@object-ui/core 17.7.0 → 18.0.0

package/dist/actions/ActionRunner.js

@@ -10,7 +10,16 @@ import { hasDeclaredPredicate } from '../evaluator/declaredPredicate.js';
 import { globalUndoManager } from './UndoManager.js';
 import { warnOnDeprecatedObjectParams, warnOnUnknownActionKeys } from './actionKeys.js';
 import { readActionPayload } from './actionResponse.js';
+import { classifyNavigationTarget } from './navigationTarget.js';
 import { toPredicateRecord } from '../utils/predicate-record.js';
+/**
+ * What a navigation target outside `classifyNavigationTarget`'s admitted set
+ * answers (objectui#12191). It names the admitted set, so the author learns the
+ * fix from the refusal. ⚠️ Nothing derives this text from the classifier: a
+ * change to the set changes this sentence by hand.
+ * `navigationTarget.mailto-12191.test.ts` pins that it names each admitted kind.
+ */
+const NAVIGATION_TARGET_REFUSAL = 'Invalid URL scheme. Only http://, https://, mailto: and in-app relative paths (/path, ./path) are allowed.';
 /**
  * The text the runner writes itself, and so the only text
  * {@link ActionRunner.setTranslator}'s translator is asked for. In each entry
@@ -139,6 +148,61 @@ function readContextObjectFields(context, objectName) {
     const fields = context.objectFields;
     return fields && typeof fields === 'object' ? fields : undefined;
 }
+/**
+ * The declared actions the host published for `objectName`, or `undefined`
+ * (objectui#13022).
+ *
+ * A host publishes `objectActions` (the object's `actions` list, the
+ * declarations the platform action route resolves an action's `name` against)
+ * beside `objectName` and `objectFields`; `useConsoleActionRuntime` and
+ * `RecordDetailView` both do. Answered only for THAT object, for the reason
+ * {@link readContextObjectFields} gives: a dispatch that retargets another
+ * object names a declaration this list does not hold.
+ */
+function readContextObjectActions(context, objectName) {
+    if (!objectName || readContextObjectName(context) !== objectName)
+        return undefined;
+    const actions = context.objectActions;
+    return Array.isArray(actions) ? actions : undefined;
+}
+/** A `patch` as the route reads one: a plain object's own members, else none. */
+function patchMembers(patch) {
+    return patch && typeof patch === 'object' && !Array.isArray(patch)
+        ? { ...patch }
+        : {};
+}
+/**
+ * The static values the platform action route writes for an
+ * `operation: 'update'` dispatch: the `patch` of the DECLARATION the action's
+ * `name` names (objectui#13022).
+ *
+ * The route resolves that declaration by the dispatch's object and the
+ * action's `name`, and writes its `patch` under the params it is sent
+ * (`declarativeUpdateWrite`). A page action row's own `patch` is never that
+ * write: `@objectstack/spec` 18 retires the key on `action:button`,
+ * `action:icon` and the `action:group` / `action:menu` member, and none of
+ * those renderers forwards it. So the declaration is read from one of two
+ * places, and no third:
+ *
+ *  1. The declarations the host published for the dispatch's object
+ *     ({@link readContextObjectActions}), when they name this action: the
+ *     lookup the route performs. A declaration with no `patch` writes the
+ *     collected params alone.
+ *  2. Otherwise the def itself. A host that dispatches an object's action whole
+ *     (`ObjectGrid`'s rows, `DeclaredActionsBar`, `RelatedRecordActionsBridge`,
+ *     `page:header`) hands the runner the declaration, `patch` included. A page
+ *     row reaches the runner through a renderer, which forwards no `patch`, so
+ *     this reads nothing for one.
+ *
+ * Read for the Undo snapshot only; ⛔ never sent (objectui#12941).
