@object-ui/core 17.5.0 → 17.6.0

package/dist/utils/predicate-fields.d.ts

@@ -30,6 +30,12 @@
  * more column and no extra round trip. (A relation that IS displayed still gets
  * expanded for its label, and `toPredicateRecord` collapses it back for the
  * predicate.)
+ *
+ * Since objectstack#8018 the same reader also carries the non-predicate row keys
+ * a view's actions read — today just `recordIdField`. The name kept the
+ * "predicate" spelling because the mechanism is identical (harvest a name, gate
+ * it against the declared fields, add it to `$select`); see
+ * {@link listViewPredicates} for what is in the set and why.
  */
 /**
  * The columns the framework provisions on EVERY business object
@@ -71,13 +77,32 @@ export declare function isProjectableField(name: string, declaredFields: Record<
  */
 export declare function collectPredicateFieldRefs(predicates: readonly unknown[]): string[];
 /**
- * Every predicate a list-ish view carries, flattened for
+ * Every record-field reference a list-ish view carries, flattened for
  * {@link collectPredicateFieldRefs}.
  *
  * One reader so the projection cannot fall behind the surfaces: each entry here
- * is a place a predicate is actually evaluated against a row — conditional
- * formatting, the row kebab (custom defs AND the built-in Edit/Delete
- * overrides), the selection bar, and the object's declared actions.
+ * is a place a row field is actually READ — conditional formatting, the row
+ * kebab (custom defs AND the built-in Edit/Delete overrides), the selection bar,
+ * and the object's declared actions.
+ *
+ * Most entries are predicates. Two are not, and both are spelled as a synthetic
+ * `record.<name>` so the one harvester handles them: conditional formatting's
+ * native `{ field, operator, value }` shape, and an action's `recordIdField`
+ * (objectstack#8018). The `recordIdField` case is the same *class* of bug the
+ * predicate harvest exists to close, one surface over — the action runtime reads
+ * `rowRecord[action.recordIdField]` to seed `recordIdParam`, so a key outside the
+ * listView columns arrived absent and the injection was silently skipped, which
+ * turns a record-scoped mutation into one that names no record while still
+ * reporting success. The default (`id`) is already projected unconditionally, so
+ * only an explicit declaration adds anything here.
+ *
+ * A `recordIdField` that is not a bare identifier is dropped here, and one naming
+ * a field the object does not declare is dropped by the caller's
+ * `isProjectableField` guard. Both drops are the safe direction: such a name is
+ * not a column anywhere, and an unknown key in `$select` is not ignored by every
+ * backend. The identifier gate is not decoration — without it the harvester's
+ * regex would read a PREFIX of a malformed name (`record.not a field` → `not`)
+ * and contribute a plausible wrong field instead of nothing.
  *
  * `objectActions` is deliberately the object's WHOLE action set rather than
  * only the ones this view promotes. Narrowing it would mean re-running the

