@businessdash/sdk 0.9.60

package/dist/forms-core/elements.js

@@ -0,0 +1,68 @@
+/**
+ * Small, framework-free helpers the bindings share when rendering elements.
+ *
+ * Anything here would otherwise be copy-pasted into React, Svelte, Vue, Angular,
+ * Solid, Qwik and vanilla — and then drift. The dashboard renderer keeps its own
+ * copy of the threshold only because it can't import from the SDK; the values
+ * are deliberately identical.
+ */
+/**
+ * Past this many options a dropdown grows a search affordance on its own.
+ * Scrolling a long list to find one entry is the worse default, and an author
+ * shouldn't have to notice their list got long. Mirrors `SEARCHABLE_THRESHOLD`
+ * in the dashboard builder's `constants.tsx`.
+ */
+export const SEARCHABLE_THRESHOLD = 10;
+/** Should this dropdown offer search? Either the author asked for it (the
+ *  ComboBox card sets `display: "combobox"`) or the list is long enough. */
+export function shouldSearchOptions(optionCount, display) {
+    return display === "combobox" || optionCount > SEARCHABLE_THRESHOLD;
+}
+/**
+ * Where BIAB serves icon art.
+ *
+ * The `icon_select` element stores an icon NAME, and rendering it back needs the
+ * icon set. The SDK deliberately doesn't bundle one: it's ~1,600 icons, and
+ * three of the bindings can't import a React package anyway. Names resolve to
+ * `<img src="…/api/icons/<name>.svg">`, so the platform stays the single source
+ * of truth for what a name means.
+ *
+ * Override with `NEXT_PUBLIC_BIAB_ORIGIN` when pointing a consumer app at a
+ * non-production BIAB.
+ */
+export const BIAB_ICON_BASE = (() => {
+    // Read through `globalThis` rather than the bare `process` identifier: the
+    // SDK is consumed by browser bundlers that have no `@types/node`, where
+    // naming `process` directly fails to compile (and can throw at runtime).
+    const env = globalThis.process?.env;
+    return env?.["NEXT_PUBLIC_BIAB_ORIGIN"] || "https://www.biab.app";
+})();
+/** SVG URL for one icon name. */
+export function iconUrl(name) {
+    return `${BIAB_ICON_BASE}/api/icons/${encodeURIComponent(name)}.svg`;
+}
+/** The lazily-fetched icon-name index (only needed when an author hasn't
+ *  curated `iconConfig.allowedIcons`). */
+export const ICON_INDEX_URL = `${BIAB_ICON_BASE}/api/icons`;
+/** Narrow an icon list by a search query, capped so the grid never mounts
+ *  thousands of nodes at once. */
+export function filterIconNames(names, query, limit = 120) {
+    const q = query.trim().toLowerCase();
+    return (q ? names.filter((n) => n.includes(q)) : names).slice(0, limit);
+}
+/** Fetch the icon-name index. Resolves to `[]` on any failure — a missing index
+ *  leaves the picker's grid empty, which is recoverable; throwing here would
+ *  take the whole form down. */
+export async function fetchIconNames() {
+    try {
+        const res = await fetch(ICON_INDEX_URL);
+        if (!res.ok)
+            return [];
+        const data = (await res.json());
+        return data.icons ?? [];
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=elements.js.map

package/dist/forms-core/elements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"elements.js","sourceRoot":"","sources":["../../src/forms-core/elements.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEvC;4EAC4E;AAC5E,MAAM,UAAU,mBAAmB,CAClC,WAAmB,EACnB,OAAgB;IAEhB,OAAO,OAAO,KAAK,UAAU,IAAI,WAAW,GAAG,oBAAoB,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,cAAc,GAAW,CAAC,GAAG,EAAE;IAC3C,2EAA2E;IAC3E,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,GAAG,GACR,UAGA,CAAC,OAAO,EAAE,GAAG,CAAC;IACf,OAAO,GAAG,EAAE,CAAC,yBAAyB,CAAC,IAAI,sBAAsB,CAAC;AACnE,CAAC,CAAC,EAAE,CAAC;AAEL,iCAAiC;AACjC,MAAM,UAAU,OAAO,CAAC,IAAY;IACnC,OAAO,GAAG,cAAc,cAAc,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;AACtE,CAAC;AAED;0CAC0C;AAC1C,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,cAAc,YAAY,CAAC;AAE5D;kCACkC;AAClC,MAAM,UAAU,eAAe,CAC9B,KAAwB,EACxB,KAAa,EACb,KAAK,GAAG,GAAG;IAEX,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAC5D,CAAC,EACD,KAAK,CACO,CAAC;AACf,CAAC;AAED;;gCAEgC;AAChC,MAAM,CAAC,KAAK,UAAU,cAAc;IACnC,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,OAAO,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC"}

