@object-ui/fields 16.0.0 → 17.1.0

package/CHANGELOG.md

@@ -1,5 +1,635 @@
 # @object-ui/fields
 
+## 17.1.0
+
+### Minor Changes
+
+- f8a95e5: fix(fields): the sharing-criteria builder stops calling an empty criteria "All records" (objectstack#3896)
+
+  `FilterConditionField` renders `sys_sharing_rule.criteria_json`. With no
+  criteria it displayed **"All records"**, and `filterGroupToMongo` carried a
+  matching `// empty = match all` comment. That was describing a bug as a
+  feature: a sharing rule with no predicate was stored as `criteria_json: null`
+  and evaluated as `find(object, { filter: {} })` under the system context —
+  every record of the object, granted to the recipient. `SharingRuleSchema` had
+  always forbidden the shape ("never seeded as a permissive match-all",
+  ADR-0049); the REST and data-API entries just never checked.
+
+  objectstack#3896 closes those entries: the server now refuses to save a rule
+  whose criteria would match everything, and one already stored shares nothing.
+  This is the renderer catching up.
+
+  - **The empty read-only state now says the rule shares nothing**, in
+    `destructive` styling — key renamed `fields.filterCondition.allRecords` →
+    `fields.filterCondition.noCriteria`, retranslated across all ten locales.
+    Nothing else read the old key.
+  - **A new `fields.filterCondition.criteriaRequired` hint** renders under the
+    builder (and the JSON editor) while the criteria is empty. The server's
+    rejection is precise but only arrives as a toast _after_ Save; this says it
+    while the admin is still looking at the empty builder.
+  - **`isMatchAllCriteria` is exported** — a client-side mirror of the server
+    predicate covering `{}`, `[]`, and the vacuous combinators (`{ $and: [] }`,
+    `{ $or: [{}] }`), conservative in the same direction. The server stays
+    authoritative; this only decides whether to show the hint.
+
+  Unparsable JSON keeps its own `invalidJson` message and does **not** also
+  collect the empty-criteria hint.
+
+  Note for anyone wiring this end-to-end: the Criteria field is not marked
+  `required` in the object metadata, deliberately — `sys_sharing_rule.criteria_json`
+  is nullable in deployed tenants, so `required: true` would only produce a
+  destructive `NOT NULL` migration that those nulls block. The invariant lives in
+  the server's write guards; this change makes the UI stop contradicting it.
+
+### Patch Changes
+
+- aecc934: fix(fields): PeoplePicker's keyboard cursor can no longer be eaten by a late reset
+
+  The cursor reset on new results lived in a `useEffect`. Effects flush
+  asynchronously after the render that delivered the records — so a reset queued
+  by their arrival could land AFTER a subsequent ArrowDown and wipe the just-set
+  cursor. That was the residual ArrowDown→Enter flake in
+  `PeoplePicker.test.tsx` (the earlier signature-keyed fix closed the
+  too-often resets, not the too-late one), and a real fast-fingers UX bug: rows
+  appear, the user presses ArrowDown, the highlight vanishes.
+
+  The reset now runs in the render phase (the "adjusting state during render"
+  pattern), in the same render that shows the new rows — by the time a row is
+  visible, the reset has already happened, so it can never race a keypress.
+  Semantics unchanged and now pinned by a test: a replaced result set does not
+  inherit the previous set's cursor.
+
+- 7f23cd0: fix(form): a numeric/boolean select option survives selection with its type intact — #3090
+
+  `SelectOptionSchema.value` has accepted `string | number | boolean` for as
+  long as it has existed, but the Radix controls underneath speak strings:
+  picking `{ value: 2 }` silently submitted `"2"` — a wrong-typed write into a
+  number field that nothing on the client ever reported. (Display half-worked:
+  a numeric default matched its numeric item; only SELECTION morphed the type.)
+
+  The renderers now stringify on the way into the control and map the selection
+  back to the AUTHORED option value on the way out (`matchOptionValue`), across
+  the in-form select, the standalone `type: 'select'` component, and the
+  standalone `type: 'radio-group'` component. The TS types stop lying to match:
+  `SelectOption.value` / `RadioOption.value` and the corresponding
+  `value`/`defaultValue`/`onChange` channels widen to what the zod schemas
+  always accepted — a call site treating `option.value` as `string` is now a
+  compile error pointing at a real latent crash, not a false comfort.