+ */
+function declaredUpdatePatch(action, context, objectName) {
+    const name = typeof action.name === 'string' && action.name !== '' ? action.name : undefined;
+    const declared = name === undefined
+        ? undefined
+        : readContextObjectActions(context, objectName)?.find((candidate) => !!candidate && typeof candidate === 'object' && candidate.name === name);
+    return patchMembers(declared ? declared.patch : action.patch);
+}
 /**
  * Whether opening FormView `viewName` from a record of `contextObject` would
  * cross an object boundary (objectui#4292).
@@ -177,6 +241,14 @@ function crossesObjectBoundary(viewName, contextObject) {
 function isUpdateOperationAction(action) {
     return action.operation === 'update';
 }
+/**
+ * Whether the action declares its own success copy, read the way
+ * `composeSuccessMessage` reads its `successMessage` rung: a non-empty string.
+ * A navigation toasts only then (objectui#12755).
+ */
+function declaresSuccessMessage(action) {
+    return typeof action.successMessage === 'string' && action.successMessage.trim() !== '';
+}
 /**
  * The fields an `operation: 'update'` action writes, and their prior values.
  *
@@ -498,7 +570,26 @@ export class ActionRunner {
     unregisterScript(scriptName) {
         this.scripts.delete(scriptName);
     }
-    async execute(action) {
+    /**
+     * Run `action`; with `callContext`, run it against that context for this
+     * one dispatch (objectui#13063).
+     *
+     * The runner's context names the PAGE: its `record` and its `objectName`.
+     * A dispatch that runs against some other record, such as a related-list
+     * row on a record page, which is a record of the CHILD object, hands that
+     * record here as `{ record, objectName }`. Every executor then reads it as
+     * the record the action runs against, the way a dispatch from that record's
+     * own page does: `executeForm` forwards its id and object, and its
+     * boundary check compares the target view against the child object instead
+     * of the page's.
+     *
+     * The runner's own context is not touched: the dispatch runs on a one-shot
+     * runner over the merged context that shares this runner's handlers (see
+     * {@link ActionRunner.scopedTo}).
+     */
+    async execute(action, callContext) {
+        if (callContext)
+            return this.scopedTo(callContext).execute(action);
         try {
             // `ActionDef` accepts any key of any type, so a typo (`targt`) and a
             // retired key (`execute`) both reach here having type-checked. Neither
@@ -575,8 +666,14 @@ export class ActionRunner {
             // structured `confirm.message` read that used to OUTRANK it is retired
             // (objectui#4314): it had zero producers and no bundle key, so a dialog
             // authored that way silently lost localization.
+            //
+            // Read through `templateEvaluatorFor`, not the runner's own evaluator:
+            // a row dispatch binds no `record` in the runner's context, so a
+            // `${record.*}` hole the record header fills was shown raw from a list
+            // row (objectui#12967).
+            const templates = this.templateEvaluatorFor(action);
             if (action.confirmText) {
-                const confirmed = await this.confirmHandler(this.evaluator.evaluate(action.confirmText));
+                const confirmed = await this.confirmHandler(templates.evaluate(action.confirmText));
                 if (!confirmed) {
                     return { success: false, error: 'Action cancelled by user' };
                 }
@@ -591,75 +688,69 @@ export class ActionRunner {
                 : (Array.isArray(action.params) ? action.params : undefined);
             if (paramDefs && paramDefs.length > 0) {
                 if (this.paramCollectionHandler) {
-                    const collected = await this.paramCollectionHandler(paramDefs, action);
-                    if (collected === null) {
-                        return { success: false, error: 'Action cancelled by user (params)' };
-                    }
                     // Merge collected params into action.params as a values map for downstream consumers.
                     // Preserve any pre-attached row context (`_rowRecord`) used by list_item
                     // actions so downstream handlers (apiHandler) can inject the row id.
