@object-ui/core 17.5.0 → 17.7.0

package/dist/validation/server-owned-value.js

@@ -0,0 +1,99 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * The ONE client-side answer to "is this field's value the PRODUCER's to
+ * supply?" — the other half of {@link isMissingForRequired}.
+ *
+ * A `required` verdict is a question about two facts: is the value absent
+ * (`required-presence.ts`), and was the client ever supposed to provide it.
+ * This module owns the second one. Both live here in `@object-ui/core` because
+ * every layer that decides required-ness reads them: the form renderer
+ * (`resolveFieldRuleState`), the wizard's cross-step gate, and the
+ * create-form field builders in `@object-ui/plugin-form`.
+ *
+ * ## What makes a value server-owned
+ *
+ * A `defaultValue` may be a literal, or an *instruction* the server resolves
+ * per insert:
+ *
+ *   - a runtime token — `'NOW()'` / `'current_user'`, the whole
+ *     `DEFAULT_VALUE_TOKENS` family from `@objectstack/spec/data`
+ *   - a CEL Expression envelope — `{ dialect: 'cel', source: 'today()' }`
+ *
+ * A CREATE form deliberately leaves such a control EMPTY and omits the key
+ * from the payload, because `ObjectQL.applyFieldDefaults` resolves a declared
+ * default only for a field that arrives absent or null (#4047 / #4068). The
+ * field is therefore not "missing" on that submit — it is server-owned, and
+ * nothing the client evaluates may declare it required (#4069 / #4085).
+ *
+ * ## Create only
+ *
+ * On an EDIT form the token was already resolved at insert. The control shows
+ * a persisted value, so blanking it is a real removal and `required` (static
+ * or conditional) enforces normally.
+ */
+import { isRuntimeDefaultToken } from '@objectstack/spec/data';
+/**
+ * Is `v` a CEL/template Expression envelope rather than a literal value?
+ *
+ * Same shape test the engine applies before handing a default to
+ * `ExpressionEngine` (`{ dialect, source }`), kept structural on purpose: the
+ * point is "the server evaluates this", which is true for every dialect.
+ */
+function isExpressionEnvelope(v) {
+    return (typeof v === 'object' &&
+        v !== null &&
+        typeof v.dialect === 'string' &&
+        typeof v.source === 'string');
+}
+/**
+ * Is this declared `defaultValue` a RUNTIME INSTRUCTION the server resolves per
+ * insert, rather than a literal value?
+ *
+ * True for the `DEFAULT_VALUE_TOKENS` family (`'NOW()'` / `'current_user'`) and
+ * for CEL/template Expression envelopes. This is THE classifier for "the
+ * producer owns this field's create value", and every consumer reads THIS one
+ * — a second copy would be free to disagree about, say, a CEL envelope, and
+ * then a form would seed a field it also refuses to submit. Today's consumers:
+ *
+ *   1. seeding (#4047 / #4068) — such a default is not seeded, because putting
+ *      the literal text `NOW()` into a datetime input and submitting it
+ *      suppresses the very resolution the declaration asked for;
+ *   2. the create-mode static `required` rule (#4069) —
+ *      `isRequiredInForm` in `@object-ui/plugin-form`;
+ *   3. the create-mode `requiredWhen` rule (#4085) —
+ *      {@link isServerOwnedValue}, read by `resolveFieldRuleState`.
+ */
+export function isRuntimeDefault(v) {
+    return isRuntimeDefaultToken(v) || isExpressionEnvelope(v);
+}
+/**
+ * Does the PRODUCER supply this field's value for the submit this form is
+ * about to make? (#4085)
+ *
+ * The single derivation of that fact, so the three call sites that feed
+ * `resolveFieldRuleState` cannot each answer "where does the declared default
+ * live" differently. It reads the runtime FormField's `field` slot — the
+ * resolved object-field metadata the object-bound builders stash there
+ * (`ObjectForm`, `sectionFields`, and the containers' no-sections paths), and
+ * the only spelling of a declared `defaultValue` that reaches the renderer.
+ * A hand-authored FormField carries no object metadata, so it is never
+ * server-owned and its rules are untouched.
+ *
+ * `isCreateForm` is the CALLER's fact, never inferred here: the form renderer
+ * reads it off `FormSchema.previousValues` (whose absence *is* the declared
+ * "this is an insert" signal, objectui#3484), while the wizard's step gate
+ * reads its own `mode`. An evaluator guessing from a `previous` argument would
+ * call an edit-mode caller that simply passes no `previous` a create form, and
+ * silently drop a `requiredWhen` the author meant to enforce.
+ */
+export function isServerOwnedValue(field, isCreateForm) {
+    if (!isCreateForm)
+        return false;
+    return isRuntimeDefault(field?.field?.defaultValue);
+}

