@object-ui/core 17.3.0 → 17.6.0

package/dist/utils/retired-field-types.d.ts

@@ -0,0 +1,90 @@
+/**
+ * ObjectUI — retired field-type spellings
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * TOMBSTONE table — field-type spellings this renderer has RETIRED, mapped to
+ * the prescription an author must follow instead (ADR-0049 enforce-or-remove).
+ *
+ * A retired spelling is not merely absent: absence here means
+ * `mapFieldTypeToFormType`'s `|| 'field:text'` tail would hand back a
+ * working plain text input, which is the failure mode this table exists to
+ * prevent. An author who writes a retired name — or an AI author who copies one
+ * out of a stale doc — must be TOLD, not quietly given a text box that looks
+ * like it worked. So each entry resolves to a registered tombstone widget that
+ * renders a visible refusal naming the migration
+ * (`packages/fields/src/index.tsx`), while {@link reportRetiredFieldType}
+ * writes the same prescription to the console.
+ *
+ * `owner` (objectui#4814, ruling A′): a synonym for `user` with zero behavioral
+ * delta — both resolved to the SAME `UserField` widget — and absent from the
+ * spec's closed 48-member `FieldType`, so no object schema could ever declare
+ * it; it was reachable only through hand-written SDUI. Three code faces had
+ * already drifted apart on this one word (the form's data-source rule excluded
+ * it while plugin-grid's bulk dialog included it), which is the standing
+ * evidence that a second spelling for one concept is a drift channel, not a
+ * convenience. The idiom survives verbatim as `{ type: 'user', name: 'owner' }`.
+ *
+ * ## Why this table lives in `@object-ui/core` and not in `@object-ui/fields`
+ *
+ * It was born in `packages/fields/src/field-type-alias.ts`, next to the widget
+ * map that is its first consumer, and `@object-ui/fields` still exports every
+ * name in this module so no consumer of that surface had to move. It was HOISTED
+ * here by objectui#4914, and for a measured reason rather than a tidiness one:
+ * the retirement gate has to run ahead of six predicate faces, and one of them
+ * — `operatorsForFieldType` / the filter row's control choice in
+ * `packages/components/src/custom/filter-builder.tsx` — lives in
+ * `@object-ui/components`, which `@object-ui/fields` DEPENDS ON (54 source
+ * files import from it). A `components → fields` import is a package cycle, so
+ * the six faces could not all read one table while that table lived in
+ * `fields`.
+ *
+ * The alternative was a second copy of the table inside `components`, and that
+ * is precisely what this file exists to make impossible: two tables means two
+ * `reportedRetiredTypes` sets, so one retired spelling logs its prescription
+ * TWICE — and the "fires once" half of the ruling would be false the day it
+ * landed. `@object-ui/core` is below all six faces' packages (it imports only
+ * `@object-ui/types`), and already owns the sibling cross-package field-type
+ * vocabulary — {@link EXPANDABLE_FIELD_TYPES} in `./expand-fields.js`, whose
+ * own docblock records what happened the last time this kind of table was
+ * hand-copied per consumer. One table, one home, seven consumers.
+ */
+export declare const RETIRED_FIELD_TYPES: Readonly<Record<string, string>>;
+/**
+ * THE retirement gate — true when a spelling has been retired by this renderer.
+ *
+ * Ruled into existence by the maintainer on 2026-08-18 (objectui#4914, option
+ * B) as the ONE question every field-type predicate asks before it answers:
+ * "a retired spelling fires `reportRetiredFieldType` once and takes the
+ * established disposition, instead of riding the lookup-family paths or
+ * silently degrading."
+ *
+ * Quantified over the whole table rather than written per spelling, which is
+ * the entire point of having a gate at all: the next retirement closes every
+ * face the day it lands in {@link RETIRED_FIELD_TYPES}, instead of leaving each
+ * consumer open until someone notices it. `owner` survived objectui#4814 in
+ * thirteen more faces exactly because each one had hand-written its own
+ * membership list.
+ *
+ * `hasOwnProperty`, not `RETIRED_FIELD_TYPES[type]`: a `type` of
+ * `'constructor'` or `'toString'` reaches `Object.prototype` and would answer
+ * truthy through a plain index read.
+ *
+ * @param type - The spelling an author wrote (or a backend column declared).
+ * @returns `true` when the spelling is retired. Pure — it does NOT log; pair it
+ * with {@link reportRetiredFieldType} at the face that wants to be loud.
+ */
+export declare function isRetiredFieldType(type: string | undefined | null): boolean;
+/**
+ * Report a retired field-type spelling loudly, once per spelling.
+ *
+ * @param fieldType - The spelling the author wrote.
+ * @returns `true` when `fieldType` is retired (whether or not this call was the
+ * one that logged), so callers can branch on it without a second table lookup.
+ */
+export declare function reportRetiredFieldType(fieldType: string): boolean;
+/** Test seam — forget which spellings have been reported. */
+export declare function resetRetiredFieldTypeReports(): void;