package/dist/utils/predicate-fields.js

@@ -30,6 +30,12 @@
  * more column and no extra round trip. (A relation that IS displayed still gets
  * expanded for its label, and `toPredicateRecord` collapses it back for the
  * predicate.)
+ *
+ * Since objectstack#8018 the same reader also carries the non-predicate row keys
+ * a view's actions read — today just `recordIdField`. The name kept the
+ * "predicate" spelling because the mechanism is identical (harvest a name, gate
+ * it against the declared fields, add it to `$select`); see
+ * {@link listViewPredicates} for what is in the set and why.
  */
 /**
  * The columns the framework provisions on EVERY business object
@@ -74,6 +80,14 @@ export function isProjectableField(name, declaredFields) {
  * record-header path), so this covers the documented spelling.
  */
 const RECORD_REF = /\b(?:record|data)\.([A-Za-z_][A-Za-z0-9_]*)/g;
+/**
+ * A whole bare identifier — what a field name is, and the only shape that can be
+ * spelled as `record.<name>` without the harvester's regex reading a PREFIX of it
+ * as the name (`record.not a field` would otherwise yield `not`). Used to gate
+ * the non-predicate names folded into {@link listViewPredicates}, so a malformed
+ * declaration contributes nothing instead of contributing a plausible wrong name.
+ */
+const BARE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
 /** Pull the CEL source out of any of the shapes a predicate is authored in. */
 function predicateSource(pred) {
     if (typeof pred === 'string')
@@ -117,13 +131,32 @@ export function collectPredicateFieldRefs(predicates) {
     return out;
 }
 /**
- * Every predicate a list-ish view carries, flattened for
+ * Every record-field reference a list-ish view carries, flattened for
  * {@link collectPredicateFieldRefs}.
  *
  * One reader so the projection cannot fall behind the surfaces: each entry here
- * is a place a predicate is actually evaluated against a row — conditional
- * formatting, the row kebab (custom defs AND the built-in Edit/Delete
- * overrides), the selection bar, and the object's declared actions.
+ * is a place a row field is actually READ — conditional formatting, the row
+ * kebab (custom defs AND the built-in Edit/Delete overrides), the selection bar,
+ * and the object's declared actions.
+ *
+ * Most entries are predicates. Two are not, and both are spelled as a synthetic
+ * `record.<name>` so the one harvester handles them: conditional formatting's
+ * native `{ field, operator, value }` shape, and an action's `recordIdField`
+ * (objectstack#8018). The `recordIdField` case is the same *class* of bug the
+ * predicate harvest exists to close, one surface over — the action runtime reads
+ * `rowRecord[action.recordIdField]` to seed `recordIdParam`, so a key outside the
+ * listView columns arrived absent and the injection was silently skipped, which
+ * turns a record-scoped mutation into one that names no record while still
+ * reporting success. The default (`id`) is already projected unconditionally, so
+ * only an explicit declaration adds anything here.
+ *
+ * A `recordIdField` that is not a bare identifier is dropped here, and one naming
+ * a field the object does not declare is dropped by the caller's
+ * `isProjectableField` guard. Both drops are the safe direction: such a name is
+ * not a column anywhere, and an unknown key in `$select` is not ignored by every
+ * backend. The identifier gate is not decoration — without it the harvester's
+ * regex would read a PREFIX of a malformed name (`record.not a field` → `not`)
+ * and contribute a plausible wrong field instead of nothing.
  *
  * `objectActions` is deliberately the object's WHOLE action set rather than
  * only the ones this view promotes. Narrowing it would mean re-running the
@@ -151,6 +184,13 @@ export function listViewPredicates(view) {
                 continue;
             const d = def;
             preds.push(d.visible, d.disabled);
+            // The row key this action identifies its record by — a field the runtime
+            // READS off the row, so the projection owes it exactly as it owes a
+            // predicate's operands. Spelled as a `record.` reference so the one
+            // harvester handles it (see the doc above).
+            if (typeof d.recordIdField === 'string' && BARE_IDENTIFIER.test(d.recordIdField)) {
+                preds.push(`record.${d.recordIdField}`);
+            }
         }
     }
     for (const override of Object.values(view.userActions ?? {})) {

