@object-ui/core 17.6.0 → 18.0.0

package/dist/registry/Registry.js

@@ -5,7 +5,69 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  */
+import { ELEMENT_DATA_SOURCE_INPUT, isElementDataSourceBlock, } from '../data-scope/element-data-source.js';
 import { PUBLIC_BLOCKS } from './public-blocks.js';
+import { HTML_TIER_INTRINSICS } from './html-tier-intrinsics.js';
+/**
+ * Emit the spec's `dataSource` input for a registration whose renderer wraps
+ * `ElementDataSourceGate` (objectui#6678).
+ *
+ * ## The one place, and why it is this one
+ *
+ * The maintainer ruling of 2026-08-29 adopted option B **in the injection
+ * form**: the declaration is emitted mechanically at the wrapping seam so every
+ * gate-wrapping registration declares the key from the same place that reads it
+ * — one mechanism rather than nine hand-kept copies across nine packages, which
+ * drift and which a tenth block would simply forget. `register()` is where every
+ * one of those registrations passes through, so it is where the emission lands;
+ * the DECLARATION itself is `ELEMENT_DATA_SOURCE_INPUT`, which lives beside the
+ * binding's own semantics in `data-scope/element-data-source.ts`.
+ *
+ * ## What it must NOT do, which is half the ruling
+ *
+ * Widening this to every registration is option A wearing a different hat: it
+ * would silence `dataSource` on `flex` and `card`, which do not read it, and the
+ * diagnostic would lie in the other direction instead of the one it lied in
+ * before. So the condition is the marker and nothing else — no heuristic over
+ * `objectName`, no "looks object-bound".
+ *
+ * ## Idempotent, and it never overwrites
+ *
+ * A registration that declares `dataSource` ITSELF keeps its own entry: the
+ * emission fills a gap, it does not own the key. (Nothing declares it today —
+ * that is the defect — but a block whose binding needs a narrower description
+ * later must be able to say so without fighting this function.) Re-registering
+ * the same component, which the registry allows and tests do constantly, is
+ * likewise a no-op rather than a growing `inputs` array.
+ *
+ * ## Typed end to end — the cast is gone (`9e37d9b39`)
+ *
+ * The spliced element is an `InjectedComponentInput` (`@object-ui/types`): a
+ * `ComponentInput` plus the framework-set `binding` marker, so it is a plain
+ * subtype of the array's element type and the return value type-checks as a
+ * `RegistryComponentMeta` with no assertion. This used to read `as ComponentMeta`,
+ * because `ELEMENT_DATA_SOURCE_INPUT` carried a hand-written inline type and
+ * `binding` had no declared home — and a cast at the one place the key is
+ * written is exactly what would have hidden any later drift between the
+ * constant and the type. The absence is held by `eslint.config.js`, which
+ * scopes `@typescript-eslint/consistent-type-assertions` with
+ * `assertionStyle: 'never'` to THIS FILE (objectui#8316) — an AST rule,
+ * because `tsc --noEmit` stays at exit 0 with the cast re-added and the
+ * source-text pin that used to stand here was green for `<ComponentMeta>{…}`,
+ * the same assertion in the other spelling.
+ * `packages/types/src/__tests__/injected-component-input-6950.test.ts` still
+ * pins the positive half, that the local below is ANNOTATED. Keep it typed: if
+ * the shape ever stops fitting, that line is where the compiler should say so.
+ */
+export function withElementDataSourceInput(component, meta) {
+    if (!isElementDataSourceBlock(component))
+        return meta;
+    const inputs = meta?.inputs ?? [];
+    if (inputs.some((input) => input?.name === ELEMENT_DATA_SOURCE_INPUT.name))
+        return meta;
+    const injected = { ...ELEMENT_DATA_SOURCE_INPUT };
+    return { ...(meta ?? {}), inputs: [...inputs, injected] };
+}
 export class Registry {
     constructor() {
         Object.defineProperty(this, "components", {
@@ -65,6 +127,9 @@ export class Registry {
      */
     register(type, component, meta) {
         const fullType = meta?.namespace ? `${meta.namespace}:${type}` : type;
+        // The `dataSource` declaration is EMITTED here, not written by the blocks
+        // (objectui#6678). See `withElementDataSourceInput`.
