fix(fields): FieldEditWidget delivers the declared NON-DOM host-plumbing block

.changeset/7008-field-edit-widget-host-plumbing.md

@@ -0,0 +1,33 @@
+---
+'@object-ui/fields': minor
+'@object-ui/plugin-kanban': patch
+---
+
+`FieldEditWidget` now delivers the NON-DOM half of the contract it declares (objectui#7008).
+
+objectui#7009 made the factory forward its declared DOM pass-through block. The rest of
+`FieldWidgetComponentProps` was still dropped: `error`, `onUploadingChange`, and the whole
+"Host plumbing" block (`dataSource`, `dependentValues`, `dependsOn`, `dependsOnLabels`,
+`emptyHint`, `onSelectRecord`, `onCreateNew`). A host could pass any of them with no type
+error and the widget never received it — the "declared but not delivered" class this
+package treats as first-class.
+
+`error` was the live one. `InlineFieldInput` has passed `error` into this factory since
+PR #7109 and the factory dropped it, so an inline-edit control that had failed validation
+never reported `aria-invalid`: a sighted user saw the red hint, a screen-reader user was
+told nothing. The kanban `RequiredFieldsDialog` had the same hole from the other side — it
+computes the validation state and could not hand it over — and now passes `error`, so its
+controls are marked. Delivering `error` buys the a11y MARKING only; the message text stays
+with the host, per the objectui#3222 contract.
+
+The keys travel through a new sibling executor, `toHostProps` (exported alongside
+`toDomProps`), never through the DOM whitelist — none of them is DOM-legal, and routing a
+`dataSource` adapter there is the `[object Object]` leak that whitelist exists to stop.
+Three compile-time assertions make the two executors partition the contract, so a future
+declared key cannot go undelivered silently.
+
+`dataSource` precedence is stated rather than left to emerge: a host's explicit
+`dataSource` prop WINS over `SchemaRendererContext`. That is the order `LookupField`
+already implements; the factory is a conduit and resolves nothing. A host that passes no
+`dataSource` keeps reading the context exactly as before, so no in-repo host changes
+behaviour.

packages/fields/src/FieldEditWidget.tsx

@@ -11,6 +11,9 @@ import type { FieldWidgetComponentProps } from './widgets/types.js';
 // The package's own executor of the DOM pass-through declaration, reused here
 // rather than re-listed — see the note on this component's return statement.
 import { toDomProps } from './widgets/toDomProps.js';
+// The package's own executor of the NON-DOM half of the same declaration
+// (objectui#7008) — a separate function because those keys are not DOM-legal.
+import { toHostProps } from './widgets/toHostProps.js';
 
 // The SAME dedicated widgets the form renders — reused for in-place editing
 // (e.g. the data grid's inline cell editor) so a select edits as a dropdown, a
@@ -271,6 +274,40 @@ const COMPACT_EDIT_TYPES = new Set<string>(['lookup', 'master_detail', 'user']);
  * each widget's own whitelist carries these onto the real focusable control, so
  * nothing here needs to know which element that is. A host that passes nothing
  * is unaffected.
+ *
+ * The host's NON-DOM set is forwarded WHOLE too (objectui#7008), through the
+ * sibling executor `toHostProps`. The DOM fix left the other half of the
+ * contract undelivered: `error`, `onUploadingChange` and the "Host plumbing"
+ * block (`dataSource`, `dependentValues`, `dependsOn`, `dependsOnLabels`,
+ * `emptyHint`, `onSelectRecord`, `onCreateNew`) still type-checked, read as
+ * supported, and never reached the widget. `error` was the live one:
+ * `InlineFieldInput` has passed `error={error}` since PR #7109 and this factory
+ * dropped it, so a control that had failed validation never reported
+ * `aria-invalid`. Forwarding is not a widening — every one of those keys is
+ * already declared on `FieldWidgetComponentProps`, the same argument #7009
+ * landed on in this file.
+ *
+ * ⛔ They do NOT go through `toDomProps`. None of them is DOM-legal, and that
+ * whitelist is closed for exactly this reason — a `dataSource` adapter routed
+ * there becomes `dataSource="[object Object]"` on an `<input>`, the leak the
+ * helper exists to prevent. `toHostProps`' direction-3 assertion makes the two
+ * sets provably disjoint, so the order of the two spreads below is not a
+ * question anyone has to answer again.
+ *
+ * ## `dataSource` precedence: the explicit prop WINS
+ *
+ * Delivering `dataSource` can change behaviour where before it could not
+ * arrive, because the relational widgets fall back to `SchemaRendererContext`
+ * (which the grid already provides). The precedence is therefore STATED rather
+ * than left to emerge: **a host's explicit `dataSource` prop wins over the
+ * context**. That is not a new decision — `LookupField` already resolves
+ * `props.dataSource ?? lookupField?.dataSource ?? fieldMeta?.dataSource ??
+ * contextDataSource` and documents that order on the line that does it. This
+ * factory is a CONDUIT and resolves nothing: adding a resolution here would
+ * give `dataSource` a second author, the `field || schema` shape objectui#3233
+ * removed. A host that passes no `dataSource` keeps reading the context exactly
+ * as before, so no in-repo host changes behaviour. The full per-key precedence
+ * table lives on `toHostProps`, next to the list it governs.
  */
 export function FieldEditWidget(
  props: FieldWidgetComponentProps<any>,
@@ -324,9 +361,17 @@ export function FieldEditWidget(
  // The semantic props stay explicit and come AFTER the spread. They are not in
  // the whitelist, so there is no collision to resolve; ordering them this way
  // states that this component OWNS them and a host cannot displace them.
+ //
+ // `toHostProps` is the same reuse argument applied to the other half of the
+ // declaration (objectui#7008): the declared NON-DOM keys — `error` and the
+ // "Host plumbing" block — travel as COMPONENT props, never through the DOM
+ // whitelist, which is closed against exactly them. The two executors are
+ // asserted disjoint at compile time, so neither spread can shadow the other,
+ // and `compact` below still wins because the factory owns it.
  return (
  <Widget
  {...toDomProps(props)}
+ {...toHostProps(props)}
  field={field}
  value={value}
  onChange={onChange}

packages/fields/src/__tests__/FieldEditWidget.hostPlumbing-7008.test.tsx

@@ -0,0 +1,229 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * `FieldEditWidget` DELIVERS the NON-DOM half of the contract it DECLARES
+ * (objectui#7008) — the other half of objectui#6909 / #7009.
+ *
+ * ## The defect this pins closed
+ *
+ * #7009 made the factory forward `toDomProps(props)`, so the declared DOM block
+ * finally arrived. `FieldWidgetComponentProps` also declares `error`,
+ * `onUploadingChange`, and a whole "Host plumbing" block (`dataSource`,
+ * `dependentValues`, `dependsOn`, `dependsOnLabels`, `emptyHint`,
+ * `onSelectRecord`, `onCreateNew`) — and nothing carried any of it. A host
+ * passed them with no type error and the widget never received them.
+ *
+ * `error` was the LIVE one, and measurably so on `main` at `71d83a6b1`:
+ * `InlineFieldInput` (`@object-ui/plugin-detail`, since PR #7109) already
+ * passes `error={error}` into this factory, which dropped it — so a control
+ * that had failed validation never reported `aria-invalid`. A sighted user saw
+ * the red hint; a screen-reader user was told nothing. That is the class
+ * objectui#3222 / #3290 exist to close, and the one #7002 closed for
+ * `NumberField` one layer down.
+ *
+ * ## What binds it, and what this file adds
+ *
+ * The fix hands the widget `toHostProps(props)` — a SIBLING executor, not more
+ * entries in `DOM_PASS_THROUGH_KEYS`, because none of these keys is DOM-legal
+ * and that whitelist is closed against exactly them. Three compile-time
+ * assertions in `toHostProps.ts` make the two executors PARTITION the contract,
+ * so a future declared key cannot go undelivered without a red build.
+ *
+ * A type cannot see the two things this file pins: that the keys ARRIVE at
+ * runtime, and that arriving actually changes what assistive tech is told.
+ */
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { render, cleanup, waitFor } from '@testing-library/react';
+import '@testing-library/jest-dom';
+import React from 'react';
+import { SchemaRendererContext } from '@object-ui/react';
+
+import { FieldEditWidget } from '../FieldEditWidget';
+import type { FieldWidgetComponentProps } from '../widgets/types';
+
+afterEach(() => cleanup());
+
+/** `select` resolves to `SelectField`, whose trigger carries `aria-invalid`. */
+const SELECT_FIELD = {
+ name: 'stage',
+ type: 'select',
+ label: 'Stage',
+ options: [{ label: 'New', value: 'new' }],
+} as never;
+
+/** `text` resolves to `TextField` — used only where the widget is irrelevant. */
+const TEXT_FIELD = { name: 'f', type: 'text', label: 'F' } as never;
+
+describe('FieldEditWidget delivers its declared NON-DOM block (objectui#7008)', () => {
+ it('forwards every declared host-plumbing key it is handed, at the factory boundary', () => {
+ const onUploadingChange = vi.fn();
+ const onSelectRecord = vi.fn();
+ const onCreateNew = vi.fn();
+ const dataSource = { find: vi.fn() };
+
+ // `zzcanary` is the control, carried over from the #7009 pin: NOT declared
+ // on `FieldWidgetComponentProps` (passing it is a compile error, hence the
+ // cast), but an SDUI node or a field config can carry exactly such a key at
+ // runtime. Without it, "everything forwards now" would be
+ // indistinguishable from having reopened the bare `{...props}` spread.
+ const props = {
+ field: TEXT_FIELD,
+ value: '',
+ onChange: () => {},
+ readonly: false,
+ // the two declared controlled-input keys the factory neither owns nor
+ // routes to the DOM
+ error: 'Required',
+ onUploadingChange,
+ // the declared "Host plumbing" block, minus `compact` (factory-owned)
+ dataSource,
+ dependentValues: { account: 'a1' },
+ dependsOn: 'account',
+ dependsOnLabels: { account: 'Account' },
+ emptyHint: 'Pick an account first',
+ onSelectRecord,
+ onCreateNew,
+ zzcanary: 'CANARY-STR',
+ } as unknown as FieldWidgetComponentProps<string>;
+
+ // Called as a plain function rather than rendered: it uses no hooks and its
+ // return value IS the widget element, so this reads the handoff itself.
+ const element = FieldEditWidget(props);
+ expect(element).not.toBeNull();
+ const forwarded = element!.props as Record<string, unknown>;
+
+ // Exact set, not a subset — a subset check cannot see the control key, and
+ // an extra key appearing here is the leak this guards.
+ expect(Object.keys(forwarded).sort()).toEqual(
+ [
+ // rendered by the factory itself
+ 'field',
+ 'value',
+ 'onChange',
+ 'readonly',
+ // the declared NON-DOM keys, via `toHostProps`
+ 'error',
+ 'onUploadingChange',
+ 'dataSource',
+ 'dependentValues',
+ 'dependsOn',
+ 'dependsOnLabels',
+ 'emptyHint',
+ 'onSelectRecord',
+ 'onCreateNew',
+ ].sort(),
+ );
+
+ // Identity, not just presence: a conduit hands over the host's own object.
+ expect(forwarded.dataSource).toBe(dataSource);
+ expect(forwarded.onSelectRecord).toBe(onSelectRecord);
+ expect(forwarded.onCreateNew).toBe(onCreateNew);
+ expect(forwarded.onUploadingChange).toBe(onUploadingChange);
+ expect(forwarded.error).toBe('Required');
+
+ // CONTROL: the undeclared authored key is still dropped.
+ expect(forwarded).not.toHaveProperty('zzcanary');
+ });
+
+ it('CONTROL: a key the host did not pass stays ABSENT, not `undefined`', () => {
+ // The #7009 pin asserts an exact boundary set for a host that passes only
+ // DOM keys. Forwarding the non-DOM block as nine always-present
+ // `undefined`s would have broken that pin AND made the boundary unreadable
+ // — "what the host supplied" is the claim, so absence must survive.
+ const element = FieldEditWidget({
+ field: TEXT_FIELD,
+ value: '',
+ onChange: () => {},
+ } as FieldWidgetComponentProps<string>);
+ expect(element).not.toBeNull();
+ const forwarded = element!.props as Record<string, unknown>;
+
+ for (const key of [
+ 'error',
+ 'onUploadingChange',
+ 'dataSource',
+ 'dependentValues',
+ 'dependsOn',
+ 'dependsOnLabels',
+ 'emptyHint',
+ 'onSelectRecord',
+ 'onCreateNew',
+ ]) {
+ expect(forwarded).not.toHaveProperty(key);
+ }
+ // CONTROL: the factory's own props are still there, so the assertion above
+ // is not passing because the handoff is empty.
+ expect(forwarded).toHaveProperty('field');
+ expect(forwarded).toHaveProperty('value');
+ });
+
+ it('`error` reaches a real control as `aria-invalid` — the live a11y defect', async () => {
+ const { getByTestId, rerender } = render(
+ <FieldEditWidget field={SELECT_FIELD} value="" onChange={() => {}} error="Required" />,
+ );
+ // `SelectField` puts the DOM pass-through and `aria-invalid` on
+ // `SelectTrigger` — the focusable `button role="combobox"` the user and
+ // their screen reader actually meet (objectui#3306) — not on Radix `Root`,
+ // which renders no element.
+ const trigger = getByTestId('select-trigger-stage');
+ expect(trigger.tagName).toBe('BUTTON');
+ expect(trigger).toHaveAttribute('aria-invalid', 'true');
+
+ // CONTROL: the same widget, same host, no `error`. `SelectField` computes
+ // `!!error`, so a valid field SAYS "false" rather than staying mute — which
+ // makes this a real two-state reading and not "the attribute exists".
+ rerender(<FieldEditWidget field={SELECT_FIELD} value="" onChange={() => {}} />);
+ expect(getByTestId('select-trigger-stage')).toHaveAttribute('aria-invalid', 'false');
+ });
+
+ it('`dataSource`: the explicit prop WINS over SchemaRendererContext', async () => {
+ // The one delivered key that can CHANGE behaviour rather than only add it:
+ // the relational widgets fall back to `SchemaRendererContext` (which the
+ // grid already provides), so delivering the prop creates a precedence
+ // question. `LookupField` already resolves "explicit prop > field-level >
+ // wrapper field > SchemaRendererContext > none"; the factory is a conduit
+ // and adds no second authority. This pins that the delivered prop is what
+ // the widget ends up querying.
+ const LOOKUP_FIELD = { name: 'account', type: 'lookup', reference_to: 'accounts' } as never;
+ const makeSource = () => ({
+ find: vi.fn().mockResolvedValue([]),
+ getObjectSchema: vi.fn().mockResolvedValue({ name: 'accounts' }),
+ });
+
+ const fromProp = makeSource();
+ const fromContext = makeSource();
+
+ render(
+ <SchemaRendererContext.Provider value={{ dataSource: fromContext } as never}>
+ <FieldEditWidget
+ field={LOOKUP_FIELD}
+ value={undefined}
+ onChange={() => {}}
+ dataSource={fromProp}
+ />
+ </SchemaRendererContext.Provider>,
+ );
+
+ await waitFor(() => expect(fromProp.getObjectSchema).toHaveBeenCalledWith('accounts'));
+ expect(fromContext.getObjectSchema).not.toHaveBeenCalled();
+
+ cleanup();
+
+ // CONTROL: drop the prop and the SAME context source IS queried. Without
+ // this, "the context was not called" would be indistinguishable from a
+ // context that was never wired up in this test at all.
+ const contextOnly = makeSource();
+ render(
+ <SchemaRendererContext.Provider value={{ dataSource: contextOnly } as never}>
+ <FieldEditWidget field={LOOKUP_FIELD} value={undefined} onChange={() => {}} />
+ </SchemaRendererContext.Provider>,
+ );
+ await waitFor(() => expect(contextOnly.getObjectSchema).toHaveBeenCalledWith('accounts'));
+ });
+});

packages/fields/src/index.tsx

@@ -3347,6 +3347,15 @@ export { withFieldCarrier } from './withFieldCarrier.js';
 export { toDomProps } from './widgets/toDomProps.js';
 export type { DomProps } from './widgets/toDomProps.js';
 
+// The sibling executor for the NON-DOM half of the same declaration
+// (objectui#7008): `error` plus the "Host plumbing" block, forwarded as
+// COMPONENT props because none of them is DOM-legal. Exported alongside
+// `toDomProps` because a host factory authored outside this repo needs the
+// pair — reaching for only the first one is how `FieldEditWidget` came to
+// deliver half the contract it declares.
+export { toHostProps } from './widgets/toHostProps.js';
+export type { HostProps } from './widgets/toHostProps.js';
+
 // The native date/time control value adapters (objectui#3127). `DateTimeField`
 // is ISO-canonical on BOTH sides — it takes the record's ISO instant and hands
 // an ISO instant back, which is also the wire form the platform's `datetime`

packages/fields/src/widgets/toDomProps.ts

@@ -123,7 +123,16 @@ const DOM_PASS_THROUGH_KEYS = [
  'disabled',
 ] as const;
 
-type DomPassThroughKey = (typeof DOM_PASS_THROUGH_KEYS)[number];
+/**
+ * The keys this helper forwards.
+ *
+ * Exported so the SIBLING executor — `toHostProps`, which carries the declared
+ * NON-DOM keys (objectui#7008) — can subtract this set from the contract and
+ * assert that the two together cover every declared key exactly once. Without
+ * that subtraction there is no way to state "these keys are handled elsewhere"
+ * as a compile-time fact rather than as a comment.
+ */
+export type DomPassThroughKey = (typeof DOM_PASS_THROUGH_KEYS)[number];
 