package/dist/utils/retired-field-types.d.ts

@@ -0,0 +1,90 @@
+/**
+ * ObjectUI — retired field-type spellings
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * TOMBSTONE table — field-type spellings this renderer has RETIRED, mapped to
+ * the prescription an author must follow instead (ADR-0049 enforce-or-remove).
+ *
+ * A retired spelling is not merely absent: absence here means
+ * `mapFieldTypeToFormType`'s `|| 'field:text'` tail would hand back a
+ * working plain text input, which is the failure mode this table exists to
+ * prevent. An author who writes a retired name — or an AI author who copies one
+ * out of a stale doc — must be TOLD, not quietly given a text box that looks
+ * like it worked. So each entry resolves to a registered tombstone widget that
+ * renders a visible refusal naming the migration
+ * (`packages/fields/src/index.tsx`), while {@link reportRetiredFieldType}
+ * writes the same prescription to the console.
+ *
+ * `owner` (objectui#4814, ruling A′): a synonym for `user` with zero behavioral
+ * delta — both resolved to the SAME `UserField` widget — and absent from the
+ * spec's closed 48-member `FieldType`, so no object schema could ever declare
+ * it; it was reachable only through hand-written SDUI. Three code faces had
+ * already drifted apart on this one word (the form's data-source rule excluded
+ * it while plugin-grid's bulk dialog included it), which is the standing
+ * evidence that a second spelling for one concept is a drift channel, not a
+ * convenience. The idiom survives verbatim as `{ type: 'user', name: 'owner' }`.
+ *
+ * ## Why this table lives in `@object-ui/core` and not in `@object-ui/fields`
+ *
+ * It was born in `packages/fields/src/field-type-alias.ts`, next to the widget
+ * map that is its first consumer, and `@object-ui/fields` still exports every
+ * name in this module so no consumer of that surface had to move. It was HOISTED
+ * here by objectui#4914, and for a measured reason rather than a tidiness one:
+ * the retirement gate has to run ahead of six predicate faces, and one of them
+ * — `operatorsForFieldType` / the filter row's control choice in
+ * `packages/components/src/custom/filter-builder.tsx` — lives in
+ * `@object-ui/components`, which `@object-ui/fields` DEPENDS ON (54 source
+ * files import from it). A `components → fields` import is a package cycle, so
+ * the six faces could not all read one table while that table lived in
+ * `fields`.
+ *
+ * The alternative was a second copy of the table inside `components`, and that
+ * is precisely what this file exists to make impossible: two tables means two
+ * `reportedRetiredTypes` sets, so one retired spelling logs its prescription
+ * TWICE — and the "fires once" half of the ruling would be false the day it
+ * landed. `@object-ui/core` is below all six faces' packages (it imports only
+ * `@object-ui/types`), and already owns the sibling cross-package field-type
+ * vocabulary — {@link EXPANDABLE_FIELD_TYPES} in `./expand-fields.js`, whose
+ * own docblock records what happened the last time this kind of table was
+ * hand-copied per consumer. One table, one home, seven consumers.
+ */
+export declare const RETIRED_FIELD_TYPES: Readonly<Record<string, string>>;
+/**
+ * THE retirement gate — true when a spelling has been retired by this renderer.
+ *
+ * Ruled into existence by the maintainer on 2026-08-18 (objectui#4914, option
+ * B) as the ONE question every field-type predicate asks before it answers:
+ * "a retired spelling fires `reportRetiredFieldType` once and takes the
+ * established disposition, instead of riding the lookup-family paths or
+ * silently degrading."
+ *
+ * Quantified over the whole table rather than written per spelling, which is
+ * the entire point of having a gate at all: the next retirement closes every
+ * face the day it lands in {@link RETIRED_FIELD_TYPES}, instead of leaving each
+ * consumer open until someone notices it. `owner` survived objectui#4814 in
+ * thirteen more faces exactly because each one had hand-written its own
+ * membership list.
+ *
+ * `hasOwnProperty`, not `RETIRED_FIELD_TYPES[type]`: a `type` of
+ * `'constructor'` or `'toString'` reaches `Object.prototype` and would answer
+ * truthy through a plain index read.
+ *
+ * @param type - The spelling an author wrote (or a backend column declared).
+ * @returns `true` when the spelling is retired. Pure — it does NOT log; pair it
+ * with {@link reportRetiredFieldType} at the face that wants to be loud.
+ */
+export declare function isRetiredFieldType(type: string | undefined | null): boolean;
+/**
+ * Report a retired field-type spelling loudly, once per spelling.
+ *
+ * @param fieldType - The spelling the author wrote.
+ * @returns `true` when `fieldType` is retired (whether or not this call was the
+ * one that logged), so callers can branch on it without a second table lookup.
+ */
+export declare function reportRetiredFieldType(fieldType: string): boolean;
+/** Test seam — forget which spellings have been reported. */
+export declare function resetRetiredFieldTypeReports(): void;

