@object-ui/core 6.2.3 → 7.1.0

package/CHANGELOG.md

@@ -1,5 +1,226 @@
 # @object-ui/core
 
+## 7.1.0
+
+### Patch Changes
+
+- 08c47da: feat(dashboard): dataset chart widgets paint select/lookup dimensions in their option colors
+
+  A dashboard `DatasetWidget` chart grouped by a select/lookup dimension (e.g.
+  project `health`) painted its categories from the generic `--chart-1..5`
+  palette — the same gap the chart view (`object-chart`) had before #1932. It now
+  resolves the dimension field's option colors (using the dataset's base `object`
+  - dimension→field map the query already returns) and threads them to the
+    renderer as a per-category `categoryColors` map, so health green/red/yellow
+    paints semantically.
+
+  The value/label→color resolution is extracted into a shared `buildOptionColorMap`
+  (`@object-ui/core`) now used by both `DatasetWidget` and `ObjectChart`.
+
+- Updated dependencies [677f7ed]
+- Updated dependencies [a71be60]
+- Updated dependencies [cb03bc3]
+  - @object-ui/types@7.1.0
+
+## 7.0.0
+
+### Minor Changes
+
+- f7f325d: feat: action progress state + Undo affordance
+
+  - **core**: `ActionResult.undo` (an `UndoableOperation`) and `ActionDef.undoable`.
+    On success the `ActionRunner` pushes the operation onto the global UndoManager
+    and the success toast carries an "Undo" affordance (`ToastHandler` gains an
+    `undo` option).
+  - **app-shell**: the console action runtime mounts `useGlobalUndo` (Ctrl+Z /
+    Ctrl+Shift+Z) and renders the toast's "Undo" button; its `apiHandler` resolves
+    the row id from the list row record and, for `undoable` actions, captures the
+    changed fields' prior values so the update can be reverted.
+  - **plugin-detail**: record-header quick-action buttons show a spinner + disable
+    while the action runs (a visible progress state for slow/flow actions).
+
+- c12986e: Add resultDialog + target interpolation for one-shot action reveals
+
+  Some platform actions return values the user MUST copy now because the
+  server will not surface them again — 2FA TOTP URI + backup codes, freshly
+  minted OAuth client_secret, regenerated recovery codes. Previously these
+  had to ship as bespoke pages in `apps/account` because actions only
+  emitted a fire-and-forget toast.
+
+  **`@object-ui/core` — ActionRunner**
+
+  - New `ActionDef.resultDialog: ResultDialogSpec` field. When set on a
+    successful action, the runner suppresses the `successMessage` toast and
+    awaits the registered `ResultDialogHandler` instead. Missing handler is
+    non-fatal (logs a warning); rejected handler is treated as acknowledged.
+  - New `setResultDialogHandler(handler)` setter.
+  - New types: `ResultDialogSpec`, `ResultDialogFieldSpec`,
+    `ResultDialogHandler`.
+  - `executeUrl` and `executeAPI` now run `${param.X}` and `${ctx.X}`
+    interpolation against `target` before fetching / navigating. Values are
+    `encodeURIComponent`'d, missing keys resolve to empty string. `ctx`
+    exposes `origin`, `user`, `org`, `recordId` by default; consumers can
+    inject more via `context.ctx`.
+
+  **`@object-ui/react`**
+
+  - `ActionProvider` and `useActionRunner` both gained an `onResultDialog`
+    option that wires straight through to the runner.
+
+  **`@object-ui/app-shell`**
+
+  - New `ActionResultDialog` component — promise-based, blocks click-outside
+    and Escape (the user MUST click acknowledge), renders five field
+    formats: `qrcode` (client-side via the `qrcode` package — never sent
+    off-device, so 2FA URIs stay secret), `code-list`, `secret`, `text`,
+    `json`. Falls back to `json` when a value's shape doesn't match its
+    declared format.
+  - `ObjectView` and `RecordDetailView` install the handler and mount the
+    dialog automatically, so any action with `resultDialog` declared in
+    metadata now works without code changes.
+  - New dependency: `qrcode@^1.5.x` for client-side QR rendering.