+                    // Read ONCE, before any run: a second `run` after a refusal merges
+                    // its values over the same base, not over the first run's values.
                     const priorParams = Array.isArray(action.params) ? {} : (action.params || {});
                     const rowRecord = priorParams._rowRecord;
-                    action.params = { ...priorParams, ...collected };
-                    if (rowRecord !== undefined)
-                        action.params._rowRecord = rowRecord;
+                    const applyCollected = (collected) => {
+                        action.params = { ...priorParams, ...collected };
+                        if (rowRecord !== undefined)
+                            action.params._rowRecord = rowRecord;
+                    };
+                    const cancelled = { success: false, error: 'Action cancelled by user (params)' };
+                    // The handler-driven session (objectui#13161) — see `ParamCollectionHandler`.
+                    // The dialog that collected the values stays open until it hears
+                    // how the run went, so a refusal lands beside what the user typed
+                    // instead of on a closed dialog.
+                    let lastRun;
+                    let inFlight = false;
+                    const run = (values) => {
+                        if (inFlight && lastRun)
+                            return lastRun;
+                        inFlight = true;
+                        lastRun = (async () => {
+                            try {
+                                let attempt;
+                                try {
+                                    applyCollected(values);
+                                    attempt = await this.dispatchCollected(action, actionType);
+                                }
+                                catch (error) {
+                                    // A dispatch that throws is a refused run, exactly as the
+                                    // `catch` at the end of `execute` reports one.
+                                    attempt = { success: false, error: error.message };
+                                }
+                                // A refused attempt gets its post-execution now, as a lone run
+                                // would; a successful one waits for the session to end below.
+                                if (!attempt.success)
+                                    await this.handlePostExecution(action, attempt);
+                                return attempt;
+                            }
+                            finally {
+                                inFlight = false;
+                            }
+                        })();
+                        return lastRun;
+                    };
+                    const collected = await this.paramCollectionHandler(paramDefs, action, (text) => String(templates.evaluate(text) ?? ''), run);
+                    if (lastRun) {
+                        const last = await lastRun;
+                        if (last.success) {
+                            await this.handlePostExecution(action, last);
+                            return last;
+                        }
+                        return collected === null ? cancelled : last;
+                    }
+                    if (collected === null) {
+                        return cancelled;
+                    }
+                    applyCollected(collected);
                 }
             }
-            // ── `operation` is read BEFORE `type`, and this is the only order that
-            // can work ────────────────────────────────────────────────────────────
-            //
-            // `operation: 'update'` is a PARALLEL key beside `type`, not a member of
-            // it: `@objectstack/spec` materializes `type: 'script'` on such an action
-            // (the platform action route is the script type's own route) and refuses
-            // any other explicit `type`. `ActionType` therefore did not gain a
-            // member, which is why `builtinExecutors` — a `Record<RunnableActionType,
-            // …>` — still compiles unchanged across the bump that added this key.
-            //
-            // The cost of that design is paid here: by the time `actionType` is
-            // consulted, an update action is indistinguishable from every other
-            // script action. Dispatched on `type` it would reach the registered
-            // `script` handler with its `patch` never merged into the request — the
-            // route would be POSTed a payload with no field values in it and answer a
-            // green success for having written nothing (objectui#2960). Worse, a row
-            // rehydrated from `sys_metadata` UNPARSED (objectui#3903) carries no
-            // materialized `type` at all, so `actionType` falls back to the action's
-            // NAME, matches no executor, and the action lands in
-            // `executeActionSchema`. Reading `operation` first is what makes both of
-            // those impossible.
-            if (isUpdateOperationAction(action)) {
-                const result = await this.executeUpdateOperation(action);
-                await this.handlePostExecution(action, result);
-                return result;
-            }
-            // Check for a registered custom handler first
-            if (actionType && this.handlers.has(actionType)) {
-                const handler = this.handlers.get(actionType);
-                const result = await handler(action, this.context);
-                await this.handlePostExecution(action, result);
-                return result;
-            }
-            // Built-in action execution by type.
