@object-ui/react 17.5.0 → 17.7.0

package/dist/context/ActionContext.js

@@ -13,7 +13,9 @@ import { jsx as _jsx } from "react/jsx-runtime";
  * Components can consume actions without creating their own runner instances.
  */
 import { createContext, useCallback, useContext, useMemo, useState } from 'react';
-import { ActionRunner, } from '@object-ui/core';
+import { ActionRunner, subjectPermissionsOf, } from '@object-ui/core';
+import { useActionRunnerTranslator } from './actionRunnerTranslator.js';
+import { usePredicateScope } from '../hooks/useExpression.js';
 export const ActionCtxReact = createContext(null);
 /**
  * ActionProvider — Provides a shared ActionRunner to the tree.
@@ -34,6 +36,8 @@ export const ActionProvider = ({ children, context = {}, onConfirm, onToast, onM
     const [loading, setLoading] = useState(false);
     const [error, setError] = useState(null);
     const [result, setResult] = useState(null);
+    // The runner's own copy (the generic success toast) in the session's language.
+    const translate = useActionRunnerTranslator();
     const runner = useMemo(() => {
         // Normalize the evaluator scope so predicates can use *either* flat
         // (`record`, `user`, `objectName`) *or* the canonical `ctx.*` namespace
@@ -49,6 +53,7 @@ export const ActionProvider = ({ children, context = {}, onConfirm, onToast, onM
                 : { ...context },
         };
         const r = new ActionRunner(normalizedContext);
+        r.setTranslator(translate);
         if (onConfirm)
             r.setConfirmHandler(onConfirm);
         if (onToast)
@@ -69,6 +74,40 @@ export const ActionProvider = ({ children, context = {}, onConfirm, onToast, onM
         return r;
         // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [JSON.stringify(context)]);
+    // The acting subject the surrounding predicate scope binds as `current_user`
+    // (objectui#11242): the ONE object `ExpressionProvider` publishes under
+    // `current_user` / `user` / `ctx.user` / `os.user`, carrying the caller's
+    // effective object permissions once they have loaded. The runner evaluates
+    // its own gates — `execute`'s `disabled` re-check, `params[].visible`, the
+    // engine's `visible` filter — against ITS bag, which a host seeds with its
+    // own `user` and never with `current_user`. Bound here, every `execute` gate
+    // under this provider answers `current_user.can(…)` and every other
+    // `current_user.*` predicate, whatever else the page mounts. Before, only
+    // `useActionEngine` wrote it onto a shared runner, so the answer depended on
+    // whether the page happened to mount `record:quick_actions`, `record:alert`
+    // or a dashboard (the objectui#6493 "one bag" rule, broken per page).
+    //
+    // The same object, not a copy: the engine answers `can` only for a receiver
+    // IDENTICAL to the bound `current_user`. Only `current_user` is added — the
+    // runner's `user` / `ctx.user` / `os.user` stay the host's object, which
+    // carries the `systemPermissions` the capability gate reads — so on this bag
+    // `user.can(…)` still faults while `current_user.can(…)` answers. With no
+    // scope above this provider (`{}`) nothing is bound, and a host's own
+    // `context.current_user`, if it passed one, is left as it is.
+    //
+    // Bound during render, before any child renders or executes, and keyed on
+    // what the binding READS, never on the subject's identity (a memoised value
+    // upstream — AGENTS.md #10): its serialisable fields, and the permissions map
+    // it carries, which the upstream adapter caches per payload outside React. A
+    // new runner (the host `context` changed) is bound again.
+    const subject = usePredicateScope().current_user;
+    const subjectKey = subject === undefined ? '' : JSON.stringify(subject);
+    const subjectPermissions = subjectPermissionsOf(subject);
+    useMemo(() => {
+        if (subject !== undefined)
+            runner.updateContext({ current_user: subject });
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [runner, subjectKey, subjectPermissions]);
     const execute = useCallback(async (action) => {
         setLoading(true);
         setError(null);