+
+  Pairs with the framework-side `Action.resultDialog` schema added in
+  `@objectstack/spec` and the `sys_two_factor` / `sys_oauth_application` /
+  `sys_account` updates in `@objectstack/platform-objects`.
+
+- 053c948: feat(app-shell): zero-roundtrip `newTabUrl` fast path for `opensInNewTab` actions
+
+  Actions that declare `newTabUrl` (a path template with a `{recordId}` placeholder
+  whose target endpoint performs all auth/authz itself) now drive the pre-opened
+  popup straight to that URL on click, skipping the action POST entirely — applied
+  to both server-action paths (list rows via `useConsoleActionRuntime`, record
+  header via `RecordDetailView`). The popup paints the existing spinner page until
+  the (possibly slow) endpoint commits its redirect; the URL is resolved absolute
+  because `about:blank` gives a bare-relative href no reliable base. The
+  popup-blocked toast fallback is unchanged. Removes one full round trip of
+  white-screen latency from every such Open click.
+
+- ddbe4a2: B2 step 3: client-side field-level conditional rules (`visibleWhen` / `readonlyWhen` / `requiredWhen`). The form renderer now evaluates these CEL predicates reactively against the live record and gates each field's visibility, read-only state, and required-ness accordingly. Evaluation delegates to the canonical `@objectstack/formula` `ExpressionEngine` — the _same_ dialect the server enforces (`requiredWhen` in the rule-validator, `readonlyWhen` in `stripReadonlyWhenFields`) — so the UX and the persisted verdict always agree. New core helpers `evalFieldPredicate` / `resolveFieldRuleState` (zero-React, fail-open). `FormField` gains `visibleWhen` / `readonlyWhen` / `requiredWhen` (+ deprecated `conditionalRequired` alias), and `ObjectForm` carries them through from object metadata.
+- d54346c: feat: action/flow completion messaging
+
+  - **core**: `ActionResult.silent` — a handler sets it when the action only
+    HANDED OFF to a follow-up UI (rather than completing), so `ActionRunner`
+    skips the automatic success toast. Fixes the misleading "Action completed
+    successfully" toast that fired the moment a `flow` action opened its wizard.
+  - **app-shell**: both flow handlers now return `silent: true` when the flow
+    pauses at a screen (the wizard only opened — it hasn't completed). `FlowRunner`
+    renders the flow's declared `successMessage` / `errorMessage` (from the
+    terminal `AutomationResult`) instead of a generic "Done" / the raw error.
+
+- 2270239: feat: scoped style-object rendering (ADR-0065)
+
+  A metadata node may carry `responsiveStyles` (per-breakpoint CSS-property maps);
+  `SchemaRenderer` compiles it to **id-scoped CSS** injected as a `<style>` tag and
+  appends a scope class to the node. Build-independent (arbitrary values + design
+  tokens pass through verbatim — no Tailwind JIT), collision-free (per-node scope,
+  unlayered so it beats base utilities), responsive-correct (model breakpoint maps
+  → generated `@media`, never `md:` variant classes). Adds `compileScopedStyles`/
+  `scopeClassFor`/`hasResponsiveStyles` to `@object-ui/core` and an SDUI design-token
+  palette (`--space-*`, `--surface`, `--brand`, …) to the theme. Mirrors Builder.io.
+
+### Patch Changes
+
+- 5976ba3: fix(core): evaluate bare CEL predicates in `evaluateCondition`
+
+  `ExpressionEvaluator.evaluateCondition` delegated to `evaluate`, which only
+  processes `${...}` templates and returns any other string verbatim. A bare
+  predicate such as `record.status == "converted"` (the shape `objectstack build`
+  emits for `disabled`/`visible`/`condition`) was therefore returned as a
+  non-empty string and coerced to `true` — so every bare-expression predicate was
+  silently always-truthy.
+
+  The most visible symptom: a param-collecting `api` action invoked from the
+  record header (e.g. CRM "Reassign Lead") was treated as permanently `disabled`,
+  so `ActionRunner.execute` bailed before opening the param dialog. The renderer
+  (`page:header`) was unaffected because it evaluates via `evaluateExpression`
+  directly.
