@object-ui/core 14.0.0 → 14.1.0

package/CHANGELOG.md

@@ -1,5 +1,142 @@
 # @object-ui/core
 
+## 14.1.0
+
+### Minor Changes
+
+- 0890fa7: feat(core): build-time guardrail for cascading select option predicates (#1583)
+
+  `@object-ui/core` now exports `lintOptionPredicates(fields)` — a static,
+  conservative validator for the per-option `visibleWhen` CEL predicates that
+  drive cascading / role-gated `select` options (#2284). An option predicate fails
+  _closed_ — a wrong one makes its option silently never appear — so this catches
+  the class of bug runtime fail-open can't surface:
+
+  - `syntax` — invalid CEL, delegated to `@objectstack/formula`'s
+    `validateExpression` (no schema hint, so a legitimate `current_user.roles`
+    reference is never mistaken for an error);
+  - `unknown-field` — a `record.<name>` reference to a field the form never
+    declares (a sibling typo);
+  - `option-literal-not-in-domain` — a literal compared against an _enum_ sibling
+    that is outside its declared option values, e.g. `record.country == 'chna'`
+    when `country` is `cn`/`us` (the AI-authoring typo #2284 called out).
+
+  It only flags what it can statically prove — non-`record.` roots
+  (`current_user.*`), open-domain fields, and unrecognized shapes are left alone,
+  so there are no false positives. The schema catalog runs it over every shipped
+  example. Design recorded in ADR-0058.
+
+- 5523fc4: Dashboard-level filters — the three #2578 item-5 enhancements (framework#2501):
+
+  - **react**: nested `PageVariablesProvider`s now MERGE instead of shadowing
+    wholesale. A filtered dashboard embedded in a Page with its own `variables`
+    keeps the outer page variables readable inside widget subtrees (`page.*`);
+    an inner definition shadows only the SAME name; writes route to the scope
+    that defines the variable (writing an outer-defined name from inside the
+    nested subtree updates the outer provider); `resetVariables` stays local.
+    Names defined nowhere still write locally, exactly as before.
+  - **core**: `buildWidgetScopedFilter` accepts an optional `knownFields` set —
+    a DEFAULT binding whose target field is not on the widget's object is
+    skipped with a console warning instead of emitting a query the backend
+    empty-matches. Explicit `filterBindings` strings are always honoured (a
+    typo surfaces as a visibly empty widget, never a silently dropped filter).
+    Omitting `knownFields` preserves the previous unchecked behaviour.
+  - **plugin-dashboard**: `DashboardRenderer` feeds `knownFields` from
+    `dataSource.getObjectSchema` for inline `object` widgets (best-effort —
+    unchecked while metadata loads or when the source can't describe objects).
+    `optionsFrom` dynamic filter options now resolve DISTINCT values
+    server-side via a dataset GROUP BY (`queryDataset` with an inline draft)
+    when the data source supports it, falling back to the previous client-side
+    top-200 dedupe otherwise.
+
+- 887062c: feat(dashboard): dashboard-level filters (date / region) driving multiple charts (framework#2501)
+
+  A dashboard's `dateRange` + `globalFilters` declarations are now wired end to
+  end: the filter values live as dashboard-level variables (the page variables
+  primitive, so they're also readable as `page.<name>` in widget expressions),
+  a filter bar renders above the widgets, and at render time the dashboard
+  broadcasts the active values into every bound widget's inline query —
+  `AND`-merged with the widget's own `filter`. Charts stay inline and
+  self-contained; each widget maps a filter to **its own** field.
+
+  - **`@object-ui/types`** — `globalFilters[].name` (stable filter/variable key,
+    defaults to `field`) and `DashboardWidgetSchema.filterBindings`
+    (`Record<string, string | false>`: per-widget field override / `false`
+    opt-out). Zod mirrors included. **Pending paired `@objectstack/spec`
+    alignment (framework#2501)** — same precedent as `dataset` /
+    `categoryGranularity`.
+  - **`@object-ui/core`** — new pure `dashboard-filters` module
+    (`resolveDashboardFilterDefs`, `dashboardFilterVariableDefs`,
+    `buildFilterCondition`, `buildWidgetScopedFilter`); `mergeFilters` lifted
+    from plugin-report (re-exported there unchanged). Date presets emit
+    date-macro tokens (`{30_days_ago}` …) so widgets resolve them at query time
+    like hand-authored filters.
+  - **`@object-ui/plugin-dashboard`** — `DashboardFilterBar` (date presets +
+    custom range calendar, select with static `options` or `optionsFrom`,
+    text/number inputs, reset); `DashboardRenderer` mounts a
+    `PageVariablesProvider` when filters are declared and merges the
+    widget-scoped condition into inline widgets' `filter` and dataset widgets'
+    `runtimeFilter`. Dashboards without filters render exactly as before.
+
+  Binding precedence: explicit `filterBindings` string/`false` → legacy
+  `targetWidgets` allow-list → the filter's own `field` (dateRange defaults to
+  `created_at`). Static-data widgets are not filtered.
+
+- dea65f7: Unify the list-view conditional tier onto the canonical CEL engine (#1584).
+
+  Conditional formatting (list / grid / kanban) and row-action `visible` /
+  `disabled` predicates are now evaluated by `@objectstack/formula`'s
+  `ExpressionEngine` — the same engine the server uses — instead of the legacy
+  JS-dialect `ExpressionEvaluator`, matching how `@objectstack/spec` already types
+  these surfaces (`ExpressionInputSchema` / CEL). The whole platform now speaks one
+  expression dialect (framework ADR-0058).
+
+  - `@object-ui/core`: new `evalRowPredicate` + `resolveConditionalFormatting`
+    helpers (next to `evalFieldPredicate`). One implementation of all three
+    formatting rule shapes; dialect routing (a `{ dialect: 'cel' }` envelope is
+    always CEL; a bare string is CEL unless it carries legacy-only syntax
+    (`${…}` / `===` / `?.` / `.includes()`), which routes to the old engine with a
+    one-time deprecation warning); the native `{ field, operator, value }` form is
+    translated to CEL.
+  - `@object-ui/react`: new `useRowPredicate` hook (canonical CEL, ambient
+    predicate scope merged).
+  - Consumers converged: `ListView.evaluateConditionalFormatting` (thin wrapper,
+    export kept), `ObjectGrid` row styling (inline copy removed), kanban card
+    styles, and the grid / data-table row-action menus. `plugin-view`'s kanban
+    branch now forwards top-level `conditionalFormatting` (previously dropped).
+  - Row-action `visible` fails **closed** (broken predicate → hidden + warn);
+    `disabled` fails soft. The CEL `in` operator (and list membership) now work in
+    row predicates — the legacy engine could not parse them.
+  - The legacy `FormField.condition: { field, equals/notEquals/in }` is retired to
+    a CEL translation (back-compat preserved); `FieldDesigner` migrated to
+    `visibleWhen`.
+
+  Fully back-compat: existing conditional-formatting rules, row-action predicates,
+  and form `condition` metadata keep working (translated / routed as needed).
+
+### Patch Changes
+
+- 2ded18c: Fix: a dashboard filter declaring its static `options` in the
+  `@objectstack/spec` object form (`options: [{ value, label }]` — the shape
+  the spec validates and what framework-authored dashboards ship) crashed the
+  whole dashboard with "Objects are not valid as a React child". Caught driving
+  the showcase Revenue Pulse dashboard in a real browser.
+
+  `resolveDashboardFilterDefs` now normalizes both the spec object form and the
+  bare-string shorthand (`options: ['EMEA']`) to `{ value, label }` pairs —
+  `DashboardFilterDef.options` is typed accordingly — and the filter bar's
+  select renders labels (the trigger now shows the selected option's label, not
+  its raw value). `@object-ui/types` aligns the `GlobalFilterSchema.options`
+  shape with the spec union.
+
+- Updated dependencies [2ded18c]
+- Updated dependencies [e628d1f]
+- Updated dependencies [887062c]
+- Updated dependencies [9e2d58f]
+- Updated dependencies [d5b1bc0]
+- Updated dependencies [f0f10f5]
+  - @object-ui/types@14.1.0
+
 ## 14.0.0
 
