@object-ui/plugin-form 17.5.0 → 17.7.0

package/dist/sectionFields.d.ts

@@ -26,14 +26,77 @@ export interface SectionFieldsContext {
      * passes it.
      */
     fieldLabel: (objectName: string, fieldName: string, fallback: string) => string;
+    /**
+     * The authored inline members (`schema.customFields`). A member naming the
+     * field a section entry names is that entry's BASE definition, in place of
+     * the one generated from the object schema — the precedence `ObjectForm`'s
+     * default arm resolves its section members with (`findCustomFieldMember`,
+     * objectui#10254). Only the base moves: the entry's own overrides still
+     * apply on top, by the rules below. Omitted or empty → every base is
+     * generated, as before.
+     */
+    customFields?: readonly FormField[] | null;
+    /**
+     * The parent field POOL the section resolves its members against, for the
+     * one caller that has one: `ObjectForm`'s default arm (`SimpleObjectForm`),
+     * whose pool is built from top-level `fields` (or the object) merged with
+     * `customFields` (objectui#10475).
+     *
+     * When set, {@link buildSectionFields} still walks the section's entries in
+     * AUTHORED order and applies each entry's overrides by the same rules as
+     * every other arm; two things change, both the pool's to decide:
+     *
+     *   - membership — an entry naming a field the pool does not hold is
+     *     dropped. That is objectui#9884's INTERSECTION of `fields` and
+     *     `sections`; the caller emits its warning
+     *     (`warnSectionMemberExcludedByFields`), this module only drops;
+     *   - the BASE — the pooled field is what a name string draws and what a
+     *     spec entry's overrides are written onto (a copy), in place of
+     *     `fromObjectSchema` / the member lookup. The pool already resolved the
+     *     member-over-generated precedence, and its generated fields carry the
+     *     default arm's own per-field facts (the lock on a computed `formula` /
+     *     `summary` / `auto_number` field, the input type, the step), which only
+     *     LAYOUT and per-entry overrides may move. The managed-object lock is
+     *     not one of them: every arm applies it after this builder, in
+     *     `gateFormFields` (objectui#10612).
+     *
+     * An already-built runtime FormField entry (shape 3) is its own definition
+     * with or without a pool; the pool decides only whether it is drawn.
+     * Omitted → no pool: every entry is drawn, from the bases above.
+     */
+    pool?: readonly FormField[] | null;
 }
+export declare function warnUnresolvedTopLevelField(entry: unknown, objectName: string): void;
+export declare function warnSectionMemberExcludedByFields(memberName: string, objectName: string, sectionLabel?: string): void;
+/**
+ * Build a runtime FormField from object-schema metadata for `fieldName`.
+ *
+ * The ONE object-field-to-FormField mapping in this package. Exported because
+ * the flat (no-sections) containers need the identical mapping — see
+ * `flatFields.ts`, and objectui#4755 for what a second hand-copied version
+ * costs.
+ */
+export declare function fromObjectSchema(fieldName: string, ctx: SectionFieldsContext): FormField;
+/**
+ * The field name a section entry resolves to — the identity rule of the three
+ * shapes above, spelled once: a string is the name; a spec entry's identity is
+ * its `field` STRING; an already-built runtime FormField's is its `name`.
+ * `undefined` when the entry names nothing.
+ */
+export declare function sectionEntryName(fieldDef: unknown): string | undefined;
 /**
  * Normalize one section field definition (string | spec object | runtime
  * FormField) into a runtime FormField with a guaranteed `name`.
  */
 export declare function normalizeSectionField(fieldDef: string | Record<string, any>, ctx: SectionFieldsContext): FormField;
-/** Normalize every field def in a section. */
+/**
+ * Normalize every field def in a section, in the section's AUTHORED order.
+ *
+ * With a {@link SectionFieldsContext.pool}, an entry naming a field the pool
+ * does not hold is dropped, and a pooled field is the base the entry starts
+ * from; the order stays the section's own either way (objectui#10475).
+ */
 export declare function buildSectionFields(section: {
-    fields: Array<string | Record<string, any>>;
+    fields?: Array<string | Record<string, any>>;
 }, ctx: SectionFieldsContext): FormField[];
 //# sourceMappingURL=sectionFields.d.ts.map