+
+  `evaluateCondition` now treats a non-`${}` condition as a single expression
+  (via `evaluateExpression`), keeps the `${...}` template path, and preserves the
+  "empty/undefined ⇒ visible/enabled" and "unparseable ⇒ default visible/enabled"
+  fallbacks. Also hardens `ActionRunner`'s `disabled` gate to evaluate the
+  boolean/string/envelope form rather than treating any object as truthy, and
+  unifies the grid row-action predicate scope so `record.*` and bare-field
+  predicates resolve identically on every surface.
+
+- eaccefd: fix(actions): warn when an action is hidden by a throwing `visible` predicate
+
+  `ActionEngine.getActionsForLocation` is fail-closed: a `visible` predicate that
+  throws hides the action. The most common cause is an authoring bug — a BARE
+  field reference (`done` instead of `record.done`), which is undeclared in the
+  `{ record, recordId, objectName, user }` eval scope. Hiding it silently made
+  that bug invisible (a long debugging hunt). The catch now emits a one-time
+  `console.warn` naming the action + predicate + error, with the `record.<field>`
+  tip. Deduped per predicate so re-renders don't spam.
+
+- 71d7ce0: fix(actions): handle `type: 'form'` in ActionRunner
+
+  A `form` action had no `case` in `ActionRunner`'s execution switch, so it fell
+  through to `executeActionSchema` and silently no-opped — clicking a Log-Time /
+  "open form" action did nothing. Add `executeForm`, which opens the FormView as a
+  routed page (`/forms/:name`, per the action spec) via the navigation handler,
+  forwarding the current record id as `?recordId=` for hosts that support it.
+  Covered by ActionRunner unit tests.
+
+- 2d47e94: B2 follow-ups (A): field conditional rules in inline grids + submit-time enforcement.
+
+  - **Grids**: a line-item column's `readonlyWhen` / `requiredWhen` CEL rule is now honored per row — `deriveMasterDetail` carries the props onto the `GridColumn` and `GridField` evaluates them against each row via `resolveFieldRuleState` (a `readonlyWhen`-TRUE cell locks; a `requiredWhen`-TRUE empty cell flags inline-invalid). Rules are row-scoped (`record.*`); the core helpers gained an optional `scope` (and `GridField` a `contextRecord` prop) so a future header-driven lock can bind `parent.*` — that wiring is deferred (it needs the master-detail header's re-renders isolated).
+  - **Submit enforcement**: `requiredWhen` already drove react-hook-form's `required` rule, so submit is blocked with a field error when the predicate is TRUE and the value is empty. Added a reactive cleanup so a stale _required_ error clears when the predicate flips FALSE (and all errors clear when a field is hidden by `visibleWhen`).
+
+- c3749eb: feat(dashboard): dataset chart widgets drill through to records
+
+  Dataset-bound **chart** widgets (bar/line/pie/area/donut/funnel/…) are now
+  click-drillable, matching table/pivot. Clicking a segment maps it back to its
+  dataset row and opens the same governed drill drawer (raw group keys preserved),
+  so a chart-only dashboard is no longer an exploration dead-end. This closes the
+  "object-backed chart drills but dataset chart doesn't" inconsistency and aligns
+  with mainstream BI (click a chart → see records).
+
+  - `@object-ui/core`: `findChartSeriesRow` — inverse of `buildChartSeries`,
+    maps a clicked `{category, series}` back to the source dataset row index
+    (matches both dims when a 2nd dimension is pivoted into series).
+  - `ObjectChart`: optional `onSegmentClick` lets a host own the chart click
+    (and suppress the widget's own object-drill).
+  - `DatasetWidget`: lifts the drill machinery to cover both table/pivot and
+    chart, and wires the chart's segment click to the precise dataset drill.
+
+- 1394e34: feat(chart): visualise the second dataset dimension as grouped series
+
+  A dataset chart with two dimensions (e.g. `['status','priority']`) previously
+  only rendered the first dimension — the second was invisible (repeated x-axis
+  labels, no grouping). New shared `buildChartSeries` helper (`@object-ui/core`)
+  pivots the second dimension into one series per value; `ObjectChart`
+  (plugin-charts) and `DatasetWidget` (plugin-dashboard) both use it, so
+  multi-dimension charts render consistently as grouped/coloured bars.