package/dist/context/DiscussionContext.d.ts

@@ -50,6 +50,18 @@ export interface DiscussionContextValue {
     onUploadAttachments?: (files: FileList) => Promise<DiscussionAttachment[]>;
     loading?: boolean;
     error?: Error | null;
+    /**
+     * The host's `sys_activity` read was REFUSED: 401 / 403, or a permission
+     * envelope (objectui#11195). The feed renderers then show a no-permission
+     * state rather than claiming the record has no activity. Produced by the
+     * host that owns the fetch (app-shell `RecordDetailView`), which judges the
+     * rejection with plugin-detail's `isRefusedFeedRead`. A read that answered
+     * with zero rows, a 404, or any other failure is not a refusal and leaves
+     * this unset.
+     */
+    activityDenied?: boolean;
+    /** The same, for the host's `sys_comment` read. */
+    commentsDenied?: boolean;
 }
 export interface DiscussionContextProviderProps extends DiscussionContextValue {
     children: React.ReactNode;

package/dist/context/DiscussionContext.js

@@ -28,6 +28,8 @@ export const DiscussionContextProvider = ({ children, ...value }) => {
         value.onUploadAttachments,
         value.loading,
         value.error,
+        value.activityDenied,
+        value.commentsDenied,
     ]);
     return (_jsx(DiscussionContext.Provider, { value: memo, children: children }));
 };

package/dist/context/DrillNavigationContext.d.ts

@@ -27,6 +27,19 @@ export interface DrillNavigationValue {
      * Open the full list page for `objectName`, scoped by `filter` (an object
      * FIELD name → raw stored value map). Implemented by the app shell as a
      * SPA navigation to the object's list route. Absent when no host wired it.
+     *
+     * ⚠️ `filter` is the widget's AUTHORED filter composed with the click
+     * context, so it may still carry unresolved placeholders — `{current_user_id}`,
+     * `{current_org_id}`, and the relative-date macros. **Resolving them is the
+     * host implementation's job**: call `resolveFilterPlaceholders(filter, scope)`
+     * from `@object-ui/core` with the session scope the host holds
+     * (`useFilterScope`), exactly once, before the value reaches a query or a URL.
+     *
+     * A host that skips it gives ONE drill TWO scopes: the in-place drawer arm is
+     * already scoped by the resolved value, because the `object-data-table` it
+     * renders resolves `schema.filter` in its own fetch, so only the navigate arm
+     * would carry the literal — and a literal placeholder matches no record
+     * (objectui#9022).
      */
     openRecordList?: (objectName: string, filter?: Record<string, unknown>) => void;
 }

