@object-ui/core 17.6.0 → 17.7.0

package/dist/evaluator/optionRules.js

@@ -6,6 +6,7 @@
  * LICENSE file in the root directory of this source tree.
  */
 import { evalFieldPredicate } from './fieldRules.js';
+import { isEmptyValue } from '../utils/emptiness.js';
 /**
  * Normalize a field's `dependsOn` to the list of sibling field names it reacts
  * to. The lookup-only `{field,param}` form contributes just its `field`.
@@ -18,10 +19,12 @@ export function resolveDependsOnFields(dependsOn) {
         .map((d) => (typeof d === 'string' ? d : d && typeof d === 'object' ? d.field : null))
         .filter((f) => typeof f === 'string' && f.length > 0);
 }
-/** A value counts as "empty" (dependency unmet) when nullish, blank, or an empty array. */
-function isEmptyValue(v) {
-    return v === undefined || v === null || v === '' || (Array.isArray(v) && v.length === 0);
-}
+// A dependency counts as UNMET on exactly the shared floor — `null`,
+// `undefined`, the empty string, the empty array — and this module is where
+// those four members were first written down. objectui#8496 promoted them out
+// of here into `utils/emptiness.ts` (byte-for-byte the same four) so the four
+// other surfaces that had each re-spelled them could stop. No extension and no
+// declension: a gated option list asks the floor and nothing more.
 /**
  * True when at least one `dependsOn` field is empty in the record — the option
  * list is gated and the widget should prompt for the parent rather than show an
@@ -45,6 +48,71 @@ export function resolveVisibleOptions(options, record, scope) {
             context: `visibleWhen of option '${String(o.value)}'`,
         }));
 }
+/**
+ * The text an option widget SHOWS for one option: its `label`, or its `value`
+ * when the label is blank (`20b507aff`).
+ *
+ * ## Why a blank label reaches a renderer at all — it is a LEGAL document
+ *
+ * This is deliberately NOT the lenient renderer fallback AGENTS.md #0.1
+ * forbids. That rule governs metadata the contract REFUSES ("if the metadata
+ * is off-spec, fix it at the producer"); an empty label is metadata the
+ * contract ACCEPTS. Measured on the installed `@objectstack/spec` 17.6.0,
+ * `SelectOptionSchema`:
+ *
+ *   { value: 'low', label: 'Low' } -> ACCEPT   (lit control)
+ *   { value: 'low', label: '' }    -> ACCEPT   <- the key reading
+ *   { value: 'low' }               -> REJECT invalid_type at [label]
+ *
+ * `@object-ui/types` mirrors that reading in prose on `SelectOptionBase`:
+ * "An empty string is a valid label; an ABSENT one is not." So the producer
+ * is right to emit `label: ''` — the field designer's `patchOptions` does,
+ * under the ruling `f0f774b0d` landed, and a pin
+ * (`ObjectFieldInspector.optionLabel.test.tsx`) fails if it ever invents
+ * content to fill the hole instead. A document every layer calls legal has to
+ * render as something a person can click.
+ *
+ * ## What the contract does NOT say, and who had already answered it
+ *
+ * The spec states no display default for a legal-but-blank label, so nothing
+ * upstream decides this. objectui had nevertheless already decided it — on
+ * HALF its read sites. Measured across the four option widgets before this
+ * helper existed, with `{ value: 'low', label: '' }` authored and
+ * `{ value: 'high', label: 'High' }` beside it as the lit control:
+ *
+ *   | widget      | readonly path      | interactive path |
+ *   | select      | "low"              | ""               |
+ *   | multiselect | "low"              | ""               |
+ *   | radio       | "low"              | ""               |
+ *   | checkboxes  | "low"              | ""               |
+ *
+ * Four summary paths spelled `opt?.label || value` and fell back; the four
+ * interactive paths spelled `{opt.label}` and rendered nothing. So the same
+ * option read "low" in a read-only form and blank in the editable one — the
+ * bug was never "tolerate or refuse", it was a widget family disagreeing with
+ * itself, and the blank half is the one a person has to click.