 /**
  * Compile-time link to the declaration, direction 1 of 2: every key forwarded

.changeset/7008-field-edit-widget-host-plumbing.md

@@ -0,0 +1,33 @@
+---
+'@object-ui/fields': minor
+'@object-ui/plugin-kanban': patch
+---
+
+`FieldEditWidget` now delivers the NON-DOM half of the contract it declares (objectui#7008).
+
+objectui#7009 made the factory forward its declared DOM pass-through block. The rest of
+`FieldWidgetComponentProps` was still dropped: `error`, `onUploadingChange`, and the whole
+"Host plumbing" block (`dataSource`, `dependentValues`, `dependsOn`, `dependsOnLabels`,
+`emptyHint`, `onSelectRecord`, `onCreateNew`). A host could pass any of them with no type
+error and the widget never received it — the "declared but not delivered" class this
+package treats as first-class.
+
+`error` was the live one. `InlineFieldInput` has passed `error` into this factory since
+PR #7109 and the factory dropped it, so an inline-edit control that had failed validation
+never reported `aria-invalid`: a sighted user saw the red hint, a screen-reader user was
+told nothing. The kanban `RequiredFieldsDialog` had the same hole from the other side — it
+computes the validation state and could not hand it over — and now passes `error`, so its
+controls are marked. Delivering `error` buys the a11y MARKING only; the message text stays
+with the host, per the objectui#3222 contract.
+
+The keys travel through a new sibling executor, `toHostProps` (exported alongside
+`toDomProps`), never through the DOM whitelist — none of them is DOM-legal, and routing a
+`dataSource` adapter there is the `[object Object]` leak that whitelist exists to stop.
+Three compile-time assertions make the two executors partition the contract, so a future
+declared key cannot go undelivered silently.
+
+`dataSource` precedence is stated rather than left to emerge: a host's explicit
+`dataSource` prop WINS over `SchemaRendererContext`. That is the order `LookupField`
+already implements; the factory is a conduit and resolves nothing. A host that passes no
+`dataSource` keeps reading the context exactly as before, so no in-repo host changes
+behaviour.

packages/fields/src/FieldEditWidget.tsx

@@ -11,6 +11,9 @@ import type { FieldWidgetComponentProps } from './widgets/types.js';
 // The package's own executor of the DOM pass-through declaration, reused here
 // rather than re-listed — see the note on this component's return statement.
 import { toDomProps } from './widgets/toDomProps.js';
+// The package's own executor of the NON-DOM half of the same declaration
+// (objectui#7008) — a separate function because those keys are not DOM-legal.
+import { toHostProps } from './widgets/toHostProps.js';
 
 // The SAME dedicated widgets the form renders — reused for in-place editing
 // (e.g. the data grid's inline cell editor) so a select edits as a dropdown, a
@@ -271,6 +274,40 @@ const COMPACT_EDIT_TYPES = new Set<string>(['lookup', 'master_detail', 'user']);
  * each widget's own whitelist carries these onto the real focusable control, so
  * nothing here needs to know which element that is. A host that passes nothing
  * is unaffected.
+ *
+ * The host's NON-DOM set is forwarded WHOLE too (objectui#7008), through the
+ * sibling executor `toHostProps`. The DOM fix left the other half of the
+ * contract undelivered: `error`, `onUploadingChange` and the "Host plumbing"
+ * block (`dataSource`, `dependentValues`, `dependsOn`, `dependsOnLabels`,
+ * `emptyHint`, `onSelectRecord`, `onCreateNew`) still type-checked, read as
+ * supported, and never reached the widget. `error` was the live one:
+ * `InlineFieldInput` has passed `error={error}` since PR #7109 and this factory
+ * dropped it, so a control that had failed validation never reported
+ * `aria-invalid`. Forwarding is not a widening — every one of those keys is
+ * already declared on `FieldWidgetComponentProps`, the same argument #7009
+ * landed on in this file.
+ *
+ * ⛔ They do NOT go through `toDomProps`. None of them is DOM-legal, and that
+ * whitelist is closed for exactly this reason — a `dataSource` adapter routed
+ * there becomes `dataSource="[object Object]"` on an `<input>`, the leak the
+ * helper exists to prevent. `toHostProps`' direction-3 assertion makes the two
+ * sets provably disjoint, so the order of the two spreads below is not a
+ * question anyone has to answer again.
+ *
+ * ## `dataSource` precedence: the explicit prop WINS
+ *
+ * Delivering `dataSource` can change behaviour where before it could not
+ * arrive, because the relational widgets fall back to `SchemaRendererContext`
+ * (which the grid already provides). The precedence is therefore STATED rather
+ * than left to emerge: **a host's explicit `dataSource` prop wins over the
+ * context**. That is not a new decision — `LookupField` already resolves
+ * `props.dataSource ?? lookupField?.dataSource ?? fieldMeta?.dataSource ??
+ * contextDataSource` and documents that order on the line that does it. This
+ * factory is a CONDUIT and resolves nothing: adding a resolution here would
+ * give `dataSource` a second author, the `field || schema` shape objectui#3233
+ * removed. A host that passes no `dataSource` keeps reading the context exactly
+ * as before, so no in-repo host changes behaviour. The full per-key precedence
+ * table lives on `toHostProps`, next to the list it governs.
  */
 export function FieldEditWidget(
  props: FieldWidgetComponentProps<any>,
@@ -324,9 +361,17 @@ export function FieldEditWidget(
  // The semantic props stay explicit and come AFTER the spread. They are not in
  // the whitelist, so there is no collision to resolve; ordering them this way
  // states that this component OWNS them and a host cannot displace them.
+ //
+ // `toHostProps` is the same reuse argument applied to the other half of the
+ // declaration (objectui#7008): the declared NON-DOM keys — `error` and the
+ // "Host plumbing" block — travel as COMPONENT props, never through the DOM
+ // whitelist, which is closed against exactly them. The two executors are
+ // asserted disjoint at compile time, so neither spread can shadow the other,
+ // and `compact` below still wins because the factory owns it.
  return (
  <Widget
  {...toDomProps(props)}
+ {...toHostProps(props)}
  field={field}
  value={value}
  onChange={onChange}

packages/fields/src/__tests__/FieldEditWidget.hostPlumbing-7008.test.tsx

@@ -0,0 +1,229 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * `FieldEditWidget` DELIVERS the NON-DOM half of the contract it DECLARES
+ * (objectui#7008) — the other half of objectui#6909 / #7009.
+ *
+ * ## The defect this pins closed
+ *
+ * #7009 made the factory forward `toDomProps(props)`, so the declared DOM block
+ * finally arrived. `FieldWidgetComponentProps` also declares `error`,
+ * `onUploadingChange`, and a whole "Host plumbing" block (`dataSource`,
+ * `dependentValues`, `dependsOn`, `dependsOnLabels`, `emptyHint`,
+ * `onSelectRecord`, `onCreateNew`) — and nothing carried any of it. A host
+ * passed them with no type error and the widget never received them.
+ *
+ * `error` was the LIVE one, and measurably so on `main` at `71d83a6b1`:
+ * `InlineFieldInput` (`@object-ui/plugin-detail`, since PR #7109) already
+ * passes `error={error}` into this factory, which dropped it — so a control
+ * that had failed validation never reported `aria-invalid`. A sighted user saw
+ * the red hint; a screen-reader user was told nothing. That is the class
+ * objectui#3222 / #3290 exist to close, and the one #7002 closed for
+ * `NumberField` one layer down.
+ *
+ * ## What binds it, and what this file adds
+ *
+ * The fix hands the widget `toHostProps(props)` — a SIBLING executor, not more
+ * entries in `DOM_PASS_THROUGH_KEYS`, because none of these keys is DOM-legal
+ * and that whitelist is closed against exactly them. Three compile-time
+ * assertions in `toHostProps.ts` make the two executors PARTITION the contract,
+ * so a future declared key cannot go undelivered without a red build.
+ *
+ * A type cannot see the two things this file pins: that the keys ARRIVE at
+ * runtime, and that arriving actually changes what assistive tech is told.
+ */
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { render, cleanup, waitFor } from '@testing-library/react';
+import '@testing-library/jest-dom';
+import React from 'react';
+import { SchemaRendererContext } from '@object-ui/react';
+
+import { FieldEditWidget } from '../FieldEditWidget';
+import type { FieldWidgetComponentProps } from '../widgets/types';
+
+afterEach(() => cleanup());
+
+/** `select` resolves to `SelectField`, whose trigger carries `aria-invalid`. */
+const SELECT_FIELD = {
+ name: 'stage',
+ type: 'select',
+ label: 'Stage',
+ options: [{ label: 'New', value: 'new' }],
+} as never;
+
+/** `text` resolves to `TextField` — used only where the widget is irrelevant. */
+const TEXT_FIELD = { name: 'f', type: 'text', label: 'F' } as never;
+
+describe('FieldEditWidget delivers its declared NON-DOM block (objectui#7008)', () => {
+ it('forwards every declared host-plumbing key it is handed, at the factory boundary', () => {
+ const onUploadingChange = vi.fn();
+ const onSelectRecord = vi.fn();
+ const onCreateNew = vi.fn();
+ const dataSource = { find: vi.fn() };
+
+ // `zzcanary` is the control, carried over from the #7009 pin: NOT declared
+ // on `FieldWidgetComponentProps` (passing it is a compile error, hence the
+ // cast), but an SDUI node or a field config can carry exactly such a key at
+ // runtime. Without it, "everything forwards now" would be
+ // indistinguishable from having reopened the bare `{...props}` spread.
+ const props = {
+ field: TEXT_FIELD,
+ value: '',
+ onChange: () => {},
+ readonly: false,
+ // the two declared controlled-input keys the factory neither owns nor
+ // routes to the DOM
+ error: 'Required',
+ onUploadingChange,
+ // the declared "Host plumbing" block, minus `compact` (factory-owned)
+ dataSource,
+ dependentValues: { account: 'a1' },
+ dependsOn: 'account',
+ dependsOnLabels: { account: 'Account' },
+ emptyHint: 'Pick an account first',
+ onSelectRecord,
+ onCreateNew,
+ zzcanary: 'CANARY-STR',
+ } as unknown as FieldWidgetComponentProps<string>;
+
+ // Called as a plain function rather than rendered: it uses no hooks and its
+ // return value IS the widget element, so this reads the handoff itself.
+ const element = FieldEditWidget(props);
+ expect(element).not.toBeNull();
+ const forwarded = element!.props as Record<string, unknown>;
+
+ // Exact set, not a subset — a subset check cannot see the control key, and
+ // an extra key appearing here is the leak this guards.
+ expect(Object.keys(forwarded).sort()).toEqual(
+ [
+ // rendered by the factory itself
+ 'field',
+ 'value',
+ 'onChange',
+ 'readonly',
+ // the declared NON-DOM keys, via `toHostProps`
+ 'error',
+ 'onUploadingChange',
+ 'dataSource',
+ 'dependentValues',
+ 'dependsOn',
+ 'dependsOnLabels',
+ 'emptyHint',
+ 'onSelectRecord',
+ 'onCreateNew',
+ ].sort(),
+ );
+
+ // Identity, not just presence: a conduit hands over the host's own object.
+ expect(forwarded.dataSource).toBe(dataSource);
+ expect(forwarded.onSelectRecord).toBe(onSelectRecord);
+ expect(forwarded.onCreateNew).toBe(onCreateNew);
+ expect(forwarded.onUploadingChange).toBe(onUploadingChange);
+ expect(forwarded.error).toBe('Required');
+
+ // CONTROL: the undeclared authored key is still dropped.
+ expect(forwarded).not.toHaveProperty('zzcanary');
+ });
+
+ it('CONTROL: a key the host did not pass stays ABSENT, not `undefined`', () => {
+ // The #7009 pin asserts an exact boundary set for a host that passes only
+ // DOM keys. Forwarding the non-DOM block as nine always-present
+ // `undefined`s would have broken that pin AND made the boundary unreadable
+ // — "what the host supplied" is the claim, so absence must survive.
+ const element = FieldEditWidget({
+ field: TEXT_FIELD,
+ value: '',
+ onChange: () => {},
+ } as FieldWidgetComponentProps<string>);
+ expect(element).not.toBeNull();
+ const forwarded = element!.props as Record<string, unknown>;
+
+ for (const key of [
+ 'error',
+ 'onUploadingChange',
+ 'dataSource',
+ 'dependentValues',
+ 'dependsOn',
+ 'dependsOnLabels',
+ 'emptyHint',
+ 'onSelectRecord',
+ 'onCreateNew',
+ ]) {
+ expect(forwarded).not.toHaveProperty(key);
+ }
+ // CONTROL: the factory's own props are still there, so the assertion above
+ // is not passing because the handoff is empty.
+ expect(forwarded).toHaveProperty('field');
+ expect(forwarded).toHaveProperty('value');
+ });
+
+ it('`error` reaches a real control as `aria-invalid` — the live a11y defect', async () => {
+ const { getByTestId, rerender } = render(
+ <FieldEditWidget field={SELECT_FIELD} value="" onChange={() => {}} error="Required" />,
+ );
+ // `SelectField` puts the DOM pass-through and `aria-invalid` on
+ // `SelectTrigger` — the focusable `button role="combobox"` the user and
+ // their screen reader actually meet (objectui#3306) — not on Radix `Root`,
+ // which renders no element.
+ const trigger = getByTestId('select-trigger-stage');
+ expect(trigger.tagName).toBe('BUTTON');
+ expect(trigger).toHaveAttribute('aria-invalid', 'true');
+
+ // CONTROL: the same widget, same host, no `error`. `SelectField` computes
+ // `!!error`, so a valid field SAYS "false" rather than staying mute — which
+ // makes this a real two-state reading and not "the attribute exists".
+ rerender(<FieldEditWidget field={SELECT_FIELD} value="" onChange={() => {}} />);
+ expect(getByTestId('select-trigger-stage')).toHaveAttribute('aria-invalid', 'false');
+ });
+
+ it('`dataSource`: the explicit prop WINS over SchemaRendererContext', async () => {
+ // The one delivered key that can CHANGE behaviour rather than only add it:
+ // the relational widgets fall back to `SchemaRendererContext` (which the
+ // grid already provides), so delivering the prop creates a precedence
+ // question. `LookupField` already resolves "explicit prop > field-level >
+ // wrapper field > SchemaRendererContext > none"; the factory is a conduit
+ // and adds no second authority. This pins that the delivered prop is what
+ // the widget ends up querying.
+ const LOOKUP_FIELD = { name: 'account', type: 'lookup', reference_to: 'accounts' } as never;
+ const makeSource = () => ({
+ find: vi.fn().mockResolvedValue([]),
+ getObjectSchema: vi.fn().mockResolvedValue({ name: 'accounts' }),
+ });
+
+ const fromProp = makeSource();
+ const fromContext = makeSource();
+
+ render(
+ <SchemaRendererContext.Provider value={{ dataSource: fromContext } as never}>
+ <FieldEditWidget
+ field={LOOKUP_FIELD}
+ value={undefined}
+ onChange={() => {}}
+ dataSource={fromProp}
+ />
+ </SchemaRendererContext.Provider>,
+ );
+
+ await waitFor(() => expect(fromProp.getObjectSchema).toHaveBeenCalledWith('accounts'));
+ expect(fromContext.getObjectSchema).not.toHaveBeenCalled();
+
+ cleanup();
+
+ // CONTROL: drop the prop and the SAME context source IS queried. Without
+ // this, "the context was not called" would be indistinguishable from a
+ // context that was never wired up in this test at all.
+ const contextOnly = makeSource();
+ render(
+ <SchemaRendererContext.Provider value={{ dataSource: contextOnly } as never}>
+ <FieldEditWidget field={LOOKUP_FIELD} value={undefined} onChange={() => {}} />
+ </SchemaRendererContext.Provider>,
+ );
+ await waitFor(() => expect(contextOnly.getObjectSchema).toHaveBeenCalledWith('accounts'));
+ });
+});

packages/fields/src/index.tsx

@@ -3347,6 +3347,15 @@ export { withFieldCarrier } from './withFieldCarrier.js';
 export { toDomProps } from './widgets/toDomProps.js';
 export type { DomProps } from './widgets/toDomProps.js';
 
+// The sibling executor for the NON-DOM half of the same declaration
+// (objectui#7008): `error` plus the "Host plumbing" block, forwarded as
+// COMPONENT props because none of them is DOM-legal. Exported alongside
+// `toDomProps` because a host factory authored outside this repo needs the
+// pair — reaching for only the first one is how `FieldEditWidget` came to
+// deliver half the contract it declares.
+export { toHostProps } from './widgets/toHostProps.js';
+export type { HostProps } from './widgets/toHostProps.js';
+
 // The native date/time control value adapters (objectui#3127). `DateTimeField`
 // is ISO-canonical on BOTH sides — it takes the record's ISO instant and hands
 // an ISO instant back, which is also the wire form the platform's `datetime`

packages/fields/src/widgets/toDomProps.ts

@@ -123,7 +123,16 @@ const DOM_PASS_THROUGH_KEYS = [
  'disabled',
 ] as const;
 
-type DomPassThroughKey = (typeof DOM_PASS_THROUGH_KEYS)[number];
+/**
+ * The keys this helper forwards.
+ *
+ * Exported so the SIBLING executor — `toHostProps`, which carries the declared
+ * NON-DOM keys (objectui#7008) — can subtract this set from the contract and
+ * assert that the two together cover every declared key exactly once. Without
+ * that subtraction there is no way to state "these keys are handled elsewhere"
+ * as a compile-time fact rather than as a comment.
+ */
+export type DomPassThroughKey = (typeof DOM_PASS_THROUGH_KEYS)[number];
 