 ### Patch Changes

package/dist/actions/ActionEngine.js

@@ -39,7 +39,7 @@ function warnHiddenPredicate(name, raw, err) {
     const msg = err instanceof Error ? err.message : String(err);
     // eslint-disable-next-line no-console
     console.warn(`[ActionEngine] action "${String(name)}" hidden: its \`visible\` predicate threw — ${msg}. ` +
-        `Predicate: ${src}. Action predicates evaluate against { record, recordId, objectName, user, … }; ` +
+        `Predicate: ${src}. Action predicates evaluate against { record, recordId, objectName, user, os.user, … }; ` +
         `use \`record.<field>\` (not a bare field).`);
 }
 export class ActionEngine {

package/dist/actions/ActionRunner.js

@@ -15,6 +15,25 @@
  */
 import { ExpressionEvaluator } from '../evaluator/ExpressionEvaluator';
 import { globalUndoManager } from './UndoManager';
+/**
+ * Bind the server-CEL-parity `os.user` identity alias into an action context
+ * (#2358 trap 1). `@objectstack/spec` documents the canonical CEL identity
+ * scope as `os.user.*` (server formula / validation / sharing), while client
+ * contexts historically only bound `user`. Deriving the alias here means an
+ * action `visible` predicate authored as `os.user.role == "admin"` evaluates
+ * identically on client and server instead of throwing (and being fail-closed
+ * hidden). `os.user` always tracks `context.user`; other consumer-provided
+ * keys under `os` are preserved.
+ */
+function withIdentityAlias(context) {
+    const user = context.user;
+    if (user === undefined)
+        return context;
+    const os = context.os;
+    if (os && typeof os === 'object' && os.user === user)
+        return context;
+    return { ...context, os: { ...(os && typeof os === 'object' ? os : {}), user } };
+}
 export class ActionRunner {
     constructor(context = {}) {
         Object.defineProperty(this, "handlers", {
@@ -77,8 +96,8 @@ export class ActionRunner {
             writable: true,
             value: void 0
         });
-        this.context = context;
-        this.evaluator = new ExpressionEvaluator(context);
+        this.context = withIdentityAlias(context);
+        this.evaluator = new ExpressionEvaluator(this.context);
         // Default confirmation: window.confirm (can be overridden)
         this.confirmHandler = async (message) => window.confirm(message);
         this.toastHandler = null;
@@ -337,7 +356,17 @@ export class ActionRunner {
                 this.toastHandler(message, { type: 'success', duration, undo: result.undo ? {} : undefined });
             }
             if (!result.success && showToast.showOnError !== false && result.error) {
-                const message = action.errorMessage || result.error;
+                // `result.error` is typed as a string, but a handler bug can leak an
+                // error OBJECT (e.g. the ObjectStack `{ code, message }` envelope)
+                // through here — and a non-string toast payload is rendered as a React
+                // child, crashing the page (React #31). Coerce defensively at this
+                // single sink so no handler can take the whole page down.
+                const raw = action.errorMessage || result.error;
+                const message = typeof raw === 'string'
+                    ? raw
+                    : (raw && typeof raw.message === 'string')
+                        ? raw.message
+                        : 'Action failed';
                 this.toastHandler(message, { type: 'error', duration });
             }
         }
@@ -734,8 +763,10 @@ export class ActionRunner {
         return ctx;
     }
     updateContext(newContext) {
-        this.context = { ...this.context, ...newContext };
-        this.evaluator.updateContext(newContext);
+        this.context = withIdentityAlias({ ...this.context, ...newContext });
+        // Feed the merged (re-aliased) context so a refreshed `user` also
+        // refreshes the derived `os.user` binding in the evaluator scope.
+        this.evaluator.updateContext(this.context);
     }
     getContext() {
         return this.context;

package/dist/evaluator/index.d.ts

@@ -8,7 +8,9 @@
 export * from './ExpressionContext.js';
 export * from './ExpressionEvaluator.js';
 export * from './fieldRules.js';
+export * from './listConditional.js';
 export * from './optionRules.js';
+export * from './optionLint.js';
 export * from './ExpressionCache.js';
 export * from './FormulaFunctions.js';
 export * from './SafeExpressionParser.js';

