@object-ui/core 16.0.0 → 17.1.0

package/dist/utils/chart-series.js

@@ -147,6 +147,61 @@ export function buildOptionColorMap(options) {
     }
     return Object.keys(map).length > 0 ? map : null;
 }
+/**
+ * Build the DECLARED category order from a select field's `options` — the
+ * sequence the author wrote them in on the object (framework#3588).
+ *
+ * A picklist's option order is already the domain order: a sales `stage` field
+ * lists Qualification → Needs Analysis → Proposal → Negotiation because that IS
+ * the pipeline. Analytics groups by that field and returns buckets in whatever
+ * order the GROUP BY produced (usually alphabetical), which for an
+ * ordered-sequence chart — a funnel above all — draws a shape that reads as a
+ * pipeline but isn't one.
+ *
+ * Emits BOTH the stored `value` and its display `label` per option, adjacent
+ * and in declared order, for the same reason {@link buildOptionColorMap} keys
+ * by both: a chart row's category may carry either, depending on whether the
+ * server resolved the dimension's labels. Rank is "index of first match", so
+ * either key ranks the option identically.
+ *
+ * Returns `null` for a field with no options, so callers keep their existing
+ * ordering (a funnel falls back to descending by value).
+ */
+export function buildCategoryOrder(options) {
+    if (!Array.isArray(options) || options.length === 0)
+        return null;
+    const keys = [];
+    for (const opt of options) {
+        if (typeof opt === 'string' || typeof opt === 'number' || typeof opt === 'boolean') {
+            keys.push(String(opt));
+            continue;
+        }
+        if (opt && typeof opt === 'object') {
+            const o = opt;
+            if (o.value != null)
+                keys.push(String(o.value));
+            if (o.label != null && String(o.label) !== String(o.value))
+                keys.push(String(o.label));
+        }
+    }
+    return keys.length > 0 ? keys : null;
+}
+/**
+ * Rank map for {@link buildCategoryOrder} keys — `category → position`, first
+ * occurrence wins. Categories absent from the declared order get no entry; the
+ * caller decides where those sort (see `AdvancedChartImpl`, which keeps them
+ * after the declared ones rather than dropping them).
+ */
+export function buildCategoryRank(order) {
+    if (!Array.isArray(order) || order.length === 0)
+        return null;
+    const rank = new Map();
+    order.forEach((key, i) => {
+        if (!rank.has(key))
+            rank.set(key, i);
+    });
+    return rank.size > 0 ? rank : null;
+}
 /**
  * Build a `{ value → label }` map from a select/enum field's `options`, for
  * resolving a grouped dimension's stored value to its display label (fed to