package/dist/sectionFields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sectionFields.d.ts","sourceRoot":"","sources":["../src/sectionFields.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAIlD,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,YAAY,EAAE,GAAG,CAAC;IAClB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,sDAAsD;IACtD,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;CACjF;AA8ED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACtC,GAAG,EAAE,oBAAoB,GACxB,SAAS,CA2FX;AAED,8CAA8C;AAC9C,wBAAgB,kBAAkB,CAChC,OAAO,EAAE;IAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;CAAE,EACxD,GAAG,EAAE,oBAAoB,GACxB,SAAS,EAAE,CAEb"}
+{"version":3,"file":"sectionFields.d.ts","sourceRoot":"","sources":["../src/sectionFields.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAMlD,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,YAAY,EAAE,GAAG,CAAC;IAClB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,sDAAsD;IACtD,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IAChF;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,SAAS,SAAS,EAAE,GAAG,IAAI,CAAC;IAC3C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,IAAI,CAAC,EAAE,SAAS,SAAS,EAAE,GAAG,IAAI,CAAC;CACpC;AA0FD,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAepF;AAkCD,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,GACpB,IAAI,CAaN;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,oBAAoB,GAAG,SAAS,CAgCxF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAMtE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACtC,GAAG,EAAE,oBAAoB,GACxB,SAAS,CAEX;AAwHD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;CAAE,EACzD,GAAG,EAAE,oBAAoB,GACxB,SAAS,EAAE,CAmBb"}

package/dist/sectionGroups.d.ts

@@ -0,0 +1,62 @@
+import { ObjectFormSection } from '@object-ui/types';
+/**
+ * The keys `@objectstack/spec` REFUSES beside `group`, measured against
+ * `FormSectionSchema` in `@objectstack/spec` 17.3.0 and pinned in
+ * `__tests__/formSectionGroupReference-7051.test.tsx`.
+ *
+ * There are no override semantics: each of these is something the object's
+ * `fieldGroups` entry declares, so restating one on the referencing section
+ * would be a second writable spelling of one fact. Authored metadata carrying
+ * one never reaches this renderer (the spec door rejects it); a programmatic
+ * SDUI caller, which does not pass that door, is reported instead of quietly
+ * having its key honoured or quietly having it dropped.
+ */
+export declare const GROUP_OWNED_SECTION_KEYS: readonly ["name", "label", "description", "collapsible", "collapsed", "visibleWhen"];
+/**
+ * The keys the spec PERMITS beside `group`. They describe how THIS form lays
+ * the section out, which is the form's business and not the group's, so the
+ * authored value wins over the derived section.
+ */
+export declare const SECTION_LAYOUT_KEYS: readonly ["columns", "pane"];
+/** Test seam — forget which section-group diagnostics have been reported. */
+export declare function resetSectionGroupReports(): void;
+/** Does any section in this list use the reference form? */
+export declare function hasSectionGroupReference(sections: unknown): boolean;
+export interface ResolveSectionGroupsOptions {
+    /** Object name — diagnostics say WHICH object is missing the group. */
+    objectName: string;
+    /** The form's layout. `wizard` is the one the spec bans `group` on. */
+    formType?: string;
+    /**
+     * The object definition (`{ fields, fieldGroups }`), or `null`/`undefined`
+     * while it is still loading. A `group` section is rendered EMPTY until it
+     * arrives — never dropped, see the note on the return value.
+     */
+    objectDef: any;
+    /**
+     * `false` when this form can never load an object definition (no
+     * DataSource), so an unresolvable reference is reported as such instead of
+     * being left to look like a load that never finished.
+     */
+    resolvable?: boolean;
+}
+/**
+ * Replace every `{ group }` section with the section that group declares.
+ *
+ * Returns the SAME array reference when nothing uses the reference form, so a
+ * caller can keep this in a `useMemo` without perturbing any existing form.
+ *
+ * ⚠️ A reference that cannot be resolved yields `{ fields: [] }` — an empty
+ * section — and NOT a dropped one. Both render nothing, which is what the spec
+ * assigns to an unresolvable reference (`deriveFieldGroupLayout` already drops
+ * a declared group nothing references, and `@objectstack/lint`'s
+ * `form-section-group-unknown` is the declared reporter of a dangling key).
+ * The choice between them is forced by THIS surface and was measured: a form
+ * whose `sections` array empties out stops being a sectioned form at all and
+ * falls back to the flat every-field layout, so dropping would make a single
+ * mistyped key render MORE than the author asked for. Emptying renders
+ * exactly nothing, and leaves the array length — which is the wizard's step
+ * count and the container routing's condition — untouched.
+ */
+export declare function resolveSectionGroupReferences(sections: ObjectFormSection[] | undefined, opts: ResolveSectionGroupsOptions): ObjectFormSection[] | undefined;
+//# sourceMappingURL=sectionGroups.d.ts.map

