fix(app-shell): move the clone dispatch shaping out of the scanned editor surface (objectui#5987)

CI Test (shard 1/8) failed `permission-slice.authoredKeys.test.ts` on the
first commit: `expected [ 'objectName', 'params' ] to deeply equal []`.

The scanner reads `{ ...spread, key }` literals inside `setDraft(` regions of
`PermissionMatrixEditor.tsx` as facets written into the permission-set draft.
Its `setDraft(` regex also matches the prose `funnels through setDraft (matrix
checkboxes, …` in a `//` comment, and the `)` that would close that region is
on the next comment line, which the walker skips wholesale — so that region
runs to end of file (on main too) and every leading-spread literal below it is
counted. The clone dispatch literal (`{ ...localized, objectName, params }`)
is the action runner's call shape, not a permission-set facet, and it landed
inside that region.

The construction now lives in `permission-set-clone-dispatch.ts`
(`findCloneAction`, `buildCloneDispatch`), which the scan does not read. No
behaviour change; the slice's carried-key list is untouched. The scanner's
comment-matching is reported separately, not changed here.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014mXUNuFomfj24w7s1pZzhN

Author: claude

packages/app-shell/src/views/metadata-admin/PermissionMatrixEditor.tsx

@@ -72,15 +72,18 @@ import {
   SheetTitle,
 } from '@object-ui/components';
 import { useAdapter, useAction, useMetadata, useActionTextLocalizer } from '@object-ui/react';
-import type { ActionDef } from '@object-ui/core';
 import { CapabilityMultiSelectField, parseCapabilityNames } from '@object-ui/fields';
 import { PageShell } from './PageShell.js';
 import { HistoryPanel } from './ResourceHistoryPage.js';
 import { useMetadataClient, useMetadataTypes, type RichMetadataTypeEntry } from './useMetadata.js';
 import { t as translate, tFormat, useMetadataLocale } from './i18n.js';
 import { PermissionAdvancedFacets } from './PermissionAdvancedFacets.js';
 import { errorCodeIs } from '@object-ui/types';
-import type { ConsoleActionDispatch } from '../../consoleActionDispatch.js';
+import {
+  PERMISSION_SET_OBJECT,
+  buildCloneDispatch,
+  findCloneAction,
+} from './permission-set-clone-dispatch.js';
 import {
   mergePermissionSlice,
   scopePermissionSet,
@@ -179,22 +182,6 @@ function isArtifactBackedLayer(
   );
 }
 
