@object-ui/core 17.5.0 → 17.7.0

package/dist/utils/without-denied-fields.js

@@ -0,0 +1,52 @@
+/**
+ * ObjectUI — the field-read rule for a single record
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * `record` as the viewer may READ it on `objectName`: every field the loaded
+ * `policy` denies is removed, which leaves the row ObjectStack's `FieldMasker`
+ * already serves (objectui#10594).
+ *
+ * The renderer-side field-level-security rulings (objectui#7215 /
+ * objectui#7230) say FLS gates the OUTPUT: a value the loaded policy denies is
+ * not drawn, even when a backend serves it. Every surface that builds a display
+ * value from a whole row (a record title, a lookup label, a search-hit label, a
+ * person's name) calls this one function, so a denied field reads as an absent
+ * field on every surface at once, and the display ladder falls through to its
+ * next source exactly as it does for the stripped row. Field-LIST filters (which
+ * columns to head, which relations to `$expand`) are a different shape and are
+ * not this function.
+ *
+ * - `id` and `_id` are never judged, nor is any key in `extraKeep` (a declared
+ *   id field): an id addresses the record and is not a field value the policy
+ *   withholds, and the `Record #<id>` floor reads it.
+ * - Before a policy loads, with no policy, with no object to judge the fields
+ *   against, or for a value that is not an object, `record` comes back as it
+ *   is.
+ * - When nothing is withheld, the SAME object comes back, so a caller can tell
+ *   "nothing withheld" from "something withheld" by identity and a cache keyed
+ *   on the served row keeps hitting.
+ *
+ * Pure: it reads `policy.checkField` and never writes to `record`.
+ */
+export function withoutDeniedFields(record, policy, objectName, extraKeep) {
+    if (!policy?.isLoaded || !objectName || !record || typeof record !== 'object')
+        return record;
+    const shown = {};
+    let withheld = false;
+    for (const [key, value] of Object.entries(record)) {
+        if (key === 'id' ||
+            key === '_id' ||
+            extraKeep?.includes(key) ||
+            policy.checkField(objectName, key, 'read')) {
+            shown[key] = value;
+        }
+        else {
+            withheld = true;
+        }
+    }
+    return withheld ? shown : record;
+}

package/dist/validation/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * @object-ui/core - Validation Module
  *
- * Phase 3.5: Validation engine
+ * Phase 3.5: Validation module
  *
  * Object-level validation. The rule vocabulary is owned by
  * `@objectstack/spec/data` and derived in `@object-ui/types`; canonicity is
@@ -9,10 +9,15 @@
  *
  * The object-level rule ENGINE (`validators/`) is @deprecated (#3110) — the
  * server is the single implementation of rule enforcement. Field/record SHAPE
- * validation (`schema-validator.js`, `validation-engine.js`) is unaffected: it
- * is client-side form validation, not a mirror of a server rule.
+ * validation (`schema-validator.js`) is unaffected: it is client-side form
+ * validation, not a mirror of a server rule.
+ *
+ * The field-rule engine that once sat beside it (`ValidationEngine`, a second
+ * snake_case rule vocabulary no renderer consumed) was retired under ADR-0049
+ * enforce-or-remove (objectui#7659). Client-side field rules are compiled by
+ * `buildValidationRules` in `@object-ui/fields`.
  */
 export * from './required-presence.js';
-export * from './validation-engine.js';
+export * from './server-owned-value.js';
 export * from './schema-validator.js';
 export * from './validators/index.js';

package/dist/validation/index.js

@@ -1,7 +1,7 @@
 /**
  * @object-ui/core - Validation Module
  *
- * Phase 3.5: Validation engine
+ * Phase 3.5: Validation module
  *
  * Object-level validation. The rule vocabulary is owned by
  * `@objectstack/spec/data` and derived in `@object-ui/types`; canonicity is
@@ -9,10 +9,15 @@
  *
  * The object-level rule ENGINE (`validators/`) is @deprecated (#3110) — the
  * server is the single implementation of rule enforcement. Field/record SHAPE
- * validation (`schema-validator.js`, `validation-engine.js`) is unaffected: it
- * is client-side form validation, not a mirror of a server rule.
+ * validation (`schema-validator.js`) is unaffected: it is client-side form
+ * validation, not a mirror of a server rule.