+
+  Refs objectstack-ai/objectui#1759, objectstack-ai/framework#1890
+
+- 7c239fd: Add `ComponentRegistry.unregister(type, namespace?)` — the inverse of
+  `register()`. Clears the namespaced key and the bare-name fallback (when it
+  still resolves to that registration) plus any matching lazy stub, and notifies
+  subscribers only when something was removed. Lets callers (and tests) restore
+  prior registry state cleanly.
+- 8d1195d: Fix `type: 'url'` actions so they actually reach the backend in split-origin dev setups, and so reveal-once result dialogs render.
+
+  - `ActionRunner.executeUrl`: when context provides `apiBase`, relative `/api/...`, `/_auth/...`, and `/_account/...` URLs are now promoted to absolute (`${apiBase}${path}`) before navigation. Same-origin API paths (with or without `apiBase`) trigger a full-page `window.location.href` rather than React-Router push — this is required for server-side OAuth redirect dances (e.g. better-auth `/sign-in/social`) that React Router would otherwise swallow into the SPA's fallback route.
+  - `ActionRunner.buildInterpolationContext`: surfaces `ctx.apiBase` for action targets that want to template it explicitly.
+  - `ObjectView`: passes `apiBase: import.meta.env.VITE_SERVER_URL` into the toolbar `ActionProvider` context so the above resolves.
+  - `action-button` and `action-menu` renderers now forward `resultDialog` when invoking the runner. Previously this field was silently dropped by an explicit whitelist, breaking every "show once, then hide" flow (2FA QR/backup codes, OAuth client_secret, regenerated tokens).
+
+- Updated dependencies [ddbe4a2]
+- Updated dependencies [9049bbe]
+- Updated dependencies [cb2fdb1]
+- Updated dependencies [6cfa330]
+- Updated dependencies [ad8ade6]
+- Updated dependencies [3870c20]
+- Updated dependencies [b88c560]
+- Updated dependencies [d16566f]
+- Updated dependencies [300d755]
+- Updated dependencies [4eb9cb6]
+- Updated dependencies [858ad94]
+  - @object-ui/types@7.0.0
+
 ## 6.2.3
 
 ### Patch Changes

package/dist/actions/ActionEngine.d.ts

@@ -16,8 +16,16 @@
  *   ActionSchema[] → ActionEngine → ActionRunner → ActionResult
  */
 import { ActionRunner, type ActionDef, type ActionContext, type ActionResult } from './ActionRunner';
-/** Action location types (from @objectstack/spec) */
-export type ActionLocation = 'list_toolbar' | 'list_item' | 'record_header' | 'record_more' | 'record_related' | 'global_nav';
+/**
+ * Action location types — re-exported from `@objectstack/spec/ui` so the
+ * platform has one source of truth (`ACTION_LOCATIONS`). Do NOT redeclare
+ * this enum locally; add new values in
+ * `framework/packages/spec/src/ui/action.zod.ts` and they propagate here
+ * automatically.
+ */
+export type { ActionLocation } from '@object-ui/types';
+export { ACTION_LOCATIONS } from '@object-ui/types';
+import type { ActionLocation } from '@object-ui/types';
 /** Registered action with metadata */
 export interface RegisteredAction {
     action: ActionDef;
@@ -51,7 +59,16 @@ export declare class ActionEngine {
     private shortcuts;
     private normalizedShortcutMap;
     private runner;
-    constructor(context?: ActionContext);
+    /**
+     * @param contextOrRunner Either an initial `ActionContext` (constructs a
+     *  new local `ActionRunner`) or an existing `ActionRunner` to share.
+     *  Sharing is how nested consumers (e.g. `record:quick_actions` inside
+     *  an `<ActionProvider>`) inherit the provider's confirm/param/modal/
+     *  toast/navigate handlers without redeclaring them — without this,
+     *  any action declaring `params: [...]` or `confirmText` would silently
+     *  no-op in the nested engine.