 /**
  * Compile-time link to the declaration, direction 1 of 2: every key forwarded

.changeset/7008-field-edit-widget-host-plumbing.md

@@ -0,0 +1,33 @@
+---
+'@object-ui/fields': minor
+'@object-ui/plugin-kanban': patch
+---
+
+`FieldEditWidget` now delivers the NON-DOM half of the contract it declares (objectui#7008).
+
+objectui#7009 made the factory forward its declared DOM pass-through block. The rest of
+`FieldWidgetComponentProps` was still dropped: `error`, `onUploadingChange`, and the whole
+"Host plumbing" block (`dataSource`, `dependentValues`, `dependsOn`, `dependsOnLabels`,
+`emptyHint`, `onSelectRecord`, `onCreateNew`). A host could pass any of them with no type
+error and the widget never received it — the "declared but not delivered" class this
+package treats as first-class.
+
+`error` was the live one. `InlineFieldInput` has passed `error` into this factory since
+PR #7109 and the factory dropped it, so an inline-edit control that had failed validation
+never reported `aria-invalid`: a sighted user saw the red hint, a screen-reader user was
+told nothing. The kanban `RequiredFieldsDialog` had the same hole from the other side — it
+computes the validation state and could not hand it over — and now passes `error`, so its
+controls are marked. Delivering `error` buys the a11y MARKING only; the message text stays
+with the host, per the objectui#3222 contract.
+
+The keys travel through a new sibling executor, `toHostProps` (exported alongside
+`toDomProps`), never through the DOM whitelist — none of them is DOM-legal, and routing a
+`dataSource` adapter there is the `[object Object]` leak that whitelist exists to stop.
+Three compile-time assertions make the two executors partition the contract, so a future
+declared key cannot go undelivered silently.
+
+`dataSource` precedence is stated rather than left to emerge: a host's explicit
+`dataSource` prop WINS over `SchemaRendererContext`. That is the order `LookupField`
+already implements; the factory is a conduit and resolves nothing. A host that passes no
+`dataSource` keeps reading the context exactly as before, so no in-repo host changes
+behaviour.

packages/fields/src/FieldEditWidget.tsx

@@ -11,6 +11,9 @@ import type { FieldWidgetComponentProps } from './widgets/types.js';
 // The package's own executor of the DOM pass-through declaration, reused here
 // rather than re-listed — see the note on this component's return statement.
 import { toDomProps } from './widgets/toDomProps.js';
+// The package's own executor of the NON-DOM half of the same declaration
+// (objectui#7008) — a separate function because those keys are not DOM-legal.
+import { toHostProps } from './widgets/toHostProps.js';
 
 // The SAME dedicated widgets the form renders — reused for in-place editing
 // (e.g. the data grid's inline cell editor) so a select edits as a dropdown, a
@@ -271,6 +274,40 @@ const COMPACT_EDIT_TYPES = new Set<string>(['lookup', 'master_detail', 'user']);
  * each widget's own whitelist carries these onto the real focusable control, so
  * nothing here needs to know which element that is. A host that passes nothing
  * is unaffected.
+ *
+ * The host's NON-DOM set is forwarded WHOLE too (objectui#7008), through the
+ * sibling executor `toHostProps`. The DOM fix left the other half of the
+ * contract undelivered: `error`, `onUploadingChange` and the "Host plumbing"
+ * block (`dataSource`, `dependentValues`, `dependsOn`, `dependsOnLabels`,
+ * `emptyHint`, `onSelectRecord`, `onCreateNew`) still type-checked, read as
+ * supported, and never reached the widget. `error` was the live one:
+ * `InlineFieldInput` has passed `error={error}` since PR #7109 and this factory
+ * dropped it, so a control that had failed validation never reported
+ * `aria-invalid`. Forwarding is not a widening — every one of those keys is
+ * already declared on `FieldWidgetComponentProps`, the same argument #7009
+ * landed on in this file.
+ *
+ * ⛔ They do NOT go through `toDomProps`. None of them is DOM-legal, and that
+ * whitelist is closed for exactly this reason — a `dataSource` adapter routed
+ * there becomes `dataSource="[object Object]"` on an `<input>`, the leak the
+ * helper exists to prevent. `toHostProps`' direction-3 assertion makes the two
+ * sets provably disjoint, so the order of the two spreads below is not a
+ * question anyone has to answer again.
+ *
+ * ## `dataSource` precedence: the explicit prop WINS
+ *
+ * Delivering `dataSource` can change behaviour where before it could not
+ * arrive, because the relational widgets fall back to `SchemaRendererContext`
+ * (which the grid already provides). The precedence is therefore STATED rather
+ * than left to emerge: **a host's explicit `dataSource` prop wins over the
+ * context**. That is not a new decision — `LookupField` already resolves
+ * `props.dataSource ?? lookupField?.dataSource ?? fieldMeta?.dataSource ??
+ * contextDataSource` and documents that order on the line that does it. This
+ * factory is a CONDUIT and resolves nothing: adding a resolution here would
+ * give `dataSource` a second author, the `field || schema` shape objectui#3233
+ * removed. A host that passes no `dataSource` keeps reading the context exactly
+ * as before, so no in-repo host changes behaviour. The full per-key precedence
+ * table lives on `toHostProps`, next to the list it governs.
  */
 export function FieldEditWidget(
  props: FieldWidgetComponentProps<any>,
@@ -324,9 +361,17 @@ export function FieldEditWidget(
  // The semantic props stay explicit and come AFTER the spread. They are not in
  // the whitelist, so there is no collision to resolve; ordering them this way
  // states that this component OWNS them and a host cannot displace them.
+ //
+ // `toHostProps` is the same reuse argument applied to the other half of the
+ // declaration (objectui#7008): the declared NON-DOM keys — `error` and the
+ // "Host plumbing" block — travel as COMPONENT props, never through the DOM
+ // whitelist, which is closed against exactly them. The two executors are
+ // asserted disjoint at compile time, so neither spread can shadow the other,
+ // and `compact` below still wins because the factory owns it.
  return (
  <Widget
  {...toDomProps(props)}
+ {...toHostProps(props)}
  field={field}
  value={value}
  onChange={onChange}

packages/fields/src/__tests__/FieldEditWidget.hostPlumbing-7008.test.tsx

@@ -0,0 +1,229 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * `FieldEditWidget` DELIVERS the NON-DOM half of the contract it DECLARES
+ * (objectui#7008) — the other half of objectui#6909 / #7009.
+ *
+ * ## The defect this pins closed
+ *
+ * #7009 made the factory forward `toDomProps(props)`, so the declared DOM block
+ * finally arrived. `FieldWidgetComponentProps` also declares `error`,
+ * `onUploadingChange`, and a whole "Host plumbing" block (`dataSource`,
+ * `dependentValues`, `dependsOn`, `dependsOnLabels`, `emptyHint`,
+ * `onSelectRecord`, `onCreateNew`) — and nothing carried any of it. A host
+ * passed them with no type error and the widget never received them.
+ *
+ * `error` was the LIVE one, and measurably so on `main` at `71d83a6b1`:
+ * `InlineFieldInput` (`@object-ui/plugin-detail`, since PR #7109) already
+ * passes `error={error}` into this factory, which dropped it — so a control
+ * that had failed validation never reported `aria-invalid`. A sighted user saw
+ * the red hint; a screen-reader user was told nothing. That is the class
+ * objectui#3222 / #3290 exist to close, and the one #7002 closed for
+ * `NumberField` one layer down.
+ *
+ * ## What binds it, and what this file adds
+ *
+ * The fix hands the widget `toHostProps(props)` — a SIBLING executor, not more
+ * entries in `DOM_PASS_THROUGH_KEYS`, because none of these keys is DOM-legal
+ * and that whitelist is closed against exactly them. Three compile-time
+ * assertions in `toHostProps.ts` make the two executors PARTITION the contract,
+ * so a future declared key cannot go undelivered without a red build.
+ *
+ * A type cannot see the two things this file pins: that the keys ARRIVE at
+ * runtime, and that arriving actually changes what assistive tech is told.
+ */
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { render, cleanup, waitFor } from '@testing-library/react';
+import '@testing-library/jest-dom';
+import React from 'react';
+import { SchemaRendererContext } from '@object-ui/react';
+
+import { FieldEditWidget } from '../FieldEditWidget';
+import type { FieldWidgetComponentProps } from '../widgets/types';
+
+afterEach(() => cleanup());
+
+/** `select` resolves to `SelectField`, whose trigger carries `aria-invalid`. */
+const SELECT_FIELD = {
+ name: 'stage',
+ type: 'select',
+ label: 'Stage',
+ options: [{ label: 'New', value: 'new' }],
+} as never;
+
+/** `text` resolves to `TextField` — used only where the widget is irrelevant. */
+const TEXT_FIELD = { name: 'f', type: 'text', label: 'F' } as never;
+
+describe('FieldEditWidget delivers its declared NON-DOM block (objectui#7008)', () => {
+ it('forwards every declared host-plumbing key it is handed, at the factory boundary', () => {
+ const onUploadingChange = vi.fn();
+ const onSelectRecord = vi.fn();
+ const onCreateNew = vi.fn();
+ const dataSource = { find: vi.fn() };
+
+ // `zzcanary` is the control, carried over from the #7009 pin: NOT declared
+ // on `FieldWidgetComponentProps` (passing it is a compile error, hence the
+ // cast), but an SDUI node or a field config can carry exactly such a key at
+ // runtime. Without it, "everything forwards now" would be
+ // indistinguishable from having reopened the bare `{...props}` spread.
+ const props = {
+ field: TEXT_FIELD,
+ value: '',
+ onChange: () => {},
+ readonly: false,
+ // the two declared controlled-input keys the factory neither owns nor
+ // routes to the DOM
+ error: 'Required',
+ onUploadingChange,
+ // the declared "Host plumbing" block, minus `compact` (factory-owned)
+ dataSource,
+ dependentValues: { account: 'a1' },
+ dependsOn: 'account',
+ dependsOnLabels: { account: 'Account' },
+ emptyHint: 'Pick an account first',
+ onSelectRecord,
+ onCreateNew,
+ zzcanary: 'CANARY-STR',
+ } as unknown as FieldWidgetComponentProps<string>;
+
+ // Called as a plain function rather than rendered: it uses no hooks and its
+ // return value IS the widget element, so this reads the handoff itself.
+ const element = FieldEditWidget(props);
+ expect(element).not.toBeNull();
+ const forwarded = element!.props as Record<string, unknown>;
+
+ // Exact set, not a subset — a subset check cannot see the control key, and
+ // an extra key appearing here is the leak this guards.
+ expect(Object.keys(forwarded).sort()).toEqual(
+ [
+ // rendered by the factory itself
+ 'field',
+ 'value',
+ 'onChange',
+ 'readonly',
+ // the declared NON-DOM keys, via `toHostProps`
+ 'error',
+ 'onUploadingChange',
+ 'dataSource',
+ 'dependentValues',
+ 'dependsOn',
+ 'dependsOnLabels',
+ 'emptyHint',
+ 'onSelectRecord',
+ 'onCreateNew',
+ ].sort(),
+ );
+
+ // Identity, not just presence: a conduit hands over the host's own object.
+ expect(forwarded.dataSource).toBe(dataSource);
+ expect(forwarded.onSelectRecord).toBe(onSelectRecord);
+ expect(forwarded.onCreateNew).toBe(onCreateNew);
+ expect(forwarded.onUploadingChange).toBe(onUploadingChange);
+ expect(forwarded.error).toBe('Required');
+
+ // CONTROL: the undeclared authored key is still dropped.
+ expect(forwarded).not.toHaveProperty('zzcanary');
+ });
+
+ it('CONTROL: a key the host did not pass stays ABSENT, not `undefined`', () => {
+ // The #7009 pin asserts an exact boundary set for a host that passes only
+ // DOM keys. Forwarding the non-DOM block as nine always-present
+ // `undefined`s would have broken that pin AND made the boundary unreadable
+ // — "what the host supplied" is the claim, so absence must survive.
+ const element = FieldEditWidget({
+ field: TEXT_FIELD,
+ value: '',
+ onChange: () => {},
+ } as FieldWidgetComponentProps<string>);
+ expect(element).not.toBeNull();
+ const forwarded = element!.props as Record<string, unknown>;
+
+ for (const key of [
+ 'error',
+ 'onUploadingChange',
+ 'dataSource',
+ 'dependentValues',
+ 'dependsOn',
+ 'dependsOnLabels',
+ 'emptyHint',
+ 'onSelectRecord',
+ 'onCreateNew',
+ ]) {
+ expect(forwarded).not.toHaveProperty(key);
+ }
+ // CONTROL: the factory's own props are still there, so the assertion above
+ // is not passing because the handoff is empty.
+ expect(forwarded).toHaveProperty('field');
+ expect(forwarded).toHaveProperty('value');
+ });
+
+ it('`error` reaches a real control as `aria-invalid` — the live a11y defect', async () => {
+ const { getByTestId, rerender } = render(
+ <FieldEditWidget field={SELECT_FIELD} value="" onChange={() => {}} error="Required" />,
+ );
+ // `SelectField` puts the DOM pass-through and `aria-invalid` on
+ // `SelectTrigger` — the focusable `button role="combobox"` the user and
+ // their screen reader actually meet (objectui#3306) — not on Radix `Root`,
+ // which renders no element.
+ const trigger = getByTestId('select-trigger-stage');
+ expect(trigger.tagName).toBe('BUTTON');
+ expect(trigger).toHaveAttribute('aria-invalid', 'true');
+
+ // CONTROL: the same widget, same host, no `error`. `SelectField` computes
+ // `!!error`, so a valid field SAYS "false" rather than staying mute — which
+ // makes this a real two-state reading and not "the attribute exists".
+ rerender(<FieldEditWidget field={SELECT_FIELD} value="" onChange={() => {}} />);
+ expect(getByTestId('select-trigger-stage')).toHaveAttribute('aria-invalid', 'false');
+ });
+
+ it('`dataSource`: the explicit prop WINS over SchemaRendererContext', async () => {
+ // The one delivered key that can CHANGE behaviour rather than only add it:
+ // the relational widgets fall back to `SchemaRendererContext` (which the
+ // grid already provides), so delivering the prop creates a precedence
+ // question. `LookupField` already resolves "explicit prop > field-level >
+ // wrapper field > SchemaRendererContext > none"; the factory is a conduit
+ // and adds no second authority. This pins that the delivered prop is what
+ // the widget ends up querying.
+ const LOOKUP_FIELD = { name: 'account', type: 'lookup', reference_to: 'accounts' } as never;
+ const makeSource = () => ({
+ find: vi.fn().mockResolvedValue([]),
+ getObjectSchema: vi.fn().mockResolvedValue({ name: 'accounts' }),
+ });
+
+ const fromProp = makeSource();
+ const fromContext = makeSource();
+
+ render(
+ <SchemaRendererContext.Provider value={{ dataSource: fromContext } as never}>
+ <FieldEditWidget
+ field={LOOKUP_FIELD}
+ value={undefined}
+ onChange={() => {}}
+ dataSource={fromProp}
+ />
+ </SchemaRendererContext.Provider>,
+ );
+
+ await waitFor(() => expect(fromProp.getObjectSchema).toHaveBeenCalledWith('accounts'));
+ expect(fromContext.getObjectSchema).not.toHaveBeenCalled();
+
+ cleanup();
+
+ // CONTROL: drop the prop and the SAME context source IS queried. Without
+ // this, "the context was not called" would be indistinguishable from a
+ // context that was never wired up in this test at all.
+ const contextOnly = makeSource();
+ render(
+ <SchemaRendererContext.Provider value={{ dataSource: contextOnly } as never}>
+ <FieldEditWidget field={LOOKUP_FIELD} value={undefined} onChange={() => {}} />
+ </SchemaRendererContext.Provider>,
+ );
+ await waitFor(() => expect(contextOnly.getObjectSchema).toHaveBeenCalledWith('accounts'));
+ });
+});

packages/fields/src/index.tsx

@@ -3347,6 +3347,15 @@ export { withFieldCarrier } from './withFieldCarrier.js';
 export { toDomProps } from './widgets/toDomProps.js';
 export type { DomProps } from './widgets/toDomProps.js';
 
+// The sibling executor for the NON-DOM half of the same declaration
+// (objectui#7008): `error` plus the "Host plumbing" block, forwarded as
+// COMPONENT props because none of them is DOM-legal. Exported alongside
+// `toDomProps` because a host factory authored outside this repo needs the
+// pair — reaching for only the first one is how `FieldEditWidget` came to
+// deliver half the contract it declares.
+export { toHostProps } from './widgets/toHostProps.js';
+export type { HostProps } from './widgets/toHostProps.js';
+
 // The native date/time control value adapters (objectui#3127). `DateTimeField`
 // is ISO-canonical on BOTH sides — it takes the record's ISO instant and hands
 // an ISO instant back, which is also the wire form the platform's `datetime`

packages/fields/src/widgets/toDomProps.ts

@@ -123,7 +123,16 @@ const DOM_PASS_THROUGH_KEYS = [
  'disabled',
 ] as const;
 
-type DomPassThroughKey = (typeof DOM_PASS_THROUGH_KEYS)[number];
+/**
+ * The keys this helper forwards.
+ *
+ * Exported so the SIBLING executor — `toHostProps`, which carries the declared
+ * NON-DOM keys (objectui#7008) — can subtract this set from the contract and
+ * assert that the two together cover every declared key exactly once. Without
+ * that subtraction there is no way to state "these keys are handled elsewhere"
+ * as a compile-time fact rather than as a comment.
+ */
+export type DomPassThroughKey = (typeof DOM_PASS_THROUGH_KEYS)[number];
 
