@@ -0,0 +1,31 @@
+---
+'@object-ui/types': patch
+'@object-ui/components': patch
+---
+
+fix(types,components)!: a renderer's props index signature is `unknown`, not `any`, so a forwarded key must be narrowed before it is used
+
+Clause-②: yes (narrowing)
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (type-surface-only ui/packages/types/src/base.ts#ComponentRendererProps) A TypeScript annotation narrowing on a published renderer-props type: no metadata key, accepted value, export or error code is removed or renamed, nothing at runtime changes, and `objectstack migrate meta` has nothing to rewrite. The affected party is a TypeScript consumer, reached by its own compiler. -->
+
+**BREAKING** type-surface narrowing, compile-time only. Nothing a renderer receives or renders at runtime changes.
+
+- **`@object-ui/types`.** `ComponentRendererProps` keeps its index signature, so every key the host forwards is still admitted, but the signature now maps to `unknown` instead of `any`.
+- **`@object-ui/components`.** The built-in renderers' own inline props annotations move the same way. The three host keys renderers read by name and pass to their root element (`data-obj-id`, `data-obj-type` and `style`, written or forwarded by `SchemaRenderer`) are declared once in a package-local type instead. The host-supplied callbacks and values a renderer reads by name (`onPageChange` on `pagination`, `onChange` / `value` on `input-otp`, `loading` on `button`, `className` on `text`, react-hook-form's `ref` on the form's built-in controls) are declared on that renderer's props.
+
+**Migration.** A renderer typed with `ComponentRendererProps` that reads a forwarded key:
+
+```ts
+// FROM — compiled, because the key was `any`
+const Pager = ({ schema, ...props }: ComponentRendererProps<PagerSchema>) =>
+  <Nav onSelect={(n) => props.onPageChange(n)} />;
+
+// TO — declare the key you read on your own props, or narrow it before use
+type PagerProps = ComponentRendererProps<PagerSchema> & { onPageChange?: (page: number) => void };
+const Pager = ({ schema, onPageChange }: PagerProps) =>
+  <Nav onSelect={(n) => onPageChange?.(n)} />;
+```
+
+What to do: nothing if your renderers never read a forwarded key off `ComponentRendererProps` without declaring it. Otherwise declare the key on your renderer's props (as above) or narrow the `unknown` value (`typeof x === 'function'`, `typeof x === 'string'`) before using it.
@@ -0,0 +1,31 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+import type { CSSProperties } from 'react';
+
+/**
+ * The host keys a renderer in this package reads BY NAME off its props and
+ * hands to its root element (#25918).
+ *
+ * A renderer's props carry an index signature to `unknown`, not `any`: a key
+ * the host forwards is still admitted, but the renderer has to narrow it
+ * before it can use it. These three are the exception that is declared rather
+ * than narrowed at every site, because they are not authoring keys a renderer
+ * interprets — `SchemaRenderer` (`@object-ui/react`) writes `data-obj-id` from
+ * the node's `id` and `data-obj-type` from its `type`, and forwards the node's
+ * `style` (`BaseSchema.style`) — and every renderer that reads them passes
+ * them straight to the DOM.
+ *
+ * Intersect it into a renderer's props annotation; ⛔ never widen the index
+ * signature back to `any` to make a by-name read compile.
+ */
+export interface RendererHostProps {
+  'data-obj-id'?: string;
+  'data-obj-type'?: string;
+  style?: CSSProperties;
+}
@@ -57,6 +57,7 @@ import { cn } from '../../lib/utils';
 import { useIsMobile } from '../../hooks/use-mobile';
 import { ButtonGroup } from '../../custom/button-group';
 import { withEvaluatedProperties } from './static-params';
+import type { RendererHostProps } from '../../lib/renderer-host-props';
 
 function useActionsLabel(): string {
   // useObjectTranslation is provider-safe (never throws); no try/catch, which
@@ -94,7 +95,7 @@ function useActionsLabel(): string {
 // exported and never appears in JSX, and `Registry.register` takes
 // `ComponentRenderer<T = any> = T`.
 const ActionBarRenderer = forwardRef<HTMLDivElement, { schema: ActionBarSchema; className?: string }>(
-  ({ schema, className, ...props }: { schema: ActionBarSchema; className?: string; [key: string]: any }, ref) => {
+  ({ schema, className, ...props }: { schema: ActionBarSchema; className?: string; [key: string]: unknown } & RendererHostProps, ref) => {
     const actionsAriaLabel = useActionsLabel();
     const {
       'data-obj-id': dataObjId,
 
