@objectstack/console 17.5.0 → 17.6.0

package/dist/sdui.manifest.json

@@ -21,8 +21,11 @@
         },
         {
           "name": "label",
-          "type": "string",
-          "description": "Grid label, used as the table caption and as the export file title. The canonical spelling — the deprecated `title` is only read when this is absent."
+          "type": [
+            "string",
+            "object"
+          ],
+          "description": "Grid label, used as the table caption, as the export file title and in the record-detail overlay heading. The canonical spelling — the deprecated `title` is only read when this is absent. Accepts either a plain string or an inline per-locale map (`{ en: \"Accounts\", \"zh-CN\": \"客户\" }`) — the `I18nLabel` union the contract admits on this key — and the grid resolves the map against the display locale (the workspace's regional default when one is configured, otherwise the active UI language), falling back through base language, a region-qualified sibling, `default`, then `en`, and finally to any remaining entry."
         },
         {
           "name": "sort",
@@ -271,21 +274,28 @@
         },
         {
           "name": "title",
-          "type": "string"
+          "type": [
+            "string",
+            "object"
+          ],
+          "description": "Heading of the drawer and modal presentations (`formType: \"drawer\"` / `\"modal\"`). Accepts either a plain string or an inline per-locale map (`{ en: \"New order\", \"zh-CN\": \"新建订单\" }`) — the `I18nLabel` union the contract admits on this key — and the form resolves the map against the active UI language, falling back through base language, a region-qualified sibling, `default`, then `en`, and finally to any remaining entry."
         },
         {
           "name": "description",
-          "type": "string"
+          "type": [
+            "string",
+            "object"
+          ],
+          "description": "Subtitle under the drawer and modal heading. Accepts either a plain string or an inline per-locale map (`{ en: \"Enter the order details\", \"zh-CN\": \"填写订单信息\" }`), resolved against the active UI language with the same fallback chain as `title`."
         },
         {
           "name": "layout",
           "type": "enum",
           "enum": [
             "vertical",
-            "horizontal",
-            "inline",
-            "grid"
-          ]
+            "horizontal"
+          ],
+          "description": "Label placement: `vertical` puts each label above its field (the default), `horizontal` beside it."
         },
         {
           "name": "columns",
@@ -357,7 +367,7 @@
         {
           "name": "modalCloseButton",
           "type": "boolean",
-          "description": "Show the modal presentation’s close button. Read at ObjectForm.tsx:361 and honoured by ModalForm."
+          "description": "Show the modal presentation’s close (X) button. Default `true`; `false` hides it. Forwarded by `ObjectForm`’s modal route and honoured by `ModalForm` on both of its dialog arms. With the button hidden the modal still closes on Escape, and on the Cancel action when that is shown."
         },
         {
           "name": "contentLayout",
@@ -366,7 +376,7 @@
             "simple",
             "tabbed"
           ],
-          "description": "How the modal presentation lays out sections. `tabbed` needs more than one section to differ from `simple` (ModalForm.tsx:638)."
+          "description": "How the modal presentation lays out sections. `tabbed` differs from `simple` only when more than one section has a field to show (`ModalForm` tests `schema.contentLayout === \"tabbed\" && groups.length > 1`)."
         },
         {
           "name": "confirmOnDiscard",
@@ -400,21 +410,35 @@
         },
         {
           "name": "submitText",
-          "type": "string"
+          "type": [
+            "string",
+            "object"
+          ],
+          "description": "Label of the Save button. A map no locale limb resolves shows the default label. Accepts either a plain string or an inline per-locale map (`{ en: \"Save order\", \"zh-CN\": \"保存订单\" }`), resolved against the active UI language with the same fallback chain as `title`."
         },
         {
           "name": "cancelText",
-          "type": "string"
+          "type": [
+            "string",
+            "object"
+          ],
+          "description": "Label of the Cancel button. Accepts either a plain string or an inline per-locale map (`{ en: \"Back\", \"zh-CN\": \"返回\" }`), resolved against the active UI language with the same fallback chain as `title`."
         },
         {
           "name": "nextText",
-          "type": "string",
-          "description": "Label of the next-step button (wizard)."
+          "type": [
+            "string",
+            "object"
+          ],
+          "description": "Label of the next-step button (wizard). Accepts either a plain string or an inline per-locale map (`{ en: \"Continue\", \"zh-CN\": \"继续\" }`), resolved against the active UI language with the same fallback chain as `title`."
         },
         {
           "name": "prevText",
-          "type": "string",
-          "description": "Label of the previous-step button (wizard)."
+          "type": [
+            "string",
+            "object"
+          ],
+          "description": "Label of the previous-step button (wizard). Accepts either a plain string or an inline per-locale map (`{ en: \"Previous\", \"zh-CN\": \"上一步\" }`), resolved against the active UI language with the same fallback chain as `title`."
         },
         {
           "name": "showSubmit",
@@ -435,8 +459,11 @@
         },
         {
           "name": "successMessage",
-          "type": "string",
-          "description": "Toast shown after a successful submit. Ignored when `submitBehavior` or `navigateOnSuccess` is set."
