@object-ui/core 17.6.0 → 18.0.0

package/dist/evaluator/rowPredicateCanon.js

@@ -6,70 +6,76 @@
  * LICENSE file in the root directory of this source tree.
  */
 /**
- * The row-predicate spelling CANON, and the Phase-1 deprecation warning for the
- * two spellings that are not it (objectui#5330).
+ * The row-predicate spelling CANON: on a runtime record surface the row is bound
+ * as `record.*` and nothing else (objectui#5330, maintainer ruling 2026-08-20,
+ * option B; Phase 2 executed by `83fe6e741`).
  *
- * ## The canon (maintainer ruling, 2026-08-20 — option B)
+ * ## The canon
  *
  * A row predicate — `visible` / `disabled` / `enabled` on an action renderer, a
- * row scope, a `record:alert` — binds the row THREE ways today: canonical
- * `record.status`, bare shorthand `status`, and legacy `data.status`
- * (objectui#4075 / PR #4079 bound all four action renderers all three ways to
- * restore consistency, deliberately without deciding which of them is
- * CONTRACT). This module is where that decision now lives:
- *
- * > **The canon is `record.*`.** The bare shorthand and `data.*` are
- * > client-side tolerances in a deprecation window, kept because stored
- * > metadata carries them, warned about here, and removable only after a
- * > stored-metadata survey sizes the window (⛔ no removal before the survey).
- *
- * It mirrors the objectstack#7917 option-② precedent for the identical shape (a
- * renderer tolerance quietly becoming a second de-facto contract — AGENTS.md
- * #0.1), whose objectui half is `utils/dashboard-filters.ts`' bare-string
- * `options` shorthand: same three phases, same reason the warning is not
- * decoration (ADR-0078 — nothing silently inert; a tolerance nothing ever
- * reports can never be retired, because nothing would ever show that the last
- * document carrying it is gone).
- *
- * ## The canon states the SERVER's accept set, not this client's
- *
- * The ruling made that the dev's first measurement, because a canon that only
- * describes the renderer would be the very thing it exists to end. Measured
- * against `@objectstack/formula@17.1.0` — the engine the server evaluates with,
- * and the one `fieldRules.ts` already delegates to:
+ * row scope, a `record:alert`, a conditional-formatting `condition` — used to
+ * bind the row THREE ways: canonical `record.status`, bare shorthand `status`,
+ * and legacy `data.status` (objectui#4075 / PR #4079 bound all four action
+ * renderers all three ways to restore consistency, deliberately without
+ * deciding which of them was CONTRACT). The ruling decided it, in two phases:
+ *
+ * > **The canon is `record.*`.** Phase 1 (`d1ab06f0f`) declared it and warned
+ * > once, in dev, on the two other spellings. Phase 2 (`83fe6e741`, ruled
+ * > 2026-09-02 and amended 2026-09-05) retired them: the bare shorthand and
+ * > `data.*` are no longer bound on runtime record surfaces, and the Phase-1
+ * > warning went with them. No stored-metadata survey was run (「不考虑存量」);
+ * > the Phase-1 warning period was the notice.
+ *
+ * ## What a retired spelling does now: it FAULTS, as it always did on the server
+ *
+ * The canon states the SERVER's accept set. Measured against
+ * `@objectstack/formula@17.1.0` — the engine the server evaluates with, and the
+ * one `fieldRules.ts` delegates to:
  *
  * | spelling | server runtime (`buildScope` + `celEngine`) | server authoring oracle |
  * |---|---|---|
  * | `record.status` | ✅ `{ ok: true, value: true }` | ✅ accepted |
  * | bare `status`   | ❌ `Unknown variable: status` | ❌ refused (`'status'`) |
- * | `data.status`   | ❌ `Unknown variable: data`   | ⚠️ **silently accepted** |
- *
- * `buildScope({ record })` mounts exactly `['record']` — `data` is never bound
- * and the row's fields are never flattened to top level. So **the server
- * accepts `record.*` and nothing else**; both other spellings fault there. The
- * three-way binding is a client tolerance with no server counterpart, which is
- * precisely why it is the client's job to warn.
- *
- * ⚠️ The `data.*` row is the dangerous one and the reason this warning exists
- * at all. `data` IS in `@objectstack/formula`'s `SCOPE_ROOTS`, so the server's
- * bare-identifier oracle waves `data.status` through — that list is a
- * deliberately generous "never faults" LINT BASELINE, not the runtime accept
- * set. A `data.*` row predicate therefore passes every authoring gate the
- * platform has and then binds nothing at runtime: it is not an error, it is a
- * constant `false`, and a `visible` that is constantly false is a button that
- * silently never appears. That is the #4075 fail-closed family's exact
- * signature, and this client is the only layer positioned to catch it.
