Merge remote-tracking branch 'origin/main' into claude/youthful-pasteur-be09ad

# Conflicts:
#	packages/components/src/renderers/form/form.tsx

Author: os-zhuang

.changeset/action-target-is-the-only-handler-slot.md

@@ -0,0 +1,42 @@
+---
+'@object-ui/types': major
+'@object-ui/core': major
+'@object-ui/components': major
+'@object-ui/app-shell': major
+---
+
+**`target` is the only action handler slot — the `execute` alias is gone from the renderer (framework#3856).**
+
+`ActionRunner.executeScript` read `action.target || action.execute`. That fallback
+is unreachable against `@objectstack/spec` 17: `execute` is now a tombstoned key
+(framework#3855) that the parser **rejects** with the rename prescription, so no
+parsed action can carry it and the `||` could only ever yield `target`. Verified
+against 17.0.0-rc.0 — an action declaring `execute` fails `ActionSchema.safeParse`,
+and a `target` action's parsed output has no `execute` key at all.
+
+Deleted rather than left as harmless residue: two handler slots is what let one
+action run one script server-side and a different one client-side (framework#3713,
+where this renderer preferred the alias while the spec transform preferred
+`target`). A dead slot still reads as a live contract to the next maintainer.
+
+`execute` is also **removed from the types**, which is the part that had never
+landed. framework#3856 predicted a compile error here; there wasn't one, because
+neither reader was typed against the spec's `z.infer`:
+
+- `@object-ui/types` `ActionSchema` hand-declared `execute?: string`. Removed, so
+  `execute: '…'` now fails `tsc` at the authoring site (TS2353).
+- `@object-ui/core` `ActionDef` hand-declared it too. Removed — but `ActionDef`
+  carries a `[key: string]: any` index signature, so stale hand-authored metadata
+  that never passed through the parser still compiles. For that path
+  `executeScript` now returns the rename prescription instead of a bare
+  "No script provided", matching the spec tombstone's rule that removing an
+  authorable key must be audible: silently binding no handler is the
+  "Mark Done does nothing" shape (framework#2169).
+
+The four action renderers (`action:button`, `action:icon`, `action:menu`,
+`action:group`) no longer forward `execute` into the runner, and Studio's
+`ActionPreview` no longer falls back to it — previewing an alias-only draft as
+"bound" contradicted the parse that rejects it on save.
+
+Requires `@objectstack/spec` 17. Metadata still on the alias is rewritten by
+`os migrate meta --from 16`.

.changeset/navigation-action-alias.md

@@ -0,0 +1,44 @@
+---
+"@object-ui/types": minor
+"@object-ui/core": minor
+---
+
+refactor(actions): `navigation` becomes a named alias of the spec's `url`, sharing one navigator (#2944)
+
+The last open item of #2944: `ActionRunner` dispatched a seventh action type,
+`navigation`, that `@objectstack/spec`'s `ActionType` does not contain. The issue
+asked for a decision — promote it upstream or delete the case. Neither, as stated.
+
+- **Promoting it is wrong.** The spec already has `url` for "go to a location",
+  with `openIn` for the new-tab/same-tab choice. A seventh type would put a
+  second spec name on one operation, which is the exact failure the #2901 audit
+  is named after: *a second definition of the vocabulary exists, and the renderer
+  is faithful to the wrong one*.
+- **Deleting it is worse, because it is silent.** `{ type: 'navigation', to: … }`
+  is authored today (`element:button` CTAs). Without the case the action falls
+  through to `executeActionSchema`, which returns `{ success: true }` — a green
+  toast that navigates nowhere. That is #2960's trap.
+
+So it stays, but stops being dialect. `ObjectUiLocalActionType` /
+`OBJECTUI_LOCAL_ACTION_TYPES` in `@object-ui/types` declare it as objectui's own
+alias of `url` — the same treatment #2985 gave `PageVisualizationAlias` — and the
+runner routes both names through one navigator.
+
+**The alias had already drifted, which is the point.** `executeNavigation` was
+quietly the weaker of the two implementations: no `${param.X}` / `${ctx.X}`
+interpolation, `openIn` ignored, and no `/api/…` full-page short-circuit (the
+redirect-dance case `url` exists to handle). An author who wrote
+`{ type: 'navigation', to: '/x?p=${param.p}' }` shipped the literal `${param.p}`,
+while the identical `url` action resolved it. Both names now behave identically;
+`url` in turn gains `replace` pass-through, the one modifier only the alias had.
+
+Additive only. `replace` is omitted from the `NavigationHandler` options object
+when unset, so hosts see the option shape they already saw.
+
+The new guard is structural rather than another assertion. The runner's built-in
+dispatch is a table typed `Record<RunnableActionType, …>` instead of a `switch`,
+so an `ActionType` the spec **adds** stops compiling until an executor exists for
+it — the Tier-2 "validates at save, renders nothing at run time" failure (#2942)
+becomes a build error for actions. `spec-derived-unions.test.ts` additionally
+asserts `navigation` is *absent* from the spec enum, so the day it is adopted
+upstream, the test fails and names the alias to retire.