package/dist/utils/column-identity.d.ts

@@ -0,0 +1,110 @@
+/**
+ * ObjectUI — column identity canonicalization
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * The spec's canonical key for "which object field this column shows".
+ * `ListColumnSchema` (`@objectstack/spec/view`) declares `field: z.ZodString`
+ * as its ONLY required key — there is no `name`, no `fieldName`, no
+ * `accessorKey` on it. So `field` is not one dialect among several: it is the
+ * contract, and everything else is objectui-side legacy (AGENTS.md #0).
+ *
+ * Note this is the exact opposite of the FORM layer, where the runtime key is
+ * `name` (objectui#3090). The two surfaces sit next to each other and mean the
+ * opposite thing by the same pair of key names, which is why copy-paste between
+ * them keeps producing the defect this module exists to close.
+ */
+export declare const CANONICAL_COLUMN_IDENTITY_KEY = "field";
+/**
+ * Legacy identity spellings, in the order a canonicalizing read falls back
+ * through them. `field` wins over both, always.
+ *
+ * `fieldName` is here for defence, not because objectui emits it: as of
+ * objectui#3104 a repo-wide scan finds NO writer of a column-level `fieldName`
+ * — every `fieldName:` occurrence in the tree is a function parameter or an
+ * unrelated interface member (`AIFieldSuggestion.fieldName`). It survives
+ * purely in READERS that were written defensively, and stored host metadata
+ * could still carry it, so the fold accepts it and the ratchet counts it.
+ */
+export declare const LEGACY_COLUMN_IDENTITY_KEYS: readonly ["name", "fieldName"];
+/**
+ * NOT an identity key — deliberately excluded from everything in this module.
+ *
+ * `accessorKey` is TanStack Table's own column key (`TableColumn.accessorKey`,
+ * `packages/types/src/data-display.ts`, "Data accessor key"). It names a slot in
+ * the table LIBRARY's column model, not a field in ObjectStack metadata. Reads
+ * like `RelatedList`'s `accessorKey || field || name` therefore merge two
+ * different vocabularies in one expression; canonicalizing across that boundary
+ * would fossilize the merge, which is precisely the mistake this battle exists
+ * to undo. The fold neither reads nor writes it.
+ */
+export declare const TABLE_ADAPTER_COLUMN_KEY = "accessorKey";
+/**
+ * Read a column entry's field identity — the ONE reader every consumer should
+ * converge onto (objectui#3104 PR2).
+ *
+ * Accepts the three shapes a `columns` array actually holds: a bare string
+ * (`'stage'`), a spec column (`{ field: 'stage' }`), and the legacy objectui
+ * shapes (`{ name }` / `{ fieldName }`). Resolution is canonical-first, so it
+ * agrees with `buildExpandFields` and with the `$select` projection rather than
+ * with whichever half of a mixed-key column happened to be read.
+ *
+ * Returns `undefined` — not `''` — when nothing is resolvable, so callers can
+ * tell "no identity" from "identity is the empty string" and drop the entry
+ * instead of requesting a nameless column.
+ */
+export declare function columnIdentity(entry: unknown): string | undefined;
+/**
+ * True when a column entry carries more than one identity key AND they
+ * disagree — the shape that makes the renderer and the data request resolve
+ * two different fields. Exported for the "say who wins, loudly" step
+ * (objectui#3104 PR3) and used by the tests to name the defect precisely.
+ */
+export declare function hasConflictingColumnIdentity(entry: unknown): boolean;
+/** Reset the warn-once memo. Exported for tests. */
+export declare function resetColumnIdentityWarnings(): void;
+/**
+ * Stamp the canonical identity onto one column entry.
+ *
+ * The transitional strategy (objectui#3104 PR1) is **mirror, don't delete**:
+ *
+ *  - `field` is written with the resolved identity, so the request path — which
+ *    reads `field` and ONLY `field` in `ListView`'s `$expand`/`$select`
+ *    builders and in `ObjectGrid.getSelectFields` — always finds one.
+ *  - a legacy key that is ALREADY PRESENT is overwritten with that same
+ *    identity, so the name-first read sites still standing (`ListView` ×8,
+ *    `ObjectGrid`, `ObjectTree`, the detail renderers) resolve to exactly what
+ *    the request asked for.
+ *  - a legacy key that is ABSENT is never invented. A spec-clean
+ *    `{ field: 'stage' }` comes back untouched, by reference; the fold does not
+ *    manufacture the legacy vocabulary it is trying to retire.
+ *
+ * This differs on purpose from `normalizeListViewSchema`'s other folds, which
+ * DELETE the legacy key so a missed read-site fails loudly. Deleting works
+ * inside this repo — every name-first read here falls through to `field` — but
+ * `columns` entries cross the package boundary into host applications and
+ * third-party renderers, and dropping `name` from under them is a breaking
+ * change we have no inventory for. Mirroring is behaviour-preserving for every
+ * reader, in or out of the repo; the deletion is PR3's call to make once the
+ * in-repo consumers have converged onto {@link columnIdentity}.
+ *
+ * The result: for any single-key column the resolved identity is unchanged at
+ * every read site. The only entries whose behaviour moves are the ones where
+ * two sites already disagreed — which is the defect, not a regression.
+ */
+export declare function normalizeColumnIdentity<T>(entry: T): T;
+/**
+ * Stamp the canonical identity across a `columns` array.
+ *
+ * Non-mutating and allocation-frugal in the same way as
+ * `normalizeListViewSchema`: when every entry is already canonical the INPUT
+ * array is returned by reference, so `ListView`'s downstream `useMemo`s keep a
+ * stable dependency identity on the common path and nothing re-renders.
+ *
+ * String entries pass through untouched — a bare `'stage'` is unambiguous and
+ * every consumer already special-cases it.
+ */
+export declare function normalizeColumnIdentities<T>(columns: T): T;