package/dist/context/HostNavigationContext.d.ts

@@ -0,0 +1,82 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * HostNavigationContext — the host's own in-app navigate, offered to renderers.
+ *
+ * A published renderer package cannot navigate correctly on its own. Its only
+ * dependency-free option is a browser-level navigation
+ * (`window.location.assign`), which resolves a rooted path such as `/thanks`
+ * against the ORIGIN. Under a host mounted at a sub-path — the framework CLI
+ * configures one for every embedded deployment — that leaves the application
+ * entirely. This is objectui#4989 defect 4, and the same class as
+ * objectui#4190 / #4181.
+ *
+ * The host is the only party that knows its mount, so the host supplies the
+ * navigate. This context is that seam: **optional injection**, ruled by the
+ * maintainer on 2026-08-17. Two mechanisms were rejected in that ruling and are
+ * named here so they are not re-proposed:
+ *
+ *   - **router-presence sniffing** (a renderer reading React Router's context
+ *     when it happens to be there) — implicit magic, and it forces every
+ *     renderer that wants mount-awareness to import `react-router`;
+ *   - **a `react-router` peer requirement** — it imposes module resolution on
+ *     router-less consumers. Two real ones exist in this repo (`apps/site`,
+ *     `packages/plugin-view`), and a published renderer's whole property is
+ *     that it drops into ANY React application.
+ *
+ * Explicit injection keeps every renderer dependency-free and puts
+ * mount-awareness on the type face where a host can see it is missing.
+ *
+ * ## Absent is a supported state, not a degraded one
+ *
+ * The default value is an empty object, so `useHostNavigation()` outside a
+ * provider answers `{ navigate: undefined }` and never throws. A consumer reads
+ * it as "no host navigate — fall back to whatever this renderer did before",
+ * which for a router-less host is already the correct behaviour: with no
+ * router there is no basename, so origin-rooted resolution is right. The seam
+ * changes what a MOUNTED host gets, and changes nothing else.
+ *
+ * ## Relationship to the other navigation seams in this package
+ *
+ * `DrillNavigationContext.openRecordList` is a SEMANTIC navigation — "show me
+ * the records behind this aggregate" — that only the console can turn into a
+ * URL. `ActionProvider`'s `onNavigate` is the ActionRunner's handler for
+ * `type: 'navigate'` actions, reachable only through an action dispatch. This
+ * one is neither: it is the plain "go to this already-resolved in-app path"
+ * that a renderer holds a destination for and cannot perform correctly itself.
+ * All three are supplied by the same shell from the same router `navigate`.
+ */
+import React from 'react';
+export interface HostNavigationValue {
+    /**
+     * Navigate to an in-app path, resolved by the HOST — so a mounted host's
+     * basename is applied and the transition stays inside the application.
+     *
+     * `to` is an already-resolved, application-relative path (e.g. `/thanks`,
+     * `/apps/crm/accounts/r1`), never an absolute URL: a renderer that holds an
+     * external destination must not launder it through the host's router. It is
+     * the CALLER's job to have judged the destination — this seam performs a
+     * navigation, it does not authorize one.
+     *
+     * Absent when no host wired it; consumers fall back to their own default.
+     */
+    navigate?: (to: string, options?: {
+        replace?: boolean;
+    }) => void;
+}
+export declare const HostNavigationContext: React.Context<HostNavigationValue>;
