Merge remote-tracking branch 'origin/main' into claude/issue-27565-query-syntax-projection

Author: claude

.changeset/27188-record-currency-display.md

@@ -0,0 +1,31 @@
+---
+'@object-ui/core': patch
+'@object-ui/i18n': patch
+'@object-ui/fields': patch
+'@object-ui/components': patch
+'@object-ui/plugin-form': patch
+'@object-ui/plugin-grid': patch
+'@object-ui/plugin-list': patch
+'@object-ui/plugin-dashboard': patch
+'@object-ui/plugin-report': patch
+'@object-ui/plugin-detail': patch
+'@object-ui/plugin-gantt': patch
+'@object-ui/app-shell': patch
+---
+
+feat(ui): a `record`-mode currency amount shows each record's own currency; the code field is an ISO 4217 select pre-filled with the organization currency; Studio edits the mode and the pointer (ADR-0144 D2, D6, D8 rule 4)
+
+Clause-②: no
+Metadata-protocol: none
+
+An amount declaring `currencyConfig: { currencyMode: 'record', currencyField: 'currency_code' }` now renders in the currency its record's `currency_code` holds, on every face that holds the record:
+
+- **Cells and widgets.** `resolveFieldCurrency(field, tenantDefault, record)` takes the record in scope as an optional third argument. Under `record` mode it reads only that record's code field; no record, or a blank code, resolves to no currency, so the amount shows as a plain number and never in the tenant default. `dynamic` and `fixed` fields resolve exactly as before. The list cell, the form and inline amount box (symbol, decimals and spinner step follow the selected code), formula cells returning `currency`, the record page's summary chips, the dashboard table and record drawer, and Gantt tooltips all pass the record. `recordCurrencyField(field)` names the pointer.
+- **The code field.** A `text` field declaring `valueDomain: 'iso_4217_currency'` renders a searchable select instead of a free-text box, grouped "Available" (the organization currency, then rated currencies, then the codes the object's records already hold) and "All currencies (ISO 4217)". It offers only codes the value domain accepts. The form reads the used codes once per object, with one grouped query, and hands them to the field on its own metadata (`usedCurrencyCodes`); a data source without grouped queries offers home + the record's own code. The rated group is empty until the exchange-rate table ships. The picker itself is `CurrencyCodePicker` in `@object-ui/components`.
+- **Filters.** In the list's filter builder, a condition on a `record`-mode amount gains a required currency picker, defaulting to the organization currency, and the filter reads `amount op X AND code = C`: the code condition is a second row of the same group, so stored filters keep their shape. A group holding such a pair stays on AND (under OR the pair would split), and a stored OR group says so. Presence checks (`is null`, `is empty`, …) need no currency.
+- **Create forms.** A code field that a `record`-mode amount points at opens pre-filled with `localization.currency`, as a value the user submits; a declared `defaultValue` and the caller's record win, and nothing is seeded while the setting is unset.
+- **Totals.** The grid footer draws no sum, average, minimum or maximum for a `record`-mode amount (its rows are in different currencies); counts stand. A group header keeps those aggregates only when the grid is grouped by the amount's code field. Consolidated totals belong to the home field, a `dynamic` amount that totals as before.
+- **Dataset answers.** A grouped analytics answer over a `record`-mode amount marks its measure column with `currencyField`, the result column holding each row's code. The dashboard `table` widget, the report table (and its export) and the Studio dataset preview format each row in that row's currency; a row without a code, and the totals row, show a plain number. `measureCellCurrency(field, row)` in `@object-ui/core` is the one read. Columns without `currencyField` format exactly as before.
+- **Studio.** A currency field (or a formula returning `currency`) gains a currency section: the mode (dynamic, fixed, record), the fixed code, and under `record` a `currencyField` picker listing the object's ISO 4217 code fields, with "Create currency field", which adds `currency_code` (`text`, `valueDomain: 'iso_4217_currency'`, required) and points the amount at it.
+
+⛔ Not released alone: this ships in the same release as `currencyMode: 'record'` itself and its aggregate refusals.

