hidden columns from clients

common/proto/table_definition.proto

@@ -58,6 +58,11 @@ service TableDefinition {
   // Physical column names and identities remain unchanged.
   rpc SetColumnPresentation(SetColumnPresentationRequest) returns (SetColumnPresentationResponse);
 
+  // Shows or hides one column in bundled data-entry forms. This is presentation
+  // metadata only: hidden columns remain available to data APIs, scripts and
+  // backend calculations.
+  rpc SetColumnFormVisibility(SetColumnFormVisibilityRequest) returns (SetColumnFormVisibilityResponse);
+
   // Drops a table and its metadata, then deletes the profile if it becomes empty.
   rpc DeleteTable(DeleteTableRequest) returns (DeleteTableResponse);
 }
@@ -471,6 +476,10 @@ message ColumnBehavior {
 
   // Stable public identity used when updating this column's presentation.
   int64 column_id = 5;
+
+  // True when bundled data-entry clients should not render this column.
+  // This is not an authorization boundary; data APIs still expose the column.
+  bool hidden_from_forms = 6;
 }
 
 // A script that targets a specific column in a table.
@@ -507,6 +516,24 @@ message SetColumnPresentationResponse {
   int64 row_version = 4;
 }
 
+message SetColumnFormVisibilityRequest {
+  string profile_name = 1;
+  string table_name = 2;
+  int64 column_id = 3;
+  bool hidden_from_forms = 4;
+  // Row version returned by GetProfileDetails when the column was read.
+  int64 expected_row_version = 5;
+}
+
+message SetColumnFormVisibilityResponse {
+  bool success = 1;
+  string message = 2;
+  int64 column_id = 3;
+  bool hidden_from_forms = 4;
+  // New row version after the update.
+  int64 row_version = 5;
+}
+
 // Request to delete one table definition entirely.
 message DeleteTableRequest {
   // Profile (schema) name owning the table (must exist).