package/dist/evaluator/index.js

@@ -8,7 +8,9 @@
 export * from './ExpressionContext.js';
 export * from './ExpressionEvaluator.js';
 export * from './fieldRules.js';
+export * from './listConditional.js';
 export * from './optionRules.js';
+export * from './optionLint.js';
 export * from './ExpressionCache.js';
 export * from './FormulaFunctions.js';
 export * from './SafeExpressionParser.js';

package/dist/evaluator/listConditional.d.ts

@@ -0,0 +1,93 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Client-side evaluation of the **list-view conditional tier** — conditional
+ * formatting and row-action visibility — on the canonical CEL engine.
+ *
+ * B2 (ADR-0036) moved *field-level* rules (`visibleWhen` / `readonlyWhen` /
+ * `requiredWhen`) onto `@objectstack/formula`'s `ExpressionEngine`, evaluated
+ * identically on the client and the server. The list tier historically stayed
+ * on the legacy `ExpressionEvaluator` (a JS-dialect recursive-descent parser),
+ * even though `@objectstack/spec` already types these surfaces as CEL
+ * (`ListViewSchema.conditionalFormatting[].condition` and `ActionSchema.visible`
+ * are `ExpressionInputSchema` → `{ dialect: 'cel', source }`). This module
+ * converges them onto the same engine so the whole platform speaks one dialect
+ * (framework ADR-0058, "one authoring language, one interpret backend").
+ *
+ * Two evaluation entry points:
+ *   - {@link evalRowPredicate} — a single boolean predicate over a row record
+ *     (row-action `visible` / `disabled`, or a formatting `condition`).
+ *   - {@link resolveConditionalFormatting} — the one implementation of the
+ *     three historical rule shapes, returning the first matching rule's style.
+ *
+ * **Dialect routing.** A predicate authored as the `{ dialect: 'cel', source }`
+ * envelope is authoritative CEL and is *always* sent to the CEL engine. A bare
+ * string is CEL per the spec contract, *unless* it carries legacy-only syntax
+ * (`${…}` templating, `===`/`!==`, `?.` JS optional-chaining, JS string/array
+ * methods) — those are routed to the legacy engine for back-compat and emit a
+ * one-time deprecation warning, because such a string means something different
+ * (or nothing) to the server's CEL engine.
+ */
+import { type FieldRulePredicate } from './fieldRules.js';
+/** True when a *string* predicate uses legacy-only (non-CEL) syntax. */
+export declare function isLegacyDialectSource(source: string): boolean;
+/** Options for {@link evalRowPredicate}. */
+export interface RowPredicateOptions {
+    /** Value returned when the predicate is absent or fails to evaluate.
+     * Pick the safe default for the surface: `false` (fail-closed) for a
+     * row-action `visible`/`disabled`; `false` (no style) for formatting. */
+    fallback?: boolean;
+    /** Extra top-level scope merged alongside the row — e.g. the global predicate
+     * scope (`features` / `user` / `app`) a host shell provides. */
+    scope?: Record<string, unknown>;
+    /** When true, log a one-time warning if a *present* predicate faults. */
+    warnOnError?: boolean;
+    /** Label used in warning messages (e.g. an action name or rule index). */
+    label?: string;
+}
+/**
+ * Evaluate a single boolean predicate against a row record on the canonical CEL
+ * engine (with a legacy-dialect fallback — see the module note). The row's
+ * fields are bound three ways so every authoring convention resolves:
+ * `record.status` (spec/canonical), bare `status` (row-action shorthand), and
+ * `data.status` (legacy). The optional `scope` (host predicate scope) is bound
+ * alongside so `features.*` / `user.*` predicates keep working.
+ */
+export declare function evalRowPredicate(pred: FieldRulePredicate | undefined | null, row: Record<string, unknown> | null | undefined, opts?: RowPredicateOptions): boolean;
+/** A conditional-formatting rule in any of the three historical shapes. */
+export type ConditionalFormattingRuleLike = {
+    /** Spec shape: a CEL predicate (`ExpressionInputSchema`). */
+    condition?: FieldRulePredicate;
+    /** ObjectUI template shape: a `${…}` / plain expression string. */
+    expression?: string;
+    /** ObjectUI native shape: structured field/operator/value comparison. */
+    field?: string;
+    operator?: 'equals' | 'not_equals' | 'contains' | 'greater_than' | 'less_than' | 'in';
+    value?: unknown;
+    /** Style outputs (all shapes). `style` is the base; the three color props
+     * override individual CSS keys. */
+    style?: Record<string, unknown>;
+    backgroundColor?: string;
+    textColor?: string;
+    borderColor?: string;
+};
+/**
+ * Evaluate conditional-formatting rules against a record and return the style
+ * map for the first matching rule (rules are first-match-wins), or `{}`.
+ *
+ * Zero-React: returns a plain `Record<string, string>` style map; React
+ * consumers cast it to `CSSProperties`. Accepts all three historical rule
+ * shapes — spec `{ condition, style }`, ObjectUI `{ expression, … }`, and the
+ * native `{ field, operator, value, … }` — and evaluates every expression on
+ * the canonical CEL engine (with the legacy-dialect fallback in
+ * {@link evalRowPredicate}).
+ *
+ * @param scope  Extra top-level scope (host predicate scope) bound alongside
+ *               the row, so `features.*` predicates keep resolving.
+ */
+export declare function resolveConditionalFormatting(record: Record<string, unknown> | null | undefined, rules?: readonly ConditionalFormattingRuleLike[] | null, scope?: Record<string, unknown>): Record<string, string>;