+ *
+ * The field-rule engine that once sat beside it (`ValidationEngine`, a second
+ * snake_case rule vocabulary no renderer consumed) was retired under ADR-0049
+ * enforce-or-remove (objectui#7659). Client-side field rules are compiled by
+ * `buildValidationRules` in `@object-ui/fields`.
  */
 export * from './required-presence.js';
-export * from './validation-engine.js';
+export * from './server-owned-value.js';
 export * from './schema-validator.js';
 export * from './validators/index.js';

package/dist/validation/schema-validator.d.ts

@@ -69,7 +69,7 @@ export interface SchemaNodeValidationResult {
  * }
  * ```
  */
-export declare function validateSchema(schema: any, path?: string): SchemaNodeValidationResult;
+export declare function validateSchema(schema: unknown, path?: string): SchemaNodeValidationResult;
 /**
  * Assert that a schema is valid, throwing an error if not
  *

package/dist/validation/schema-validator.js

@@ -5,6 +5,82 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  */
+import { hasDeclaredPredicate } from '../evaluator/declaredPredicate.js';
+import { isUnevaluablePredicate } from '../evaluator/unevaluablePredicate.js';
+/**
+ * The rule for a PREDICATE GATE key (`visible` / `disabled`) — objectui#6505.
+ *
+ * ## What this rule used to say, and what it cost
+ *
+ * Both keys read `typeof value === 'boolean'`, message `"<key> must be a
+ * boolean"`. Both keys are EXPRESSIONS everywhere else in the system: AGENTS.md
+ * §4 declares the protocol as `hidden?: string; // expression` /
+ * `disabled?: string; // expression`, `SchemaRenderer` evaluates them through
+ * `hasDeclaredPredicate` + `evaluateCondition`, `@objectstack/spec` normalizes
+ * every authored predicate into a `{ dialect, source }` envelope, and the
+ * objectui#3862 / objectui#3955 rulings are entirely about which EXPRESSION
+ * spellings count as declared. So the node the docs teach —
+ * `{ type: 'button', disabled: "${record.stage == 'closed'}" }` — was reported
+ * `disabled must be a boolean` by the dev-mode validator and its host element
+ * got `data-obj-schema-invalid`, the cue apps hang a red outline off.
+ *
+ * `BASE_SCHEMA_RULES` was the ONE place in the repo that disagreed with the
+ * protocol, so this restores declared = enforced rather than widening a
+ * contract: the accept set moves to exactly what the runtime already accepts.
+ *
+ * ## Why `hasDeclaredPredicate` and not a check written here
+ *
+ * `evaluator/declaredPredicate.ts` is the repo's single definition of "is a
+ * predicate gate DECLARED on this value?" (objectui#3850's ruling; nothing in
+ * the repo asks that question anywhere else). A second, hand-rolled answer in
+ * this table is how the validator and the renderer come to disagree about the
+ * same value — which is the defect class this rule was already an instance of.
+ * The delegation is behavioural, so it is pinned behaviourally: the drift pin in
+ * `__tests__/predicate-valued-gate-rules.test.ts` asserts this rule's verdict
+ * equals `boolean || (declared && !unevaluable)` across every probe — the second
+ * half since objectui#11358, see below.
+ *
+ * ## Why the boolean arm survives even though it is subsumed
+ *
+ * `hasDeclaredPredicate(true)` and `hasDeclaredPredicate(false)` are both
+ * `true` today (`toPredicateInput` returns a boolean unchanged), so the first
+ * arm changes no verdict. It is kept because it makes this rule's accept set a
+ * provable SUPERSET of the one it replaces, locally: a future narrowing on the
+ * declaredness side cannot silently start reporting `disabled: false` — the
+ * most explicit gate an author can write — as an invalid schema.
+ *
+ * ## What it still REFUSES (the half that is not negotiable)
+ *
+ * `null`, `''`, whitespace-only predicate text and the empty / blank-`source`
+ * envelope (objectui#3960) — what `hasDeclaredPredicate` calls "not declared" —
+ * and a value that IS declared but cannot be evaluated: a number, `{}`, an
+ * array, an envelope with no string `source` (`isUnevaluablePredicate`).
+ * Every one of those was refused before this change too — the accept set
+ * widens and nothing refused becomes accepted. Dropping the two keys from this
+ * table was the option this fix was explicitly forbidden to take: an absent
+ * rule reports nothing at all, which is gate weakening wearing the same green.