- *
- * ## `data.*` is DEPRECATED HERE, not everywhere — the canon is layer-scoped
+ * | `data.status`   | ❌ `Unknown variable: data`   | ⚠️ silently accepted |
+ *
+ * `buildScope({ record })` mounts exactly `['record']`. Since Phase 2 the client
+ * binds the same set (`listConditional.ts`' scope bag and `@object-ui/react`'s
+ * `usePredicateRecordContext`), so both retired spellings fault on the client
+ * with the server's verdict, and each surface applies its EXISTING fault policy:
+ * fail-closed `visible` on the throwing `useCondition` legs, the caller's
+ * `fallback` on `evalRowPredicate` / `partitionRowsByPredicate`, fail-soft on
+ * the non-throwing `useCondition` legs. There is no runtime detector, no
+ * "treat as absent" special case and no uniform override — a retired spelling
+ * is not a recognised-and-rejected thing, it is an unknown variable like any
+ * other, and the existing fault warnings are what name it.
+ *
+ * One consequence, stated so it is not read back as a bug: a host scope may
+ * legitimately carry its OWN `data` (a rowless dialog's, or app-shell's ambient
+ * `data: {}`), and it is left standing. `data.*` on a record surface then reads
+ * the host's object rather than the row — which is exactly what "no longer bound
+ * to the row" means, and, against an ambient `data: {}`, the constant-false
+ * signature the Phase-1 warning text already described for the server.
+ *
+ * ## `data.*` is retired HERE, not everywhere — the canon is layer-scoped
  *
  * `data` is the CANONICAL root one layer over, in a metadata-editing form (the
  * row under edit): objectstack's `CANONICAL_ROOT_BY_LAYER` reads
  * `{ runtime: 'record', metadata: 'data' }` (ADR-0089 D3), and objectui's own
- * `app-shell` metadata-admin `SchemaForm` binds `{ data: row }` on purpose. So
- * `data.*` is not a legacy alias to be deprecated platform-wide — it is a
- * WRONG-LAYER paste on a runtime record surface, and only that is what this
- * module reports. Stating the deprecation unqualified would contradict
- * ADR-0089 D3 and break the metadata-editing layer's own contract.
+ * `app-shell` metadata-admin `SchemaForm` binds `{ data: row }` on purpose,
+ * through its own evaluator (`views/metadata-admin/predicate.ts`) — never
+ * through `evalRowPredicate` or `usePredicateRecordContext`. So `data.*` is not
+ * retired platform-wide: it is a WRONG-LAYER spelling on a runtime record
+ * surface, and that is the only thing the detector below reports.
+ *
+ * ## What is left in this module, and why
+ *
+ * {@link detectNonCanonicalRowSpelling} is the OFFLINE instrument: it classifies
+ * an authored predicate's spelling against a row without evaluating it, so a
+ * sweep over stored or in-repo metadata (the `702c48a62` corpus sweep's
+ * recipe) can find the documents that still need rewriting. It is
+ * exported for that purpose and nothing on the hot path calls it — the runtime
+ * warning half Phase 1 built on it (`warnNonCanonicalRowSpelling`,
+ * `resetRowPredicateCanonWarnings`) was removed with the bindings.
  *
  * ## Why the detection reuses the server's oracle instead of a regex
  *
@@ -94,8 +100,8 @@ const METADATA_LAYER_ROOT = 'data';
  * predicate is already canonical (or is not this module's verdict to give).
  *
  * Deliberately conservative in both arms — every condition below can only
- * REMOVE a finding, never invent one, because a false deprecation warning sends
- * an author to rewrite a predicate that was correct:
+ * REMOVE a finding, never invent one, because a false finding sends an author
+ * to rewrite a predicate that was correct:
  *
  * - **Unparseable source** → `null`. Syntax is another gate's verdict.
  * - **Bare shorthand** is reported only when the undeclared identifier is an own
@@ -113,10 +119,11 @@ const METADATA_LAYER_ROOT = 'data';
  * predicate manages both it is the one the author must fix to have anything
  * evaluate at all.
  *
- * @param source       The predicate's CEL text. Callers must have already
- *                     routed legacy `${…}`-dialect strings elsewhere — in that
- *                     dialect `data.*` is the NORMAL spelling, and reporting it
- *                     here would be a false positive on every legacy predicate.