+export declare const HostNavigationProvider: React.FC<{
+    value: HostNavigationValue;
+    children: React.ReactNode;
+}>;
+/**
+ * Consume the host-provided in-app navigate. Answers `{}` (i.e. `navigate`
+ * undefined) when no host wired one — that is a supported state, see the module
+ * docblock.
+ */
+export declare function useHostNavigation(): HostNavigationValue;

package/dist/context/HostNavigationContext.js

@@ -0,0 +1,65 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * HostNavigationContext — the host's own in-app navigate, offered to renderers.
+ *
+ * A published renderer package cannot navigate correctly on its own. Its only
+ * dependency-free option is a browser-level navigation
+ * (`window.location.assign`), which resolves a rooted path such as `/thanks`
+ * against the ORIGIN. Under a host mounted at a sub-path — the framework CLI
+ * configures one for every embedded deployment — that leaves the application
+ * entirely. This is objectui#4989 defect 4, and the same class as
+ * objectui#4190 / #4181.
+ *
+ * The host is the only party that knows its mount, so the host supplies the
+ * navigate. This context is that seam: **optional injection**, ruled by the
+ * maintainer on 2026-08-17. Two mechanisms were rejected in that ruling and are
+ * named here so they are not re-proposed:
+ *
+ *   - **router-presence sniffing** (a renderer reading React Router's context
+ *     when it happens to be there) — implicit magic, and it forces every
+ *     renderer that wants mount-awareness to import `react-router`;
+ *   - **a `react-router` peer requirement** — it imposes module resolution on
+ *     router-less consumers. Two real ones exist in this repo (`apps/site`,
+ *     `packages/plugin-view`), and a published renderer's whole property is
+ *     that it drops into ANY React application.
+ *
+ * Explicit injection keeps every renderer dependency-free and puts
+ * mount-awareness on the type face where a host can see it is missing.
+ *
+ * ## Absent is a supported state, not a degraded one
+ *
+ * The default value is an empty object, so `useHostNavigation()` outside a
+ * provider answers `{ navigate: undefined }` and never throws. A consumer reads
+ * it as "no host navigate — fall back to whatever this renderer did before",
+ * which for a router-less host is already the correct behaviour: with no
+ * router there is no basename, so origin-rooted resolution is right. The seam
+ * changes what a MOUNTED host gets, and changes nothing else.
+ *
+ * ## Relationship to the other navigation seams in this package
+ *
+ * `DrillNavigationContext.openRecordList` is a SEMANTIC navigation — "show me
+ * the records behind this aggregate" — that only the console can turn into a
+ * URL. `ActionProvider`'s `onNavigate` is the ActionRunner's handler for
+ * `type: 'navigate'` actions, reachable only through an action dispatch. This
+ * one is neither: it is the plain "go to this already-resolved in-app path"
+ * that a renderer holds a destination for and cannot perform correctly itself.
+ * All three are supplied by the same shell from the same router `navigate`.
+ */
+import { createContext, useContext } from 'react';
+export const HostNavigationContext = createContext({});
+export const HostNavigationProvider = ({ value, children }) => (_jsx(HostNavigationContext.Provider, { value: value, children: children }));
+/**
+ * Consume the host-provided in-app navigate. Answers `{}` (i.e. `navigate`
+ * undefined) when no host wired one — that is a supported state, see the module
+ * docblock.
+ */
+export function useHostNavigation() {
+    return useContext(HostNavigationContext);
+}