package/dist/utils/retired-field-types.js

@@ -0,0 +1,124 @@
+/**
+ * ObjectUI — retired field-type spellings
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * TOMBSTONE table — field-type spellings this renderer has RETIRED, mapped to
+ * the prescription an author must follow instead (ADR-0049 enforce-or-remove).
+ *
+ * A retired spelling is not merely absent: absence here means
+ * `mapFieldTypeToFormType`'s `|| 'field:text'` tail would hand back a
+ * working plain text input, which is the failure mode this table exists to
+ * prevent. An author who writes a retired name — or an AI author who copies one
+ * out of a stale doc — must be TOLD, not quietly given a text box that looks
+ * like it worked. So each entry resolves to a registered tombstone widget that
+ * renders a visible refusal naming the migration
+ * (`packages/fields/src/index.tsx`), while {@link reportRetiredFieldType}
+ * writes the same prescription to the console.
+ *
+ * `owner` (objectui#4814, ruling A′): a synonym for `user` with zero behavioral
+ * delta — both resolved to the SAME `UserField` widget — and absent from the
+ * spec's closed 48-member `FieldType`, so no object schema could ever declare
+ * it; it was reachable only through hand-written SDUI. Three code faces had
+ * already drifted apart on this one word (the form's data-source rule excluded
+ * it while plugin-grid's bulk dialog included it), which is the standing
+ * evidence that a second spelling for one concept is a drift channel, not a
+ * convenience. The idiom survives verbatim as `{ type: 'user', name: 'owner' }`.
+ *
+ * ## Why this table lives in `@object-ui/core` and not in `@object-ui/fields`
+ *
+ * It was born in `packages/fields/src/field-type-alias.ts`, next to the widget
+ * map that is its first consumer, and `@object-ui/fields` still exports every
+ * name in this module so no consumer of that surface had to move. It was HOISTED
+ * here by objectui#4914, and for a measured reason rather than a tidiness one:
+ * the retirement gate has to run ahead of six predicate faces, and one of them
+ * — `operatorsForFieldType` / the filter row's control choice in
+ * `packages/components/src/custom/filter-builder.tsx` — lives in
+ * `@object-ui/components`, which `@object-ui/fields` DEPENDS ON (54 source
+ * files import from it). A `components → fields` import is a package cycle, so
+ * the six faces could not all read one table while that table lived in
+ * `fields`.
+ *
+ * The alternative was a second copy of the table inside `components`, and that
+ * is precisely what this file exists to make impossible: two tables means two
+ * `reportedRetiredTypes` sets, so one retired spelling logs its prescription
+ * TWICE — and the "fires once" half of the ruling would be false the day it
+ * landed. `@object-ui/core` is below all six faces' packages (it imports only
+ * `@object-ui/types`), and already owns the sibling cross-package field-type
+ * vocabulary — {@link EXPANDABLE_FIELD_TYPES} in `./expand-fields.js`, whose
+ * own docblock records what happened the last time this kind of table was
+ * hand-copied per consumer. One table, one home, seven consumers.
+ */
+export const RETIRED_FIELD_TYPES = Object.freeze({
+    owner: "[object-ui] Field type `owner` was RETIRED (objectui#4814). It was a synonym " +
+        "for `user` with no behavioral difference, and it is not a member of " +
+        "`@objectstack/spec`'s FieldType. Write the record-owner field as " +
+        "`{ type: 'user', name: 'owner' }` — the field NAME carries the ownership " +
+        "meaning, the type carries the widget. The `widget: 'field:owner'` spelling " +
+        "is retired with it.",
+});
+/**
+ * THE retirement gate — true when a spelling has been retired by this renderer.
+ *
+ * Ruled into existence by the maintainer on 2026-08-18 (objectui#4914, option
+ * B) as the ONE question every field-type predicate asks before it answers:
+ * "a retired spelling fires `reportRetiredFieldType` once and takes the
+ * established disposition, instead of riding the lookup-family paths or
+ * silently degrading."
+ *
+ * Quantified over the whole table rather than written per spelling, which is
+ * the entire point of having a gate at all: the next retirement closes every
+ * face the day it lands in {@link RETIRED_FIELD_TYPES}, instead of leaving each
+ * consumer open until someone notices it. `owner` survived objectui#4814 in
+ * thirteen more faces exactly because each one had hand-written its own
+ * membership list.
+ *
+ * `hasOwnProperty`, not `RETIRED_FIELD_TYPES[type]`: a `type` of
+ * `'constructor'` or `'toString'` reaches `Object.prototype` and would answer
+ * truthy through a plain index read.
+ *
+ * @param type - The spelling an author wrote (or a backend column declared).
+ * @returns `true` when the spelling is retired. Pure — it does NOT log; pair it
+ * with {@link reportRetiredFieldType} at the face that wants to be loud.
+ */
+export function isRetiredFieldType(type) {
+    if (typeof type !== 'string' || !type)
+        return false;
+    return Object.prototype.hasOwnProperty.call(RETIRED_FIELD_TYPES, type);
+}
+/**
+ * Spellings already reported this session, so a retired type inside a rendered
+ * list logs its prescription ONCE instead of once per row. The message is a
+ * fix instruction for an author, not a per-render event — a 1000-row grid
+ * repeating it 1000 times buries the very thing it is trying to surface.
+ *
+ * Module state, and that is load bearing now that SEVEN faces call the reporter
+ * (objectui#4914): the dedupe is per SPELLING, not per face, so a filter row
+ * whose column is refused by `operatorsForFieldType`, by the control chooser
+ * and by `normalizeFieldType` on the same render still prints one line.
+ */
+const reportedRetiredTypes = new Set();
+/**
+ * Report a retired field-type spelling loudly, once per spelling.
+ *
+ * @param fieldType - The spelling the author wrote.
+ * @returns `true` when `fieldType` is retired (whether or not this call was the
+ * one that logged), so callers can branch on it without a second table lookup.
+ */
+export function reportRetiredFieldType(fieldType) {
+    const prescription = isRetiredFieldType(fieldType) ? RETIRED_FIELD_TYPES[fieldType] : undefined;
+    if (!prescription)
+        return false;
+    if (!reportedRetiredTypes.has(fieldType)) {
+        reportedRetiredTypes.add(fieldType);
+        console.error(prescription);
+    }
+    return true;
+}
+/** Test seam — forget which spellings have been reported. */
+export function resetRetiredFieldTypeReports() {
+    reportedRetiredTypes.clear();
+}