-            let result;
-            const builtin = actionType
-                ? this.builtinExecutors[actionType]
-                : undefined;
-            if (builtin) {
-                result = await builtin(action);
-            }
-            else if (action.navigate) {
-                // Legacy fallback: check for navigate, api, or onClick
-                result = await this.executeNavigation(action);
-            }
-            else if (action.api || action.endpoint) {
-                result = await this.executeAPI(action);
-            }
-            else if (action.onClick) {
-                await action.onClick();
-                result = { success: true };
-            }
-            else {
-                result = await this.executeActionSchema(action);
-            }
+            const result = await this.dispatchCollected(action, actionType);
             await this.handlePostExecution(action, result);
             return result;
         }
@@ -669,6 +760,66 @@ export class ActionRunner {
             return result;
         }
     }
+    /**
+     * Dispatch an action whose params are collected, and answer what it
+     * returned — WITHOUT post-execution, which each caller runs itself:
+     * `execute` right after a lone run, and the param-collection session
+     * (`ParamCollectionHandler`'s `run`, objectui#13161) once per refused attempt
+     * and once for the successful one when the session ends.
+     */
+    async dispatchCollected(action, actionType) {
+        // ── `operation` is read BEFORE `type`, and this is the only order that
+        // can work ────────────────────────────────────────────────────────────
+        //
+        // `operation: 'update'` is a PARALLEL key beside `type`, not a member of
+        // it: `@objectstack/spec` materializes `type: 'script'` on such an action
+        // (the platform action route is the script type's own route) and refuses
+        // any other explicit `type`. `ActionType` therefore did not gain a
+        // member, which is why `builtinExecutors` — a `Record<RunnableActionType,
+        // …>` — still compiles unchanged across the bump that added this key.
+        //
+        // The cost of that design is paid here: by the time `actionType` is
+        // consulted, an update action is indistinguishable from every other
+        // script action. Dispatched on `type` it would reach the registered
+        // `script` handler as a plain script action: the route still writes the
+        // declared `patch` (it applies it from the declaration, never from the
+        // request — objectui#12941), but no Undo snapshot of the written fields
+        // would be taken, and with no `script` handler registered the action
+        // would end at `executeScript`'s "No script provided" instead of the
+        // update path's refusal naming the remedy. Worse, a row rehydrated from
+        // `sys_metadata` UNPARSED (objectui#3903) carries no materialized `type`
+        // at all, so `actionType` falls back to the action's NAME, matches no
+        // executor, and the action lands in `executeActionSchema`, reported on
+        // and never run. Reading `operation` first is what makes all of those
+        // impossible.
+        if (isUpdateOperationAction(action)) {
+            return this.executeUpdateOperation(action);
+        }
+        // Check for a registered custom handler first
+        if (actionType && this.handlers.has(actionType)) {
+            const handler = this.handlers.get(actionType);
+            return handler(action, this.context);
+        }
+        // Built-in action execution by type.
+        const builtin = actionType
+            ? this.builtinExecutors[actionType]
+            : undefined;
+        if (builtin) {
+            return builtin(action);
+        }
+        else if (action.navigate) {
+            // Legacy fallback: check for navigate, api, or onClick
+            return this.executeNavigation(action);
+        }
+        else if (action.api || action.endpoint) {
+            return this.executeAPI(action);
+        }
+        else if (action.onClick) {
+            await action.onClick();
+            return { success: true };
+        }
+        return this.executeActionSchema(action);
+    }
     /**
      * Execute multiple actions in sequence or parallel.
      */
@@ -881,7 +1032,9 @@ export class ActionRunner {
      * react-router's `navigate` — so `openIn: 'self'` is a real SPA route hop,
      * in place, immune to popup blocking. No `window.location` / `window.open`
      * mechanism is introduced here; the no-handler fallback is the same
-     * `result.redirect` hand-off `navigateTo` already uses.
+     * `result.redirect` hand-off `navigateTo` already uses. The one exception is
+     * shared with `navigateTo`: a `mailto:` target is not a route, so it is a
+     * full-page navigation in place (objectui#12191).