package/dist/sectionGroups.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sectionGroups.d.ts","sourceRoot":"","sources":["../src/sectionGroups.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAG1D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,sFAO3B,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,8BAA+B,CAAC;AAWhE,6EAA6E;AAC7E,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAED,4DAA4D;AAC5D,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,CAKnE;AAcD,MAAM,WAAW,2BAA2B;IAC1C,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,SAAS,EAAE,GAAG,CAAC;IACf;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,iBAAiB,EAAE,GAAG,SAAS,EACzC,IAAI,EAAE,2BAA2B,GAChC,iBAAiB,EAAE,GAAG,SAAS,CAyEjC"}

package/dist/sectionPredicateDiagnostic.d.ts

@@ -0,0 +1,38 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * The one layout arm that still DROPS an authored `FormSection.visibleWhen`
+ * (objectui#6237).
+ *
+ * Of the six layout routes in `ObjectForm`, five honour the predicate:
+ * `split` / `drawer` / `modal` rebuild each section key by key and copy it
+ * (#6111), the flat arm carries it on the `section-divider` pseudo-field
+ * (#6236), and `tabbed` joined them by copying it onto the tab `TabbedForm`
+ * synthesises, where the renderer evaluates it (#6237). `wizard` is the
+ * remainder.
+ *
+ * ⛔ The wizard's gap is a DESIGN boundary, not an oversight, and it is not one
+ * copy line away. A step predicate would be step-boundary reactive against the
+ * ruled live-record reactivity, and it needs navigation, indicator, final-gate
+ * and re-selection semantics that the tab arm's machinery does not supply —
+ * `WizardStepConfig` carries the full measurement. Until that contract is ruled,
+ * an author who writes the key on a wizard is told so rather than watching it do
+ * nothing.
+ *
+ * Since objectstack#13622 (ruled 2026-08-31) the boundary is ALSO enforced at
+ * the author door: `@objectstack/spec` refuses `visibleWhen` on a wizard step
+ * at parse, so authored form-view metadata can no longer arrive here carrying
+ * it. This report is deliberately KEPT (Card R of that ruling): programmatic
+ * SDUI callers do not pass the spec door, and metadata published before the
+ * tightening still round-trips — for both, this warning is the only signal.
+ *
+ * Single-sourced so the runtime report and the pin that holds its wording cannot
+ * drift apart.
+ */
+export declare function sectionPredicateUnsupportedWarning(layout: 'wizard', sectionNames: string): string;
+//# sourceMappingURL=sectionPredicateDiagnostic.d.ts.map

package/dist/sectionPredicateDiagnostic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sectionPredicateDiagnostic.d.ts","sourceRoot":"","sources":["../src/sectionPredicateDiagnostic.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,QAAQ,EAChB,YAAY,EAAE,MAAM,GACnB,MAAM,CASR"}