+          "type": [
+            "string",
+            "object"
+          ],
+          "description": "Toast shown after a successful submit. Ignored when `submitBehavior` or `navigateOnSuccess` is set. Accepts either a plain string or an inline per-locale map (`{ en: \"Order saved\", \"zh-CN\": \"订单已保存\" }`), resolved against the active UI language with the same fallback chain as `title`."
         },
         {
           "name": "navigateOnSuccess",
@@ -543,20 +570,31 @@
         {
           "name": "fields",
           "type": "array",
-          "description": "Which parent fields to show, in order — and it is NOT ignored when `sections` is given: the two INTERSECT. The parent field pool is built from this key first and every section then resolves its own members against that pool, so a section member this key does not list is dropped from the rendered form, and a section that loses EVERY member that way disappears with its heading. Each such drop is reported once via `console.warn` (objectui#9884); it is not repaired, because this key is also the parent pool for values, create defaults and the submitted set. Author one or the other, or list every section member here too. Members are bare field names (`{ name }` tolerated); NOT the spec `FormFieldSchema` object `sections[].fields` accepts (identity key `field`) — that shape resolves to no name here and is silently skipped (the parent form renders through the same `ObjectForm` / `SimpleObjectForm` as `object-form` — see its `fields` description)."
+          "description": "Which parent fields to show, in order — and it is NOT ignored when `sections` is given: the two INTERSECT. The parent field pool is built from this key first and every section then resolves its own members against that pool, so a section member this key does not list is dropped from the rendered form, and a section that loses EVERY member that way disappears with its heading. Each such drop is reported once via `console.warn` (objectui#9884); it is not repaired, because this key bounds what the form DRAWS and edits, not what Save writes: on a create, the submitted set is the drawn fields plus any parent value seeded through `initialValues` (or its alternate spelling `initialData`), drawn or not. A seed for an undeclared, server-owned, computed or read-only field is still stripped, as on any save. Author one or the other, or list every section member here too. Members are bare field names (`{ name }` tolerated); NOT the spec `FormFieldSchema` object `sections[].fields` accepts (identity key `field`) — that shape resolves to no name here and is silently skipped (the parent form renders through the same `ObjectForm` / `SimpleObjectForm` as `object-form` — see its `fields` description)."
         },
         {
           "name": "title",
-          "type": "string"
+          "type": [
+            "string",
+            "object"
+          ],
+          "description": "Names the record in the built-in \"… saved\" toast after an edit save, which shows only when the host supplies no `onSuccess`. Accepts either a plain string or an inline per-locale map (`{ en: \"Purchase order\", \"zh-CN\": \"采购单\" }`) — the `I18nLabel` union the contract admits on this key — and the renderer resolves the map against the active UI language, falling back through base language, a region-qualified sibling, `default`, then `en`, and finally to any remaining entry."
         },
         {
           "name": "submitText",
-          "type": "string",
-          "description": "Label of the button that saves the parent and every detail row in one batch."
+          "type": [
+            "string",
+            "object"
+          ],
+          "description": "Label of the button that saves the parent and every detail row in one batch. Defaults to \"Save\" when editing a record (`mode: \"edit\"` with a `recordId`) and to \"Create\" otherwise, in the active UI language; an empty string, or a map no locale limb resolves, shows the default too. Accepts either a plain string or an inline per-locale map (`{ en: \"Save order\", \"zh-CN\": \"保存订单\" }`), resolved against the active UI language with the same fallback chain as `title`."
         },
         {
           "name": "cancelText",
-          "type": "string"
+          "type": [
+            "string",
+            "object"
+          ],
+          "description": "Label of the Cancel button, which renders only when the host supplies an `onCancel` callback (a runtime slot, not authorable in a JSON document). Defaults to \"Cancel\", in the active UI language; an empty string, or a map no locale limb resolves, shows the default too. Accepts either a plain string or an inline per-locale map (`{ en: \"Back\", \"zh-CN\": \"返回\" }`), resolved against the active UI language with the same fallback chain as `title`."
         },
         {
           "name": "showSubmit",
@@ -653,6 +691,11 @@
           "type": "array",
           "description": "Per-card style rules, each evaluated against that card’s own record. Two member dialects are accepted: the native `{ field, operator, value, backgroundColor?, borderColor? }` and the spec CEL `{ condition, backgroundColor?, borderColor? }`. A matching rule colours that card alone. A rule comparing a relation field sees the stored foreign key rather than the expanded record."
         },
+        {
+          "name": "navigation",
+          "type": "object",
+          "description": "What a card click opens — the `{ mode, size, openNewTab, preventNavigation }` block a list view declares. With the key ABSENT a click opens the record in a drawer. `mode` is an overlay (`drawer`, `modal`, `split`, `popover`), `new_window`, `page` or `none`; write it whenever the block is written, because a block without `mode` takes the spec’s `page` default and `page` opens nothing on a board no parent view navigates for. `openNewTab: true` opens the record page in a new tab and outranks the mode, `preventNavigation: true` opens nothing, and `size` sets the overlay width. A click handler from a parent view outranks the whole key."
