Server-Driven Action Flows for RemoteAction

[marioserrano09]

Summary

Tracking issue for the Server-Driven Action Flows system for RemoteAction — a protocol that lets a RemoteAction return "not done yet, show the user this, then call me back with their answer" (confirm/wizard-style interactions) instead of only ever returning a final result in one HTTP round trip.

Design doc: framework/docs/design/SERVER_DRIVEN_ACTION_FLOWS.md.

Primary motivation: theme-dynamical-vue has no ZK fallback for anything, so any interactive backend action (confirm-before-delete, multi-step approval, etc.) has to go through this protocol.

Status

Phases 0–4 are implemented (0ddfbe66 "Phases 0-3", d03b14c5 "Phase 4"):

• platform/core/actions: ActionFlowStep/ActionFlowStepType/ActionFlowContext/FlowRemoteAction/ActionFlows, HMAC-signed stateless resumeToken (FlowTokenSigner/FlowTokenPayload).
• platform/packages/ui-core + vue: ConfirmManager/ToastManager, Dialog.vue/ConfirmHost.vue/ToastHost.vue, useConfirm/useToast, runActionFlow loop.
• platform/packages/sdk: TS mirrors of the wire types.
• platform/core/crud/.../actions/remote: SaveRemoteAction/SaveFlowRemoteAction/DeleteRemoteAction/DeleteFlowRemoteAction, wired into useCrudPage's save/delete handlers.
• One end-to-end example: MarkOutOfStockAction in examples/demo-zk-books.

The design doc was reconciled against this implementation and now reflects reality plus what's still genuinely open (see sub-issues below, all filed against this one).

Known gaps (tracked as sub-issues)

1. resumeToken signer uses an independent secret instead of the JWT cookie key the original design assumed, with a silent per-JVM fallback in dev.
2. INPUT/DIALOG/REDIRECT/CALL/CUSTOM flow steps have no renderer on the Vue side — they throw at runtime today; only CONFIRM/NOTIFY work.
3. Validation-error response shape differs between plain REST CRUD (422/ErrorResult) and the Action-framework path (406/ActionExecutionResponse) — now a live inconsistency since SaveRemoteAction coexists with plain REST for the same entity.
4. CrudState enforcement is only scoped to SaveSupport/SaveRemoteAction, not generic for any CrudRemoteAction at the controller level.

References

• Design doc: framework/docs/design/SERVER_DRIVEN_ACTION_FLOWS.md
• Implementation commits: 0ddfbe66, d03b14c5