package/dist/submitRedirect.d.ts

@@ -0,0 +1,148 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * Where a form's `submitBehavior: { kind: 'redirect' }` sends the submitter
+ * (objectui#4989), under the shape objectstack#7496 ruled on 2026-08-11 and
+ * objectstack#7657 landed in `@objectstack/spec` (live on the 17.0.0 GA pin
+ * this package depends on).
+ *
+ * The ruling has three points:
+ *
+ *   1. **relative paths only** — an absolute or protocol-relative URL is
+ *      refused. This is the open-redirect face: the destination is authored
+ *      metadata, which is exactly where an address somebody else chose gets
+ *      copied in.
+ *   2. **interpolation only from declared record fields**, spelled
+ *      `{{record.field_name}}`, with every interpolated value **URL-escaped
+ *      when the redirect is built**.
+ *   3. a **verbatim redirect on the resolved relative path** is the intended
+ *      consumption — the destination is that string with its tokens
+ *      substituted, and nothing else.
+ *
+ * Point 1 is a property of the string, so the spec enforces it at the authoring
+ * door and this module ASKS it rather than restating it. Whether
+ * `{{record.foo}}` names a field the form's object actually declares needs both
+ * the string and the object declaration, so `@objectstack/lint`'s
+ * reference-integrity family owns that. Point 2's "when the redirect is built"
+ * and point 3's consumption are runtime, and this module is where they happen.
+ *
+ * ## The shape verdict is the spec's, not a copy of it
+ *
+ * `@objectstack/spec` does not export its url check as a function, but it does
+ * export the schema the check lives in, so the verdict here is produced by
+ * PARSING the smallest form view that carries this behavior. That costs one
+ * parse per submit and buys the property that matters: there is no second
+ * spelling of a security rule in this repo to drift from the first, and when the
+ * ruling widens (it says an allowlist of absolute origins "waits for measured
+ * demand") this package follows the pin with no edit here.
+ *
+ * The alternative was a local re-implementation of the seven refusal families
+ * kept honest by a parity table. `scripts/check-spec-symbol-derivation.mjs`
+ * exists because this repo has paid for that shape four times
+ * (objectstack#4115, objectui#4074/#4588/#4592): a hand copy passes every value
+ * comparison right up to the release that moves the original.
+ *
+ * Parsing a MINIMAL view is load-bearing, not laziness. A whole stored
+ * `FormView` refuses on any unrelated key the strict schema does not know, and a
+ * redirect must not be refused because some other part of the metadata drifted.
+ * The question asked here is narrow — "is this url a value the contract
+ * allows?" — so only that value is submitted for judgement, and only issues on
+ * that value's path are read back.
+ *
+ * `@objectstack/spec` is already a declared runtime dependency of this package
+ * and already imported by its siblings (`sectionFields.ts`, `sanitize.ts`), so
+ * the import adds no dependency and no chunk.
+ *
+ * ## Relationship to `apps/console`'s `submitRedirect.ts`
+ *
+ * `apps/console` consumes the same ruled key and got the same treatment in
+ * objectui#4190 / PR #4992. The two are deliberately SEMANTICALLY aligned and
+ * physically separate: a published renderer package cannot import an app's
+ * module, and the shared thing — the shape verdict — is not duplicated at all,
+ * because both ask the same `FormViewSchema`. What is written twice is the token
+ * substitution and the escape, ~20 lines the spec exports no substituter for.
+ *
+ * Two deliberate divergences, both named so a future consolidation has a map.
+ * The accepted value: the console resolves to a `path` it hands to a ROUTER
+ * unconditionally, whereas this package resolves to a path it hands to the
+ * host's injected navigate when there is one and to a browser-level navigation
+ * when there is not — a renderer cannot assume a router, which is the whole
+ * subject of `submitRedirectNavigation.ts`. And the split: the console has since
