@object-ui/core 17.5.0 → 17.6.0

package/dist/actions/actionKeys.js

@@ -106,9 +106,10 @@
 /**
  * Every property `ActionDef` declares, in declaration order.
  *
- * Kept as data because TypeScript types do not survive to runtime — and
- * `keyof ActionDef` cannot substitute for this list: the index signature widens
- * it to `string | number`, which is precisely the problem being worked around.
+ * Kept as data because TypeScript types do not survive to runtime — `keyof
+ * ActionDef` is erased along with the interface, so it cannot hand a runtime
+ * classifier a list of anything. `actionKeys.pin.test.ts` re-derives this one
+ * from the interface's AST, which is what keeps the data true.
  */
 export const ACTION_DEF_KEYS = [
     'type',
@@ -235,6 +236,14 @@ export const SPEC_ACTION_KEYS = [
     'name',
     'newTabUrl',
     'objectName',
+    // Declared by `ActionSchema` as of @objectstack/spec 17.1.0 (objectui#5328).
+    // Listing it here is a DIAGNOSTIC statement only — `KNOWN_ACTION_KEYS` feeds
+    // `warnOnUnknownActionKeys`, so without this row an author writing the key the
+    // spec now accepts would be warned it is unknown. It says nothing about the
+    // key being forwarded: the four declared action surfaces still drop it before
+    // the runner, tracked as KNOWN_GAPS in check-action-forward-parity.mjs and
+    // filed as objectui#5493.
+    'onSuccess',
     'openIn',
     'opensInNewTab',
     'order',
@@ -264,6 +273,54 @@ export const SPEC_ACTION_KEYS = [
  * runner itself supports.
  */
 export const NAVIGATION_ALIAS_KEYS = ['to', 'external', 'newTab', 'replace'];
+/**
+ * Keys a HOST composes on the DISPATCH OBJECT at dispatch time — chrome the
+ * runtime reads once on its way to the dialog, that no author ever writes and
+ * no store ever holds.
+ *
+ * Distinct from every other list in this module, and the distinction is the
+ * whole point: each of the three lists above restates one AUTHORED surface —
+ * what `ActionDef` itself declares, what the spec's `ActionSchema` declares,
+ * and the `navigation` alias's objectui dialect — so a key joining one of them
+ * is a key an author may legally write. This list claims no such derivation and
+ * must not acquire one: a key here is the opposite, and writing it in metadata
+ * is still a compile error that must stay one. Maintainer ruling
+ * 2026-08-22 fixes both halves of that: ⛔ the key is NOT declared on
+ * `ActionDef` and ⛔ NOT added to {@link ACTION_DEF_KEYS}; it is declared at the
+ * seam, on `packages/app-shell/src/consoleActionDispatch.ts`'s
+ * `ConsoleActionDispatch`, and appears HERE only so the dev-mode warning below
+ * stops calling it unknown.
+ *
+ * Why the warning has to know: `classifyActionKeys` sees the object the runner
+ * was handed, which is the DISPATCH, not the stored metadata row. With the key
+ * absent from the inventory, `warnOnUnknownActionKeys` told the author that a
+ * key TWO files read is one "no reader recognizes", and prescribed promoting it
+ * to `ActionDef` — the one shape the ruling forbids for it. A diagnostic that
+ * fires on the product's own privileged path is how a console gets muted.
+ *
+ * {@link HOST_STASHED_PARAM_KEYS} below is the same category one level down —
+ * host-composed keys inside `params` rather than on the action itself — and
+ * cites `DeclaredActionsBar` by name for the same reason this does. Two lists
+ * because the two warnings ask different questions of different objects, not
+ * because the categories differ.
+ *
+ * `overrideNotice` — the privileged-override safety copy (objectui#5178),
+ * naming the approvers about to be bypassed.
+ * - producer: `packages/app-shell/src/views/DeclaredActionsBar.tsx`, on the
+ *   `can_act:false && can_override:true` branch.