.changeset/27188-share-link-record-currency.md

@@ -0,0 +1,15 @@
+---
+'@objectstack/types': patch
+'@object-ui/console': patch
+---
+
+fix(types, console): a shared `record`-mode currency amount shows its record's own currency (ADR-0144 D2, D9)
+
+Clause-②: no
+Metadata-protocol: none
+
+The share-link resolve answer's field projection (`buildShareLinkResolveAnswer`, `@objectstack/types`) carried a currency field's `currencyMode` and `defaultCurrency` only, so a shared `record`-mode amount, whose currency lives in a sibling code field, rendered as a plain number. A currency field's projected `currencyConfig` now also carries `currencyField`, the amount's code-field pointer, when the answer's `record` carries that code field. A link that redacts the code field gets neither the code nor the pointer, so the answer still describes nothing the record hides, and the amount shows as a plain number.
+
+The shared-record page hands the shared record to the currency face, which reads the code from it, so the amount shows in the currency its own record names. Every other field and every other key of the answer is unchanged.
+
+⛔ Not released alone: this ships in the same release as `currencyMode: 'record'` itself.

.changeset/27221-tenant-rewritten-rule-message-wins.md

@@ -0,0 +1,16 @@
+---
+'@objectstack/spec': minor
+'@objectstack/objectql': minor
+---
+
+fix(i18n): a tenant's rewrite of a packaged validation rule message is served as written in every locale, on the refusal and on `/meta` (#27221)
+
+Clause-②: yes (widening)
+Metadata-protocol: semantic
+
+A package's bundle translates the rule messages that package shipped (`objects.<object>._validations.<rule>.message`). When a tenant overlaid a packaged object and reworded one of its validation rule messages, keeping the rule's name, a reader in any locale the bundle carries got the package's translation instead of the tenant's sentence. The rejected write's error and the rule served by `/meta` (and the public form) both showed it.
+
+- **Now.** Both readers apply the bundle entry only while the served message still equals the packaged rule's message of the same name. A message that differs is the tenant's own and is served and returned as written, in every locale. Rules the tenant left alone are still translated. A `conditional` branch is matched by its own name. A rule the owning package does not declare (one an `objectExtensions` entry adds, or one the tenant added) has no packaged message to differ from and is still translated under its own name, as before. With no packaged owner (an object authored entirely at runtime), nothing changes.
+- **One rule, both readers.** `/meta` (`translateObject`) and the rule evaluator use the same comparison, the one already applied to an object's `label`, `description`, embedded list views and fields. `/meta` and the refusal of the same write still show one sentence for one rule and locale.
+- **`scalarOverridesPackagedBase`** (`@objectstack/spec/system`) now also accepts the key `'message'`, so the rule evaluator judges a rule message through it. Its behaviour for the existing keys is unchanged.
+- **`evaluateValidationRules`'s `messages` option** (`EvaluateRulesOptions.messages`, `@objectstack/objectql`) gains an optional `packagedRule` lookup, which the engine fills from the object's packaged owner. A caller that passes its own `messages` without it keeps the previous behaviour.

content/docs/ui/translations.mdx

@@ -223,6 +223,19 @@ Objects follow the same rule for their `label`, `pluralLabel` and
 label an [object extension](/docs/data-modeling/object-extensions) contributes,
 for one) is served as written.
 
+An object's validation rule messages follow it too, on both places a reader
+sees them: the error a rejected write returns, and the rule served with the
+object (`/meta`, and the forms built from it). The rule's `message` is compared
+with the message of the rule of the same `name` in the owning package's
+declaration, a `conditional` rule's `then` / `otherwise` branch by its own name.
+An organization that overlays a packaged object and rewords a rule's message,
+keeping its name, gets that sentence as written in every locale; the rules it
+left alone are still translated, and both places always show the same sentence.
+Unlike a widget or a bulk action, a rule the owning package does not declare
+(one an object extension adds, or one the organization added) is **still
+translated** under its own name, `objects.<name>._validations.<rule>.message`:
+there is no shipped message for it to differ from.
+
 ## Organizing the files
 
 How you lay out translation source files is an authoring convention — your

packages/objectql/src/engine-validation-messages.ts

@@ -33,13 +33,15 @@
  * closure, which runs after `validationMessageContext` has returned and sees
  * whatever service `setI18nService` has installed by then, as it did.
  * `setI18nService` itself stays in the class: it is the field's setter.
+ * `registry` (ADR-0029 D9.2a, the packaged rule lookup) goes as a getter too.
  *
  * This module imports the engine only as a TYPE, so there is no module cycle
  * at run time, and nothing re-exports it, so the published surface does not
  * move.
  */
 
 import type { ObjectQL } from './engine.js';
+import type { ValidationMessageContext } from './validation/record-validator.js';
 import { objectLabelKey, resolveBundleLocale } from '@objectstack/spec/system';
 