package/dist/context/InlineEditContext.d.ts

@@ -95,6 +95,37 @@ export interface InlineEditContextValue {
      * doesn't resolve approvals at all.
      */
     approvalProgress?: ApprovalProgress;
+    /**
+     * Whether the viewer is the SUBMITTER of the pending approval request
+     * (`830ed5803`). Recall is the submitter's lever and the server enforces
+     * exactly that — a non-submitter's recall is refused — so a recall button
+     * lit for everyone who can read the record is a button whose click must
+     * fail. The host resolves the identity (server-resolved `viewer.is_submitter`
+     * on the pending request, with an id comparison as the pre-framework#3310
+     * fallback) for the same reason it resolves `locked`: the renderer stays
+     * DataSource-agnostic and never re-derives who submitted what.
+     *
+     * TRI-STATE, and the third state is the load-bearing one:
+     *   `true`      — the viewer submitted this approval; offer recall.
+     *   `false`     — the host consulted the pending request and this viewer is
+     *                 not its submitter; withdraw the recall affordance.
+     *   `undefined` — the host does not resolve submitter identity at all
+     *                 (no approvals API, band driven by the record's
+     *                 `approval_status` mirror alone). Behaviour is UNCHANGED
+     *                 from before this signal existed: recall stays offered.
+     *
+     * The `undefined` case defaults to *showing* on purpose, mirroring how
+     * `approvalPending` falls back to `locked`: omission preserves a host's
+     * previous behaviour. Defaulting it to "hide" would silently take the
+     * submitter's only unlock lever away from every host that never learns of
+     * this prop — trading a cosmetic defect for a functional loss.
+     *
+     * ⚠️ FEEDBACK ONLY. This decides who is SHOWN the entry, never who MAY
+     * recall: the server authorizes the recall itself and rejects a
+     * non-submitter regardless of what any client renders. Nothing may treat
+     * this as an authorization verdict.
+     */
+    approvalIsSubmitter?: boolean;
     /**
      * Human-readable reason for the approval lock, surfaced as the band's
      * tooltip. Optional — consumers fall back to their own localized default
@@ -104,7 +135,15 @@ export interface InlineEditContextValue {
     /**
      * Draft of user-edited values. Holds ONLY the keys the user actually
      * changed, so the save path never writes computed / read-only / untouched
-     * fields. Read a field's live value as `draft[name] ?? data[name]`.
+     * fields. Read a field's live value from the staged record
+     * `{ ...data, ...draft }`, where `data` is the saved record: an OWN draft
+     * key wins even when its value is empty (`null`, `undefined`, `''`), and
+     * `data[name]` is read only when the key is absent. An own key with an
+     * empty value is a field the user, or a cascade clear, emptied, not an
+     * untouched one. A read that falls back to the saved value there shows the
+     * value the user just removed, and hands an option widget that pruned it
+     * the same value to prune again on every render (objectui#7190,
+     * objectui#10466).
      */
     draft: Record<string, any>;
     /** Field to auto-focus when edit was entered from a specific field. */
@@ -113,6 +152,34 @@ export interface InlineEditContextValue {
     saving: boolean;
     /** Last save error message, or null (driven by the save bar). */
     error: string | null;
+    /**
+     * Per-field reasons from the last rejected save, keyed by field MACHINE NAME
+     * — or `null` when the refusal was not field-scoped (objectui#6868).
+     *
+     * The record-level companion to `error`, and driven by the same component:
+     * `<InlineEditSaveBar>` reads the server's `VALIDATION_FAILED` envelope
+     * through `extractFieldErrors` and publishes the result here, so the field
+     * renderers (`DetailSection`, `HeaderHighlight`) can draw the reason beside
+     * the input the server actually refused. Before this slot existed the save
+     * bar and the field rows had no channel between them — they are SIBLINGS
+     * under this provider in both persistence modes — so an attributed refusal
+     * could only be shown record-level, which is not the in-place hint the
+     * objectui#6868 ruling asked for.
+     *
+     * ⚠️ PRESENTATION ONLY. These are the SERVER's verdicts, transported. The
+     * ruling makes the server the validation authority on the inline-edit
+     * surface: nothing may populate this slot from a client-side rule check, and
+     * nothing may read it as an authorization or acceptance decision. It is text
+     * to render beside an input, nothing more.
+     *
+     * Keyed by machine name because that is what both ends already use — the
+     * draft key the field renderers set, and the `field` the server names — so
+     * no spelling translation sits between the refusal and the input.
+     *
+     * Cleared by `enter()` and by teardown, exactly like `error`, so an
+     * attribution can never outlive the session that produced it.
+     */
+    fieldErrors: Record<string, string> | null;
     /** Enter inline-edit mode, optionally focused on `field`. No-op when `!canEdit`. */
     enter: (field?: string) => void;
     /** Stage a single field edit into the draft. */
@@ -125,6 +192,11 @@ export interface InlineEditContextValue {
     setSaving: (saving: boolean) => void;
     /** Set or clear the save error message (used by the save bar). */
     setError: (error: string | null) => void;
+    /**
+     * Publish or clear the per-field reasons for a rejected save (used by the
+     * save bar). Pass `null` when the refusal was not field-scoped.
+     */
+    setFieldErrors: (errors: Record<string, string> | null) => void;
 }
 export interface InlineEditProviderProps {
     /**
@@ -152,6 +224,14 @@ export interface InlineEditProviderProps {
      * for `first_response` nodes and for hosts that don't read approvals.
      */
     approvalProgress?: ApprovalProgress;
+    /**
+     * Whether the viewer submitted the pending approval request
+     * (`830ed5803`). Surfaced verbatim so the recall affordance is offered to
+     * the submitter only. Omitted ⇒ `undefined` ⇒ recall is offered exactly as
+     * it was before this prop existed (see `InlineEditContextValue`), so a host
+     * that resolves no approval identity is unchanged.
+     */
+    approvalIsSubmitter?: boolean;
     /** Optional human-readable lock reason, surfaced as the band tooltip. */
     lockedReason?: string;
     children: React.ReactNode;