+
+  The ripple the widening named, handled at each boundary: `@object-ui/core`'s
+  `OptionLike.value` widens (the option engines compare by identity, so values
+  flow opaquely; the option-lint's CEL-literal domain stringifies at its
+  boundary), and the multi-value field widgets (checkboxes / multiselect /
+  radio) stringify at theirs — multi-value fields store string arrays.
+
+  Round-trip pinned by real Radix interactions in jsdom: the in-form select
+  submits `2` (number), the standalone select hands its handler `false`
+  (boolean).
+
+- Updated dependencies [62311b6]
+- Updated dependencies [fc0272a]
+- Updated dependencies [9e7349e]
+- Updated dependencies [8864971]
+- Updated dependencies [1cf0de7]
+- Updated dependencies [752e18f]
+- Updated dependencies [c785740]
+- Updated dependencies [b41f401]
+- Updated dependencies [19e9fa0]
+- Updated dependencies [d61efd1]
+- Updated dependencies [95b7214]
+- Updated dependencies [7d9734d]
+- Updated dependencies [6ae818e]
+- Updated dependencies [9eb932b]
+- Updated dependencies [746dd00]
+- Updated dependencies [aebfa4f]
+- Updated dependencies [38ca8be]
+- Updated dependencies [3cb9646]
+- Updated dependencies [68ef584]
+- Updated dependencies [4952edf]
+- Updated dependencies [7f0252e]
+- Updated dependencies [c4d7b20]
+- Updated dependencies [c769d3d]
+- Updated dependencies [7639a61]
+- Updated dependencies [94e63ef]
+- Updated dependencies [c735bf7]
+- Updated dependencies [02aef0c]
+- Updated dependencies [6f29aa5]
+- Updated dependencies [d21794c]
+- Updated dependencies [c4db402]
+- Updated dependencies [5319bf1]
+- Updated dependencies [49e5671]
+- Updated dependencies [9a04d25]
+- Updated dependencies [b5b97e2]
+- Updated dependencies [f59f2c1]
+- Updated dependencies [07de839]
+- Updated dependencies [2a40b5e]
+- Updated dependencies [df613fa]
+- Updated dependencies [4874117]
+- Updated dependencies [ad0183a]
+- Updated dependencies [ce08d55]
+- Updated dependencies [eb4b740]
+- Updated dependencies [5b084eb]
+- Updated dependencies [aa1240a]
+- Updated dependencies [2374a49]
+- Updated dependencies [390c071]
+- Updated dependencies [d10f526]
+- Updated dependencies [2d5d594]
+- Updated dependencies [ea7f477]
+- Updated dependencies [379728f]
+- Updated dependencies [7f23cd0]
+- Updated dependencies [0ded602]
+- Updated dependencies [24e0e0a]
+- Updated dependencies [f8a95e5]
+- Updated dependencies [3a6cf24]
+- Updated dependencies [aa35561]
+- Updated dependencies [03bd53b]
+- Updated dependencies [3c1f321]
+- Updated dependencies [a045a32]
+- Updated dependencies [912496d]
+- Updated dependencies [80edbd4]
+- Updated dependencies [9867281]
+  - @object-ui/core@17.1.0
+  - @object-ui/components@17.1.0
+  - @object-ui/react@17.1.0
+  - @object-ui/types@17.1.0
+  - @object-ui/i18n@17.1.0
+  - @object-ui/providers@17.1.0
+
+## 17.0.0
+
+### Minor Changes
+
+- 697cda4: feat(fields): adopt the file-as-reference value shape (ObjectStack ADR-0104 D3 wave 2)
+
+  A `file`/`image` field value now reaches the UI in one of three forms, and the
+  rules for reading them live in one place — `@object-ui/fields`' new
+  `file-value` module — instead of being re-derived in each widget:
+
+  1. **Reference** — a bare `sys_file` id string, what the backend stores once
+     file-as-reference is adopted.
+  2. **Expanded** — `{ id, name, size, mimeType, url }`, what the read path
+     returns after resolving a reference.
+  3. **Legacy inline blob** — `{ file_id?, name, original_name, size, mime_type,
+url }`, the pre-reference shape this package used to build itself.
+
+  **The casing split is the bug this fixes.** The expanded form carries
+  `mimeType`; the legacy blob carries `mime_type`. `FileField`, `FileCell` and
+  `ImageField` all read only `mime_type`, so the moment a backend starts returning
+  the expanded form they stop recognising images — thumbnails silently degrade to
+  a generic file icon, with nothing pointing at a value shape as the cause.