+        },
         {
           "name": "dataSource",
           "type": "object",
@@ -668,7 +711,7 @@
         {
           "name": "objectName",
           "type": "string",
-          "description": "ObjectQL object name. The record source is one of `data`, `staticData` and `objectName`; the `object-calendar` schema refuses a block that declares none of them."
+          "description": "ObjectQL object name. The record source is one of `data`, `staticData` and `objectName`; the `object-calendar` schema refuses a block that declares none of them, unless the node's `dataSource.object` names the object, which then lands on this key."
         },
         {
           "name": "calendar",
@@ -715,6 +758,11 @@
           "type": "boolean",
           "description": "External loading state, honoured ONLY alongside an array `data`: it then replaces the calendar with its loading placeholder. On a calendar fed by `staticData` or by `objectName` it is dropped, because that calendar owns its own loading state."
         },
+        {
+          "name": "navigation",
+          "type": "object",
+          "description": "What an event click opens — the `{ mode, size, openNewTab, preventNavigation }` block a list view declares. With the key ABSENT a click opens the record in a drawer. `mode` is an overlay (`drawer`, `modal`, `split`, `popover`), `new_window`, `page` or `none`; write it whenever the block is written, because a block without `mode` takes the spec’s `page` default and `page` opens nothing on a calendar no parent view navigates for. `openNewTab: true` opens the record page in a new tab and outranks the mode, `preventNavigation: true` opens nothing, and `size` sets the overlay width. An overlay mode wins over a parent view’s click handler; any other mode hands the click to it."
+        },
         {
           "name": "dataSource",
           "type": "object",
@@ -730,7 +778,7 @@
         {
           "name": "objectName",
           "type": "string",
-          "description": "ObjectQL object name. The record source is one of `data`, `staticData` and `objectName`; the `object-gantt` schema refuses a block that declares none of them."
+          "description": "ObjectQL object name. The record source is one of `data`, `staticData` and `objectName`; the `object-gantt` schema refuses a block that declares none of them, unless the node's `dataSource.object` names the object, which then lands on this key."
         },
         {
           "name": "gantt",
@@ -747,6 +795,16 @@
           "type": "array",
           "description": "Inline records, read SECOND on the record-source ladder: a `data` configuration wins and this key is then never reached, while `objectName` is read AFTER it, so a gantt carrying both charts these rows and never queries that object. `filter` and `sort` narrow and order these rows exactly as they do fetched ones."
         },
+        {
+          "name": "filter",
+          "type": "array",
+          "description": "Base query filter in the rule-array form `[{ field, operator, value }, ...]`, narrowing the tasks the gantt charts — from every record source it reads: the object, an `api` request, or inline rows. Context tokens such as `{current_user_id}` are resolved first, then the filter is lowered to `$filter` on the query. The MongoDB-style record form is not this key’s shape."
+        },
+        {
+          "name": "sort",
+          "type": "array",
+          "description": "Task order in `[{ field, order }]` form, ordering the rows the gantt charts. Lowered to `$orderby` on the same query."
+        },
         {
           "name": "dataSource",
           "type": "object",
@@ -773,6 +831,21 @@
             "gantt"
           ]
         },
+        {
+          "name": "filter",
+          "type": "array",
+          "description": "Base query filter in the rule-array form `[{ field, operator, value }, ...]`, narrowing the records the timeline fetches. Context tokens such as `{current_user_id}` are resolved first, then the filter is lowered to `$filter` on the query. Authored `items` or `data` suppress that query, so the key then narrows nothing. The MongoDB-style record form is not this key’s shape."
+        },
+        {
+          "name": "sort",
+          "type": "array",
+          "description": "Entry order in `[{ field, order }]` form, ordering the records the timeline fetches. Lowered to `$orderby` on the same query."
+        },
+        {
+          "name": "navigation",
+          "type": "object",
+          "description": "What an entry click opens — the `{ mode, size, openNewTab, preventNavigation }` block a list view declares. Write it with `mode`: with the key ABSENT, or with a block that omits `mode` (it takes the spec’s `page` default), a click opens nothing on a timeline no parent view navigates for. `drawer`, `modal` and `popover` open the entry’s record in that overlay; `new_window` opens the record page in a new tab; `page`, `none` and `split` open nothing here, because the timeline hands the split shell no main panel. `openNewTab: true` opens the record page in a new tab and outranks the mode, `preventNavigation: true` opens nothing, and `size` sets the overlay width. A click handler from a parent view outranks the whole key."
+        },
         {
           "name": "dataSource",
           "type": "object",
@@ -788,7 +861,7 @@
         {
           "name": "objectName",
           "type": "string",
-          "description": "ObjectQL object name. The record source is one of `data`, `staticData` and `objectName`; the `object-map` schema refuses a block that declares none of them."
+          "description": "ObjectQL object name. The record source is one of `data`, `staticData` and `objectName`, or the node’s `dataSource` binding; the `object-map` schema refuses a block that declares none of them."
         },
         {
           "name": "map",
@@ -805,6 +878,16 @@
           "type": "array",
           "description": "Inline records, read SECOND on the record-source ladder: a `data` configuration wins and this key is then never reached, while `objectName` is read AFTER it, so a map carrying both plots these rows and never queries that object. `filter` and `sort` narrow and order these rows exactly as they do fetched ones."