+ *
+ * This function is that decision written ONCE, the same "one definition, N
+ * surfaces" move as {@link CASCADE_OPTION_WIDGET_TYPES} below. All eight sites
+ * call it, so the two halves cannot drift apart again.
+ *
+ * ## Boundaries
+ *
+ * - Blank means TRIM-empty, so a whitespace-only label falls back too: it is
+ *   the same invisible row to the person looking at it, and it is the
+ *   spelling the producer's own reader already uses to call an authored
+ *   `value` blank (`classifyOption`, `o.value.trim() === ''`).
+ * - `label` is typed required, but this reads defensively because renderers
+ *   are handed unvalidated runtime metadata: a non-string label must fall back
+ *   rather than throw where `{opt.label}` merely rendered nothing.
+ * - This changes DISPLAY only. It writes nothing, and it is not a licence to
+ *   author blank labels — whether the contract should refuse them outright is
+ *   a `packages/spec` question, not a renderer one.
+ */
+export function optionDisplayLabel(option) {
+    const { label } = option;
+    return typeof label === 'string' && label.trim() !== '' ? label : String(option.value);
+}
 /**
  * Whether a scalar field value is still valid given the currently-visible
  * options — used to decide a cascade clear (parent changed, child's old choice
@@ -112,12 +180,21 @@ export function resolveCascadingOptions(rawOptions, record, dependsOn, scope) {
  *
  * `dependentValues` is also the channel two widget-hint pickers read a specific
  * SIBLING KEY from (`filter-condition` reads `object_name`, `recipient-picker`
- * reads `recipient_type`), and the lookup family filters its query by it. All
- * three surfaces above agree today in NOT feeding those from action / bulk
- * dialog params, but that is a different wiring question from the one ruled
- * here and it has never been decided either way. Stated here so the three
- * copies of the statement become one — the boundary itself stays open:
- * objectui#4771.
+ * reads `recipient_type`), and the lookup family filters its query by it —
+ * neither of which is an option list, so ⛔ no member is ever added to THIS set
+ * to serve them. Each surface decides that separately, by OR-ing its own rule
+ * beside this one, and they do not agree:
+ *
+ * - the object form has fed both families all along — `needsDataSourceWiring`,
+ *   its own line beside the one that reads this set;
+ * - the single-record action dialog feeds the lookup family since
+ *   objectui#8672 ruling A — `paramNeedsDependentValues()`, same shape;
+ * - the bulk action dialog feeds neither, and nothing has ruled on it.
+ *
+ * ⇒ objectui#4771 is the open boundary for the widget-hint pickers everywhere,
+ * and for the lookup family on the bulk dialog. Stated here so the surfaces'
+ * copies of the statement become one; ⛔ do not read a member of this set as
+ * the answer to "does widget X get the record on surface Y".
  *
  * ## Normalization stays with the consumer
  *

package/dist/evaluator/predicateInput.d.ts

@@ -9,7 +9,9 @@
  * The normalized shape {@link ExpressionEvaluator.evaluateCondition} consumes:
  * a boolean (short-circuits), a `${…}` template string (legacy JS path), a
  * `{ dialect: 'cel', source }` envelope (canonical `@objectstack/formula`
- * path), or `undefined` for "no predicate declared".
+ * path), `undefined` for "no predicate declared", or a `cel` envelope with NO
+ * `source` for a gate that is declared but cannot be evaluated — which the
+ * evaluator treats as a fault, never as "absent" (objectui#11358).
  *
  * ## Why not `PredicateInput` (objectstack#4115 / objectui#3074)
  *
@@ -24,7 +26,8 @@
  * admits `boolean` and the `${…}` template spelling (neither of which the spec
  * models as a predicate), narrows `dialect` to `cel` alone (every other dialect
  * has already been flattened onto the legacy path by `toPredicateInput`),
- * requires a non-empty `source`, and carries no `ast` / `meta`. The two unions
+ * requires a non-empty `source` (or none at all, for the declared-but-
+ * unevaluable state), and carries no `ast` / `meta`. The two unions
  * are not mutually assignable in either direction.