+ * - readers: `packages/app-shell/src/hooks/useConsoleActionRuntime.tsx` and
+ *   `packages/app-shell/src/views/RecordDetailView.tsx`, the console's two
+ *   param-collection handlers, which render it ahead of the declared
+ *   description in the dialog's subtitle.
+ *
+ * Anything added here must satisfy all three of: composed by a host in code,
+ * never read back out of stored metadata, and read by the runtime. A key an
+ * AUTHOR is meant to write belongs on `ActionDef` — or, when the spec owns it,
+ * in `@objectstack/spec` first — and not in this list. `actionKeys.pin.test.ts`
+ * pins the contents exactly, so growing the set is a deliberate, reviewed edit
+ * rather than a quiet one.
+ */
+export const HOST_DISPATCH_ACTION_KEYS = ['overrideNotice'];
 /**
  * Keys the spec has TOMBSTONED: still present in `ActionSchema` so the parser can
  * reject them BY NAME with a rename prescription, rather than fail with a bare
@@ -287,11 +344,21 @@ export const RETIRED_ACTION_KEYS = {
         'The value (a script name or expression) is unchanged. ' +
         'Run `os migrate meta --from 16` to rewrite it automatically.',
 };
-/** Every key an action may legitimately carry today. */
+/**
+ * Every key an action may legitimately carry today — authored or host-composed.
+ *
+ * Four inputs, three of them mirrors of an authored surface and the fourth
+ * ({@link HOST_DISPATCH_ACTION_KEYS}) the host-composed dispatch chrome. The
+ * union is what `classifyActionKeys` consults, and it is deliberately wider
+ * than the authored surface: the runner classifies the object it was HANDED,
+ * and a host hands it a dispatch. Membership here grants nothing to an author —
+ * `ActionDef` is what decides that, and it is closed.
+ */
 export const KNOWN_ACTION_KEYS = new Set([
     ...ACTION_DEF_KEYS,
     ...SPEC_ACTION_KEYS,
     ...NAVIGATION_ALIAS_KEYS,
+    ...HOST_DISPATCH_ACTION_KEYS,
 ].filter((key) => !(key in RETIRED_ACTION_KEYS)));
 /** Split an action's own keys into the two things worth saying out loud. */
 export function classifyActionKeys(action) {
@@ -326,9 +393,11 @@ const isDev = () => globalThis.process?.env?.NODE_ENV !==
  * Dev-mode only: name the keys an action carries that no reader will ever look
  * at. Non-breaking by construction — it changes no types and rejects nothing.
  *
- * Silently binding no handler is the #2169 "Mark Done does nothing" shape, and
- * the compiler cannot help while the index signature stands. Until it comes
- * down, this is the audible half.
+ * Silently binding no handler is the #2169 "Mark Done does nothing" shape. The
+ * compiler now catches it in action literals AUTHORED IN CODE — objectstack#4075
+ * step 3 closed `ActionDef` — but not in the actions that arrive as DATA, which
+ * reach the runner unparsed and which no compiler ever looked at. This is the
+ * audible half for that population; see this module's header.
  */
 export function warnOnUnknownActionKeys(action, where = 'ActionRunner') {
     if (!isDev())
@@ -351,8 +420,11 @@ export function warnOnUnknownActionKeys(action, where = 'ActionRunner') {
     console.warn(`[${where}] action "${String(name)}" carries ${unknown.length === 1 ? 'a key' : 'keys'} no reader ` +
         `recognizes: \`${unknown.join('`, `')}\`. Nothing will read ${unknown.length === 1 ? 'it' : 'them'} — ` +
         'check for a typo, or promote the key to an explicit field on `ActionDef` ' +
-        '(packages/core/src/actions/actionKeys.ts). Warned rather than rejected because `ActionDef` ' +
-        'still carries `[key: string]: any`, so the compiler cannot see this (objectstack#4075).');
+        '(packages/core/src/actions/ActionRunner.ts), adding it to `ACTION_DEF_KEYS` ' +
+        '(packages/core/src/actions/actionKeys.ts) in the SAME commit — the pin test derives one ' +
+        'from the other, so either edit alone goes red. Warned rather than rejected because `tsc` ' +
+        'only sees actions authored in code: this one may have arrived as DATA, and stored ' +
+        '`sys_metadata` rows reach the runner unparsed (objectstack#3903).');
 }
 /**
  * Keys a HOST stashes into an action's `params` for the runner's own plumbing,

package/dist/actions/actionResponse.js

@@ -47,7 +47,7 @@
  * - **transport-level `success: false`** — the outer envelope reporting a
  *   failure directly.
