@object-ui/core 16.1.0 → 17.1.0

package/dist/utils/column-identity.js

@@ -0,0 +1,210 @@
+/**
+ * ObjectUI — column identity canonicalization
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * The spec's canonical key for "which object field this column shows".
+ * `ListColumnSchema` (`@objectstack/spec/view`) declares `field: z.ZodString`
+ * as its ONLY required key — there is no `name`, no `fieldName`, no
+ * `accessorKey` on it. So `field` is not one dialect among several: it is the
+ * contract, and everything else is objectui-side legacy (AGENTS.md #0).
+ *
+ * Note this is the exact opposite of the FORM layer, where the runtime key is
+ * `name` (objectui#3090). The two surfaces sit next to each other and mean the
+ * opposite thing by the same pair of key names, which is why copy-paste between
+ * them keeps producing the defect this module exists to close.
+ */
+export const CANONICAL_COLUMN_IDENTITY_KEY = 'field';
+/**
+ * Legacy identity spellings, in the order a canonicalizing read falls back
+ * through them. `field` wins over both, always.
+ *
+ * `fieldName` is here for defence, not because objectui emits it: as of
+ * objectui#3104 a repo-wide scan finds NO writer of a column-level `fieldName`
+ * — every `fieldName:` occurrence in the tree is a function parameter or an
+ * unrelated interface member (`AIFieldSuggestion.fieldName`). It survives
+ * purely in READERS that were written defensively, and stored host metadata
+ * could still carry it, so the fold accepts it and the ratchet counts it.
+ */
+export const LEGACY_COLUMN_IDENTITY_KEYS = ['name', 'fieldName'];
+/**
+ * NOT an identity key — deliberately excluded from everything in this module.
+ *
+ * `accessorKey` is TanStack Table's own column key (`TableColumn.accessorKey`,
+ * `packages/types/src/data-display.ts`, "Data accessor key"). It names a slot in
+ * the table LIBRARY's column model, not a field in ObjectStack metadata. Reads
+ * like `RelatedList`'s `accessorKey || field || name` therefore merge two
+ * different vocabularies in one expression; canonicalizing across that boundary
+ * would fossilize the merge, which is precisely the mistake this battle exists
+ * to undo. The fold neither reads nor writes it.
+ */
+export const TABLE_ADAPTER_COLUMN_KEY = 'accessorKey';
+const isRecord = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const asIdentity = (v) => typeof v === 'string' && v.length > 0 ? v : undefined;
+/**
+ * Read a column entry's field identity — the ONE reader every consumer should
+ * converge onto (objectui#3104 PR2).
+ *
+ * Accepts the three shapes a `columns` array actually holds: a bare string
+ * (`'stage'`), a spec column (`{ field: 'stage' }`), and the legacy objectui
+ * shapes (`{ name }` / `{ fieldName }`). Resolution is canonical-first, so it
+ * agrees with `buildExpandFields` and with the `$select` projection rather than
+ * with whichever half of a mixed-key column happened to be read.
+ *
+ * Returns `undefined` — not `''` — when nothing is resolvable, so callers can
+ * tell "no identity" from "identity is the empty string" and drop the entry
+ * instead of requesting a nameless column.
+ */
+export function columnIdentity(entry) {
+    if (typeof entry === 'string')
+        return asIdentity(entry);
+    if (!isRecord(entry))
+        return undefined;
+    const canonical = asIdentity(entry[CANONICAL_COLUMN_IDENTITY_KEY]);
+    if (canonical)
+        return canonical;
+    for (const key of LEGACY_COLUMN_IDENTITY_KEYS) {
+        const legacy = asIdentity(entry[key]);
+        if (legacy)
+            return legacy;
+    }
+    return undefined;
+}
+/**
+ * True when a column entry carries more than one identity key AND they
+ * disagree — the shape that makes the renderer and the data request resolve
+ * two different fields. Exported for the "say who wins, loudly" step
+ * (objectui#3104 PR3) and used by the tests to name the defect precisely.
+ */
+export function hasConflictingColumnIdentity(entry) {
+    if (!isRecord(entry))
+        return false;
+    const resolved = columnIdentity(entry);
+    if (!resolved)
+        return false;
+    for (const key of [CANONICAL_COLUMN_IDENTITY_KEY, ...LEGACY_COLUMN_IDENTITY_KEYS]) {
+        const present = asIdentity(entry[key]);
+        if (present && present !== resolved)
+            return true;
+    }
+    return false;
+}
+// Warn once per (identity, conflicting spelling), not once per fold: columns are
+// re-normalized on every ListView render, and a warning that floods the console
+// is a warning that gets muted. Keyed by the pair rather than by the identity
+// alone so a column carrying two different stale spellings reports both — the
+// author needs to fix every producer, not just the first one seen.
+const warnedConflicts = new Set();
+/** Reset the warn-once memo. Exported for tests. */
+export function resetColumnIdentityWarnings() {
+    warnedConflicts.clear();
+}
+const isDev = () => globalThis.process?.env?.NODE_ENV !==
+    'production';
+/**
+ * Dev-mode only: say which key won, out loud, when a column carries two identity