package/dist/context/InlineEditContext.js

@@ -24,7 +24,7 @@ import { jsx as _jsx } from "react/jsx-runtime";
  */
 import React from 'react';
 const InlineEditContext = React.createContext(null);
-export const InlineEditProvider = ({ canEdit = true, locked = false, approvalPending, approvalProgress, lockedReason, children, }) => {
+export const InlineEditProvider = ({ canEdit = true, locked = false, approvalPending, approvalProgress, approvalIsSubmitter, lockedReason, children, }) => {
     // A locked record always has an approval running; the converse is what
     // #2902 added. Defaulting this way means an un-migrated host keeps its
     // previous behavior with no code change.
@@ -34,6 +34,7 @@ export const InlineEditProvider = ({ canEdit = true, locked = false, approvalPen
     const [autoFocusField, setAutoFocusField] = React.useState(null);
     const [saving, setSaving] = React.useState(false);
     const [error, setError] = React.useState(null);
+    const [fieldErrors, setFieldErrors] = React.useState(null);
     const enter = React.useCallback((field) => {
         // Object-lifecycle / permission gate: never enter edit on a record the
         // host has marked non-editable, even if a stray affordance fires.
@@ -42,6 +43,7 @@ export const InlineEditProvider = ({ canEdit = true, locked = false, approvalPen
         setAutoFocusField(field ?? null);
         setEditing(true);
         setError(null);
+        setFieldErrors(null);
     }, [canEdit]);
     const setField = React.useCallback((field, value) => {
         setDraft((prev) => ({ ...prev, [field]: value }));
@@ -56,6 +58,7 @@ export const InlineEditProvider = ({ canEdit = true, locked = false, approvalPen
         setAutoFocusField(null);
         setSaving(false);
         setError(null);
+        setFieldErrors(null);
     }, []);
     const value = React.useMemo(() => ({
         editing,
@@ -63,18 +66,21 @@ export const InlineEditProvider = ({ canEdit = true, locked = false, approvalPen
         locked,
         approvalPending: pending,
         approvalProgress,
+        approvalIsSubmitter,
         lockedReason,
         draft,
         autoFocusField,
         saving,
         error,
+        fieldErrors,
         enter,
         setField,
         cancel: teardown,
         reset: teardown,
         setSaving,
         setError,
-    }), [editing, canEdit, locked, pending, approvalProgress, lockedReason, draft, autoFocusField, saving, error, enter, setField, teardown]);
+        setFieldErrors,
+    }), [editing, canEdit, locked, pending, approvalProgress, approvalIsSubmitter, lockedReason, draft, autoFocusField, saving, error, fieldErrors, enter, setField, teardown]);
     return _jsx(InlineEditContext.Provider, { value: value, children: children });
 };
 /**

package/dist/context/RecordContext.d.ts

@@ -13,6 +13,7 @@
  * receive props from the schema tree.
  */
 import React from 'react';
+import type { DataSource } from '@object-ui/types';
 export declare const HighlightFieldsProvider: React.FC<{
     children: React.ReactNode;
 }>;
@@ -27,10 +28,42 @@ export declare function useRegisterHighlightFields(instanceId: string, names: st
 export interface RecordContextValue<TData = any, TObjectSchema = any> {
     /** Object machine name, e.g. "crm_opportunity". */
     objectName: string;
-    /** Primary key value of the record being displayed. */
-    recordId: string | number | null | undefined;
-    /** Optional datasource id; mirrors the page-level datasource override. */
-    dataSource?: string;
+    /**
+     * Primary key value of the record being displayed, as a `string` -- the one
+     * spelling `@objectstack/spec` declares on every record door (get, update,
+     * delete and the batch operation are all `z.string()`), so this consumer
+     * type is no longer wider than the protocol (objectui#9333).
+     *
+     * A host whose primary keys are numeric does NOT stringify at its call
+     * sites: `RecordContextProviderProps` still accepts `string | number`, and
+     * the provider pays the conversion once, below.
+     *
+     * `LineItemsPanel` reads this member as a `string` and hands it to a
+     * `string` parameter with no assertion in between, which is what
+     * objectui#9304 had to leave behind. That is a statement about that one
+     * reader, not about every reader: three `record:*` renderers in
+     * `@object-ui/plugin-detail` -- `record-details`, `record-quick-actions` and
+     * `record-alert` -- still read it through an `as any`. Those casts are
+     * redundant now rather than load-bearing, and removing them was left outside
+     * objectui#9333 deliberately.
+     */
+    recordId: string | null | undefined;
+    /**
+     * The data adapter the page is bound to, as the host resolved it — the same
+     * object the host hands `SchemaRendererProvider`, forwarded so that
+     * `record:*` renderers can self-fetch (related lists, activity, the
+     * reference rail) without re-plumbing it through the schema tree.
+     *
+     * Typed `DataSource`, not an id: every producer has always passed the
+     * adapter, and every reader has always called adapter methods on it
+     * (objectui#9197). `getObjectSchema` is a REQUIRED member of `DataSource`,
+     * so a reader gets the compiler's answer about it instead of a cast.
+     *
+     * Optional: hosts that render a record with no adapter bound (the Studio
+     * designer and palette previews) leave it undefined, and renderers treat
+     * that as "cannot self-fetch" rather than throwing.
+     */
+    dataSource?: DataSource;
     /** Loaded record data (flat record map). Undefined while loading. */
     data?: TData;
     /** Resolved object metadata schema (fields, label, etc.). */
@@ -68,7 +101,17 @@ export interface RecordContextValue<TData = any, TObjectSchema = any> {
      */
     embedded?: boolean;
 }
-export interface RecordContextProviderProps extends RecordContextValue {
+/**
+ * Props of `RecordContextProvider` -- THE injection boundary (objectui#9333).
+ *
+ * Identical to `RecordContextValue` except for `recordId`, the one member a
+ * host may still hand over in the wider shape its backend actually holds. The
+ * provider narrows it to the protocol's `string` exactly once, here, so no
+ * consumer downstream carries a `String(...)` or a cast.
+ */
+export interface RecordContextProviderProps extends Omit<RecordContextValue, 'recordId'> {
+    /** Primary key as the host holds it; narrowed to `string` on the way in. */
+    recordId: string | number | null | undefined;
     children: React.ReactNode;
 }
 export declare const RecordContextProvider: React.FC<RecordContextProviderProps>;