  *
  * The rename is pinned from both sides by the tripwire in
@@ -36,6 +39,9 @@
 export type EvaluatorPredicateInput = string | boolean | {
     dialect: 'cel';
     source: string;
+} | {
+    readonly dialect: 'cel';
+    readonly source?: undefined;
 } | undefined;
 /**
  * Normalize a schema-supplied predicate (`visible` / `enabled` / `disabled` /
@@ -52,8 +58,13 @@ export type EvaluatorPredicateInput = string | boolean | {
  *     authored predicate, including bare strings) → a `cel` dialect keeps
  *     its envelope; every other dialect is unwrapped and wrapped as
  *     `${source}`.
- *   - `null` / `undefined` / empty / anything else → `undefined`
- *     (default visible/enabled).
+ *   - `null` / `undefined` / `''` / an envelope whose `source` is `''` →
+ *     `undefined` (absent: default visible/enabled).
+ *   - anything else that is present — an envelope with no string `source`
+ *     (`{ dialect: 'cel', ast }`), a number, `{}`, an array → the frozen
+ *     `{ dialect: 'cel' }` with no `source`: declared, and a FAULT to the
+ *     evaluator (objectui#11358 — see `DECLARED_UNEVALUABLE` above). This used
+ *     to fold into `undefined` with the absent shapes.
  *
  * ## Why the `cel` envelope must survive normalization (#2661 / #3314)
  *

package/dist/evaluator/predicateInput.js

@@ -5,6 +5,28 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  */
+import { isUnevaluablePredicate } from './unevaluablePredicate.js';
+/**
+ * The normalized answer for a gate that is DECLARED but has nothing the client
+ * can evaluate (objectui#11358) — the fourth member of
+ * {@link EvaluatorPredicateInput}, a `cel` envelope with no `source`.
+ *
+ * It exists so the normalizer can tell three states apart instead of two.
+ * `undefined` is "absent" and evaluates to `true` (visible / enabled) by the
+ * evaluator's one documented default; this value is "declared and faulting"
+ * and `ExpressionEvaluator.evaluateCondition` treats it as a FAULT — reported,
+ * thrown to a `throwOnError` caller, and answered with the fail-soft `true`
+ * otherwise — so every reader gets the fail direction its key already has for
+ * a predicate that cannot be evaluated. Folding it into `undefined`, as this
+ * function did, made an `ast`-only envelope, `0`, `{}` or an array read as
+ * "no gate" everywhere, in silence (ADR-0137 D4).
+ *
+ * Shape, not a marker: it says what the evaluator receives — a CEL predicate
+ * (a bare predicate is CEL by the spec's contract) whose `source` is absent —
+ * and carries nothing of the original value, so no reader can guess what an
+ * `ast` meant. Frozen and shared, so a reader's memo sees one value per state.
+ */
+const DECLARED_UNEVALUABLE = Object.freeze({ dialect: 'cel' });
 /**
  * Wrap a BARE expression as a `${…}` template, and leave a string that already
  * carries template syntax alone (objectui#3871 — rationale in
@@ -29,8 +51,13 @@ function wrapIfBare(expression) {
  *     authored predicate, including bare strings) → a `cel` dialect keeps
  *     its envelope; every other dialect is unwrapped and wrapped as
  *     `${source}`.
- *   - `null` / `undefined` / empty / anything else → `undefined`
- *     (default visible/enabled).
+ *   - `null` / `undefined` / `''` / an envelope whose `source` is `''` →
+ *     `undefined` (absent: default visible/enabled).
+ *   - anything else that is present — an envelope with no string `source`
+ *     (`{ dialect: 'cel', ast }`), a number, `{}`, an array → the frozen
+ *     `{ dialect: 'cel' }` with no `source`: declared, and a FAULT to the
+ *     evaluator (objectui#11358 — see `DECLARED_UNEVALUABLE` above). This used
+ *     to fold into `undefined` with the absent shapes.
  *
  * ## Why the `cel` envelope must survive normalization (#2661 / #3314)
  *
@@ -113,6 +140,10 @@ export function toPredicateInput(value) {
         return value;
     if (typeof value === 'string')
         return wrapIfBare(value);
+    // Declared, but nothing here can be evaluated (objectui#11358): kept as its
+    // own state rather than folded into "absent". See `DECLARED_UNEVALUABLE`.