package/dist/utils/sort-query.d.ts

@@ -16,21 +16,23 @@
  * accepts four shapes; normalizing here means one shape reaches the wire and a
  * block does not have to know which spelling its author used.
  *
- * This is the same conversion three sibling blocks already inline privately
- * (`ObjectGantt` / `ObjectMap` / `ObjectCalendar`, byte-identical copies). It is
- * hoisted here because objectstack#7137 added two more read sites
- * (`object-timeline`, `record:line_items`), and a fifth and sixth private copy is
- * how the conversions start disagreeing. Collapsing the three existing copies
- * onto this one is deliberately NOT part of #7137 — it is tracked as
- * objectstack#7148.
+ * This is now the ONLY definition in the repo. It was hoisted here because
+ * objectstack#7137 added two more read sites (`object-timeline`,
+ * `record:line_items`) next to three sibling blocks that each inlined a
+ * byte-identical private copy (`ObjectGantt` / `ObjectMap` / `ObjectCalendar`),
+ * and a fifth and sixth copy is how the conversions start disagreeing. Those
+ * three copies were deliberately left alone by #7137 and collapsed onto this
+ * function by objectui#4022; every block now imports it from here.
  *
- * Two deliberate differences from those private copies, both of which make this
- * function more faithful to the declared contract rather than adding tolerance:
+ * Two deliberate differences from those retired private copies, both of which
+ * make this function more faithful to the declared contract rather than adding
+ * tolerance — and both are BEHAVIOUR CHANGES the migration delivered, not pure
+ * refactor:
  *
  *  - **`order` is optional in `SortConfig`**, so an entry that omits it means
  *    ascending (that is what `$orderby`'s own
  *    `Array<{ field: string; order?: 'asc' | 'desc' }>` shape says). The private
- *    copies require BOTH keys and silently drop such an entry, which loses an
+ *    copies required BOTH keys and silently dropped such an entry, which lost an
  *    authored sort key instead of ordering by it.
  *  - **Nothing usable yields `undefined`, never `{}`.** An empty object is a
  *    truthy value that means "no ordering" only by accident of the adapter's