package/dist/forms-core/email-domains.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Free / consumer webmail detection for the email field's "business only" rule.
+ * Mirror of the app's `src/lib/onboarding-email-domain.ts` (the consumer-domain
+ * set + helpers) so the SDK's client validation agrees with the server.
+ */
+/** The lowercase host portion of an email, or null when malformed. */
+export declare function getEmailDomain(email: string): string | null;
+/** True for free/personal webmail hosts (so "business only" can reject them). */
+export declare function isConsumerEmailDomain(host: string): boolean;
+//# sourceMappingURL=email-domains.d.ts.map

package/dist/forms-core/email-domains.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-domains.d.ts","sourceRoot":"","sources":["../../src/forms-core/email-domains.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA+CH,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO3D;AAED,iFAAiF;AACjF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAK3D"}

package/dist/forms-core/email-domains.js

@@ -0,0 +1,69 @@
+/**
+ * Free / consumer webmail detection for the email field's "business only" rule.
+ * Mirror of the app's `src/lib/onboarding-email-domain.ts` (the consumer-domain
+ * set + helpers) so the SDK's client validation agrees with the server.
+ */
+const CONSUMER_EMAIL_DOMAINS = new Set([
+    "gmail.com",
+    "googlemail.com",
+    "yahoo.com",
+    "yahoo.co.uk",
+    "yahoo.fr",
+    "yahoo.de",
+    "hotmail.com",
+    "hotmail.co.uk",
+    "outlook.com",
+    "live.com",
+    "msn.com",
+    "icloud.com",
+    "me.com",
+    "mac.com",
+    "aol.com",
+    "proton.me",
+    "protonmail.com",
+    "pm.me",
+    "yandex.com",
+    "yandex.ru",
+    "mail.com",
+    "gmx.com",
+    "gmx.de",
+    "gmx.net",
+    "hey.com",
+    "fastmail.com",
+    "fastmail.fm",
+    "duck.com",
+    "tutanota.com",
+    "tutamail.com",
+    "qq.com",
+    "163.com",
+    "sbcglobal.net",
+    "att.net",
+    "verizon.net",
+    "comcast.net",
+    "btinternet.com",
+    "sky.com",
+    "orange.fr",
+    "wanadoo.fr",
+    "free.fr",
+    "laposte.net",
+]);
+/** The lowercase host portion of an email, or null when malformed. */
+export function getEmailDomain(email) {
+    const at = email.lastIndexOf("@");
+    if (at < 0 || at === email.length - 1)
+        return null;
+    return email
+        .slice(at + 1)
+        .trim()
+        .toLowerCase();
+}
+/** True for free/personal webmail hosts (so "business only" can reject them). */
+export function isConsumerEmailDomain(host) {
+    const h = host.trim().toLowerCase();
+    if (CONSUMER_EMAIL_DOMAINS.has(h))
+        return true;
+    if (h.endsWith(".gmail.com") || h.endsWith(".googlemail.com"))
+        return true;
+    return false;
+}
+//# sourceMappingURL=email-domains.js.map