 /**
  * Compile-time link to the declaration, direction 1 of 2: every key forwarded

.changeset/7008-field-edit-widget-host-plumbing.md

@@ -0,0 +1,33 @@
+---
+'@object-ui/fields': minor
+'@object-ui/plugin-kanban': patch
+---
+
+`FieldEditWidget` now delivers the NON-DOM half of the contract it declares (objectui#7008).
+
+objectui#7009 made the factory forward its declared DOM pass-through block. The rest of
+`FieldWidgetComponentProps` was still dropped: `error`, `onUploadingChange`, and the whole
+"Host plumbing" block (`dataSource`, `dependentValues`, `dependsOn`, `dependsOnLabels`,
+`emptyHint`, `onSelectRecord`, `onCreateNew`). A host could pass any of them with no type
+error and the widget never received it — the "declared but not delivered" class this
+package treats as first-class.
+
+`error` was the live one. `InlineFieldInput` has passed `error` into this factory since
+PR #7109 and the factory dropped it, so an inline-edit control that had failed validation
+never reported `aria-invalid`: a sighted user saw the red hint, a screen-reader user was
+told nothing. The kanban `RequiredFieldsDialog` had the same hole from the other side — it
+computes the validation state and could not hand it over — and now passes `error`, so its
+controls are marked. Delivering `error` buys the a11y MARKING only; the message text stays
+with the host, per the objectui#3222 contract.
+
+The keys travel through a new sibling executor, `toHostProps` (exported alongside
+`toDomProps`), never through the DOM whitelist — none of them is DOM-legal, and routing a
+`dataSource` adapter there is the `[object Object]` leak that whitelist exists to stop.
+Three compile-time assertions make the two executors partition the contract, so a future
+declared key cannot go undelivered silently.
+
+`dataSource` precedence is stated rather than left to emerge: a host's explicit
+`dataSource` prop WINS over `SchemaRendererContext`. That is the order `LookupField`
+already implements; the factory is a conduit and resolves nothing. A host that passes no
+`dataSource` keeps reading the context exactly as before, so no in-repo host changes
+behaviour.

packages/fields/src/FieldEditWidget.tsx

@@ -11,6 +11,9 @@ import type { FieldWidgetComponentProps } from './widgets/types.js';
 // The package's own executor of the DOM pass-through declaration, reused here
 // rather than re-listed — see the note on this component's return statement.
 import { toDomProps } from './widgets/toDomProps.js';
+// The package's own executor of the NON-DOM half of the same declaration
+// (objectui#7008) — a separate function because those keys are not DOM-legal.
+import { toHostProps } from './widgets/toHostProps.js';
 
 // The SAME dedicated widgets the form renders — reused for in-place editing
 // (e.g. the data grid's inline cell editor) so a select edits as a dropdown, a
@@ -271,6 +274,40 @@ const COMPACT_EDIT_TYPES = new Set<string>(['lookup', 'master_detail', 'user']);
  * each widget's own whitelist carries these onto the real focusable control, so
  * nothing here needs to know which element that is. A host that passes nothing
  * is unaffected.
+ *
+ * The host's NON-DOM set is forwarded WHOLE too (objectui#7008), through the
+ * sibling executor `toHostProps`. The DOM fix left the other half of the
+ * contract undelivered: `error`, `onUploadingChange` and the "Host plumbing"
+ * block (`dataSource`, `dependentValues`, `dependsOn`, `dependsOnLabels`,
+ * `emptyHint`, `onSelectRecord`, `onCreateNew`) still type-checked, read as
+ * supported, and never reached the widget. `error` was the live one:
+ * `InlineFieldInput` has passed `error={error}` since PR #7109 and this factory
+ * dropped it, so a control that had failed validation never reported
+ * `aria-invalid`. Forwarding is not a widening — every one of those keys is
+ * already declared on `FieldWidgetComponentProps`, the same argument #7009
+ * landed on in this file.
+ *
+ * ⛔ They do NOT go through `toDomProps`. None of them is DOM-legal, and that
+ * whitelist is closed for exactly this reason — a `dataSource` adapter routed
+ * there becomes `dataSource="[object Object]"` on an `<input>`, the leak the
+ * helper exists to prevent. `toHostProps`' direction-3 assertion makes the two
+ * sets provably disjoint, so the order of the two spreads below is not a
+ * question anyone has to answer again.
+ *
+ * ## `dataSource` precedence: the explicit prop WINS
+ *
+ * Delivering `dataSource` can change behaviour where before it could not
+ * arrive, because the relational widgets fall back to `SchemaRendererContext`
+ * (which the grid already provides). The precedence is therefore STATED rather
+ * than left to emerge: **a host's explicit `dataSource` prop wins over the
+ * context**. That is not a new decision — `LookupField` already resolves
+ * `props.dataSource ?? lookupField?.dataSource ?? fieldMeta?.dataSource ??
+ * contextDataSource` and documents that order on the line that does it. This
+ * factory is a CONDUIT and resolves nothing: adding a resolution here would
+ * give `dataSource` a second author, the `field || schema` shape objectui#3233
+ * removed. A host that passes no `dataSource` keeps reading the context exactly
+ * as before, so no in-repo host changes behaviour. The full per-key precedence
+ * table lives on `toHostProps`, next to the list it governs.
  */
 export function FieldEditWidget(
  props: FieldWidgetComponentProps<any>,
@@ -324,9 +361,17 @@ export function FieldEditWidget(
  // The semantic props stay explicit and come AFTER the spread. They are not in
  // the whitelist, so there is no collision to resolve; ordering them this way
  // states that this component OWNS them and a host cannot displace them.
+ //
+ // `toHostProps` is the same reuse argument applied to the other half of the
+ // declaration (objectui#7008): the declared NON-DOM keys — `error` and the
+ // "Host plumbing" block — travel as COMPONENT props, never through the DOM
+ // whitelist, which is closed against exactly them. The two executors are
+ // asserted disjoint at compile time, so neither spread can shadow the other,
+ // and `compact` below still wins because the factory owns it.
  return (
  <Widget
  {...toDomProps(props)}
+ {...toHostProps(props)}
  field={field}
  value={value}
  onChange={onChange}

packages/fields/src/__tests__/FieldEditWidget.hostPlumbing-7008.test.tsx

@@ -0,0 +1,229 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * `FieldEditWidget` DELIVERS the NON-DOM half of the contract it DECLARES
+ * (objectui#7008) — the other half of objectui#6909 / #7009.
+ *
+ * ## The defect this pins closed
+ *
+ * #7009 made the factory forward `toDomProps(props)`, so the declared DOM block
+ * finally arrived. `FieldWidgetComponentProps` also declares `error`,
+ * `onUploadingChange`, and a whole "Host plumbing" block (`dataSource`,
+ * `dependentValues`, `dependsOn`, `dependsOnLabels`, `emptyHint`,
+ * `onSelectRecord`, `onCreateNew`) — and nothing carried any of it. A host
+ * passed them with no type error and the widget never received them.
+ *
+ * `error` was the LIVE one, and measurably so on `main` at `71d83a6b1`:
+ * `InlineFieldInput` (`@object-ui/plugin-detail`, since PR #7109) already
+ * passes `error={error}` into this factory, which dropped it — so a control
+ * that had failed validation never reported `aria-invalid`. A sighted user saw
+ * the red hint; a screen-reader user was told nothing. That is the class
+ * objectui#3222 / #3290 exist to close, and the one #7002 closed for
+ * `NumberField` one layer down.
+ *
+ * ## What binds it, and what this file adds
+ *
+ * The fix hands the widget `toHostProps(props)` — a SIBLING executor, not more
+ * entries in `DOM_PASS_THROUGH_KEYS`, because none of these keys is DOM-legal
+ * and that whitelist is closed against exactly them. Three compile-time
+ * assertions in `toHostProps.ts` make the two executors PARTITION the contract,
+ * so a future declared key cannot go undelivered without a red build.
+ *
+ * A type cannot see the two things this file pins: that the keys ARRIVE at
+ * runtime, and that arriving actually changes what assistive tech is told.
+ */
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { render, cleanup, waitFor } from '@testing-library/react';
+import '@testing-library/jest-dom';
+import React from 'react';
+import { SchemaRendererContext } from '@object-ui/react';
+
+import { FieldEditWidget } from '../FieldEditWidget';
+import type { FieldWidgetComponentProps } from '../widgets/types';
+
+afterEach(() => cleanup());
+
+/** `select` resolves to `SelectField`, whose trigger carries `aria-invalid`. */
+const SELECT_FIELD = {
+ name: 'stage',
+ type: 'select',
+ label: 'Stage',
+ options: [{ label: 'New', value: 'new' }],
+} as never;
+
+/** `text` resolves to `TextField` — used only where the widget is irrelevant. */
+const TEXT_FIELD = { name: 'f', type: 'text', label: 'F' } as never;
+
+describe('FieldEditWidget delivers its declared NON-DOM block (objectui#7008)', () => {
+ it('forwards every declared host-plumbing key it is handed, at the factory boundary', () => {
+ const onUploadingChange = vi.fn();
+ const onSelectRecord = vi.fn();
+ const onCreateNew = vi.fn();
+ const dataSource = { find: vi.fn() };
+
+ // `zzcanary` is the control, carried over from the #7009 pin: NOT declared
+ // on `FieldWidgetComponentProps` (passing it is a compile error, hence the
+ // cast), but an SDUI node or a field config can carry exactly such a key at
+ // runtime. Without it, "everything forwards now" would be
+ // indistinguishable from having reopened the bare `{...props}` spread.
+ const props = {
+ field: TEXT_FIELD,
+ value: '',
+ onChange: () => {},
+ readonly: false,
+ // the two declared controlled-input keys the factory neither owns nor
+ // routes to the DOM
+ error: 'Required',
+ onUploadingChange,
+ // the declared "Host plumbing" block, minus `compact` (factory-owned)
+ dataSource,
+ dependentValues: { account: 'a1' },
+ dependsOn: 'account',
+ dependsOnLabels: { account: 'Account' },
+ emptyHint: 'Pick an account first',
+ onSelectRecord,
+ onCreateNew,
+ zzcanary: 'CANARY-STR',
+ } as unknown as FieldWidgetComponentProps<string>;
+
+ // Called as a plain function rather than rendered: it uses no hooks and its
+ // return value IS the widget element, so this reads the handoff itself.
+ const element = FieldEditWidget(props);
+ expect(element).not.toBeNull();
+ const forwarded = element!.props as Record<string, unknown>;
+
+ // Exact set, not a subset — a subset check cannot see the control key, and
+ // an extra key appearing here is the leak this guards.
+ expect(Object.keys(forwarded).sort()).toEqual(
+ [
+ // rendered by the factory itself
+ 'field',
+ 'value',
+ 'onChange',
+ 'readonly',
+ // the declared NON-DOM keys, via `toHostProps`
+ 'error',
+ 'onUploadingChange',
+ 'dataSource',
+ 'dependentValues',
+ 'dependsOn',
+ 'dependsOnLabels',
+ 'emptyHint',
+ 'onSelectRecord',
+ 'onCreateNew',
+ ].sort(),
+ );
+
+ // Identity, not just presence: a conduit hands over the host's own object.
+ expect(forwarded.dataSource).toBe(dataSource);
+ expect(forwarded.onSelectRecord).toBe(onSelectRecord);
+ expect(forwarded.onCreateNew).toBe(onCreateNew);
+ expect(forwarded.onUploadingChange).toBe(onUploadingChange);
+ expect(forwarded.error).toBe('Required');
+
+ // CONTROL: the undeclared authored key is still dropped.
+ expect(forwarded).not.toHaveProperty('zzcanary');
+ });
+
+ it('CONTROL: a key the host did not pass stays ABSENT, not `undefined`', () => {
+ // The #7009 pin asserts an exact boundary set for a host that passes only
+ // DOM keys. Forwarding the non-DOM block as nine always-present
+ // `undefined`s would have broken that pin AND made the boundary unreadable
+ // — "what the host supplied" is the claim, so absence must survive.
+ const element = FieldEditWidget({
+ field: TEXT_FIELD,
+ value: '',
+ onChange: () => {},
+ } as FieldWidgetComponentProps<string>);
+ expect(element).not.toBeNull();
+ const forwarded = element!.props as Record<string, unknown>;
+
+ for (const key of [
+ 'error',
+ 'onUploadingChange',
+ 'dataSource',
+ 'dependentValues',
+ 'dependsOn',
+ 'dependsOnLabels',
+ 'emptyHint',
+ 'onSelectRecord',
+ 'onCreateNew',
+ ]) {
+ expect(forwarded).not.toHaveProperty(key);
+ }
+ // CONTROL: the factory's own props are still there, so the assertion above
+ // is not passing because the handoff is empty.
+ expect(forwarded).toHaveProperty('field');
+ expect(forwarded).toHaveProperty('value');
+ });
+
+ it('`error` reaches a real control as `aria-invalid` — the live a11y defect', async () => {
+ const { getByTestId, rerender } = render(
+ <FieldEditWidget field={SELECT_FIELD} value="" onChange={() => {}} error="Required" />,
+ );
+ // `SelectField` puts the DOM pass-through and `aria-invalid` on
+ // `SelectTrigger` — the focusable `button role="combobox"` the user and
+ // their screen reader actually meet (objectui#3306) — not on Radix `Root`,
+ // which renders no element.
+ const trigger = getByTestId('select-trigger-stage');
+ expect(trigger.tagName).toBe('BUTTON');
+ expect(trigger).toHaveAttribute('aria-invalid', 'true');
+
+ // CONTROL: the same widget, same host, no `error`. `SelectField` computes
+ // `!!error`, so a valid field SAYS "false" rather than staying mute — which
+ // makes this a real two-state reading and not "the attribute exists".
+ rerender(<FieldEditWidget field={SELECT_FIELD} value="" onChange={() => {}} />);
+ expect(getByTestId('select-trigger-stage')).toHaveAttribute('aria-invalid', 'false');
+ });
+
+ it('`dataSource`: the explicit prop WINS over SchemaRendererContext', async () => {
+ // The one delivered key that can CHANGE behaviour rather than only add it:
+ // the relational widgets fall back to `SchemaRendererContext` (which the
+ // grid already provides), so delivering the prop creates a precedence
+ // question. `LookupField` already resolves "explicit prop > field-level >
+ // wrapper field > SchemaRendererContext > none"; the factory is a conduit
+ // and adds no second authority. This pins that the delivered prop is what
+ // the widget ends up querying.
+ const LOOKUP_FIELD = { name: 'account', type: 'lookup', reference_to: 'accounts' } as never;
+ const makeSource = () => ({
+ find: vi.fn().mockResolvedValue([]),
+ getObjectSchema: vi.fn().mockResolvedValue({ name: 'accounts' }),
+ });
+
+ const fromProp = makeSource();
+ const fromContext = makeSource();
+
+ render(
+ <SchemaRendererContext.Provider value={{ dataSource: fromContext } as never}>
+ <FieldEditWidget
+ field={LOOKUP_FIELD}
+ value={undefined}
+ onChange={() => {}}
+ dataSource={fromProp}
+ />
+ </SchemaRendererContext.Provider>,
+ );
+
+ await waitFor(() => expect(fromProp.getObjectSchema).toHaveBeenCalledWith('accounts'));
+ expect(fromContext.getObjectSchema).not.toHaveBeenCalled();
+
+ cleanup();
+
+ // CONTROL: drop the prop and the SAME context source IS queried. Without
+ // this, "the context was not called" would be indistinguishable from a
+ // context that was never wired up in this test at all.
+ const contextOnly = makeSource();
+ render(
+ <SchemaRendererContext.Provider value={{ dataSource: contextOnly } as never}>
+ <FieldEditWidget field={LOOKUP_FIELD} value={undefined} onChange={() => {}} />
+ </SchemaRendererContext.Provider>,
+ );
+ await waitFor(() => expect(contextOnly.getObjectSchema).toHaveBeenCalledWith('accounts'));
+ });
+});

packages/fields/src/index.tsx

@@ -3347,6 +3347,15 @@ export { withFieldCarrier } from './withFieldCarrier.js';
 export { toDomProps } from './widgets/toDomProps.js';
 export type { DomProps } from './widgets/toDomProps.js';
 
+// The sibling executor for the NON-DOM half of the same declaration
+// (objectui#7008): `error` plus the "Host plumbing" block, forwarded as
+// COMPONENT props because none of them is DOM-legal. Exported alongside
+// `toDomProps` because a host factory authored outside this repo needs the
+// pair — reaching for only the first one is how `FieldEditWidget` came to
+// deliver half the contract it declares.
+export { toHostProps } from './widgets/toHostProps.js';
+export type { HostProps } from './widgets/toHostProps.js';
+
 // The native date/time control value adapters (objectui#3127). `DateTimeField`
 // is ISO-canonical on BOTH sides — it takes the record's ISO instant and hands
 // an ISO instant back, which is also the wire form the platform's `datetime`

packages/fields/src/widgets/toDomProps.ts

@@ -123,7 +123,16 @@ const DOM_PASS_THROUGH_KEYS = [
  'disabled',
 ] as const;
 
-type DomPassThroughKey = (typeof DOM_PASS_THROUGH_KEYS)[number];
+/**
+ * The keys this helper forwards.
+ *
+ * Exported so the SIBLING executor — `toHostProps`, which carries the declared
+ * NON-DOM keys (objectui#7008) — can subtract this set from the contract and
+ * assert that the two together cover every declared key exactly once. Without
+ * that subtraction there is no way to state "these keys are handled elsewhere"
+ * as a compile-time fact rather than as a comment.
+ */
+export type DomPassThroughKey = (typeof DOM_PASS_THROUGH_KEYS)[number];
 
 /**
  * Compile-time link to the declaration, direction 1 of 2: every key forwarded