  */
-import { actionErrorDetail } from './actionErrorDetail';
+import { actionErrorDetail } from './actionErrorDetail.js';
 /**
  * The handler's own return value — one level deeper than the action envelope.
  *

package/dist/actions/index.d.ts

@@ -14,3 +14,4 @@ export * from './bulkFastPath.js';
 export * from './actionErrorDetail.js';
 export * from './actionResponse.js';
 export * from './serverActionHandler.js';
+export * from './recordIdParam.js';

package/dist/actions/index.js

@@ -14,3 +14,4 @@ export * from './bulkFastPath.js';
 export * from './actionErrorDetail.js';
 export * from './actionResponse.js';
 export * from './serverActionHandler.js';
+export * from './recordIdParam.js';

package/dist/actions/recordIdParam.d.ts

@@ -0,0 +1,77 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Seeding an action's `recordIdParam` from the row — and refusing to dispatch
+ * when the row cannot supply it (objectstack#8018).
+ *
+ * An `api` action declaring `recordIdParam` names the request key that carries
+ * the record it acts on; `recordIdField` names the row field whose value seeds
+ * it (default `id`). Every call site used to spell the read the same permissive
+ * way:
+ *
+ * ```ts
+ * const rowValue = rowRecord[action.recordIdField || 'id'];
+ * if (rowValue != null) body[action.recordIdParam] = rowValue;   // else: nothing
+ * ```
+ *
+ * The `else` branch is the defect. It cannot distinguish "this row has no such
+ * key" from "this row's value is null", and in both cases it drops the parameter
+ * and lets the request go out anyway. What reaches the server is a mutation with
+ * no record named — and a backend that treats a missing selector as "match
+ * nothing" answers `{ status: true }` for having deleted nothing. The user is
+ * told the action succeeded. The measured instance was a session-revocation
+ * control that revoked nothing, which is the worst shape this can take: a
+ * security affordance that reports success while no-op'ing.
+ *
+ * The absent-key half is reachable from ordinary authoring, not just from bad
+ * data: the grid projects `$select` from the listView columns, so until
+ * `recordIdField` was harvested into it (see `listViewPredicates`) any action
+ * keyed on a non-column field got a row without that key. The harvest closes the
+ * common route; this guard closes the class, because a row can still lack the key
+ * for reasons projection cannot fix — a server-side read mask that strips the
+ * field regardless of projection (`internal: true`), a partial payload handed
+ * down from a host, a field the principal cannot read.
+ *
+ * Contract-first (AGENTS.md #0.1): the answer to an under-specified request is to
+ * refuse it at the producer, loudly, not to send it and hope the server objects.
+ * The two failures are named separately because they point at different repairs —
+ * an absent key is a projection/visibility problem, a null value is a data one.
+ */
+/** The minimal action shape this resolution reads. */
+export interface RecordIdParamAction {
+    /** Request key that carries the record id. Absent ⇒ no injection is declared. */
+    recordIdParam?: string;
+    /** Row field whose value seeds it. Defaults to `id`. */
+    recordIdField?: string;
+    /** Used only to make the refusal message name the action. */
+    name?: string;
+    label?: string;
+}
+/**
+ * Either the value to inject, or the reason the action must not be dispatched.
+ * `{}` (neither key) means no injection is declared — carry on unchanged.