package/dist/validation/validators/object-validation-engine.d.ts

@@ -186,7 +186,7 @@ export declare class ObjectValidationEngine {
      *   - no `initialStates` declared        → allow (legacy no-op)
      *   - field absent from the write        → allow (requiredness is not our job)
      *   - value empty                        → allow (ditto)
-     *   - value ∉ initialStates              → reject (the FSM entry point, #3165)
+     *   - value ∉ initialStates              → reject (the FSM entry point, objectstack-ai/objectstack#3165)
      *
      *   UPDATE
      *   - field absent from the write        → allow (no transition to police)

package/dist/validation/validators/object-validation-engine.js

@@ -53,7 +53,15 @@ function priorityOf(rule) {
  * Simple expression evaluator using a simple parser (no dynamic code execution)
  *
  * SECURITY: This implementation parses expressions into an AST and evaluates them
- * without using eval() or new Function(). It supports:
+ * without using eval() or new Function(). That is a remediation, not a style
+ * preference: an earlier revision compiled the predicate with
+ * `new Function(...contextKeys, "'use strict'; return (" + expression + ")")`,
+ * and CodeQL flagged it as "Unsafe code constructed from library input" —
+ * expressions reach this class from validation metadata, so that shape is a
+ * code-injection vector in any consumer that renders metadata it does not
+ * control. Never reintroduce eval(), new Function() or any other dynamic-code
+ * path here to buy expressiveness or speed; extend the parser, or inject a
+ * richer evaluator through the constructor (see NOT CEL below). Supports:
  * - Comparison operators: ==, !=, >, <, >=, <=
  * - Logical operators: &&, ||, !
  * - Property access: record.field, record['field']
@@ -72,7 +80,10 @@ function priorityOf(rule) {
  * pre-check agree with the server on richer predicates, pass a CEL-backed
  * `ValidationExpressionEvaluator` to the constructor.
  *
- * @see https://github.com/objectstack-ai/objectui/blob/main/SECURITY_FIX_SUMMARY.md
+ * The write-up this block used to link to (`SECURITY_FIX_SUMMARY.md`) was
+ * deleted with no successor; its load-bearing reasoning is inline above, and
+ * the original text remains readable at
+ * `git show ea72f1886^:SECURITY_FIX_SUMMARY.md`.
  */
 class SimpleExpressionEvaluator {
     evaluate(expression, context) {
@@ -129,13 +140,11 @@ class SimpleExpressionEvaluator {
                     return leftVal === rightVal;
                 case '==':
                     // Use loose equality for backward compatibility with existing expressions
-                    // eslint-disable-next-line eqeqeq
                     return leftVal == rightVal;
                 case '!==':
                     return leftVal !== rightVal;
                 case '!=':
                     // Use loose inequality for backward compatibility with existing expressions
-                    // eslint-disable-next-line eqeqeq
                     return leftVal != rightVal;
                 case '>': return leftVal > rightVal;
                 case '<': return leftVal < rightVal;
@@ -386,7 +395,7 @@ export class ObjectValidationEngine {
      *   - no `initialStates` declared        → allow (legacy no-op)
      *   - field absent from the write        → allow (requiredness is not our job)
      *   - value empty                        → allow (ditto)
-     *   - value ∉ initialStates              → reject (the FSM entry point, #3165)
+     *   - value ∉ initialStates              → reject (the FSM entry point, objectstack-ai/objectstack#3165)
      *
      *   UPDATE
      *   - field absent from the write        → allow (no transition to police)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/core",
-  "version": "17.5.0",
+  "version": "17.7.0",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",
@@ -25,15 +25,14 @@
     }
   },
   "dependencies": {
-    "@objectstack/formula": "^17.0.0-rc.6",
-    "@objectstack/spec": "^17.0.0-rc.6",
-    "lodash": "^4.18.1",
-    "zod": "^4.4.3",
-    "@object-ui/types": "17.5.0"
+    "@objectstack/formula": "^17.5.0",
+    "@objectstack/spec": "^17.6.0",
+    "@object-ui/types": "17.7.0"
   },
   "devDependencies": {
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.10",
+    "@object-ui/test-support": "17.4.0"
   },
   "keywords": [
     "objectui",
@@ -60,8 +59,8 @@
     "LICENSE"
   ],
   "scripts": {
-    "build": "tsc",
-    "test": "vitest run",
+    "build": "tsc && node ../../scripts/check-dist-completeness.mjs",
+    "test": "vitest run --root ../.. packages/core/",
     "type-check": "tsc --noEmit && tsc -p tsconfig.test.json",
     "lint": "eslint ."
   }