      *
      * **No default is written here.** `openIn` is a materialised
      * `.default('self')` in the spec, so parse output always carries a resolved
@@ -905,15 +1058,21 @@ export class ActionRunner {
         const url = this.interpolateTarget(block.navigate, action, readActionPayload(result.data));
         // `navigate` is author-supplied metadata and lands in a URL position, so
         // it goes through the same scheme guard as every other navigator here.
-        if (!this.isValidUrl(url)) {
-            console.warn('[ActionRunner] onSuccess.navigate resolved to a URL this runner refuses to open '
-                + '(only http://, https:// and relative URLs are allowed) — no navigation performed.', { action: action.name, navigate: block.navigate, resolved: url });
+        const kind = classifyNavigationTarget(url);
+        if (kind === null) {
+            console.warn(`[ActionRunner] onSuccess.navigate resolved to a URL this runner refuses to open — no navigation performed. ${NAVIGATION_TARGET_REFUSAL}`, { action: action.name, navigate: block.navigate, resolved: url });
+            return;
+        }
+        // `mailto:` hands off to the mail client in place, whatever `openIn` says,
+        // and never through the host's router (see `navigateTo`).
+        if (kind === 'mail') {
+            window.location.href = url;
             return;
         }
         const newTab = block.openIn === 'newTab';
         // Same external-URL convention `navigateTo` hands the handler; `newTab`
         // stays the declared choice alone, never `?? isExternal`.
-        const external = url.startsWith('http://') || url.startsWith('https://');
+        const external = kind === 'web';
         if (this.navigationHandler) {
             this.navigationHandler(url, { external, newTab });
             return;
@@ -948,12 +1107,34 @@ export class ActionRunner {
      * sent hunting for a field they were right not to write), and falling through
      * to `executeActionSchema` reports on an action that never ran.
      *
-     * ## `patch` rides UNDER the collected params
+     * ## `patch` is the route's: it never rides on the wire (objectui#12941)
+     *
+     * The request carries the values collected for the action's declared
+     * `params`, plus the transport keys the dispatch reads (`recordId`, and the
+     * `_rowRecord` stash it strips before POSTing) — and NOTHING from `patch`.
+     * The route applies the declared `patch` itself, from the declaration it
+     * resolves by the action's name (`@objectstack/runtime`'s
+     * `declarativeUpdateWrite`, which writes `{ ...patch, ...params }`). The
+     * patch keys are not params the action declares, so posting them makes every
+     * declarative-update button a request carrying undeclared params — the very
+     * request the ADR-0104 D2 param contract refuses (objectstack#24268). A
+     * client copy of `patch` on the wire also adds nothing: the server never
+     * reads it.
      *
-     * The spec's words: static field values "merged UNDER the user-supplied
-     * `params` so a fixed value can be declared without exposing it in the
-     * dialog". So a collected param of the same name WINS — the author declared a
-     * default, and the user answered it.
+     * The spec's words for the merge the route performs: static field values
+     * "merged UNDER the user-supplied `params` so a fixed value can be declared
+     * without exposing it in the dialog". So a collected param of the same name
+     * WINS — the author declared a default, and the user answered it. This
+     * runner still computes that same merge, but only to know what the route
+     * WROTE, which is what an Undo snapshot must cover; it is never sent.
+     *
+     * ## The `patch` in that merge is the DECLARATION's (objectui#13022)
+     *
+     * The route writes the `patch` of the declaration the action's `name` names,
+     * so that is the `patch` the snapshot covers: read by
+     * {@link declaredUpdatePatch} from the declarations the host published, else
+     * off a def that is the declaration itself. A page action row's own `patch`
+     * is never written (`@objectstack/spec` 18 retires it) and never covered.