package/dist/utils/column-identity.js

@@ -0,0 +1,210 @@
+/**
+ * ObjectUI — column identity canonicalization
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * The spec's canonical key for "which object field this column shows".
+ * `ListColumnSchema` (`@objectstack/spec/view`) declares `field: z.ZodString`
+ * as its ONLY required key — there is no `name`, no `fieldName`, no
+ * `accessorKey` on it. So `field` is not one dialect among several: it is the
+ * contract, and everything else is objectui-side legacy (AGENTS.md #0).
+ *
+ * Note this is the exact opposite of the FORM layer, where the runtime key is
+ * `name` (objectui#3090). The two surfaces sit next to each other and mean the
+ * opposite thing by the same pair of key names, which is why copy-paste between
+ * them keeps producing the defect this module exists to close.
+ */
+export const CANONICAL_COLUMN_IDENTITY_KEY = 'field';
+/**
+ * Legacy identity spellings, in the order a canonicalizing read falls back
+ * through them. `field` wins over both, always.
+ *
+ * `fieldName` is here for defence, not because objectui emits it: as of
+ * objectui#3104 a repo-wide scan finds NO writer of a column-level `fieldName`
+ * — every `fieldName:` occurrence in the tree is a function parameter or an
+ * unrelated interface member (`AIFieldSuggestion.fieldName`). It survives
+ * purely in READERS that were written defensively, and stored host metadata
+ * could still carry it, so the fold accepts it and the ratchet counts it.
+ */
+export const LEGACY_COLUMN_IDENTITY_KEYS = ['name', 'fieldName'];
+/**
+ * NOT an identity key — deliberately excluded from everything in this module.
+ *
+ * `accessorKey` is TanStack Table's own column key (`TableColumn.accessorKey`,
+ * `packages/types/src/data-display.ts`, "Data accessor key"). It names a slot in
+ * the table LIBRARY's column model, not a field in ObjectStack metadata. Reads
+ * like `RelatedList`'s `accessorKey || field || name` therefore merge two
+ * different vocabularies in one expression; canonicalizing across that boundary
+ * would fossilize the merge, which is precisely the mistake this battle exists
+ * to undo. The fold neither reads nor writes it.
+ */
+export const TABLE_ADAPTER_COLUMN_KEY = 'accessorKey';
+const isRecord = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const asIdentity = (v) => typeof v === 'string' && v.length > 0 ? v : undefined;
+/**
+ * Read a column entry's field identity — the ONE reader every consumer should
+ * converge onto (objectui#3104 PR2).
+ *
+ * Accepts the three shapes a `columns` array actually holds: a bare string
+ * (`'stage'`), a spec column (`{ field: 'stage' }`), and the legacy objectui
+ * shapes (`{ name }` / `{ fieldName }`). Resolution is canonical-first, so it
+ * agrees with `buildExpandFields` and with the `$select` projection rather than
+ * with whichever half of a mixed-key column happened to be read.
+ *
+ * Returns `undefined` — not `''` — when nothing is resolvable, so callers can
+ * tell "no identity" from "identity is the empty string" and drop the entry
+ * instead of requesting a nameless column.
+ */
+export function columnIdentity(entry) {
+    if (typeof entry === 'string')
+        return asIdentity(entry);
+    if (!isRecord(entry))
+        return undefined;
+    const canonical = asIdentity(entry[CANONICAL_COLUMN_IDENTITY_KEY]);
+    if (canonical)
+        return canonical;
+    for (const key of LEGACY_COLUMN_IDENTITY_KEYS) {
+        const legacy = asIdentity(entry[key]);
+        if (legacy)
+            return legacy;
+    }
+    return undefined;
+}
+/**
+ * True when a column entry carries more than one identity key AND they
+ * disagree — the shape that makes the renderer and the data request resolve
+ * two different fields. Exported for the "say who wins, loudly" step
+ * (objectui#3104 PR3) and used by the tests to name the defect precisely.
+ */
+export function hasConflictingColumnIdentity(entry) {
+    if (!isRecord(entry))
+        return false;
+    const resolved = columnIdentity(entry);
+    if (!resolved)
+        return false;
+    for (const key of [CANONICAL_COLUMN_IDENTITY_KEY, ...LEGACY_COLUMN_IDENTITY_KEYS]) {
+        const present = asIdentity(entry[key]);
+        if (present && present !== resolved)
+            return true;
+    }
+    return false;
+}
+// Warn once per (identity, conflicting spelling), not once per fold: columns are
+// re-normalized on every ListView render, and a warning that floods the console
+// is a warning that gets muted. Keyed by the pair rather than by the identity
+// alone so a column carrying two different stale spellings reports both — the
+// author needs to fix every producer, not just the first one seen.
+const warnedConflicts = new Set();
+/** Reset the warn-once memo. Exported for tests. */
+export function resetColumnIdentityWarnings() {
+    warnedConflicts.clear();
+}
+const isDev = () => globalThis.process?.env?.NODE_ENV !==
+    'production';
+/**
+ * Dev-mode only: say which key won, out loud, when a column carries two identity