package/dist/utils/retired-field-types.js

@@ -0,0 +1,124 @@
+/**
+ * ObjectUI — retired field-type spellings
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * TOMBSTONE table — field-type spellings this renderer has RETIRED, mapped to
+ * the prescription an author must follow instead (ADR-0049 enforce-or-remove).
+ *
+ * A retired spelling is not merely absent: absence here means
+ * `mapFieldTypeToFormType`'s `|| 'field:text'` tail would hand back a
+ * working plain text input, which is the failure mode this table exists to
+ * prevent. An author who writes a retired name — or an AI author who copies one
+ * out of a stale doc — must be TOLD, not quietly given a text box that looks
+ * like it worked. So each entry resolves to a registered tombstone widget that
+ * renders a visible refusal naming the migration
+ * (`packages/fields/src/index.tsx`), while {@link reportRetiredFieldType}
+ * writes the same prescription to the console.
+ *
+ * `owner` (objectui#4814, ruling A′): a synonym for `user` with zero behavioral
+ * delta — both resolved to the SAME `UserField` widget — and absent from the
+ * spec's closed 48-member `FieldType`, so no object schema could ever declare
+ * it; it was reachable only through hand-written SDUI. Three code faces had
+ * already drifted apart on this one word (the form's data-source rule excluded
+ * it while plugin-grid's bulk dialog included it), which is the standing
+ * evidence that a second spelling for one concept is a drift channel, not a
+ * convenience. The idiom survives verbatim as `{ type: 'user', name: 'owner' }`.
+ *
+ * ## Why this table lives in `@object-ui/core` and not in `@object-ui/fields`
+ *
+ * It was born in `packages/fields/src/field-type-alias.ts`, next to the widget
+ * map that is its first consumer, and `@object-ui/fields` still exports every
+ * name in this module so no consumer of that surface had to move. It was HOISTED
+ * here by objectui#4914, and for a measured reason rather than a tidiness one:
+ * the retirement gate has to run ahead of six predicate faces, and one of them
+ * — `operatorsForFieldType` / the filter row's control choice in
+ * `packages/components/src/custom/filter-builder.tsx` — lives in
+ * `@object-ui/components`, which `@object-ui/fields` DEPENDS ON (54 source
+ * files import from it). A `components → fields` import is a package cycle, so
+ * the six faces could not all read one table while that table lived in
+ * `fields`.
+ *
+ * The alternative was a second copy of the table inside `components`, and that
+ * is precisely what this file exists to make impossible: two tables means two
+ * `reportedRetiredTypes` sets, so one retired spelling logs its prescription
+ * TWICE — and the "fires once" half of the ruling would be false the day it
+ * landed. `@object-ui/core` is below all six faces' packages (it imports only
+ * `@object-ui/types`), and already owns the sibling cross-package field-type
+ * vocabulary — {@link EXPANDABLE_FIELD_TYPES} in `./expand-fields.js`, whose
+ * own docblock records what happened the last time this kind of table was
+ * hand-copied per consumer. One table, one home, seven consumers.
+ */
+export const RETIRED_FIELD_TYPES = Object.freeze({
+    owner: "[object-ui] Field type `owner` was RETIRED (objectui#4814). It was a synonym " +
+        "for `user` with no behavioral difference, and it is not a member of " +
+        "`@objectstack/spec`'s FieldType. Write the record-owner field as " +
+        "`{ type: 'user', name: 'owner' }` — the field NAME carries the ownership " +
+        "meaning, the type carries the widget. The `widget: 'field:owner'` spelling " +
+        "is retired with it.",
+});
+/**
+ * THE retirement gate — true when a spelling has been retired by this renderer.
+ *
+ * Ruled into existence by the maintainer on 2026-08-18 (objectui#4914, option
+ * B) as the ONE question every field-type predicate asks before it answers:
+ * "a retired spelling fires `reportRetiredFieldType` once and takes the
+ * established disposition, instead of riding the lookup-family paths or
+ * silently degrading."
+ *
+ * Quantified over the whole table rather than written per spelling, which is
+ * the entire point of having a gate at all: the next retirement closes every
+ * face the day it lands in {@link RETIRED_FIELD_TYPES}, instead of leaving each
+ * consumer open until someone notices it. `owner` survived objectui#4814 in
+ * thirteen more faces exactly because each one had hand-written its own
+ * membership list.
+ *
+ * `hasOwnProperty`, not `RETIRED_FIELD_TYPES[type]`: a `type` of
+ * `'constructor'` or `'toString'` reaches `Object.prototype` and would answer
+ * truthy through a plain index read.
+ *
+ * @param type - The spelling an author wrote (or a backend column declared).
+ * @returns `true` when the spelling is retired. Pure — it does NOT log; pair it
+ * with {@link reportRetiredFieldType} at the face that wants to be loud.
+ */
+export function isRetiredFieldType(type) {
+    if (typeof type !== 'string' || !type)
+        return false;
+    return Object.prototype.hasOwnProperty.call(RETIRED_FIELD_TYPES, type);
+}
+/**
+ * Spellings already reported this session, so a retired type inside a rendered
+ * list logs its prescription ONCE instead of once per row. The message is a
+ * fix instruction for an author, not a per-render event — a 1000-row grid
+ * repeating it 1000 times buries the very thing it is trying to surface.
+ *
+ * Module state, and that is load bearing now that SEVEN faces call the reporter
+ * (objectui#4914): the dedupe is per SPELLING, not per face, so a filter row
+ * whose column is refused by `operatorsForFieldType`, by the control chooser
+ * and by `normalizeFieldType` on the same render still prints one line.
+ */
+const reportedRetiredTypes = new Set();
+/**
+ * Report a retired field-type spelling loudly, once per spelling.
+ *
+ * @param fieldType - The spelling the author wrote.
+ * @returns `true` when `fieldType` is retired (whether or not this call was the
+ * one that logged), so callers can branch on it without a second table lookup.
+ */
+export function reportRetiredFieldType(fieldType) {
+    const prescription = isRetiredFieldType(fieldType) ? RETIRED_FIELD_TYPES[fieldType] : undefined;
+    if (!prescription)
+        return false;
+    if (!reportedRetiredTypes.has(fieldType)) {
+        reportedRetiredTypes.add(fieldType);
+        console.error(prescription);
+    }
+    return true;
+}
+/** Test seam — forget which spellings have been reported. */
+export function resetRetiredFieldTypeReports() {
+    reportedRetiredTypes.clear();
+}