         },
+        {
+          "name": "filter",
+          "type": "array",
+          "description": "Base query filter in the rule-array form `[{ field, operator, value }, ...]`, narrowing the markers the map plots — fetched rows and inline (`staticData`, `{ provider: 'value' }`) rows alike. Context tokens such as `{current_user_id}` are resolved first, then the filter is lowered to `$filter` on the query. The MongoDB-style record form is not this key’s shape."
+        },
+        {
+          "name": "sort",
+          "type": "array",
+          "description": "Marker order in `[{ field, order }]` form, ordering the rows the map plots. Lowered to `$orderby` on the same query."
+        },
         {
           "name": "dataSource",
           "type": "object",
@@ -840,7 +923,11 @@
         },
         {
           "name": "label",
-          "type": "string"
+          "type": [
+            "string",
+            "object"
+          ],
+          "description": "Heading of the tile, and of the drill-down panel when `title` is not set. Accepts either a plain string or an inline per-locale map (`{ en: \"Pipeline\", \"zh-CN\": \"销售管道\" }`) — the `I18nLabel` union the contract admits on this key — and the tile resolves the map against the active UI language, falling back through base language, a region-qualified sibling, `default`, then `en`, and finally to any remaining entry."
         },
         {
           "name": "aggregate",
@@ -853,13 +940,19 @@
         },
         {
           "name": "description",
-          "type": "string",
-          "description": "Helper text rendered under the value."
+          "type": [
+            "string",
+            "object"
+          ],
+          "description": "Helper text rendered under the value. Accepts either a plain string or an inline per-locale map (`{ en: \"This quarter\", \"zh-CN\": \"本季度\" }`), resolved against the active UI language with the same fallback chain as `label`."
         },
         {
           "name": "title",
-          "type": "string",
-          "description": "Heading of the drill-down panel. Defaults to `label` — set it only when the records list wants a different name from the tile."
+          "type": [
+            "string",
+            "object"
+          ],
+          "description": "Heading of the drill-down panel. Defaults to `label` — set it only when the records list wants a different name from the tile. Accepts either a plain string or an inline per-locale map (`{ en: \"Open deals\", \"zh-CN\": \"进行中的商机\" }`), resolved against the active UI language with the same fallback chain as `label`."
         },
         {
           "name": "filter",
@@ -1158,6 +1251,23 @@
           "name": "showHeader",
           "type": "boolean",
           "description": "Render the detail body's own title / follow-star / copy-id chip above the fields. Off by default because this block is normally composed under a `page:header` that already draws that chrome, and turning it on there shows the record title twice. Set it true only when this block is the whole page."
+        },
+        {
+          "name": "enforceFieldSecurity",
+          "type": "boolean",
+          "description": "Fold this block's field list through the caller's FIELD-read permissions before rendering, so a field the permission set denies leaves no empty row behind (renderer default: off). Presentation only: it re-applies the same field-read answer the server already enforced (ADR-0066 D3) and never widens access — with it off a denied field still arrives masked or stripped, and with it on the server still decides every value."
+        },
+        {
+          "name": "redactFields",
+          "type": "array",
+          "of": "string",
+          "description": "Field names this block never renders, whatever the permission answer (renderer default: render everything authored). Presentation only, evaluated in the browser after the record is fetched — the values are still in the page, so this is NOT a data-access control and NOT the object's `publicSharing.redactFields`, which removes them server-side. To keep a value from the caller, gate the field itself (`requiredPermissions` / `maskingRule`, ADR-0066 D3) or the permission set. Neighbours `hideFields`, which is the dedupe channel the renderer also writes to."
+        },
+        {
+          "name": "requiredPermissions",
+          "type": "array",
+          "of": "string",
+          "description": "[ADR-0066] Capabilities the user must ALL hold — names that permission sets grant through `systemPermissions`, not object actions: `read` or `update` here is an ordinary capability name, not the object's read or edit permission. When the client has resolved the user's capabilities and any of these is missing, this block does not render its content; wherever it would otherwise render, an insufficient-permissions notice takes its place. Presentation only: it authorises nothing, and the data API still serves the same data to the same user. A client that cannot resolve the user's capabilities (no permission provider, or one that does not report `systemPermissions`) renders this block as if they were held — it fails open."
         }
       ]
     },
@@ -1179,6 +1289,23 @@
             "vertical"
           ],
           "description": "Layout orientation for highlight fields"
+        },
+        {
+          "name": "enforceFieldSecurity",
+          "type": "boolean",
+          "description": "Fold this block's highlight chips through the caller's FIELD-read permissions before rendering, so a field the permission set denies leaves no empty chip behind (renderer default: off). Presentation only: it re-applies the same field-read answer the server already enforced (ADR-0066 D3) and never widens access — the record is fetched either way and the server still decides every value."