.changeset/tabbed-modal-keeps-every-tab.md

@@ -0,0 +1,35 @@
+---
+"@object-ui/types": patch
+"@object-ui/components": patch
+"@object-ui/plugin-form": patch
+---
+
+fix(form): a tabbed/sectioned create-edit form no longer loses the tabs you are not looking at (#2959, #2153)
+
+The explicit-`sections` path rendered one `SchemaRenderer` — one react-hook-form
+instance and one `<form>` element — **per section**, all sharing the same
+`formId`. Two failures compounded:
+
+1. the footer submit button (`form={formId}`) can only be associated with the
+   **first** of those forms, so section 2+ never reached the payload; and
+2. in the `tabbed` variant Radix unmounted the inactive panel, destroying that
+   tab's form state outright.
+
+Reported flow (HotCRM, 3 tabs, required `description` on tab 3): fill tab 1 →
+submit → server 400 `description is required` → switch to tab 3, fill it →
+submit → the server now reports `subject; description; status; priority` **all**
+missing, because the second submit's body had lost every earlier value.
+
+`ModalForm` (stacked and `contentLayout: 'tabbed'`) and `TabbedForm` now render
+ONE form for all sections, matching `ObjectForm` / `DrawerForm`. Stacked sections
+use the existing inline `section-divider` header (which now also renders the
+section's `description`); tabbed sections go through a new
+`FormSchema.fieldTabs` (+ `defaultFieldTab`, `fieldTabsPosition`) that the form
+renderer distributes into **force-mounted** Radix panels — CSS-hidden rather
+than unmounted, since react-hook-form skips validation for unmounted fields,
+which is how a required field on a tab nobody opened used to sail past the
+client and come back as a server 400.
+
+Validation feedback now points at the tab: a rejected field activates its tab and
+every tab holding one is marked on its trigger, for client-side rules and server
+`fields[]` rejections alike.

.changeset/view-operator-builder-parity.md

@@ -0,0 +1,43 @@
+---
+"@object-ui/components": minor
+"@object-ui/plugin-view": patch
+---
+
+fix(view,components): the spec→FilterBuilder operator table covers the whole view vocabulary, and the dead write direction is gone
+
+`view-config-utils`' `SPEC_TO_BUILDER_OP` resolved **10 of the spec's 19
+canonical `VIEW_FILTER_OPERATORS`**. The nine it missed —
+`not_equals`, `starts_with`, `ends_with`, `greater_than`, `less_than`,
+`greater_than_or_equal`, `less_than_or_equal`, `is_null`, `is_not_null` — all
+appear in stored view metadata (they are canonical; `ViewFilterRuleSchema`
+validates against exactly this list), and each reached the FilterBuilder as a
+raw spelling its operator dropdown cannot select.
+
+Same defect and same cause as #2974, one table over: spellings were enumerated
+by hand. That table is now derived from the spec's own canonical list and
+`VIEW_FILTER_OPERATOR_ALIASES`, matched case- and separator-insensitively, so
+`not_in` / `notIn` / `'not in'` / `NOT_IN` are one entry rather than four
+chances to miss one.
+
+Four canonical operators have no FilterBuilder equivalent —
+`starts_with`/`ends_with` (absent from its vocabulary) and `is_null`/
+`is_not_null` (distinct from the `is_empty`/`is_not_empty` it does have). They
+are recorded as explicit `null`s and asserted, and deliberately left unmapped:
+folding them onto a near-equivalent would silently rewrite the author's
+operator on the next save, whereas an unmapped operator surfaces as a condition
+row the author must complete.
+
+Also retired `BUILDER_TO_SPEC_OP` and `toSpecFilter` — the write direction,
+dead since the legacy `buildViewConfigSchema` engine was replaced by the
+studio's spec-driven inspector (no caller anywhere in the repo, and not part of
+`@object-ui/plugin-view`'s public exports). It was objectui's last emitter of
+`'not in'` with a space, plus `before`/`after`, as *filter-AST* operators —
+spellings that reached the server outside `VALID_AST_OPERATORS` and were dropped
+without an error (objectstack-ai/objectstack#3948).
+
+`@object-ui/components` now exports `FILTER_BUILDER_OPERATORS` (and the
+`FilterBuilderOperator` type), derived from the operators the FilterBuilder
+actually renders, so tables mapping onto that vocabulary can assert against it
+instead of restating it.
+
+Refs objectstack-ai/objectui#2945, #2901.