package/dist/utils/sort-query.d.ts

@@ -0,0 +1,57 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * sort-query — lower a block's authored `sort` to the `$orderby` value a
+ * `DataSource.find` query carries.
+ *
+ * Two authored spellings reach every object-bound block, because both are
+ * declared: the legacy OData-ish string (`ObjectGridSchema.sort: "name desc"`)
+ * and the spec's `SortConfig[]` (`[{ field, order }]`). A read site that hands
+ * either straight to `$orderby` works only because `QueryParams.$orderby`
+ * accepts four shapes; normalizing here means one shape reaches the wire and a
+ * block does not have to know which spelling its author used.
+ *
+ * This is now the ONLY definition in the repo. It was hoisted here because
+ * objectstack#7137 added two more read sites (`object-timeline`,
+ * `record:line_items`) next to three sibling blocks that each inlined a
+ * byte-identical private copy (`ObjectGantt` / `ObjectMap` / `ObjectCalendar`),
+ * and a fifth and sixth copy is how the conversions start disagreeing. Those
+ * three copies were deliberately left alone by #7137 and collapsed onto this
+ * function by objectui#4022; every block now imports it from here.
+ *
+ * Two deliberate differences from those retired private copies, both of which
+ * make this function more faithful to the declared contract rather than adding
+ * tolerance — and both are BEHAVIOUR CHANGES the migration delivered, not pure
+ * refactor:
+ *
+ *  - **`order` is optional in `SortConfig`**, so an entry that omits it means
+ *    ascending (that is what `$orderby`'s own
+ *    `Array<{ field: string; order?: 'asc' | 'desc' }>` shape says). The private
+ *    copies required BOTH keys and silently dropped such an entry, which lost an
+ *    authored sort key instead of ordering by it.
+ *  - **Nothing usable yields `undefined`, never `{}`.** An empty object is a
+ *    truthy value that means "no ordering" only by accident of the adapter's
+ *    serializer; `undefined` says it, so the query simply carries no `$orderby`.
+ *
+ * Not a lenient alias: an unusable input (a number, an object, an array of
+ * strings) yields `undefined` rather than a guess. Only the two spellings the
+ * schema types declare are honoured.
+ */
+/** A field name paired with a direction — the spec's `SortConfig`. */
+export interface QuerySortEntry {
+    field?: string;
+    order?: 'asc' | 'desc';
+}
+/**
+ * Normalize an authored `sort` into the field→direction map used for
+ * `QueryParams.$orderby`.
+ *
+ * @param sort `"name desc"` (legacy string) or `SortConfig[]`.
+ * @returns The ordering map, or `undefined` when nothing orderable was authored.
+ */
+export declare function convertSortToQueryParams(sort: string | QuerySortEntry[] | undefined | null): Record<string, 'asc' | 'desc'> | undefined;