+ * spellings that disagree.
+ *
+ * This is the audible half of objectui#3104. The fold below makes the two halves
+ * of such a column agree, which is what stops the bug — but silently rewriting
+ * `name` to match `field` also hides that the metadata producer is emitting a
+ * contradiction. The renderer recovering is not the same as the metadata being
+ * right, so the recovery says so.
+ *
+ * Non-breaking by construction: changes no types, rejects nothing, and is a
+ * no-op under `NODE_ENV=production`.
+ */
+function warnOnConflictingIdentity(entry, identity, losing) {
+    if (!isDev() || losing.length === 0)
+        return;
+    for (const key of losing) {
+        const memo = `${identity}:${key}:${String(entry[key])}`;
+        if (warnedConflicts.has(memo))
+            continue;
+        warnedConflicts.add(memo);
+        // eslint-disable-next-line no-console
+        console.warn(`[ObjectUI] Column carries two identities: \`${CANONICAL_COLUMN_IDENTITY_KEY}: ` +
+            `'${identity}'\` and \`${key}: '${String(entry[key])}'\`. ` +
+            `\`${CANONICAL_COLUMN_IDENTITY_KEY}\` wins — it is the only key ` +
+            `\`ListColumnSchema\` declares — and \`${key}\` has been rewritten to match, ` +
+            `so the rendered column and the requested field agree. Fix the producer: ` +
+            `drop \`${key}\` and author \`${CANONICAL_COLUMN_IDENTITY_KEY}\` only. ` +
+            `(objectui#3104)`);
+    }
+}
+/**
+ * Stamp the canonical identity onto one column entry.
+ *
+ * The transitional strategy (objectui#3104 PR1) is **mirror, don't delete**:
+ *
+ *  - `field` is written with the resolved identity, so the request path — which
+ *    reads `field` and ONLY `field` in `ListView`'s `$expand`/`$select`
+ *    builders and in `ObjectGrid.getSelectFields` — always finds one.
+ *  - a legacy key that is ALREADY PRESENT is overwritten with that same
+ *    identity, so the name-first read sites still standing (`ListView` ×8,
+ *    `ObjectGrid`, `ObjectTree`, the detail renderers) resolve to exactly what
+ *    the request asked for.
+ *  - a legacy key that is ABSENT is never invented. A spec-clean
+ *    `{ field: 'stage' }` comes back untouched, by reference; the fold does not
+ *    manufacture the legacy vocabulary it is trying to retire.
+ *
+ * This differs on purpose from `normalizeListViewSchema`'s other folds, which
+ * DELETE the legacy key so a missed read-site fails loudly. Deleting works
+ * inside this repo — every name-first read here falls through to `field` — but
+ * `columns` entries cross the package boundary into host applications and
+ * third-party renderers, and dropping `name` from under them is a breaking
+ * change we have no inventory for. Mirroring is behaviour-preserving for every
+ * reader, in or out of the repo; the deletion is PR3's call to make once the
+ * in-repo consumers have converged onto {@link columnIdentity}.
+ *
+ * The result: for any single-key column the resolved identity is unchanged at
+ * every read site. The only entries whose behaviour moves are the ones where
+ * two sites already disagreed — which is the defect, not a regression.
+ */
+export function normalizeColumnIdentity(entry) {
+    if (typeof entry === 'string' || !isRecord(entry))
+        return entry;
+    const identity = columnIdentity(entry);
+    if (!identity)
+        return entry;
+    const needsCanonical = entry[CANONICAL_COLUMN_IDENTITY_KEY] !== identity;
+    const staleLegacy = LEGACY_COLUMN_IDENTITY_KEYS.filter((key) => entry[key] !== undefined && entry[key] !== identity);
+    if (!needsCanonical && staleLegacy.length === 0)
+        return entry;
+    // Say who won before rewriting, while the losing spelling is still readable.
+    // Only genuine contradictions are reported: a column that merely lacks the
+    // canonical key (`{ name: 'stage' }`) is legacy, not conflicting, and gets
+    // stamped without noise.
+    warnOnConflictingIdentity(entry, identity, staleLegacy);
+    const next = { ...entry };
+    next[CANONICAL_COLUMN_IDENTITY_KEY] = identity;
+    for (const key of staleLegacy)
+        next[key] = identity;
+    return next;
+}
+/**
+ * Stamp the canonical identity across a `columns` array.
+ *
+ * Non-mutating and allocation-frugal in the same way as
+ * `normalizeListViewSchema`: when every entry is already canonical the INPUT
+ * array is returned by reference, so `ListView`'s downstream `useMemo`s keep a
+ * stable dependency identity on the common path and nothing re-renders.
+ *
+ * String entries pass through untouched — a bare `'stage'` is unambiguous and
+ * every consumer already special-cases it.
+ */
+export function normalizeColumnIdentities(columns) {
+    if (!Array.isArray(columns))
+        return columns;
+    let changed = false;
+    const next = columns.map((entry) => {
+        const folded = normalizeColumnIdentity(entry);
+        if (folded !== entry)
+            changed = true;
+        return folded;
+    });
+    return (changed ? next : columns);
+}