+        },
+        {
+          "name": "redactFields",
+          "type": "array",
+          "of": "string",
+          "description": "Field names this block never renders as a chip, whatever the permission answer (renderer default: render every field authored). Presentation only, evaluated in the browser after the record is fetched — the values are still in the page, so this is NOT a data-access control and NOT the object's `publicSharing.redactFields`, which removes them server-side. To keep a value from the caller, gate the field itself (`requiredPermissions` / `maskingRule`, ADR-0066 D3) or the permission set."
+        },
+        {
+          "name": "requiredPermissions",
+          "type": "array",
+          "of": "string",
+          "description": "[ADR-0066] Capabilities the user must ALL hold — names that permission sets grant through `systemPermissions`, not object actions: `read` or `update` here is an ordinary capability name, not the object's read or edit permission. When the client has resolved the user's capabilities and any of these is missing, this block does not render its content; wherever it would otherwise render, an insufficient-permissions notice takes its place. Presentation only: it authorises nothing, and the data API still serves the same data to the same user. A client that cannot resolve the user's capabilities (no permission provider, or one that does not report `systemPermissions`) renders this block as if they were held — it fails open."
         }
       ]
     },
@@ -1227,7 +1354,11 @@
         },
         {
           "name": "title",
-          "type": "string"
+          "type": [
+            "string",
+            "object"
+          ],
+          "description": "Heading of the list. Defaults to the related object's label (its translation when one is loaded, otherwise the humanized object name). Accepts either a plain string or an inline per-locale map (`{ en: \"Open tasks\", \"zh-CN\": \"未完成任务\" }`) — the `I18nLabel` union the contract admits on this key — and the list resolves the map against the active UI language, falling back through base language, a region-qualified sibling, `default`, then `en`, and finally to any remaining entry."
         },
         {
           "name": "showViewAll",
@@ -1244,6 +1375,23 @@
           "type": "object",
           "description": "Adds an \"Add\" button that assigns EXISTING records instead of creating one — the m2m/junction case. Shape: `{ picker: { object, valueField?, labelField?, filter? }, linkField?, label? }`. `picker.object` (required) is the object whose records the dialog offers. `picker.valueField` is the field of the picked record used as the link value (default \"id\"); `picker.labelField` is the column shown in the picker rows (default \"name\", and the other columns are derived from that object's schema). With `linkField` set, selecting records CREATES rows in this list's own object as `{ [relationshipField]: parentValue, [linkField]: pickedId }` — the junction case; omit `linkField` and the picked child is RE-PARENTED instead, by setting its own `relationshipField` to this parent. `label` is the button text (default \"Add\", localizable inline). Setting `add` also enables generic link removal on rows when no host delete handler is wired. `picker.filter` restricts which records the dialog offers — a list of `{ field, operator, value }` rules in the same vocabulary as this list's own `filter`, applied as a hard constraint the user cannot widen (it never appears as an editable filter row)."
         },
+        {
+          "name": "enforceFieldSecurity",
+          "type": "boolean",
+          "description": "Fold this list's `columns` through the caller's FIELD-read permissions on the RELATED object before rendering (renderer default: off). Presentation only: it re-applies the same field-read answer the server already enforced (ADR-0066 D3) and never widens access — the rows are fetched either way and the server still decides every value."
+        },
+        {
+          "name": "redactFields",
+          "type": "array",
+          "of": "string",
+          "description": "Field names this list never renders, whatever the permission answer (renderer default: render every column authored or derived). Applies to the authored `columns` AND to the columns the list derives for itself when none are authored. Presentation only, evaluated in the browser after the rows are fetched — the values are still in the page, so this is NOT a data-access control and NOT the object's `publicSharing.redactFields`, which removes them server-side. To keep a value from the caller, gate the field itself (`requiredPermissions` / `maskingRule`, ADR-0066 D3) or the permission set."
+        },
+        {
+          "name": "requiredPermissions",
+          "type": "array",
+          "of": "string",
+          "description": "[ADR-0066] Capabilities the user must ALL hold — names that permission sets grant through `systemPermissions`, not object actions: `read` or `update` here is an ordinary capability name, not the object's read or edit permission. When the client has resolved the user's capabilities and any of these is missing, this block does not render its content; wherever it would otherwise render, an insufficient-permissions notice takes its place. Presentation only: it authorises nothing, and the data API still serves the same data to the same user. A client that cannot resolve the user's capabilities (no permission provider, or one that does not report `systemPermissions`) renders this block as if they were held — it fails open."
+        },
         {
           "name": "dataSource",
           "type": "object",
@@ -1442,7 +1590,7 @@
           "name": "requiredPermissions",
           "type": "array",
           "of": "string",
-          "description": "Hide the whole bar unless the user holds these permissions"
+          "description": "[ADR-0066] Capabilities the user must ALL hold — names that permission sets grant through `systemPermissions`, not object actions: `read` or `update` here is an ordinary capability name, not the object's read or edit permission. When the client has resolved the user's capabilities and any of these is missing, this block does not render its content; wherever it would otherwise render, an insufficient-permissions notice takes its place. Presentation only: it authorises nothing, and the data API still serves the same data to the same user. A client that cannot resolve the user's capabilities (no permission provider, or one that does not report `systemPermissions`) renders this block as if they were held — it fails open."