+ *
+ * ## Why "declared" alone stopped being this rule's answer (objectui#11358)
+ *
+ * Until objectui#11358 every declared gate was also an evaluable one, so
+ * "declared" answered both questions. That ruling made a present value with no
+ * evaluable `source` DECLARED (and faulting) so that the runtime fails it in
+ * its key's fault direction instead of reading it as no gate — and this rule
+ * asks a different question, "is this a predicate the runtime can evaluate?".
+ * Reading `hasDeclaredPredicate` alone would have widened the accept set to
+ * exactly the shapes that ruling exists to stop. So the rule refuses the
+ * unevaluable state by the same internal definition the runtime uses for it,
+ * not by a list written here.
+ */
+function predicateGateRule(key) {
+    return {
+        required: false,
+        validate: (value) => typeof value === 'boolean' || (!isUnevaluablePredicate(value) && hasDeclaredPredicate(value)),
+        message: `${key} must be a boolean or a declared predicate: an expression string ` +
+            `(bare, e.g. "record.stage == 'closed'", or the "\${...}" template ` +
+            `spelling), or a { dialect, source } expression envelope`,
+    };
+}
 /**
  * Validation rules for base schema
  */
@@ -24,31 +100,39 @@ const BASE_SCHEMA_RULES = {
         validate: (value) => typeof value === 'string',
         message: 'className must be a string'
     },
-    visible: {
-        required: false,
-        validate: (value) => typeof value === 'boolean',
-        message: 'visible must be a boolean'
-    },
-    disabled: {
-        required: false,
-        validate: (value) => typeof value === 'boolean',
-        message: 'disabled must be a boolean'
-    }
+    // objectui#6505 — both keys are EXPRESSIONS in the protocol, not booleans.
+    // See `predicateGateRule` above for the accept set and what it still refuses.
+    visible: predicateGateRule('visible'),
+    disabled: predicateGateRule('disabled')
 };
+/**
+ * The ONE narrowing between {@link validateSchema}'s `unknown` parameter and
+ * every rule below it (objectui#8416).
+ *
+ * The VERDICT is the guard this replaces, spelled the same way: the
+ * `!schema || typeof schema !== 'object'` test that used to sit at the top of
+ * `validateBaseSchema`. `null`, `undefined` and every primitive are refused;
+ * arrays and plain objects pass, exactly as before.
+ *
+ * What changes is WHERE it runs. Only ONE of the four rules ever had it, and
+ * `validateSchema` calls all four unconditionally: `validateFormSchema` read
+ * `schema.type` and `validateChildren` read `schema.children` with no guard at
+ * all, so `validateSchema(null)` and `validateSchema(undefined)` threw a raw
+ * `TypeError: Cannot read properties of null (reading 'type')` — measured on
+ * 256c709e2 — instead of returning the `INVALID_SCHEMA` result this function's
+ * own contract promises, and `isValidSchema(null)` threw instead of answering
+ * `false`. `SchemaRenderer` wraps its call in a `try`/`catch` whose comment
+ * reads "Validator itself failed — surface but don't crash render"; that catch
+ * is where the crash was landing.
+ */
+function isSchemaNodeShape(value) {
+    return !!value && typeof value === 'object';
+}
 /**
  * Validate a schema against base rules
  */
 function validateBaseSchema(schema, path = 'schema') {
     const errors = [];
-    if (!schema || typeof schema !== 'object') {
-        errors.push({
-            path,
-            message: 'Schema must be an object',
-            type: 'error',
-            code: 'INVALID_SCHEMA'
-        });
-        return errors;
-    }
     // Validate required and optional properties
     Object.entries(BASE_SCHEMA_RULES).forEach(([key, rule]) => {
         const value = schema[key];
@@ -72,56 +156,165 @@ function validateBaseSchema(schema, path = 'schema') {
     return errors;
 }
 /**
- * Validate CRUD schema specific properties
+ * TOMBSTONE table — node `type` spellings this renderer has RETIRED, mapped to
+ * the prescription an author must follow instead (ADR-0049 enforce-or-remove).