-/**
- * "Clone to customize" (objectui#5987) — the record object a permission set is
- * projected onto, and the record action the server PUBLISHES on it. The
- * server's own `403 not_overridable` refusal names that action as the remedy
- * (maintainer ruling on objectstack#11513: lock the base, clone to customize),
- * so the editor runs THAT action — resolved by name off the object definition
- * the console already holds, dispatched through the console's shared action
- * runner exactly as a `record_header` button would be — and never hand-rolls a
- * copy out of create/update calls: the action's `params` list IS the payload
- * (which facets a clone carries is decided where the action is declared), and
- * a second spelling of it here would be the silent-grant-loss shape
- * objectstack#11703 closed.
- */
-const PERMISSION_SET_OBJECT = 'sys_permission_set';
-const CLONE_PERMISSION_SET_ACTION = 'clone_permission_set';
-
 /** Localized short label for an OWD value; falls back to the raw value. */
 function owdLabel(t: (k: string) => string, value: string): string {
   const key: Record<string, string> = {
@@ -304,7 +291,8 @@ export function PermissionMatrixEditPage({ type, name, packageId, onDraftSaved,
   // (where the `sys_permission_set` object definition, and with it the
   // published `clone_permission_set` action, is read from), and the
   // `_actions.<name>` bundle localizer every declared-action surface uses for
-  // the dialog title. See {@link PERMISSION_SET_OBJECT}.
+  // the dialog title. Resolution and dispatch shape live in
+  // `permission-set-clone-dispatch.ts` — see its header for why.
   const { execute: executeAction } = useAction();
   const metadataStore = useMetadata();
   const localizeActionTexts = useActionTextLocalizer();
@@ -935,15 +923,14 @@ export function PermissionMatrixEditPage({ type, name, packageId, onDraftSaved,
    *
    * Every step is the same one a `record_header` "Clone" button on the
    * `sys_permission_set` record page takes — resolve the action off the object
-   * definition, stash the row under `params._rowRecord` (what the runner's
-   * param dialog seeds `defaultFromRow` params from and what the api handler
-   * reads for `{id}` / record-id injection), surface the declared `params`
-   * ARRAY as `actionParams`, and `execute` — so the clone's payload, dialog,
-   * refusal toasts and success toast are the published action's, not this
-   * editor's. What this editor adds is only where the clone OPENS: on the
-   * routed metadata admin it navigates to the clone, which loads with no code
-   * layer and is therefore writable; an embedded host has no route, so the
-   * clone is announced by name instead.
+   * definition (`findCloneAction`), shape the dispatch (`buildCloneDispatch`:
+   * the row under `params._rowRecord`, the declared `params` ARRAY as
+   * `actionParams`), and `execute` — so the clone's payload, dialog, refusal
+   * toasts and success toast are the published action's, not this editor's.
+   * What this editor adds is only where the clone OPENS: on the routed
+   * metadata admin it navigates to the clone, which loads with no code layer
+   * and is therefore writable; an embedded host has no route, so the clone is
+   * announced by name instead.
    *
    * Two refusals, no fallbacks (AGENTS.md #0.1): an object that publishes no
    * such action, or a set with no `sys_permission_set` row, ends here with a
@@ -956,14 +943,7 @@ export function PermissionMatrixEditPage({ type, name, packageId, onDraftSaved,
     setError(null);
     setCloneNotice(null);
     try {
-      const objectDefs = await metadataStore.ensureType('object');
-      const setObject = (Array.isArray(objectDefs) ? objectDefs : []).find(
-        (o: { name?: unknown }) => o?.name === PERMISSION_SET_OBJECT,
-      ) as { actions?: unknown } | undefined;
-      const declaredActions = Array.isArray(setObject?.actions) ? setObject.actions : [];
-      const cloneAction = declaredActions.find(
-        (a: { name?: unknown }) => a?.name === CLONE_PERMISSION_SET_ACTION,
-      ) as (ActionDef & { params?: unknown }) | undefined;
+      const cloneAction = findCloneAction(await metadataStore.ensureType('object'));
       if (!cloneAction) throw new Error(t('perm.clone.actionMissing'));
 
       // The row the action runs against — `AssignedUsersSection` resolves the
@@ -973,16 +953,7 @@ export function PermissionMatrixEditPage({ type, name, packageId, onDraftSaved,
       const row = (found?.data ?? [])[0] as Record<string, unknown> | undefined;
       if (!row) throw new Error(tFormat('perm.clone.rowMissing', locale, { name }));
 
-      const { params: declaredParams, ...rest } = cloneAction;
-      const dispatch: ConsoleActionDispatch = {
-        ...localizeActionTexts(PERMISSION_SET_OBJECT, rest as Record<string, unknown>),
-        objectName: PERMISSION_SET_OBJECT,
-        params: { _rowRecord: row },
-      };
-      if (Array.isArray(declaredParams) && declaredParams.length > 0) {
-        dispatch.actionParams = declaredParams as ConsoleActionDispatch['actionParams'];
-      }
-      const result = await executeAction(dispatch);
+      const result = await executeAction(buildCloneDispatch(cloneAction, row, localizeActionTexts));
       // A cancelled dialog and a refused POST both come back `success: false`;
       // the runner has already toasted a refusal, and a cancel needs nothing.
       if (!result.success) return;