package/dist/forms-core/email-domains.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-domains.js","sourceRoot":"","sources":["../../src/forms-core/email-domains.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACtC,WAAW;IACX,gBAAgB;IAChB,WAAW;IACX,aAAa;IACb,UAAU;IACV,UAAU;IACV,aAAa;IACb,eAAe;IACf,aAAa;IACb,UAAU;IACV,SAAS;IACT,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,SAAS;IACT,WAAW;IACX,gBAAgB;IAChB,OAAO;IACP,YAAY;IACZ,WAAW;IACX,UAAU;IACV,SAAS;IACT,QAAQ;IACR,SAAS;IACT,SAAS;IACT,cAAc;IACd,aAAa;IACb,UAAU;IACV,cAAc;IACd,cAAc;IACd,QAAQ;IACR,SAAS;IACT,eAAe;IACf,SAAS;IACT,aAAa;IACb,aAAa;IACb,gBAAgB;IAChB,SAAS;IACT,WAAW;IACX,YAAY;IACZ,SAAS;IACT,aAAa;CACb,CAAC,CAAC;AAEH,sEAAsE;AACtE,MAAM,UAAU,cAAc,CAAC,KAAa;IAC3C,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,KAAK;SACV,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;SACb,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;AACjB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,qBAAqB,CAAC,IAAY;IACjD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/forms-core/file-rules.d.ts

@@ -0,0 +1,51 @@
+/**
+ * File-upload rules — the single source of truth for what a `file_upload` field
+ * accepts, shared by the builder picker, the live renderers, and all submission
+ * validators (so the client never disagrees with the server).
+ *
+ * Three concerns:
+ *  - **iOS formats:** iPhones hand back HEIC photos + HEVC/`.mov` video. When a
+ *    field allows images/video we transparently accept those too, so a visitor
+ *    isn't blocked by their camera's default codec.
+ *  - **Per-file rules:** allowed type + max size (MB), per the field config.
+ *  - **Form-wide cap:** at most {@link FORM_WIDE_MAX_FILES} files across ALL
+ *    file fields in one submission (anti-abuse; a field's own `maxFiles` still
+ *    caps that field).
+ *
+ * Pure + isomorphic (no DOM, no DB). The SDK mirrors it.
+ */
+/** HEIC/HEIF still-image formats (iPhone default photo codec). */
+export declare const IOS_IMAGE_TYPES: readonly ["image/heic", "image/heif"];
+/** iPhone video container (`.mov`, typically HEVC). */
+export declare const IOS_VIDEO_TYPES: readonly ["video/quicktime"];
+/** Max total files across every `file_upload` field in one submission. */
+export declare const FORM_WIDE_MAX_FILES = 5;
+export interface FileRule {
+    /** Allowed MIME types / wildcards (e.g. `image/*`) / extensions (`.pdf`). */
+    allowedTypes?: string[] | undefined;
+    /** Per-field file count cap. */
+    maxFiles?: number | undefined;
+    /** Per-file size cap in MB. */
+    maxSize?: number | undefined;
+}
+/** A minimal file descriptor — works for a real `File` or a stored value. */
+export interface FileLike {
+    name: string;
+    type?: string | undefined;
+    size?: number | undefined;
+}
+/**
+ * Expand a field's `allowedTypes` to also accept iOS HEIC/HEVC when the field
+ * already allows images/video, then format the `<input accept>` attribute.
+ * Returns undefined (= accept anything) when no allow-list is set.
+ */
+export declare function buildAcceptAttr(allowed?: string[]): string | undefined;
+/** The allow-list plus the iOS formats implied by it (deduped, order-stable). */
+export declare function expandAllowedTypes(allowed: string[]): string[];
+/** Is `file` an accepted type for `allowed`? Empty/absent allow-list = anything.
+ *  Handles exact MIME, `type/*` wildcards, and `.ext` entries; iOS HEIC/HEVC are
+ *  honored whenever images/video are allowed. */
+export declare function isFileTypeAllowed(file: FileLike, allowed?: string[]): boolean;
+/** Per-file validation (type + size). Returns an error string or null. */
+export declare function validateFile(file: FileLike, rule: FileRule): string | null;
+//# sourceMappingURL=file-rules.d.ts.map

package/dist/forms-core/file-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-rules.d.ts","sourceRoot":"","sources":["../../src/forms-core/file-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,kEAAkE;AAClE,eAAO,MAAM,eAAe,uCAAwC,CAAC;AACrE,uDAAuD;AACvD,eAAO,MAAM,eAAe,8BAA+B,CAAC;AAE5D,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,MAAM,WAAW,QAAQ;IACxB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACpC,gCAAgC;IAChC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B;AAED,6EAA6E;AAC7E,MAAM,WAAW,QAAQ;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAiBD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAGtE;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAe9D;AAED;;iDAEiD;AACjD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAmB7E;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAa1E"}