      */
     async executeUpdateOperation(action) {
         const dispatch = this.handlers.get('script');
@@ -971,19 +1152,25 @@ export class ActionRunner {
         const collected = (action.params && !Array.isArray(action.params))
             ? { ...action.params }
             : {};
-        const patch = (action.patch && typeof action.patch === 'object' && !Array.isArray(action.patch))
-            ? { ...action.patch }
-            : {};
-        // `patch` UNDER the collected params — see the doc above.
-        const params = { ...patch, ...collected };
+        // The object the write lands on: the action's own, else the host's.
+        const objectName = action.objectName || readContextObjectName(this.context);
+        // What the route WRITES: the DECLARATION's `patch` UNDER the collected
+        // params, the route's own merge (see the doc above), never a page row's
+        // own `patch` (objectui#13022). Read for the Undo snapshot only — ⛔ never
+        // the request: the route applies `patch` from its declaration.
+        const patch = declaredUpdatePatch(action, this.context, objectName);
+        const written = { ...patch, ...collected };
         // The row stash and the record selector are transport mechanics, not
         // written fields: the dispatch strips `_rowRecord` before POSTing and reads
         // `recordId` as the record's address.
         const rowRecord = (collected._rowRecord && typeof collected._rowRecord === 'object')
             ? collected._rowRecord
             : undefined;
-        const writtenFields = Object.keys(params).filter((k) => k !== '_rowRecord' && k !== 'recordId');
-        const result = await dispatch({ ...action, params }, this.context);
+        const writtenFields = Object.keys(written).filter((k) => k !== '_rowRecord' && k !== 'recordId');
+        // What the request CARRIES: the collected values alone, as a copy of its
+        // own so a dispatch that edits its bag cannot reach the reads below.
+        const wire = { ...collected };
+        const result = await dispatch({ ...action, params: wire }, this.context);
         // A refusal is returned exactly as the dispatch reported it. The route's
         // envelope rule (`interpretActionResponse`) has already turned a 4xx/5xx
         // AND a 200-with-`success:false` business rejection into `error`, and
@@ -1000,7 +1187,6 @@ export class ActionRunner {
         // carries expanded is captured as its stored id, read against the field
         // map the host published for this object (objectui#11122).
         if (action.undoable && rowRecord && writtenFields.length > 0) {
-            const objectName = action.objectName || readContextObjectName(this.context);
             const recordId = collected.recordId ?? rowRecord.id;
             if (objectName && recordId != null) {
                 const undoData = captureUpdateUndoData(writtenFields, rowRecord, readContextObjectFields(this.context, objectName));
@@ -1016,7 +1202,7 @@ export class ActionRunner {
                         // action that declared no label is named by the object it acted on.
                         description: action.label || objectName,
                         undoData,
-                        redoData: Object.fromEntries(writtenFields.map((k) => [k, params[k]])),
+                        redoData: Object.fromEntries(writtenFields.map((k) => [k, written[k]])),
                     };
                 }
                 else {
@@ -1121,7 +1307,29 @@ export class ActionRunner {
         if (!rawUrl) {
             return { success: false, error: 'No URL provided for url action' };
         }
-        return this.navigateTo(action, rawUrl, action);
+        return this.announceNavigation(action, await this.navigateTo(action, rawUrl, action));
+    }
+    /**
+     * A navigation announces nothing unless its action declares the copy
+     * (objectui#12755).
+     *
+     * `type: 'url'`, its `navigation` alias and `type: 'form'` only change the
+     * route: nothing was written, so there is nothing to confirm. Their
+     * `{ success: true }` used to reach `handlePostExecution` like a write's, and
+     * the generic `completedSuccessfully` toast ("操作已成功完成") told the user an
+     * operation had completed when a page had merely opened (objectstack-ai/cloud#2909:
+     * an "invite member" button that only navigated read as "invitation sent").
+     *
+     * The result keeps `success: true` (callers read it as "the navigation
+     * happened") and is marked `silent`, the flag that already means "no success
+     * toast for this result". An author who wants a toast after the navigation
+     * declares `successMessage`, and that copy still shows: the declaration is the
+     * only signal, so there is no separate switch to forget.