packages/app-shell/src/views/metadata-admin/permission-set-clone-dispatch.ts

@@ -0,0 +1,92 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * "Clone to customize" (objectui#5987) — resolving the server-published
+ * `clone_permission_set` record action and shaping its dispatch.
+ *
+ * The permission matrix locks a set a code package ships (the artifact tier).
+ * The maintainer's ruling on objectstack#11513 — lock the base, clone to
+ * customize — makes cloning the sanctioned edit path, and the server's own
+ * `403 not_overridable` refusal names the `clone_permission_set` action as the
+ * remedy. The editor therefore runs THAT action, resolved by name off the
+ * `sys_permission_set` object definition the console already holds, and never
+ * hand-rolls a copy out of create/update calls: the action's `params` list IS
+ * the payload (which facets a clone carries is decided where the action is
+ * declared), and a second spelling of it here would be the silent-grant-loss
+ * shape objectstack#11703 closed.
+ *
+ * ## Why this lives beside the editor rather than in it
+ *
+ * The dispatch is the same shape `DeclaredActionsBar` and `ObjectGrid` hand
+ * the console action runner for a `record_header` / `list_item` action: the
+ * declaration spread first, `objectName`, and the row under
+ * `params._rowRecord`. That is an object literal that opens with a spread —
+ * the very shape `permission-slice.authoredKeys.test.ts` reads inside
+ * `PermissionMatrixEditor.tsx` as "a facet written into the permission-set
+ * draft". These keys are the action call's arguments, not facets of a
+ * permission set, so the construction sits in this module, which that scan
+ * does not read, instead of being reshaped to dodge it.
+ */
+
+import type { ActionDef } from '@object-ui/core';
+import type { ConsoleActionDispatch } from '../../consoleActionDispatch.js';
+
+/** The record object a permission set is projected onto. */
+export const PERMISSION_SET_OBJECT = 'sys_permission_set';
+/** The record action the server publishes on it, and the 403 names as the remedy. */
+export const CLONE_PERMISSION_SET_ACTION = 'clone_permission_set';
+
+/** The published action, as an object definition declares it. */
+export type CloneAction = ActionDef & { params?: unknown };
+
+/**
+ * Find `clone_permission_set` on the `sys_permission_set` object among the
+ * object definitions the console metadata store holds. `undefined` when the
+ * server publishes no such object or no such action — the caller refuses,
+ * it does not fall back.
+ */
+export function findCloneAction(objectDefs: unknown): CloneAction | undefined {
+  const defs = Array.isArray(objectDefs) ? objectDefs : [];
+  const setObject = defs.find(
+    (o: { name?: unknown }) => o?.name === PERMISSION_SET_OBJECT,
+  ) as { actions?: unknown } | undefined;
+  const declared = Array.isArray(setObject?.actions) ? setObject.actions : [];
+  return declared.find(
+    (a: { name?: unknown }) => a?.name === CLONE_PERMISSION_SET_ACTION,
+  ) as CloneAction | undefined;
+}
+
+/**
+ * `localizeActionTexts` from `@object-ui/react`, by its call shape: label,
+ * confirmText and successMessage resolved through the `_actions.NAME` bundle.
+ */
+export type ActionTextLocalize = (
+  objectName: string,
+  action: Record<string, unknown>,
+) => Record<string, unknown>;
+
+/**
+ * Shape the runner dispatch for cloning `row` through `cloneAction`.
+ *
+ * Same dispatch shape as `DeclaredActionsBar`: the (localized) declaration
+ * forwarded whole, `objectName` set, the declared `params` ARRAY surfaced as
+ * `actionParams` (the runner's param-dialog input, seeded `defaultFromRow`
+ * from the row), and `params` reserved for the `_rowRecord` stash the api
+ * handler reads for `{id}` interpolation and record-id injection.
+ */
+export function buildCloneDispatch(
+  cloneAction: CloneAction,
+  row: Record<string, unknown>,
+  localize: ActionTextLocalize,
+): ConsoleActionDispatch {
+  const { params: declaredParams, ...rest } = cloneAction;
+  const dispatch: ConsoleActionDispatch = {
+    ...localize(PERMISSION_SET_OBJECT, rest as Record<string, unknown>),
+    objectName: PERMISSION_SET_OBJECT,
+    params: { _rowRecord: row },
+  };
+  if (Array.isArray(declaredParams) && declaredParams.length > 0) {
+    dispatch.actionParams = declaredParams as ConsoleActionDispatch['actionParams'];
+  }
+  return dispatch;
+}