package/dist/__benchmarks__/core.bench.d.ts

@@ -1,8 +0,0 @@
-/**
- * ObjectUI
- * Copyright (c) 2024-present ObjectStack Inc.
- *
- * This source code is licensed under the MIT license found in the
- * LICENSE file in the root directory of this source tree.
- */
-export {};

package/dist/__benchmarks__/core.bench.js

@@ -1,53 +0,0 @@
-/**
- * ObjectUI
- * Copyright (c) 2024-present ObjectStack Inc.
- *
- * This source code is licensed under the MIT license found in the
- * LICENSE file in the root directory of this source tree.
- */
-/**
- * Performance benchmark suite for @object-ui/core.
- *
- * Part of Q1 2026 roadmap §1.4 Test Coverage Improvement.
- *
- * Run with: npx vitest bench packages/core/src/__benchmarks__/
- */
-import { bench, describe } from 'vitest';
-import { ExpressionEvaluator } from '@object-ui/core';
-import { ComponentRegistry } from '@object-ui/core';
-import { contrastRatio, meetsContrastLevel, hexToHSL } from '@object-ui/core';
-describe('ExpressionEvaluator performance', () => {
-    const evaluator = new ExpressionEvaluator({ data: { name: 'Alice', age: 30, active: true } });
-    bench('evaluate simple string', () => {
-        evaluator.evaluate('Hello ${data.name}');
-    });
-    bench('evaluate 100 expressions', () => {
-        for (let i = 0; i < 100; i++) {
-            evaluator.evaluate('Hello ${data.name}');
-        }
-    });
-});
-describe('ComponentRegistry performance', () => {
-    bench('get registered component', () => {
-        ComponentRegistry.get('button');
-    });
-    bench('has check', () => {
-        ComponentRegistry.has('button');
-    });
-});
-describe('Theme utilities performance', () => {
-    bench('hexToHSL conversion', () => {
-        hexToHSL('#336699');
-    });
-    bench('contrastRatio calculation', () => {
-        contrastRatio('#000000', '#ffffff');
-    });
-    bench('meetsContrastLevel check', () => {
-        meetsContrastLevel('#000000', '#ffffff', 'AA');
-    });
-    bench('100 contrast checks', () => {
-        for (let i = 0; i < 100; i++) {
-            meetsContrastLevel('#336699', '#ffffff', 'AA');
-        }
-    });
-});