 /**
@@ -52,22 +54,88 @@ import { objectLabelKey, resolveBundleLocale } from '@objectstack/spec/system';
  */
 export interface ValidationMessageHost {
   readonly i18nService: ObjectQL['i18nService'];
+  readonly registry: ObjectQL['registry'];
   negotiatedMessageLocale: ObjectQL['negotiatedMessageLocale'];
 }
 
-/** The body of `ObjectQL#validationMessageContext`; the method's docblock there is its contract. */
+/**
+ * The body of `ObjectQL#validationMessageContext`; the method's docblock there is its contract.
+ *
+ * [ADR-0029 D9.2a] It also carries `packagedRule` (`ValidationMessageContext`),
+ * the lookup the rule evaluator judges a tenant's rewrite of a rule message by,
+ * when the object has a packaged owner — see {@link packagedRuleLookup}.
+ */
 export function validationMessageContext(
-  this: Pick<ValidationMessageHost, 'i18nService' | 'negotiatedMessageLocale'>,
+  this: Pick<ValidationMessageHost, 'i18nService' | 'registry' | 'negotiatedMessageLocale'>,
   objectName: string,
   // Only `locale` is read — narrower than `ExecutionContext` so both the
   // resolved and the input-shaped envelope satisfy it.
   context?: { locale?: string },
-): { locale?: string; translate?: (key: string, locale: string, params?: Record<string, unknown>) => string; objectName: string } {
+): ValidationMessageContext & { objectName: string } {
   const t = this.i18nService?.t;
+  const packagedRule = packagedRuleLookup(this.registry, objectName);
   return {
     objectName,
     locale: this.negotiatedMessageLocale(context?.locale),
     translate: t ? (key, locale, params) => t.call(this.i18nService, key, locale, params) : undefined,
+    ...(packagedRule !== undefined ? { packagedRule } : {}),
+  };
+}
+
+/**
+ * How deep {@link packagedRuleLookup} follows `conditional` branches — the
+ * bound `/meta`'s `translateObjectValidations` walks to, so both readers judge
+ * the same branches.
+ */
+const MAX_VALIDATION_DEPTH = 10;
+
+/**
+ * [ADR-0029 D9.2a] The packaged (code-shipped) rule of a name on `objectName`,
+ * for the rule evaluator's divergence test.
+ *
+ * The declaration is the packaged OWNER's (`getPackagedObjectOwner`, pre-fold),
+ * the same body `/meta` hands `translateObject` as `packagedBase` through
+ * `getPackagedObjectBase`, so both readers compare a served message against one
+ * packaged rule. Rules are keyed by `name`, each `conditional` branch under its
+ * own name; the first rule of a name wins, as on `/meta`.
+ *
+ * `undefined` — nothing inferred, the catalog applies — when no packaged owner
+ * is registered for the object, or the registry cannot answer (a partial
+ * double). The index is built on the first lookup, which a write that refuses
+ * nothing never makes.
+ */
+function packagedRuleLookup(
+  registry: ValidationMessageHost['registry'] | undefined,
+  objectName: string,
+): ((ruleName: string) => unknown) | undefined {
+  if (typeof registry?.getPackagedObjectOwner !== 'function') return undefined;
+  let definition: unknown;
+  try {
+    definition = registry.getPackagedObjectOwner(objectName)?.definition;
+  } catch {
+    // A read over in-memory contributors must not turn a 400 into a 500.
+    return undefined;
+  }
+  if (!definition || typeof definition !== 'object') return undefined;
+  const validations = (definition as { validations?: unknown }).validations;
+  let byName: Map<string, unknown> | undefined;
+  return (ruleName) => {
+    if (byName === undefined) {
+      const index = new Map<string, unknown>();
+      const visit = (raw: unknown, depth: number): void => {
+        if (!raw || typeof raw !== 'object' || depth >= MAX_VALIDATION_DEPTH) return;
+        const rule = raw as { type?: unknown; name?: unknown; then?: unknown; otherwise?: unknown };
+        if (rule.type === 'conditional') {
+          visit(rule.then, depth + 1);
+          visit(rule.otherwise, depth + 1);
+          return;
+        }
+        if (typeof rule.name === 'string' && rule.name.length > 0 && !index.has(rule.name)) index.set(rule.name, rule);
+      };
+      if (Array.isArray(validations)) for (const raw of validations) visit(raw, 0);
+      byName = index;
+    }
+    return byName.get(ruleName);
   };
 }