+        const resolvedMeta = withElementDataSourceInput(component, meta);
         // Warn if registering without namespace (deprecated pattern)
         if (!meta?.namespace) {
             console.warn(`Registering component "${type}" without a namespace is deprecated. ` +
@@ -74,7 +139,7 @@ export class Registry {
                 `  registry.register('${type}', MyComponent);\n\n` +
                 `  // After:\n` +
                 `  registry.register('${type}', MyComponent, { namespace: 'my-plugin' });\n\n` +
-                `  See: https://github.com/objectstack-ai/objectui/blob/main/MIGRATION_GUIDE.md`);
+                `  See: https://www.objectui.org/docs/guide/plugin-development#namespaced-registration`);
         }
         if (this.components.has(fullType)) {
             // console.warn(`Component type "${fullType}" is already registered. Overwriting.`);
@@ -82,7 +147,7 @@ export class Registry {
         this.components.set(fullType, {
             type: fullType,
             component,
-            ...meta
+            ...resolvedMeta
         });
         // Also register without namespace for backward compatibility
         // This allows "button" to work even when registered as "ui:button"
@@ -101,24 +166,93 @@ export class Registry {
                     `If this is intentional keep going; otherwise register "${fullType}" with ` +
                     `{ skipFallback: true } so it doesn't claim the bare "${type}" key.`);
             }
+            else if (!existing) {
+                // The CROSS-TABLE half of the same guard (objectui#9821), and the half
+                // the contest objectui#9533 measured actually went through. The check
+                // above reads `components` only, so a bare key held by a pending STUB
+                // is invisible to it: the console declared bare `dashboard` for
+                // `plugin-dashboard:dashboard` at boot, this door took the same bare key
+                // for `view:dashboard` when the chunk landed, and because `components`
+                // still held nothing under `dashboard` at that moment, NOTHING warned.
+                // Measured, not reasoned: replaying that card's three real claimants
+                // against a real registry emitted zero warnings in BOTH orders.
+                //
+                // ⚠️ The guard has to fire HERE and not only in `registerLazy`, because
+                // a contest that is only reported in one registration order is reported
+                // in the order this repository does not boot in. The `report-` and
+                // `timeline-bare-key-ownership` pins replay both orders for exactly
+                // that reason.
+                //
+                // ⭐ The remedy this warning names CHANGED with objectui#9839, and it
+                // changed because the behaviour behind it did. It used to send the
+                // author away from `skipFallback: true` — correctly at the time, since
+                // this door cleared the bare stub outside the fallback branch, so the
+                // opt-out left the bare key resolving to nothing at all. The delete is
+                // now inside the branch, so declining the bare key leaves it with its
+                // owner and the opt-out settles this contest exactly as it does on the
+                // lazy door. Both doors therefore prescribe the same thing now, which
+                // `each door prescribes the remedy that is true for it` pins.
+                const stubType = this.lazyEntries.get(type)?.fullType;
+                if (stubType && stubType !== fullType) {
+                    console.warn(`Component "${type}" bare-name fallback is being overwritten by "${fullType}", ` +
+                        `which a pending lazy stub already claims for "${stubType}". Which one an ` +
+                        `authored "${type}" node resolves to depends on whether that chunk has loaded. ` +
+                        `If this is intentional keep going; otherwise register "${fullType}" with ` +
+                        `{ skipFallback: true } so it doesn't claim the bare "${type}" key — that ` +
+                        `opt-out settles it, because the bare "${type}" key is then left with ` +
+                        `"${stubType}".`);
+                }
+            }
             this.components.set(type, {
                 type: fullType, // Keep reference to namespaced type
                 component,
-                ...meta
+                ...resolvedMeta
             });
+            // The bare key now resolves to THIS registration, so the bare stub is
+            // ours to clear. It is cleared here — inside the branch, under the same
+            // predicate that took the key — and deliberately not below (objectui#9839).