+     */
+    announceNavigation(action, result) {
+        if (!result.success || declaresSuccessMessage(action))
+            return result;
+        return { ...result, silent: true };
     }
     /**
      * The one navigator behind `type: 'url'` and its `navigation` alias.
@@ -1145,11 +1353,19 @@ export class ActionRunner {
         // like `?provider=foo+bar`).
         const interpolated = this.interpolateTarget(rawUrl, action);
         let url = this.evaluator.evaluate(interpolated);
-        if (!this.isValidUrl(url)) {
-            return {
-                success: false,
-                error: 'Invalid URL scheme. Only http://, https://, and relative URLs are allowed.',
-            };
+        const kind = classifyNavigationTarget(url);
+        if (kind === null) {
+            return { success: false, error: NAVIGATION_TARGET_REFUSAL };
+        }
+        // A `mailto:` target opens the mail client IN PLACE (objectui#12191): it
+        // never opens a new tab, so `openIn` is not consulted. It does not go to
+        // the host's navigation handler either. The console's handler opens every
+        // `external` URL in a new tab and hands the rest to react-router, which
+        // resolves `mailto:a@b.com` as a path under the current route. So this is
+        // a full-page navigation here, the same mechanism as the `/api/` case below.
+        if (kind === 'mail') {
+            window.location.href = url;
+            return { success: true };
         }
         // Promote same-origin-style `/api/...` paths to absolute when an
         // `apiBase` is provided in context (typical of split SPA + backend
@@ -1163,7 +1379,7 @@ export class ActionRunner {
         }
         // `source.external` is the `navigation` shape's explicit override; the
         // scheme heuristic covers every other case.
-        const isExternal = Boolean(source.external) || url.startsWith('http://') || url.startsWith('https://');
+        const isExternal = Boolean(source.external) || classifyNavigationTarget(url) === 'web';
         // Same-origin API endpoints (most commonly the auth provider's
         // `/api/v1/auth/sign-in/social` redirect dance) issue server-side
         // 302s that must be followed by the *browser*, not the SPA router.
@@ -1354,9 +1570,9 @@ export class ActionRunner {
                     : '');
         if (this.navigationHandler) {
             this.navigationHandler(to, { external: false });
-            return { success: true };
+            return this.announceNavigation(action, { success: true });
         }
-        return { success: true, redirect: to };
+        return this.announceNavigation(action, { success: true, redirect: to });
     }
     /**
      * `navigation` — objectui's alias of the spec's `url` (`ObjectUiLocalActionType`).
@@ -1374,7 +1590,7 @@ export class ActionRunner {
         if (!rawUrl) {
             return { success: false, error: 'No URL provided for navigation action' };
         }
-        return this.navigateTo(action, rawUrl, nav);
+        return this.announceNavigation(action, await this.navigateTo(action, rawUrl, nav));
     }
     /**
      * Assemble the request body for the runner's OWN `executeAPI` — the path taken
@@ -1498,15 +1714,6 @@ export class ActionRunner {
             return { success: false, error: error.message };
         }
     }
-    /**
-     * Validate URL to prevent javascript: or data: protocol injection.
-     */
-    isValidUrl(url) {
-        return typeof url === 'string' && (url.startsWith('http://') ||
-            url.startsWith('https://') ||
-            url.startsWith('/') ||
-            url.startsWith('./'));
-    }
     /**
      * Substitute `${param.X}` and `${ctx.X}` tokens in an action target.
      *
@@ -1630,6 +1837,36 @@ export class ActionRunner {
         }
         return ctx;
     }
+    /**
+     * The evaluator a dispatch's authored copy is read through: `confirmText`,
+     * and the param dialog's `description` / `helpText` via the handler's
+     * `interpolate` argument.