package/dist/context/RecordContext.js

@@ -87,7 +87,16 @@ const NOOP_SUBSCRIBE = (_) => () => { };
 const GET_EMPTY = () => EMPTY_SET;
 const EMPTY_SET = new Set();
 const RecordContext = React.createContext(null);
-export const RecordContextProvider = ({ children, ...value }) => {
+export const RecordContextProvider = ({ children, recordId, ...rest }) => {
+    // The whole conversion for this contract, in one typed place. Gated on
+    // `typeof` rather than written as an unconditional `String(...)`: `null` and
+    // `undefined` mean "no record bound", and stringifying them would hand
+    // consumers the literal ids "null" / "undefined". A falsiness gate would be
+    // wrong in the other direction -- a numeric `0` is a real primary key.
+    const value = {
+        ...rest,
+        recordId: typeof recordId === 'number' ? String(recordId) : recordId,
+    };
     // Memoize so consumers that rely on referential equality don't re-render
     // on unrelated parent renders.
     const memo = React.useMemo(() => value, [

package/dist/context/RelatedRecordActionsContext.d.ts

@@ -61,6 +61,21 @@ export interface RelatedRecordHandlers {
      * argument is needed here (增).
      */
     onCreate?: () => void;
+    /**
+     * [#4646] Offer "+ New", but GREYED — the `userActions.create.disabledWhen`
+     * verdict for the scope this toolbar sits in (the host parent record on a
+     * record page's related list).
+     *
+     * A separate channel from omitting {@link onCreate} because hidden and
+     * disabled are different answers, exactly as they are for the row Edit/Delete
+     * predicates (objectui#2614) and for the record header's (objectui#4419 /
+     * PR #4515): `visibleWhen` decides whether the affordance exists at all,
+     * `disabledWhen` decides whether the existing affordance can be pressed. The
+     * host still supplies `onCreate` in the disabled case, so the button keeps
+     * its label and tooltip and the user can see that creating is a thing this
+     * list does — just not right now.
+     */
+    createDisabled?: boolean;
     /** Open an edit form for an existing child record (改). */
     onEdit?: (recordId: string | number, record?: unknown) => void;
     /**
@@ -68,7 +83,11 @@ export interface RelatedRecordHandlers {
      * the deletion resolves.
      */
     onDelete?: (recordId: string | number, record?: unknown) => void | Promise<void>;
-    /** Child object row-level actions (`locations: ['list_item']`), localized. */
+    /**
+     * Child object row-level actions, localized: its `list_item` actions, and
+     * its `record_related` ones when the list sits inside a parent record
+     * (objectui#11270).
+     */
     rowActions?: RelatedRowActionDef[];
     /** Execute one of {@link rowActions} against a specific child row. */
     onRowAction?: (action: RelatedRowActionDef, record: unknown) => void | Promise<void>;