@@ -32,6 +32,7 @@ import { hasDeclaredVisibilityGate } from './visibility-gate';
 import { useAutoTriggerOnce } from './auto-trigger';
 import { readStaticParamValues } from './static-params';
 import { DisabledReasonTrigger, describedByWithReason, useDisabledReason } from './disabled-reason';
+import type { RendererHostProps } from '../../lib/renderer-host-props';
 
 /** A record value: a plain object, never `null` or an array. */
 function asRecord(value: unknown): Record<string, unknown> | undefined {
@@ -97,7 +98,7 @@ function withUndoBaseline(
 // `ActionButtonProps` as the block's AUTHORED property bag (`actionType`, `label`, `variant`, …).
 // This is the React envelope that carries a node (`schema`, `context`, `disabled`, an open
 // tail) — a different layer, named as objectui#7265 named `RecordAlertRendererProps`.
-export interface ActionButtonRendererProps {
+export interface ActionButtonRendererProps extends RendererHostProps {
   schema: UIActionSchema & { type: string; className?: string; actionType?: string };
   className?: string;
   /** Override context for this specific action */
@@ -110,7 +111,7 @@ export interface ActionButtonRendererProps {
    * therefore never reaches the DOM spread — see the destructure.
    */
   disabled?: boolean;
-  [key: string]: any;
+  [key: string]: unknown;
 }
 
 // `PropsWithoutRef` would collapse `ActionButtonRendererProps` to its bare index
 
@@ -42,6 +42,7 @@ import {
   menuItemReasonAria,
   useDisabledReason,
 } from './disabled-reason';
+import type { RendererHostProps } from '../../lib/renderer-host-props';
 
 // No group-level `name` (objectui#11168): nothing renders, forwards or keys on
 // it, and `@objectstack/spec` refuses it on this block, so the registration
@@ -275,7 +276,7 @@ DropdownActionItem.displayName = 'DropdownActionItem';
 // host-EVALUATED enablement verdict, declared rather than left to the index
 // signature, as `ActionButtonRendererProps` declares it (objectui#9131).
 const ActionGroupRenderer = forwardRef<HTMLDivElement, { schema: ActionGroupSchema; className?: string }>(
-  ({ schema, className, ...props }: { schema: ActionGroupSchema; className?: string; disabled?: boolean; [key: string]: any }, ref) => {
+  ({ schema, className, ...props }: { schema: ActionGroupSchema; className?: string; disabled?: boolean; [key: string]: unknown } & RendererHostProps, ref) => {
     const {
       'data-obj-id': dataObjId,
       'data-obj-type': dataObjType,
 
@@ -28,6 +28,7 @@ import { hasDeclaredVisibilityGate } from './visibility-gate';
 import { useAutoTriggerOnce } from './auto-trigger';
 import { readStaticParamValues } from './static-params';
 import { DisabledReasonTrigger, describedByWithReason, useDisabledReason } from './disabled-reason';
+import type { RendererHostProps } from '../../lib/renderer-host-props';
 
 /**
  * The declared props. `schema` is `UIActionSchema` (objectui#4418) for the same
@@ -44,7 +45,7 @@ import { DisabledReasonTrigger, describedByWithReason, useDisabledReason } from
 // `ActionIconProps` as the block's AUTHORED property bag (`actionType`, `label`, `variant`, …).
 // This is the React envelope that carries a node (`schema`, `context`, `disabled`, an open
 // tail) — a different layer, named as objectui#7265 named `RecordAlertRendererProps`.
-export interface ActionIconRendererProps {
+export interface ActionIconRendererProps extends RendererHostProps {
   schema: UIActionSchema & { type: string; className?: string; actionType?: string };
   className?: string;
   context?: Record<string, any>;
@@ -54,7 +55,7 @@ export interface ActionIconRendererProps {
    * signature, consumed by name below, never re-spread onto the DOM.
    */
   disabled?: boolean;
-  [key: string]: any;
+  [key: string]: unknown;
 }
 