+ * @param source       The predicate's CEL text. A legacy `${…}`-dialect string
+ *                     is not CEL and returns `null` here (unparseable); classify
+ *                     it by its own dialect's rules — on a runtime record surface
+ *                     it retired with the CEL spellings (`83fe6e741`), while on
+ *                     the schema/widget tier `data` is a different scope entirely.
  * @param row          The row the predicate is bound against.
  * @param dataNamesRow Whether `data` is bound to that same row on this surface.
  */
@@ -149,60 +156,3 @@ export function detectNonCanonicalRowSpelling(source, row, dataNamesRow) {
     }
     return null;
 }
-/**
- * Dev-mode gate, matching `utils/dashboard-filters.ts` and `actions/actionKeys.ts`
- * — a deprecation warning that floods a production console is a warning that
- * gets muted.
- */
-const isDev = () => globalThis.process?.env
-    ?.NODE_ENV !== 'production';
-/**
- * Warn-once memo, keyed by the `(label, predicate source)` pair — the same
- * identity `warnEvalError` uses, and JSON-encoded for the same reason: the
- * separator that boundary once used was a raw U+0000, which made the file
- * carrying it binary to grep (objectstack#5450). Keying on the source alone
- * would report the first surface carrying a shorthand `status` predicate and
- * stay silent about every other one; the label is what sends the author to the
- * right screen.
- *
- * Module scope, not per-call: these predicates are re-evaluated on every row of
- * every render, so per-call state would warn once per frame — the flood the
- * dedupe exists to prevent.
- */
-const warnedSpellings = new Set();
-/** Reset the row-predicate spelling warn-once memo. Exported for tests. */
-export function resetRowPredicateCanonWarnings() {
-    warnedSpellings.clear();
-}
-/**
- * Report a non-canonical row-predicate spelling once, in dev.
- *
- * Phase 1 of the objectui#5330 window: the binding is UNCHANGED and every
- * spelling still resolves — this only says so out loud, so the stored
- * population stops growing and a later survey has something to count. It is a
- * warning and deliberately not a refusal: turning it into one would move the
- * accept/reject set, which this card is explicitly not entitled to do.
- */
-export function warnNonCanonicalRowSpelling(source, row, dataNamesRow, label) {
-    if (!isDev())
-        return;
-    const finding = detectNonCanonicalRowSpelling(source, row, dataNamesRow);
-    if (!finding)
-        return;
-    const key = JSON.stringify([label ?? '', source, finding.kind]);
-    if (warnedSpellings.has(key))
-        return;
-    warnedSpellings.add(key);
-    const where = label ? ` (${label})` : '';
-    const detail = finding.kind === 'bare-shorthand'
-        ? `it references the bare field ${JSON.stringify(finding.identifier)}; ` +
-            `the server refuses that spelling outright ("Unknown variable: ${finding.identifier}")`
-        : 'it is rooted at `data.`, which is the metadata-editing-form root — on a ' +
-            'record surface the server binds no `data` at all, so the predicate is a ' +
-            'constant false there rather than an error';
-    console.warn(`[object-ui] A row predicate${where} uses a DEPRECATED spelling: ` +
-        `${JSON.stringify(source)} — ${detail}. The canon is \`record.*\` ` +
-        `(objectui#5330, ruled 2026-08-20): write \`${finding.canonical}\`. ` +
-        'This still evaluates here for now; the tolerance retires after a ' +
-        'stored-metadata survey.');
-}

package/dist/evaluator/subjectPermissions.d.ts

@@ -0,0 +1,105 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * The acting subject's effective object permissions, carried to the one place
+ * this repo hands a predicate to the CEL engine (objectui#4421).
+ *
+ * ## What it is for
+ *
+ * `@objectstack/formula` registers `current_user.can(object, verb)` as a
+ * receiver method on the acting subject, and answers it from
+ * `EvalContext.permissions` — the verbatim `objects` map of the
+ * `/auth/me/permissions` response. That map is a separate field of the engine
+ * context, and the engine is explicit that it is ⛔ NOT a CEL variable: an
+ * authored predicate must not be able to read `permissions.crm_lead.allowEdit`
+ * and step around the closed verb table.
+ *
+ * This repo's evaluation seam (`evalFieldPredicate`) is not handed an engine
+ * context by its callers, though. Every action surface — the row menu, the
+ * record header, the `action:*` renderers, `DeclaredActionsBar` — hands it a
+ * variable BAG (the host's predicate scope, spread, merged, pushed through an
+ * `ExpressionContext`), and the bag's string keys all become CEL roots. So the
+ * permissions cannot ride on the bag under a name: any name would be a root.
