feat(i18n): make action resultDialog copy translatable (schema slot + resolver + platform bundles)

The one-shot secret-reveal dialogs (create-user temporary password, 2FA
backup codes, OAuth client secrets) always rendered hardcoded English:
the translation protocol had no slot for Action.resultDialog, so neither
the bundles nor any resolver could localize the dialog's title,
description, acknowledge button, or field labels.

- spec: add ActionResultDialogTranslationSchema and hang it off object
  `_actions`, `globalActions`, and the object-first `_actions` node.
  `fields` is keyed by the LITERAL result-field path ("user.email") —
  keys may contain dots, resolvers index the record directly. New
  resolveActionResultDialog overlay resolver, wired into translateAction.
- cli: `os i18n extract` emits resultDialog.title/description/acknowledge
  and resultDialog.fields.<path> entries (dotted paths stay one segment).
- platform-objects: fill the en / zh-CN / ja-JP / es-ES bundles for all
  six shipped resultDialogs (sys_user create_user + set_user_password,
  sys_two_factor enable + regenerate backup codes, sys_oauth_application
  register + rotate secret).

Client-side rendering lands in objectui (@object-ui/i18n
actionResultDialog + result-dialog handlers). Verified end-to-end against
a live showcase instance: the create-user and set-password dialogs render
fully localized in zh-CN.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: baozhoutao

.changeset/action-result-dialog-i18n.md

@@ -0,0 +1,33 @@
+---
+"@objectstack/spec": minor
+"@objectstack/cli": patch
+"@objectstack/platform-objects": patch
+---
+
+feat(i18n): translation slot for action `resultDialog` copy — the one-shot secret-reveal dialogs are now localizable
+
+The post-success `resultDialog` (temporary passwords, 2FA backup codes, OAuth
+client secrets) had no slot in the translation protocol, so its title /
+description / acknowledge button / field labels always rendered the hardcoded
+English metadata literals even on fully-translated locales.
+
+- **spec.** `_actions.<action>` (object + object-first node) and
+  `globalActions.<action>` gain an optional `resultDialog` translation node
+  (`ActionResultDialogTranslationSchema`): `title`, `description`,
+  `acknowledge`, and `fields` keyed by the **literal** result-field path
+  (e.g. `"user.email"` — keys may contain dots; resolvers index the record
+  directly, never split on `.`). New `resolveActionResultDialog` overlay
+  resolver, wired into `translateAction` for API-boundary translation.
+- **cli.** `os i18n extract` emits the new `resultDialog.*` keys (title /
+  description / acknowledge / `fields.<path>` for labelled fields), so
+  coverage and skeleton generation see them.
+- **platform-objects.** en / zh-CN / ja-JP / es-ES bundles ship the
+  resultDialog copy for all six shipped dialogs: `sys_user.create_user`,
+  `sys_user.set_user_password`, `sys_two_factor.enable_two_factor`,
+  `sys_two_factor.regenerate_backup_codes`,
+  `sys_oauth_application.create_oauth_application`, and
+  `sys_oauth_application.rotate_client_secret`.
+
+Client-side rendering lands in objectui (`actionResultDialog` resolver in
+`@object-ui/i18n` + result-dialog handlers). Purely additive — untranslated
+locales keep falling back to the metadata literals.

packages/cli/src/utils/i18n-extract.ts

@@ -27,8 +27,10 @@
  *   objects.<name>._actions.<action>.successMessage
  *   objects.<name>._actions.<action>.params.<param>.label / .helpText / .placeholder
  *   objects.<name>._actions.<action>.params.<param>.options.<value>
+ *   objects.<name>._actions.<action>.resultDialog.title / .description / .acknowledge
+ *   objects.<name>._actions.<action>.resultDialog.fields.<path>
  *   globalActions.<action>.label / .confirmText / .successMessage
- *   globalActions.<action>.params.<param>.* (same shape as object actions)
+ *   globalActions.<action>.params.<param>.* / .resultDialog.* (same shape as object actions)
  *   apps.<app>.label / .description
  *   apps.<app>.navigation.<id>.label
  *   dashboards.<dash>.label / .description
@@ -199,6 +201,43 @@ function pushActionParams(
   }
 }
 