+ *
+ * A retired spelling is not merely absent from this file. Absence here means
+ * {@link validateSchema} runs `validateBaseSchema` — which only asks that
+ * `type` be a non-empty string — finds nothing type-specific to say, and
+ * returns `valid: true`. That silence is the failure mode this table exists to
+ * prevent: the author is told their schema is fine and then gets the OBJUI-001
+ * "Unknown component type" panel at render time, one layer too late to act on.
+ * So a retired spelling is refused BY NAME, with the migration in the message.
+ *
+ * `crud` (objectui#5373, maintainer ruling of 2026-08-20): `CRUDSchema` carried
+ * FOUR declaration faces — the TS interface, the zod mirror, a dedicated branch
+ * in this very function, and `CRUDBuilder` — and never once had a registered
+ * renderer, for the whole life of the key. Every face taught an author (and an
+ * AI author reading the published reference page) that the type existed. The
+ * branch that used to sit here is what made this validator the loudest of the
+ * four lies: it read `schema.type === 'crud'`, checked that `columns` was an
+ * array, and returned no error — an affirmative "your CRUD schema is valid"
+ * for a node that renders nothing.
+ *
+ * Keyed by the authored spelling, and quantified over the table rather than
+ * written per spelling, so the next retirement closes this face the day it
+ * lands here.
  */
-function validateCRUDSchema(schema, path = 'schema') {
-    const errors = [];
-    if (schema.type === 'crud') {
-        // Check required properties for CRUD
-        if (!schema.columns || !Array.isArray(schema.columns)) {
-            errors.push({
-                path: `${path}.columns`,
-                message: 'CRUD schema requires columns array',
-                type: 'error',
-                code: 'MISSING_COLUMNS'
-            });
-        }
-        if (!schema.api && !schema.dataSource) {
-            errors.push({
-                path: `${path}.api`,
-                message: 'CRUD schema requires api or dataSource',
-                type: 'warning',
-                code: 'MISSING_DATA_SOURCE'
-            });
-        }
-        // Validate columns
-        if (schema.columns && Array.isArray(schema.columns)) {
-            schema.columns.forEach((column, index) => {
-                if (!column.name) {
-                    errors.push({
-                        path: `${path}.columns[${index}]`,
-                        message: 'Column requires name property',
-                        type: 'error',
-                        code: 'MISSING_COLUMN_NAME'
-                    });
-                }
-            });
-        }
-        // Validate fields if present
-        if (schema.fields && Array.isArray(schema.fields)) {
-            schema.fields.forEach((field, index) => {
-                if (!field.name) {
-                    errors.push({
-                        path: `${path}.fields[${index}]`,
-                        message: 'Field requires name property',
-                        type: 'error',
-                        code: 'MISSING_FIELD_NAME'
-                    });
-                }
-            });
-        }
-    }
-    return errors;
+const RETIRED_NODE_TYPES = Object.freeze({
+    crud: "Node type `crud` was RETIRED (objectui#5373, ADR-0049 enforce-or-remove). " +
+        "`CRUDSchema` declared it in four places and no renderer ever registered it, " +
+        "so a node spelling it painted the OBJUI-001 \"Unknown component type\" panel. " +
+        "Compose the shapes that DO render instead: `object-grid` for the record " +
+        "table with its toolbar, filters, pagination and row/batch actions, " +
+        "`object-form` for the create/edit form, and `detail` for the record view.",
+});
+/**
+ * Refuse a retired node-type spelling by name.
+ *
+ * Severity is `error`, not `warning`, and that is the whole point of the
+ * retirement: a warning leaves `result.valid === true`, so `assertValidSchema`
+ * would still not throw and `isValidSchema` would still answer `true` — the
+ * same silence, one console line louder.
+ *
+ * `hasOwnProperty` rather than a plain index read: a `type` of `'constructor'`
+ * or `'toString'` reaches `Object.prototype` and would answer truthy.
+ *
+ * Reached for every node in the tree, not just the root — {@link validateSchema}
+ * is what `validateChildren` recurses with, so a retired spelling nested inside
+ * a `children` array is refused with its own path.
+ */
+function validateRetiredNodeType(schema, path = 'schema') {
+    const type = schema.type;
+    if (typeof type !== 'string')
+        return [];
+    if (!Object.prototype.hasOwnProperty.call(RETIRED_NODE_TYPES, type))
+        return [];
+    return [{
+            path: `${path}.type`,
+            message: RETIRED_NODE_TYPES[type],
+            type: 'error',
+            code: 'RETIRED_TYPE'
+        }];
+}
+/**
+ * The ONE namespace a form field's widget id may name — objectui#5254,
+ * maintainer ruling of 2026-08-19.