.changeset/7008-field-edit-widget-host-plumbing.md

@@ -0,0 +1,33 @@
+---
+'@object-ui/fields': minor
+'@object-ui/plugin-kanban': patch
+---
+
+`FieldEditWidget` now delivers the NON-DOM half of the contract it declares (objectui#7008).
+
+objectui#7009 made the factory forward its declared DOM pass-through block. The rest of
+`FieldWidgetComponentProps` was still dropped: `error`, `onUploadingChange`, and the whole
+"Host plumbing" block (`dataSource`, `dependentValues`, `dependsOn`, `dependsOnLabels`,
+`emptyHint`, `onSelectRecord`, `onCreateNew`). A host could pass any of them with no type
+error and the widget never received it — the "declared but not delivered" class this
+package treats as first-class.
+
+`error` was the live one. `InlineFieldInput` has passed `error` into this factory since
+PR #7109 and the factory dropped it, so an inline-edit control that had failed validation
+never reported `aria-invalid`: a sighted user saw the red hint, a screen-reader user was
+told nothing. The kanban `RequiredFieldsDialog` had the same hole from the other side — it
+computes the validation state and could not hand it over — and now passes `error`, so its
+controls are marked. Delivering `error` buys the a11y MARKING only; the message text stays
+with the host, per the objectui#3222 contract.
+
+The keys travel through a new sibling executor, `toHostProps` (exported alongside
+`toDomProps`), never through the DOM whitelist — none of them is DOM-legal, and routing a
+`dataSource` adapter there is the `[object Object]` leak that whitelist exists to stop.
+Three compile-time assertions make the two executors partition the contract, so a future
+declared key cannot go undelivered silently.
+
+`dataSource` precedence is stated rather than left to emerge: a host's explicit
+`dataSource` prop WINS over `SchemaRendererContext`. That is the order `LookupField`
+already implements; the factory is a conduit and resolves nothing. A host that passes no
+`dataSource` keeps reading the context exactly as before, so no in-repo host changes
+behaviour.

packages/fields/src/FieldEditWidget.tsx

@@ -11,6 +11,9 @@ import type { FieldWidgetComponentProps } from './widgets/types.js';
 // The package's own executor of the DOM pass-through declaration, reused here
 // rather than re-listed — see the note on this component's return statement.
 import { toDomProps } from './widgets/toDomProps.js';
+// The package's own executor of the NON-DOM half of the same declaration
+// (objectui#7008) — a separate function because those keys are not DOM-legal.
+import { toHostProps } from './widgets/toHostProps.js';
 
 // The SAME dedicated widgets the form renders — reused for in-place editing
 // (e.g. the data grid's inline cell editor) so a select edits as a dropdown, a
@@ -271,6 +274,40 @@ const COMPACT_EDIT_TYPES = new Set<string>(['lookup', 'master_detail', 'user']);
  * each widget's own whitelist carries these onto the real focusable control, so
  * nothing here needs to know which element that is. A host that passes nothing
  * is unaffected.
+ *
+ * The host's NON-DOM set is forwarded WHOLE too (objectui#7008), through the
+ * sibling executor `toHostProps`. The DOM fix left the other half of the
+ * contract undelivered: `error`, `onUploadingChange` and the "Host plumbing"
+ * block (`dataSource`, `dependentValues`, `dependsOn`, `dependsOnLabels`,
+ * `emptyHint`, `onSelectRecord`, `onCreateNew`) still type-checked, read as
+ * supported, and never reached the widget. `error` was the live one:
+ * `InlineFieldInput` has passed `error={error}` since PR #7109 and this factory
+ * dropped it, so a control that had failed validation never reported
+ * `aria-invalid`. Forwarding is not a widening — every one of those keys is
+ * already declared on `FieldWidgetComponentProps`, the same argument #7009
+ * landed on in this file.
+ *
+ * ⛔ They do NOT go through `toDomProps`. None of them is DOM-legal, and that
+ * whitelist is closed for exactly this reason — a `dataSource` adapter routed
+ * there becomes `dataSource="[object Object]"` on an `<input>`, the leak the
+ * helper exists to prevent. `toHostProps`' direction-3 assertion makes the two
+ * sets provably disjoint, so the order of the two spreads below is not a
+ * question anyone has to answer again.
+ *
+ * ## `dataSource` precedence: the explicit prop WINS
+ *
+ * Delivering `dataSource` can change behaviour where before it could not
+ * arrive, because the relational widgets fall back to `SchemaRendererContext`
+ * (which the grid already provides). The precedence is therefore STATED rather
+ * than left to emerge: **a host's explicit `dataSource` prop wins over the
+ * context**. That is not a new decision — `LookupField` already resolves
+ * `props.dataSource ?? lookupField?.dataSource ?? fieldMeta?.dataSource ??
+ * contextDataSource` and documents that order on the line that does it. This
+ * factory is a CONDUIT and resolves nothing: adding a resolution here would
+ * give `dataSource` a second author, the `field || schema` shape objectui#3233
+ * removed. A host that passes no `dataSource` keeps reading the context exactly
+ * as before, so no in-repo host changes behaviour. The full per-key precedence
+ * table lives on `toHostProps`, next to the list it governs.
  */
 export function FieldEditWidget(
  props: FieldWidgetComponentProps<any>,
@@ -324,9 +361,17 @@ export function FieldEditWidget(
  // The semantic props stay explicit and come AFTER the spread. They are not in
  // the whitelist, so there is no collision to resolve; ordering them this way
  // states that this component OWNS them and a host cannot displace them.
+ //
+ // `toHostProps` is the same reuse argument applied to the other half of the
+ // declaration (objectui#7008): the declared NON-DOM keys — `error` and the
+ // "Host plumbing" block — travel as COMPONENT props, never through the DOM
+ // whitelist, which is closed against exactly them. The two executors are
+ // asserted disjoint at compile time, so neither spread can shadow the other,
+ // and `compact` below still wins because the factory owns it.
  return (
  <Widget
  {...toDomProps(props)}
+ {...toHostProps(props)}
  field={field}
  value={value}
  onChange={onChange}

packages/fields/src/__tests__/FieldEditWidget.hostPlumbing-7008.test.tsx

@@ -0,0 +1,229 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * `FieldEditWidget` DELIVERS the NON-DOM half of the contract it DECLARES
+ * (objectui#7008) — the other half of objectui#6909 / #7009.
+ *
+ * ## The defect this pins closed
+ *
+ * #7009 made the factory forward `toDomProps(props)`, so the declared DOM block
+ * finally arrived. `FieldWidgetComponentProps` also declares `error`,
+ * `onUploadingChange`, and a whole "Host plumbing" block (`dataSource`,
+ * `dependentValues`, `dependsOn`, `dependsOnLabels`, `emptyHint`,
+ * `onSelectRecord`, `onCreateNew`) — and nothing carried any of it. A host
+ * passed them with no type error and the widget never received them.
+ *
+ * `error` was the LIVE one, and measurably so on `main` at `71d83a6b1`:
+ * `InlineFieldInput` (`@object-ui/plugin-detail`, since PR #7109) already
+ * passes `error={error}` into this factory, which dropped it — so a control
+ * that had failed validation never reported `aria-invalid`. A sighted user saw
+ * the red hint; a screen-reader user was told nothing. That is the class
+ * objectui#3222 / #3290 exist to close, and the one #7002 closed for
+ * `NumberField` one layer down.
+ *
+ * ## What binds it, and what this file adds
+ *
+ * The fix hands the widget `toHostProps(props)` — a SIBLING executor, not more
+ * entries in `DOM_PASS_THROUGH_KEYS`, because none of these keys is DOM-legal
+ * and that whitelist is closed against exactly them. Three compile-time
+ * assertions in `toHostProps.ts` make the two executors PARTITION the contract,
+ * so a future declared key cannot go undelivered without a red build.
+ *
+ * A type cannot see the two things this file pins: that the keys ARRIVE at
+ * runtime, and that arriving actually changes what assistive tech is told.
+ */
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { render, cleanup, waitFor } from '@testing-library/react';
+import '@testing-library/jest-dom';
+import React from 'react';
+import { SchemaRendererContext } from '@object-ui/react';
+
+import { FieldEditWidget } from '../FieldEditWidget';
+import type { FieldWidgetComponentProps } from '../widgets/types';
+
+afterEach(() => cleanup());
+
+/** `select` resolves to `SelectField`, whose trigger carries `aria-invalid`. */
+const SELECT_FIELD = {
+ name: 'stage',
+ type: 'select',
+ label: 'Stage',
+ options: [{ label: 'New', value: 'new' }],
+} as never;
+
+/** `text` resolves to `TextField` — used only where the widget is irrelevant. */
+const TEXT_FIELD = { name: 'f', type: 'text', label: 'F' } as never;
+
+describe('FieldEditWidget delivers its declared NON-DOM block (objectui#7008)', () => {
+ it('forwards every declared host-plumbing key it is handed, at the factory boundary', () => {
+ const onUploadingChange = vi.fn();
+ const onSelectRecord = vi.fn();
+ const onCreateNew = vi.fn();
+ const dataSource = { find: vi.fn() };
+
+ // `zzcanary` is the control, carried over from the #7009 pin: NOT declared
+ // on `FieldWidgetComponentProps` (passing it is a compile error, hence the
+ // cast), but an SDUI node or a field config can carry exactly such a key at
+ // runtime. Without it, "everything forwards now" would be
+ // indistinguishable from having reopened the bare `{...props}` spread.
+ const props = {
+ field: TEXT_FIELD,
+ value: '',
+ onChange: () => {},
+ readonly: false,
+ // the two declared controlled-input keys the factory neither owns nor
+ // routes to the DOM
+ error: 'Required',
+ onUploadingChange,
+ // the declared "Host plumbing" block, minus `compact` (factory-owned)
+ dataSource,
+ dependentValues: { account: 'a1' },
+ dependsOn: 'account',
+ dependsOnLabels: { account: 'Account' },
+ emptyHint: 'Pick an account first',
+ onSelectRecord,
+ onCreateNew,
+ zzcanary: 'CANARY-STR',
+ } as unknown as FieldWidgetComponentProps<string>;
+
+ // Called as a plain function rather than rendered: it uses no hooks and its
+ // return value IS the widget element, so this reads the handoff itself.
+ const element = FieldEditWidget(props);
+ expect(element).not.toBeNull();
+ const forwarded = element!.props as Record<string, unknown>;
+
+ // Exact set, not a subset — a subset check cannot see the control key, and
+ // an extra key appearing here is the leak this guards.
+ expect(Object.keys(forwarded).sort()).toEqual(
+ [
+ // rendered by the factory itself
+ 'field',
+ 'value',
+ 'onChange',
+ 'readonly',
+ // the declared NON-DOM keys, via `toHostProps`
+ 'error',
+ 'onUploadingChange',
+ 'dataSource',
+ 'dependentValues',
+ 'dependsOn',
+ 'dependsOnLabels',
+ 'emptyHint',
+ 'onSelectRecord',
+ 'onCreateNew',
+ ].sort(),
+ );
+
+ // Identity, not just presence: a conduit hands over the host's own object.
+ expect(forwarded.dataSource).toBe(dataSource);
+ expect(forwarded.onSelectRecord).toBe(onSelectRecord);
+ expect(forwarded.onCreateNew).toBe(onCreateNew);
+ expect(forwarded.onUploadingChange).toBe(onUploadingChange);
+ expect(forwarded.error).toBe('Required');
+
+ // CONTROL: the undeclared authored key is still dropped.
+ expect(forwarded).not.toHaveProperty('zzcanary');
+ });
+
+ it('CONTROL: a key the host did not pass stays ABSENT, not `undefined`', () => {
+ // The #7009 pin asserts an exact boundary set for a host that passes only
+ // DOM keys. Forwarding the non-DOM block as nine always-present
+ // `undefined`s would have broken that pin AND made the boundary unreadable
+ // — "what the host supplied" is the claim, so absence must survive.
+ const element = FieldEditWidget({
+ field: TEXT_FIELD,
+ value: '',
+ onChange: () => {},
+ } as FieldWidgetComponentProps<string>);
+ expect(element).not.toBeNull();
+ const forwarded = element!.props as Record<string, unknown>;
+
+ for (const key of [
+ 'error',
+ 'onUploadingChange',
+ 'dataSource',
+ 'dependentValues',
+ 'dependsOn',
+ 'dependsOnLabels',
+ 'emptyHint',
+ 'onSelectRecord',
+ 'onCreateNew',
+ ]) {
+ expect(forwarded).not.toHaveProperty(key);
+ }
+ // CONTROL: the factory's own props are still there, so the assertion above
+ // is not passing because the handoff is empty.
+ expect(forwarded).toHaveProperty('field');
+ expect(forwarded).toHaveProperty('value');
+ });
+
+ it('`error` reaches a real control as `aria-invalid` — the live a11y defect', async () => {
+ const { getByTestId, rerender } = render(
+ <FieldEditWidget field={SELECT_FIELD} value="" onChange={() => {}} error="Required" />,
+ );
+ // `SelectField` puts the DOM pass-through and `aria-invalid` on
+ // `SelectTrigger` — the focusable `button role="combobox"` the user and
+ // their screen reader actually meet (objectui#3306) — not on Radix `Root`,
+ // which renders no element.
+ const trigger = getByTestId('select-trigger-stage');
+ expect(trigger.tagName).toBe('BUTTON');
+ expect(trigger).toHaveAttribute('aria-invalid', 'true');
+
+ // CONTROL: the same widget, same host, no `error`. `SelectField` computes
+ // `!!error`, so a valid field SAYS "false" rather than staying mute — which
+ // makes this a real two-state reading and not "the attribute exists".
+ rerender(<FieldEditWidget field={SELECT_FIELD} value="" onChange={() => {}} />);
+ expect(getByTestId('select-trigger-stage')).toHaveAttribute('aria-invalid', 'false');
+ });
+
+ it('`dataSource`: the explicit prop WINS over SchemaRendererContext', async () => {
+ // The one delivered key that can CHANGE behaviour rather than only add it:
+ // the relational widgets fall back to `SchemaRendererContext` (which the
+ // grid already provides), so delivering the prop creates a precedence
+ // question. `LookupField` already resolves "explicit prop > field-level >
+ // wrapper field > SchemaRendererContext > none"; the factory is a conduit
+ // and adds no second authority. This pins that the delivered prop is what
+ // the widget ends up querying.
+ const LOOKUP_FIELD = { name: 'account', type: 'lookup', reference_to: 'accounts' } as never;
+ const makeSource = () => ({
+ find: vi.fn().mockResolvedValue([]),
+ getObjectSchema: vi.fn().mockResolvedValue({ name: 'accounts' }),
+ });
+
+ const fromProp = makeSource();
+ const fromContext = makeSource();
+
+ render(
+ <SchemaRendererContext.Provider value={{ dataSource: fromContext } as never}>
+ <FieldEditWidget
+ field={LOOKUP_FIELD}
+ value={undefined}
+ onChange={() => {}}
+ dataSource={fromProp}
+ />
+ </SchemaRendererContext.Provider>,
+ );
+
+ await waitFor(() => expect(fromProp.getObjectSchema).toHaveBeenCalledWith('accounts'));
+ expect(fromContext.getObjectSchema).not.toHaveBeenCalled();
+
+ cleanup();
+
+ // CONTROL: drop the prop and the SAME context source IS queried. Without
+ // this, "the context was not called" would be indistinguishable from a
+ // context that was never wired up in this test at all.
+ const contextOnly = makeSource();
+ render(
+ <SchemaRendererContext.Provider value={{ dataSource: contextOnly } as never}>
+ <FieldEditWidget field={LOOKUP_FIELD} value={undefined} onChange={() => {}} />
+ </SchemaRendererContext.Provider>,
+ );
+ await waitFor(() => expect(contextOnly.getObjectSchema).toHaveBeenCalledWith('accounts'));
+ });
+});

packages/fields/src/index.tsx

@@ -3347,6 +3347,15 @@ export { withFieldCarrier } from './withFieldCarrier.js';
 export { toDomProps } from './widgets/toDomProps.js';
 export type { DomProps } from './widgets/toDomProps.js';
 
+// The sibling executor for the NON-DOM half of the same declaration
+// (objectui#7008): `error` plus the "Host plumbing" block, forwarded as
+// COMPONENT props because none of them is DOM-legal. Exported alongside
+// `toDomProps` because a host factory authored outside this repo needs the
+// pair — reaching for only the first one is how `FieldEditWidget` came to
+// deliver half the contract it declares.
+export { toHostProps } from './widgets/toHostProps.js';
+export type { HostProps } from './widgets/toHostProps.js';
+
 // The native date/time control value adapters (objectui#3127). `DateTimeField`
 // is ISO-canonical on BOTH sides — it takes the record's ISO instant and hands
 // an ISO instant back, which is also the wire form the platform's `datetime`

packages/fields/src/widgets/toDomProps.ts

@@ -123,7 +123,16 @@ const DOM_PASS_THROUGH_KEYS = [
  'disabled',
 ] as const;
 
-type DomPassThroughKey = (typeof DOM_PASS_THROUGH_KEYS)[number];
+/**
+ * The keys this helper forwards.
+ *
+ * Exported so the SIBLING executor — `toHostProps`, which carries the declared
+ * NON-DOM keys (objectui#7008) — can subtract this set from the contract and
+ * assert that the two together cover every declared key exactly once. Without
+ * that subtraction there is no way to state "these keys are handled elsewhere"
+ * as a compile-time fact rather than as a comment.
+ */
+export type DomPassThroughKey = (typeof DOM_PASS_THROUGH_KEYS)[number];
 
 /**
  * Compile-time link to the declaration, direction 1 of 2: every key forwarded