+     */
+    constructor(contextOrRunner?: ActionContext | ActionRunner);
     /** Get the underlying ActionRunner for handler configuration */
     getRunner(): ActionRunner;
     /** Register a single action */
@@ -67,7 +84,28 @@ export declare class ActionEngine {
     unregisterAction(name: string): void;
     /** Add an event-to-action mapping */
     addMapping(mapping: ActionMapping): void;
-    /** Get actions available at a specific location, sorted by priority */
+    /**
+     * Get actions available at a specific location, sorted by priority.
+     *
+     * Filtering applied (in order):
+     *   1. `locations.includes(location)` — location/region match
+     *   2. `action.visible` — evaluated against the runner's current context
+     *      ({ record, recordId, objectName, user, … }). Missing or `true`
+     *      passes; any other value is coerced to boolean. Evaluator errors
+     *      hide the action (fail-closed) rather than throwing — this matches
+     *      the contract used by every individual action renderer
+     *      (`action-button`, `action-menu`, `action-bar`, …) so the same
+     *      action behaves identically whether surfaced via the engine or
+     *      consumed standalone.
+     *
+     *   Predicate normalization matches `@object-ui/react`'s `toPredicateInput`:
+     *   raw strings (`'record.foo == true'`) are wrapped as `${...}` so they
+     *   evaluate as expressions, not as truthy string literals. Spec-style
+     *   `{ dialect, source }` envelopes are unwrapped to their `source`.
+     *   Without this, every per-action renderer (which already calls
+     *   `toPredicateInput`) and the engine path would disagree on the same
+     *   `visible:` predicate.
+     */
     getActionsForLocation(location: ActionLocation): ActionDef[];
     /** Get actions that support bulk operations */
     getBulkActions(): ActionDef[];

package/dist/actions/ActionEngine.js

@@ -16,12 +16,43 @@
  *   ActionSchema[] → ActionEngine → ActionRunner → ActionResult
  */
 import { ActionRunner } from './ActionRunner';
+export { ACTION_LOCATIONS } from '@object-ui/types';
 /** Normalize a shortcut string for comparison (lowercase, trimmed, sorted parts) */
 function normalizeShortcut(keys) {
     return keys.toLowerCase().split('+').map(k => k.trim()).sort().join('+');
 }
+/** De-dupe key set so a broken predicate warns once, not every re-render. */
+const _warnedPredicates = new Set();
+/**
+ * Surface an action whose `visible` predicate threw (and was therefore
+ * fail-closed hidden). Almost always an authoring bug — typically a bare field
+ * reference that should be `record.<field>`. Warned once per predicate.
+ */
+function warnHiddenPredicate(name, raw, err) {
+    const src = typeof raw === 'string'
+        ? raw
+        : (raw && typeof raw === 'object' && typeof raw.source === 'string' ? raw.source : String(raw));
+    const key = `${String(name)}::${src}`;
+    if (_warnedPredicates.has(key))
+        return;
+    _warnedPredicates.add(key);
+    const msg = err instanceof Error ? err.message : String(err);
+    // eslint-disable-next-line no-console
+    console.warn(`[ActionEngine] action "${String(name)}" hidden: its \`visible\` predicate threw — ${msg}. ` +
+        `Predicate: ${src}. Action predicates evaluate against { record, recordId, objectName, user, … }; ` +
+        `use \`record.<field>\` (not a bare field).`);
+}
 export class ActionEngine {
-    constructor(context = {}) {
+    /**
+     * @param contextOrRunner Either an initial `ActionContext` (constructs a
+     *  new local `ActionRunner`) or an existing `ActionRunner` to share.
+     *  Sharing is how nested consumers (e.g. `record:quick_actions` inside
+     *  an `<ActionProvider>`) inherit the provider's confirm/param/modal/
+     *  toast/navigate handlers without redeclaring them — without this,
+     *  any action declaring `params: [...]` or `confirmText` would silently
+     *  no-op in the nested engine.