+  `readFileValue()` accepts both.
+
+  **Uploads now submit the reference form** — the bare `sys_file` id — when the
+  upload adapter surfaced one, falling back to the legacy blob when it did not
+  (the object-URL fallback adapter, or a backend predating file-as-reference). The
+  same build therefore works against both. Action params already POSTed a bare
+  fileId; record field values now use the same contract, and
+  `serializeParamValues` shares the `fileIdOf()` extractor so the two surfaces
+  cannot drift on what counts as an id.
+
+  Because a bare id carries no name or URL, each widget remembers the display
+  details of files it just uploaded, keyed by id, so an upload renders immediately
+  rather than showing a bare token until the next read enriches it.
+
+### Patch Changes
+
+- 4b1ed7d: feat(app-shell): approval approver values become record lookups (framework #3508)
+
+  - The flow designer's approver `Value` cell now sources directory kinds from DATA
+    records instead of the metadata registry: `user` / `team` / `department` / `position`
+    render a single-select record lookup (`LookupField` over `sys_user` / `sys_team` /
+    `sys_business_unit` / `sys_position` via the DataSource adapter), with a manual-entry
+    escape hatch and a plain free-text fallback when no adapter is available (offline
+    preview). `position` commits the machine name; the others commit the record id —
+    matching the approval engine's resolution semantics.
+  - `org-membership-level` is now a strict select (owner/admin/member); a stored
+    out-of-enum value renders flagged instead of being blanked.
+  - `manager` renders as an auto-resolved (disabled) cell; `queue` is no longer offered
+    for new approver rows and stored queue rows carry a "not supported by the runtime"
+    warning.
+  - `@object-ui/fields`: `LookupField` hydrates the selected label through `id_field`
+    when it is not the primary id (e.g. `id_field: 'name'`), instead of always calling
+    `findOne` with the primary id.
+
+- 3e886eb: fix(i18n): localize FileField upload widget + approvals snapshot field labels
+
+  - `FileField` (the shared upload widget) hard-coded every visible string
+    ("Drag & drop files here", "or click to browse", "Take photo", "Uploading…",
+    size/upload validation messages, …). They now route through
+    `useObjectTranslation` with new `fields.file.*` keys, translated across all
+    10 locale bundles. This is why the approvals Approve/Reject dialog's
+    attachment dropzone was English in a Chinese console.
+  - The approvals inbox record-snapshot summary title-cased raw machine keys
+    instead of the target object's field labels. It now consumes the
+    server-sent `payload_labels` in `payloadSummary`/`decisionAmountEntry`,
+    falling back to the prettified key when absent; `approvalsApi`'s row type
+    gains `payload_labels`.
+
+- faad45e: fix(fields): render `image` fields consistently and add click-to-zoom (#2836)
+
+  An `image` field rendered differently — and wrongly — on three surfaces:
+
+  - **Edit form showed broken thumbnails.** A record read back its `image` value
+    as a bare `sys_file` id (the reference form), but `readFileValue` returned an
+    id with no URL — the comment assumed the read path expands it, which the
+    edit-form data path does not. The result was `<img src="">`. `file-value` now
+    derives the stable download URL (`/api/v1/storage/files/:id`, which
+    302-redirects to a signed URL and works directly as `<img src>`) for a bare
+    id or an id-only object, so every widget and cell renderer resolves one.
+  - **Inline edit leaked the raw storage URL.** `InlineFieldInput` had no branch
+    for file-backed types and fell through to a plain text input showing
+    `/api/v1/storage/files/…`. It now renders the same upload widgets the form
+    uses (`image`/`avatar`/`signature`/`file`/`video`/`audio`).
+  - **Hard-coded English.** `ImageField`'s upload/crop/remove/alt strings now go
+    through `t('fields.image.*')` (en + zh added).
+
+  Also adds an `ImageLightbox` — click a read-only thumbnail (detail or list cell)
+  to open a full-screen preview; multiple images get prev/next navigation, a
+  position counter and arrow-key support, a single image just the image. In a
+  grid cell the click is `stopPropagation`-guarded so enlarging doesn't also open
+  the row.