+ *
+ * They ride on the SUBJECT instead, under a symbol:
+ *
+ *  - The engine models the map as the subject's own answer sheet — it binds
+ *    `permissions` only alongside a user, and `can` refuses any receiver that
+ *    is not that user (`receiver !== subject`). The subject is the one object
+ *    every bag already carries by reference under `current_user` (and the
+ *    `user` / `ctx.user` / `os.user` aliases of it), through every spread and
+ *    every `ExpressionContext` scope, so no surface needs its own copy of the
+ *    hand-off.
+ *  - A symbol is the one kind of key no predicate dialect can name: CEL
+ *    identifiers and member names are strings, and so are the legacy
+ *    evaluator's. `current_user.permissions` still faults as an unknown key.
+ *
+ * ## Absent is not empty
+ *
+ * A subject that carries NO map — the payload has not loaded, no permission
+ * provider is mounted, or the provider has no `/auth/me/permissions` answer at
+ * all — hands the engine no `permissions`, and `can` then refuses loudly
+ * (`ok: false`, `kind: 'runtime'`). That refusal is a FAULT, so each surface
+ * applies its own fault policy to it; it is never turned into a quiet `false`
+ * here, because the engine's contract is that an empty map means "holds
+ * nothing" and a caller that has no data must not claim it has that answer.
+ */
+import type { EvalPermissions, EvalSystemPermissions } from '@objectstack/formula';
+/**
+ * The key the subject carries its effective object permissions under.
+ *
+ * `Symbol.for` rather than `Symbol()` so two copies of this module in one page
+ * (a host that bundles `@object-ui/core` twice) still agree on the key; the
+ * namespace keeps it from colliding with anyone else's registry entry.
+ */
+export declare const SUBJECT_PERMISSIONS: unique symbol;
+/**
+ * The subject to publish as `current_user`, carrying `permissions` when there
+ * are any.
+ *
+ * Returns a shallow copy so the caller's own user object is never mutated; the
+ * copy is what the whole predicate scope must use for every alias of the
+ * subject, because the engine compares the `can` receiver by IDENTITY. With no
+ * `permissions` the result carries none — a subject built from one that did is
+ * stripped rather than left answering from a stale map.
+ */
+export declare function bindSubjectPermissions<T extends object>(subject: T, permissions: EvalPermissions | undefined): T;
+/**
+ * The effective object permissions a subject carries, or `undefined` when it
+ * carries none (see "Absent is not empty" above).
+ */
+export declare function subjectPermissionsOf(subject: unknown): EvalPermissions | undefined;
+/**
+ * The key the subject carries its held system capabilities under — the
+ * `systemPermissions` list of the `/auth/me/permissions` response, the one
+ * input `current_user.hasCapability(name)` is answered from (objectui#13006).
+ *
+ * It rides beside {@link SUBJECT_PERMISSIONS} for the same reasons: the engine
+ * reads it from `EvalContext.systemPermissions`, ⛔ never from a CEL variable,
+ * so it can be neither a scope key (every scope key is a root) nor a string
+ * member of `current_user` (`current_user.systemPermissions` would be a
+ * readable member reaching around the function). A symbol is neither.
+ *
+ * Absent is not empty, exactly as for the permissions map: a subject carrying
+ * no list hands the engine none, and `hasCapability` refuses loudly; an empty
+ * list is a real answer ("holds no capability") and evaluates to `false`.
+ */
+export declare const SUBJECT_CAPABILITIES: unique symbol;
+/**
+ * The subject to publish as `current_user`, carrying `systemPermissions` when
+ * there is a list — the sibling of {@link bindSubjectPermissions}, on the same
+ * terms: a shallow copy (the caller's object is never mutated, and every alias
+ * must be the returned object), and with no list a subject built from one that
+ * had a list is stripped rather than left answering from a stale one.
+ */
+export declare function bindSubjectCapabilities<T extends object>(subject: T, systemPermissions: EvalSystemPermissions | undefined): T;
+/**
+ * The held system capabilities a subject carries, or `undefined` when it
+ * carries none (absent is not empty — see {@link SUBJECT_CAPABILITIES}).
+ */
+export declare function subjectCapabilitiesOf(subject: unknown): EvalSystemPermissions | undefined;

package/dist/evaluator/subjectPermissions.js

@@ -0,0 +1,86 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * The key the subject carries its effective object permissions under.
+ *
+ * `Symbol.for` rather than `Symbol()` so two copies of this module in one page
+ * (a host that bundles `@object-ui/core` twice) still agree on the key; the
+ * namespace keeps it from colliding with anyone else's registry entry.