+ * separated its shape verdict
+ * into `checkSubmitRedirectUrl` because it also owns an authoring door
+ * (`PublicFormsPage` asks it before saving), which this package has no
+ * counterpart to — a renderer only ever consumes.
+ */
+/** Accepted: `url` is the resolved relative destination to navigate to. */
+interface SubmitRedirectAccepted {
+    ok: true;
+    url: string;
+}
+/** Refused: `refusal` is author-facing prose explaining what to write instead. */
+interface SubmitRedirectRefused {
+    ok: false;
+    refusal: string;
+}
+export type SubmitRedirectVerdict = SubmitRedirectAccepted | SubmitRedirectRefused;
+/**
+ * The token scope for one submit: "the record this submit just wrote".
+ *
+ * The values as submitted, with whatever the DataSource answered layered over
+ * them — defaults, computed columns and the new id are canonical there, and the
+ * submitted values are what a `create` that echoes nothing back still has. Both
+ * form components call this so a `{{record.id}}` token cannot resolve one way in
+ * `ObjectForm` and another in `WizardForm`.
+ */
+export declare function submitRedirectScope(submittedValues: unknown, result: unknown): Record<string, unknown>;
+/**
+ * Resolve an authored `submitBehavior.url` into the relative destination to
+ * navigate to, or refuse it.
+ *
+ * @param url    the authored value, exactly as the metadata carries it
+ * @param record the record this submit just wrote — the token scope
+ *
+ * Refusal is fail-closed and quotable: the message is the spec's own
+ * prescription (it names the key, the rule, and what to write instead, including
+ * that a deliberately external destination is an app navigation item rather than
+ * this key), so the author reads the same sentence here that the authoring door
+ * would have told them. Callers must SHOW it — the write already succeeded, and
+ * dropping the refusal leaves the submitter looking at a still-filled form with
+ * no idea why nothing happened, which is objectui#4989's defect 2 and the one
+ * outcome the ruling's consumer half rules out.
+ *
+ * ## Why substitution cannot widen the destination
+ *
+ * Every interpolated value goes through `encodeURIComponent`, which escapes the
+ * characters that could add structure — `/` and `:`, along with `?`, `#` and the
+ * rest. So a field carrying an address, a traversal, or a space becomes one
+ * opaque segment or query value: a token is a VALUE in the path, never a way to
+ * add path structure.
+ *
+ * That escape carries the whole weight of the property, and re-parsing the
+ * result would NOT be enough on its own. Interpolated raw,
+ * `/t/{{record.slug}}` with an address in `slug` becomes
+ * `/t/https://evil.example/steal` — which still starts with `/` and carries no
+ * leading scheme, i.e. a spec-VALID relative path pointing somewhere the author
+ * never wrote. Relative-only is a rule about where a path STARTS, so it has
+ * nothing to say about structure injected further along. `submitRedirect.test.ts`
+ * therefore pins both halves.
+ *
+ * ## What this module does not answer: WHO travels (objectui#4989 defect 4)
+ *
+ * An accepted value is a rooted relative path, and a rooted path resolves
+ * against the ORIGIN root when a browser-level navigation performs it — so
+ * under a host mounted at a sub-path a ruled in-app `/thanks` used to leave the
+ * app. That is defect 4 of the card, and it is not a property of the string:
+ * the same accepted path is correct or wrong depending on who travels to it.
+ * It is therefore answered one layer out, in `submitRedirectNavigation.ts`,
+ * where the host's optionally injected navigate is used when present
+ * (maintainer ruling, 2026-08-17) and `window.location.assign` otherwise.
+ *
+ * Nothing about the verdict changes with the seam: an injected host navigate is
+ * never a laundering route for a value this module refuses, because it is only
+ * ever handed a path this module already accepted.
+ */
+export declare function resolveSubmitRedirect(url: string, record: Record<string, unknown>): SubmitRedirectVerdict;
+export {};
+//# sourceMappingURL=submitRedirect.d.ts.map