package/dist/utils/dashboard-filters.d.ts

@@ -18,7 +18,7 @@
  * Everything in this module is pure and synchronous so the binding rules
  * are unit-testable in isolation from React and the data layer.
  */
-import type { DashboardSchema, DashboardWidgetSchema, PageVariable } from '@object-ui/types';
+import type { DashboardComponentSchema, DashboardWidgetSchema, PageVariable } from '@object-ui/types';
 /** Reserved filter name for the dashboard's built-in date range. */
 export declare const DATE_RANGE_FILTER_NAME = "dateRange";
 export interface DashboardFilterDef {
@@ -66,7 +66,7 @@ export declare const DATE_RANGE_PRESETS: string[];
  * under the reserved name `"dateRange"`; each `globalFilters` entry follows,
  * named by its `name` (defaulting to `field`). Later duplicates win.
  */
-export declare function resolveDashboardFilterDefs(schema: Pick<DashboardSchema, 'globalFilters' | 'dateRange'>): DashboardFilterDef[];
+export declare function resolveDashboardFilterDefs(schema: Pick<DashboardComponentSchema, 'globalFilters' | 'dateRange'>): DashboardFilterDef[];
 /**
  * Derive `PageVariable` definitions for a dashboard's filter values so the
  * dashboard can host them in a `PageVariablesProvider` (the page/dashboard

package/dist/utils/expand-fields.js

@@ -5,6 +5,7 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  */
+import { columnIdentity } from './column-identity.js';
 /**
  * Relational ("reference-bearing") field types whose stored value is a foreign
  * key into another object — and which therefore benefit from `$expand` so a
@@ -90,14 +91,13 @@ export function buildExpandFields(schemaFields, columns) {
     if (columns && Array.isArray(columns) && columns.length > 0) {
         const columnFieldNames = new Set();
         for (const col of columns) {
-            if (typeof col === 'string') {
-                columnFieldNames.add(col);
-            }
-            else if (col && typeof col === 'object') {
-                const name = col.field ?? col.name ?? col.fieldName;
-                if (name)
-                    columnFieldNames.add(name);
-            }
+            // `columnIdentity` handles all three entry shapes (bare string, spec
+            // `{field}`, legacy `{name}`/`{fieldName}`) and resolves canonical-first
+            // — the same precedence every renderer now uses, so what gets expanded
+            // and what gets rendered can no longer name two different fields (#3104).
+            const name = columnIdentity(col);
+            if (name)
+                columnFieldNames.add(name);
         }
         return referenceFieldNames.filter((f) => columnFieldNames.has(f));
     }