content/docs/plugins/plugin-form.mdx

@@ -62,6 +62,35 @@ interface FormField {
 }
 ```
 
+### Tabbed field layout (`fieldTabs`)
+
+A sectioned form stays **one** form: declare the tabs on it and the renderer
+distributes the fields into panels, instead of rendering a form per section
+(which strands every section but the first outside the submit, and lets an
+inactive tab unmount along with its values).
+
+```plaintext
+{
+  type: 'form',
+  fields: [/* every tab's fields, in one flat list */],
+  fieldTabs: [
+    { key: 'basics', label: 'Basics', fields: ['subject', 'status'] },
+    { key: 'detail', label: 'Detail', description: 'Anything else', fields: ['description'] },
+  ],
+  defaultFieldTab?: 'basics',       // defaults to the first tab
+  fieldTabsPosition?: 'top',        // 'top' | 'bottom' | 'left' | 'right'
+}
+```
+
+- Panels are force-mounted and only CSS-hidden, so a tab the user leaves keeps
+  its values **and** its validation.
+- A failed submit activates the tab holding the first offending field and marks
+  every tab with a rejected field — client rules and server `fields[]` alike.
+- Fields no tab claims render above the tab strip rather than disappearing.
+- Needs at least two tabs; ignored when the form uses `children`.
+
+`ModalForm` (`contentLayout: 'tabbed'`) and `TabbedForm` build on this.
+
 ## Usage
 
 ### Auto-registration (Side-effect Import)

docs/audits/2901-spec-enum-renderer-coverage.md

@@ -2,7 +2,7 @@
 
 Audited against `@objectstack/spec@16.0.0-rc.0` and `objectui@cd09a7b90`.
 **Re-validated against `17.0.0-rc.0`** — see the addendum at the end, which also
-carries three corrections. Read it before acting on any row below.
+carries four corrections. Read it before acting on any row below.
 
 Every row below was confirmed by reading the dispatch code. Nothing was exercised at
 runtime, so symptoms are read off the code path, not observed. Rows the auditors could
@@ -165,7 +165,7 @@ value corruption rather than disclosure.
 
 | Name | Location | Call |
 |---|---|---|
-| `navigation` action type | [ActionRunner.ts:539](../../packages/core/src/actions/ActionRunner.ts) | Fully implemented (`executeNavigation`). **Promote** — it is a real capability the spec doesn't name. |
+| `navigation` action type | [ActionRunner.ts](../../packages/core/src/actions/ActionRunner.ts) | ~~Promote~~ — **resolved as a declared alias instead.** See the correction below. |
 | `combo` chart type | [normalizeChartSchema.ts:63](../../packages/plugin-charts/src/normalizeChartSchema.ts) | Drawn at `AdvancedChartImpl.tsx:819`. Promote or delete. |
 | `system` theme mode | ThemeProvider ×2 | Delete — the spec name is `auto`, and `react/ThemeContext.tsx` already gets it right. |
 | `scale-fade` preset | [useAnimation.ts:71](../../packages/react/src/hooks/useAnimation.ts) | Delete with the hyphen/underscore fix. |
@@ -358,6 +358,33 @@ On a list whose only narrowing is that filter, the user sees rows they had asked
 to exclude. It is not a permission bypass — row-scoping `$and`-composes as a
 separate arm and survives — but it ranks with Tier 1, not Tier 2.
 
+## Correction 4 — "promote `navigation` upstream" was the wrong call
+
+Direction B told the reader to promote the `navigation` action type into the spec,
+on the grounds that it is "a real capability the spec doesn't name". The capability
+is real; the framing was not. The spec already names it — `type: 'url'`, with
+`openIn` for the new-tab choice — so promoting `navigation` would have put a second
+spec name on one operation. That is the failure this audit exists to describe,
+committed one level up.
+
+The row *also* under-read the cost of the stated alternative. Deleting the case
+does not surface an error: the action falls through to `executeActionSchema`, which
+returns `{ success: true }`, so the user gets a success toast and no navigation —
+#2960's trap, reached by way of a cleanup.
+
+What was missing from the row is that the alias had **already drifted**, which is
+the ordinary outcome of two implementations of one concept. `executeNavigation` did
+no `${param.X}` interpolation, ignored `openIn`, and skipped the `/api/…`
+full-page short-circuit — so `{ type: 'navigation', to: '/x?p=${param.p}' }`
+shipped the literal `${param.p}` while the identical `url` action resolved it.
+
+Resolved by declaring it (`ObjectUiLocalActionType`) and routing both names