+ * spellings that disagree.
+ *
+ * This is the audible half of objectui#3104. The fold below makes the two halves
+ * of such a column agree, which is what stops the bug — but silently rewriting
+ * `name` to match `field` also hides that the metadata producer is emitting a
+ * contradiction. The renderer recovering is not the same as the metadata being
+ * right, so the recovery says so.
+ *
+ * Non-breaking by construction: changes no types, rejects nothing, and is a
+ * no-op under `NODE_ENV=production`.
+ */
+function warnOnConflictingIdentity(entry, identity, losing) {
+    if (!isDev() || losing.length === 0)
+        return;
+    for (const key of losing) {
+        const memo = `${identity}:${key}:${String(entry[key])}`;
+        if (warnedConflicts.has(memo))
+            continue;
+        warnedConflicts.add(memo);
+        // eslint-disable-next-line no-console
+        console.warn(`[ObjectUI] Column carries two identities: \`${CANONICAL_COLUMN_IDENTITY_KEY}: ` +
+            `'${identity}'\` and \`${key}: '${String(entry[key])}'\`. ` +
+            `\`${CANONICAL_COLUMN_IDENTITY_KEY}\` wins — it is the only key ` +
+            `\`ListColumnSchema\` declares — and \`${key}\` has been rewritten to match, ` +
+            `so the rendered column and the requested field agree. Fix the producer: ` +
+            `drop \`${key}\` and author \`${CANONICAL_COLUMN_IDENTITY_KEY}\` only. ` +
+            `(objectui#3104)`);
+    }
+}
+/**
+ * Stamp the canonical identity onto one column entry.
+ *
+ * The transitional strategy (objectui#3104 PR1) is **mirror, don't delete**:
+ *
+ *  - `field` is written with the resolved identity, so the request path — which
+ *    reads `field` and ONLY `field` in `ListView`'s `$expand`/`$select`
+ *    builders and in `ObjectGrid.getSelectFields` — always finds one.
+ *  - a legacy key that is ALREADY PRESENT is overwritten with that same
+ *    identity, so the name-first read sites still standing (`ListView` ×8,
+ *    `ObjectGrid`, `ObjectTree`, the detail renderers) resolve to exactly what
+ *    the request asked for.
+ *  - a legacy key that is ABSENT is never invented. A spec-clean
+ *    `{ field: 'stage' }` comes back untouched, by reference; the fold does not
+ *    manufacture the legacy vocabulary it is trying to retire.
+ *
+ * This differs on purpose from `normalizeListViewSchema`'s other folds, which
+ * DELETE the legacy key so a missed read-site fails loudly. Deleting works
+ * inside this repo — every name-first read here falls through to `field` — but
+ * `columns` entries cross the package boundary into host applications and
+ * third-party renderers, and dropping `name` from under them is a breaking
+ * change we have no inventory for. Mirroring is behaviour-preserving for every
+ * reader, in or out of the repo; the deletion is PR3's call to make once the
+ * in-repo consumers have converged onto {@link columnIdentity}.
+ *
+ * The result: for any single-key column the resolved identity is unchanged at
+ * every read site. The only entries whose behaviour moves are the ones where
+ * two sites already disagreed — which is the defect, not a regression.
+ */
+export function normalizeColumnIdentity(entry) {
+    if (typeof entry === 'string' || !isRecord(entry))
+        return entry;
+    const identity = columnIdentity(entry);
+    if (!identity)
+        return entry;
+    const needsCanonical = entry[CANONICAL_COLUMN_IDENTITY_KEY] !== identity;
+    const staleLegacy = LEGACY_COLUMN_IDENTITY_KEYS.filter((key) => entry[key] !== undefined && entry[key] !== identity);
+    if (!needsCanonical && staleLegacy.length === 0)
+        return entry;
+    // Say who won before rewriting, while the losing spelling is still readable.
+    // Only genuine contradictions are reported: a column that merely lacks the
+    // canonical key (`{ name: 'stage' }`) is legacy, not conflicting, and gets
+    // stamped without noise.
+    warnOnConflictingIdentity(entry, identity, staleLegacy);
+    const next = { ...entry };
+    next[CANONICAL_COLUMN_IDENTITY_KEY] = identity;
+    for (const key of staleLegacy)
+        next[key] = identity;
+    return next;
+}
+/**
+ * Stamp the canonical identity across a `columns` array.
+ *
+ * Non-mutating and allocation-frugal in the same way as
+ * `normalizeListViewSchema`: when every entry is already canonical the INPUT
+ * array is returned by reference, so `ListView`'s downstream `useMemo`s keep a
+ * stable dependency identity on the common path and nothing re-renders.
+ *
+ * String entries pass through untouched — a bare `'stage'` is unambiguous and
+ * every consumer already special-cases it.
+ */
+export function normalizeColumnIdentities(columns) {
+    if (!Array.isArray(columns))
+        return columns;
+    let changed = false;
+    const next = columns.map((entry) => {
+        const folded = normalizeColumnIdentity(entry);
+        if (folded !== entry)
+            changed = true;
+        return folded;
+    });
+    return (changed ? next : columns);
+}