package/dist/utils/filter-converter.d.ts

@@ -29,6 +29,19 @@ export type FilterNode = [string, string, any] | [string, ...FilterNode[]];
  * @param operator - MongoDB-style operator (e.g., '$gte', '$in')
  * @returns ObjectStack operator or null if not recognized
  */
+/**
+ * A filter operator this layer will not translate.
+ *
+ * Carries the data API's own code and status for the same refusal so a failed
+ * list renders "the filter is malformed" rather than "check your connection" —
+ * `classifyLoadError` reads these, and a bare `Error` classifies as a network
+ * fault, which is the one thing this is definitely not.
+ */
+export declare class FilterOperatorError extends Error {
+    readonly code = "INVALID_FILTER";
+    readonly httpStatus = 400;
+    constructor(message: string);
+}
 export declare function convertOperatorToAST(operator: string): string | null;
 /**
  * Convert object-based filters to ObjectStack FilterNode AST format.
@@ -55,3 +68,37 @@ export declare function convertOperatorToAST(operator: string): string | null;
  * @throws {Error} If an unknown operator is encountered
  */
 export declare function convertFiltersToAST(filter: Record<string, any>): FilterNode | Record<string, any>;
+/**
+ * Normalize ONE filter source into a single filter node.
+ *
+ * A "source" is whatever a view hands a renderer, and there are three shapes in
+ * circulation, all legitimate:
+ *
+ *   - `[{ field, operator, value }, ...]`  a spec `ViewFilterRule[]`
+ *   - `[['stage', '=', 'won'], ...]`       an AST node / legacy flat array
+ *   - `{ status: 'active' }`               a MongoDB-style object
+ *
+ * The third is the one that kept getting lost. Renderers tested `source.length
+ * > 0` before using it, which is `undefined > 0` for an object — so a
+ * `table.defaultFilters` (declared `Record<string, any>`) was DROPPED and the
+ * view returned every record. Silently: no error, just a wider answer.
+ *
+ * Returns `undefined` for an absent or empty source, so callers can skip
+ * `$filter` rather than sending an empty array.
+ */
+export declare function toFilterNode(source: unknown): FilterNode | Record<string, any> | undefined;
+/**
+ * Combine filter sources under a single `and`, each as its OWN child.
+ *
+ * Wrapping rather than spreading, on purpose. `['and', ...rules]` looks
+ * equivalent and is not: spreading a `ViewFilterRule[]` puts bare rule OBJECTS
+ * where the AST expects nodes, and the server neither understands nor rejects
+ * that cleanly — `isFilterAST` says no (a 400 since objectstack#4121), while
+ * `parseFilterAST` reads the rule as a Mongo condition and filters on columns
+ * literally named `field` / `operator` / `value`. Spreading is only correct
+ * when the source happens to be an array of nodes, which is why it survived.
+ *
+ * Sources that normalize to nothing are skipped; one surviving source is
+ * returned as-is rather than wrapped in a pointless `and`.
+ */
+export declare function mergeFilterNodes(...sources: unknown[]): FilterNode | Record<string, any> | undefined;