package/dist/evaluator/optionLint.d.ts

@@ -0,0 +1,43 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+import type { DependsOnInput, OptionLike } from './optionRules.js';
+/** A lint finding on one option's `visibleWhen` predicate. */
+export interface OptionLintIssue {
+    /** Name of the `select`/`radio` field that owns the option (`''` if unnamed). */
+    field: string;
+    /** `value` of the option whose predicate is faulty. */
+    option: string;
+    /** Machine-readable finding kind. */
+    code: 'syntax' | 'unknown-field' | 'option-literal-not-in-domain';
+    /** Human-readable, self-correcting explanation. */
+    message: string;
+}
+/**
+ * Minimal field shape the linter reads — structurally satisfied by
+ * `FormFieldConfig`, `SelectFieldMetadata`, and a bare object-schema field.
+ * Only `name`, the type (`type` or `widget`), `options`, and `dependsOn` are
+ * consulted.
+ */
+export interface LintFieldLike {
+    name?: string;
+    type?: string;
+    widget?: string;
+    dependsOn?: DependsOnInput;
+    options?: readonly OptionLike[] | null;
+}
+/**
+ * Statically lint the per-option `visibleWhen` predicates of a field list
+ * (a form's `fields`, or an object's fields) and return every provable issue.
+ * An empty array means nothing was disprovable — not that every predicate is
+ * semantically correct (see the conservative-by-design note above).
+ *
+ * @param fields  Sibling fields sharing one record scope. Enum fields
+ *                (`select`/`radio`/`multiselect`) contribute their option
+ *                `value`s as the value domain for cross-checks.
+ */
+export declare function lintOptionPredicates(fields: readonly LintFieldLike[] | null | undefined): OptionLintIssue[];

package/dist/evaluator/optionLint.js

@@ -0,0 +1,166 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Build-time / authoring guardrail for cascading `select` options (#1583, #2284).
+ *
+ * A per-option `visibleWhen` predicate (see {@link ./optionRules.js}) fails
+ * *closed*: a broken or wrong predicate makes its option silently never show.
+ * That is invisible at runtime — the offered set just quietly lacks a value —
+ * so the class of bug this catches is exactly the one runtime fail-open can't
+ * surface. The motivating case (#2284) is an AI-authored literal typo:
+ *
+ *   { value: 'zj', visibleWhen: "record.country == 'chna'" }   // 'chna' ≠ 'cn'
+ *
+ * `country`'s own options are `cn` / `us`, so `record.country` can never equal
+ * `'chna'` and Zhejiang is unreachable. The reference *parses*, the field
+ * *exists* — only the compared literal is outside the controlling field's value
+ * domain, which no syntax/existence check knows about. This linter closes that
+ * hole by cross-checking each option predicate against its sibling fields.
+ *
+ * Three checks, in order of confidence:
+ *   1. `syntax`      — the predicate is valid CEL. Delegated to the canonical
+ *                      `@objectstack/formula` `validateExpression` (no schema
+ *                      hint → pure parse validation, so a legitimate
+ *                      `current_user.positions` reference is never flagged).
+ *   2. `unknown-field` — a `record.<name>` reference names a field the form
+ *                      doesn't declare (a sibling typo, `record.contry`).
+ *   3. `option-literal-not-in-domain` — a `record.<enum> == '<literal>'` (or
+ *                      `!=` / `in [...]`) compares against a value outside that
+ *                      *enum* sibling's declared option set (the `'chna'` case).
+ *
+ * Deliberately **conservative**: it only flags what it can statically prove and
+ * never guesses. Anything it can't resolve — a non-`record.` root
+ * (`current_user.*`), a reference to a non-enum field (free text / number /
+ * lookup, whose domain is open), a comparison it doesn't recognise — is left
+ * alone. False positives would train authors to ignore it, so there are none by
+ * construction; it is a safety net, not a schema validator.
+ */
+import { validateExpression } from '@objectstack/formula';
+/** Field types whose value set is a closed, statically-known enum. */
+const OPTION_FIELD_TYPES = new Set(['select', 'radio', 'multiselect']);
+/** The literal source of a predicate (`string` or `{ source }` envelope). */
+function predicateSource(pred) {
+    return typeof pred === 'string' ? pred : (pred?.source ?? '');
+}
+/** Resolved value type of a field, or `select`/`radio`/`multiselect` for enums. */
+function fieldType(f) {
+    return (f.widget || f.type || '').toString();
+}
+/** All `record.<name>` field references in a predicate source. */
+function recordRefs(source) {
+    const refs = [];
+    const re = /record\.([A-Za-z_$][\w$]*)/g;
+    let m;
+    while ((m = re.exec(source)) !== null)
+        refs.push(m[1]);
+    return refs;
+}
+/**
+ * Every `(field, literal)` pair where the predicate compares a `record.<field>`
+ * to a string literal via `==`, `!=`, or `in [...]` — the forms whose literal
+ * can be domain-checked. Recognises both operand orders for equality. Anything
+ * else (ranges, function calls, arithmetic) yields nothing and is skipped.
+ */
+function literalComparisons(source) {
+    const out = [];
+    // record.field == 'lit'  /  record.field != 'lit'
+    const eqRight = /record\.([A-Za-z_$][\w$]*)\s*[=!]=\s*'([^']*)'/g;
+    // 'lit' == record.field  /  'lit' != record.field
+    const eqLeft = /'([^']*)'\s*[=!]=\s*record\.([A-Za-z_$][\w$]*)/g;
+    // record.field in ['a', 'b', ...]
+    const inList = /record\.([A-Za-z_$][\w$]*)\s+in\s+\[([^\]]*)\]/g;
+    let m;
+    while ((m = eqRight.exec(source)) !== null)
+        out.push({ field: m[1], literal: m[2] });
+    while ((m = eqLeft.exec(source)) !== null)
+        out.push({ field: m[2], literal: m[1] });
+    while ((m = inList.exec(source)) !== null) {
+        const field = m[1];
+        const listRe = /'([^']*)'/g;
+        let lm;
+        while ((lm = listRe.exec(m[2])) !== null)
+            out.push({ field, literal: lm[1] });
+    }
+    return out;
+}
+/**
+ * Statically lint the per-option `visibleWhen` predicates of a field list
+ * (a form's `fields`, or an object's fields) and return every provable issue.
+ * An empty array means nothing was disprovable — not that every predicate is
+ * semantically correct (see the conservative-by-design note above).
+ *
+ * @param fields  Sibling fields sharing one record scope. Enum fields
+ *                (`select`/`radio`/`multiselect`) contribute their option
+ *                `value`s as the value domain for cross-checks.
+ */
+export function lintOptionPredicates(fields) {
+    if (!fields || fields.length === 0)
+        return [];
+    const knownFields = new Set();
+    // Value domain of each *enum* field; fields with an open domain are absent.
+    const domainByField = new Map();
+    for (const f of fields) {
+        if (!f?.name)
+            continue;
+        knownFields.add(f.name);
+        if (OPTION_FIELD_TYPES.has(fieldType(f)) && f.options && f.options.length > 0) {
+            domainByField.set(f.name, new Set(f.options.map((o) => o.value)));
+        }
+    }
+    const issues = [];
+    for (const f of fields) {
+        if (!OPTION_FIELD_TYPES.has(fieldType(f)) || !f.options)
+            continue;
+        const field = f.name ?? '';
+        for (const opt of f.options) {
+            if (opt?.visibleWhen == null)
+                continue;
+            const source = predicateSource(opt.visibleWhen);
+            if (!source.trim())
+                continue;
+            const option = opt.value;
+            // 1. Syntax — canonical CEL parse (no schema hint = no scope false-positives).
+            const parsed = validateExpression('predicate', source);
+            if (!parsed.ok) {
+                issues.push({
+                    field,
+                    option,
+                    code: 'syntax',
+                    message: parsed.errors[0]?.message ?? `invalid CEL predicate: ${source}`,
+                });
+                // Extraction below trusts a parseable source; skip it for broken CEL.
+                continue;
+            }
+            // 2. Unknown sibling field — a `record.<name>` the form never declares.
+            for (const ref of recordRefs(source)) {
+                if (!knownFields.has(ref)) {
+                    issues.push({
+                        field,
+                        option,
+                        code: 'unknown-field',
+                        message: `option '${option}' visibleWhen references record.${ref}, which is not a field of this form`,
+                    });
+                }
+            }
+            // 3. Literal outside the controlling enum's value domain (the #2284 case).
+            for (const { field: ref, literal } of literalComparisons(source)) {
+                const domain = domainByField.get(ref);
+                if (domain && !domain.has(literal)) {
+                    issues.push({
+                        field,
+                        option,
+                        code: 'option-literal-not-in-domain',
+                        message: `option '${option}' visibleWhen compares record.${ref} to '${literal}', ` +
+                            `which is not one of ${ref}'s option values (${[...domain].map((v) => `'${v}'`).join(', ')})`,
+                    });
+                }
+            }
+        }
+    }
+    return issues;
+}