         },
         {
           "name": "location",
@@ -1697,11 +1845,19 @@
           "name": "variant",
           "type": "enum",
           "enum": [
-            "heading",
-            "subheading",
+            "h1",
+            "h2",
+            "h3",
+            "h4",
+            "h5",
+            "h6",
             "body",
-            "caption"
-          ]
+            "caption",
+            "overline",
+            "heading",
+            "subheading"
+          ],
+          "description": "One of the nine text styles ui:text uses: h1-h6 (rendered as that heading level), body, caption or overline. heading and subheading are earlier spellings the contract still accepts and renders as h2 and h3; write h2 or h3 instead."
         },
         {
           "name": "align",
@@ -1721,8 +1877,7 @@
         {
           "name": "object",
           "type": "string",
-          "required": true,
-          "description": "Object the aggregate runs over"
+          "description": "Object the aggregate runs over. Required unless a node-level `dataSource` binding names one; when both are set, `dataSource.object` wins."
         },
         {
           "name": "aggregate",
@@ -1743,7 +1898,8 @@
         },
         {
           "name": "filter",
-          "type": "array"
+          "type": "array",
+          "description": "Criteria the aggregate is scoped by. When a node-level `dataSource` binding also supplies a filter (its own, or the saved view its `view` names), the two are AND-combined: neither is dropped."
         },
         {
           "name": "format",
@@ -1761,6 +1917,12 @@
         {
           "name": "suffix",
           "type": "string"
+        },
+        {
+          "name": "dataSource",
+          "type": "object",
+          "binding": "object",
+          "description": "Per-element data binding: { object, view, filter, sort, limit }. Overrides the page-level object context for this block; `view` names a saved view of `object`, and `filter` is ANDed with the view’s own rather than replacing it."
         }
       ]
     },
@@ -1828,16 +1990,23 @@
         {
           "name": "items",
           "type": "array",
-          "required": true,
-          "description": "Term/description pairs [{ term, description }]"
+          "of": "object",
+          "description": "Term/description pairs [{ term, description }], in order: `term` is the row label, `description` is shown as-is (an object as JSON, an omitted one as an em dash). Omitted or empty renders the \"No details\" state"
         },
         {
           "name": "columns",
           "type": "enum",
           "enum": [
-            "1",
-            "2"
-          ]
+            {
+              "label": "1",
+              "value": 1
+            },
+            {
+              "label": "2",
+              "value": 2
+            }
+          ],
+          "description": "Grid columns from the small breakpoint up: the NUMBER 1 or 2 (default 1)"
         },
         {
           "name": "inline",
@@ -1863,15 +2032,19 @@
         {
           "name": "fields",
           "type": "array",
-          "description": "Columns per row — bare names or { field, label? }"
+          "description": "Fields shown after the title on each line, in order: a bare field name, or `{ field }`"
         },
         {
           "name": "filter",
-          "type": "array"
+          "type": "array",
+          "of": "object",
+          "description": "Filter rules `[{ field, operator, value }]`. A string `value` may be a context token such as `{current_user_id}`, resolved before the query"
         },
         {
           "name": "sort",
-          "type": "array"
+          "type": "array",
+          "of": "object",
+          "description": "Sort order `[{ field, order }]`, applied in list order"
         },
         {
           "name": "limit",
@@ -1935,14 +2108,139 @@
           "name": "size",
           "type": "enum",
           "enum": [
+            "default",
             "sm",
             "md",
-            "lg"
-          ]
+            "lg",
+            "icon"
+          ],
+          "description": "Button size: the Button primitive's `default`, `sm`, `lg` or `icon`, plus `md`, which renders as `default` (default: `default`)"
         },
         {
           "name": "className",
           "type": "string"
+        },
+        {
+          "name": "visible",
+          "type": [
+            "boolean",
+            "string",
+            "object"
+          ],
+          "description": "Visibility predicate: `true`/`false`, a bare CEL expression, or the `{ dialect: 'cel', source }` envelope, evaluated against the row the host binds; the button is not rendered when it is false, nor when the predicate fails to evaluate. Omit for always-visible"
+        },
+        {
+          "name": "disabled",
+          "type": [
+            "boolean",
+            "string",
+            "object"
+          ],
+          "description": "Disabled predicate, in the same three shapes as `visible`: the button is shown but cannot be pressed while it holds. Omit for never-disabled"
+        },
+        {
+          "name": "params",
+          "type": "array",
+          "description": "The parameters to collect from the user before the action runs (`ActionParam` objects: `name`, `type`, `label`, …); each collected value reaches the executor under its parameter `name`. Static execution values ride `properties.params` instead"
+        },
+        {
+          "name": "description",
+          "type": "string",
+          "description": "Action description — the parameter dialog shows it under its title"
+        },
+        {
+          "name": "openIn",
+          "type": "enum",
+          "enum": [
+            "self",
+            "new-tab"
+          ],
+          "description": "For a `url` action: `self` navigates in place, `new-tab` opens a new browser tab"
+        },
+        {
+          "name": "method",
+          "type": "string",
+          "description": "HTTP method of an `api` action (`POST` when omitted)"
+        },
+        {
+          "name": "bodyExtra",