package/dist/utils/filter-converter.js

@@ -11,6 +11,32 @@
  * @param operator - MongoDB-style operator (e.g., '$gte', '$in')
  * @returns ObjectStack operator or null if not recognized
  */
+/**
+ * A filter operator this layer will not translate.
+ *
+ * Carries the data API's own code and status for the same refusal so a failed
+ * list renders "the filter is malformed" rather than "check your connection" —
+ * `classifyLoadError` reads these, and a bare `Error` classifies as a network
+ * fault, which is the one thing this is definitely not.
+ */
+export class FilterOperatorError extends Error {
+    constructor(message) {
+        super(message);
+        Object.defineProperty(this, "code", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: 'INVALID_FILTER'
+        });
+        Object.defineProperty(this, "httpStatus", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: 400
+        });
+        this.name = 'FilterOperatorError';
+    }
+}
 export function convertOperatorToAST(operator) {
     // Spec reference: framework/packages/spec/src/data/filter.zod.ts
     // Canonical MongoDB-style keys are camelCase ($startsWith, $endsWith, $notContains).
@@ -69,14 +95,22 @@ export function convertFiltersToAST(filter) {
         if (typeof value === 'object' && !Array.isArray(value)) {
             // Handle operator-based filters
             for (const [operator, operatorValue] of Object.entries(value)) {
-                // Special handling for $regex - warn users about limited support
+                // `$regex` is refused, not downgraded. It used to become `contains`
+                // behind a `console.warn` — but substring matching is a DIFFERENT
+                // QUESTION, not a weaker version of the same one: `$regex: 'a.c'`
+                // matches "abc", `contains 'a.c'` does not, and neither result looks
+                // wrong on screen. A warning is not an error channel; nobody reads the
+                // console of a deployed app.
+                //
+                // The spec has no `$regex` (`FILTER_OPERATORS`, data/filter.zod.ts), so
+                // there is nothing to translate it INTO. Same treatment the unknown
+                // operator below already gets, and for the same stated reason.
                 if (operator === '$regex') {
-                    console.warn(`[ObjectUI] Warning: $regex operator is not fully supported. ` +
-                        `Converting to 'contains' which only supports substring matching, not regex patterns. ` +
+                    throw new FilterOperatorError(`[ObjectUI] The '$regex' filter operator is not supported. It used to be ` +
+                        `converted to 'contains', which matches a literal substring rather than a ` +
+                        `pattern — a different result, not a degraded one. ` +
                         `Field: '${field}', Value: ${JSON.stringify(operatorValue)}. ` +
-                        `Consider using $contains or $startsWith instead.`);
-                    conditions.push([field, 'contains', operatorValue]);
-                    continue;
+                        `Use $contains, $startsWith or $endsWith.`);
                 }
                 // $null / $exists translate based on their boolean value (per spec semantics).
                 // $null: true  → IS NULL    | $null: false  → IS NOT NULL
@@ -95,7 +129,7 @@ export function convertFiltersToAST(filter) {
                 }
                 else {
                     // Unknown operator - throw error to avoid silent failure
-                    throw new Error(`[ObjectUI] Unknown filter operator '${operator}' for field '${field}'. ` +
+                    throw new FilterOperatorError(`[ObjectUI] Unknown filter operator '${operator}' for field '${field}'. ` +
                         `Supported operators: $eq, $ne, $gt, $gte, $lt, $lte, $in, $nin, $between, ` +
                         `$contains, $notContains, $startsWith, $endsWith, $null, $exists. ` +
                         `If you need exact object matching, use the value directly without an operator.`);
@@ -118,3 +152,56 @@ export function convertFiltersToAST(filter) {
     // Multiple conditions: combine with 'and'
     return ['and', ...conditions];
 }
+/**
+ * Normalize ONE filter source into a single filter node.
+ *
+ * A "source" is whatever a view hands a renderer, and there are three shapes in
+ * circulation, all legitimate:
+ *
+ *   - `[{ field, operator, value }, ...]`  a spec `ViewFilterRule[]`
+ *   - `[['stage', '=', 'won'], ...]`       an AST node / legacy flat array
+ *   - `{ status: 'active' }`               a MongoDB-style object
+ *
+ * The third is the one that kept getting lost. Renderers tested `source.length
+ * > 0` before using it, which is `undefined > 0` for an object — so a
+ * `table.defaultFilters` (declared `Record<string, any>`) was DROPPED and the
+ * view returned every record. Silently: no error, just a wider answer.
+ *
+ * Returns `undefined` for an absent or empty source, so callers can skip
+ * `$filter` rather than sending an empty array.
+ */
+export function toFilterNode(source) {
+    if (source === null || source === undefined)
+        return undefined;
+    if (Array.isArray(source))
+        return source.length > 0 ? source : undefined;
+    if (typeof source !== 'object')
+        return undefined;
+    const obj = source;
+    if (Object.keys(obj).length === 0)
+        return undefined;
+    // MongoDB-style → AST, so it can sit beside the other shapes under one `and`.
+    return convertFiltersToAST(obj);
+}
+/**
+ * Combine filter sources under a single `and`, each as its OWN child.
+ *
+ * Wrapping rather than spreading, on purpose. `['and', ...rules]` looks
+ * equivalent and is not: spreading a `ViewFilterRule[]` puts bare rule OBJECTS
+ * where the AST expects nodes, and the server neither understands nor rejects
+ * that cleanly — `isFilterAST` says no (a 400 since objectstack#4121), while
+ * `parseFilterAST` reads the rule as a Mongo condition and filters on columns
+ * literally named `field` / `operator` / `value`. Spreading is only correct
+ * when the source happens to be an array of nodes, which is why it survived.
+ *
+ * Sources that normalize to nothing are skipped; one surviving source is
+ * returned as-is rather than wrapped in a pointless `and`.
+ */
+export function mergeFilterNodes(...sources) {
+    const nodes = sources.map(toFilterNode).filter((n) => n !== undefined);
+    if (nodes.length === 0)
+        return undefined;
+    if (nodes.length === 1)
+        return nodes[0];
+    return ['and', ...nodes];
+}