package/dist/utils/sort-query.js

@@ -0,0 +1,35 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Normalize an authored `sort` into the field→direction map used for
+ * `QueryParams.$orderby`.
+ *
+ * @param sort `"name desc"` (legacy string) or `SortConfig[]`.
+ * @returns The ordering map, or `undefined` when nothing orderable was authored.
+ */
+export function convertSortToQueryParams(sort) {
+    if (!sort)
+        return undefined;
+    // Legacy string clause: "name desc" / "name" (a bare field means ascending).
+    if (typeof sort === 'string') {
+        const [field, direction] = sort.trim().split(/\s+/);
+        if (!field)
+            return undefined;
+        return { [field]: direction?.toLowerCase() === 'desc' ? 'desc' : 'asc' };
+    }
+    if (Array.isArray(sort)) {
+        const out = {};
+        for (const entry of sort) {
+            if (!entry || typeof entry.field !== 'string' || entry.field === '')
+                continue;
+            out[entry.field] = entry.order === 'desc' ? 'desc' : 'asc';
+        }
+        return Object.keys(out).length > 0 ? out : undefined;
+    }
+    return undefined;
+}

package/dist/utils/unmaterialized-fields.d.ts

@@ -0,0 +1,52 @@
+/**
+ * ObjectUI — unmaterialized-fields utility
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Field types no driver materialises a stored column for — the value is
+ * computed on read (objectui#3950).
+ *
+ * A STORAGE fact, not a taste judgement, and it decides what the SERVER can be
+ * asked to do with such a field. All three query axes have now closed on it:
+ *
+ *  - SORT — refused since objectstack#6994 (`400 INVALID_SORT`). Before that it
+ *    degraded in silence: the response carried the very values it was asked to
+ *    order by, out of order, under a `200`, with ascending and descending
+ *    byte-identical (measured on a real SQL driver).
+ *  - FILTER — refused since objectstack#8296 (`400 INVALID_FIELD`); previously
+ *    `200` with zero rows whichever way the predicate pointed.
+ *  - SEARCH — refused by name since objectstack#6674.
+ *
+ * The membership is bound to `@objectstack/spec` instead of being written out
+ * here, on the reasoning the platform's own filter door applies to itself: a
+ * layer that re-decided "which types have a column" drifts from the drivers,
+ * and then either withholds an affordance that works or offers one that 400s.
+ * The spec pins the set to `formula` alone.
+ *
+ * Deliberately NOT `COMPUTED_VALUE_TYPES` (`formula` / `summary` /
+ * `autonumber`) — that is the WRITE contract ("never client-written"). A
+ * `summary` and an `autonumber` each get a real maintained column and order,
+ * filter and search correctly, so widening to that set would withhold
+ * affordances from two types that work. The platform's own conformance suite
+ * pins that trap by name.
+ *
+ * SCOPE on the sort axis: this rules out a sort the SERVER performs. A
+ * client-side sort keys off the value the cell renders — which the server
+ * hydrates on read — so it orders by exactly what the user sees and stays
+ * honest. Consumers therefore apply this where they already apply the
+ * relational carve-out (see {@link EXPANDABLE_FIELD_TYPES}): under server
+ * sorting only.
+ */
+export declare const UNMATERIALIZED_FIELD_TYPES: ReadonlySet<string>;
+/**
+ * Whether a field definition's type materialises no stored column.
+ *
+ * Shaped like {@link isExpandableFieldType}: only `type` is read, so it answers
+ * for any field-metadata shape an object schema resolves to, and an unreadable
+ * definition is not a verdict — `null` / `undefined` / a bare type string all
+ * answer `false`.
+ */
+export declare function isUnmaterializedFieldType(fieldDef: unknown): boolean;