+     */
+    constructor(contextOrRunner = {}) {
         Object.defineProperty(this, "actions", {
             enumerable: true,
             configurable: true,
@@ -52,7 +83,10 @@ export class ActionEngine {
             writable: true,
             value: void 0
         });
-        this.runner = new ActionRunner(context);
+        this.runner =
+            contextOrRunner instanceof ActionRunner
+                ? contextOrRunner
+                : new ActionRunner(contextOrRunner);
     }
     /** Get the underlying ActionRunner for handler configuration */
     getRunner() {
@@ -100,10 +134,87 @@ export class ActionEngine {
     addMapping(mapping) {
         this.mappings.push(mapping);
     }
-    /** Get actions available at a specific location, sorted by priority */
+    /**
+     * Get actions available at a specific location, sorted by priority.
+     *
+     * Filtering applied (in order):
+     *   1. `locations.includes(location)` — location/region match
+     *   2. `action.visible` — evaluated against the runner's current context
+     *      ({ record, recordId, objectName, user, … }). Missing or `true`
+     *      passes; any other value is coerced to boolean. Evaluator errors
+     *      hide the action (fail-closed) rather than throwing — this matches
+     *      the contract used by every individual action renderer
+     *      (`action-button`, `action-menu`, `action-bar`, …) so the same
+     *      action behaves identically whether surfaced via the engine or
+     *      consumed standalone.
+     *
+     *   Predicate normalization matches `@object-ui/react`'s `toPredicateInput`:
+     *   raw strings (`'record.foo == true'`) are wrapped as `${...}` so they
+     *   evaluate as expressions, not as truthy string literals. Spec-style
+     *   `{ dialect, source }` envelopes are unwrapped to their `source`.
+     *   Without this, every per-action renderer (which already calls
+     *   `toPredicateInput`) and the engine path would disagree on the same
+     *   `visible:` predicate.
+     */
     getActionsForLocation(location) {
+        const evaluator = this.runner.getEvaluator();
         return Array.from(this.actions.values())
             .filter(ra => ra.locations.includes(location))
+            .filter(ra => {
+            // [ADR-0066 D4] Capability gate (UI half — the server enforces the
+            // source of truth). Hide an action whose `requiredPermissions` are not
+            // ALL held by the caller's `systemPermissions`. Fail-OPEN when
+            // systemPermissions is unknown (undefined): the server still 403s, and
+            // hiding on missing data is a worse regression than showing a button
+            // that errors clearly. Mirrors the App/nav requiredPermissions gate.
+            const required = ra.action.requiredPermissions;
+            if (!Array.isArray(required) || required.length === 0)
+                return true;
+            const held = this.runner.getContext()?.user?.systemPermissions;
+            if (!Array.isArray(held))
+                return true;
+            return required.every((p) => held.includes(p));
+        })
+            .filter(ra => {
+            const raw = ra.action.visible;
+            if (raw == null || raw === '' || raw === true)
+                return true;
+            if (raw === false)
+                return false;
+            let expr;
+            if (typeof raw === 'string') {
+                expr = `\${${raw}}`;
+            }
+            else if (typeof raw === 'object' && typeof raw.source === 'string') {
+                const src = raw.source;
+                if (!src)
+                    return true;
+                expr = `\${${src}}`;
+            }
+            else {
+                expr = Boolean(raw);
+            }
+            try {
+                // `throwOnError: true` is required for fail-closed semantics: the
+                // evaluator's default behavior swallows expression errors and
+                // returns the raw template string, which `Boolean(string)` then
+                // coerces to `true` — silently leaking actions whose preconditions
+                // failed (e.g. `ctx` undefined). Surface the error so our catch
+                // below can hide the action.
+                return evaluator.evaluateCondition(expr, { throwOnError: true });
+            }
+            catch (err) {
+                // Fail-closed: hide the action. But a *thrown* predicate is almost
+                // always an authoring bug, not a real precondition — most often a
+                // BARE field reference (`done` instead of `record.done`), which is
+                // an undeclared variable in the `{ record, recordId, objectName,
+                // user }` eval scope. Silently hiding it makes that bug invisible
+                // (the #2183 hunt). Warn once per predicate so it is diagnosable
+                // without spamming re-renders.