package/dist/utils/dashboard-filters.d.ts

@@ -18,7 +18,7 @@
  * Everything in this module is pure and synchronous so the binding rules
  * are unit-testable in isolation from React and the data layer.
  */
-import type { DashboardSchema, DashboardWidgetSchema, PageVariable } from '@object-ui/types';
+import type { DashboardComponentSchema, DashboardWidgetSchema, PageVariable } from '@object-ui/types';
 /** Reserved filter name for the dashboard's built-in date range. */
 export declare const DATE_RANGE_FILTER_NAME = "dateRange";
 export interface DashboardFilterDef {
@@ -66,7 +66,7 @@ export declare const DATE_RANGE_PRESETS: string[];
  * under the reserved name `"dateRange"`; each `globalFilters` entry follows,
  * named by its `name` (defaulting to `field`). Later duplicates win.
  */
-export declare function resolveDashboardFilterDefs(schema: Pick<DashboardSchema, 'globalFilters' | 'dateRange'>): DashboardFilterDef[];
+export declare function resolveDashboardFilterDefs(schema: Pick<DashboardComponentSchema, 'globalFilters' | 'dateRange'>): DashboardFilterDef[];
 /**
  * Derive `PageVariable` definitions for a dashboard's filter values so the
  * dashboard can host them in a `PageVariablesProvider` (the page/dashboard