package/dist/utils/unmaterialized-fields.js

@@ -0,0 +1,57 @@
+/**
+ * ObjectUI — unmaterialized-fields utility
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+import { SEARCH_VIRTUAL_TYPES } from '@objectstack/spec/data';
+/**
+ * Field types no driver materialises a stored column for — the value is
+ * computed on read (objectui#3950).
+ *
+ * A STORAGE fact, not a taste judgement, and it decides what the SERVER can be
+ * asked to do with such a field. All three query axes have now closed on it:
+ *
+ *  - SORT — refused since objectstack#6994 (`400 INVALID_SORT`). Before that it
+ *    degraded in silence: the response carried the very values it was asked to
+ *    order by, out of order, under a `200`, with ascending and descending
+ *    byte-identical (measured on a real SQL driver).
+ *  - FILTER — refused since objectstack#8296 (`400 INVALID_FIELD`); previously
+ *    `200` with zero rows whichever way the predicate pointed.
+ *  - SEARCH — refused by name since objectstack#6674.
+ *
+ * The membership is bound to `@objectstack/spec` instead of being written out
+ * here, on the reasoning the platform's own filter door applies to itself: a
+ * layer that re-decided "which types have a column" drifts from the drivers,
+ * and then either withholds an affordance that works or offers one that 400s.
+ * The spec pins the set to `formula` alone.
+ *
+ * Deliberately NOT `COMPUTED_VALUE_TYPES` (`formula` / `summary` /
+ * `autonumber`) — that is the WRITE contract ("never client-written"). A
+ * `summary` and an `autonumber` each get a real maintained column and order,
+ * filter and search correctly, so widening to that set would withhold
+ * affordances from two types that work. The platform's own conformance suite
+ * pins that trap by name.
+ *
+ * SCOPE on the sort axis: this rules out a sort the SERVER performs. A
+ * client-side sort keys off the value the cell renders — which the server
+ * hydrates on read — so it orders by exactly what the user sees and stays
+ * honest. Consumers therefore apply this where they already apply the
+ * relational carve-out (see {@link EXPANDABLE_FIELD_TYPES}): under server
+ * sorting only.
+ */
+export const UNMATERIALIZED_FIELD_TYPES = SEARCH_VIRTUAL_TYPES;
+/**
+ * Whether a field definition's type materialises no stored column.
+ *
+ * Shaped like {@link isExpandableFieldType}: only `type` is read, so it answers
+ * for any field-metadata shape an object schema resolves to, and an unreadable
+ * definition is not a verdict — `null` / `undefined` / a bare type string all
+ * answer `false`.
+ */
+export function isUnmaterializedFieldType(fieldDef) {
+    return (!!fieldDef &&
+        typeof fieldDef === 'object' &&
+        UNMATERIALIZED_FIELD_TYPES.has(fieldDef.type));
+}

package/dist/validation/index.d.ts

@@ -13,6 +13,7 @@
  * is client-side form validation, not a mirror of a server rule.
  */
 export * from './required-presence.js';
+export * from './server-owned-value.js';
 export * from './validation-engine.js';
 export * from './schema-validator.js';
 export * from './validators/index.js';

package/dist/validation/index.js

@@ -13,6 +13,7 @@
  * is client-side form validation, not a mirror of a server rule.
  */
 export * from './required-presence.js';
+export * from './server-owned-value.js';
 export * from './validation-engine.js';
 export * from './schema-validator.js';
 export * from './validators/index.js';