+ */
+export type RecordIdParamSeed = {
+    value: unknown;
+    error?: undefined;
+} | {
+    value?: undefined;
+    error: string;
+} | {
+    value?: undefined;
+    error?: undefined;
+};
+/**
+ * Resolve the value an action's `recordIdParam` should carry, or the refusal.
+ *
+ * Pure — reads the action and the row, mutates nothing. Returns `{}` when the
+ * action declares no `recordIdParam` (nothing to inject) or when there is no row
+ * record at all (the caller is on a path where no row context exists; that is not
+ * this guard's business).
+ */
+export declare function resolveRecordIdParamSeed(action: RecordIdParamAction | null | undefined, rowRecord: Record<string, unknown> | null | undefined): RecordIdParamSeed;

package/dist/actions/recordIdParam.js

@@ -0,0 +1,37 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Resolve the value an action's `recordIdParam` should carry, or the refusal.
+ *
+ * Pure — reads the action and the row, mutates nothing. Returns `{}` when the
+ * action declares no `recordIdParam` (nothing to inject) or when there is no row
+ * record at all (the caller is on a path where no row context exists; that is not
+ * this guard's business).
+ */
+export function resolveRecordIdParamSeed(action, rowRecord) {
+    const param = action?.recordIdParam;
+    if (!param || !rowRecord || typeof rowRecord !== 'object')
+        return {};
+    const field = action?.recordIdField || 'id';
+    const label = action?.label || action?.name || param;
+    if (!(field in rowRecord)) {
+        return {
+            error: `Action "${label}" identifies its record by "${field}", but that field is not ` +
+                `present on the row. Add it to the view's columns, or check that it is readable ` +
+                `— running without it would send a request that names no record.`,
+        };
+    }
+    const value = rowRecord[field];
+    if (value == null) {
+        return {
+            error: `Action "${label}" identifies its record by "${field}", but this record has no ` +
+                `value for it — running without it would send a request that names no record.`,
+        };
+    }
+    return { value };
+}

package/dist/actions/serverActionHandler.d.ts

@@ -52,7 +52,7 @@
  * // <ActionProvider handlers={{ script }} … />  (or runner.registerHandler('script', script))
  * ```
  */
-import type { ActionContext, ActionDef, ActionResult } from './ActionRunner';
+import type { ActionContext, ActionDef, ActionResult } from './ActionRunner.js';
 /** The response surface the dispatcher needs — satisfied by a WHATWG `Response`. */
 export interface ServerActionFetchResponse {
     ok: boolean;

package/dist/actions/serverActionHandler.js

@@ -5,7 +5,7 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  */
-import { interpretActionResponse } from './actionResponse';
+import { interpretActionResponse } from './actionResponse.js';
 /**
  * An action that also mounts on list rows (`list_item`) or record pages is
  * designed to run against a single record. When such an action is launched

package/dist/evaluator/ExpressionEvaluator.d.ts

@@ -129,7 +129,48 @@ export declare class ExpressionEvaluator {
      */
     getFormulas(): FormulaFunctions;
     /**
-     * Register a custom formula function
+     * Register a custom formula function.
+     *
+     * **The name is case-folded: it is stored — and must be called — in UPPER
+     * CASE.** `registerFunction('formatCurrency', fn)` registers
+     * `FORMATCURRENCY`, and an expression has to spell it that way:
+     * `${FORMATCURRENCY(price)}` resolves, `${formatCurrency(price)}` does not.
+     * The fold is deliberate — formula names are spreadsheet-style vocabulary
+     * (`SUM`, `IF`, `UPPER`) and the built-ins go through the very same
+     * {@link FormulaFunctions.register} — but two things keep it from being
+     * self-evident at the call site:
+     *
+     * 1. The registry API stays case-insensitive, so it never surfaces the fold:
+     *    `getFormulas().has('formatCurrency')` is `true` and `.get()` returns the
+     *    function. Only expressions see the stored spelling, because the
+     *    evaluation scope is built from `FormulaFunctions.toObject()` — a plain
+     *    object, whose identifiers expressions match case-sensitively.