+ *
+ * A form field's `type` either names a `field:`-namespaced widget or takes the
+ * renderer's declared `default` input branch. It never resolves a plain SDUI
+ * node renderer: `renderFieldComponent` (`@object-ui/components`) resolves a
+ * colon-qualified id ONLY under this prefix, and `resolveFieldLabelling` /
+ * `resolvesToRegisteredFieldWidget` there mirror it exactly.
+ */
+const FIELD_WIDGET_NAMESPACE = 'field:';
+/**
+ * The widget id a form field will actually be RENDERED as.
+ *
+ * Mirrors the renderer's own precedence (`resolvedType` in
+ * `packages/components/src/renderers/form/form.tsx`: explicit form-config
+ * `widget`, then the resolved field metadata's widget hint, then the bare
+ * `type`). Only the two keys an AUTHORED schema carries are read here —
+ * `field.field?.widget` is a resolved metadata OBJECT that a hand-authored
+ * standalone `FormSchema` does not have.
+ *
+ * The mirroring is the point, not a convenience: validator and renderer must
+ * not be able to disagree about which component will actually render, which is
+ * the same discipline `resolveFieldLabelling` states on the renderer side.
+ */
+function resolveAuthoredFieldWidgetId(field) {
+    const id = field.widget ?? field.type;
+    return typeof id === 'string' ? id : undefined;
+}
+/**
+ * A form field's widget id names a namespace that resolves NO field widget —
+ * objectui#5375, maintainer ruling of 2026-08-20 (option C, the primary).
+ *
+ * ## What this refuses, and why it is an error rather than a warning
+ *
+ * Measured on `main` at f2e11ae6f, the real `form` renderer on the built-in
+ * path (no `registerAllFields()`):
+ *
+ *   type            registry hit   rendered type
+ *   ui:password     TRUE           text
+ *   secret          false          text
+ *   field:secret    false          text
+ *
+ * `ui:password` **is** registered — as an SDUI node renderer for a top-level
+ * `{ type: 'email' }`-style node — so an author who checks whether it resolves
+ * gets a YES, and still gets a clear-text box on the field path. That is the
+ * shape where verifying does not protect you, and it is why the class, not
+ * another entry in a renderer-side table, is what gets closed here: the table
+ * fix answers today's spellings and leaves the next invented id to find the
+ * same silent degrade. AI-authored metadata invents plausible-looking widget
+ * ids constantly; this makes inventing one an ERROR at authoring time instead
+ * of a text box that looks like it worked.
+ *
+ * A warning was explicitly ruled out — a warning IS the silent degrade this
+ * check exists to kill, in a new spelling.
+ *
+ * ## Why only the NAMESPACED spelling
+ *
+ * `field:` is allowed whether or not the widget is registered: registration is
+ * a RUNTIME fact (`registerAllFields()`, a lazily loaded plugin) that an
+ * authoring-time validator cannot see, and the renderer already answers an
+ * unregistered `field:` secret with a visible refusal (objectui#5322). A BARE
+ * name is likewise allowed: it is an open set — every registered `field:<name>`
+ * widget, third-party ones included, is reachable by its short name.
+ *
+ * What is decidable statically is the namespace, and it is a CLOSED set of one.
+ * Any other `<ns>:<name>` resolves nothing on the field path by the #5254
+ * ruling and falls to the renderer's plain-text `default` arm.
+ *
+ * ## Census (the ruling made arming this conditional on one)
+ *
+ * 4,397 authored files in this repo, 649 form-field `type`/`widget` literals,
+ * 98 structurally parsed form-field entries in `examples/schema-catalog`:
+ * SEVEN colon-qualified ids on the form-field path, five of them `field:*`.
+ * The two remaining occurrences are one source line naming `ref:component`,
+ * which is a metadata-admin designer `SchemaForm` widget resolved by its own
+ * `WIDGETS` table — a different shape (`{ field, widget }` under
+ * `sections[].fields[]`, node type `simple`) that this function, gated on
+ * `type === 'form'`, never reaches. Zero occurrences of `ui:password`,
+ * `secret` or `field:secret` anywhere on the field path.