package/dist/submitRedirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submitRedirect.d.ts","sourceRoot":"","sources":["../src/submitRedirect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAsBH,2EAA2E;AAC3E,UAAU,sBAAsB;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,GAAG,EAAE,MAAM,CAAC;CACb;AAED,kFAAkF;AAClF,UAAU,qBAAqB;IAC7B,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,qBAAqB,GAAG,sBAAsB,GAAG,qBAAqB,CAAC;AAoBnF;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,OAAO,GACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,qBAAqB,CAgDvB"}

package/dist/submitRedirectNavigation.d.ts

@@ -0,0 +1,82 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * How an ACCEPTED `submitBehavior: { kind: 'redirect' }` destination is
+ * actually travelled to — objectui#4989 **defect 4, mount-blindness**, the
+ * reopened half of that card.
+ *
+ * `submitRedirect.ts` answers WHETHER a destination may be followed and WHAT
+ * the resolved relative path is. This module answers WHO performs the
+ * navigation, and it is a separate question because the right answer is not
+ * this package's to pick: a rooted path such as `/thanks` handed to
+ * `window.location.assign` resolves against the ORIGIN, so under a host mounted
+ * at a sub-path (the framework CLI configures one for every embedded
+ * deployment) a ruled in-app destination leaves the application. Only the host
+ * knows its mount.
+ *
+ * ## The mechanism, and why it is this one
+ *
+ * Maintainer ruling, 2026-08-17: **optional injected navigation**. The host
+ * offers its own router-aware, basename-aware navigate through
+ * `HostNavigationContext` (`@object-ui/react`); this package uses it when it is
+ * there and keeps today's `window.location.assign` when it is not. Two other
+ * mechanisms were weighed and REJECTED in that ruling, recorded here so the
+ * next reader does not re-derive them as improvements:
+ *
+ *   - **reading React Router's context when a router happens to be present** —
+ *     implicit, and unavailable regardless: a React context is a module-instance
+ *     object, so reading the host's requires importing `react-router` here.
+ *     This package declares it in none of its four dependency fields, its Vite
+ *     build externalises every bare specifier, and two real consumers
+ *     (`apps/site`, `packages/plugin-view`) have no react-router to resolve —
+ *     the published `dist` would break their builds. Declaring it as a normal
+ *     dependency does not help either: that yields this package its OWN
+ *     react-router instance, whose context object is not the host's, so the
+ *     read answers null forever.
+ *   - **a `react-router` peer requirement** — the honest version of the above,
+ *     and it costs this package the property that it drops into ANY React
+ *     application.
+ *
+ * ## Absent seam is not a degraded mode
+ *
+ * With no provider the behaviour is byte-for-byte what it was: one
+ * `window.location.assign` of the resolved path after the declared delay. A
+ * host with no router has no basename, so origin-rooted resolution is already
+ * correct there — the seam changes what a MOUNTED host gets, and nothing else.
+ *
+ * ## What the host takes on by supplying it
+ *
+ * A host navigate is a client-side transition, so the destination must be a
+ * path the host's router can match; an in-app path with no route renders the
+ * host's not-found instead of a full page load. That is the host's routing
+ * table to answer for, which is exactly why the choice is the host's. The
+ * verdict is NOT relaxed for injected hosts: a destination the contract refuses
+ * is refused identically either way (`submitRedirect.ts`), so a supplied
+ * navigate can never become a laundering route for a value the authoring door
+ * rejects.
+ */
+/**
+ * An accepted destination plus the delay declared with it, captured at the
+ * moment the write was accepted. Held in component state by each form so the
+ * wait belongs to the mounted component (objectui#5033) — see the state's own
+ * comment at each call site.
+ */
+export interface PendingSubmitRedirect {
+    url: string;
+    delayMs: number;
+}
+/**
+ * Own the delayed leg of an accepted `redirect` submit behaviour: wait the
+ * declared `delayMs`, then travel to `pending.url` through the host's navigate
+ * if one was injected, else through `window.location.assign`.
+ *
+ * Unmounting cancels the wait, which is the property objectui#5033 bought and
+ * this extraction preserves: the hook's effect is the same effect both forms
+ * used to declare inline, now written once so the two cannot disagree about
+ * either the wait or the seam.
+ *
+ * Pass `null` when nothing is pending.
+ */
+export declare function useSubmitRedirectNavigation(pending: PendingSubmitRedirect | null): void;
+//# sourceMappingURL=submitRedirectNavigation.d.ts.map