package/dist/evaluator/optionRules.d.ts

@@ -15,7 +15,7 @@
  * {@link evalFieldPredicate}). This expresses both:
  *   - cascades — `record.country == 'cn'` (the dependent list narrows as the
  *     controlling field changes), and
- *   - role/context gating — `'admin' in current_user.roles`.
+ *   - role/context gating — `'admin' in current_user.positions`.
  *
  * A field declares which sibling fields its option list reacts to via
  * `dependsOn` (aligns with `@objectstack/spec` Field.dependsOn — the same knob

package/dist/evaluator/optionRules.js

@@ -15,7 +15,7 @@
  * {@link evalFieldPredicate}). This expresses both:
  *   - cascades — `record.country == 'cn'` (the dependent list narrows as the
  *     controlling field changes), and
- *   - role/context gating — `'admin' in current_user.roles`.
+ *   - role/context gating — `'admin' in current_user.positions`.
  *
  * A field declares which sibling fields its option list reacts to via
  * `dependsOn` (aligns with `@objectstack/spec` Field.dependsOn — the same knob

package/dist/index.d.ts

@@ -39,8 +39,11 @@ export * from './runtime/capabilities.js';
 export { composeStacks } from '@objectstack/spec';
 export * from './utils/drill-down.js';
 export * from './utils/date-macros.js';
+export * from './utils/dashboard-filters.js';
+export * from './utils/merge-filters.js';
 export * from './utils/compare-to.js';
 export * from './utils/chart-series.js';
 export * from './utils/dataset-format.js';
 export * from './utils/record-title.js';
 export * from './utils/export-filename.js';
+export * from './utils/reference-keys.js';

package/dist/index.js

@@ -38,8 +38,11 @@ export * from './runtime/capabilities.js';
 export { composeStacks } from '@objectstack/spec';
 export * from './utils/drill-down.js';
 export * from './utils/date-macros.js';
+export * from './utils/dashboard-filters.js';
+export * from './utils/merge-filters.js';
 export * from './utils/compare-to.js';
 export * from './utils/chart-series.js';
 export * from './utils/dataset-format.js';
 export * from './utils/record-title.js';
 export * from './utils/export-filename.js';
+export * from './utils/reference-keys.js';