+ */
+function validateFieldWidgetNamespace(field, path) {
+    const id = resolveAuthoredFieldWidgetId(field);
+    if (!id || !id.includes(':') || id.startsWith(FIELD_WIDGET_NAMESPACE))
+        return undefined;
+    const key = typeof field.widget === 'string' ? 'widget' : 'type';
+    return {
+        path: `${path}.${key}`,
+        message: `'${id}' is not a form field widget: a namespaced field widget id must name the ` +
+            `\`field:\` namespace (objectui#5254), so this id resolves NOTHING on the field path ` +
+            `and the renderer would fall through to a plain text box — putting a secret on screen ` +
+            `in clear text when the field holds one (objectui#5375). Write the built-in spelling ` +
+            `(e.g. \`password\`), or the field widget id \`field:${id.slice(id.indexOf(':') + 1)}\`. ` +
+            `Resolving in the registry is not proof it resolves HERE — \`ui:password\` is a ` +
+            `registered SDUI node renderer and still renders clear text as a field.`,
+        type: 'error',
+        code: 'UNRESOLVABLE_FIELD_WIDGET_NAMESPACE',
+    };
 }
 /**
  * Validate form schema specific properties
@@ -129,8 +322,15 @@ function validateCRUDSchema(schema, path = 'schema') {
 function validateFormSchema(schema, path = 'schema') {
     const errors = [];
     if (schema.type === 'form') {
-        if (schema.fields && Array.isArray(schema.fields)) {
-            schema.fields.forEach((field, index) => {
+        const fields = schema.fields;
+        if (Array.isArray(fields)) {
+            fields.forEach((entry, index) => {
+                // Narrowed before it is read, for the same reason the root is: a
+                // `fields` array is authored data too, and reading `field.name` off
+                // whatever an author put there made `fields: [null]` throw the same raw
+                // `TypeError` a `null` root did. A non-object entry keeps its old
+                // verdict — every key reads `undefined`, so `MISSING_FIELD_NAME`.
+                const field = isSchemaNodeShape(entry) ? entry : {};
                 if (!field.name) {
                     errors.push({
                         path: `${path}.fields[${index}]`,
@@ -139,12 +339,18 @@ function validateFormSchema(schema, path = 'schema') {
                         code: 'MISSING_FIELD_NAME'
                     });
                 }
+                // objectui#5375 — an invented namespaced widget id is an ERROR here,
+                // not a silent clear-text box at render time. See the helper's doc.
+                const namespaceError = validateFieldWidgetNamespace(field, `${path}.fields[${index}]`);
+                if (namespaceError) {
+                    errors.push(namespaceError);
+                }
                 // Check for duplicate field names
-                const duplicates = schema.fields.filter((f) => f.name === field.name);
+                const duplicates = fields.filter((other) => (isSchemaNodeShape(other) ? other.name : undefined) === field.name);
                 if (duplicates.length > 1) {
                     errors.push({
                         path: `${path}.fields[${index}]`,
-                        message: `Duplicate field name: ${field.name}`,
+                        message: `Duplicate field name: ${String(field.name)}`,
                         type: 'warning',
                         code: 'DUPLICATE_FIELD_NAME'
                     });
@@ -159,17 +365,21 @@ function validateFormSchema(schema, path = 'schema') {
  */
 function validateChildren(schema, path = 'schema') {
     const errors = [];
-    const children = schema.children || schema.body;
+    // One spelling. This walker resolved `children || body` for ANY node type,
+    // so it outlived every per-registration read of the dialect — objectui#6771
+    // retired it, and a recursive validator that still descended `body` would
+    // keep validating a child list no renderer puts on the page.
+    const children = schema.children;
     if (children) {
         if (Array.isArray(children)) {
             children.forEach((child, index) => {
-                if (typeof child === 'object' && child !== null) {
+                if (isSchemaNodeShape(child)) {
                     const childResult = validateSchema(child, `${path}.children[${index}]`);
                     errors.push(...childResult.errors, ...childResult.warnings);
                 }
             });
         }
-        else if (typeof children === 'object' && children !== null) {
+        else if (isSchemaNodeShape(children)) {
             const childResult = validateSchema(children, `${path}.children`);
             errors.push(...childResult.errors, ...childResult.warnings);
         }
@@ -199,13 +409,26 @@ function validateChildren(schema, path = 'schema') {
  */
 export function validateSchema(schema, path = 'schema') {
     const allErrors = [];
-    // Validate base schema
-    allErrors.push(...validateBaseSchema(schema, path));
-    // Validate type-specific schemas
-    allErrors.push(...validateCRUDSchema(schema, path));
-    allErrors.push(...validateFormSchema(schema, path));
-    // Validate children recursively
-    allErrors.push(...validateChildren(schema, path));
+    // Narrow ONCE, here, before any rule reads a key off the value — see
+    // `isSchemaNodeShape`. Every rule below is handed a value already proven to
+    // be an object, which is why none of them re-tests it.