+through one navigator — the same treatment #2985 gave the page-visualization names.
+Generalizing: a "renderer-local dialect" row needs a third option next to promote
+and delete — **alias to the spec name it duplicates** — and picking between the
+three starts with asking whether the spec really lacks the concept or just spells
+it differently.
+
 ## Status of the items above
 
 | Item | Status |
@@ -366,7 +393,9 @@ separate arm and survives — but it ranks with Tier 1, not Tier 2.
 | `before`/`after`, `'not in'`, + 8 legacy spellings | Fixed — #2974 |
 | `DensityModeSchema` inert | Resolved upstream (removed in spec 17) |
 | Packages lacking the `@objectstack/spec` devDep | **6** — `plugin-list` and `data-objectstack` gained it in #2974; `plugin-charts`, `plugin-dashboard`, `plugin-report`, `components`, `mobile` and `fields` remain. (The body above says 6 because it counted a 13-package "needs a guard" list that omitted `fields`; adding `fields` and removing the two now fixed leaves 6 either way.) |
-| Everything else | Open — #2941 (Tier 1), #2942 (Tier 2), #2943 (Tier 3), #2944 (forks), #2945 (vocabularies) |
+| The five shadowing forks | Fixed — #2985 (closes #2944) |
+| `navigation` action type | Resolved as a declared alias, not promoted — see Correction 4 |
+| Everything else | Open — #2941 (Tier 1), #2942 (Tier 2), #2943 (Tier 3), #2945 (vocabularies) |
 
 One method note for anyone repeating this: the original run read a checkout that
 was behind `origin/main`, which produced a spurious "objectui resolves two spec

packages/app-shell/src/views/metadata-admin/previews/ActionPreview.tsx

@@ -151,7 +151,10 @@ export function ActionPreview({ name, draft }: MetadataPreviewProps) {
   const label = localize(d.label) || actionName;
   const icon = (d.icon as string | undefined) || undefined;
   const type = String(d.type ?? 'script');
-  const target = (d.target as string | undefined) ?? (d.execute as string | undefined);
+  // `target` only: the `execute` alias was removed in @objectstack/spec 17
+  // (#3855, #3856). Reading it here would preview a draft as bound when the
+  // spec rejects it at save, which is the opposite of what a preview is for.
+  const target = d.target as string | undefined;
   const variant = (d.variant as string | undefined) || undefined;
   const component = String(d.component ?? '');
   const locations = Array.isArray(d.locations) ? (d.locations as string[]) : [];

packages/components/src/custom/filter-builder.tsx

@@ -71,7 +71,23 @@ const defaultOperators = [
   { value: "between", label: "Between" },
   { value: "in", label: "In" },
   { value: "notIn", label: "Not in" },
-]
+] as const
+
+/**
+ * The FilterBuilder's own operator vocabulary — every id its dropdown can
+ * hold, derived from the operators it actually renders.
+ *
+ * Exported because several translation tables map an external vocabulary
+ * (the spec's `VIEW_FILTER_OPERATORS`, Mongo `$`-tokens) *onto* this one, and
+ * a value that is not in this list produces a condition row whose operator
+ * select has nothing to select. Those tables assert against this export
+ * rather than restating it, so adding an operator here is the only edit
+ * needed to widen them.
+ */
+export const FILTER_BUILDER_OPERATORS = defaultOperators.map(o => o.value)
+
+/** An operator id the FilterBuilder can render. */
+export type FilterBuilderOperator = (typeof defaultOperators)[number]['value']
 
 const useSafeFilterTranslation = createSafeTranslation(
   {

packages/components/src/renderers/action/action-button.tsx

@@ -99,7 +99,6 @@ const ActionButtonRenderer = forwardRef<HTMLButtonElement, ActionButtonProps>(
           // Static "open in new tab" switch for url actions — forward so the
           // runner's executeUrl honors it (dropped, the toggle is silently lost).
           openIn: (schema as any).openIn,
-          execute: schema.execute,
           endpoint: schema.endpoint,
           method: schema.method,
           ...paramsPayload,

packages/components/src/renderers/action/action-group.tsx

@@ -200,7 +200,6 @@ const ActionGroupRenderer = forwardRef<HTMLDivElement, { schema: ActionGroupSche
           name: action.name,
           target: action.target,
           openIn: (action as any).openIn,
-          execute: action.execute,
           endpoint: action.endpoint,
           method: action.method,
           params: action.params as Record<string, any> | undefined,