+
+- 341bfb5: fix: read spec-canonical keys for dashboard header title and field length rules
+
+  Two naming-drift closeouts (framework#1878 / framework#1891):
+
+  - `DashboardRenderer` header now falls back to the spec-canonical `label` when
+    the legacy `title` is absent (mirrors the `DashboardGridLayout` fallback from
+    #2666) — a spec-compliant dashboard gets its header title.
+  - Field validation rules now read the spec-canonical camelCase
+    `minLength`/`maxLength` (what the server record-validator enforces) with the
+    legacy snake_case `min_length`/`max_length` kept as fallback — authored
+    length constraints reach the client form.
+
+- 2f947e4: fix(page,field): consume the spec's `type`/`label`/`maxLength` keys (framework#1878 §3 naming-drift recheck)
+
+  Three forward-drifts where objectui read a different key than the spec
+  declares, so authoring the documented key silently no-oped:
+
+  - **page `type` → `pageType`** (app-shell + components): `PageSchema` declares
+    the page KIND as `type`, but `PageRenderer` reads `schema.pageType` and fell
+    back to `'record'` — and nothing mapped between them. Every non-record page
+    (`home`/`app`/`list`/`utility`) rendered with the record max-width, a wrong
+    `data-page-type` attribute, and a suppressed header. `PageView` now passes
+    `pageType` alongside the SchemaNode discriminator `type`.
+  - **page `label` → `title`** (components): `PageSchema.label` is required but the
+    region renderer read only `title`. Now dual-reads `title ?? label`, mirroring
+    the fallback `DashboardRenderer` already uses. Coupled with the above — the
+    header is gated on `pageType !== 'record'`, so both were needed for a title to
+    appear.
+  - **field `maxLength`/`minLength`** (plugin-form + fields): validation already
+    dual-read these, but `ObjectForm`'s HTML-attribute pass and `TextAreaField`
+    read `max_length` only, so a spec-authored `maxLength` gave no browser cap and
+    no character counter. Both now dual-read, matching `buildValidationRules`.
+
+  Verified in the browser against the showcase: `capability_map` (`type: 'home'`)
+  now renders `data-page-type="home"`, the `home` max-width and its page title;
+  record pages are unchanged.
+
+- 53642d4: fix(core,fields): a string `$orderby` is a clause, not a character array — and localize the sharing-rule widgets (objectstack#3821)
+
+  **The recipient picker listed nothing, ever.** `QueryParams['$orderby']` was
+  typed as `Record | string[] | SortObject[]`, so `queryParamsToRecord` sent any
+  non-array value through `Object.entries`. Handed the clause string `'name asc'`
+  — which callers do build by hand — it walked the string index by index and
+  emitted `$orderby=0 n,1 a,2 m,3 e,4 ,5 a,6 s,7 c`. The server sorted by columns
+  that don't exist and every row was filtered out, so
+  `sys_sharing_rule.recipient_id` rendered "No matches" for every recipient type
+  and no sharing rule could be created from the Console. `ObjectGrid` builds the
+  same shape from a schema-level `sort` in three places, so grids with a string
+  sort silently showed an empty table.
+
+  A string `$orderby` is now passed through verbatim (the server's OData
+  normalizer has always parsed `'name asc'`), and the type admits `string`.
+  `RecipientPickerField` additionally switched to the structured
+  `{ name: 'asc' }` form so it can't regress this way against any data source.
+
+  **The three sharing-rule authoring widgets never had translations.**
+  `ObjectRefField`, `RecipientPickerField` and `FilterConditionField` hardcoded
+  their English copy — a Chinese Console showed "Select an object", "Select a
+  user", "Search…", "No matches", "Edit as JSON". They now go through
+  `useFieldTranslation` like every other widget, with keys added under `fields.*`
+  in all ten locales.
+
+  The recipient placeholder was the interesting one: it read
+  `` `Select a ${recipientType.replace(/_/g,' ')}` ``, interpolating the enum
+  value into an English sentence — a shape no locale can translate. It is now a
+  per-type key (`fields.recipient.selectUser`, `…selectBusinessUnit`, …), so
+  "选择业务单元" and "Select a business unit" no longer have to share a structure.
+
+  **Editing a rule silently dropped its recipient.** The picker resets the stored
+  id when `recipient_type` changes, because an id valid for a user is meaningless
+  for a team. It treated the edit form's `'' → 'user'` hydration as such a change:
+  opening any saved rule blanked the recipient, and saving persisted the blank.