package/dist/utils/unmaterialized-fields.d.ts

@@ -0,0 +1,52 @@
+/**
+ * ObjectUI — unmaterialized-fields utility
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Field types no driver materialises a stored column for — the value is
+ * computed on read (objectui#3950).
+ *
+ * A STORAGE fact, not a taste judgement, and it decides what the SERVER can be
+ * asked to do with such a field. All three query axes have now closed on it:
+ *
+ *  - SORT — refused since objectstack#6994 (`400 INVALID_SORT`). Before that it
+ *    degraded in silence: the response carried the very values it was asked to
+ *    order by, out of order, under a `200`, with ascending and descending
+ *    byte-identical (measured on a real SQL driver).
+ *  - FILTER — refused since objectstack#8296 (`400 INVALID_FIELD`); previously
+ *    `200` with zero rows whichever way the predicate pointed.
+ *  - SEARCH — refused by name since objectstack#6674.
+ *
+ * The membership is bound to `@objectstack/spec` instead of being written out
+ * here, on the reasoning the platform's own filter door applies to itself: a
+ * layer that re-decided "which types have a column" drifts from the drivers,
+ * and then either withholds an affordance that works or offers one that 400s.
+ * The spec pins the set to `formula` alone.
+ *
+ * Deliberately NOT `COMPUTED_VALUE_TYPES` (`formula` / `summary` /
+ * `autonumber`) — that is the WRITE contract ("never client-written"). A
+ * `summary` and an `autonumber` each get a real maintained column and order,
+ * filter and search correctly, so widening to that set would withhold
+ * affordances from two types that work. The platform's own conformance suite
+ * pins that trap by name.
+ *
+ * SCOPE on the sort axis: this rules out a sort the SERVER performs. A
+ * client-side sort keys off the value the cell renders — which the server
+ * hydrates on read — so it orders by exactly what the user sees and stays
+ * honest. Consumers therefore apply this where they already apply the
+ * relational carve-out (see {@link EXPANDABLE_FIELD_TYPES}): under server
+ * sorting only.
+ */
+export declare const UNMATERIALIZED_FIELD_TYPES: ReadonlySet<string>;
+/**
+ * Whether a field definition's type materialises no stored column.
+ *
+ * Shaped like {@link isExpandableFieldType}: only `type` is read, so it answers
+ * for any field-metadata shape an object schema resolves to, and an unreadable
+ * definition is not a verdict — `null` / `undefined` / a bare type string all
+ * answer `false`.
+ */
+export declare function isUnmaterializedFieldType(fieldDef: unknown): boolean;

package/dist/utils/unmaterialized-fields.js

@@ -0,0 +1,57 @@
+/**
+ * ObjectUI — unmaterialized-fields utility
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+import { SEARCH_VIRTUAL_TYPES } from '@objectstack/spec/data';
+/**
+ * Field types no driver materialises a stored column for — the value is
+ * computed on read (objectui#3950).
+ *
+ * A STORAGE fact, not a taste judgement, and it decides what the SERVER can be
+ * asked to do with such a field. All three query axes have now closed on it:
+ *
+ *  - SORT — refused since objectstack#6994 (`400 INVALID_SORT`). Before that it
+ *    degraded in silence: the response carried the very values it was asked to
+ *    order by, out of order, under a `200`, with ascending and descending
+ *    byte-identical (measured on a real SQL driver).
+ *  - FILTER — refused since objectstack#8296 (`400 INVALID_FIELD`); previously
+ *    `200` with zero rows whichever way the predicate pointed.
+ *  - SEARCH — refused by name since objectstack#6674.
+ *
+ * The membership is bound to `@objectstack/spec` instead of being written out
+ * here, on the reasoning the platform's own filter door applies to itself: a
+ * layer that re-decided "which types have a column" drifts from the drivers,
+ * and then either withholds an affordance that works or offers one that 400s.
+ * The spec pins the set to `formula` alone.
+ *
+ * Deliberately NOT `COMPUTED_VALUE_TYPES` (`formula` / `summary` /
+ * `autonumber`) — that is the WRITE contract ("never client-written"). A
+ * `summary` and an `autonumber` each get a real maintained column and order,
+ * filter and search correctly, so widening to that set would withhold
+ * affordances from two types that work. The platform's own conformance suite
+ * pins that trap by name.
+ *
+ * SCOPE on the sort axis: this rules out a sort the SERVER performs. A
+ * client-side sort keys off the value the cell renders — which the server
+ * hydrates on read — so it orders by exactly what the user sees and stays
+ * honest. Consumers therefore apply this where they already apply the
+ * relational carve-out (see {@link EXPANDABLE_FIELD_TYPES}): under server
+ * sorting only.
+ */
+export const UNMATERIALIZED_FIELD_TYPES = SEARCH_VIRTUAL_TYPES;
+/**
+ * Whether a field definition's type materialises no stored column.
+ *
+ * Shaped like {@link isExpandableFieldType}: only `type` is read, so it answers
+ * for any field-metadata shape an object schema resolves to, and an unreadable
+ * definition is not a verdict — `null` / `undefined` / a bare type string all
+ * answer `false`.
+ */
+export function isUnmaterializedFieldType(fieldDef) {
+    return (!!fieldDef &&
+        typeof fieldDef === 'object' &&
+        UNMATERIALIZED_FIELD_TYPES.has(fieldDef.type));
+}