package/dist/forms-core/file-rules.js

@@ -0,0 +1,105 @@
+/**
+ * File-upload rules — the single source of truth for what a `file_upload` field
+ * accepts, shared by the builder picker, the live renderers, and all submission
+ * validators (so the client never disagrees with the server).
+ *
+ * Three concerns:
+ *  - **iOS formats:** iPhones hand back HEIC photos + HEVC/`.mov` video. When a
+ *    field allows images/video we transparently accept those too, so a visitor
+ *    isn't blocked by their camera's default codec.
+ *  - **Per-file rules:** allowed type + max size (MB), per the field config.
+ *  - **Form-wide cap:** at most {@link FORM_WIDE_MAX_FILES} files across ALL
+ *    file fields in one submission (anti-abuse; a field's own `maxFiles` still
+ *    caps that field).
+ *
+ * Pure + isomorphic (no DOM, no DB). The SDK mirrors it.
+ */
+/** HEIC/HEIF still-image formats (iPhone default photo codec). */
+export const IOS_IMAGE_TYPES = ["image/heic", "image/heif"];
+/** iPhone video container (`.mov`, typically HEVC). */
+export const IOS_VIDEO_TYPES = ["video/quicktime"];
+/** Max total files across every `file_upload` field in one submission. */
+export const FORM_WIDE_MAX_FILES = 5;
+function ext(name) {
+    const dot = name.lastIndexOf(".");
+    return dot >= 0 ? name.slice(dot).toLowerCase() : "";
+}
+/** Does `image/*` / `video/*` appear in the allow-list (so iOS codecs apply)? */
+function allowsImages(allowed) {
+    return allowed.some((a) => a === "image/*" || (a.startsWith("image/") && !a.includes("heic")));
+}
+function allowsVideo(allowed) {
+    return allowed.some((a) => a === "video/*" || a.startsWith("video/"));
+}
+/**
+ * Expand a field's `allowedTypes` to also accept iOS HEIC/HEVC when the field
+ * already allows images/video, then format the `<input accept>` attribute.
+ * Returns undefined (= accept anything) when no allow-list is set.
+ */
+export function buildAcceptAttr(allowed) {
+    if (!allowed || allowed.length === 0)
+        return undefined;
+    return expandAllowedTypes(allowed).join(",");
+}
+/** The allow-list plus the iOS formats implied by it (deduped, order-stable). */
+export function expandAllowedTypes(allowed) {
+    const out = [...allowed];
+    const add = (t) => {
+        if (!out.includes(t))
+            out.push(t);
+    };
+    if (allowsImages(allowed)) {
+        for (const t of IOS_IMAGE_TYPES)
+            add(t);
+        add(".heic");
+        add(".heif");
+    }
+    if (allowsVideo(allowed)) {
+        for (const t of IOS_VIDEO_TYPES)
+            add(t);
+        add(".mov");
+    }
+    return out;
+}
+/** Is `file` an accepted type for `allowed`? Empty/absent allow-list = anything.
+ *  Handles exact MIME, `type/*` wildcards, and `.ext` entries; iOS HEIC/HEVC are
+ *  honored whenever images/video are allowed. */
+export function isFileTypeAllowed(file, allowed) {
+    if (!allowed || allowed.length === 0)
+        return true;
+    const list = expandAllowedTypes(allowed);
+    const type = (file.type ?? "").toLowerCase();
+    const fileExt = ext(file.name);
+    for (const raw of list) {
+        const a = raw.toLowerCase().trim();
+        if (!a)
+            continue;
+        if (a.startsWith(".")) {
+            if (fileExt === a)
+                return true;
+            continue;
+        }
+        if (a.endsWith("/*")) {
+            if (type.startsWith(`${a.slice(0, -1)}`))
+                return true;
+            continue;
+        }
+        if (type && type === a)
+            return true;
+    }
+    return false;
+}
+/** Per-file validation (type + size). Returns an error string or null. */
+export function validateFile(file, rule) {
+    if (!isFileTypeAllowed(file, rule.allowedTypes)) {
+        return `File type not allowed: ${file.type || file.name}`;
+    }
+    if (typeof rule.maxSize === "number" &&
+        rule.maxSize > 0 &&
+        typeof file.size === "number" &&
+        file.size > rule.maxSize * 1024 * 1024) {
+        return `"${file.name}" exceeds the ${rule.maxSize} MB limit.`;
+    }
+    return null;
+}
+//# sourceMappingURL=file-rules.js.map