package/dist/utils/filter-tokens.d.ts

@@ -0,0 +1,101 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Session-scoped filter placeholders — the sibling vocabulary to
+ * `{date-macros}`.
+ *
+ * Filter values travel as JSON, so a user-scoped slice cannot call
+ * `currentUser().id` inline; it writes a placeholder that this module expands
+ * immediately before the filter reaches the data source:
+ *
+ *     { owner_id: '{current_user_id}' }
+ *
+ * ## Why this module exists (framework #3574)
+ *
+ * There used to be no shared resolver. Three ad-hoc implementations had grown
+ * up independently — one in `ObjectView` for list views, one in
+ * `ObjectDataPage` for URL filter triples, one in `NavigationRenderer` for
+ * hrefs — and each handled only the shape its own surface happened to use.
+ * Dashboard widgets never got one at all, so `{current_user_id}` in a widget
+ * filter reached SQL as a literal, matched no row, and the widget rendered
+ * `0` with no error in the console or the server log.
+ *
+ * The failure mode is the point: a metric reading `0` is indistinguishable
+ * from a metric that is legitimately zero, so the bug survived review and
+ * shipped. Any *new* surface that resolves placeholders itself will
+ * eventually reproduce it, which is why resolution lives here, once, and
+ * every surface calls {@link resolveFilterPlaceholders}.
+ *
+ * ## Presentation scope, NOT a security boundary
+ *
+ * These tokens scope what a surface *shows*. They do not decide what a caller
+ * is *allowed* to read — that is RLS, enforced server-side against a
+ * different vocabulary rooted at `current_user` (`owner_id = current_user.id`).
+ * Dropping a `{current_user_id}` filter widens a view; it must never widen
+ * access. Never use a context token as an access control.
+ *
+ * ## Contract source
+ *
+ * The canonical vocabulary is published as part of the platform contract at
+ * `@objectstack/spec` → `CONTEXT_TOKENS` / `classifyFilterToken`. It is
+ * mirrored here — exactly as `date-macros.ts` mirrors `DATE_MACRO_TOKENS` —
+ * because the installed `@objectstack/spec` predates that export. Keep the two
+ * in sync; the duplication is temporary until the next coordinated release.
+ */
+/** The complete set of session-scoped filter tokens. */
+export declare const CONTEXT_TOKENS: readonly ["current_user_id", "current_org_id"];
+export type ContextTokenName = (typeof CONTEXT_TOKENS)[number];
+/** Session values a filter placeholder can resolve against. */
+export interface FilterTokenScope {
+    /** The signed-in user's id. */
+    currentUserId?: string | null;
+    /** The active organization id. */
+    currentOrgId?: string | null;
+    /**
+     * Called when a placeholder cannot be resolved — either a recognised token
+     * with no value in scope (signed out), or a near-miss spelling that resolves
+     * in no vocabulary. Defaults to a `console.warn`; pass `null` to silence.
+     */
+    onUnresolved?: ((message: string) => void) | null;
+}
+/**
+ * Expand `{current_user_id}` / `{current_org_id}` inside a filter.
+ *
+ * Walks arrays and plain objects recursively, which is what makes one
+ * resolver cover both platform filter shapes: the MongoDB-style object a
+ * dashboard widget carries (`{ owner_id: '{current_user_id}' }`) and the
+ * condition/triple arrays a list view carries (`[{ field, operator, value }]`
+ * / `[['owner','=','…']]`). The predecessor helper in `ObjectView` bailed on
+ * non-arrays (`if (!Array.isArray(filter)) return filter`), which is why
+ * lifting it into the dashboard would have been a silent no-op.
+ *
+ * Only whole-string placeholders are substituted — an id is an opaque value,
+ * so embedding it in a larger string (`'user-{current_user_id}'`) is never
+ * what an author means, and substituting there would silently produce a value
+ * that matches nothing. Unknown tokens are passed through untouched so that
+ * date macros and nav-only `AppContextSelector` ids survive this pass.
+ *
+ * An unresolvable *known* token is deliberately left as-is rather than
+ * dropped: leaving it yields an empty result, whereas dropping the clause
+ * would widen the result set — and a filter that silently widens is far worse
+ * than one that silently narrows.
+ */
+export declare function resolveContextTokens<T = any>(filter: T, scope?: FilterTokenScope): T;
+/**
+ * Resolve **every** placeholder vocabulary a filter value understands — date
+ * macros and context tokens — in one call.
+ *
+ * This is the function surfaces should call. Calling only one of the two
+ * resolvers is the defect behind framework #3574: dashboard widgets called
+ * `resolveDateMacros` alone, so `{today}` worked and `{current_user_id}`
+ * silently did not.
+ *
+ * Order is irrelevant (the vocabularies are disjoint) but fixed here so
+ * behaviour is identical everywhere.
+ */
+export declare function resolveFilterPlaceholders<T = any>(filter: T, scope?: FilterTokenScope, now?: Date): T;