package/dist/validation/index.d.ts

@@ -13,6 +13,7 @@
  * is client-side form validation, not a mirror of a server rule.
  */
 export * from './required-presence.js';
+export * from './server-owned-value.js';
 export * from './validation-engine.js';
 export * from './schema-validator.js';
 export * from './validators/index.js';

package/dist/validation/index.js

@@ -13,6 +13,7 @@
  * is client-side form validation, not a mirror of a server rule.
  */
 export * from './required-presence.js';
+export * from './server-owned-value.js';
 export * from './validation-engine.js';
 export * from './schema-validator.js';
 export * from './validators/index.js';

package/dist/validation/schema-validator.js

@@ -123,6 +123,105 @@ function validateCRUDSchema(schema, path = 'schema') {
     }
     return errors;
 }
+/**
+ * The ONE namespace a form field's widget id may name — objectui#5254,
+ * maintainer ruling of 2026-08-19.
+ *
+ * A form field's `type` either names a `field:`-namespaced widget or takes the
+ * renderer's declared `default` input branch. It never resolves a plain SDUI
+ * node renderer: `renderFieldComponent` (`@object-ui/components`) resolves a
+ * colon-qualified id ONLY under this prefix, and `resolveFieldLabelling` /
+ * `resolvesToRegisteredFieldWidget` there mirror it exactly.
+ */
+const FIELD_WIDGET_NAMESPACE = 'field:';
+/**
+ * The widget id a form field will actually be RENDERED as.
+ *
+ * Mirrors the renderer's own precedence (`resolvedType` in
+ * `packages/components/src/renderers/form/form.tsx`: explicit form-config
+ * `widget`, then the resolved field metadata's widget hint, then the bare
+ * `type`). Only the two keys an AUTHORED schema carries are read here —
+ * `field.field?.widget` is a resolved metadata OBJECT that a hand-authored
+ * standalone `FormSchema` does not have.
+ *
+ * The mirroring is the point, not a convenience: validator and renderer must
+ * not be able to disagree about which component will actually render, which is
+ * the same discipline `resolveFieldLabelling` states on the renderer side.
+ */
+function resolveAuthoredFieldWidgetId(field) {
+    const id = field.widget ?? field.type;
+    return typeof id === 'string' ? id : undefined;
+}
+/**
+ * A form field's widget id names a namespace that resolves NO field widget —
+ * objectui#5375, maintainer ruling of 2026-08-20 (option C, the primary).
+ *
+ * ## What this refuses, and why it is an error rather than a warning
+ *
+ * Measured on `main` at f2e11ae6f, the real `form` renderer on the built-in
+ * path (no `registerAllFields()`):
+ *
+ *   type            registry hit   rendered type
+ *   ui:password     TRUE           text
+ *   secret          false          text
+ *   field:secret    false          text
+ *
+ * `ui:password` **is** registered — as an SDUI node renderer for a top-level
+ * `{ type: 'email' }`-style node — so an author who checks whether it resolves
+ * gets a YES, and still gets a clear-text box on the field path. That is the
+ * shape where verifying does not protect you, and it is why the class, not
+ * another entry in a renderer-side table, is what gets closed here: the table
+ * fix answers today's spellings and leaves the next invented id to find the
+ * same silent degrade. AI-authored metadata invents plausible-looking widget
+ * ids constantly; this makes inventing one an ERROR at authoring time instead
+ * of a text box that looks like it worked.
+ *