+            this.lazyEntries.delete(type);
         }
-        // A real component is now available — clear any matching lazy stub so we
-        // don't keep holding the loader reference, and notify subscribers.
+        // A real component is now available — clear the stub for the key this
+        // registration actually claimed, so we don't keep holding the loader
+        // reference, and notify subscribers.
+        //
+        // ⭐ `fullType` only. With no namespace `fullType === type`, so a bare
+        // registration still clears the bare stub — it claimed the bare key. What
+        // this line must NOT do is clear a bare stub the registration DECLINED:
+        // `skipFallback: true` skips the branch above, so `components` is never
+        // written under the bare key, and deleting the stub here took the bare key
+        // away from its owner and gave it to nobody — the stub was gone and this
+        // registration had refused to replace it (objectui#9839). A registration
+        // that opts out of the bare key opts out of clearing it too.
         this.lazyEntries.delete(fullType);
-        this.lazyEntries.delete(type);
         this.notify();
     }
     /**
      * Remove a previously registered component. Mirrors {@link register} by
      * clearing both the namespaced key and the bare-name fallback (when the
-     * fallback still points at this registration), plus any matching lazy stub.
+     * fallback still points at this registration), plus any matching lazy stub —
+     * where "matching" means the same thing on both tables: a stub that still
+     * belongs to THIS registration (objectui#9839).
      * Notifies subscribers only when something was actually removed.
      *
+     * ⭐ Why "matching" cannot mean "a stub under either key". This function
+     * already answers that question for the bare `components` key and answers it
+     * "ownership" — it will not drop bare `dashboard` when it resolves to
+     * `plugin-dashboard:dashboard`. Reading the next line as an unconditional
+     * delete makes the SAME call, on the SAME bare key, with the SAME owner,
+     * take the opposite decision purely because the owner happens to be sitting
+     * in the other table at that instant — and which table it is sitting in is
+     * exactly the "has the chunk loaded yet" race that objectui#9533 and
+     * objectui#9821 are about. A policy that flips on chunk-load timing is not a
+     * policy, so the stub gets the ownership test too.
+     *
+     * ⚠️ The BARE form (`unregister(type)` with no namespace) is unchanged and
+     * is still the unconditional one, on both tables: `fullType === type` there,
+     * so the deletes below address the bare key directly. That is the "force"
+     * form teardown sites pair with the namespaced call, and taking it away
+     * would break them.
+     *
      * Mainly used by tests that install a stub renderer and need to restore the
      * prior registry state on teardown, since the registry is a process-level
      * singleton shared across test files.
@@ -133,7 +267,13 @@ export class Registry {
                 this.components.delete(type);
         }
         this.lazyEntries.delete(fullType);
-        this.lazyEntries.delete(type);
+        // The same ownership test, on the other table.
+        if (namespace) {
+            const bareStub = this.lazyEntries.get(type);
+            if (bareStub && bareStub.fullType === fullType) {
+                this.lazyEntries.delete(type);
+            }
+        }
         if (removed)
             this.notify();
         return removed;
@@ -152,9 +292,45 @@ export class Registry {
      */
     registerLazy(type, loader, meta) {
         const fullType = meta?.namespace ? `${meta.namespace}:${type}` : type;
-        const entry = { loader, meta };
+        const entry = { loader, meta, fullType };
         this.lazyEntries.set(fullType, entry);
         if (meta?.namespace && !meta?.skipFallback) {
+            // Collision guard (objectui#9821). This door took the same bare-name
+            // fallback branch as `register` with no check at all, so a stub could
+            // take the bare key off another declaration in total silence — and the
+            // silence is why the class stayed invisible: two of the three claimants
+            // in the contest objectui#9533 filed came in through here.
+            //
+            // ⭐ The predicate keys on the FULL TYPE and reads BOTH tables, and both
+            // halves of that were decided by the census rather than chosen:
+            //
+            //   - BOTH tables, because the contention is cross-table. Copying the
+            //     guard above verbatim would compare `lazyEntries` against itself,
+            //     and the one contested bare key on this tree is a stub in this table
+            //     against a loaded registration in the other one. A same-table check
+            //     would not have caught the card that produced this one.