.changeset/7008-field-edit-widget-host-plumbing.md

@@ -0,0 +1,33 @@
+---
+'@object-ui/fields': minor
+'@object-ui/plugin-kanban': patch
+---
+
+`FieldEditWidget` now delivers the NON-DOM half of the contract it declares (objectui#7008).
+
+objectui#7009 made the factory forward its declared DOM pass-through block. The rest of
+`FieldWidgetComponentProps` was still dropped: `error`, `onUploadingChange`, and the whole
+"Host plumbing" block (`dataSource`, `dependentValues`, `dependsOn`, `dependsOnLabels`,
+`emptyHint`, `onSelectRecord`, `onCreateNew`). A host could pass any of them with no type
+error and the widget never received it — the "declared but not delivered" class this
+package treats as first-class.
+
+`error` was the live one. `InlineFieldInput` has passed `error` into this factory since
+PR #7109 and the factory dropped it, so an inline-edit control that had failed validation
+never reported `aria-invalid`: a sighted user saw the red hint, a screen-reader user was
+told nothing. The kanban `RequiredFieldsDialog` had the same hole from the other side — it
+computes the validation state and could not hand it over — and now passes `error`, so its
+controls are marked. Delivering `error` buys the a11y MARKING only; the message text stays
+with the host, per the objectui#3222 contract.
+
+The keys travel through a new sibling executor, `toHostProps` (exported alongside
+`toDomProps`), never through the DOM whitelist — none of them is DOM-legal, and routing a
+`dataSource` adapter there is the `[object Object]` leak that whitelist exists to stop.
+Three compile-time assertions make the two executors partition the contract, so a future
+declared key cannot go undelivered silently.
+
+`dataSource` precedence is stated rather than left to emerge: a host's explicit
+`dataSource` prop WINS over `SchemaRendererContext`. That is the order `LookupField`
+already implements; the factory is a conduit and resolves nothing. A host that passes no
+`dataSource` keeps reading the context exactly as before, so no in-repo host changes
+behaviour.

packages/fields/src/FieldEditWidget.tsx

@@ -11,6 +11,9 @@ import type { FieldWidgetComponentProps } from './widgets/types.js';
 // The package's own executor of the DOM pass-through declaration, reused here
 // rather than re-listed — see the note on this component's return statement.
 import { toDomProps } from './widgets/toDomProps.js';
+// The package's own executor of the NON-DOM half of the same declaration
+// (objectui#7008) — a separate function because those keys are not DOM-legal.
+import { toHostProps } from './widgets/toHostProps.js';
 
 // The SAME dedicated widgets the form renders — reused for in-place editing
 // (e.g. the data grid's inline cell editor) so a select edits as a dropdown, a
@@ -271,6 +274,40 @@ const COMPACT_EDIT_TYPES = new Set<string>(['lookup', 'master_detail', 'user']);
  * each widget's own whitelist carries these onto the real focusable control, so
  * nothing here needs to know which element that is. A host that passes nothing
  * is unaffected.
+ *
+ * The host's NON-DOM set is forwarded WHOLE too (objectui#7008), through the
+ * sibling executor `toHostProps`. The DOM fix left the other half of the
+ * contract undelivered: `error`, `onUploadingChange` and the "Host plumbing"
+ * block (`dataSource`, `dependentValues`, `dependsOn`, `dependsOnLabels`,
+ * `emptyHint`, `onSelectRecord`, `onCreateNew`) still type-checked, read as
+ * supported, and never reached the widget. `error` was the live one:
+ * `InlineFieldInput` has passed `error={error}` since PR #7109 and this factory
+ * dropped it, so a control that had failed validation never reported
+ * `aria-invalid`. Forwarding is not a widening — every one of those keys is
+ * already declared on `FieldWidgetComponentProps`, the same argument #7009
+ * landed on in this file.
+ *
+ * ⛔ They do NOT go through `toDomProps`. None of them is DOM-legal, and that
+ * whitelist is closed for exactly this reason — a `dataSource` adapter routed
+ * there becomes `dataSource="[object Object]"` on an `<input>`, the leak the
+ * helper exists to prevent. `toHostProps`' direction-3 assertion makes the two
+ * sets provably disjoint, so the order of the two spreads below is not a
+ * question anyone has to answer again.
+ *
+ * ## `dataSource` precedence: the explicit prop WINS
+ *
+ * Delivering `dataSource` can change behaviour where before it could not
+ * arrive, because the relational widgets fall back to `SchemaRendererContext`
+ * (which the grid already provides). The precedence is therefore STATED rather
+ * than left to emerge: **a host's explicit `dataSource` prop wins over the
+ * context**. That is not a new decision — `LookupField` already resolves
+ * `props.dataSource ?? lookupField?.dataSource ?? fieldMeta?.dataSource ??
+ * contextDataSource` and documents that order on the line that does it. This
+ * factory is a CONDUIT and resolves nothing: adding a resolution here would
+ * give `dataSource` a second author, the `field || schema` shape objectui#3233
+ * removed. A host that passes no `dataSource` keeps reading the context exactly
+ * as before, so no in-repo host changes behaviour. The full per-key precedence
+ * table lives on `toHostProps`, next to the list it governs.
  */
 export function FieldEditWidget(
  props: FieldWidgetComponentProps<any>,
@@ -324,9 +361,17 @@ export function FieldEditWidget(
  // The semantic props stay explicit and come AFTER the spread. They are not in
  // the whitelist, so there is no collision to resolve; ordering them this way
  // states that this component OWNS them and a host cannot displace them.
+ //
+ // `toHostProps` is the same reuse argument applied to the other half of the
+ // declaration (objectui#7008): the declared NON-DOM keys — `error` and the
+ // "Host plumbing" block — travel as COMPONENT props, never through the DOM
+ // whitelist, which is closed against exactly them. The two executors are
+ // asserted disjoint at compile time, so neither spread can shadow the other,
+ // and `compact` below still wins because the factory owns it.
  return (
  <Widget
  {...toDomProps(props)}
+ {...toHostProps(props)}
  field={field}
  value={value}
  onChange={onChange}

packages/fields/src/__tests__/FieldEditWidget.hostPlumbing-7008.test.tsx

@@ -0,0 +1,229 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * `FieldEditWidget` DELIVERS the NON-DOM half of the contract it DECLARES
+ * (objectui#7008) — the other half of objectui#6909 / #7009.
+ *
+ * ## The defect this pins closed
+ *
+ * #7009 made the factory forward `toDomProps(props)`, so the declared DOM block
+ * finally arrived. `FieldWidgetComponentProps` also declares `error`,
+ * `onUploadingChange`, and a whole "Host plumbing" block (`dataSource`,
+ * `dependentValues`, `dependsOn`, `dependsOnLabels`, `emptyHint`,
+ * `onSelectRecord`, `onCreateNew`) — and nothing carried any of it. A host
+ * passed them with no type error and the widget never received them.
+ *
+ * `error` was the LIVE one, and measurably so on `main` at `71d83a6b1`:
+ * `InlineFieldInput` (`@object-ui/plugin-detail`, since PR #7109) already
+ * passes `error={error}` into this factory, which dropped it — so a control
+ * that had failed validation never reported `aria-invalid`. A sighted user saw
+ * the red hint; a screen-reader user was told nothing. That is the class
+ * objectui#3222 / #3290 exist to close, and the one #7002 closed for
+ * `NumberField` one layer down.
+ *
+ * ## What binds it, and what this file adds
+ *
+ * The fix hands the widget `toHostProps(props)` — a SIBLING executor, not more
+ * entries in `DOM_PASS_THROUGH_KEYS`, because none of these keys is DOM-legal
+ * and that whitelist is closed against exactly them. Three compile-time
+ * assertions in `toHostProps.ts` make the two executors PARTITION the contract,
+ * so a future declared key cannot go undelivered without a red build.
+ *
+ * A type cannot see the two things this file pins: that the keys ARRIVE at
+ * runtime, and that arriving actually changes what assistive tech is told.
+ */
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { render, cleanup, waitFor } from '@testing-library/react';
+import '@testing-library/jest-dom';
+import React from 'react';
+import { SchemaRendererContext } from '@object-ui/react';
+
+import { FieldEditWidget } from '../FieldEditWidget';
+import type { FieldWidgetComponentProps } from '../widgets/types';
+
+afterEach(() => cleanup());
+
+/** `select` resolves to `SelectField`, whose trigger carries `aria-invalid`. */
+const SELECT_FIELD = {
+ name: 'stage',
+ type: 'select',
+ label: 'Stage',
+ options: [{ label: 'New', value: 'new' }],
+} as never;
+
+/** `text` resolves to `TextField` — used only where the widget is irrelevant. */
+const TEXT_FIELD = { name: 'f', type: 'text', label: 'F' } as never;
+
+describe('FieldEditWidget delivers its declared NON-DOM block (objectui#7008)', () => {
+ it('forwards every declared host-plumbing key it is handed, at the factory boundary', () => {
+ const onUploadingChange = vi.fn();
+ const onSelectRecord = vi.fn();
+ const onCreateNew = vi.fn();
+ const dataSource = { find: vi.fn() };
+
+ // `zzcanary` is the control, carried over from the #7009 pin: NOT declared
+ // on `FieldWidgetComponentProps` (passing it is a compile error, hence the
+ // cast), but an SDUI node or a field config can carry exactly such a key at
+ // runtime. Without it, "everything forwards now" would be
+ // indistinguishable from having reopened the bare `{...props}` spread.
+ const props = {
+ field: TEXT_FIELD,
+ value: '',
+ onChange: () => {},
+ readonly: false,
+ // the two declared controlled-input keys the factory neither owns nor
+ // routes to the DOM
+ error: 'Required',
+ onUploadingChange,
+ // the declared "Host plumbing" block, minus `compact` (factory-owned)
+ dataSource,
+ dependentValues: { account: 'a1' },
+ dependsOn: 'account',
+ dependsOnLabels: { account: 'Account' },
+ emptyHint: 'Pick an account first',
+ onSelectRecord,
+ onCreateNew,
+ zzcanary: 'CANARY-STR',
+ } as unknown as FieldWidgetComponentProps<string>;
+
+ // Called as a plain function rather than rendered: it uses no hooks and its
+ // return value IS the widget element, so this reads the handoff itself.
+ const element = FieldEditWidget(props);
+ expect(element).not.toBeNull();
+ const forwarded = element!.props as Record<string, unknown>;
+
+ // Exact set, not a subset — a subset check cannot see the control key, and
+ // an extra key appearing here is the leak this guards.
+ expect(Object.keys(forwarded).sort()).toEqual(
+ [
+ // rendered by the factory itself
+ 'field',
+ 'value',
+ 'onChange',
+ 'readonly',
+ // the declared NON-DOM keys, via `toHostProps`
+ 'error',
+ 'onUploadingChange',
+ 'dataSource',
+ 'dependentValues',
+ 'dependsOn',
+ 'dependsOnLabels',
+ 'emptyHint',
+ 'onSelectRecord',
+ 'onCreateNew',
+ ].sort(),
+ );
+
+ // Identity, not just presence: a conduit hands over the host's own object.
+ expect(forwarded.dataSource).toBe(dataSource);
+ expect(forwarded.onSelectRecord).toBe(onSelectRecord);
+ expect(forwarded.onCreateNew).toBe(onCreateNew);
+ expect(forwarded.onUploadingChange).toBe(onUploadingChange);
+ expect(forwarded.error).toBe('Required');
+
+ // CONTROL: the undeclared authored key is still dropped.
+ expect(forwarded).not.toHaveProperty('zzcanary');
+ });
+
+ it('CONTROL: a key the host did not pass stays ABSENT, not `undefined`', () => {
+ // The #7009 pin asserts an exact boundary set for a host that passes only
+ // DOM keys. Forwarding the non-DOM block as nine always-present
+ // `undefined`s would have broken that pin AND made the boundary unreadable
+ // — "what the host supplied" is the claim, so absence must survive.
+ const element = FieldEditWidget({
+ field: TEXT_FIELD,
+ value: '',
+ onChange: () => {},
+ } as FieldWidgetComponentProps<string>);
+ expect(element).not.toBeNull();
+ const forwarded = element!.props as Record<string, unknown>;
+
+ for (const key of [
+ 'error',
+ 'onUploadingChange',
+ 'dataSource',
+ 'dependentValues',
+ 'dependsOn',
+ 'dependsOnLabels',
+ 'emptyHint',
+ 'onSelectRecord',
+ 'onCreateNew',
+ ]) {
+ expect(forwarded).not.toHaveProperty(key);
+ }
+ // CONTROL: the factory's own props are still there, so the assertion above
+ // is not passing because the handoff is empty.
+ expect(forwarded).toHaveProperty('field');
+ expect(forwarded).toHaveProperty('value');
+ });
+
+ it('`error` reaches a real control as `aria-invalid` — the live a11y defect', async () => {
+ const { getByTestId, rerender } = render(
+ <FieldEditWidget field={SELECT_FIELD} value="" onChange={() => {}} error="Required" />,
+ );
+ // `SelectField` puts the DOM pass-through and `aria-invalid` on
+ // `SelectTrigger` — the focusable `button role="combobox"` the user and
+ // their screen reader actually meet (objectui#3306) — not on Radix `Root`,
+ // which renders no element.
+ const trigger = getByTestId('select-trigger-stage');
+ expect(trigger.tagName).toBe('BUTTON');
+ expect(trigger).toHaveAttribute('aria-invalid', 'true');
+
+ // CONTROL: the same widget, same host, no `error`. `SelectField` computes
+ // `!!error`, so a valid field SAYS "false" rather than staying mute — which
+ // makes this a real two-state reading and not "the attribute exists".
+ rerender(<FieldEditWidget field={SELECT_FIELD} value="" onChange={() => {}} />);
+ expect(getByTestId('select-trigger-stage')).toHaveAttribute('aria-invalid', 'false');
+ });
+
+ it('`dataSource`: the explicit prop WINS over SchemaRendererContext', async () => {
+ // The one delivered key that can CHANGE behaviour rather than only add it:
+ // the relational widgets fall back to `SchemaRendererContext` (which the
+ // grid already provides), so delivering the prop creates a precedence
+ // question. `LookupField` already resolves "explicit prop > field-level >
+ // wrapper field > SchemaRendererContext > none"; the factory is a conduit
+ // and adds no second authority. This pins that the delivered prop is what
+ // the widget ends up querying.
+ const LOOKUP_FIELD = { name: 'account', type: 'lookup', reference_to: 'accounts' } as never;
+ const makeSource = () => ({
+ find: vi.fn().mockResolvedValue([]),
+ getObjectSchema: vi.fn().mockResolvedValue({ name: 'accounts' }),
+ });
+
+ const fromProp = makeSource();
+ const fromContext = makeSource();
+
+ render(
+ <SchemaRendererContext.Provider value={{ dataSource: fromContext } as never}>
+ <FieldEditWidget
+ field={LOOKUP_FIELD}
+ value={undefined}
+ onChange={() => {}}
+ dataSource={fromProp}
+ />
+ </SchemaRendererContext.Provider>,
+ );
+
+ await waitFor(() => expect(fromProp.getObjectSchema).toHaveBeenCalledWith('accounts'));
+ expect(fromContext.getObjectSchema).not.toHaveBeenCalled();
+
+ cleanup();
+
+ // CONTROL: drop the prop and the SAME context source IS queried. Without
+ // this, "the context was not called" would be indistinguishable from a
+ // context that was never wired up in this test at all.
+ const contextOnly = makeSource();
+ render(
+ <SchemaRendererContext.Provider value={{ dataSource: contextOnly } as never}>
+ <FieldEditWidget field={LOOKUP_FIELD} value={undefined} onChange={() => {}} />
+ </SchemaRendererContext.Provider>,
+ );
+ await waitFor(() => expect(contextOnly.getObjectSchema).toHaveBeenCalledWith('accounts'));
+ });
+});

packages/fields/src/index.tsx

@@ -3347,6 +3347,15 @@ export { withFieldCarrier } from './withFieldCarrier.js';
 export { toDomProps } from './widgets/toDomProps.js';
 export type { DomProps } from './widgets/toDomProps.js';
 
+// The sibling executor for the NON-DOM half of the same declaration
+// (objectui#7008): `error` plus the "Host plumbing" block, forwarded as
+// COMPONENT props because none of them is DOM-legal. Exported alongside
+// `toDomProps` because a host factory authored outside this repo needs the
+// pair — reaching for only the first one is how `FieldEditWidget` came to
+// deliver half the contract it declares.
+export { toHostProps } from './widgets/toHostProps.js';
+export type { HostProps } from './widgets/toHostProps.js';
+
 // The native date/time control value adapters (objectui#3127). `DateTimeField`
 // is ISO-canonical on BOTH sides — it takes the record's ISO instant and hands
 // an ISO instant back, which is also the wire form the platform's `datetime`

packages/fields/src/widgets/toDomProps.ts

@@ -123,7 +123,16 @@ const DOM_PASS_THROUGH_KEYS = [
  'disabled',
 ] as const;
 
-type DomPassThroughKey = (typeof DOM_PASS_THROUGH_KEYS)[number];
+/**
+ * The keys this helper forwards.
+ *
+ * Exported so the SIBLING executor — `toHostProps`, which carries the declared
+ * NON-DOM keys (objectui#7008) — can subtract this set from the contract and
+ * assert that the two together cover every declared key exactly once. Without
+ * that subtraction there is no way to state "these keys are handled elsewhere"
+ * as a compile-time fact rather than as a comment.
+ */
+export type DomPassThroughKey = (typeof DOM_PASS_THROUGH_KEYS)[number];
 
 /**
  * Compile-time link to the declaration, direction 1 of 2: every key forwarded