+    if (!isSchemaNodeShape(schema)) {
+        allErrors.push({
+            path,
+            message: 'Schema must be an object',
+            type: 'error',
+            code: 'INVALID_SCHEMA'
+        });
+    }
+    else {
+        // Validate base schema
+        allErrors.push(...validateBaseSchema(schema, path));
+        // Validate type-specific schemas
+        allErrors.push(...validateRetiredNodeType(schema, path));
+        allErrors.push(...validateFormSchema(schema, path));
+        // Validate children recursively
+        allErrors.push(...validateChildren(schema, path));
+    }
     const errors = allErrors.filter(e => e.type === 'error');
     const warnings = allErrors.filter(e => e.type === 'warning');
     return {

package/dist/validation/server-owned-value.d.ts

@@ -0,0 +1,62 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Is this declared `defaultValue` a RUNTIME INSTRUCTION the server resolves per
+ * insert, rather than a literal value?
+ *
+ * True for the `DEFAULT_VALUE_TOKENS` family (`'NOW()'` / `'current_user'`) and
+ * for CEL/template Expression envelopes. This is THE classifier for "the
+ * producer owns this field's create value", and every consumer reads THIS one
+ * — a second copy would be free to disagree about, say, a CEL envelope, and
+ * then a form would seed a field it also refuses to submit. Today's consumers:
+ *
+ *   1. seeding (#4047 / #4068) — such a default is not seeded, because putting
+ *      the literal text `NOW()` into a datetime input and submitting it
+ *      suppresses the very resolution the declaration asked for;
+ *   2. the create-mode static `required` rule (#4069) —
+ *      `isRequiredInForm` in `@object-ui/plugin-form`;
+ *   3. the create-mode `requiredWhen` rule (#4085) —
+ *      {@link isServerOwnedValue}, read by `resolveFieldRuleState`.
+ */
+export declare function isRuntimeDefault(v: unknown): boolean;
+/**
+ * A runtime `FormField` as far as this module is concerned: the resolved
+ * object-field metadata stash, and whatever else the field carries.
+ *
+ * Stated structurally rather than as `@object-ui/types`' `FormField` so the
+ * one key this module reads is visible in the signature — and with an index
+ * signature so a caller (or a test) may hand over an object literal carrying
+ * the rest of the field without tripping TypeScript's excess-property check.
+ */
+export interface FieldWithDeclaredDefault {
+    field?: {
+        defaultValue?: unknown;
+    } | null;
+    [key: string]: unknown;
+}
+/**
+ * Does the PRODUCER supply this field's value for the submit this form is
+ * about to make? (#4085)
+ *
+ * The single derivation of that fact, so the three call sites that feed
+ * `resolveFieldRuleState` cannot each answer "where does the declared default
+ * live" differently. It reads the runtime FormField's `field` slot — the
+ * resolved object-field metadata the object-bound builders stash there
+ * (`ObjectForm`, `sectionFields`, and the containers' no-sections paths), and
+ * the only spelling of a declared `defaultValue` that reaches the renderer.
+ * A hand-authored FormField carries no object metadata, so it is never
+ * server-owned and its rules are untouched.
+ *
+ * `isCreateForm` is the CALLER's fact, never inferred here: the form renderer
+ * reads it off `FormSchema.previousValues` (whose absence *is* the declared
+ * "this is an insert" signal, objectui#3484), while the wizard's step gate
+ * reads its own `mode`. An evaluator guessing from a `previous` argument would
+ * call an edit-mode caller that simply passes no `previous` a create form, and
+ * silently drop a `requiredWhen` the author meant to enforce.
+ */
+export declare function isServerOwnedValue(field: FieldWithDeclaredDefault | null | undefined, isCreateForm: boolean): boolean;