Merge remote-tracking branch 'origin/main' into claude/issue-28829-pair-added-locale

Author: claude

.changeset/28812-platform-admin-gate-examples.md

@@ -0,0 +1,10 @@
+---
+'@object-ui/core': patch
+---
+
+docs(core): the README's `evaluateExpression` example gates on `user.isPlatformAdmin`, not `user.role === "admin"` (objectstack#28812)
+
+Clause-②: no
+Metadata-protocol: none
+
+The example taught `${user.role === "admin"}` as the admin check. `user.role` is better-auth's legacy `sys_user.role` scalar: ObjectStack never writes it, and with the admin plugin on it reads `user` for every user, a platform admin included, so a predicate copied from the example never opens for the people it means. The example now evaluates `${user.isPlatformAdmin === true}`, the documented platform-admin signal (`current_user.isPlatformAdmin == true`, ADR-0068 D4). No code, export or behaviour changes.

ui/docs/design/console-architecture.md

@@ -129,7 +129,7 @@ Navigation items can be conditionally hidden using expressions:
 {
   "type": "object",
   "objectName": "admin_settings",
-  "visible": "${user.role === 'admin'}"
+  "visible": "${current_user.isPlatformAdmin === true}"
 }
 ```
 

ui/packages/app-shell/src/providers/ExpressionProvider.tsx

@@ -547,7 +547,9 @@ function reportAppShellVisibleFault(
  * Supports:
  * - boolean: true/false
  * - string "true"/"false"
- * - template expression: "${user.role === 'admin'}"
+ * - template expression: "${current_user.isPlatformAdmin === true}" (the
+ *   platform-admin gate; never `user.role`, better-auth's legacy scalar that
+ *   reads `'user'` for a platform admin too)
  * - `{ dialect: 'cel', source }` envelopes — the shape the spec's
  *   `ExpressionInputSchema` normalizes every authored `visible` string into,
  *   which is what nav/area items carry after the server serves the app schema

ui/packages/core/README.md

@@ -68,8 +68,8 @@ argument, and `getMeta()` — not `get()` — reads that metadata back.
 ```typescript
 import { evaluateExpression } from '@object-ui/core'
 
-const isAdmin = evaluateExpression('${user.role === "admin"}', {
-  user: { name: 'John', role: 'admin' },
+const isPlatformAdmin = evaluateExpression('${user.isPlatformAdmin === true}', {
+  user: { name: 'John', isPlatformAdmin: true },
 }) // true
 ```
 

ui/packages/core/src/actions/ActionRunner.ts

@@ -932,7 +932,7 @@ export interface ActionParamDef {
  * (#2358 trap 1). `@objectstack/spec` documents the canonical CEL identity
  * scope as `os.user.*` (server formula / validation / sharing), while client
  * contexts historically only bound `user`. Deriving the alias here means an
- * action `visible` predicate authored as `os.user.role == "admin"` evaluates
+ * action `visible` predicate authored as `os.user.isPlatformAdmin == true` evaluates
  * identically on client and server instead of throwing (and being fail-closed
  * hidden). `os.user` always tracks `context.user`; other consumer-provided
  * keys under `os` are preserved.