+    if (isUnevaluablePredicate(value))
+        return DECLARED_UNEVALUABLE;
     if (typeof value === 'object' && typeof value.source === 'string') {
         const src = value.source;
         if (!src)
@@ -125,5 +156,7 @@ export function toPredicateInput(value) {
         // Every other dialect (template / unset) keeps the legacy `${…}` behavior.
         return wrapIfBare(src);
     }
+    // Unreachable: every present value is a boolean, a string, an envelope with a
+    // string `source`, or unevaluable — all answered above. Kept for the compiler.
     return undefined;
 }

package/dist/evaluator/rowPredicateCanon.d.ts

@@ -26,8 +26,8 @@ export type NonCanonicalRowSpelling = {
  * predicate is already canonical (or is not this module's verdict to give).
  *
  * Deliberately conservative in both arms — every condition below can only
- * REMOVE a finding, never invent one, because a false deprecation warning sends
- * an author to rewrite a predicate that was correct:
+ * REMOVE a finding, never invent one, because a false finding sends an author
+ * to rewrite a predicate that was correct:
  *
  * - **Unparseable source** → `null`. Syntax is another gate's verdict.
  * - **Bare shorthand** is reported only when the undeclared identifier is an own
@@ -45,23 +45,12 @@ export type NonCanonicalRowSpelling = {
  * predicate manages both it is the one the author must fix to have anything
  * evaluate at all.
  *
- * @param source       The predicate's CEL text. Callers must have already
- *                     routed legacy `${…}`-dialect strings elsewhere — in that
- *                     dialect `data.*` is the NORMAL spelling, and reporting it
- *                     here would be a false positive on every legacy predicate.
+ * @param source       The predicate's CEL text. A legacy `${…}`-dialect string
+ *                     is not CEL and returns `null` here (unparseable); classify
+ *                     it by its own dialect's rules — on a runtime record surface
+ *                     it retired with the CEL spellings (`83fe6e741`), while on
+ *                     the schema/widget tier `data` is a different scope entirely.
  * @param row          The row the predicate is bound against.
  * @param dataNamesRow Whether `data` is bound to that same row on this surface.
  */
 export declare function detectNonCanonicalRowSpelling(source: string, row: Record<string, unknown> | null | undefined, dataNamesRow: boolean): NonCanonicalRowSpelling | null;
-/** Reset the row-predicate spelling warn-once memo. Exported for tests. */
-export declare function resetRowPredicateCanonWarnings(): void;
-/**
- * Report a non-canonical row-predicate spelling once, in dev.
- *
- * Phase 1 of the objectui#5330 window: the binding is UNCHANGED and every
- * spelling still resolves — this only says so out loud, so the stored
- * population stops growing and a later survey has something to count. It is a
- * warning and deliberately not a refusal: turning it into one would move the
- * accept/reject set, which this card is explicitly not entitled to do.
- */
-export declare function warnNonCanonicalRowSpelling(source: string, row: Record<string, unknown> | null | undefined, dataNamesRow: boolean, label?: string): void;

package/dist/evaluator/rowPredicateCanon.js

@@ -6,70 +6,76 @@
  * LICENSE file in the root directory of this source tree.
  */
 /**
- * The row-predicate spelling CANON, and the Phase-1 deprecation warning for the
- * two spellings that are not it (objectui#5330).
+ * The row-predicate spelling CANON: on a runtime record surface the row is bound
+ * as `record.*` and nothing else (objectui#5330, maintainer ruling 2026-08-20,
+ * option B; Phase 2 executed by `83fe6e741`).
  *
- * ## The canon (maintainer ruling, 2026-08-20 — option B)
+ * ## The canon
  *
  * A row predicate — `visible` / `disabled` / `enabled` on an action renderer, a
- * row scope, a `record:alert` — binds the row THREE ways today: canonical
- * `record.status`, bare shorthand `status`, and legacy `data.status`
- * (objectui#4075 / PR #4079 bound all four action renderers all three ways to
- * restore consistency, deliberately without deciding which of them is
- * CONTRACT). This module is where that decision now lives:
- *
- * > **The canon is `record.*`.** The bare shorthand and `data.*` are
- * > client-side tolerances in a deprecation window, kept because stored
- * > metadata carries them, warned about here, and removable only after a
- * > stored-metadata survey sizes the window (⛔ no removal before the survey).