+                warnHiddenPredicate(ra.action.name, raw, err);
+                return false;
+            }
+        })
             .sort((a, b) => (a.priority ?? 100) - (b.priority ?? 100))
             .map(ra => ra.action);
     }

package/dist/actions/ActionRunner.d.ts

@@ -14,6 +14,7 @@
  * redirect handling, action chaining, custom handler registration.
  */
 import { ExpressionEvaluator } from '../evaluator/ExpressionEvaluator';
+import { type UndoableOperation } from './UndoManager';
 export interface ActionResult {
     success: boolean;
     data?: any;
@@ -23,6 +24,20 @@ export interface ActionResult {
     redirect?: string;
     /** Modal schema to render (for type: 'modal') */
     modal?: any;
+    /**
+     * Suppress the automatic success toast for this result. A handler sets this
+     * when the action only HANDED OFF to a follow-up UI rather than completing —
+     * e.g. a `flow` action that paused at a screen and opened the flow-runner. The
+     * action hasn't "completed yet", so a "success" toast on open would be
+     * misleading; the follow-up surface owns its own completion messaging.
+     */
+    silent?: boolean;
+    /**
+     * An undoable operation captured by the handler (e.g. an `undoable` update
+     * action's prior field values). When present, the runner pushes it onto the
+     * global UndoManager and the success toast offers an "Undo" affordance.
+     */
+    undo?: UndoableOperation;
 }
 export interface ActionContext {
     data?: Record<string, any>;
@@ -102,10 +117,18 @@ export interface ActionDef {
     errorMessage?: string;
     /** Whether to refresh data after execution (from UIActionSchema) */
     refreshAfter?: boolean;
+    /** Single-record update actions: offer an Undo affordance on success. */
+    undoable?: boolean;
     /** Params object (for custom handlers) */
     params?: Record<string, any>;
     /** ActionParam definitions to collect from user before execution (from spec ActionSchema.params) */
     actionParams?: ActionParamDef[];
+    /**
+     * Result dialog spec — when present and the action succeeds, the runner
+     * suppresses the successMessage toast and asks the consumer to open a
+     * reveal dialog rendering `result.data` (see ResultDialogSpec).
+     */
+    resultDialog?: ResultDialogSpec;
     /** Script/expression to execute (for type: 'script') */
     execute?: string;
     /** Target URL or identifier (for type: 'url', 'modal', 'flow') */
@@ -124,6 +147,12 @@ export interface ActionDef {
      *  handler can drive it to a returned `redirectUrl` after an awaited fetch
      *  without tripping popup blockers. Used by actions like `sso_as_owner`. */
     opensInNewTab?: boolean;
+    /** Zero-roundtrip new-tab target: a path template (`{recordId}` placeholder)
+     *  the handler navigates the pre-opened tab to IMMEDIATELY on click, skipping
+     *  the action POST entirely. Only valid with `opensInNewTab`; the endpoint
+     *  must perform all auth/authz itself (e.g. the cloud `/sso-open` endpoint,
+     *  which re-runs every check the POST half would have done). */
+    newTabUrl?: string;
     /** Any additional properties */
     [key: string]: any;
 }
@@ -143,6 +172,11 @@ export type ConfirmationHandler = (message: string, options?: {
 export type ToastHandler = (message: string, options?: {
     type?: 'success' | 'error' | 'info' | 'warning';
     duration?: number;
+    /** When set, the toast offers an "Undo" affordance (the runner has already
+     *  pushed the operation onto the global UndoManager). */
+    undo?: {
+        label?: string;
+    };
 }) => void;
 /**
  * Modal handler — consumers provide to render modal dialogs.
@@ -162,6 +196,35 @@ export type NavigationHandler = (url: string, options?: {
  * Returns collected values, or null if cancelled.
  */
 export type ParamCollectionHandler = (params: ActionParamDef[], action?: ActionDef) => Promise<Record<string, any> | null>;
+/**
+ * Result dialog spec — declarative description of how to render a
+ * one-shot reveal of an action's API response. Mirrors
+ * `Action.resultDialog` in @objectstack/spec.
+ *
+ * When set on an action and the action succeeds, the runner suppresses
+ * the success toast and awaits a ResultDialogHandler instead. Used for
+ * values the user must copy NOW (2FA secret, OAuth client_secret, backup
+ * codes).