package/dist/validation/schema-validator.js

@@ -123,6 +123,105 @@ function validateCRUDSchema(schema, path = 'schema') {
     }
     return errors;
 }
+/**
+ * The ONE namespace a form field's widget id may name — objectui#5254,
+ * maintainer ruling of 2026-08-19.
+ *
+ * A form field's `type` either names a `field:`-namespaced widget or takes the
+ * renderer's declared `default` input branch. It never resolves a plain SDUI
+ * node renderer: `renderFieldComponent` (`@object-ui/components`) resolves a
+ * colon-qualified id ONLY under this prefix, and `resolveFieldLabelling` /
+ * `resolvesToRegisteredFieldWidget` there mirror it exactly.
+ */
+const FIELD_WIDGET_NAMESPACE = 'field:';
+/**
+ * The widget id a form field will actually be RENDERED as.
+ *
+ * Mirrors the renderer's own precedence (`resolvedType` in
+ * `packages/components/src/renderers/form/form.tsx`: explicit form-config
+ * `widget`, then the resolved field metadata's widget hint, then the bare
+ * `type`). Only the two keys an AUTHORED schema carries are read here —
+ * `field.field?.widget` is a resolved metadata OBJECT that a hand-authored
+ * standalone `FormSchema` does not have.
+ *
+ * The mirroring is the point, not a convenience: validator and renderer must
+ * not be able to disagree about which component will actually render, which is
+ * the same discipline `resolveFieldLabelling` states on the renderer side.
+ */
+function resolveAuthoredFieldWidgetId(field) {
+    const id = field.widget ?? field.type;
+    return typeof id === 'string' ? id : undefined;
+}
+/**
+ * A form field's widget id names a namespace that resolves NO field widget —
+ * objectui#5375, maintainer ruling of 2026-08-20 (option C, the primary).
+ *
+ * ## What this refuses, and why it is an error rather than a warning
+ *
+ * Measured on `main` at f2e11ae6f, the real `form` renderer on the built-in
+ * path (no `registerAllFields()`):
+ *
+ *   type            registry hit   rendered type
+ *   ui:password     TRUE           text
+ *   secret          false          text
+ *   field:secret    false          text
+ *
+ * `ui:password` **is** registered — as an SDUI node renderer for a top-level
+ * `{ type: 'email' }`-style node — so an author who checks whether it resolves
+ * gets a YES, and still gets a clear-text box on the field path. That is the
+ * shape where verifying does not protect you, and it is why the class, not
+ * another entry in a renderer-side table, is what gets closed here: the table
+ * fix answers today's spellings and leaves the next invented id to find the
+ * same silent degrade. AI-authored metadata invents plausible-looking widget
+ * ids constantly; this makes inventing one an ERROR at authoring time instead
+ * of a text box that looks like it worked.
+ *
+ * A warning was explicitly ruled out — a warning IS the silent degrade this
+ * check exists to kill, in a new spelling.
+ *
+ * ## Why only the NAMESPACED spelling
+ *
+ * `field:` is allowed whether or not the widget is registered: registration is
+ * a RUNTIME fact (`registerAllFields()`, a lazily loaded plugin) that an
+ * authoring-time validator cannot see, and the renderer already answers an
+ * unregistered `field:` secret with a visible refusal (objectui#5322). A BARE
+ * name is likewise allowed: it is an open set — every registered `field:<name>`
+ * widget, third-party ones included, is reachable by its short name.
+ *
+ * What is decidable statically is the namespace, and it is a CLOSED set of one.
+ * Any other `<ns>:<name>` resolves nothing on the field path by the #5254
+ * ruling and falls to the renderer's plain-text `default` arm.
+ *
+ * ## Census (the ruling made arming this conditional on one)
+ *
+ * 4,397 authored files in this repo, 649 form-field `type`/`widget` literals,
+ * 98 structurally parsed form-field entries in `examples/schema-catalog`:
+ * SEVEN colon-qualified ids on the form-field path, five of them `field:*`.
+ * The two remaining occurrences are one source line naming `ref:component`,
+ * which is a metadata-admin designer `SchemaForm` widget resolved by its own
+ * `WIDGETS` table — a different shape (`{ field, widget }` under
+ * `sections[].fields[]`, node type `simple`) that this function, gated on
+ * `type === 'form'`, never reaches. Zero occurrences of `ui:password`,
+ * `secret` or `field:secret` anywhere on the field path.
+ */
+function validateFieldWidgetNamespace(field, path) {
+    const id = resolveAuthoredFieldWidgetId(field);
+    if (!id || !id.includes(':') || id.startsWith(FIELD_WIDGET_NAMESPACE))
+        return undefined;
+    const key = typeof field.widget === 'string' ? 'widget' : 'type';
+    return {
+        path: `${path}.${key}`,
+        message: `'${id}' is not a form field widget: a namespaced field widget id must name the ` +
+            `\`field:\` namespace (objectui#5254), so this id resolves NOTHING on the field path ` +
+            `and the renderer would fall through to a plain text box — putting a secret on screen ` +
+            `in clear text when the field holds one (objectui#5375). Write the built-in spelling ` +
+            `(e.g. \`password\`), or the field widget id \`field:${id.slice(id.indexOf(':') + 1)}\`. ` +
+            `Resolving in the registry is not proof it resolves HERE — \`ui:password\` is a ` +
+            `registered SDUI node renderer and still renders clear text as a field.`,
+        type: 'error',
+        code: 'UNRESOLVABLE_FIELD_WIDGET_NAMESPACE',
+    };
+}
 /**
  * Validate form schema specific properties
  */
@@ -139,6 +238,12 @@ function validateFormSchema(schema, path = 'schema') {
                         code: 'MISSING_FIELD_NAME'
                     });
                 }
+                // objectui#5375 — an invented namespaced widget id is an ERROR here,
+                // not a silent clear-text box at render time. See the helper's doc.
+                const namespaceError = validateFieldWidgetNamespace(field, `${path}.fields[${index}]`);
+                if (namespaceError) {
+                    errors.push(namespaceError);
+                }
                 // Check for duplicate field names
                 const duplicates = schema.fields.filter((f) => f.name === field.name);
                 if (duplicates.length > 1) {