package/dist/context/SchemaRendererContext.d.ts

@@ -1,5 +1,6 @@
 import React from 'react';
 import type { DebugFlags } from '@object-ui/core';
+import type { DataSource } from '@object-ui/types';
 /**
  * Host-provided fetch used for `provider: 'api'` view data sources so custom
  * endpoints carry the same credentials (Authorization, tenant, locale headers)
@@ -8,7 +9,29 @@ import type { DebugFlags } from '@object-ui/core';
  */
 export type ApiFetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
 interface SchemaRendererContextType {
-    dataSource: any;
+    /**
+     * The adapter the host injected, as the published `DataSource` contract
+     * declares it (objectui#7912).
+     *
+     * Typed, not `any`: this is the injection point for the ENTIRE renderer tree,
+     * and `useSchemaContext()` hands whatever is declared here to every consumer
+     * that reads it back. While it was `any`, a bare string passed where the
+     * host's adapter belongs raised nothing at compile time and failed at runtime
+     * on the first `find()` — the shape of a config value read from the wrong
+     * place. The type was never unknown: `@object-ui/types` exports `DataSource`,
+     * `useSettledSchema` in this same package already declares its parameter as
+     * `DataSource<any> | null | undefined`, and `app-shell`'s README writes
+     * `DataSource` against this very seam.
+     *
+     * `null | undefined` are part of the contract, not a weakening of it: a host
+     * renders with no adapter bound (a Studio preview, a react page before the
+     * AdapterProvider connects, a widget test that drives `apiFetch` alone), and
+     * every reader in the tree already guards for it. The union states the three
+     * states that actually occur and refuses everything else — a string, `{}`, a
+     * plain data bag, a partial adapter missing a required member. It is spelled
+     * exactly as `useSettledSchema` spells it, one hop away.
+     */
+    dataSource: DataSource | null | undefined;
     debug?: boolean;
     debugFlags?: DebugFlags;
     apiFetch?: ApiFetch;
@@ -17,10 +40,39 @@ declare const SchemaRendererContext: React.Context<SchemaRendererContextType | n
 export { SchemaRendererContext };
 export declare const SchemaRendererProvider: ({ children, dataSource, debug, debugFlags, apiFetch, }: {
     children: React.ReactNode;
-    dataSource: any;
+    /** The host's adapter — see {@link SchemaRendererContextType.dataSource}. */
+    dataSource: DataSource | null | undefined;
     debug?: boolean;
     debugFlags?: DebugFlags;
     apiFetch?: ApiFetch;
 }) => React.JSX.Element;
 export declare const useSchemaContext: () => SchemaRendererContextType;
+/**
+ * Resolve a `bind` path against the ambient predicate scope.
+ *
+ * ## What it reads, and what it deliberately does not (objectui#9308)
+ *
+ * The scope a host publishes through `PredicateScopeProvider` — the same
+ * channel `useCondition` / `useExpression` merge under a locally-passed
+ * context, and the one app-shell's `ExpressionProvider` already feeds. It is
+ * NOT `SchemaRendererContext.dataSource`.
+ *
+ * `dataSource` is the host's injected ADAPTER, declared as the published
+ * `DataSource` contract (objectui#7912). An adapter has no `users` member, no
+ * `value` member, no member a `bind` path names — so walking it resolved
+ * `undefined` for every conformant host, and the nine production readers of
+ * this hook have all been running their fallback (`boundData || schema.items`,
+ * `|| schema.nodes`, or a fall-through to their own fetch chain) ever since.
+ * The only hosts it answered were ones injecting a data bag through a key the
+ * contract says is an adapter, which has been a compile error since
+ * objectui#7912.
+ *
+ * Maintainer ruling 2026-09-13 (option B) points it at the channel that can
+ * actually answer it. No published key is added: the provider, the hook and
+ * the host wiring all already exist.
+ *
+ * Returns `undefined` for an absent or empty path, and for any path the scope
+ * does not carry — the readers' fallbacks are what run then, exactly as
+ * before.
+ */
 export declare const useDataScope: (path?: string) => any;