.changeset/7008-field-edit-widget-host-plumbing.md

@@ -0,0 +1,33 @@
+---
+'@object-ui/fields': minor
+'@object-ui/plugin-kanban': patch
+---
+
+`FieldEditWidget` now delivers the NON-DOM half of the contract it declares (objectui#7008).
+
+objectui#7009 made the factory forward its declared DOM pass-through block. The rest of
+`FieldWidgetComponentProps` was still dropped: `error`, `onUploadingChange`, and the whole
+"Host plumbing" block (`dataSource`, `dependentValues`, `dependsOn`, `dependsOnLabels`,
+`emptyHint`, `onSelectRecord`, `onCreateNew`). A host could pass any of them with no type
+error and the widget never received it — the "declared but not delivered" class this
+package treats as first-class.
+
+`error` was the live one. `InlineFieldInput` has passed `error` into this factory since
+PR #7109 and the factory dropped it, so an inline-edit control that had failed validation
+never reported `aria-invalid`: a sighted user saw the red hint, a screen-reader user was
+told nothing. The kanban `RequiredFieldsDialog` had the same hole from the other side — it
+computes the validation state and could not hand it over — and now passes `error`, so its
+controls are marked. Delivering `error` buys the a11y MARKING only; the message text stays
+with the host, per the objectui#3222 contract.
+
+The keys travel through a new sibling executor, `toHostProps` (exported alongside
+`toDomProps`), never through the DOM whitelist — none of them is DOM-legal, and routing a
+`dataSource` adapter there is the `[object Object]` leak that whitelist exists to stop.
+Three compile-time assertions make the two executors partition the contract, so a future
+declared key cannot go undelivered silently.
+
+`dataSource` precedence is stated rather than left to emerge: a host's explicit
+`dataSource` prop WINS over `SchemaRendererContext`. That is the order `LookupField`
+already implements; the factory is a conduit and resolves nothing. A host that passes no
+`dataSource` keeps reading the context exactly as before, so no in-repo host changes
+behaviour.

packages/fields/src/FieldEditWidget.tsx

@@ -11,6 +11,9 @@ import type { FieldWidgetComponentProps } from './widgets/types.js';
 // The package's own executor of the DOM pass-through declaration, reused here
 // rather than re-listed — see the note on this component's return statement.
 import { toDomProps } from './widgets/toDomProps.js';
+// The package's own executor of the NON-DOM half of the same declaration
+// (objectui#7008) — a separate function because those keys are not DOM-legal.
+import { toHostProps } from './widgets/toHostProps.js';
 
 // The SAME dedicated widgets the form renders — reused for in-place editing
 // (e.g. the data grid's inline cell editor) so a select edits as a dropdown, a
@@ -271,6 +274,40 @@ const COMPACT_EDIT_TYPES = new Set<string>(['lookup', 'master_detail', 'user']);
  * each widget's own whitelist carries these onto the real focusable control, so
  * nothing here needs to know which element that is. A host that passes nothing
  * is unaffected.
+ *
+ * The host's NON-DOM set is forwarded WHOLE too (objectui#7008), through the
+ * sibling executor `toHostProps`. The DOM fix left the other half of the
+ * contract undelivered: `error`, `onUploadingChange` and the "Host plumbing"
+ * block (`dataSource`, `dependentValues`, `dependsOn`, `dependsOnLabels`,
+ * `emptyHint`, `onSelectRecord`, `onCreateNew`) still type-checked, read as
+ * supported, and never reached the widget. `error` was the live one:
+ * `InlineFieldInput` has passed `error={error}` since PR #7109 and this factory
+ * dropped it, so a control that had failed validation never reported
+ * `aria-invalid`. Forwarding is not a widening — every one of those keys is
+ * already declared on `FieldWidgetComponentProps`, the same argument #7009
+ * landed on in this file.
+ *
+ * ⛔ They do NOT go through `toDomProps`. None of them is DOM-legal, and that
+ * whitelist is closed for exactly this reason — a `dataSource` adapter routed
+ * there becomes `dataSource="[object Object]"` on an `<input>`, the leak the
+ * helper exists to prevent. `toHostProps`' direction-3 assertion makes the two
+ * sets provably disjoint, so the order of the two spreads below is not a
+ * question anyone has to answer again.
+ *
+ * ## `dataSource` precedence: the explicit prop WINS
+ *
+ * Delivering `dataSource` can change behaviour where before it could not
+ * arrive, because the relational widgets fall back to `SchemaRendererContext`
+ * (which the grid already provides). The precedence is therefore STATED rather
+ * than left to emerge: **a host's explicit `dataSource` prop wins over the
+ * context**. That is not a new decision — `LookupField` already resolves
+ * `props.dataSource ?? lookupField?.dataSource ?? fieldMeta?.dataSource ??
+ * contextDataSource` and documents that order on the line that does it. This
+ * factory is a CONDUIT and resolves nothing: adding a resolution here would
+ * give `dataSource` a second author, the `field || schema` shape objectui#3233
+ * removed. A host that passes no `dataSource` keeps reading the context exactly
+ * as before, so no in-repo host changes behaviour. The full per-key precedence
+ * table lives on `toHostProps`, next to the list it governs.
  */
 export function FieldEditWidget(
  props: FieldWidgetComponentProps<any>,
@@ -324,9 +361,17 @@ export function FieldEditWidget(
  // The semantic props stay explicit and come AFTER the spread. They are not in
  // the whitelist, so there is no collision to resolve; ordering them this way
  // states that this component OWNS them and a host cannot displace them.
+ //
+ // `toHostProps` is the same reuse argument applied to the other half of the
+ // declaration (objectui#7008): the declared NON-DOM keys — `error` and the
+ // "Host plumbing" block — travel as COMPONENT props, never through the DOM
+ // whitelist, which is closed against exactly them. The two executors are
+ // asserted disjoint at compile time, so neither spread can shadow the other,
+ // and `compact` below still wins because the factory owns it.
  return (
  <Widget
  {...toDomProps(props)}
+ {...toHostProps(props)}
  field={field}
  value={value}
  onChange={onChange}

packages/fields/src/__tests__/FieldEditWidget.hostPlumbing-7008.test.tsx

@@ -0,0 +1,229 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * `FieldEditWidget` DELIVERS the NON-DOM half of the contract it DECLARES
+ * (objectui#7008) — the other half of objectui#6909 / #7009.
+ *
+ * ## The defect this pins closed
+ *
+ * #7009 made the factory forward `toDomProps(props)`, so the declared DOM block
+ * finally arrived. `FieldWidgetComponentProps` also declares `error`,
+ * `onUploadingChange`, and a whole "Host plumbing" block (`dataSource`,
+ * `dependentValues`, `dependsOn`, `dependsOnLabels`, `emptyHint`,
+ * `onSelectRecord`, `onCreateNew`) — and nothing carried any of it. A host
+ * passed them with no type error and the widget never received them.
+ *
+ * `error` was the LIVE one, and measurably so on `main` at `71d83a6b1`:
+ * `InlineFieldInput` (`@object-ui/plugin-detail`, since PR #7109) already
+ * passes `error={error}` into this factory, which dropped it — so a control
+ * that had failed validation never reported `aria-invalid`. A sighted user saw
+ * the red hint; a screen-reader user was told nothing. That is the class
+ * objectui#3222 / #3290 exist to close, and the one #7002 closed for
+ * `NumberField` one layer down.
+ *
+ * ## What binds it, and what this file adds
+ *
+ * The fix hands the widget `toHostProps(props)` — a SIBLING executor, not more
+ * entries in `DOM_PASS_THROUGH_KEYS`, because none of these keys is DOM-legal
+ * and that whitelist is closed against exactly them. Three compile-time
+ * assertions in `toHostProps.ts` make the two executors PARTITION the contract,
+ * so a future declared key cannot go undelivered without a red build.
+ *
+ * A type cannot see the two things this file pins: that the keys ARRIVE at
+ * runtime, and that arriving actually changes what assistive tech is told.
+ */
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { render, cleanup, waitFor } from '@testing-library/react';
+import '@testing-library/jest-dom';
+import React from 'react';
+import { SchemaRendererContext } from '@object-ui/react';
+
+import { FieldEditWidget } from '../FieldEditWidget';
+import type { FieldWidgetComponentProps } from '../widgets/types';
+
+afterEach(() => cleanup());
+
+/** `select` resolves to `SelectField`, whose trigger carries `aria-invalid`. */
+const SELECT_FIELD = {
+ name: 'stage',
+ type: 'select',
+ label: 'Stage',
+ options: [{ label: 'New', value: 'new' }],
+} as never;
+
+/** `text` resolves to `TextField` — used only where the widget is irrelevant. */
+const TEXT_FIELD = { name: 'f', type: 'text', label: 'F' } as never;
+
+describe('FieldEditWidget delivers its declared NON-DOM block (objectui#7008)', () => {
+ it('forwards every declared host-plumbing key it is handed, at the factory boundary', () => {
+ const onUploadingChange = vi.fn();
+ const onSelectRecord = vi.fn();
+ const onCreateNew = vi.fn();
+ const dataSource = { find: vi.fn() };
+
+ // `zzcanary` is the control, carried over from the #7009 pin: NOT declared
+ // on `FieldWidgetComponentProps` (passing it is a compile error, hence the
+ // cast), but an SDUI node or a field config can carry exactly such a key at
+ // runtime. Without it, "everything forwards now" would be
+ // indistinguishable from having reopened the bare `{...props}` spread.
+ const props = {
+ field: TEXT_FIELD,
+ value: '',
+ onChange: () => {},
+ readonly: false,
+ // the two declared controlled-input keys the factory neither owns nor
+ // routes to the DOM
+ error: 'Required',
+ onUploadingChange,
+ // the declared "Host plumbing" block, minus `compact` (factory-owned)
+ dataSource,
+ dependentValues: { account: 'a1' },
+ dependsOn: 'account',
+ dependsOnLabels: { account: 'Account' },
+ emptyHint: 'Pick an account first',
+ onSelectRecord,
+ onCreateNew,
+ zzcanary: 'CANARY-STR',
+ } as unknown as FieldWidgetComponentProps<string>;
+
+ // Called as a plain function rather than rendered: it uses no hooks and its
+ // return value IS the widget element, so this reads the handoff itself.
+ const element = FieldEditWidget(props);
+ expect(element).not.toBeNull();
+ const forwarded = element!.props as Record<string, unknown>;
+
+ // Exact set, not a subset — a subset check cannot see the control key, and
+ // an extra key appearing here is the leak this guards.
+ expect(Object.keys(forwarded).sort()).toEqual(
+ [
+ // rendered by the factory itself
+ 'field',
+ 'value',
+ 'onChange',
+ 'readonly',
+ // the declared NON-DOM keys, via `toHostProps`
+ 'error',
+ 'onUploadingChange',
+ 'dataSource',
+ 'dependentValues',
+ 'dependsOn',
+ 'dependsOnLabels',
+ 'emptyHint',
+ 'onSelectRecord',
+ 'onCreateNew',
+ ].sort(),
+ );
+
+ // Identity, not just presence: a conduit hands over the host's own object.
+ expect(forwarded.dataSource).toBe(dataSource);
+ expect(forwarded.onSelectRecord).toBe(onSelectRecord);
+ expect(forwarded.onCreateNew).toBe(onCreateNew);
+ expect(forwarded.onUploadingChange).toBe(onUploadingChange);
+ expect(forwarded.error).toBe('Required');
+
+ // CONTROL: the undeclared authored key is still dropped.
+ expect(forwarded).not.toHaveProperty('zzcanary');
+ });
+
+ it('CONTROL: a key the host did not pass stays ABSENT, not `undefined`', () => {
+ // The #7009 pin asserts an exact boundary set for a host that passes only
+ // DOM keys. Forwarding the non-DOM block as nine always-present
+ // `undefined`s would have broken that pin AND made the boundary unreadable
+ // — "what the host supplied" is the claim, so absence must survive.
+ const element = FieldEditWidget({
+ field: TEXT_FIELD,
+ value: '',
+ onChange: () => {},
+ } as FieldWidgetComponentProps<string>);
+ expect(element).not.toBeNull();
+ const forwarded = element!.props as Record<string, unknown>;
+
+ for (const key of [
+ 'error',
+ 'onUploadingChange',
+ 'dataSource',
+ 'dependentValues',
+ 'dependsOn',
+ 'dependsOnLabels',
+ 'emptyHint',
+ 'onSelectRecord',
+ 'onCreateNew',
+ ]) {
+ expect(forwarded).not.toHaveProperty(key);
+ }
+ // CONTROL: the factory's own props are still there, so the assertion above
+ // is not passing because the handoff is empty.
+ expect(forwarded).toHaveProperty('field');
+ expect(forwarded).toHaveProperty('value');
+ });
+
+ it('`error` reaches a real control as `aria-invalid` — the live a11y defect', async () => {
+ const { getByTestId, rerender } = render(
+ <FieldEditWidget field={SELECT_FIELD} value="" onChange={() => {}} error="Required" />,
+ );
+ // `SelectField` puts the DOM pass-through and `aria-invalid` on
+ // `SelectTrigger` — the focusable `button role="combobox"` the user and
+ // their screen reader actually meet (objectui#3306) — not on Radix `Root`,
+ // which renders no element.
+ const trigger = getByTestId('select-trigger-stage');
+ expect(trigger.tagName).toBe('BUTTON');
+ expect(trigger).toHaveAttribute('aria-invalid', 'true');
+
+ // CONTROL: the same widget, same host, no `error`. `SelectField` computes
+ // `!!error`, so a valid field SAYS "false" rather than staying mute — which
+ // makes this a real two-state reading and not "the attribute exists".
+ rerender(<FieldEditWidget field={SELECT_FIELD} value="" onChange={() => {}} />);
+ expect(getByTestId('select-trigger-stage')).toHaveAttribute('aria-invalid', 'false');
+ });
+
+ it('`dataSource`: the explicit prop WINS over SchemaRendererContext', async () => {
+ // The one delivered key that can CHANGE behaviour rather than only add it:
+ // the relational widgets fall back to `SchemaRendererContext` (which the
+ // grid already provides), so delivering the prop creates a precedence
+ // question. `LookupField` already resolves "explicit prop > field-level >
+ // wrapper field > SchemaRendererContext > none"; the factory is a conduit
+ // and adds no second authority. This pins that the delivered prop is what
+ // the widget ends up querying.
+ const LOOKUP_FIELD = { name: 'account', type: 'lookup', reference_to: 'accounts' } as never;
+ const makeSource = () => ({
+ find: vi.fn().mockResolvedValue([]),
+ getObjectSchema: vi.fn().mockResolvedValue({ name: 'accounts' }),
+ });
+
+ const fromProp = makeSource();
+ const fromContext = makeSource();
+
+ render(
+ <SchemaRendererContext.Provider value={{ dataSource: fromContext } as never}>
+ <FieldEditWidget
+ field={LOOKUP_FIELD}
+ value={undefined}
+ onChange={() => {}}
+ dataSource={fromProp}
+ />
+ </SchemaRendererContext.Provider>,
+ );
+
+ await waitFor(() => expect(fromProp.getObjectSchema).toHaveBeenCalledWith('accounts'));
+ expect(fromContext.getObjectSchema).not.toHaveBeenCalled();
+
+ cleanup();
+
+ // CONTROL: drop the prop and the SAME context source IS queried. Without
+ // this, "the context was not called" would be indistinguishable from a
+ // context that was never wired up in this test at all.
+ const contextOnly = makeSource();
+ render(
+ <SchemaRendererContext.Provider value={{ dataSource: contextOnly } as never}>
+ <FieldEditWidget field={LOOKUP_FIELD} value={undefined} onChange={() => {}} />
+ </SchemaRendererContext.Provider>,
+ );
+ await waitFor(() => expect(contextOnly.getObjectSchema).toHaveBeenCalledWith('accounts'));
+ });
+});

packages/fields/src/index.tsx

@@ -3347,6 +3347,15 @@ export { withFieldCarrier } from './withFieldCarrier.js';
 export { toDomProps } from './widgets/toDomProps.js';
 export type { DomProps } from './widgets/toDomProps.js';
 
+// The sibling executor for the NON-DOM half of the same declaration
+// (objectui#7008): `error` plus the "Host plumbing" block, forwarded as
+// COMPONENT props because none of them is DOM-legal. Exported alongside
+// `toDomProps` because a host factory authored outside this repo needs the
+// pair — reaching for only the first one is how `FieldEditWidget` came to
+// deliver half the contract it declares.
+export { toHostProps } from './widgets/toHostProps.js';
+export type { HostProps } from './widgets/toHostProps.js';
+
 // The native date/time control value adapters (objectui#3127). `DateTimeField`
 // is ISO-canonical on BOTH sides — it takes the record's ISO instant and hands
 // an ISO instant back, which is also the wire form the platform's `datetime`

packages/fields/src/widgets/toDomProps.ts

@@ -123,7 +123,16 @@ const DOM_PASS_THROUGH_KEYS = [
  'disabled',
 ] as const;
 
-type DomPassThroughKey = (typeof DOM_PASS_THROUGH_KEYS)[number];
+/**
+ * The keys this helper forwards.
+ *
+ * Exported so the SIBLING executor — `toHostProps`, which carries the declared
+ * NON-DOM keys (objectui#7008) — can subtract this set from the contract and
+ * assert that the two together cover every declared key exactly once. Without
+ * that subtraction there is no way to state "these keys are handled elsewhere"
+ * as a compile-time fact rather than as a comment.
+ */
+export type DomPassThroughKey = (typeof DOM_PASS_THROUGH_KEYS)[number];
 
 /**
  * Compile-time link to the declaration, direction 1 of 2: every key forwarded