 // Index signature on the parameter annotation, not on the `forwardRef` type
 
@@ -35,6 +35,7 @@ import { hasDeclaredVisibilityGate } from './visibility-gate';
 import { useAutoTriggerOnce } from './auto-trigger';
 import { readActionEntryParamValues } from './static-params';
 import { DisabledReasonMenuLabel, menuItemReasonAria, useDisabledReason } from './disabled-reason';
+import type { RendererHostProps } from '../../lib/renderer-host-props';
 
 function useMoreActionsLabel(): string {
   // useObjectTranslation is provider-safe (never throws); no try/catch, which
@@ -207,7 +208,7 @@ ActionAutoTrigger.displayName = 'ActionAutoTrigger';
 // host-EVALUATED enablement verdict, declared rather than left to the index
 // signature, as `ActionButtonRendererProps` declares it (objectui#9131).
 const ActionMenuRenderer = forwardRef<HTMLButtonElement, { schema: ActionMenuSchema; className?: string }>(
-  ({ schema, className, ...props }: { schema: ActionMenuSchema; className?: string; disabled?: boolean; [key: string]: any }, ref) => {
+  ({ schema, className, ...props }: { schema: ActionMenuSchema; className?: string; disabled?: boolean; [key: string]: unknown } & RendererHostProps, ref) => {
     const {
       'data-obj-id': dataObjId,
       'data-obj-type': dataObjType,
 
@@ -10,9 +10,10 @@ import { ComponentRegistry } from '@object-ui/core';
 import type { ButtonGroupSchema } from '@object-ui/types';
 import { Button } from '../../ui';
 import { cn } from '../../lib/utils';
+import type { RendererHostProps } from '../../lib/renderer-host-props';
 
 ComponentRegistry.register('button-group', 
-  ({ schema, ...props }: { schema: ButtonGroupSchema; [key: string]: any }) => {
+  ({ schema, ...props }: { schema: ButtonGroupSchema; [key: string]: unknown } & RendererHostProps) => {
     const { 
         'data-obj-id': dataObjId, 
         'data-obj-type': dataObjType,
 
@@ -10,6 +10,7 @@ import { ComponentRegistry } from '@object-ui/core';
 import type { DivSchema } from '@object-ui/types';
 import { renderChildren } from '../../lib/utils';
 import { forwardRef } from 'react';
+import type { RendererHostProps } from '../../lib/renderer-host-props';
 
 /**
  * Deprecated types already reported in this module instance — the notice is a
@@ -128,7 +129,7 @@ const DIV_DEPRECATION_NOTICE =
 // argument — mechanism note on `action:bar` (objectui#4422), pinned by
 // `__tests__/forwardref-props-annotation.guard.test.ts`.
 const DivRenderer = forwardRef<HTMLDivElement, { schema: DivSchema; className?: string }>(
-  ({ schema, className, ...props }: { schema: DivSchema; className?: string; [key: string]: any }, ref) => {
+  ({ schema, className, ...props }: { schema: DivSchema; className?: string; [key: string]: unknown } & RendererHostProps, ref) => {
     // Deprecation notice, once per module load (objectui#3965, see
     // warnDeprecatedOnce). There is no provenance exemption any more: the
     // declaration below names both authoring surfaces (objectui#10757), so a
 
@@ -31,7 +31,7 @@ import { renderChildren } from '../../lib/utils';
 import { createElement, forwardRef, useContext } from 'react';
 import type { MouseEventHandler } from 'react';
 
-type AnyProps = { schema: any; className?: string; [key: string]: any };
+type AnyProps = { schema: any; className?: string; [key: string]: unknown };
 
 // Tags that take no children.
 const VOID_TAGS = new Set(['img', 'hr', 'br']);