- *
- * It mirrors the objectstack#7917 option-② precedent for the identical shape (a
- * renderer tolerance quietly becoming a second de-facto contract — AGENTS.md
- * #0.1), whose objectui half is `utils/dashboard-filters.ts`' bare-string
- * `options` shorthand: same three phases, same reason the warning is not
- * decoration (ADR-0078 — nothing silently inert; a tolerance nothing ever
- * reports can never be retired, because nothing would ever show that the last
- * document carrying it is gone).
- *
- * ## The canon states the SERVER's accept set, not this client's
- *
- * The ruling made that the dev's first measurement, because a canon that only
- * describes the renderer would be the very thing it exists to end. Measured
- * against `@objectstack/formula@17.1.0` — the engine the server evaluates with,
- * and the one `fieldRules.ts` already delegates to:
+ * row scope, a `record:alert`, a conditional-formatting `condition` — used to
+ * bind the row THREE ways: canonical `record.status`, bare shorthand `status`,
+ * and legacy `data.status` (objectui#4075 / PR #4079 bound all four action
+ * renderers all three ways to restore consistency, deliberately without
+ * deciding which of them was CONTRACT). The ruling decided it, in two phases:
+ *
+ * > **The canon is `record.*`.** Phase 1 (`d1ab06f0f`) declared it and warned
+ * > once, in dev, on the two other spellings. Phase 2 (`83fe6e741`, ruled
+ * > 2026-09-02 and amended 2026-09-05) retired them: the bare shorthand and
+ * > `data.*` are no longer bound on runtime record surfaces, and the Phase-1
+ * > warning went with them. No stored-metadata survey was run (「不考虑存量」);
+ * > the Phase-1 warning period was the notice.
+ *
+ * ## What a retired spelling does now: it FAULTS, as it always did on the server
+ *
+ * The canon states the SERVER's accept set. Measured against
+ * `@objectstack/formula@17.1.0` — the engine the server evaluates with, and the
+ * one `fieldRules.ts` delegates to:
  *
  * | spelling | server runtime (`buildScope` + `celEngine`) | server authoring oracle |
  * |---|---|---|
  * | `record.status` | ✅ `{ ok: true, value: true }` | ✅ accepted |
  * | bare `status`   | ❌ `Unknown variable: status` | ❌ refused (`'status'`) |
- * | `data.status`   | ❌ `Unknown variable: data`   | ⚠️ **silently accepted** |
- *
- * `buildScope({ record })` mounts exactly `['record']` — `data` is never bound
- * and the row's fields are never flattened to top level. So **the server
- * accepts `record.*` and nothing else**; both other spellings fault there. The
- * three-way binding is a client tolerance with no server counterpart, which is
- * precisely why it is the client's job to warn.
- *
- * ⚠️ The `data.*` row is the dangerous one and the reason this warning exists
- * at all. `data` IS in `@objectstack/formula`'s `SCOPE_ROOTS`, so the server's
- * bare-identifier oracle waves `data.status` through — that list is a
- * deliberately generous "never faults" LINT BASELINE, not the runtime accept
- * set. A `data.*` row predicate therefore passes every authoring gate the
- * platform has and then binds nothing at runtime: it is not an error, it is a
- * constant `false`, and a `visible` that is constantly false is a button that
- * silently never appears. That is the #4075 fail-closed family's exact
- * signature, and this client is the only layer positioned to catch it.
- *
- * ## `data.*` is DEPRECATED HERE, not everywhere — the canon is layer-scoped
+ * | `data.status`   | ❌ `Unknown variable: data`   | ⚠️ silently accepted |
+ *
+ * `buildScope({ record })` mounts exactly `['record']`. Since Phase 2 the client
+ * binds the same set (`listConditional.ts`' scope bag and `@object-ui/react`'s
+ * `usePredicateRecordContext`), so both retired spellings fault on the client
+ * with the server's verdict, and each surface applies its EXISTING fault policy:
+ * fail-closed `visible` on the throwing `useCondition` legs, the caller's
+ * `fallback` on `evalRowPredicate` / `partitionRowsByPredicate`, fail-soft on
+ * the non-throwing `useCondition` legs. There is no runtime detector, no
+ * "treat as absent" special case and no uniform override — a retired spelling
+ * is not a recognised-and-rejected thing, it is an unknown variable like any
+ * other, and the existing fault warnings are what name it.