+     * 2. A wrong-case call site does not raise. {@link evaluate} catches, warns,
+     *    and returns `defaultValue ?? expression`, so the template renders its own
+     *    `${...}` source as literal text.
+     *    {@link ExpressionEvaluator.evaluateExpression} is the throwing sibling,
+     *    and reports `'formatCurrency' is not a function`.
+     *
+     * To keep a name's exact spelling, supply the function as evaluation context
+     * data instead: context entries are merged over the formulas and stay verbatim.
+     *
+     * @param name Function name; folded to upper case for both storage and lookup.
+     * @param fn Implementation, invoked with the evaluated call arguments.
+     *
+     * @example
+     * ```ts
+     * const evaluator = new ExpressionEvaluator({ price: 1234.5 });
+     * evaluator.registerFunction('formatCurrency', fmt);
+     *
+     * evaluator.evaluate('${FORMATCURRENCY(price)}'); // '$1,234.50'
+     * evaluator.evaluate('${formatCurrency(price)}'); // '${formatCurrency(price)}' — the source, verbatim
+     *
+     * // Case-sensitive alternative — the function travels as context data.
+     * // Note the receiver: the call below is the MODULE-LEVEL export (a context
+     * // bag as its second parameter), not the method used above.
+     * import { evaluateExpression } from '@object-ui/core';
+     * evaluateExpression('${formatCurrency(price)}', { formatCurrency: fmt, price: 1234.5 }); // '$1,234.50'
+     * ```
      */
     registerFunction(name: string, fn: (...args: any[]) => any): void;
 }

package/dist/evaluator/ExpressionEvaluator.js

@@ -305,7 +305,48 @@ export class ExpressionEvaluator {
         return this.formulas;
     }
     /**
-     * Register a custom formula function
+     * Register a custom formula function.
+     *
+     * **The name is case-folded: it is stored — and must be called — in UPPER
+     * CASE.** `registerFunction('formatCurrency', fn)` registers
+     * `FORMATCURRENCY`, and an expression has to spell it that way:
+     * `${FORMATCURRENCY(price)}` resolves, `${formatCurrency(price)}` does not.
+     * The fold is deliberate — formula names are spreadsheet-style vocabulary
+     * (`SUM`, `IF`, `UPPER`) and the built-ins go through the very same
+     * {@link FormulaFunctions.register} — but two things keep it from being
+     * self-evident at the call site:
+     *
+     * 1. The registry API stays case-insensitive, so it never surfaces the fold:
+     *    `getFormulas().has('formatCurrency')` is `true` and `.get()` returns the
+     *    function. Only expressions see the stored spelling, because the
+     *    evaluation scope is built from `FormulaFunctions.toObject()` — a plain
+     *    object, whose identifiers expressions match case-sensitively.
+     * 2. A wrong-case call site does not raise. {@link evaluate} catches, warns,
+     *    and returns `defaultValue ?? expression`, so the template renders its own
+     *    `${...}` source as literal text.
+     *    {@link ExpressionEvaluator.evaluateExpression} is the throwing sibling,
+     *    and reports `'formatCurrency' is not a function`.
+     *
+     * To keep a name's exact spelling, supply the function as evaluation context
+     * data instead: context entries are merged over the formulas and stay verbatim.
+     *
+     * @param name Function name; folded to upper case for both storage and lookup.
+     * @param fn Implementation, invoked with the evaluated call arguments.
+     *
+     * @example
+     * ```ts
+     * const evaluator = new ExpressionEvaluator({ price: 1234.5 });
+     * evaluator.registerFunction('formatCurrency', fmt);
+     *
+     * evaluator.evaluate('${FORMATCURRENCY(price)}'); // '$1,234.50'
+     * evaluator.evaluate('${formatCurrency(price)}'); // '${formatCurrency(price)}' — the source, verbatim
+     *
+     * // Case-sensitive alternative — the function travels as context data.
+     * // Note the receiver: the call below is the MODULE-LEVEL export (a context
+     * // bag as its second parameter), not the method used above.