+/**
+ * Emit `resultDialog.{title,description,acknowledge}` and
+ * `resultDialog.fields.<path>` entries under an action's translation root.
+ * Mirrors `ActionResultDialogTranslationSchema` in @objectstack/spec and the
+ * client-side `actionResultDialog` resolver. Field entries are keyed by the
+ * LITERAL result-field path (`"user.email"`) — the dot stays inside a single
+ * path segment, matching how resolvers index the record without splitting.
+ */
+function pushActionResultDialog(
+  out: ExpectedEntry[],
+  actionRoot: string[],
+  action: any,
+  kind: ExpectedEntry['source'],
+  objectName?: string,
+): void {
+  const dialog = action?.resultDialog;
+  if (!dialog || typeof dialog !== 'object') return;
+  const base = [...actionRoot, 'resultDialog'];
+  if (typeof dialog.title === 'string' && dialog.title.length > 0) {
+    pushEntry(out, [...base, 'title'], dialog.title, kind, { objectName });
+  }
+  if (typeof dialog.description === 'string' && dialog.description.length > 0) {
+    pushEntry(out, [...base, 'description'], dialog.description, kind, { objectName });
+  }
+  if (typeof dialog.acknowledge === 'string' && dialog.acknowledge.length > 0) {
+    pushEntry(out, [...base, 'acknowledge'], dialog.acknowledge, kind, { objectName });
+  }
+  if (Array.isArray(dialog.fields)) {
+    for (const field of dialog.fields) {
+      if (!field || typeof field !== 'object') continue;
+      if (typeof field.path !== 'string' || field.path.length === 0) continue;
+      if (typeof field.label !== 'string' || field.label.length === 0) continue;
+      pushEntry(out, [...base, 'fields', field.path], field.label, kind, { objectName });
+    }
+  }
+}
+
 /** Collect every translatable entry from a normalized stack config. */
 export function collectExpectedEntries(config: any): ExpectedEntry[] {
   const out: ExpectedEntry[] = [];
@@ -286,6 +325,7 @@ export function collectExpectedEntries(config: any): ExpectedEntry[] {
           pushEntry(out, ['objects', objectName, '_actions', aname, 'successMessage'], action.successMessage, 'action', { objectName });
         }
         pushActionParams(out, ['objects', objectName, '_actions', aname], action, 'action', objectName);
+        pushActionResultDialog(out, ['objects', objectName, '_actions', aname], action, 'action', objectName);
       }
     }
   }
@@ -320,6 +360,7 @@ export function collectExpectedEntries(config: any): ExpectedEntry[] {
       pushEntry(out, [...root, 'successMessage'], action.successMessage, kind, { objectName });
     }
     pushActionParams(out, root, action, kind, objectName);
+    pushActionResultDialog(out, root, action, kind, objectName);
   }
 
   // ── Apps + navigation ────────────────────────────────────────────

packages/cli/test/i18n-extract.test.ts

@@ -168,6 +168,16 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
           mustChangePassword: {
             label: "Require Password Change On First Login"
           }
+        },
+        resultDialog: {
+          title: "User Created",
+          description: "Copy the temporary password now — it is shown only once and never stored.",
+          acknowledge: "I have saved this password",
+          fields: {
+            "user.email": "Email",
+            "user.phoneNumber": "Phone Number",
+            temporaryPassword: "Temporary Password"
+          }
         }
       },
       set_user_password: {
@@ -183,6 +193,14 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
           mustChangePassword: {
             label: "Require Password Change On Next Login"
           }
+        },
+        resultDialog: {
+          title: "Password Updated",
+          description: "If a temporary password was generated, copy it now — it is shown only once and never stored.",
+          acknowledge: "Done",
+          fields: {
+            temporaryPassword: "Temporary Password"
+          }
         }
       },
       set_user_role: {
@@ -988,6 +1006,15 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
           password: {
             label: "Current Password"
           }
+        },
+        resultDialog: {
+          title: "Two-factor authentication enabled",
+          description: "Scan the QR code with your authenticator app, then save the backup codes somewhere safe. The backup codes are shown only once.",
+          acknowledge: "I have saved my backup codes",
+          fields: {
+            totpURI: "Authenticator URI",
+            backupCodes: "Backup Codes"
+          }
         }
       },
       disable_two_factor: {
@@ -1007,6 +1034,14 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
           password: {
             label: "Current Password"
           }
+        },
+        resultDialog: {
+          title: "New backup codes generated",
+          description: "Previous backup codes are now invalid. Save these new codes somewhere safe — they are shown only once.",
+          acknowledge: "I have saved the new codes",
+          fields: {
+            backupCodes: "Backup Codes"
+          }
         }
       }
     }
@@ -1287,11 +1322,28 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
               public: "Public"
             }
           }
+        },
+        resultDialog: {
+          title: "OAuth application registered",
+          description: "Save the client_secret now — it is shown only once and cannot be recovered. You can rotate it later if it leaks.",
+          acknowledge: "I have saved the client secret",
+          fields: {
+            "client.client_id": "Client ID",
+            "client.client_secret": "Client Secret"
+          }
         }
       },
       rotate_client_secret: {
         label: "Rotate Client Secret",
-        confirmText: "Rotate this OAuth client's secret? The previous secret will stop working immediately and any integrations using it will break until they are updated with the new secret. The new secret is shown only once."
+        confirmText: "Rotate this OAuth client's secret? The previous secret will stop working immediately and any integrations using it will break until they are updated with the new secret. The new secret is shown only once.",
+        resultDialog: {
+          title: "Client secret rotated",
+          description: "Save the new secret now — it is shown only once. Update every integration before the previous secret's grace period ends.",
+          acknowledge: "I have updated my integrations",
+          fields: {
+            client_secret: "New Client Secret"
+          }
+        }
       },
       delete_oauth_application: {
         label: "Delete OAuth Application",