+            //   - FULL TYPE and not loader identity, because the ordinary correct
+            //     shape here is a stub re-declared with a DIFFERENT loader closure
+            //     for the SAME full type: two console files drive the same plugin
+            //     set, and nine of this tree's bare keys are registered twice that
+            //     way. Keying on the loader would warn on all nine, every boot.
+            //
+            // Census taken on the declared population of this repository (the same
+            // one `check-registry-bare-name-collisions.mjs` reads): of 31 bare keys
+            // a stub claims, 30 name exactly one full type across both tables — the
+            // stub-then-real lifecycle this must stay silent about — and one is a
+            // genuine contest.
+            const loaded = this.components.get(type);
+            const priorStub = loaded ? undefined : this.lazyEntries.get(type);
+            const claimedBy = loaded ? loaded.type : priorStub?.fullType;
+            if (claimedBy && claimedBy !== fullType) {
+                console.warn(`Lazy component "${type}" bare-name fallback is being overwritten by "${fullType}", ` +
+                    `which ${loaded ? 'a loaded registration' : 'another pending stub'} already claims ` +
+                    `for "${claimedBy}". If this is intentional keep going; otherwise register ` +
+                    `"${fullType}" with { skipFallback: true } so it doesn't claim the bare "${type}" ` +
+                    `key — that opt-out settles it, because the stub then claims only ` +
+                    `"${fullType}".`);
+            }
             this.lazyEntries.set(type, entry);
         }
         // Bump the version but do NOT notify: the set of KNOWN types grew, so
@@ -329,6 +505,47 @@ export class Registry {
         const key = namespace ? `${namespace}:${type}` : type;
         return this.components.get(key) ?? this.lazyEntries.get(key)?.meta;
     }
+    /**
+     * The deprecation `type` declares FOR `surface` — or `undefined` when it
+     * declares none there (objectui#6674).
+     *
+     * ## The question this makes askable
+     *
+     * "Is this type deprecated?" — which, before the {@link ComponentDeprecation}
+     * declaration existed, nothing could ask. The only two statements of a
+     * deprecation were a `console.warn` string literal in a renderer and the word
+     * "(Deprecated)" inside a human `label`; no gate, test or type can consult
+     * either. Both gates that touch component types ask whether a type RESOLVES,
+     * and a deprecated type resolves.
+     *
+     * ## Why the caller must name a surface
+     *
+     * Because the honest answer differs by surface, and a reader that dropped the
+     * distinction would let every caller re-derive it — which is how the same
+     * exemption ends up written N times and wrong in N-1 of them. `span` is
+     * deprecated for JSON-authored pages and is vocabulary of the `kind:'html'`
+     * tier (objectui#4000). Asking `deprecationFor('span', 'html')` therefore
+     * correctly answers `undefined` even when the type declares a `'json'`
+     * deprecation, while `deprecationFor('div', 'html')` answers the declaration,
+     * because `div` names both surfaces (objectui#10757). A gate over html-tier
+     * sources gets the right answer for either without knowing the rulings: the
+     * console's html compile reads exactly this to decide what it refuses.
+     *
+     * Returning the DECLARATION rather than a boolean is deliberate: the caller
+     * that has to report the finding also needs `replacement` to say what to
+     * author instead, and a boolean would send it back to the console string.
+     *
+     * Resolution is {@link getMeta}'s, so both spellings of a namespaced
+     * registration answer alike (`div` and `ui:div`), a `skipFallback` type
+     * answers only under its namespaced key, and a pending `registerLazy` stub
+     * answers from the meta it was registered with.
+     */
+    deprecationFor(type, surface, namespace) {
+        const declared = this.getMeta(type, namespace)?.deprecated;
+        if (!declared)
+            return undefined;
+        return declared.surfaces.includes(surface) ? declared : undefined;
+    }
     /**
      * Get all registered component configurations.
      *
@@ -364,9 +581,18 @@ export class Registry {
         return { ...entry.meta, type: canonical, lazy: true };
     }
     /**
-     * Get the curated PUBLIC-tier component configs (ADR-0080) — those registered
-     * with `tier: 'public'`. This is the contract/AI-vocabulary surface, a subset
-     * of the full rendering capability returned by {@link getAllConfigs}.