+ *
+ * One consequence, stated so it is not read back as a bug: a host scope may
+ * legitimately carry its OWN `data` (a rowless dialog's, or app-shell's ambient
+ * `data: {}`), and it is left standing. `data.*` on a record surface then reads
+ * the host's object rather than the row — which is exactly what "no longer bound
+ * to the row" means, and, against an ambient `data: {}`, the constant-false
+ * signature the Phase-1 warning text already described for the server.
+ *
+ * ## `data.*` is retired HERE, not everywhere — the canon is layer-scoped
  *
  * `data` is the CANONICAL root one layer over, in a metadata-editing form (the
  * row under edit): objectstack's `CANONICAL_ROOT_BY_LAYER` reads
  * `{ runtime: 'record', metadata: 'data' }` (ADR-0089 D3), and objectui's own
- * `app-shell` metadata-admin `SchemaForm` binds `{ data: row }` on purpose. So
- * `data.*` is not a legacy alias to be deprecated platform-wide — it is a
- * WRONG-LAYER paste on a runtime record surface, and only that is what this
- * module reports. Stating the deprecation unqualified would contradict
- * ADR-0089 D3 and break the metadata-editing layer's own contract.
+ * `app-shell` metadata-admin `SchemaForm` binds `{ data: row }` on purpose,
+ * through its own evaluator (`views/metadata-admin/predicate.ts`) — never
+ * through `evalRowPredicate` or `usePredicateRecordContext`. So `data.*` is not
+ * retired platform-wide: it is a WRONG-LAYER spelling on a runtime record
+ * surface, and that is the only thing the detector below reports.
+ *
+ * ## What is left in this module, and why
+ *
+ * {@link detectNonCanonicalRowSpelling} is the OFFLINE instrument: it classifies
+ * an authored predicate's spelling against a row without evaluating it, so a
+ * sweep over stored or in-repo metadata (the `702c48a62` corpus sweep's
+ * recipe) can find the documents that still need rewriting. It is
+ * exported for that purpose and nothing on the hot path calls it — the runtime
+ * warning half Phase 1 built on it (`warnNonCanonicalRowSpelling`,
+ * `resetRowPredicateCanonWarnings`) was removed with the bindings.
  *
  * ## Why the detection reuses the server's oracle instead of a regex
  *
@@ -94,8 +100,8 @@ const METADATA_LAYER_ROOT = 'data';
  * predicate is already canonical (or is not this module's verdict to give).
  *
  * Deliberately conservative in both arms — every condition below can only
- * REMOVE a finding, never invent one, because a false deprecation warning sends
- * an author to rewrite a predicate that was correct:
+ * REMOVE a finding, never invent one, because a false finding sends an author
+ * to rewrite a predicate that was correct:
  *
  * - **Unparseable source** → `null`. Syntax is another gate's verdict.
  * - **Bare shorthand** is reported only when the undeclared identifier is an own
@@ -113,10 +119,11 @@ const METADATA_LAYER_ROOT = 'data';
  * predicate manages both it is the one the author must fix to have anything
  * evaluate at all.
  *
- * @param source       The predicate's CEL text. Callers must have already
- *                     routed legacy `${…}`-dialect strings elsewhere — in that
- *                     dialect `data.*` is the NORMAL spelling, and reporting it
- *                     here would be a false positive on every legacy predicate.
+ * @param source       The predicate's CEL text. A legacy `${…}`-dialect string
+ *                     is not CEL and returns `null` here (unparseable); classify
+ *                     it by its own dialect's rules — on a runtime record surface
+ *                     it retired with the CEL spellings (`83fe6e741`), while on
+ *                     the schema/widget tier `data` is a different scope entirely.
  * @param row          The row the predicate is bound against.
  * @param dataNamesRow Whether `data` is bound to that same row on this surface.
