped: the page object's field
+     *    types and declarations must not answer for the child's record. That is
+     *    what a dispatch with no `callContext` already gets for a retargeted
+     *    action, so the update path's capture sees the same input either way.
+     */
+    scopedTo(callContext) {
+        const objectChanged = 'objectName' in callContext &&
+            readContextObjectName(callContext) !== readContextObjectName(this.context);
+        const follow = (bag) => {
+            const merged = { ...bag, ...callContext };
+            if (objectChanged) {
+                if (!('objectFields' in callContext))
+                    delete merged.objectFields;
+                if (!('objectActions' in callContext))
+                    delete merged.objectActions;
+            }
+            return merged;
+        };
+        const merged = follow(this.context);
+        const mirror = this.context.ctx;
+        if (mirror && typeof mirror === 'object' && !Array.isArray(mirror)) {
+            merged.ctx = follow(mirror);
+        }
+        const scoped = new ActionRunner(merged);
+        scoped.handlers = this.handlers;
+        scoped.scripts = this.scripts;
+        scoped.confirmHandler = this.confirmHandler;
+        scoped.toastHandler = this.toastHandler;
+        scoped.modalHandler = this.modalHandler;
+        scoped.navigationHandler = this.navigationHandler;
+        scoped.paramCollectionHandler = this.paramCollectionHandler;
+        scoped.resultDialogHandler = this.resultDialogHandler;
+        scoped.translate = this.translate;
+        return scoped;
+    }
     /**
      * Get the expression evaluator (for components that need to evaluate visibility, etc.)
      */
@@ -1295,15 +1941,14 @@ export async function executeAction(action, context = {}) {
     return await runner.execute(action);
 }
 /**
- * Is this `onSuccess` the SPEC's navigation block, or this runner's older
- * chained-callback channel (`ActionDef | ActionDef[]`)?
+ * Is this `onSuccess` the spec's navigation block?
  *
  * The test IS the spec's declaration: a non-array object carrying a STRING
- * `navigate`. Nothing else can produce that shape — the spec object is strict
- * with `navigate: z.string()` required, and on a callback `ActionDef`,
- * `navigate` is the deprecated nested navigation ENVELOPE that
- * `executeNavigation` reads `to`/`target`/`redirect` off, so a bare string
- * there has never been runnable.
+ * `navigate`. Stored rows are rehydrated UNPARSED (objectstack-ai/objectstack#3903), so the runner reads
+ * the value as data and anything else gets NO reading — since objectui#5934
+ * retired the legacy chained-callback channel (`ActionDef | ActionDef[]`),
+ * there is no other channel for an off-contract shape to fall into. This is a
+ * shape GUARD on unparsed data, not a discriminator between two meanings.
  */
 export function readOnSuccessNavigation(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
@@ -1313,6 +1958,28 @@ export function readOnSuccessNavigation(value) {
         return null;
     return value;
 }
+/**
+ * The runner's ONE `${scope.path}` token grammar — the substitution behind
+ * `interpolateTarget` (url / api targets and the `onSuccess.navigate` hop) and
+ * behind the success toast's `${result.*}` copy (`composeSuccessMessage`).
+ *
+ * The scope MAP defines the vocabulary: the pattern is built from its keys, so
+ * a token naming a scope the caller did not pass is left in the text exactly as
+ * written. A path that resolves to nothing becomes `''`. `encode` is the only
+ * thing a caller varies, and it belongs to the SINK, not to the dialect: a URL
+ * position percent-encodes each value, a toast inserts it as text.
+ */
+function substituteScopeTokens(template, scopes, encode) {
+    if (typeof template !== 'string' || template.indexOf('${') === -1)
+        return template;
+    const pattern = new RegExp(`\\$\\{(${Object.keys(scopes).join('|')})\\.([\\w.]+)\\}`, 'g');
+    return template.replace(pattern, (_match, scope, path) => {
+        const value = readPath(scopes[scope], path);
+        if (value == null)
+            return '';
+        return encode(String(value));
+    });
+}
 /**
  * Dot-path read used by target interpolation. Plain reduce — kept inline
  * to avoid pulling lodash for a 3-line helper.