+  Only a non-empty predecessor now counts as a type switch.
+
+  **Building a filter submitted the surrounding form.** None of `FilterBuilder`'s
+  controls declared `type="button"`, and a bare `<button>` inside a `<form>`
+  defaults to `type="submit"`. Adding, removing or clearing a condition therefore
+  submitted the sharing-rule dialog — firing validation mid-edit, and on an
+  already-valid form saving the record before the admin was done.
+
+  **A rejected write showed the user raw server diagnostics.** The form rendered
+  `error.message` verbatim, so a sharing / RLS denial reached the dialog and the
+  toast as `FORBIDDEN: insufficient privileges to update showcase_private_note
+pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and the
+  record id to whoever hit it. Permission failures now render localized copy
+  (`form.noPermissionToSave`, added in all ten locales), with the server text kept
+  on the console for debugging; other failures still show the server's message,
+  which is the useful part, and fall back to `form.submitFailed` when there is
+  none — replacing the previously hardcoded English "An error occurred during
+  submission".
+
+  **The detail header offered "Edit" on records the user may only read.** Object
+  permissions can't express "this one record is read-only" — a read-only sharing
+  grant sits inside an object the user may otherwise edit — so the header showed
+  the primary Edit CTA, opened the form, and let the user retype a field before
+  the server rejected the save. `DetailView` now gates Edit / Delete on the
+  object-level check AND on the explain engine's record-grained verdict
+  (`POST /api/v1/security/explain` with a `recordId`, ADR-0090 D6 / ADR-0095 C2 —
+  the same pipeline the enforcement middleware runs, so button and server cannot
+  disagree). Explaining oneself needs no special permission. The probe is one
+  cached request per record, skipped entirely when the object-level check already
+  says no, and **fails open** on every uncertainty — an unanswered hint must never
+  be the reason a permitted user cannot act; the server stays the authority
+  (ADR-0057 D10).
+
+  **A long option rendered straight past the combobox border.** `Combobox`'s
+  trigger pinned itself to the component's `w-[200px]` default while the fields
+  around it ran the full form column, and the selected label was a bare text child
+  of a flex button — flex items need `truncate` AND `min-w-0` to clip, and it had
+  neither. So "成员 (showcase_project_membership)" in the object picker overflowed
+  the control and collided with the field beside it. The label now truncates, the
+  trigger can shrink, the dropdown matches the trigger's width instead of a
+  hardcoded 200px (a widened combobox used to clip its own options), and the two
+  sharing-rule pickers ask for `w-full` so they line up with every other input.
+
+  Hardens `evaluatePermission` while there: a role config carrying only
+  `fieldPermissions` (no `actions`) made `check()` throw a TypeError that
+  propagated out of the render. A permission check must not be able to crash a
+  view.
+
+  Browser-verified against the framework showcase Console in Chinese: object /
+  criteria / recipient copy is fully localized, the recipient dropdown lists real
+  users, business units and positions, a saved rule reopens with its recipient and
+  criteria intact, editing the filter no longer submits, and a rule created
+  end-to-end stores a real record id rather than free text. The criteria authored
+  in the builder is honored by the evaluator: `{"pinned":true}` on an owner-private
+  object granted the recipient exactly the matching records and nothing else.