  */
@@ -149,60 +156,3 @@ export function detectNonCanonicalRowSpelling(source, row, dataNamesRow) {
     }
     return null;
 }
-/**
- * Dev-mode gate, matching `utils/dashboard-filters.ts` and `actions/actionKeys.ts`
- * — a deprecation warning that floods a production console is a warning that
- * gets muted.
- */
-const isDev = () => globalThis.process?.env
-    ?.NODE_ENV !== 'production';
-/**
- * Warn-once memo, keyed by the `(label, predicate source)` pair — the same
- * identity `warnEvalError` uses, and JSON-encoded for the same reason: the
- * separator that boundary once used was a raw U+0000, which made the file
- * carrying it binary to grep (objectstack#5450). Keying on the source alone
- * would report the first surface carrying a shorthand `status` predicate and
- * stay silent about every other one; the label is what sends the author to the
- * right screen.
- *
- * Module scope, not per-call: these predicates are re-evaluated on every row of
- * every render, so per-call state would warn once per frame — the flood the
- * dedupe exists to prevent.
- */
-const warnedSpellings = new Set();
-/** Reset the row-predicate spelling warn-once memo. Exported for tests. */
-export function resetRowPredicateCanonWarnings() {
-    warnedSpellings.clear();
-}
-/**
- * Report a non-canonical row-predicate spelling once, in dev.
- *
- * Phase 1 of the objectui#5330 window: the binding is UNCHANGED and every
- * spelling still resolves — this only says so out loud, so the stored
- * population stops growing and a later survey has something to count. It is a
- * warning and deliberately not a refusal: turning it into one would move the
- * accept/reject set, which this card is explicitly not entitled to do.
- */
-export function warnNonCanonicalRowSpelling(source, row, dataNamesRow, label) {
-    if (!isDev())
-        return;
-    const finding = detectNonCanonicalRowSpelling(source, row, dataNamesRow);
-    if (!finding)
-        return;
-    const key = JSON.stringify([label ?? '', source, finding.kind]);
-    if (warnedSpellings.has(key))
-        return;
-    warnedSpellings.add(key);
-    const where = label ? ` (${label})` : '';
-    const detail = finding.kind === 'bare-shorthand'
-        ? `it references the bare field ${JSON.stringify(finding.identifier)}; ` +
-            `the server refuses that spelling outright ("Unknown variable: ${finding.identifier}")`
-        : 'it is rooted at `data.`, which is the metadata-editing-form root — on a ' +
-            'record surface the server binds no `data` at all, so the predicate is a ' +
-            'constant false there rather than an error';
-    console.warn(`[object-ui] A row predicate${where} uses a DEPRECATED spelling: ` +
-        `${JSON.stringify(source)} — ${detail}. The canon is \`record.*\` ` +
-        `(objectui#5330, ruled 2026-08-20): write \`${finding.canonical}\`. ` +
-        'This still evaluates here for now; the tolerance retires after a ' +
-        'stored-metadata survey.');
-}

package/dist/evaluator/subjectPermissions.d.ts

@@ -0,0 +1,76 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * The acting subject's effective object permissions, carried to the one place
+ * this repo hands a predicate to the CEL engine (objectui#4421).
+ *
+ * ## What it is for
+ *
+ * `@objectstack/formula` registers `current_user.can(object, verb)` as a
+ * receiver method on the acting subject, and answers it from
+ * `EvalContext.permissions` — the verbatim `objects` map of the
+ * `/auth/me/permissions` response. That map is a separate field of the engine
+ * context, and the engine is explicit that it is ⛔ NOT a CEL variable: an
+ * authored predicate must not be able to read `permissions.crm_lead.allowEdit`
+ * and step around the closed verb table.
+ *
+ * This repo's evaluation seam (`evalFieldPredicate`) is not handed an engine
+ * context by its callers, though. Every action surface — the row menu, the
+ * record header, the `action:*` renderers, `DeclaredActionsBar` — hands it a
+ * variable BAG (the host's predicate scope, spread, merged, pushed through an
+ * `ExpressionContext`), and the bag's string keys all become CEL roots. So the
+ * permissions cannot ride on the bag under a name: any name would be a root.