package/dist/submitRedirectNavigation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submitRedirectNavigation.d.ts","sourceRoot":"","sources":["../src/submitRedirectNavigation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAKH;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,GAAG,IAAI,CA8BvF"}

package/dist/submitTarget.d.ts

@@ -0,0 +1,119 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Does a form have anything to submit TO? — the ONE answer for every renderer
+ * `ObjectForm` routes to (objectui#6300).
+ *
+ * ## What went wrong
+ *
+ * Each of the five variant containers opened `handleSubmit` with
+ *
+ *     if (!dataSource) { await schema.onSuccess?.(data); return data; }
+ *
+ * — a SUCCESS signal emitted without consulting `submitHandler` and without
+ * persisting anything. Measured on `main` with a `submitHandler` supplied and no
+ * `dataSource`, all five read `onSuccess 1 / submitHandler 0`. Through
+ * `MasterDetailForm` — whose parent schema declares BOTH
+ * `submitHandler: submitViaBatch` and `onSuccess: handleSaved` — that early
+ * return reached `handleSaved` directly: a success toast (measured:
+ * `toast.success("Created")`) and, in create mode, a form reset clearing the
+ * line items nobody wrote. Silent data loss in the worst direction, because the
+ * submitter is told it worked.
+ *
+ * ## The rule this module carries
+ *
+ * A form has a submit target when it has EITHER a `dataSource` (it writes) or a
+ * declared `submitHandler` (the host writes — objectui#6176's seam, which needs
+ * no adapter of its own). With neither, exactly one shape is still legitimate:
+ * fields authored INLINE, where the author's `onSuccess` IS the write. Anything
+ * else must refuse, loudly, instead of confirming.
+ *
+ * ## What counts as inline, and why it has two limbs
+ *
+ * Neither limb is a new predicate. Both name a shape this package already
+ * documents as working with no adapter, and the test refuses everything else.
+ *
+ * **(a) `customFields` is non-empty.** `SimpleObjectForm` (`ObjectForm.tsx`)
+ * gates its own carve-out on exactly this, the `object-form` element gate
+ * (`index.tsx`) declares `requiresDataSource={!(schema?.customFields?.length > 0)
+ * && …}` and says so in as many words — *"The one escape hatch is inline
+ * `customFields`, which is exactly what `hasInlineFields` gates on inside the
+ * component, so the two stay in step"* — and `ObjectFormSchema` glosses the key
+ * as *"when used with inline field definitions (without dataSource), this
+ * becomes the primary field source"*.
+ *
+ * **(b) every section field is an inline runtime `FormField`.** This limb is not
+ * optional and not an invention: it is how a sectioned form expresses the same
+ * thing with no `customFields` at all — its sections carry the definitions.
+ * This package's README documents the shape and ships an example of
+ * it, `<WizardForm schema={wizard} />` under the comment *"dataSource omitted:
+ * every step lists inline fields"*, introduced by *"The inline shape is what
+ * lets a wizard run with no data source at all"*. Measured before this module
+ * existed: that example renders and submits. A `customFields`-only test would
+ * have made the repo's own published example throw — which is why the limb is
+ * here.
+ *
+ * The limb is deliberately ALL-or-nothing, and it is the taxonomy
+ * `normalizeSectionField` already keeps: a section field is a name string
+ * (shape 1), a spec `FormFieldSchema` whose identity key `field` is a STRING
+ * (shape 2), or an inline runtime `FormField` carrying its own `name` (shape 3).
+ * Only shape 3 is self-describing; shapes 1 and 2 name fields that only an
+ * object schema — and therefore only an adapter — can resolve. So one bare name
+ * anywhere in the sections means the form DID need metadata it could not get,
+ * and it refuses. Erring that way is the loud direction; the silent one is the
+ * defect.
+ *
+ * `TabbedForm` / `SplitForm` / `WizardForm` receive `customFields` through
+ * `ObjectForm`'s `{...schema}` spread. Until objectui#10254 they neither
+ * declared nor rendered it, and limb (a) read it there only as a SIGNAL; they
+ * now declare it and draw a member a section names, as the drawer and modal do.
+ */
+/** The shape this module reads — deliberately narrower than any form schema. */
+export interface InlineFieldSource {
+    customFields?: unknown;
+    sections?: unknown;
+}
+/**
+ * Whether the author declared the form's fields inline, i.e. the form is a
+ * self-contained collector whose `onSuccess` is the write.
+ *
+ * Literally `SimpleObjectForm`'s test, kept in one place so the six renderers
+ * cannot answer it six ways.
+ *
+ * The parameter is `object`, not `InlineFieldSource`: TypeScript's weak-type
+ * check rejects an argument sharing no property with a wholly-optional
+ * interface, so a caller whose schema type declares neither key could not pass
+ * it. `TabbedFormSchema` / `SplitFormSchema` / `WizardFormSchema` declared no
+ * `customFields` while they did not render it, since declaring a field source a
+ * renderer ignores is the declared-≠-enforced shape objectui#6300 set out to
+ * undo; they declare it since objectui#10254, which made them render it.
+ */
+export declare function hasInlineFieldSource(schema: object | null | undefined): boolean;
+/**
+ * The refusal message. `SimpleObjectForm`'s own wording, verbatim, so a host
+ * that already matches on it sees one string from all six renderers.
+ */
+export declare const NO_SUBMIT_TARGET_MESSAGE = "DataSource is required for form submission (inline mode not configured)";
+/**
+ * The refusal itself.
+ *
+ * Thrown from INSIDE each container's persistence chain — as the branch taken
+ * when none of the real routes (host seam / create / OCC-guarded edit) applies
+ * — rather than from a pre-`try` guard, for two reasons:
+ *
+ *  1. it is where the fact belongs: "there is no route to persist by" is a
+ *     verdict about the persistence chain, and expressing it there is also what
+ *     lets TypeScript narrow `dataSource` for the routes that use it, with no
+ *     assertion;
+ *  2. the container's `catch` runs `schema.onError?.(err)` and RETHROWS, so the
+ *     host learns why. That is what turns the `MasterDetailForm` reading above
+ *     from `toast.success("Created")` into `toast.error(<this message>)` with
+ *     the form left intact — the visible half of the fix.
+ */
+export declare function noSubmitTargetError(): Error;
+//# sourceMappingURL=submitTarget.d.ts.map

package/dist/submitTarget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submitTarget.d.ts","sourceRoot":"","sources":["../src/submitTarget.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAkCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAI/E;AAED;;;GAGG;AACH,eAAO,MAAM,wBAAwB,4EACsC,CAAC;AAE5E;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,IAAI,KAAK,CAE3C"}