+
+- Updated dependencies [7b21891]
+- Updated dependencies [0b3be01]
+- Updated dependencies [3c4d935]
+- Updated dependencies [4b60d2d]
+- Updated dependencies [952b978]
+- Updated dependencies [de5e40c]
+- Updated dependencies [1a03af6]
+- Updated dependencies [3e886eb]
+- Updated dependencies [cfc675e]
+- Updated dependencies [20df08c]
+- Updated dependencies [1767124]
+- Updated dependencies [8ecf5a6]
+- Updated dependencies [af705b9]
+- Updated dependencies [0502a7c]
+- Updated dependencies [7b35e4b]
+- Updated dependencies [8fb1295]
+- Updated dependencies [e16ed2d]
+- Updated dependencies [c6fd752]
+- Updated dependencies [f9bbddb]
+- Updated dependencies [dfd3705]
+- Updated dependencies [c77108c]
+- Updated dependencies [2735de6]
+- Updated dependencies [c19ac11]
+- Updated dependencies [6dee2cb]
+- Updated dependencies [e05f052]
+- Updated dependencies [0502a7c]
+- Updated dependencies [faad45e]
+- Updated dependencies [09c6a17]
+- Updated dependencies [c7cff19]
+- Updated dependencies [ba73a02]
+- Updated dependencies [cd09a7b]
+- Updated dependencies [f1abf0e]
+- Updated dependencies [f05b84e]
+- Updated dependencies [9b4b952]
+- Updated dependencies [2f947e4]
+- Updated dependencies [7d46648]
+- Updated dependencies [9b53d72]
+- Updated dependencies [bb4aa25]
+- Updated dependencies [75f1cdf]
+- Updated dependencies [662bdf9]
+- Updated dependencies [059a052]
+- Updated dependencies [53642d4]
+- Updated dependencies [8aae006]
+- Updated dependencies [c6cfdf1]
+- Updated dependencies [d147a13]
+- Updated dependencies [c6aaed8]
+- Updated dependencies [263f885]
+- Updated dependencies [dc334da]
+  - @object-ui/components@17.0.0
+  - @object-ui/i18n@17.0.0
+  - @object-ui/react@17.0.0
+  - @object-ui/types@17.0.0
+  - @object-ui/core@17.0.0
+  - @object-ui/providers@17.0.0
+
+## 16.1.0
+
+### Minor Changes
+
+- 1c8935a: feat(app-shell): render ActionParamDialog params through the shared form field-widget renderer (ADR-0059, #2700)
+
+  `ActionParamDialog` no longer hand-rolls a per-type ternary chain (select /
+  lookup / textarea / number / boolean, everything else → text input). Every
+  declared action param now renders through the same `fieldWidgetMap` the object
+  form uses, so a param of ANY form-supported field type — `file`, `image`,
+  `richtext`, `markdown`, `color`, `address`, `code`, `date`, … — gets its real
+  widget, lazily loaded behind `Suspense`. Subsumes the single `file` branch ask
+  in #2698: `type: 'file'` params render the real `FileField` upload control via
+  the ambient `UploadProvider`, honoring `multiple`/`accept`/`maxSize`.
+
+  - `@object-ui/fields`: new exports `resolveFormWidgetType(type)` (widget-key
+    resolution incl. spec aliases, text fallback) and `getLazyFieldWidget(type)`
+    (per-type-cached `React.lazy` over the form's own widget loaders).
+  - `@object-ui/core`: `ActionParamDef` gains `accept`/`maxSize`; `multiple` is
+    now general widget config (was lookup-only).
+  - `@object-ui/app-shell`: new pure `paramToField()` adapter (param → field
+    shape) with a drift test pinning param support ⊇ form support (`FORM_FIELD_TYPES`),
+    mirroring the FieldEditWidget parity guard; `resolveActionParams()` inherits
+    `multiple`/`accept`/`maxSize` from the referenced field for every type.
+    `required` validation, `visible` CEL gating, helpText, error styling, and
+    value shapes for previously-supported types are unchanged.
+
+- ef14f69: feat(fields): CheckboxesField per-option `visibleWhen` cascading + `dependsOn` gating (completes the option-widget parity set)
+
+  `checkboxes` was the last static-option widget still rendering `config.options`
+  raw — with no per-option `visibleWhen` filtering, `dependsOn` gating, or cascade
+  clear. It now matches `MultiSelectField` (its multi-value sibling), completing
+  the ADR-0058 parity across `select` / `multiselect` / `radio` / `checkboxes`.
+
+  - **`@object-ui/fields`**: `CheckboxesField` routes through the shared
+    `useCascadingOptions` hook — offered boxes narrow against the live record +
+    `current_user`, the control gates behind a "select the parent first" hint
+    while a `dependsOn` field is empty, and selections no longer offered are
+    pruned per-element from the array. Adds `checkboxes-empty-*` /
+    `checkboxes-option-*` testids.
+  - **`@object-ui/components`**: adds `checkboxes` to the form renderer's option
+    field sets (`CASCADE_OPTION_FIELD_TYPES`, the cross-field cascade-clear
+    effect, and the option pre-filter) so a `checkboxes` field is threaded
+    `dependentValues` and gated identically to the other option widgets.
+  - Tests: `CheckboxesField.cascade.test.tsx` mirrors `MultiSelectField.cascade.test.tsx`.