package/dist/data-scope/DataScopeManager.d.ts

@@ -1,127 +0,0 @@
-/**
- * ObjectUI
- * Copyright (c) 2024-present ObjectStack Inc.
- *
- * This source code is licensed under the MIT license found in the
- * LICENSE file in the root directory of this source tree.
- */
-/**
- * @object-ui/core - DataScope Manager
- *
- * Runtime implementation of the DataContext interface for managing
- * named data scopes. Provides row-level data access control and
- * reactive data state management within the UI component tree.
- *
- * @module data-scope
- * @packageDocumentation
- */
-import type { DataScope, DataContext, DataSource } from '@object-ui/types';
-/**
- * Row-level filter for restricting data access within a scope
- */
-export interface RowLevelFilter {
-    /** Field to filter on */
-    field: string;
-    /** Filter operator */
-    operator: 'eq' | 'ne' | 'gt' | 'lt' | 'gte' | 'lte' | 'in' | 'nin' | 'contains';
-    /** Filter value */
-    value: any;
-}
-/**
- * Configuration for creating a data scope
- */
-export interface DataScopeConfig {
-    /** Data source instance */
-    dataSource?: DataSource;
-    /** Initial data */
-    data?: any;
-    /** Row-level filters to apply */
-    filters?: RowLevelFilter[];
-    /** Whether this scope is read-only */
-    readOnly?: boolean;
-}
-/**
- * DataScopeManager — Runtime implementation of DataContext.
- *
- * Manages named data scopes for the component tree, providing:
- * - Scope registration and lookup
- * - Row-level security via filters
- * - Data state management (data, loading, error)
- *
- * @example
- * ```ts
- * const manager = new DataScopeManager();
- * manager.registerScope('contacts', {
- *   dataSource: myDataSource,
- *   data: [],
- * });
- * const scope = manager.getScope('contacts');
- * ```
- */
-export declare class DataScopeManager implements DataContext {
-    scopes: Record<string, DataScope>;
-    private filters;
-    private readOnlyScopes;
-    private listeners;
-    /**
-     * Register a data scope
-     */
-    registerScope(name: string, scope: DataScope): void;
-    /**
-     * Register a data scope with configuration
-     */
-    registerScopeWithConfig(name: string, config: DataScopeConfig): void;
-    /**
-     * Get a data scope by name
-     */
-    getScope(name: string): DataScope | undefined;
-    /**
-     * Remove a data scope
-     */
-    removeScope(name: string): void;
-    /**
-     * Check if a scope is read-only
-     */
-    isReadOnly(name: string): boolean;
-    /**
-     * Get row-level filters for a scope
-     */
-    getFilters(name: string): RowLevelFilter[];
-    /**
-     * Set row-level filters for a scope
-     */
-    setFilters(name: string, filters: RowLevelFilter[]): void;
-    /**
-     * Apply row-level filters to a dataset
-     */
-    applyFilters(name: string, data: any[]): any[];
-    /**
-     * Update data in a scope
-     */
-    updateScopeData(name: string, data: any): void;
-    /**
-     * Update loading state for a scope
-     */
-    updateScopeLoading(name: string, loading: boolean): void;
-    /**
-     * Update error state for a scope
-     */
-    updateScopeError(name: string, error: Error | string | null): void;
-    /**
-     * Subscribe to scope changes
-     */
-    onScopeChange(name: string, listener: (scope: DataScope) => void): () => void;
-    /**
-     * Get all registered scope names
-     */
-    getScopeNames(): string[];
-    /**
-     * Clear all scopes
-     */
-    clear(): void;
-    private notifyListeners;
-}
-/**
- * Default DataScopeManager instance
- */
-export declare const defaultDataScopeManager: DataScopeManager;