package/dist/forms-core/file-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-rules.js","sourceRoot":"","sources":["../../src/forms-core/file-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,YAAY,EAAE,YAAY,CAAU,CAAC;AACrE,uDAAuD;AACvD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,iBAAiB,CAAU,CAAC;AAE5D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAkBrC,SAAS,GAAG,CAAC,IAAY;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,iFAAiF;AACjF,SAAS,YAAY,CAAC,OAAiB;IACtC,OAAO,OAAO,CAAC,IAAI,CAClB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CACzE,CAAC;AACH,CAAC;AACD,SAAS,WAAW,CAAC,OAAiB;IACrC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAkB;IACjD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvD,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,OAAiB;IACnD,MAAM,GAAG,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE;QACzB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC;IACF,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,eAAe;YAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACxC,GAAG,CAAC,OAAO,CAAC,CAAC;QACb,GAAG,CAAC,OAAO,CAAC,CAAC;IACd,CAAC;IACD,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,eAAe;YAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;iDAEiD;AACjD,MAAM,UAAU,iBAAiB,CAAC,IAAc,EAAE,OAAkB;IACnE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,OAAO,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/B,SAAS;QACV,CAAC;QACD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtD,SAAS;QACV,CAAC;QACD,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,IAAc,EAAE,IAAc;IAC1D,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACjD,OAAO,0BAA0B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3D,CAAC;IACD,IACC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAChC,IAAI,CAAC,OAAO,GAAG,CAAC;QAChB,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,IAAI,EACrC,CAAC;QACF,OAAO,IAAI,IAAI,CAAC,IAAI,iBAAiB,IAAI,CAAC,OAAO,YAAY,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/forms-core/formula.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Safe, isomorphic formula engine for Business Functions + the Math form element.
+ *
+ * SECURITY: there is NO `eval`, `new Function`, or any dynamic code execution.
+ * A formula is tokenized → parsed into an AST → walked by an evaluator that only
+ * does arithmetic/logic and calls a fixed, whitelisted function table. Unknown
+ * identifiers (that aren't a provided variable) and unknown functions are hard
+ * errors. The same module runs on the client (non-sensitive functions, live) and
+ * the server (all functions) so results never disagree. The SDK keeps a mirror at
+ * `biab-dev/src/forms-core/formula.ts`.
+ *
+ * Values are scalars: number | string | boolean. (Tables / arrays are a
+ * fast-follow.) Function reference: see FORMULA_FUNCTIONS.
+ */
+/** A record value — e.g. a measurement field `{ size, unit, base }`, a CRM record,
+ *  or a multi-output function result. Fields are read with member access
+ *  (`source.field`). */
+export interface FormulaObject {
+    [key: string]: FormulaValue;
+}
+export type FormulaValue = number | string | boolean | FormulaObject;
+export type FormulaVars = Record<string, FormulaValue | null | undefined>;
+/** Public guard: is this value a record (object) rather than a scalar? */
+export declare function isFormulaObjectValue(v: unknown): v is FormulaObject;
+export type FormulaResult = {
+    ok: true;
+    value: FormulaValue;
+} | {
+    ok: false;
+    error: string;
+};
+type Node = {
+    t: "num";
+    v: number;
+} | {
+    t: "str";
+    v: string;
+} | {
+    t: "bool";
+    v: boolean;
+} | {
+    t: "var";
+    name: string;
+} | {
+    t: "member";
+    obj: Node;
+    key: string;
+} | {
+    t: "unary";
+    op: string;
+    arg: Node;
+} | {
+    t: "binary";
+    op: string;
+    left: Node;
+    right: Node;
+} | {
+    t: "call";
+    name: string;
+    args: Node[];
+};
+/** A formula AST plus the names it references (for validation/UI). */
+export interface ParsedFormula {
+    ast: Node;
+    /** Distinct variable identifiers referenced (excludes function names). */
+    variables: string[];
+    /** Distinct function names called (built-in or user/business functions). */
+    functions: string[];
+}
+/**
+ * A user/business function callable from another formula by name. `params` are
+ * the ordered variable names the call's arguments bind to. Pass a map of these
+ * to {@link evaluateFormula} so formulas can reference other functions.
+ */
+export interface UserFunctionDef {
+    params: string[];
+    formula: ParsedFormula;
+}
+export interface EvalOptions {
+    /** name → user function, enabling formula-references-formula composition. */
+    functions?: Record<string, UserFunctionDef>;
+}
+export type FormulaCategory = "math" | "statistical" | "logical" | "text" | "date" | "reference" | "geo";
+interface FnDef {
+    category: FormulaCategory;
+    /** Min args (inclusive). */
+    min: number;
+    /** Max args, or null for variadic. */
+    max: number | null;
+    help: string;
+    fn: (args: FormulaValue[]) => FormulaValue;
+}
+export declare const FORMULA_FUNCTIONS: Record<string, FnDef>;
+/** Parse a formula into an AST + its referenced variables. Throws on syntax error. */
+export declare function parseFormula(src: string): ParsedFormula;
+/** Evaluate a parsed formula against a variables context. Never throws — returns
+ *  a controlled result. */
+export declare function evaluateFormula(parsed: ParsedFormula, vars: FormulaVars, options?: EvalOptions): FormulaResult;
+/** Parse + evaluate in one call. Never throws. */
+export declare function runFormula(src: string, vars: FormulaVars, options?: EvalOptions): FormulaResult;
+/**
+ * Static check for the builder: valid syntax, and every referenced identifier is
+ * either a known variable or a known function. Returns the unknown names so the
+ * UI can flag them.
+ */
+export declare function validateFormula(src: string, knownVars: readonly string[], knownFunctions?: readonly string[]): {
+    ok: true;
+    variables: string[];
+} | {
+    ok: false;
+    error: string;
+};
+export {};
+//# sourceMappingURL=formula.d.ts.map