.changeset/7008-field-edit-widget-host-plumbing.md

@@ -0,0 +1,33 @@
+---
+'@object-ui/fields': minor
+'@object-ui/plugin-kanban': patch
+---
+
+`FieldEditWidget` now delivers the NON-DOM half of the contract it declares (objectui#7008).
+
+objectui#7009 made the factory forward its declared DOM pass-through block. The rest of
+`FieldWidgetComponentProps` was still dropped: `error`, `onUploadingChange`, and the whole
+"Host plumbing" block (`dataSource`, `dependentValues`, `dependsOn`, `dependsOnLabels`,
+`emptyHint`, `onSelectRecord`, `onCreateNew`). A host could pass any of them with no type
+error and the widget never received it — the "declared but not delivered" class this
+package treats as first-class.
+
+`error` was the live one. `InlineFieldInput` has passed `error` into this factory since
+PR #7109 and the factory dropped it, so an inline-edit control that had failed validation
+never reported `aria-invalid`: a sighted user saw the red hint, a screen-reader user was
+told nothing. The kanban `RequiredFieldsDialog` had the same hole from the other side — it
+computes the validation state and could not hand it over — and now passes `error`, so its
+controls are marked. Delivering `error` buys the a11y MARKING only; the message text stays
+with the host, per the objectui#3222 contract.
+
+The keys travel through a new sibling executor, `toHostProps` (exported alongside
+`toDomProps`), never through the DOM whitelist — none of them is DOM-legal, and routing a
+`dataSource` adapter there is the `[object Object]` leak that whitelist exists to stop.
+Three compile-time assertions make the two executors partition the contract, so a future
+declared key cannot go undelivered silently.
+
+`dataSource` precedence is stated rather than left to emerge: a host's explicit
+`dataSource` prop WINS over `SchemaRendererContext`. That is the order `LookupField`
+already implements; the factory is a conduit and resolves nothing. A host that passes no
+`dataSource` keeps reading the context exactly as before, so no in-repo host changes
+behaviour.

packages/fields/src/FieldEditWidget.tsx

@@ -11,6 +11,9 @@ import type { FieldWidgetComponentProps } from './widgets/types.js';
 // The package's own executor of the DOM pass-through declaration, reused here
 // rather than re-listed — see the note on this component's return statement.
 import { toDomProps } from './widgets/toDomProps.js';
+// The package's own executor of the NON-DOM half of the same declaration
+// (objectui#7008) — a separate function because those keys are not DOM-legal.
+import { toHostProps } from './widgets/toHostProps.js';
 
 // The SAME dedicated widgets the form renders — reused for in-place editing
 // (e.g. the data grid's inline cell editor) so a select edits as a dropdown, a
@@ -271,6 +274,40 @@ const COMPACT_EDIT_TYPES = new Set<string>(['lookup', 'master_detail', 'user']);
  * each widget's own whitelist carries these onto the real focusable control, so
  * nothing here needs to know which element that is. A host that passes nothing
  * is unaffected.
+ *
+ * The host's NON-DOM set is forwarded WHOLE too (objectui#7008), through the
+ * sibling executor `toHostProps`. The DOM fix left the other half of the
+ * contract undelivered: `error`, `onUploadingChange` and the "Host plumbing"
+ * block (`dataSource`, `dependentValues`, `dependsOn`, `dependsOnLabels`,
+ * `emptyHint`, `onSelectRecord`, `onCreateNew`) still type-checked, read as
+ * supported, and never reached the widget. `error` was the live one:
+ * `InlineFieldInput` has passed `error={error}` since PR #7109 and this factory
+ * dropped it, so a control that had failed validation never reported
+ * `aria-invalid`. Forwarding is not a widening — every one of those keys is
+ * already declared on `FieldWidgetComponentProps`, the same argument #7009
+ * landed on in this file.
+ *
+ * ⛔ They do NOT go through `toDomProps`. None of them is DOM-legal, and that
+ * whitelist is closed for exactly this reason — a `dataSource` adapter routed
+ * there becomes `dataSource="[object Object]"` on an `<input>`, the leak the
+ * helper exists to prevent. `toHostProps`' direction-3 assertion makes the two
+ * sets provably disjoint, so the order of the two spreads below is not a
+ * question anyone has to answer again.
+ *
+ * ## `dataSource` precedence: the explicit prop WINS
+ *
+ * Delivering `dataSource` can change behaviour where before it could not
+ * arrive, because the relational widgets fall back to `SchemaRendererContext`
+ * (which the grid already provides). The precedence is therefore STATED rather
+ * than left to emerge: **a host's explicit `dataSource` prop wins over the
+ * context**. That is not a new decision — `LookupField` already resolves
+ * `props.dataSource ?? lookupField?.dataSource ?? fieldMeta?.dataSource ??
+ * contextDataSource` and documents that order on the line that does it. This
+ * factory is a CONDUIT and resolves nothing: adding a resolution here would
+ * give `dataSource` a second author, the `field || schema` shape objectui#3233
+ * removed. A host that passes no `dataSource` keeps reading the context exactly
+ * as before, so no in-repo host changes behaviour. The full per-key precedence
+ * table lives on `toHostProps`, next to the list it governs.
  */
 export function FieldEditWidget(
  props: FieldWidgetComponentProps<any>,
@@ -324,9 +361,17 @@ export function FieldEditWidget(
  // The semantic props stay explicit and come AFTER the spread. They are not in
  // the whitelist, so there is no collision to resolve; ordering them this way
  // states that this component OWNS them and a host cannot displace them.
+ //
+ // `toHostProps` is the same reuse argument applied to the other half of the
+ // declaration (objectui#7008): the declared NON-DOM keys — `error` and the
+ // "Host plumbing" block — travel as COMPONENT props, never through the DOM
+ // whitelist, which is closed against exactly them. The two executors are
+ // asserted disjoint at compile time, so neither spread can shadow the other,
+ // and `compact` below still wins because the factory owns it.
  return (
  <Widget
  {...toDomProps(props)}
+ {...toHostProps(props)}
  field={field}
  value={value}
  onChange={onChange}

packages/fields/src/__tests__/FieldEditWidget.hostPlumbing-7008.test.tsx

@@ -0,0 +1,229 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+/**
+ * `FieldEditWidget` DELIVERS the NON-DOM half of the contract it DECLARES
+ * (objectui#7008) — the other half of objectui#6909 / #7009.
+ *
+ * ## The defect this pins closed
+ *
+ * #7009 made the factory forward `toDomProps(props)`, so the declared DOM block
+ * finally arrived. `FieldWidgetComponentProps` also declares `error`,
+ * `onUploadingChange`, and a whole "Host plumbing" block (`dataSource`,
+ * `dependentValues`, `dependsOn`, `dependsOnLabels`, `emptyHint`,
+ * `onSelectRecord`, `onCreateNew`) — and nothing carried any of it. A host
+ * passed them with no type error and the widget never received them.
+ *
+ * `error` was the LIVE one, and measurably so on `main` at `71d83a6b1`:
+ * `InlineFieldInput` (`@object-ui/plugin-detail`, since PR #7109) already
+ * passes `error={error}` into this factory, which dropped it — so a control
+ * that had failed validation never reported `aria-invalid`. A sighted user saw
+ * the red hint; a screen-reader user was told nothing. That is the class
+ * objectui#3222 / #3290 exist to close, and the one #7002 closed for
+ * `NumberField` one layer down.
+ *
+ * ## What binds it, and what this file adds
+ *
+ * The fix hands the widget `toHostProps(props)` — a SIBLING executor, not more
+ * entries in `DOM_PASS_THROUGH_KEYS`, because none of these keys is DOM-legal
+ * and that whitelist is closed against exactly them. Three compile-time
+ * assertions in `toHostProps.ts` make the two executors PARTITION the contract,
+ * so a future declared key cannot go undelivered without a red build.
+ *
+ * A type cannot see the two things this file pins: that the keys ARRIVE at
+ * runtime, and that arriving actually changes what assistive tech is told.
+ */
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { render, cleanup, waitFor } from '@testing-library/react';
+import '@testing-library/jest-dom';
+import React from 'react';
+import { SchemaRendererContext } from '@object-ui/react';
+
+import { FieldEditWidget } from '../FieldEditWidget';
+import type { FieldWidgetComponentProps } from '../widgets/types';
+
+afterEach(() => cleanup());
+
+/** `select` resolves to `SelectField`, whose trigger carries `aria-invalid`. */
+const SELECT_FIELD = {
+ name: 'stage',
+ type: 'select',
+ label: 'Stage',
+ options: [{ label: 'New', value: 'new' }],
+} as never;
+
+/** `text` resolves to `TextField` — used only where the widget is irrelevant. */
+const TEXT_FIELD = { name: 'f', type: 'text', label: 'F' } as never;
+
+describe('FieldEditWidget delivers its declared NON-DOM block (objectui#7008)', () => {
+ it('forwards every declared host-plumbing key it is handed, at the factory boundary', () => {
+ const onUploadingChange = vi.fn();
+ const onSelectRecord = vi.fn();
+ const onCreateNew = vi.fn();
+ const dataSource = { find: vi.fn() };
+
+ // `zzcanary` is the control, carried over from the #7009 pin: NOT declared
+ // on `FieldWidgetComponentProps` (passing it is a compile error, hence the
+ // cast), but an SDUI node or a field config can carry exactly such a key at
+ // runtime. Without it, "everything forwards now" would be
+ // indistinguishable from having reopened the bare `{...props}` spread.
+ const props = {
+ field: TEXT_FIELD,
+ value: '',
+ onChange: () => {},
+ readonly: false,
+ // the two declared controlled-input keys the factory neither owns nor
+ // routes to the DOM
+ error: 'Required',
+ onUploadingChange,
+ // the declared "Host plumbing" block, minus `compact` (factory-owned)
+ dataSource,
+ dependentValues: { account: 'a1' },
+ dependsOn: 'account',
+ dependsOnLabels: { account: 'Account' },
+ emptyHint: 'Pick an account first',
+ onSelectRecord,
+ onCreateNew,
+ zzcanary: 'CANARY-STR',
+ } as unknown as FieldWidgetComponentProps<string>;
+
+ // Called as a plain function rather than rendered: it uses no hooks and its
+ // return value IS the widget element, so this reads the handoff itself.
+ const element = FieldEditWidget(props);
+ expect(element).not.toBeNull();
+ const forwarded = element!.props as Record<string, unknown>;
+
+ // Exact set, not a subset — a subset check cannot see the control key, and
+ // an extra key appearing here is the leak this guards.
+ expect(Object.keys(forwarded).sort()).toEqual(
+ [
+ // rendered by the factory itself
+ 'field',
+ 'value',
+ 'onChange',
+ 'readonly',
+ // the declared NON-DOM keys, via `toHostProps`
+ 'error',
+ 'onUploadingChange',
+ 'dataSource',
+ 'dependentValues',
+ 'dependsOn',
+ 'dependsOnLabels',
+ 'emptyHint',
+ 'onSelectRecord',
+ 'onCreateNew',
+ ].sort(),
+ );
+
+ // Identity, not just presence: a conduit hands over the host's own object.
+ expect(forwarded.dataSource).toBe(dataSource);
+ expect(forwarded.onSelectRecord).toBe(onSelectRecord);
+ expect(forwarded.onCreateNew).toBe(onCreateNew);
+ expect(forwarded.onUploadingChange).toBe(onUploadingChange);
+ expect(forwarded.error).toBe('Required');
+
+ // CONTROL: the undeclared authored key is still dropped.
+ expect(forwarded).not.toHaveProperty('zzcanary');
+ });
+
+ it('CONTROL: a key the host did not pass stays ABSENT, not `undefined`', () => {
+ // The #7009 pin asserts an exact boundary set for a host that passes only
+ // DOM keys. Forwarding the non-DOM block as nine always-present
+ // `undefined`s would have broken that pin AND made the boundary unreadable
+ // — "what the host supplied" is the claim, so absence must survive.
+ const element = FieldEditWidget({
+ field: TEXT_FIELD,
+ value: '',
+ onChange: () => {},
+ } as FieldWidgetComponentProps<string>);
+ expect(element).not.toBeNull();
+ const forwarded = element!.props as Record<string, unknown>;
+
+ for (const key of [
+ 'error',
+ 'onUploadingChange',
+ 'dataSource',
+ 'dependentValues',
+ 'dependsOn',
+ 'dependsOnLabels',
+ 'emptyHint',
+ 'onSelectRecord',
+ 'onCreateNew',
+ ]) {
+ expect(forwarded).not.toHaveProperty(key);
+ }
+ // CONTROL: the factory's own props are still there, so the assertion above
+ // is not passing because the handoff is empty.
+ expect(forwarded).toHaveProperty('field');
+ expect(forwarded).toHaveProperty('value');
+ });
+
+ it('`error` reaches a real control as `aria-invalid` — the live a11y defect', async () => {
+ const { getByTestId, rerender } = render(
+ <FieldEditWidget field={SELECT_FIELD} value="" onChange={() => {}} error="Required" />,
+ );
+ // `SelectField` puts the DOM pass-through and `aria-invalid` on
+ // `SelectTrigger` — the focusable `button role="combobox"` the user and
+ // their screen reader actually meet (objectui#3306) — not on Radix `Root`,
+ // which renders no element.
+ const trigger = getByTestId('select-trigger-stage');
+ expect(trigger.tagName).toBe('BUTTON');
+ expect(trigger).toHaveAttribute('aria-invalid', 'true');
+
+ // CONTROL: the same widget, same host, no `error`. `SelectField` computes
+ // `!!error`, so a valid field SAYS "false" rather than staying mute — which
+ // makes this a real two-state reading and not "the attribute exists".
+ rerender(<FieldEditWidget field={SELECT_FIELD} value="" onChange={() => {}} />);
+ expect(getByTestId('select-trigger-stage')).toHaveAttribute('aria-invalid', 'false');
+ });
+
+ it('`dataSource`: the explicit prop WINS over SchemaRendererContext', async () => {
+ // The one delivered key that can CHANGE behaviour rather than only add it:
+ // the relational widgets fall back to `SchemaRendererContext` (which the
+ // grid already provides), so delivering the prop creates a precedence
+ // question. `LookupField` already resolves "explicit prop > field-level >
+ // wrapper field > SchemaRendererContext > none"; the factory is a conduit
+ // and adds no second authority. This pins that the delivered prop is what
+ // the widget ends up querying.
+ const LOOKUP_FIELD = { name: 'account', type: 'lookup', reference_to: 'accounts' } as never;
+ const makeSource = () => ({
+ find: vi.fn().mockResolvedValue([]),
+ getObjectSchema: vi.fn().mockResolvedValue({ name: 'accounts' }),
+ });
+
+ const fromProp = makeSource();
+ const fromContext = makeSource();
+
+ render(
+ <SchemaRendererContext.Provider value={{ dataSource: fromContext } as never}>
+ <FieldEditWidget
+ field={LOOKUP_FIELD}
+ value={undefined}
+ onChange={() => {}}
+ dataSource={fromProp}
+ />
+ </SchemaRendererContext.Provider>,
+ );
+
+ await waitFor(() => expect(fromProp.getObjectSchema).toHaveBeenCalledWith('accounts'));
+ expect(fromContext.getObjectSchema).not.toHaveBeenCalled();
+
+ cleanup();
+
+ // CONTROL: drop the prop and the SAME context source IS queried. Without
+ // this, "the context was not called" would be indistinguishable from a
+ // context that was never wired up in this test at all.
+ const contextOnly = makeSource();
+ render(
+ <SchemaRendererContext.Provider value={{ dataSource: contextOnly } as never}>
+ <FieldEditWidget field={LOOKUP_FIELD} value={undefined} onChange={() => {}} />
+ </SchemaRendererContext.Provider>,
+ );
+ await waitFor(() => expect(contextOnly.getObjectSchema).toHaveBeenCalledWith('accounts'));
+ });
+});

packages/fields/src/index.tsx

@@ -3347,6 +3347,15 @@ export { withFieldCarrier } from './withFieldCarrier.js';
 export { toDomProps } from './widgets/toDomProps.js';
 export type { DomProps } from './widgets/toDomProps.js';
 
+// The sibling executor for the NON-DOM half of the same declaration
+// (objectui#7008): `error` plus the "Host plumbing" block, forwarded as
+// COMPONENT props because none of them is DOM-legal. Exported alongside
+// `toDomProps` because a host factory authored outside this repo needs the
+// pair — reaching for only the first one is how `FieldEditWidget` came to
+// deliver half the contract it declares.
+export { toHostProps } from './widgets/toHostProps.js';
+export type { HostProps } from './widgets/toHostProps.js';
+
 // The native date/time control value adapters (objectui#3127). `DateTimeField`
 // is ISO-canonical on BOTH sides — it takes the record's ISO instant and hands
 // an ISO instant back, which is also the wire form the platform's `datetime`

packages/fields/src/widgets/toDomProps.ts

@@ -123,7 +123,16 @@ const DOM_PASS_THROUGH_KEYS = [
  'disabled',
 ] as const;
 
-type DomPassThroughKey = (typeof DOM_PASS_THROUGH_KEYS)[number];
+/**
+ * The keys this helper forwards.
+ *
+ * Exported so the SIBLING executor — `toHostProps`, which carries the declared
+ * NON-DOM keys (objectui#7008) — can subtract this set from the contract and
+ * assert that the two together cover every declared key exactly once. Without
+ * that subtraction there is no way to state "these keys are handled elsewhere"
+ * as a compile-time fact rather than as a comment.
+ */
+export type DomPassThroughKey = (typeof DOM_PASS_THROUGH_KEYS)[number];
 
 /**
  * Compile-time link to the declaration, direction 1 of 2: every key forwarded