package/dist/data-scope/DataScopeManager.js

@@ -1,229 +0,0 @@
-/**
- * ObjectUI
- * Copyright (c) 2024-present ObjectStack Inc.
- *
- * This source code is licensed under the MIT license found in the
- * LICENSE file in the root directory of this source tree.
- */
-/**
- * DataScopeManager — Runtime implementation of DataContext.
- *
- * Manages named data scopes for the component tree, providing:
- * - Scope registration and lookup
- * - Row-level security via filters
- * - Data state management (data, loading, error)
- *
- * @example
- * ```ts
- * const manager = new DataScopeManager();
- * manager.registerScope('contacts', {
- *   dataSource: myDataSource,
- *   data: [],
- * });
- * const scope = manager.getScope('contacts');
- * ```
- */
-export class DataScopeManager {
-    constructor() {
-        Object.defineProperty(this, "scopes", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: {}
-        });
-        Object.defineProperty(this, "filters", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: {}
-        });
-        Object.defineProperty(this, "readOnlyScopes", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: new Set()
-        });
-        Object.defineProperty(this, "listeners", {
-            enumerable: true,
-            configurable: true,
-            writable: true,
-            value: new Map()
-        });
-    }
-    /**
-     * Register a data scope
-     */
-    registerScope(name, scope) {
-        this.scopes[name] = scope;
-        this.notifyListeners(name, scope);
-    }
-    /**
-     * Register a data scope with configuration
-     */
-    registerScopeWithConfig(name, config) {
-        const scope = {
-            dataSource: config.dataSource,
-            data: config.data,
-            loading: false,
-            error: null,
-        };
-        if (config.filters) {
-            this.filters[name] = config.filters;
-        }
-        if (config.readOnly) {
-            this.readOnlyScopes.add(name);
-        }
-        this.scopes[name] = scope;
-        this.notifyListeners(name, scope);
-    }
-    /**
-     * Get a data scope by name
-     */
-    getScope(name) {
-        return this.scopes[name];
-    }
-    /**
-     * Remove a data scope
-     */
-    removeScope(name) {
-        delete this.scopes[name];
-        delete this.filters[name];
-        this.readOnlyScopes.delete(name);
-        this.listeners.delete(name);
-    }
-    /**
-     * Check if a scope is read-only
-     */
-    isReadOnly(name) {
-        return this.readOnlyScopes.has(name);
-    }
-    /**
-     * Get row-level filters for a scope
-     */
-    getFilters(name) {
-        return this.filters[name] || [];
-    }
-    /**
-     * Set row-level filters for a scope
-     */
-    setFilters(name, filters) {
-        this.filters[name] = filters;
-    }
-    /**
-     * Apply row-level filters to a dataset
-     */
-    applyFilters(name, data) {
-        const scopeFilters = this.filters[name];
-        if (!scopeFilters || scopeFilters.length === 0) {
-            return data;
-        }
-        return data.filter(row => {
-            return scopeFilters.every(filter => {
-                const fieldValue = row[filter.field];
-                return evaluateFilter(fieldValue, filter.operator, filter.value);
-            });
-        });
-    }
-    /**
-     * Update data in a scope
-     */
-    updateScopeData(name, data) {
-        const scope = this.scopes[name];
-        if (!scope)
-            return;
-        if (this.readOnlyScopes.has(name)) {
-            throw new Error(`Cannot update read-only scope: ${name}`);
-        }
-        scope.data = data;
-        this.notifyListeners(name, scope);
-    }
-    /**
-     * Update loading state for a scope
-     */
-    updateScopeLoading(name, loading) {
-        const scope = this.scopes[name];
-        if (!scope)
-            return;
-        scope.loading = loading;
-        this.notifyListeners(name, scope);
-    }
-    /**
-     * Update error state for a scope
-     */
-    updateScopeError(name, error) {
-        const scope = this.scopes[name];
-        if (!scope)
-            return;
-        scope.error = error;
-        this.notifyListeners(name, scope);
-    }
-    /**
-     * Subscribe to scope changes
-     */
-    onScopeChange(name, listener) {
-        if (!this.listeners.has(name)) {
-            this.listeners.set(name, []);
-        }
-        this.listeners.get(name).push(listener);
-        return () => {
-            const arr = this.listeners.get(name);
-            if (arr) {
-                const idx = arr.indexOf(listener);
-                if (idx >= 0)
-                    arr.splice(idx, 1);
-            }
-        };
-    }
-    /**
-     * Get all registered scope names
-     */
-    getScopeNames() {
-        return Object.keys(this.scopes);
-    }
-    /**
-     * Clear all scopes
-     */
-    clear() {
-        this.scopes = {};
-        this.filters = {};
-        this.readOnlyScopes.clear();
-        this.listeners.clear();
-    }
-    notifyListeners(name, scope) {
-        const arr = this.listeners.get(name);
-        if (arr) {
-            arr.forEach(listener => listener(scope));
-        }
-    }
-}
-/**
- * Evaluate a single filter condition against a field value
- */
-function evaluateFilter(fieldValue, operator, filterValue) {
-    switch (operator) {
-        case 'eq':
-            return fieldValue === filterValue;
-        case 'ne':
-            return fieldValue !== filterValue;
-        case 'gt':
-            return fieldValue > filterValue;
-        case 'lt':
-            return fieldValue < filterValue;
-        case 'gte':
-            return fieldValue >= filterValue;
-        case 'lte':
-            return fieldValue <= filterValue;
-        case 'in':
-            return Array.isArray(filterValue) && filterValue.includes(fieldValue);
-        case 'nin':
-            return Array.isArray(filterValue) && !filterValue.includes(fieldValue);
-        case 'contains':
-            return typeof fieldValue === 'string' && fieldValue.includes(String(filterValue));
-        default:
-            return true;
-    }
-}
-/**
- * Default DataScopeManager instance
- */
-export const defaultDataScopeManager = new DataScopeManager();