+     * import { evaluateExpression } from '@object-ui/core';
+     * evaluateExpression('${formatCurrency(price)}', { formatCurrency: fmt, price: 1234.5 }); // '$1,234.50'
+     * ```
      */
     registerFunction(name, fn) {
         this.formulas.register(name, fn);

package/dist/evaluator/SafeExpressionParser.js

@@ -296,7 +296,6 @@ export class SafeExpressionParser {
     parseEquality() {
         let left = this.parseAddition();
         this.skipWhitespace();
-        // eslint-disable-next-line no-constant-condition
         while (true) {
             // Every branch below either assigns `op` or `break`s out of the loop, so
             // `op` is always set by the time the switch reads it (no null initializer
@@ -346,11 +345,9 @@ export class SafeExpressionParser {
                 case '!==':
                     left = left !== right;
                     break;
-                // eslint-disable-next-line eqeqeq
                 case '==':
                     left = left == right;
                     break;
-                // eslint-disable-next-line eqeqeq
                 case '!=':
                     left = left != right;
                     break;
@@ -438,7 +435,6 @@ export class SafeExpressionParser {
     /** Level 9 — Member access, method calls, function calls */
     parseMember() {
         let obj = this.parsePrimary();
-        // eslint-disable-next-line no-constant-condition
         while (true) {
             this.skipWhitespace();
             const isOptionalDot = this.peek() === '?' && this.peek(1) === '.';

package/dist/evaluator/declaredPredicate.js

@@ -5,7 +5,7 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  */
-import { toPredicateInput } from './predicateInput';
+import { toPredicateInput } from './predicateInput.js';
 /**
  * Is the predicate TEXT blank — in EITHER spelling? (objectui#3960)
  *

package/dist/evaluator/fieldRules.d.ts

@@ -68,6 +68,24 @@ export declare function evalFieldPredicate(pred: FieldRulePredicate | undefined
  * `false` predicate result for required/readonly — but `visibleWhen` is
  * authoritative when present (so a field can be conditionally shown/hidden).
  *
+ * ## `statics.serverOwnedValue` — the one thing that outranks BOTH
+ *
+ * A CREATE form leaves a producer-owned control empty on purpose and omits the
+ * key, so the server resolves the declared runtime default (#4069). Required-
+ * ness is then not the client's question at all, and this is the single place
+ * that answers it: `required` resolves to `false` whatever `statics.required`
+ * says and whatever `requiredWhen` evaluates to.
+ *
+ * Both spellings had to land HERE, not in a gate a layer up. Since
+ * objectui#4201 the submit-time check and the required marker read one live
+ * verdict — this function's — so a suppression applied anywhere else would
+ * show a field without an asterisk and still refuse the submit, which is the
+ * exact two-layer disagreement #4201 removed. #4085 is the conditional half:
+ * `requiredWhen` resolving TRUE on a create form re-required a control the
+ * renderer deliberately left empty, with nothing the user could type to
+ * unblock it. See `isServerOwnedValue` in `../validation/server-owned-value.js`
+ * for who computes the fact and why the mode is the caller's to state.
+ *
  * @param fieldContext  Optional locator for failure warnings — e.g.
  *                      `"field 'amount'"`. The warning then reads
  *                      `visibleWhen of field 'amount' …`; without it, the rule
@@ -80,6 +98,7 @@ export declare function resolveFieldRuleState(rules: {
 }, record: Record<string, unknown>, statics: {
     required?: boolean;
     readonly?: boolean;
+    serverOwnedValue?: boolean;
 }, previous?: Record<string, unknown>, scope?: Record<string, unknown>, fieldContext?: string): {
     visible: boolean;
     readonly: boolean;

package/dist/evaluator/fieldRules.js

@@ -34,8 +34,7 @@
  * `stripReadonlyWhenFieldsMulti` on the bulk path — DELETES that key from the
  * UPDATE payload. This file keeps the same fault fail-OPEN. For that one class
  * the two ends therefore point in OPPOSITE directions, deliberately: the
- * framework's ADR-0057 D10 — server enforces, client is courtesy (framework
- * numbering; this repo's own ADR-0057 is an unrelated document) — makes the
+ * framework's ADR-0124 D1 — server enforces, client is courtesy — makes the
  * server the authority, so the courtesy layer does not get to guess "locked"
  * and grey out a field the server might have accepted.