package/dist/utils/dashboard-filters.d.ts

@@ -0,0 +1,98 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Dashboard-level filter resolution (framework#2501).
+ *
+ * A dashboard declares top-level filters (`globalFilters` + the built-in
+ * `dateRange`). Their values live as dashboard-level variables; each widget
+ * may declare which of ITS OWN fields a filter binds to via
+ * `filterBindings`. At render time the dashboard broadcasts the filter
+ * values into each bound widget's inline query by merging a widget-scoped
+ * `FilterCondition` into the widget's own `filter`.
+ *
+ * Everything in this module is pure and synchronous so the binding rules
+ * are unit-testable in isolation from React and the data layer.
+ */
+import type { DashboardSchema, DashboardWidgetSchema, PageVariable } from '@object-ui/types';
+/** Reserved filter name for the dashboard's built-in date range. */
+export declare const DATE_RANGE_FILTER_NAME = "dateRange";
+export interface DashboardFilterDef {
+    /** Stable name — the variable key and the key widgets bind against. */
+    name: string;
+    /** Default target field when a widget declares no explicit binding. */
+    field: string;
+    label?: string;
+    type: 'text' | 'select' | 'date' | 'number' | 'lookup' | 'dateRange';
+    /**
+     * Static options, NORMALIZED to `{ value, label }` pairs by
+     * `resolveDashboardFilterDefs` — authors may write either the
+     * @objectstack/spec object form (`{ value, label }`) or the bare-string
+     * shorthand; consumers always see the object form.
+     */
+    options?: Array<{
+        value: string;
+        label: string;
+    }>;
+    optionsFrom?: {
+        object: string;
+        valueField: string;
+        labelField?: string;
+        filter?: any;
+    };
+    defaultValue?: any;
+    /** Legacy widget-id allow-list; ignored when a widget binds explicitly. */
+    targetWidgets?: string[];
+    /** dateRange only — whether the UI offers a custom from/to picker. */
+    allowCustomRange?: boolean;
+}
+/** Value shape held by a `dateRange`-typed filter variable. */
+export interface DateRangeValue {
+    /** One of the `DashboardSchema.dateRange.defaultRange` presets. */
+    preset?: string;
+    /** Custom range bounds as ISO dates (either bound may be omitted). */
+    from?: string;
+    to?: string;
+}
+/** Preset keys the filter bar offers, in display order. */
+export declare const DATE_RANGE_PRESETS: string[];
+/**
+ * Normalize a dashboard schema's filter declarations into a flat list of
+ * filter definitions. The built-in `dateRange` (when declared) comes first
+ * under the reserved name `"dateRange"`; each `globalFilters` entry follows,
+ * named by its `name` (defaulting to `field`). Later duplicates win.
+ */
+export declare function resolveDashboardFilterDefs(schema: Pick<DashboardSchema, 'globalFilters' | 'dateRange'>): DashboardFilterDef[];
+/**
+ * Derive `PageVariable` definitions for a dashboard's filter values so the
+ * dashboard can host them in a `PageVariablesProvider` (the page/dashboard
+ * variables primitive). Filter values are then also readable in widget
+ * expressions as `page.<name>`.
+ */
+export declare function dashboardFilterVariableDefs(defs: DashboardFilterDef[]): PageVariable[];
+/**
+ * Build the operator shape (the value side of a `FilterCondition` entry) for
+ * one filter's current value. Returns `undefined` when the value imposes no
+ * constraint. The caller keys the result by the bound field name.
+ */
+export declare function buildFilterCondition(def: DashboardFilterDef, value: unknown): Record<string, unknown> | unknown | undefined;
+/**
+ * Compute the widget-scoped `FilterCondition` for the current filter values:
+ * one `{ [boundField]: condition }` entry per active, bound filter, combined
+ * with `$and` when several apply. Returns `undefined` when nothing applies —
+ * callers then leave the widget's own filter untouched.
+ *
+ * Metadata-aware default bindings (#2578 item 5): when `knownFields` is
+ * provided (the widget's object field names), a DEFAULT binding whose target
+ * field is not on the object is skipped with a console warning instead of
+ * emitting a query the backend will empty-match or reject. An EXPLICIT
+ * `filterBindings` string is always honoured — the author asked for that
+ * field, so a typo surfaces as a visible (fixable) empty widget rather than
+ * being silently dropped. Callers omit `knownFields` when metadata is not
+ * (yet) available, preserving the previous behaviour.
+ */
+export declare function buildWidgetScopedFilter(widget: Pick<DashboardWidgetSchema, 'id' | 'filterBindings'>, defs: DashboardFilterDef[], values: Record<string, unknown>, knownFields?: ReadonlySet<string>): Record<string, unknown> | undefined;