package/dist/protocols/ResponsiveProtocol.d.ts

@@ -1,73 +0,0 @@
-/**
- * ObjectUI
- * Copyright (c) 2024-present ObjectStack Inc.
- *
- * This source code is licensed under the MIT license found in the
- * LICENSE file in the root directory of this source tree.
- */
-/**
- * @object-ui/core - Responsive Protocol Bridge
- *
- * Converts spec-aligned ResponsiveConfig schemas into Tailwind CSS
- * utility classes for visibility, grid columns, and ordering across
- * breakpoints. Also provides runtime width-based visibility checks.
- *
- * @module protocols/ResponsiveProtocol
- * @packageDocumentation
- */
-import type { SpecResponsiveConfig } from '@object-ui/types';
-/** Breakpoint name type matching Tailwind defaults. */
-export type BreakpointKey = 'xs' | 'sm' | 'md' | 'lg' | 'xl' | '2xl';
-/** Breakpoint minimum pixel widths aligned with Tailwind CSS defaults. */
-export declare const BREAKPOINT_VALUES: Record<BreakpointKey, number>;
-/** Fully resolved responsive configuration. */
-export interface ResolvedResponsiveConfig {
-    breakpoint?: BreakpointKey;
-    hiddenOn: BreakpointKey[];
-    columns: Partial<Record<BreakpointKey, number>>;
-    order: Partial<Record<BreakpointKey, number>>;
-}
-/**
- * Resolve a responsive configuration by applying defaults.
- *
- * @param config - SpecResponsiveConfig from the spec
- * @returns Fully resolved responsive configuration
- */
-export declare function resolveResponsiveConfig(config: SpecResponsiveConfig): ResolvedResponsiveConfig;
-/**
- * Generate Tailwind CSS classes for responsive visibility.
- *
- * If `breakpoint` is set, the element is hidden below that breakpoint
- * (e.g. breakpoint "md" → `['hidden', 'md:block']`).
- *
- * If `hiddenOn` contains breakpoints, the element is hidden at those
- * specific sizes (e.g. hiddenOn: ["sm", "lg"] → `['sm:hidden', 'md:block', 'lg:hidden', 'xl:block']`).
- *
- * @param config - SpecResponsiveConfig from the spec
- * @returns Array of Tailwind CSS class strings
- */
-export declare function getVisibilityClasses(config: SpecResponsiveConfig): string[];
-/**
- * Generate Tailwind grid-cols classes for responsive column layouts.
- *
- * @param config - SpecResponsiveConfig from the spec
- * @returns Array of Tailwind CSS grid column class strings
- */
-export declare function getColumnClasses(config: SpecResponsiveConfig): string[];
-/**
- * Generate Tailwind order utility classes for responsive ordering.
- *
- * @param config - SpecResponsiveConfig from the spec
- * @returns Array of Tailwind CSS order class strings
- */
-export declare function getOrderClasses(config: SpecResponsiveConfig): string[];
-/**
- * Determine whether a component should be hidden at a given viewport width.
- *
- * Checks both the minimum `breakpoint` threshold and the `hiddenOn` list.
- *
- * @param config - SpecResponsiveConfig from the spec
- * @param width - Current viewport width in pixels
- * @returns `true` if the component should be hidden at the given width
- */
-export declare function shouldHideAtBreakpoint(config: SpecResponsiveConfig, width: number): boolean;