package/dist/successBehavior.d.ts

@@ -9,17 +9,53 @@
  * for another entry (`resetOnSuccess`).
  *
  * Kept dependency-free on purpose: importing the redirect guard from
- * EmbeddableForm would create a cycle (EmbeddableForm → ObjectForm → WizardForm
- * → here), so the same-origin check is inlined.
+ * EmbeddableForm would create a cycle (EmbeddableForm -> ObjectForm ->
+ * WizardForm -> here), so the destination test below is local to this module.
  */
 export type { SubmitBehavior } from '@object-ui/types';
-/** Same-origin guard for declarative navigation (relative or absolute URLs). */
-export declare function isSameOriginUrl(rawUrl: string): boolean;
 /**
- * Resolve a `navigateOnSuccess` template into a safe URL: interpolate
- * `{id}` / `{recordId}` from the created/updated record and same-origin-guard it.
- * Returns null when there's no template, no usable id, or the URL fails the
- * guard — callers then fall back to a toast.
+ * Resolve a `navigateOnSuccess` template into the relative destination to
+ * navigate to, or refuse it. Returns null when there is no template, no usable
+ * id, or the resolved value is out of contract — callers then show the success
+ * toast carrying `NAVIGATE_ON_SUCCESS_REFUSED_NOTE`.
+ *
+ * ## The contract (maintainer ruling, 2026-08-17, objectui#5034)
+ *
+ * `navigateOnSuccess` is the pre-ruling ancestor of the `submitBehavior` family,
+ * not a second dialect, and it is **deprecated in favour of `submitBehavior`**
+ * (which already takes precedence over it, pinned). As a compat alias it runs
+ * under the semantics objectstack#7496 ruled for that family:
+ *
+ *   1. **relative paths only.** A same-origin ABSOLUTE value is refused like any
+ *      other out-of-contract value — not routed differently, refused. The
+ *      destination is authored metadata, which is exactly where an address
+ *      somebody else chose gets copied in.
+ *   2. **the interpolated value is URL-escaped** when the destination is built.
+ *   3. the `{id}` / `{recordId}` dialect **stays** for existing authors of this
+ *      key. It is the one part deliberately not converged: the ruling keeps the
+ *      spelling working and points new authoring at `submitBehavior` instead.
+ *
+ * ## Why both halves are needed, and neither substitutes for the other
+ *
+ * The escape is what stops a token from adding path STRUCTURE. Interpolated raw,
+ * `{id}` with an address in it becomes the whole destination, and `/r/{id}` with
+ * `a/b` in it silently grows a path segment. Relative-only is a rule about where
+ * a destination STARTS, so it has nothing to say about structure injected
+ * further along — the argument `submitRedirect.ts` records for the ruled sibling,
+ * which holds here verbatim.
+ *
+ * Conversely the escape alone would not refuse an authored absolute, because the
+ * template is the AUTHOR's and only the substituted value passes through
+ * `encodeURIComponent`. So: escape the data, judge the result.
+ *
+ * ## This can only narrow what is reachable
+ *
+ * Every destination this returns is a relative reference, and every relative
+ * reference was already accepted by the same-origin guard it replaces (a
+ * relative reference cannot carry an authority, RFC 3986, so it always resolves
+ * to the current origin). Escaping only ever maps an id onto one opaque segment.
+ * So the set of addresses reachable through this key is a strict subset of the
+ * set reachable before — there is no value that was refused and is now followed.
  */
 export declare function resolveSuccessNavigate(template: string | undefined, record: any): string | null;
 //# sourceMappingURL=successBehavior.d.ts.map

package/dist/successBehavior.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"successBehavior.d.ts","sourceRoot":"","sources":["../src/successBehavior.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAQvD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,GAAG,GACV,MAAM,GAAG,IAAI,CAMf"}
+{"version":3,"file":"successBehavior.d.ts","sourceRoot":"","sources":["../src/successBehavior.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AA0DvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,GAAG,GACV,MAAM,GAAG,IAAI,CAWf"}

package/dist/thankYouRedirectCountdown.d.ts

@@ -0,0 +1,17 @@
+import { PendingThankYouRedirect } from './thankYouRedirectNavigation.js';
+/** One tick per displayed second — matches the `{{seconds}}` unit the copy promises. */
+export declare const REDIRECT_COUNTDOWN_TICK_MS = 1000;
+/**
+ * The remaining whole seconds of an accepted thank-you redirect wait, ticking
+ * down once per second until it reaches 0. `null` while nothing is pending —
+ * the panel keeps deciding on its own whether a countdown renders at all (a
+ * refused destination, objectui#5073, never reaches this hook with a
+ * non-null `pending`).
+ *
+ * Pass the same `PendingThankYouRedirect | null` value given to
+ * `useThankYouRedirectNavigation`. This hook does not navigate anything and
+ * does not judge the destination — it only counts down the delay that was
+ * captured alongside it.
+ */
+export declare function useRedirectCountdownSeconds(pending: PendingThankYouRedirect | null): number | null;
+//# sourceMappingURL=thankYouRedirectCountdown.d.ts.map