+          "type": "object",
+          "description": "Static request-body fields of an `api` action, merged last, so a constant here overrides a collected value of the same name"
+        },
+        {
+          "name": "bodyShape",
+          "type": [
+            "enum",
+            "object"
+          ],
+          "enum": [
+            "flat"
+          ],
+          "description": "How an `api` action shapes its request body: `flat` (the default) or `{ wrap: KEY }` to nest the collected values under that key, with `bodyExtra` beside it"
+        },
+        {
+          "name": "operation",
+          "type": "enum",
+          "enum": [
+            "update"
+          ],
+          "description": "`update` declares a single-record field write: the runner dispatches it to the platform action route with `patch` merged under the collected values"
+        },
+        {
+          "name": "patch",
+          "type": "object",
+          "description": "For `operation: update`: the field values written, merged UNDER the values the user supplies, so a collected value of the same name wins"
+        },
+        {
+          "name": "confirmText",
+          "type": "string",
+          "description": "Confirmation question asked before the action runs; the action runs only if it is confirmed"
+        },
+        {
+          "name": "successMessage",
+          "type": "string",
+          "description": "Toast text when the action succeeds (a message the server returns takes precedence)"
+        },
+        {
+          "name": "errorMessage",
+          "type": "string",
+          "description": "Toast text when the action fails, in place of the raw error"
+        },
+        {
+          "name": "refreshAfter",
+          "type": "boolean",
+          "description": "Refresh the surrounding data after the action succeeds"
+        },
+        {
+          "name": "locations",
+          "type": "array",
+          "of": "string",
+          "description": "The placements the action declares (`list_toolbar`, `list_item`, `record_header`, …). A `script` or `flow` action declared record-scoped (`list_item`, `record_header`, `record_more` or `record_section`) refuses to run when no record or single selection is in scope, instead of running without one"
+        },
+        {
+          "name": "toast",
+          "type": "object",
+          "description": "Toast behaviour: `{ showOnSuccess?, showOnError?, duration? }` — `false` suppresses that toast, `duration` is handed to the toast"
+        },
+        {
+          "name": "resultDialog",
+          "type": "object",
+          "description": "One-shot result dialog for a value the response shows exactly once (a 2FA code, a fresh secret); it replaces the success toast"
+        },
+        {
+          "name": "onSuccess",
+          "type": "object",
+          "description": "Post-success navigation `{ navigate, openIn? }`: `navigate` is a route template that can read `${result.*}`, `openIn` is `self` (the default) or `newTab`"
+        },
+        {
+          "name": "objectName",
+          "type": "string",
+          "description": "Object the action acts on — dispatch goes to this object instead of the page's. Omit to act on the page's object"
+        },
+        {
+          "name": "recordIdField",
+          "type": "string",
+          "description": "For a `script` action run against a single selected row: the row field whose value is sent as the record id (default `id`)"
         }
       ]
     },
@@ -1950,10 +2248,6 @@
       "type": "action:group",
       "namespace": "action",
       "inputs": [
-        {
-          "name": "name",
-          "type": "string"
-        },
         {
           "name": "label",
           "type": "string"
@@ -1964,7 +2258,9 @@
         },
         {
           "name": "actions",
-          "type": "object"
+          "type": "array",
+          "of": "object",
+          "description": "The actions in this group, in order. Each member is an action object the group draws and runs itself (`name`, `label`, `icon`, `type`, `target`, `locations`, `visible`, `disabled`, …); a member's executor is its own `type`"
         },
         {
           "name": "display",
@@ -1974,6 +2270,19 @@
             "dropdown"
           ]
         },
+        {
+          "name": "location",
+          "type": "enum",
+          "enum": [
+            "list_toolbar",
+            "list_item",
+            "record_header",
+            "record_more",
+            "record_related",
+            "record_section"
+          ],
+          "description": "Render only the members whose `locations` include this location. Omit to render every member"
+        },
         {
           "name": "variant",
           "type": "enum",
@@ -1988,10 +2297,21 @@
           "name": "size",
           "type": "enum",
           "enum": [
+            "default",
             "sm",
-            "md",
-            "lg"
-          ]
+            "lg",
+            "icon"
+          ],
+          "description": "Button size for the dropdown trigger and for every inline member that sets none"
+        },
+        {
+          "name": "visible",
+          "type": [
+            "boolean",
+            "string",
+            "object"
+          ],
+          "description": "Visibility predicate for the whole group: `true`/`false`, a bare CEL expression, or the `{ dialect: 'cel', source }` envelope, evaluated against the row the host binds. Omit for always-visible"
         },
         {
           "name": "className",
@@ -2013,7 +2333,9 @@
         },
         {
           "name": "actions",
-          "type": "object"
+          "type": "array",
+          "of": "object",
+          "description": "The menu's actions, in order. Each member is an action object the menu draws and runs itself (`name`, `label`, `icon`, `type`, `target`, `visible`, `disabled`, `tags`, …); a member's executor is its own `type`"
         },
         {
           "name": "variant",
@@ -2025,6 +2347,26 @@
             "ghost"
           ]
         },
+        {
+          "name": "size",
+          "type": "enum",
+          "enum": [