package/dist/utils/dataset-format.d.ts

@@ -69,6 +69,16 @@ export declare function buildDatasetFieldHelpers(fields: DatasetResultField[] |
     measureField: (name: string) => DatasetResultField | undefined;
     headerLabel: (name: string) => string;
 };
+/**
+ * A half-open date-range drill scope for one time-bucketed dimension (#1752):
+ * the object FIELD to filter and its inclusive `gte` / exclusive `lt` bounds
+ * (the server's `drillRanges` sidecar entry).
+ */
+export interface DatasetDrillRange {
+    field: string;
+    gte: unknown;
+    lt: unknown;
+}
 /**
  * Build the record-list filter for a drilled dataset bucket (ADR-0021 D2).
  *
@@ -79,7 +89,14 @@ export declare function buildDatasetFieldHelpers(fields: DatasetResultField[] |
  * "is empty" filter). The render-time `runtimeFilter` is ANDed in so the drilled
  * list stays within the same slice the aggregate was computed over.
  *
+ * A time-bucketed date dimension (#1752) drills by RANGE, not equality — a
+ * humanized bucket ("2026-Q2") can't be exact-matched, so the server sends a
+ * half-open `[gte, lt)` per date dim in `rawRanges` instead of a raw value.
+ * Each becomes an ObjectQL range operator object (`{ $gte, $lt }`) so the drill
+ * scopes the list to the clicked time bucket instead of every bucket (which the
+ * old date-dim skip degraded to — a superset).
+ *
  * Shared by the dashboard `DatasetWidget` and the report renderer so a drill
  * filters identically (and correctly, including lookups) on both surfaces.
  */
-export declare function buildDatasetDrillFilter(rawRow: Record<string, unknown> | undefined, drillDims: string[], dimensionFields: Record<string, string>, runtimeFilter?: Record<string, unknown>): Record<string, unknown>;
+export declare function buildDatasetDrillFilter(rawRow: Record<string, unknown> | undefined, drillDims: string[], dimensionFields: Record<string, string>, runtimeFilter?: Record<string, unknown>, rawRanges?: Record<string, DatasetDrillRange>): Record<string, unknown>;

package/dist/utils/dataset-format.js

@@ -104,14 +104,27 @@ export function buildDatasetFieldHelpers(fields, object, fieldLabel) {
  * "is empty" filter). The render-time `runtimeFilter` is ANDed in so the drilled
  * list stays within the same slice the aggregate was computed over.
  *
+ * A time-bucketed date dimension (#1752) drills by RANGE, not equality — a
+ * humanized bucket ("2026-Q2") can't be exact-matched, so the server sends a
+ * half-open `[gte, lt)` per date dim in `rawRanges` instead of a raw value.
+ * Each becomes an ObjectQL range operator object (`{ $gte, $lt }`) so the drill
+ * scopes the list to the clicked time bucket instead of every bucket (which the
+ * old date-dim skip degraded to — a superset).
+ *
  * Shared by the dashboard `DatasetWidget` and the report renderer so a drill
  * filters identically (and correctly, including lookups) on both surfaces.
  */
-export function buildDatasetDrillFilter(rawRow, drillDims, dimensionFields, runtimeFilter) {
+export function buildDatasetDrillFilter(rawRow, drillDims, dimensionFields, runtimeFilter, rawRanges) {
     const drillFilter = {};
     for (const d of drillDims) {
         const raw = rawRow?.[d];
         drillFilter[dimensionFields[d]] = raw === '' || raw === undefined ? null : raw;
     }
+    if (rawRanges) {
+        for (const r of Object.values(rawRanges)) {
+            if (r && r.field)
+                drillFilter[r.field] = { $gte: r.gte, $lt: r.lt };
+        }
+    }
     return runtimeFilter ? { ...runtimeFilter, ...drillFilter } : drillFilter;
 }

package/dist/utils/expand-fields.js

@@ -5,6 +5,7 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  */
+import { columnIdentity } from './column-identity.js';
 /**
  * Relational ("reference-bearing") field types whose stored value is a foreign
  * key into another object — and which therefore benefit from `$expand` so a
@@ -90,14 +91,13 @@ export function buildExpandFields(schemaFields, columns) {
     if (columns && Array.isArray(columns) && columns.length > 0) {
         const columnFieldNames = new Set();
         for (const col of columns) {
-            if (typeof col === 'string') {
-                columnFieldNames.add(col);
-            }
-            else if (col && typeof col === 'object') {
-                const name = col.field ?? col.name ?? col.fieldName;
-                if (name)
-                    columnFieldNames.add(name);
-            }
+            // `columnIdentity` handles all three entry shapes (bare string, spec
+            // `{field}`, legacy `{name}`/`{fieldName}`) and resolves canonical-first
+            // — the same precedence every renderer now uses, so what gets expanded
+            // and what gets rendered can no longer name two different fields (#3104).
+            const name = columnIdentity(col);
+            if (name)
+                columnFieldNames.add(name);
         }
         return referenceFieldNames.filter((f) => columnFieldNames.has(f));
     }