  *
@@ -153,6 +152,24 @@ export function evalFieldPredicate(pred, record, fallback, previous, scope, diag
  * `false` predicate result for required/readonly — but `visibleWhen` is
  * authoritative when present (so a field can be conditionally shown/hidden).
  *
+ * ## `statics.serverOwnedValue` — the one thing that outranks BOTH
+ *
+ * A CREATE form leaves a producer-owned control empty on purpose and omits the
+ * key, so the server resolves the declared runtime default (#4069). Required-
+ * ness is then not the client's question at all, and this is the single place
+ * that answers it: `required` resolves to `false` whatever `statics.required`
+ * says and whatever `requiredWhen` evaluates to.
+ *
+ * Both spellings had to land HERE, not in a gate a layer up. Since
+ * objectui#4201 the submit-time check and the required marker read one live
+ * verdict — this function's — so a suppression applied anywhere else would
+ * show a field without an asterisk and still refuse the submit, which is the
+ * exact two-layer disagreement #4201 removed. #4085 is the conditional half:
+ * `requiredWhen` resolving TRUE on a create form re-required a control the
+ * renderer deliberately left empty, with nothing the user could type to
+ * unblock it. See `isServerOwnedValue` in `../validation/server-owned-value.js`
+ * for who computes the fact and why the mode is the caller's to state.
+ *
  * @param fieldContext  Optional locator for failure warnings — e.g.
  *                      `"field 'amount'"`. The warning then reads
  *                      `visibleWhen of field 'amount' …`; without it, the rule
@@ -169,9 +186,16 @@ export function resolveFieldRuleState(rules, record, statics, previous, scope, f
         (rules.readonlyWhen != null
             ? evalFieldPredicate(rules.readonlyWhen, record, false, previous, scope, diag('readonlyWhen'))
             : false);
-    const required = statics.required === true ||
-        (rules.requiredWhen != null
-            ? evalFieldPredicate(rules.requiredWhen, record, false, previous, scope, diag('requiredWhen'))
-            : false);
+    // Short-circuited, not evaluated-and-discarded: the verdict cannot depend on
+    // the predicate, so running it would only spend an engine call per field per
+    // render. A broken `requiredWhen` still warns wherever it decides something
+    // — the same object's EDIT form, and any create form where the field is not
+    // server-owned.
+    const required = statics.serverOwnedValue === true
+        ? false
+        : statics.required === true ||
+            (rules.requiredWhen != null
+                ? evalFieldPredicate(rules.requiredWhen, record, false, previous, scope, diag('requiredWhen'))
+                : false);
     return { visible, readonly, required };
 }

package/dist/evaluator/index.d.ts

@@ -10,6 +10,7 @@ export * from './ExpressionEvaluator.js';
 export * from './predicateInput.js';
 export * from './declaredPredicate.js';
 export * from './fieldRules.js';
+export * from './rowPredicateCanon.js';
 export * from './listConditional.js';
 export * from './optionRules.js';
 export * from './optionLint.js';

package/dist/evaluator/index.js

@@ -10,6 +10,7 @@ export * from './ExpressionEvaluator.js';
 export * from './predicateInput.js';
 export * from './declaredPredicate.js';
 export * from './fieldRules.js';
+export * from './rowPredicateCanon.js';
 export * from './listConditional.js';
 export * from './optionRules.js';
 export * from './optionLint.js';

package/dist/evaluator/listConditional.d.ts

@@ -51,6 +51,30 @@ export interface RowPredicateOptions {
     warnOnError?: boolean;
     /** Label used in warning messages (e.g. an action name or rule index). */
     label?: string;
+    /**
+     * This surface has **no row of its own** — bind NOTHING for the row instead
+     * of binding an empty one, so a `record` / `data` the HOST SCOPE carries
+     * survives to the predicate (objectui#4640).