+     * Get the CONTRACT-surface component configs (ADR-0080) — what the published
+     * `sdui.manifest.json` serialises. A subset of the full rendering capability
+     * returned by {@link getAllConfigs}, made of two tiers:
+     *
+     *   - the curated PUBLIC tier — `PUBLIC_BLOCKS` plus registrations that opted
+     *     in with `tier: 'public'` — the JSON-surface AI-authoring vocabulary;
+     *   - the html tier's registered intrinsic elements — `HTML_TIER_INTRINSICS`,
+     *     each entry stamped `tier: 'html'` (objectui#10735). A `kind:'html'` page
+     *     may author these tags and the gate that reads the manifest must accept
+     *     them; they are NOT part of the curated vocabulary, so a consumer that
+     *     means that vocabulary alone — the `kind:'react'` JSX scope, the block
+     *     list, a census of curated blocks — filters on the stamp.
      *
      * Includes blocks that are only lazily registered so far; those come back
      * with `lazy: true` and no `component` (see {@link PublicComponentConfig}).
@@ -398,6 +624,15 @@ export class Registry {
             if (entry.meta?.tier === 'public' && !key.includes(':'))
                 add(key, this.getContractConfig(key));
         }
+        // … and the html tier's registered intrinsic elements, LAST and STAMPED:
+        // the dedupe above means a tag on both rosters comes out curated and
+        // unstamped, which is why the two rosters are pinned disjoint. The stamp is
+        // a projection, never written back onto the registration (objectui#10735).
+        for (const tag of HTML_TIER_INTRINSICS) {
+            const cfg = this.getContractConfig(tag);
+            if (cfg)
+                add(tag, { ...cfg, tier: 'html' });
+        }
         return out;
     }
     /**

package/dist/registry/WidgetRegistry.js

@@ -147,15 +147,19 @@ export class WidgetRegistry {
                     label: manifest.label,
                     icon: manifest.icon,
                     category: manifest.category,
+                    // `WidgetInput.label` / `defaultValue` / `advanced` are NOT copied
+                    // across: they are ADR-0049 retirement tombstones on BOTH faces now
+                    // (`ComponentInput` by objectui#7493 / objectui#7781,
+                    // `WidgetInput` by objectui#7911) — the manifest serializer never
+                    // forwarded them and no consumer of `ComponentMeta.inputs` read them,
+                    // so this copy was the one non-test write of the three keys and it
+                    // fed nothing. Restoring a line here would assign from a `never`.
                     inputs: manifest.inputs?.map((input) => ({
                         name: input.name,
                         type: input.type,
-                        label: input.label,
-                        defaultValue: input.defaultValue,
                         required: input.required,
                         enum: input.options,
                         description: input.description,
-                        advanced: input.advanced,
                     })),
                     defaultProps: manifest.defaultProps,
                     isContainer: manifest.isContainer,

package/dist/registry/html-tier-intrinsics.d.ts

@@ -0,0 +1,90 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * ADR-0081 §2 — the html tier's registered intrinsic-element roster, as the
+ * published manifest declares it (objectui#10735, executing the maintainer's
+ * ruling A on objectstack#20112).
+ *
+ * A `kind:'html'` page is author-written HTML expressed as constrained JSX,
+ * parsed (never executed) into the SDUI tree. Its everyday tags — headings,
+ * paragraphs, links, lists, images, emphasis, the sectioning tags — each
+ * resolve to a renderer: `renderers/basic/html-elements.tsx` registers the
+ * flow/inline set from its `TAGS` loop, `renderers/layout/semantic.tsx` the
+ * seven sectioning tags, and `span` / `table` / `label` are registered by
+ * their own modules. The console's html-tier compile whitelists
+ * `ComponentRegistry.getKnownTypes()` minus the types whose registration is
+ * deprecated on the `'html'` surface (objectui#10757), so those pages render
+ * today.