+            "default",
+            "sm",
+            "lg",
+            "icon"
+          ],
+          "description": "Trigger button size (renderer default: `icon`)"
+        },
+        {
+          "name": "visible",
+          "type": [
+            "boolean",
+            "string",
+            "object"
+          ],
+          "description": "Visibility predicate for the whole menu: `true`/`false`, a bare CEL expression, or the `{ dialect: 'cel', source }` envelope, evaluated against the row the host binds; a predicate that fails to evaluate hides it. Omit for always-visible"
+        },
         {
           "name": "className",
           "type": "string"
@@ -2076,6 +2418,123 @@
         {
           "name": "className",
           "type": "string"
+        },
+        {
+          "name": "visible",
+          "type": [
+            "boolean",
+            "string",
+            "object"
+          ],
+          "description": "Visibility predicate: `true`/`false`, a bare CEL expression, or the `{ dialect: 'cel', source }` envelope, evaluated against the row the host binds; the icon is not rendered when it is false. Omit for always-visible"
+        },
+        {
+          "name": "disabled",
+          "type": [
+            "boolean",
+            "string",
+            "object"
+          ],
+          "description": "Disabled predicate, in the same three shapes as `visible`: the icon is shown but cannot be pressed while it holds. Omit for never-disabled"
+        },
+        {
+          "name": "params",
+          "type": "array",
+          "description": "The parameters to collect from the user before the action runs (`ActionParam` objects: `name`, `type`, `label`, …); each collected value reaches the executor under its parameter `name`. Static execution values ride `properties.params` instead"
+        },
+        {
+          "name": "description",
+          "type": "string",
+          "description": "Action description — the tooltip text when there is no `label`, and what the parameter dialog shows under its title"
+        },
+        {
+          "name": "openIn",
+          "type": "enum",
+          "enum": [
+            "self",
+            "new-tab"
+          ],
+          "description": "For a `url` action: `self` navigates in place, `new-tab` opens a new browser tab"
+        },
+        {
+          "name": "method",
+          "type": "string",
+          "description": "HTTP method of an `api` action (`POST` when omitted)"
+        },
+        {
+          "name": "bodyExtra",
+          "type": "object",
+          "description": "Static request-body fields of an `api` action, merged last, so a constant here overrides a collected value of the same name"
+        },
+        {
+          "name": "bodyShape",
+          "type": [
+            "enum",
+            "object"
+          ],
+          "enum": [
+            "flat"
+          ],
+          "description": "How an `api` action shapes its request body: `flat` (the default) or `{ wrap: KEY }` to nest the collected values under that key, with `bodyExtra` beside it"
+        },
+        {
+          "name": "operation",
+          "type": "enum",
+          "enum": [
+            "update"
+          ],
+          "description": "`update` declares a single-record field write: the runner dispatches it to the platform action route with `patch` merged under the collected values"
+        },
+        {
+          "name": "patch",
+          "type": "object",
+          "description": "For `operation: update`: the field values written, merged UNDER the values the user supplies, so a collected value of the same name wins"
+        },
+        {
+          "name": "confirmText",
+          "type": "string",
+          "description": "Confirmation question asked before the action runs; the action runs only if it is confirmed"
+        },
+        {
+          "name": "successMessage",
+          "type": "string",
+          "description": "Toast text when the action succeeds (a message the server returns takes precedence)"
+        },
+        {
+          "name": "errorMessage",
+          "type": "string",
+          "description": "Toast text when the action fails, in place of the raw error"
+        },
+        {
+          "name": "refreshAfter",
+          "type": "boolean",
+          "description": "Refresh the surrounding data after the action succeeds"
+        },
+        {
+          "name": "locations",
+          "type": "array",
+          "of": "string",
+          "description": "The placements the action declares (`list_toolbar`, `list_item`, `record_header`, …). A `script` or `flow` action declared record-scoped (`list_item`, `record_header`, `record_more` or `record_section`) refuses to run when no record or single selection is in scope, instead of running without one"
+        },
+        {
+          "name": "toast",
+          "type": "object",
+          "description": "Toast behaviour: `{ showOnSuccess?, showOnError?, duration? }` — `false` suppresses that toast, `duration` is handed to the toast"
+        },
+        {
+          "name": "resultDialog",
+          "type": "object",
+          "description": "One-shot result dialog for a value the response shows exactly once (a 2FA code, a fresh secret); it replaces the success toast"
+        },
+        {
+          "name": "onSuccess",
+          "type": "object",
+          "description": "Post-success navigation `{ navigate, openIn? }`: `navigate` is a route template that can read `${result.*}`, `openIn` is `self` (the default) or `newTab`"
+        },
+        {
+          "name": "objectName",
+          "type": "string",
+          "description": "Object the action acts on — dispatch goes to this object instead of the page's. Omit to act on the page's object"
         }
       ]
     },
@@ -2428,7 +2887,8 @@
         },
         {
           "name": "breadcrumb",
-          "type": "boolean"
+          "type": "boolean",
+          "description": "Ignored: the header draws no breadcrumb, and the key is being retired from the contract. Leave it out."
         },
         {
           "name": "recordChrome",