+
+- 14cb729: feat(fields): MultiSelectField per-option `visibleWhen` cascading + `dependsOn` gating (parity with single select, #2715)
+
+  The multi-value chip picker now implements the same ADR-0058 option
+  resolution as the single `SelectField`, closing the gap #2709 opened when a
+  `select` + `multiple` (and the `multiselect` type) started delegating to it.
+
+  - Extracted `useCascadingOptions` — the shared hook that resolves per-option
+    `visibleWhen` filtering, `dependsOn` gating, and the live `dependentValues` +
+    predicate-scope wiring — and routed both `SingleSelectField` and
+    `MultiSelectField` through it (no duplicated resolver).
+  - `MultiSelectField` narrows its offered chips against the live record +
+    `current_user`, gates behind a "select the parent first" hint while a
+    `dependsOn` field is empty, and surfaces a legible empty state instead of a
+    bare chip row.
+  - Cascade-clear: when the offered set changes (parent changed / predicate
+    flipped) the widget prunes only the now-invalid selections, keeping the
+    still-offered ones — the array analogue of the single select's clear.
+  - Tests: `MultiSelectField.cascade.test.tsx` mirrors `SelectField.cascade.test.tsx`
+    (gating, per-element cascade clear, role/context gating).
+
+- 1629313: feat(fields): RadioField per-option `visibleWhen` cascading + `dependsOn` gating; single-source the option resolver
+
+  Brings `RadioField` to parity with `SelectField` / `MultiSelectField` for ADR-0058
+  cascading & role-gated options, and collapses the three copies of the
+  gate-then-filter logic onto one shared resolver.
+
+  - **`@object-ui/core`**: new pure `resolveCascadingOptions(rawOptions, record, dependsOn, scope)`
+    → `{ options, gated, dependsOnFields }` — the single source of truth for
+    `dependsOn` gating + per-option `visibleWhen` filtering.
+  - **`@object-ui/fields`**: `RadioField` now narrows its offered radios against
+    the live record + `current_user`, gates behind a "select the parent first"
+    hint while a `dependsOn` field is empty, and clears a value no longer offered
+    (scalar cascade clear). The `useCascadingOptions` hook is refactored to a thin
+    React wrapper over `resolveCascadingOptions`.
+  - **`@object-ui/components`**: the form renderer's inline option pre-filter and
+    cross-field cascade-clear effect now call `resolveCascadingOptions` instead of
+    re-deriving gating/filtering, so they can't drift from the widgets (no
+    behavior change).
+  - Tests: `RadioField.cascade.test.tsx` mirrors the select cascade tests; core
+    gains `resolveCascadingOptions` unit coverage.
+
+- eee4ded: feat(fields): render `select` + `multiple` through the multi-value chip picker; restore fields/core lint gates
+
+  - **Multi-value select** — a `select` field/param declared `multiple: true`
+    now renders the multi-value chip picker (the `multiselect` widget) and stores
+    a `string[]`, instead of collapsing to a single-value dropdown that could
+    hold only one value. The delegation lives inside `SelectField`, so the object
+    form, the inline grid editor, and the app-shell `ActionParamDialog` all
+    inherit it from the one `select` widget with no per-surface drift. Single
+    selects keep the cascading dropdown (multi + per-option `visibleWhen`
+    cascading is not a combination in use today).
+  - **`autonumber` mapping is unchanged** here; this change is orthogonal.
+  - **Lint gates restored** — fixed the pre-existing baseline lint errors that
+    had left the `@object-ui/fields` and `@object-ui/core` package lints red (so
+    the gate could not catch new violations): `react-hooks/rules-of-hooks` in
+    `ImageField` / `TextAreaField` / `index.tsx` (hooks hoisted above early
+    returns; the `useFieldTranslate` hook no longer wrapped in try/catch), plus
+    `no-useless-assignment` / `no-useless-escape` / `no-control-regex` /
+    `prefer-const` / `preserve-caught-error` in the core evaluator and utils. No
+    behavior change from the lint fixes.
+
+### Patch Changes
+
+- 0318118: fix(app-shell): block ActionParamDialog submit while a file/image param is uploading; map spec `autonumber` (ADR-0059 follow-ups)
+
+  Two follow-ups to the shared-field-widget param rendering (ADR-0059):
+
+  - **Upload-in-progress guard.** A `file`/`image` param's value only becomes its
+    fileId once the presigned upload settles, so confirming mid-upload sent an
+    empty/stale value. `FileField`/`ImageField` now surface their upload state via
+    an optional `onUploadingChange` prop (shared `useUploadingSignal` hook,
+    ignored by other widgets); `ActionParamDialog` wires it for `file`/`image`
+    params and disables Confirm (label → "Uploading…", new `actionDialog.uploading`
+    i18n key across all locales) plus blocks submit while any upload is in flight.