+ */
+export interface ResultDialogFieldSpec {
+    path: string;
+    label?: string;
+    format?: 'qrcode' | 'code-list' | 'secret' | 'text' | 'json';
+}
+export interface ResultDialogSpec {
+    title?: string;
+    description?: string;
+    acknowledge?: string;
+    format?: 'qrcode' | 'code-list' | 'secret' | 'text' | 'json';
+    fields?: ResultDialogFieldSpec[];
+}
+/**
+ * Result dialog handler — consumers provide to render the post-success
+ * reveal dialog. Returns a promise that resolves when the user
+ * acknowledges. Errors / rejections are treated as acknowledge for
+ * cleanup purposes (the action already succeeded).
+ */
+export type ResultDialogHandler = (spec: ResultDialogSpec, data: unknown, action?: ActionDef) => Promise<void>;
 /**
  * ActionParam definition accepted by the runner.
  * Compatible with @objectstack/spec ActionParam.
@@ -210,6 +273,7 @@ export declare class ActionRunner {
     private modalHandler;
     private navigationHandler;
     private paramCollectionHandler;
+    private resultDialogHandler;
     constructor(context?: ActionContext);
     /**
      * Set a custom confirmation handler (e.g., Shadcn AlertDialog).
@@ -232,6 +296,12 @@ export declare class ActionRunner {
      * ActionParam values before action execution.
      */
     setParamCollectionHandler(handler: ParamCollectionHandler): void;
+    /**
+     * Set a result dialog handler — shows a one-shot reveal dialog after
+     * a successful action whose spec declares `resultDialog`. Used for
+     * values the user must copy now (2FA codes, OAuth client_secret).
+     */
+    setResultDialogHandler(handler: ResultDialogHandler): void;
     registerHandler(actionName: string, handler: ActionHandler): void;
     unregisterHandler(actionName: string): void;
     /**
@@ -275,6 +345,14 @@ export declare class ActionRunner {
     /**
      * Execute navigation action
      */
+    /**
+     * `form` action — open a FormView as a routed page (`/forms/:name`, per the
+     * spec). `target` is the FormView name. Without this case the action fell
+     * through to `executeActionSchema` and silently no-opped (the "Log Time does
+     * nothing" report). The current record id is forwarded as `?recordId=` for
+     * hosts that support it; the form route ignores unknown query params.
+     */
+    private executeForm;
     private executeNavigation;
     /**
      * Execute API action — supports both simple string endpoint and complex ApiConfig.
@@ -284,6 +362,34 @@ export declare class ActionRunner {
      * Validate URL to prevent javascript: or data: protocol injection.
      */
     private isValidUrl;
+    /**
+     * Substitute `${param.X}` and `${ctx.X}` tokens in an action target.
+     *
+     * Used by executeUrl and executeAPI so metadata can produce dynamic
+     * URLs without coupling to the wider ExpressionEvaluator surface
+     * (which would also evaluate operators, member access, etc. — overkill
+     * and unsafe for URL-position values).
+     *
+     * Every substituted value is `encodeURIComponent`'d, since the only
+     * legitimate use case so far (better-auth `/sign-in/social?provider=…`)
+     * places interpolated values in URL query positions. Callers MUST
+     * therefore put tokens after a `?` or `&` — using `${param.x}` inside a
+     * path segment will produce percent-encoded slashes, which is the
+     * correct behaviour for opaque IDs but would break a literal path
+     * fragment.
+     *
+     * `ctx.origin`, `ctx.user.*`, `ctx.org.*`, `ctx.recordId` are surfaced
+     * implicitly from the runner's ActionContext + window. Consumers can
+     * extend by stuffing extra keys under `context.ctx = {...}` before
+     * calling `runner.execute()`.
+     */
+    private interpolateTarget;
+    /**
+     * Assemble the `ctx` namespace exposed to target interpolation.
+     * Built-in keys: origin, user, org, recordId. Anything the consumer
+     * placed under context.ctx is merged on top.
+     */
+    private buildInterpolationContext;
     updateContext(newContext: Partial<ActionContext>): void;
     getContext(): ActionContext;
     /**