+ * A warning was explicitly ruled out — a warning IS the silent degrade this
+ * check exists to kill, in a new spelling.
+ *
+ * ## Why only the NAMESPACED spelling
+ *
+ * `field:` is allowed whether or not the widget is registered: registration is
+ * a RUNTIME fact (`registerAllFields()`, a lazily loaded plugin) that an
+ * authoring-time validator cannot see, and the renderer already answers an
+ * unregistered `field:` secret with a visible refusal (objectui#5322). A BARE
+ * name is likewise allowed: it is an open set — every registered `field:<name>`
+ * widget, third-party ones included, is reachable by its short name.
+ *
+ * What is decidable statically is the namespace, and it is a CLOSED set of one.
+ * Any other `<ns>:<name>` resolves nothing on the field path by the #5254
+ * ruling and falls to the renderer's plain-text `default` arm.
+ *
+ * ## Census (the ruling made arming this conditional on one)
+ *
+ * 4,397 authored files in this repo, 649 form-field `type`/`widget` literals,
+ * 98 structurally parsed form-field entries in `examples/schema-catalog`:
+ * SEVEN colon-qualified ids on the form-field path, five of them `field:*`.
+ * The two remaining occurrences are one source line naming `ref:component`,
+ * which is a metadata-admin designer `SchemaForm` widget resolved by its own
+ * `WIDGETS` table — a different shape (`{ field, widget }` under
+ * `sections[].fields[]`, node type `simple`) that this function, gated on
+ * `type === 'form'`, never reaches. Zero occurrences of `ui:password`,
+ * `secret` or `field:secret` anywhere on the field path.
+ */
+function validateFieldWidgetNamespace(field, path) {
+    const id = resolveAuthoredFieldWidgetId(field);
+    if (!id || !id.includes(':') || id.startsWith(FIELD_WIDGET_NAMESPACE))
+        return undefined;
+    const key = typeof field.widget === 'string' ? 'widget' : 'type';
+    return {
+        path: `${path}.${key}`,
+        message: `'${id}' is not a form field widget: a namespaced field widget id must name the ` +
+            `\`field:\` namespace (objectui#5254), so this id resolves NOTHING on the field path ` +
+            `and the renderer would fall through to a plain text box — putting a secret on screen ` +
+            `in clear text when the field holds one (objectui#5375). Write the built-in spelling ` +
+            `(e.g. \`password\`), or the field widget id \`field:${id.slice(id.indexOf(':') + 1)}\`. ` +
+            `Resolving in the registry is not proof it resolves HERE — \`ui:password\` is a ` +
+            `registered SDUI node renderer and still renders clear text as a field.`,
+        type: 'error',
+        code: 'UNRESOLVABLE_FIELD_WIDGET_NAMESPACE',
+    };
+}
 /**
  * Validate form schema specific properties
  */
@@ -139,6 +238,12 @@ function validateFormSchema(schema, path = 'schema') {
                         code: 'MISSING_FIELD_NAME'
                     });
                 }
+                // objectui#5375 — an invented namespaced widget id is an ERROR here,
+                // not a silent clear-text box at render time. See the helper's doc.
+                const namespaceError = validateFieldWidgetNamespace(field, `${path}.fields[${index}]`);
+                if (namespaceError) {
+                    errors.push(namespaceError);
+                }
                 // Check for duplicate field names
                 const duplicates = schema.fields.filter((f) => f.name === field.name);
                 if (duplicates.length > 1) {