packages/platform-objects/src/apps/translations/en.objects.generated.ts

@@ -168,6 +168,16 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
           mustChangePassword: {
             label: "Exigir cambio de contraseña en el primer inicio de sesión"
           }
+        },
+        resultDialog: {
+          title: "Usuario creado",
+          description: "Copie la contraseña temporal ahora: se muestra una sola vez y no se almacena.",
+          acknowledge: "He guardado esta contraseña",
+          fields: {
+            "user.email": "Correo electrónico",
+            "user.phoneNumber": "Número de teléfono",
+            temporaryPassword: "Contraseña temporal"
+          }
         }
       },
       set_user_password: {
@@ -183,6 +193,14 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
           mustChangePassword: {
             label: "Exigir cambio de contraseña en el próximo inicio de sesión"
           }
+        },
+        resultDialog: {
+          title: "Contraseña actualizada",
+          description: "Si se generó una contraseña temporal, cópiela ahora: se muestra una sola vez y no se almacena.",
+          acknowledge: "Hecho",
+          fields: {
+            temporaryPassword: "Contraseña temporal"
+          }
         }
       },
       set_user_role: {
@@ -988,6 +1006,15 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
           password: {
             label: "Contraseña actual"
           }
+        },
+        resultDialog: {
+          title: "Autenticación de doble factor habilitada",
+          description: "Escanee el código QR con su aplicación de autenticación y guarde los códigos de respaldo en un lugar seguro. Los códigos de respaldo se muestran una sola vez.",
+          acknowledge: "He guardado mis códigos de respaldo",
+          fields: {
+            totpURI: "URI del autenticador",
+            backupCodes: "Códigos de respaldo"
+          }
         }
       },
       disable_two_factor: {
@@ -1007,6 +1034,14 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
           password: {
             label: "Contraseña actual"
           }
+        },
+        resultDialog: {
+          title: "Nuevos códigos de respaldo generados",
+          description: "Los códigos de respaldo anteriores ya no son válidos. Guarde estos nuevos códigos en un lugar seguro: se muestran una sola vez.",
+          acknowledge: "He guardado los nuevos códigos",
+          fields: {
+            backupCodes: "Códigos de respaldo"
+          }
         }
       }
     }
@@ -1287,11 +1322,28 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
               public: "Pública"
             }
           }
+        },
+        resultDialog: {
+          title: "Aplicación OAuth registrada",
+          description: "Guarde el client_secret ahora: se muestra una sola vez y no se puede recuperar. Puede rotarlo más adelante si se filtra.",
+          acknowledge: "He guardado el secreto de cliente",
+          fields: {
+            "client.client_id": "ID de cliente",
+            "client.client_secret": "Secreto de cliente"
+          }
         }
       },
       rotate_client_secret: {
         label: "Rotar Client Secret",
-        confirmText: "¿Rotar el secreto de este cliente OAuth? El secreto anterior dejará de funcionar de inmediato y cualquier integración que lo utilice fallará hasta que se actualice con el nuevo secreto. El nuevo secreto se muestra una sola vez."
+        confirmText: "¿Rotar el secreto de este cliente OAuth? El secreto anterior dejará de funcionar de inmediato y cualquier integración que lo utilice fallará hasta que se actualice con el nuevo secreto. El nuevo secreto se muestra una sola vez.",
+        resultDialog: {
+          title: "Secreto de cliente rotado",
+          description: "Guarde el nuevo secreto ahora: se muestra una sola vez. Actualice todas las integraciones antes de que termine el periodo de gracia del secreto anterior.",
+          acknowledge: "He actualizado mis integraciones",
+          fields: {
+            client_secret: "Nuevo secreto de cliente"
+          }
+        }
       },
       delete_oauth_application: {
         label: "Eliminar aplicación OAuth",

packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts

@@ -168,6 +168,16 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
           mustChangePassword: {
             label: "初回サインイン時にパスワード変更を必須にする"
           }
+        },
+        resultDialog: {
+          title: "ユーザーを作成しました",
+          description: "一時パスワードを今すぐコピーしてください。表示は一度きりで、保存されません。",
+          acknowledge: "パスワードを保存しました",
+          fields: {
+            "user.email": "メールアドレス",
+            "user.phoneNumber": "電話番号",
+            temporaryPassword: "一時パスワード"
+          }
         }
       },
       set_user_password: {
@@ -183,6 +193,14 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
           mustChangePassword: {
             label: "次回サインイン時にパスワード変更を必須にする"
           }
+        },
+        resultDialog: {
+          title: "パスワードを更新しました",
+          description: "一時パスワードが生成された場合は今すぐコピーしてください。表示は一度きりで、保存されません。",
+          acknowledge: "完了",
+          fields: {
+            temporaryPassword: "一時パスワード"
+          }
         }
       },
       set_user_role: {
@@ -988,6 +1006,15 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
           password: {
             label: "現在のパスワード"
           }
+        },
+        resultDialog: {
+          title: "二要素認証を有効化しました",
+          description: "認証アプリで QR コードをスキャンし、バックアップコードを安全な場所に保存してください。バックアップコードの表示は一度きりです。",
+          acknowledge: "バックアップコードを保存しました",
+          fields: {
+            totpURI: "認証アプリ URI",
+            backupCodes: "バックアップコード"
+          }
         }
       },
       disable_two_factor: {
@@ -1007,6 +1034,14 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
           password: {
             label: "現在のパスワード"
           }
+        },
+        resultDialog: {
+          title: "新しいバックアップコードを生成しました",
+          description: "以前のバックアップコードは無効になりました。新しいコードを安全な場所に保存してください。表示は一度きりです。",
+          acknowledge: "新しいコードを保存しました",
+          fields: {
+            backupCodes: "バックアップコード"
+          }
         }
       }
     }
@@ -1287,11 +1322,28 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
               public: "パブリック"
             }
           }
+        },
+        resultDialog: {
+          title: "OAuthアプリケーションを登録しました",
+          description: "client_secret を今すぐ保存してください。表示は一度きりで、復元できません。漏えいした場合は後でローテーションできます。",
+          acknowledge: "クライアントシークレットを保存しました",
+          fields: {
+            "client.client_id": "クライアント ID",
+            "client.client_secret": "クライアントシークレット"
+          }
         }
       },
       rotate_client_secret: {
         label: "クライアントシークレット更新",
-        confirmText: "このOAuthクライアントのシークレットをローテーションしますか？以前のシークレットは直ちに使用できなくなり、それを使用している連携は新しいシークレットに更新されるまで動作しなくなります。新しいシークレットは一度しか表示されません。"
+        confirmText: "このOAuthクライアントのシークレットをローテーションしますか？以前のシークレットは直ちに使用できなくなり、それを使用している連携は新しいシークレットに更新されるまで動作しなくなります。新しいシークレットは一度しか表示されません。",
+        resultDialog: {
+          title: "クライアントシークレットをローテーションしました",
+          description: "新しいシークレットを今すぐ保存してください。表示は一度きりです。旧シークレットの猶予期間が終わる前にすべての連携を更新してください。",
+          acknowledge: "連携を更新しました",
+          fields: {
+            client_secret: "新しいクライアントシークレット"
+          }
+        }
       },
       delete_oauth_application: {
         label: "OAuthアプリケーションを削除",