+ *
+ * They ride on the SUBJECT instead, under a symbol:
+ *
+ *  - The engine models the map as the subject's own answer sheet — it binds
+ *    `permissions` only alongside a user, and `can` refuses any receiver that
+ *    is not that user (`receiver !== subject`). The subject is the one object
+ *    every bag already carries by reference under `current_user` (and the
+ *    `user` / `ctx.user` / `os.user` aliases of it), through every spread and
+ *    every `ExpressionContext` scope, so no surface needs its own copy of the
+ *    hand-off.
+ *  - A symbol is the one kind of key no predicate dialect can name: CEL
+ *    identifiers and member names are strings, and so are the legacy
+ *    evaluator's. `current_user.permissions` still faults as an unknown key.
+ *
+ * ## Absent is not empty
+ *
+ * A subject that carries NO map — the payload has not loaded, no permission
+ * provider is mounted, or the provider has no `/auth/me/permissions` answer at
+ * all — hands the engine no `permissions`, and `can` then refuses loudly
+ * (`ok: false`, `kind: 'runtime'`). That refusal is a FAULT, so each surface
+ * applies its own fault policy to it; it is never turned into a quiet `false`
+ * here, because the engine's contract is that an empty map means "holds
+ * nothing" and a caller that has no data must not claim it has that answer.
+ */
+import type { EvalPermissions } from '@objectstack/formula';
+/**
+ * The key the subject carries its effective object permissions under.
+ *
+ * `Symbol.for` rather than `Symbol()` so two copies of this module in one page
+ * (a host that bundles `@object-ui/core` twice) still agree on the key; the
+ * namespace keeps it from colliding with anyone else's registry entry.
+ */
+export declare const SUBJECT_PERMISSIONS: unique symbol;
+/**
+ * The subject to publish as `current_user`, carrying `permissions` when there
+ * are any.
+ *
+ * Returns a shallow copy so the caller's own user object is never mutated; the
+ * copy is what the whole predicate scope must use for every alias of the
+ * subject, because the engine compares the `can` receiver by IDENTITY. With no
+ * `permissions` the result carries none — a subject built from one that did is
+ * stripped rather than left answering from a stale map.
+ */
+export declare function bindSubjectPermissions<T extends object>(subject: T, permissions: EvalPermissions | undefined): T;
+/**
+ * The effective object permissions a subject carries, or `undefined` when it
+ * carries none (see "Absent is not empty" above).
+ */
+export declare function subjectPermissionsOf(subject: unknown): EvalPermissions | undefined;

package/dist/evaluator/subjectPermissions.js

@@ -0,0 +1,44 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * The key the subject carries its effective object permissions under.
+ *
+ * `Symbol.for` rather than `Symbol()` so two copies of this module in one page
+ * (a host that bundles `@object-ui/core` twice) still agree on the key; the
+ * namespace keeps it from colliding with anyone else's registry entry.
+ */
+export const SUBJECT_PERMISSIONS = Symbol.for('@object-ui/core:subject-permissions');
+/**
+ * The subject to publish as `current_user`, carrying `permissions` when there
+ * are any.
+ *
+ * Returns a shallow copy so the caller's own user object is never mutated; the
+ * copy is what the whole predicate scope must use for every alias of the
+ * subject, because the engine compares the `can` receiver by IDENTITY. With no
+ * `permissions` the result carries none — a subject built from one that did is
+ * stripped rather than left answering from a stale map.
+ */
+export function bindSubjectPermissions(subject, permissions) {
+    if (permissions === undefined) {
+        if (!Object.prototype.hasOwnProperty.call(subject, SUBJECT_PERMISSIONS))
+            return subject;
+        const stripped = { ...subject };
+        delete stripped[SUBJECT_PERMISSIONS];
+        return stripped;
+    }
+    return { ...subject, [SUBJECT_PERMISSIONS]: permissions };
+}
+/**
+ * The effective object permissions a subject carries, or `undefined` when it
+ * carries none (see "Absent is not empty" above).
+ */
+export function subjectPermissionsOf(subject) {
+    if (subject === null || typeof subject !== 'object')
+        return undefined;
+    return subject[SUBJECT_PERMISSIONS];
+}