package/dist/utils/dashboard-filters.js

@@ -0,0 +1,229 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/** Reserved filter name for the dashboard's built-in date range. */
+export const DATE_RANGE_FILTER_NAME = 'dateRange';
+/** Default target field for the built-in date range filter. */
+const DATE_RANGE_DEFAULT_FIELD = 'created_at';
+/**
+ * Date-range presets → date-macro token bounds. Tokens stay symbolic in the
+ * generated condition; every widget renderer resolves them at query time via
+ * `resolveDateMacros`, exactly like hand-authored widget filters.
+ */
+const PRESET_RANGES = {
+    today: { from: '{today}', to: '{today}' },
+    yesterday: { from: '{yesterday}', to: '{yesterday}' },
+    this_week: { from: '{current_week_start}', to: '{current_week_end}' },
+    last_week: { from: '{last_week_start}', to: '{last_week_end}' },
+    this_month: { from: '{current_month_start}', to: '{current_month_end}' },
+    last_month: { from: '{last_month_start}', to: '{last_month_end}' },
+    this_quarter: { from: '{current_quarter_start}', to: '{current_quarter_end}' },
+    last_quarter: { from: '{last_quarter_start}', to: '{last_quarter_end}' },
+    this_year: { from: '{current_year_start}', to: '{current_year_end}' },
+    last_year: { from: '{last_year_start}', to: '{last_year_end}' },
+    last_7_days: { from: '{7_days_ago}', to: '{today}' },
+    last_30_days: { from: '{30_days_ago}', to: '{today}' },
+    last_90_days: { from: '{90_days_ago}', to: '{today}' },
+};
+/** Preset keys the filter bar offers, in display order. */
+export const DATE_RANGE_PRESETS = Object.keys(PRESET_RANGES);
+/**
+ * Normalize a filter's static `options` declaration to `{ value, label }`
+ * pairs. The @objectstack/spec `GlobalFilterSchema.options` form is
+ * `{ value, label }` objects (label possibly an i18n record); the bare-string
+ * shorthand (`options: ['EMEA', …]`) is also accepted. Rendering an
+ * un-normalized object child crashes React — this is the single place both
+ * shapes converge.
+ */
+function normalizeFilterOptions(options) {
+    if (!Array.isArray(options) || options.length === 0)
+        return undefined;
+    const normalized = [];
+    for (const o of options) {
+        if (o === null || o === undefined)
+            continue;
+        if (typeof o === 'object') {
+            const value = o.value;
+            if (value === undefined || value === null)
+                continue;
+            const label = o.label;
+            normalized.push({
+                value: String(value),
+                label: typeof label === 'string' && label ? label : String(value),
+            });
+        }
+        else {
+            normalized.push({ value: String(o), label: String(o) });
+        }
+    }
+    return normalized.length > 0 ? normalized : undefined;
+}
+/**
+ * Normalize a dashboard schema's filter declarations into a flat list of
+ * filter definitions. The built-in `dateRange` (when declared) comes first
+ * under the reserved name `"dateRange"`; each `globalFilters` entry follows,
+ * named by its `name` (defaulting to `field`). Later duplicates win.
+ */
+export function resolveDashboardFilterDefs(schema) {
+    const byName = new Map();
+    if (schema.dateRange) {
+        const preset = schema.dateRange.defaultRange;
+        byName.set(DATE_RANGE_FILTER_NAME, {
+            name: DATE_RANGE_FILTER_NAME,
+            field: schema.dateRange.field || DATE_RANGE_DEFAULT_FIELD,
+            type: 'dateRange',
+            // 'custom' has no bounds of its own — start empty and let the user pick.
+            defaultValue: preset && preset !== 'custom' ? { preset } : undefined,
+            allowCustomRange: schema.dateRange.allowCustomRange,
+        });
+    }
+    for (const f of schema.globalFilters ?? []) {
+        if (!f?.field)
+            continue;
+        const name = f.name || f.field;
+        if (byName.has(name) && typeof console !== 'undefined') {
+            console.warn(`[dashboard-filters] duplicate filter name "${name}" — the later definition wins`);
+        }
+        byName.set(name, {
+            name,
+            field: f.field,
+            label: f.label,
+            type: f.type ?? 'text',
+            options: normalizeFilterOptions(f.options),
+            optionsFrom: f.optionsFrom,
+            defaultValue: f.defaultValue,
+            targetWidgets: f.targetWidgets,
+        });
+    }
+    return Array.from(byName.values());
+}
+/**
+ * Derive `PageVariable` definitions for a dashboard's filter values so the
+ * dashboard can host them in a `PageVariablesProvider` (the page/dashboard
+ * variables primitive). Filter values are then also readable in widget
+ * expressions as `page.<name>`.
+ */
+export function dashboardFilterVariableDefs(defs) {
+    return defs.map((def) => ({
+        name: def.name,
+        type: def.type === 'dateRange' ? 'object' : 'string',
+        defaultValue: def.defaultValue,
+    }));
+}
+/** True when a filter value carries no constraint. */
+function isEmptyValue(def, value) {
+    if (value === undefined || value === null || value === '')
+        return true;
+    if (Array.isArray(value))
+        return value.length === 0;
+    if (def.type === 'dateRange' || def.type === 'date') {
+        const v = value;
+        if (typeof v !== 'object')
+            return false;
+        return !v.preset && !v.from && !v.to;
+    }
+    if (typeof value === 'object')
+        return Object.keys(value).length === 0;
+    return false;
+}
+/**
+ * Build the operator shape (the value side of a `FilterCondition` entry) for
+ * one filter's current value. Returns `undefined` when the value imposes no
+ * constraint. The caller keys the result by the bound field name.
+ */
+export function buildFilterCondition(def, value) {
+    if (isEmptyValue(def, value))
+        return undefined;
+    if (def.type === 'dateRange' || def.type === 'date') {
+        const v = value;
+        if (typeof v === 'object') {
+            const range = v.preset ? PRESET_RANGES[v.preset] : undefined;
+            const from = range?.from ?? v.from;
+            const to = range?.to ?? v.to;
+            if (!from && !to)
+                return undefined;
+            return {
+                ...(from ? { $gte: from } : {}),
+                ...(to ? { $lte: to } : {}),
+            };
+        }
+        // A bare string date means equality on that day.
+        return value;
+    }
+    if (def.type === 'select' || def.type === 'lookup') {
+        return Array.isArray(value) ? { $in: value } : value;
+    }
+    if (def.type === 'text') {
+        return { $contains: value };
+    }
+    // number and anything else: equality.
+    return value;
+}
+/**
+ * Resolve which of the widget's fields a filter binds to.
+ * Returns `undefined` when the widget is not bound to this filter.
+ *
+ * Precedence: explicit `filterBindings` entry (string overrides the field,
+ * `false` opts out — both win over everything) → legacy `targetWidgets`
+ * allow-list → the filter's own default `field`.
+ */
+function resolveBoundField(widget, def) {
+    const binding = widget.filterBindings?.[def.name];
+    if (binding === false)
+        return undefined;
+    if (typeof binding === 'string' && binding)
+        return binding;
+    if (def.targetWidgets && def.targetWidgets.length > 0) {
+        if (!widget.id || !def.targetWidgets.includes(widget.id))
+            return undefined;
+    }
+    return def.field;
+}
+/**
+ * Compute the widget-scoped `FilterCondition` for the current filter values:
+ * one `{ [boundField]: condition }` entry per active, bound filter, combined
+ * with `$and` when several apply. Returns `undefined` when nothing applies —
+ * callers then leave the widget's own filter untouched.
+ *
+ * Metadata-aware default bindings (#2578 item 5): when `knownFields` is
+ * provided (the widget's object field names), a DEFAULT binding whose target
+ * field is not on the object is skipped with a console warning instead of
+ * emitting a query the backend will empty-match or reject. An EXPLICIT
+ * `filterBindings` string is always honoured — the author asked for that
+ * field, so a typo surfaces as a visible (fixable) empty widget rather than
+ * being silently dropped. Callers omit `knownFields` when metadata is not
+ * (yet) available, preserving the previous behaviour.
+ */
+export function buildWidgetScopedFilter(widget, defs, values, knownFields) {
+    const conditions = [];
+    for (const def of defs) {
+        const value = values[def.name];
+        if (isEmptyValue(def, value))
+            continue;
+        const field = resolveBoundField(widget, def);
+        if (!field)
+            continue;
+        const isExplicit = typeof widget.filterBindings?.[def.name] === 'string';
+        if (!isExplicit && knownFields && !knownFields.has(field)) {
+            if (typeof console !== 'undefined') {
+                console.warn(`[dashboard-filters] skipping filter "${def.name}" on widget "${widget.id ?? '?'}": ` +
+                    `default field "${field}" does not exist on the widget's object — ` +
+                    `map it with filterBindings: { "${def.name}": "<field>" } or opt out with false`);
+            }
+            continue;
+        }
+        const condition = buildFilterCondition(def, value);
+        if (condition === undefined)
+            continue;
+        conditions.push({ [field]: condition });
+    }
+    if (conditions.length === 0)
+        return undefined;
+    if (conditions.length === 1)
+        return conditions[0];
+    return { $and: conditions };
+}