package/dist/utils/export-filename.js

@@ -8,7 +8,10 @@
  * translated object label (e.g. 合同) → object API name → 'export'.
  */
 /** Windows-reserved + control characters that cannot appear in a filename. */
-const ILLEGAL_FILENAME_CHARS = /[\\\/:*?"<>|\u0000-\u001f]+/g;
+// The control-char range in the class is matched deliberately (illegal in
+// filenames, must be stripped), so no-control-regex is intentionally disabled.
+// eslint-disable-next-line no-control-regex
+const ILLEGAL_FILENAME_CHARS = /[\\/:*?"<>|\u0000-\u001f]+/g;
 /** Longest base we emit — keeps the full name comfortably under OS limits. */
 const MAX_BASE_LENGTH = 80;
 /**

package/dist/utils/filter-converter.d.ts

@@ -29,6 +29,19 @@ export type FilterNode = [string, string, any] | [string, ...FilterNode[]];
  * @param operator - MongoDB-style operator (e.g., '$gte', '$in')
  * @returns ObjectStack operator or null if not recognized
  */
+/**
+ * A filter operator this layer will not translate.
+ *
+ * Carries the data API's own code and status for the same refusal so a failed
+ * list renders "the filter is malformed" rather than "check your connection" —
+ * `classifyLoadError` reads these, and a bare `Error` classifies as a network
+ * fault, which is the one thing this is definitely not.
+ */
+export declare class FilterOperatorError extends Error {
+    readonly code = "INVALID_FILTER";
+    readonly httpStatus = 400;
+    constructor(message: string);
+}
 export declare function convertOperatorToAST(operator: string): string | null;
 /**
  * Convert object-based filters to ObjectStack FilterNode AST format.
@@ -55,3 +68,37 @@ export declare function convertOperatorToAST(operator: string): string | null;
  * @throws {Error} If an unknown operator is encountered
  */
 export declare function convertFiltersToAST(filter: Record<string, any>): FilterNode | Record<string, any>;
+/**
+ * Normalize ONE filter source into a single filter node.
+ *
+ * A "source" is whatever a view hands a renderer, and there are three shapes in
+ * circulation, all legitimate:
+ *
+ *   - `[{ field, operator, value }, ...]`  a spec `ViewFilterRule[]`
+ *   - `[['stage', '=', 'won'], ...]`       an AST node / legacy flat array
+ *   - `{ status: 'active' }`               a MongoDB-style object
+ *
+ * The third is the one that kept getting lost. Renderers tested `source.length
+ * > 0` before using it, which is `undefined > 0` for an object — so a
+ * `table.defaultFilters` (declared `Record<string, any>`) was DROPPED and the
+ * view returned every record. Silently: no error, just a wider answer.
+ *
+ * Returns `undefined` for an absent or empty source, so callers can skip
+ * `$filter` rather than sending an empty array.
+ */
+export declare function toFilterNode(source: unknown): FilterNode | Record<string, any> | undefined;
+/**
+ * Combine filter sources under a single `and`, each as its OWN child.
+ *
+ * Wrapping rather than spreading, on purpose. `['and', ...rules]` looks
+ * equivalent and is not: spreading a `ViewFilterRule[]` puts bare rule OBJECTS
+ * where the AST expects nodes, and the server neither understands nor rejects
+ * that cleanly — `isFilterAST` says no (a 400 since objectstack#4121), while
+ * `parseFilterAST` reads the rule as a Mongo condition and filters on columns
+ * literally named `field` / `operator` / `value`. Spreading is only correct
+ * when the source happens to be an array of nodes, which is why it survived.
+ *
+ * Sources that normalize to nothing are skipped; one surviving source is
+ * returned as-is rather than wrapped in a pointless `and`.
+ */
+export declare function mergeFilterNodes(...sources: unknown[]): FilterNode | Record<string, any> | undefined;