+ *
+ * The PUBLISHED contract did not say so. `sdui.manifest.json` is
+ * `getPublicConfigs()` serialised, and that read was the curated JSON-surface
+ * vocabulary (`PUBLIC_BLOCKS`) alone — so the objectstack CLI gate, which reads
+ * the manifest as the html tier's tag whitelist, refused every plain HTML tag as
+ * `forbidden-tag` / `unknown-component` on pages the renderer accepts. The
+ * ruling: the manifest declares the html tier's registered intrinsic set
+ * exactly as the registry declares it, with each tag's registered `inputs` and
+ * child slot.
+ *
+ * ## Why a SECOND roster, and a marker, rather than entries in `PUBLIC_BLOCKS`
+ *
+ * The manifest is one flat `components` map and it feeds two readers with two
+ * meanings: the objectstack gate reads its keys as the html tier's whitelist;
+ * objectui reads the same set as the curated AI-authoring vocabulary — the
+ * `kind:'react'` JSX scope (`renderers/layout/react-page.tsx`), the generated
+ * block list, the console's contract census. Listing `h1` or `p` in
+ * `PUBLIC_BLOCKS` would have widened that curated vocabulary silently, which
+ * the ruling forbids. So the tier is declared here, on its own list, and every
+ * entry it contributes to `getPublicConfigs()` is stamped `tier: 'html'`;
+ * `manifestFromConfigs` carries the stamp into the manifest as the component's
+ * `tier`, and a consumer that means the CURATED vocabulary filters on it. A
+ * consumer that ignores the key — the objectstack gate does — sees the tags as
+ * legal, which is the ruling's whole intent for that reader.
+ *
+ * ## What is deliberately NOT here
+ *
+ *   - `div` — deprecated on the JSON surface in favour of `box` (objectui#3965,
+ *     PR objectui#6878) and kept out of the published contract by the same
+ *     ruling that admits the rest: the gate keeps refusing `<div>` on an html
+ *     page. The renderer still registers it, and its declared deprecation names
+ *     both surfaces, `json` and `html` (objectui#10757): the console's html
+ *     compile refuses it too, naming `box`, so the renderer and the gate agree.
+ *   - `kbd` — a `ui` component under an HTML tag name (renders `keys` /
+ *     `label`), not named by the ruling. Admitting it is additive and cheap on
+ *     a named need; retracting a declared tag is a narrowing.
+ *   - `form`, `input`, `textarea`, `select`, `switch`, `progress`, `dialog`,
+ *     `summary`, `object`, `view` — JSON-surface components (or `field:` /
+ *     plugin fallbacks) that happen to squat on HTML tag names; the tier
+ *     excludes form controls by design (html-elements.tsx's own exclusion
+ *     list) and none of the rest is an element passthrough.
+ *   - `button`, `text`, `image`, `html` — HTML tag names that are ALREADY
+ *     curated in `PUBLIC_BLOCKS`; they reach the manifest from there, unmarked.
+ *
+ * `code` was on that list when the roster landed: the ruling named it
+ * "registered elsewhere", but the only bare `code` registration was the
+ * `field:code` widget's namespace fallback — a code editor reading `value`, no
+ * child slot — so an html author's `<code>inline</code>` drew the editor and lost
+ * its text. objectui#10756 registers `code` as a sanitised passthrough in
+ * `html-elements.tsx`'s `TAGS` and has the widget stand down from the bare key
+ * (`FIELD_TYPES_SKIP_FALLBACK` in `@object-ui/fields`; it stays `field:code`),
+ * so the tag is declared here exactly as its siblings are.
+ *
+ * The console's `html-tier-manifest` test derives the population of
+ * HTML-named registrations from `@types/react`'s `IntrinsicElements` and
+ * holds every member to one of: this roster, `PUBLIC_BLOCKS`, or its exclusion
+ * ledger with a reason — so a registration that newly squats on a tag name
+ * lands there by absence.
+ *
+ * A tag listed here that is not registered is skipped, exactly as an
+ * unregistered `PUBLIC_BLOCKS` entry is (aspirational-safe). ⛔ A tag may not be
+ * on both rosters: the curated read wins the dedupe, so the html marker would
+ * silently not apply; `__tests__/html-tier-intrinsics.test.ts` pins the
+ * disjointness.