package/dist/forms-core/formula.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"formula.d.ts","sourceRoot":"","sources":["../../src/forms-core/formula.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;wBAEwB;AACxB,MAAM,WAAW,aAAa;IAC7B,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAAC;CAC5B;AACD,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC;AACrE,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAM1E,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,aAAa,CAEnE;AAED,MAAM,MAAM,aAAa,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,GACjC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAIhC,KAAK,IAAI,GACN;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GACvB;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GACvB;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,OAAO,CAAA;CAAE,GACzB;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC1B;IAAE,CAAC,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,CAAC,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,IAAI,CAAA;CAAE,GACrC;IAAE,CAAC,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,IAAI,CAAA;CAAE,GACpD;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,IAAI,EAAE,CAAA;CAAE,CAAC;AAE7C,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC7B,GAAG,EAAE,IAAI,CAAC;IACV,0EAA0E;IAC1E,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,aAAa,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC3B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC5C;AAiUD,MAAM,MAAM,eAAe,GACxB,MAAM,GACN,aAAa,GACb,SAAS,GACT,MAAM,GACN,MAAM,GACN,WAAW,GACX,KAAK,CAAC;AAET,UAAU,KAAK;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,YAAY,CAAC;CAC3C;AAuHD,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAyjBnD,CAAC;AAiJF,sFAAsF;AACtF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAkBvD;AAED;2BAC2B;AAC3B,wBAAgB,eAAe,CAC9B,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,WAAW,EACjB,OAAO,CAAC,EAAE,WAAW,GACnB,aAAa,CAcf;AAED,kDAAkD;AAClD,wBAAgB,UAAU,CACzB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,WAAW,EACjB,OAAO,CAAC,EAAE,WAAW,GACnB,aAAa,CAWf;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC9B,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,cAAc,GAAE,SAAS,MAAM,EAAO,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA0BlE"}