package/dist/validation/server-owned-value.d.ts

@@ -0,0 +1,62 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Is this declared `defaultValue` a RUNTIME INSTRUCTION the server resolves per
+ * insert, rather than a literal value?
+ *
+ * True for the `DEFAULT_VALUE_TOKENS` family (`'NOW()'` / `'current_user'`) and
+ * for CEL/template Expression envelopes. This is THE classifier for "the
+ * producer owns this field's create value", and every consumer reads THIS one
+ * — a second copy would be free to disagree about, say, a CEL envelope, and
+ * then a form would seed a field it also refuses to submit. Today's consumers:
+ *
+ *   1. seeding (#4047 / #4068) — such a default is not seeded, because putting
+ *      the literal text `NOW()` into a datetime input and submitting it
+ *      suppresses the very resolution the declaration asked for;
+ *   2. the create-mode static `required` rule (#4069) —
+ *      `isRequiredInForm` in `@object-ui/plugin-form`;
+ *   3. the create-mode `requiredWhen` rule (#4085) —
+ *      {@link isServerOwnedValue}, read by `resolveFieldRuleState`.
+ */
+export declare function isRuntimeDefault(v: unknown): boolean;
+/**
+ * A runtime `FormField` as far as this module is concerned: the resolved
+ * object-field metadata stash, and whatever else the field carries.
+ *
+ * Stated structurally rather than as `@object-ui/types`' `FormField` so the
+ * one key this module reads is visible in the signature — and with an index
+ * signature so a caller (or a test) may hand over an object literal carrying
+ * the rest of the field without tripping TypeScript's excess-property check.
+ */
+export interface FieldWithDeclaredDefault {
+    field?: {
+        defaultValue?: unknown;
+    } | null;
+    [key: string]: unknown;
+}
+/**
+ * Does the PRODUCER supply this field's value for the submit this form is
+ * about to make? (#4085)
+ *
+ * The single derivation of that fact, so the three call sites that feed
+ * `resolveFieldRuleState` cannot each answer "where does the declared default
+ * live" differently. It reads the runtime FormField's `field` slot — the
+ * resolved object-field metadata the object-bound builders stash there
+ * (`ObjectForm`, `sectionFields`, and the containers' no-sections paths), and
+ * the only spelling of a declared `defaultValue` that reaches the renderer.
+ * A hand-authored FormField carries no object metadata, so it is never
+ * server-owned and its rules are untouched.
+ *
+ * `isCreateForm` is the CALLER's fact, never inferred here: the form renderer
+ * reads it off `FormSchema.previousValues` (whose absence *is* the declared
+ * "this is an insert" signal, objectui#3484), while the wizard's step gate
+ * reads its own `mode`. An evaluator guessing from a `previous` argument would
+ * call an edit-mode caller that simply passes no `previous` a create form, and
+ * silently drop a `requiredWhen` the author meant to enforce.
+ */
+export declare function isServerOwnedValue(field: FieldWithDeclaredDefault | null | undefined, isCreateForm: boolean): boolean;