+ */
+export declare const HTML_TIER_INTRINSICS: readonly string[];
+/** Fast membership set built from {@link HTML_TIER_INTRINSICS}. */
+export declare const HTML_TIER_INTRINSIC_SET: ReadonlySet<string>;

package/dist/registry/html-tier-intrinsics.js

@@ -0,0 +1,110 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * ADR-0081 §2 — the html tier's registered intrinsic-element roster, as the
+ * published manifest declares it (objectui#10735, executing the maintainer's
+ * ruling A on objectstack#20112).
+ *
+ * A `kind:'html'` page is author-written HTML expressed as constrained JSX,
+ * parsed (never executed) into the SDUI tree. Its everyday tags — headings,
+ * paragraphs, links, lists, images, emphasis, the sectioning tags — each
+ * resolve to a renderer: `renderers/basic/html-elements.tsx` registers the
+ * flow/inline set from its `TAGS` loop, `renderers/layout/semantic.tsx` the
+ * seven sectioning tags, and `span` / `table` / `label` are registered by
+ * their own modules. The console's html-tier compile whitelists
+ * `ComponentRegistry.getKnownTypes()` minus the types whose registration is
+ * deprecated on the `'html'` surface (objectui#10757), so those pages render
+ * today.
+ *
+ * The PUBLISHED contract did not say so. `sdui.manifest.json` is
+ * `getPublicConfigs()` serialised, and that read was the curated JSON-surface
+ * vocabulary (`PUBLIC_BLOCKS`) alone — so the objectstack CLI gate, which reads
+ * the manifest as the html tier's tag whitelist, refused every plain HTML tag as
+ * `forbidden-tag` / `unknown-component` on pages the renderer accepts. The
+ * ruling: the manifest declares the html tier's registered intrinsic set
+ * exactly as the registry declares it, with each tag's registered `inputs` and
+ * child slot.
+ *
+ * ## Why a SECOND roster, and a marker, rather than entries in `PUBLIC_BLOCKS`
+ *
+ * The manifest is one flat `components` map and it feeds two readers with two
+ * meanings: the objectstack gate reads its keys as the html tier's whitelist;
+ * objectui reads the same set as the curated AI-authoring vocabulary — the
+ * `kind:'react'` JSX scope (`renderers/layout/react-page.tsx`), the generated
+ * block list, the console's contract census. Listing `h1` or `p` in
+ * `PUBLIC_BLOCKS` would have widened that curated vocabulary silently, which
+ * the ruling forbids. So the tier is declared here, on its own list, and every
+ * entry it contributes to `getPublicConfigs()` is stamped `tier: 'html'`;
+ * `manifestFromConfigs` carries the stamp into the manifest as the component's
+ * `tier`, and a consumer that means the CURATED vocabulary filters on it. A
+ * consumer that ignores the key — the objectstack gate does — sees the tags as
+ * legal, which is the ruling's whole intent for that reader.
+ *
+ * ## What is deliberately NOT here
+ *
+ *   - `div` — deprecated on the JSON surface in favour of `box` (objectui#3965,
+ *     PR objectui#6878) and kept out of the published contract by the same
+ *     ruling that admits the rest: the gate keeps refusing `<div>` on an html
+ *     page. The renderer still registers it, and its declared deprecation names
+ *     both surfaces, `json` and `html` (objectui#10757): the console's html
+ *     compile refuses it too, naming `box`, so the renderer and the gate agree.
+ *   - `kbd` — a `ui` component under an HTML tag name (renders `keys` /
+ *     `label`), not named by the ruling. Admitting it is additive and cheap on
+ *     a named need; retracting a declared tag is a narrowing.
+ *   - `form`, `input`, `textarea`, `select`, `switch`, `progress`, `dialog`,
+ *     `summary`, `object`, `view` — JSON-surface components (or `field:` /
+ *     plugin fallbacks) that happen to squat on HTML tag names; the tier
+ *     excludes form controls by design (html-elements.tsx's own exclusion
+ *     list) and none of the rest is an element passthrough.