+     *
+     * The default (`false`) is this function's whole subject rule: the row is
+     * pinned over the scope, on both dialect paths, so `record` / `data` always
+     * name THIS row even when the host scope carries keys of those names
+     * (objectui#3796). That is right for every row surface — and exactly wrong
+     * for a surface that has no row, because the pin then writes an EMPTY
+     * `record` / `data` over the host's real ones and every `record.*` predicate
+     * faults with "No such key". "This surface has no row of its own" and "this
+     * surface's row is empty" are different facts; only the latter is entitled to
+     * shadow the scope. Same distinction, same words, as `usePredicateRecordContext`
+     * in `@object-ui/react` (objectui#4075) — which is the BINDING half of this
+     * rule for the `useCondition` tier; this is the evaluation-entry half.
+     *
+     * Set it where the predicate is scoped to a *dialog / shell / page* rather
+     * than to a record — `ActionParamDialog`'s param `visible` gates are the
+     * first caller (objectui#4640): their scope IS the host predicate scope,
+     * `data` and all. `opts.fields` is meaningless here (there is no row to
+     * collapse relations on) and is ignored.
+     */
+    rowless?: boolean;
     /**
      * The object's field definitions (`objectSchema.fields`). Supplying them lets
      * a relation field be bound as the FOREIGN KEY the server stores, rather than
@@ -64,11 +88,34 @@ export interface RowPredicateOptions {
  * Evaluate a single boolean predicate against a row record on the canonical CEL
  * engine (with a legacy-dialect fallback — see the module note). The row's
  * fields are bound three ways so every authoring convention resolves:
- * `record.status` (spec/canonical), bare `status` (row-action shorthand), and
- * `data.status` (legacy). The optional `scope` (host predicate scope) is bound
+ * `record.status`, bare `status` (row-action shorthand), and `data.status`.
+ *
+ * ⚠️ Those three are NOT peers, and this doc comment used to read as though
+ * they were. **The canon is `record.*`** (maintainer ruling 2026-08-20 on
+ * objectui#5330, option B); the other two are client tolerances in a
+ * deprecation window, kept because stored metadata carries them and warned
+ * about — from the CEL path below — by `warnNonCanonicalRowSpelling`. The
+ * server accepts `record.*` and NOTHING else: measured on
+ * `@objectstack/formula@17.1.0`, `buildScope({ record })` mounts exactly
+ * `['record']`, so a bare field faults `Unknown variable: status` there and a
+ * `data.*` predicate faults `Unknown variable: data`. See
+ * {@link ./rowPredicateCanon.ts} for the full measurement, for why `data.*` is
+ * the dangerous one (it is silently ACCEPTED by the server's authoring oracle
+ * and still binds nothing at runtime), and for why the deprecation is scoped to
+ * this runtime layer rather than declared platform-wide (`data` is the
+ * canonical root of a metadata-editing form — ADR-0089 D3).
+ *
+ * ⛔ No spelling is removed from the binding, and none may be before a
+ * stored-metadata survey sizes the window — that is part of the same ruling.
+ *
+ * The optional `scope` (host predicate scope) is bound
  * alongside so `features.*` / `user.*` predicates keep working — but the row is
  * the subject: `record` and `data` always name THIS row, on both dialect paths,
  * even when the host scope carries keys of those names (objectui#3796).
+ *
+ * A caller with no row at all passes {@link RowPredicateOptions.rowless}, and
+ * then nothing is bound over the scope — see that option for why an absent row
+ * must not be spelled as an empty one.
  */
 export declare function evalRowPredicate(pred: FieldRulePredicate | undefined | null, row: Record<string, unknown> | null | undefined, opts?: RowPredicateOptions): boolean;
 /** A conditional-formatting rule in any of the three historical shapes. */