+  - **`autonumber` spelling.** `mapFieldTypeToFormType` now maps the spec
+    `FieldType` spelling `autonumber` (in addition to the widget-map key
+    `auto_number`) to the AutoNumber widget, so a spec-typed `autonumber`
+    field/param no longer falls through to the plain text input — fixes the object
+    form path as well as action params.
+
+- aefcf39: feat(action-params): serialize file/image action params to storage id(s); retire the approvals composer
+
+  Declared action params of `type: 'file'`/`'image'` now POST the portable API
+  contract — the storage id(s) — instead of the upload widget's rich object:
+
+  - `FileField` surfaces the id it already receives from the upload adapter
+    (`meta.fileId`) as `file_id` on each emitted file object (additive; the
+    record file-field value shape is unchanged).
+  - `ActionParamDialog` maps upload-param values to their `file_id`(s) at submit
+    (`serializeParamValues`, pure + exported): single → string, `multiple` →
+    `string[]`. The api handler already forwards param values untouched, so an
+    action with a `file` param POSTs `attachments: string[]`.
+
+  This lets the approvals inbox retire its last hand-wired UI — the approve/reject
+  composer with its bespoke attachment upload — so the drawer renders every
+  decision through `DeclaredActionsBar` with the declared `attachments` file param
+  (framework side declares it; see the paired framework change). `DeclaredActionsBar`'s
+  `exclude` prop stays as a general capability.
+
+- 3b2e4d9: fix(list): route remaining system-field groupings through the shared classifier
+
+  Follow-up to the `owner_id` default-column fix: consolidate the display-oriented
+  system-field exclusions onto the shared `isSystemManagedField` /
+  `SYSTEM_MANAGED_FIELD_NAMES` (from `@object-ui/types`) so the framework-injected
+  `owner_id` is treated consistently across the grid, record picker, and detail
+  drawer.
+
+  - `ObjectGrid` record-detail drawer: the business-fields vs. muted meta-section
+    split now uses the shared classifier, so `owner_id` (and other injected system
+    fields) land in the meta section instead of the business body.
+  - `deriveLookupColumns` (record picker): drops its local name set for the shared
+    classifier — now flag-aware (`field.system`), not just name-based.
+  - `RecordDetailDrawer`: its default `systemFields` set is derived from the shared
+    `SYSTEM_MANAGED_FIELD_NAMES`; the `systemFields` prop override is preserved.
+
+  `deriveRelatedLists`' narrow "audit FK on every object" set and plugin-detail's
+  inline-edit "never editable" set are intentionally left distinct — different
+  semantics (the latter deliberately keeps `owner_id` editable).
+
+- Updated dependencies [0318118]
+- Updated dependencies [1c8935a]
+- Updated dependencies [af1b0db]
+- Updated dependencies [8b8b744]
+- Updated dependencies [7cf4051]
+- Updated dependencies [803558e]
+- Updated dependencies [2e7d7f0]
+- Updated dependencies [ef14f69]
+- Updated dependencies [94d4876]
+- Updated dependencies [1100a8b]
+- Updated dependencies [7abe4cd]
+- Updated dependencies [69fa5d1]
+- Updated dependencies [549c67d]
+- Updated dependencies [ebe6494]
+- Updated dependencies [2b17339]
+- Updated dependencies [31b77d4]
+- Updated dependencies [6d4fbe6]
+- Updated dependencies [0a3710b]
+- Updated dependencies [f80aaf2]
+- Updated dependencies [62b9ab5]
+- Updated dependencies [1629313]
+- Updated dependencies [29c6040]
+- Updated dependencies [faebac3]
+- Updated dependencies [2331ac9]
+- Updated dependencies [199fa83]
+- Updated dependencies [eee4ded]
+  - @object-ui/i18n@16.1.0
+  - @object-ui/core@16.1.0
+  - @object-ui/types@16.1.0
+  - @object-ui/react@16.1.0
+  - @object-ui/components@16.1.0
+  - @object-ui/providers@16.1.0
+
 ## 16.0.0
 
 ### Patch Changes