+ *   - `button`, `text`, `image`, `html` — HTML tag names that are ALREADY
+ *     curated in `PUBLIC_BLOCKS`; they reach the manifest from there, unmarked.
+ *
+ * `code` was on that list when the roster landed: the ruling named it
+ * "registered elsewhere", but the only bare `code` registration was the
+ * `field:code` widget's namespace fallback — a code editor reading `value`, no
+ * child slot — so an html author's `<code>inline</code>` drew the editor and lost
+ * its text. objectui#10756 registers `code` as a sanitised passthrough in
+ * `html-elements.tsx`'s `TAGS` and has the widget stand down from the bare key
+ * (`FIELD_TYPES_SKIP_FALLBACK` in `@object-ui/fields`; it stays `field:code`),
+ * so the tag is declared here exactly as its siblings are.
+ *
+ * The console's `html-tier-manifest` test derives the population of
+ * HTML-named registrations from `@types/react`'s `IntrinsicElements` and
+ * holds every member to one of: this roster, `PUBLIC_BLOCKS`, or its exclusion
+ * ledger with a reason — so a registration that newly squats on a tag name
+ * lands there by absence.
+ *
+ * A tag listed here that is not registered is skipped, exactly as an
+ * unregistered `PUBLIC_BLOCKS` entry is (aspirational-safe). ⛔ A tag may not be
+ * on both rosters: the curated read wins the dedupe, so the html marker would
+ * silently not apply; `__tests__/html-tier-intrinsics.test.ts` pins the
+ * disjointness.
+ */
+export const HTML_TIER_INTRINSICS = [
+    // ── `renderers/basic/html-elements.tsx` `TAGS` — the safe flow/inline set ──
+    'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
+    'p', 'a', 'blockquote', 'pre', 'code',
+    'strong', 'em', 'b', 'i', 'u', 'small', 'mark', 'sub', 'sup', 'del', 'ins', 'abbr',
+    'ul', 'ol', 'li', 'dl', 'dt', 'dd',
+    'figure', 'figcaption', 'img', 'hr', 'br', 'time', 'address', 'cite', 'q',
+    // ── registered elsewhere, each with its own module ────────────────────────
+    // `renderers/basic/span.tsx` — deprecated on the JSON surface, permanent
+    // vocabulary of the html tier (objectui#4000); the declaration travels with
+    // the registration, so nothing here restates it.
+    'span',
+    // `renderers/complex/table.tsx` — the data-driven table (`columns` / `data`),
+    // declared exactly as registered: no child slot, so a `<table>` authored with
+    // element children draws `not-a-container` rather than rendering them.
+    'table',
+    // `renderers/form/label.tsx` — reads `text`, declared exactly as registered.
+    'label',
+    // ── `renderers/layout/semantic.tsx` — the seven sectioning tags ──────────
+    'aside', 'main', 'header', 'nav', 'footer', 'section', 'article',
+];
+/** Fast membership set built from {@link HTML_TIER_INTRINSICS}. */
+export const HTML_TIER_INTRINSIC_SET = new Set(HTML_TIER_INTRINSICS);

package/dist/registry/public-blocks.d.ts

@@ -21,6 +21,14 @@
  *
  * This is a single, reviewable source of truth for the public surface — prefer
  * editing this list over scattering `tier` flags across registration sites.
+ *
+ * ⛔ The html tier's intrinsic elements (`h1`, `p`, `a`, the sectioning tags, …)
+ * do NOT belong here. They reach the published manifest through the second
+ * roster beside this one, `HTML_TIER_INTRINSICS`, stamped `tier: 'html'`, so
+ * that the manifest's other reader — the objectstack gate that whitelists a
+ * `kind:'html'` page's tags — accepts them without this curated JSON-surface
+ * vocabulary growing (objectui#10735). Listing one here would widen the
+ * vocabulary silently; `html-tier-intrinsics.test.ts` pins the two disjoint.
  */
 export declare const PUBLIC_BLOCKS: readonly string[];
 /** Fast membership set built from {@link PUBLIC_BLOCKS}. */