+     *
+     * One rule for every door (objectui#12967): the record the action runs
+     * against is `record`. The record header binds it in the runner's context
+     * (`RecordDetailView`'s `ActionProvider`). A row surface does not — it
+     * stashes the clicked row under `params._rowRecord` (ObjectGrid's row
+     * actions, a related list's row actions, `DeclaredActionsBar`, a page
+     * header, `action:button`'s update write) and fires through the shared
+     * runner, whose context names the page, not the row. So when the dispatch
+     * carries a row, the row is bound as `record` for this dispatch's templates,
+     * and it wins over a page-level `record` (a related-list row on a record page
+     * is the child, not the page's record). Nothing else in the scope changes,
+     * and the runner's own context is not touched.
+     *
+     * A hole naming a field the record does not carry degrades the way the
+     * header's always has: the evaluator reads `undefined` and the hole prints
+     * empty.
+     */
+    templateEvaluatorFor(action) {
+        const params = action.params;
+        const row = params && typeof params === 'object' && !Array.isArray(params)
+            ? params._rowRecord
+            : undefined;
+        if (!row || typeof row !== 'object' || Array.isArray(row))
+            return this.evaluator;
+        return new ExpressionEvaluator({ ...this.context, record: row });
+    }
     updateContext(newContext) {
         this.context = withIdentityAlias({ ...this.context, ...newContext });
         // Feed the merged (re-aliased) context so a refreshed `user` also
@@ -1639,6 +1876,56 @@ export class ActionRunner {
     getContext() {
         return this.context;
     }
+    /**
+     * A one-shot runner for {@link ActionRunner.execute}'s `callContext`
+     * (objectui#13063): this runner's context with `callContext` merged over it,
+     * and this runner's handlers, translator and registries, shared rather than
+     * copied, so the dispatch confirms, collects params, toasts and navigates
+     * exactly as this runner does.
+     *
+     * Two keys follow the merge rather than the base:
+     *
+     *  - `ctx`, the `ctx.*` mirror `ActionProvider` publishes beside the flat
+     *    keys. A `${ctx.record.…}` hole has to read the same record as a
+     *    `${record.…}` one.
+     *  - `objectFields` / `objectActions`. A host publishes them BESIDE
+     *    `objectName`, so the pair names one object (objectui#11122,
+     *    objectui#13022). When `callContext` names another object and brings no
+     *    definitions of its own, the base's are dropped: the page object's field
+     *    types and declarations must not answer for the child's record. That is
+     *    what a dispatch with no `callContext` already gets for a retargeted
+     *    action, so the update path's capture sees the same input either way.
+     */
+    scopedTo(callContext) {
+        const objectChanged = 'objectName' in callContext &&
+            readContextObjectName(callContext) !== readContextObjectName(this.context);
+        const follow = (bag) => {
+            const merged = { ...bag, ...callContext };
+            if (objectChanged) {
+                if (!('objectFields' in callContext))
+                    delete merged.objectFields;
+                if (!('objectActions' in callContext))
+                    delete merged.objectActions;
+            }
+            return merged;
+        };
+        const merged = follow(this.context);
+        const mirror = this.context.ctx;
+        if (mirror && typeof mirror === 'object' && !Array.isArray(mirror)) {
+            merged.ctx = follow(mirror);
+        }
+        const scoped = new ActionRunner(merged);
+        scoped.handlers = this.handlers;
+        scoped.scripts = this.scripts;
+        scoped.confirmHandler = this.confirmHandler;
+        scoped.toastHandler = this.toastHandler;
+        scoped.modalHandler = this.modalHandler;
+        scoped.navigationHandler = this.navigationHandler;
+        scoped.paramCollectionHandler = this.paramCollectionHandler;
+        scoped.resultDialogHandler = this.resultDialogHandler;
+        scoped.translate = this.translate;
+        return scoped;
+    }
     /**
      * Get the expression evaluator (for components that need to evaluate visibility, etc.)
      */