package/dist/utils/merge-filters.d.ts

@@ -0,0 +1,16 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Combine two `FilterCondition` objects via `$and`, dropping empty ones.
+ *
+ * The scope-filter combinator shared by the dataset report path and the
+ * dashboard filter broadcast: a widget's own `runtimeFilter`/`filter` is
+ * intersected with a host-supplied runtime filter. Returns `undefined` when
+ * nothing meaningful remains so callers can omit the key entirely.
+ */
+export declare function mergeFilters(a: Record<string, unknown> | undefined, b: Record<string, unknown> | undefined): Record<string, unknown> | undefined;

package/dist/utils/merge-filters.js

@@ -0,0 +1,26 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Combine two `FilterCondition` objects via `$and`, dropping empty ones.
+ *
+ * The scope-filter combinator shared by the dataset report path and the
+ * dashboard filter broadcast: a widget's own `runtimeFilter`/`filter` is
+ * intersected with a host-supplied runtime filter. Returns `undefined` when
+ * nothing meaningful remains so callers can omit the key entirely.
+ */
+export function mergeFilters(a, b) {
+    const hasA = a && Object.keys(a).length > 0;
+    const hasB = b && Object.keys(b).length > 0;
+    if (hasA && hasB)
+        return { $and: [a, b] };
+    if (hasA)
+        return a;
+    if (hasB)
+        return b;
+    return undefined;
+}

package/dist/utils/reference-keys.d.ts

@@ -0,0 +1,36 @@
+/**
+ * ObjectUI — reference-key canonicalization
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Backend object schemas follow the ObjectStack convention and name a
+ * relational field's target object `reference`
+ * (e.g. `{ type: 'lookup', reference: 'showcase_account' }`), while ObjectUI's
+ * types — and most in-repo consumers — historically read `reference_to`
+ * (some legacy configs also carry camelCase `referenceTo`). A consumer that
+ * reads only one key silently loses the relation under the other convention:
+ * the exact bug HeaderHighlight had (#2407 / PR #2587), where a served
+ * `reference`-keyed lookup rendered a raw id.
+ *
+ * `normalizeFieldReferenceKeys` stamps BOTH snake_case keys onto the field
+ * definition whenever any of the three spellings is present, so downstream
+ * reads work regardless of which single key they check. It mutates the field
+ * in place — the ObjectStack adapter caches the schema object and re-serves
+ * it, so the one pass must stick — and is idempotent. Keys that are already
+ * set are never overwritten.
+ */
+export declare function normalizeFieldReferenceKeys<T>(fieldDef: T): T;
+/**
+ * Apply {@link normalizeFieldReferenceKeys} to every field of an object
+ * schema. Accepts both field-container shapes the metadata API serves —
+ * a `name → def` map or an array of defs — and tolerates anything else by
+ * returning the input untouched. Mutates in place; idempotent.
+ *
+ * This is meant to run at the choke point where object schemas enter the
+ * client (`ObjectStackAdapter.getObjectSchema`, the app-shell metadata
+ * provider) so per-consumer dual-key fallbacks can't drift.
+ */
+export declare function normalizeSchemaReferenceKeys<T>(schema: T): T;

package/dist/utils/reference-keys.js

@@ -0,0 +1,56 @@
+/**
+ * ObjectUI — reference-key canonicalization
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Backend object schemas follow the ObjectStack convention and name a
+ * relational field's target object `reference`
+ * (e.g. `{ type: 'lookup', reference: 'showcase_account' }`), while ObjectUI's
+ * types — and most in-repo consumers — historically read `reference_to`
+ * (some legacy configs also carry camelCase `referenceTo`). A consumer that
+ * reads only one key silently loses the relation under the other convention:
+ * the exact bug HeaderHighlight had (#2407 / PR #2587), where a served
+ * `reference`-keyed lookup rendered a raw id.
+ *
+ * `normalizeFieldReferenceKeys` stamps BOTH snake_case keys onto the field
+ * definition whenever any of the three spellings is present, so downstream
+ * reads work regardless of which single key they check. It mutates the field
+ * in place — the ObjectStack adapter caches the schema object and re-serves
+ * it, so the one pass must stick — and is idempotent. Keys that are already
+ * set are never overwritten.
+ */
+export function normalizeFieldReferenceKeys(fieldDef) {
+    if (!fieldDef || typeof fieldDef !== 'object')
+        return fieldDef;
+    const f = fieldDef;
+    const target = f.reference_to ?? f.reference ?? f.referenceTo;
+    if (target == null || target === '')
+        return fieldDef;
+    if (f.reference_to === undefined)
+        f.reference_to = target;
+    if (f.reference === undefined)
+        f.reference = target;
+    return fieldDef;
+}
+/**
+ * Apply {@link normalizeFieldReferenceKeys} to every field of an object
+ * schema. Accepts both field-container shapes the metadata API serves —
+ * a `name → def` map or an array of defs — and tolerates anything else by
+ * returning the input untouched. Mutates in place; idempotent.
+ *
+ * This is meant to run at the choke point where object schemas enter the
+ * client (`ObjectStackAdapter.getObjectSchema`, the app-shell metadata
+ * provider) so per-consumer dual-key fallbacks can't drift.
+ */
+export function normalizeSchemaReferenceKeys(schema) {
+    const fields = schema && typeof schema === 'object' ? schema.fields : null;
+    if (!fields || typeof fields !== 'object')
+        return schema;
+    const defs = Array.isArray(fields) ? fields : Object.values(fields);
+    for (const def of defs)
+        normalizeFieldReferenceKeys(def);
+    return schema;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/core",
-  "version": "14.0.0",
+  "version": "14.1.0",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",
@@ -29,7 +29,7 @@
     "@objectstack/spec": "^14.6.0",
     "lodash": "^4.18.1",
     "zod": "^4.4.3",
-    "@object-ui/types": "14.0.0"
+    "@object-ui/types": "14.1.0"
   },
   "devDependencies": {
     "typescript": "^6.0.3",