+ */
+export const SUBJECT_PERMISSIONS = Symbol.for('@object-ui/core:subject-permissions');
+/**
+ * The subject to publish as `current_user`, carrying `permissions` when there
+ * are any.
+ *
+ * Returns a shallow copy so the caller's own user object is never mutated; the
+ * copy is what the whole predicate scope must use for every alias of the
+ * subject, because the engine compares the `can` receiver by IDENTITY. With no
+ * `permissions` the result carries none — a subject built from one that did is
+ * stripped rather than left answering from a stale map.
+ */
+export function bindSubjectPermissions(subject, permissions) {
+    if (permissions === undefined) {
+        if (!Object.prototype.hasOwnProperty.call(subject, SUBJECT_PERMISSIONS))
+            return subject;
+        const stripped = { ...subject };
+        delete stripped[SUBJECT_PERMISSIONS];
+        return stripped;
+    }
+    return { ...subject, [SUBJECT_PERMISSIONS]: permissions };
+}
+/**
+ * The effective object permissions a subject carries, or `undefined` when it
+ * carries none (see "Absent is not empty" above).
+ */
+export function subjectPermissionsOf(subject) {
+    if (subject === null || typeof subject !== 'object')
+        return undefined;
+    return subject[SUBJECT_PERMISSIONS];
+}
+/**
+ * The key the subject carries its held system capabilities under — the
+ * `systemPermissions` list of the `/auth/me/permissions` response, the one
+ * input `current_user.hasCapability(name)` is answered from (objectui#13006).
+ *
+ * It rides beside {@link SUBJECT_PERMISSIONS} for the same reasons: the engine
+ * reads it from `EvalContext.systemPermissions`, ⛔ never from a CEL variable,
+ * so it can be neither a scope key (every scope key is a root) nor a string
+ * member of `current_user` (`current_user.systemPermissions` would be a
+ * readable member reaching around the function). A symbol is neither.
+ *
+ * Absent is not empty, exactly as for the permissions map: a subject carrying
+ * no list hands the engine none, and `hasCapability` refuses loudly; an empty
+ * list is a real answer ("holds no capability") and evaluates to `false`.
+ */
+export const SUBJECT_CAPABILITIES = Symbol.for('@object-ui/core:subject-capabilities');
+/**
+ * The subject to publish as `current_user`, carrying `systemPermissions` when
+ * there is a list — the sibling of {@link bindSubjectPermissions}, on the same
+ * terms: a shallow copy (the caller's object is never mutated, and every alias
+ * must be the returned object), and with no list a subject built from one that
+ * had a list is stripped rather than left answering from a stale one.
+ */
+export function bindSubjectCapabilities(subject, systemPermissions) {
+    if (systemPermissions === undefined) {
+        if (!Object.prototype.hasOwnProperty.call(subject, SUBJECT_CAPABILITIES))
+            return subject;
+        const stripped = { ...subject };
+        delete stripped[SUBJECT_CAPABILITIES];
+        return stripped;
+    }
+    return { ...subject, [SUBJECT_CAPABILITIES]: systemPermissions };
+}
+/**
+ * The held system capabilities a subject carries, or `undefined` when it
+ * carries none (absent is not empty — see {@link SUBJECT_CAPABILITIES}).
+ */
+export function subjectCapabilitiesOf(subject) {
+    if (subject === null || typeof subject !== 'object')
+        return undefined;
+    return subject[SUBJECT_CAPABILITIES];
+}

package/dist/evaluator/unevaluablePredicate.d.ts

@@ -0,0 +1,57 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Is this value a gate the author DECLARED but the client cannot EVALUATE?
+ * (objectui#11358)
+ *
+ * A predicate gate (`visible` / `hidden` / `enabled` / `disabled` /
+ * `condition`) is in one of three states, and this is the one place the third
+ * is told apart from the other two:
+ *
+ *   - **absent** — `null` / `undefined` / `''` / blank predicate text. Nothing
+ *     was declared; {@link hasDeclaredPredicate} answers "not declared" (and
+ *     reports a blank one, objectui#8069).
+ *   - **evaluable** — a boolean, a predicate string, or an envelope whose
+ *     `source` is a non-blank string.
+ *   - **declared but not evaluable** — anything else that is present: an
+ *     envelope with no string `source` (the `ast`-only `{ dialect: 'cel', ast }`
+ *     an authoring door can admit), a number (`0`, `42`), an object with no
+ *     `source` (`{}`), an array. This function answers `true` for exactly
+ *     these.
+ *
+ * Triage's ruling on objectui#11358 makes the third state "declared and
+ * faulting": it is a gate, so it is never "no gate", and it cannot be
+ * evaluated, so it takes the path every other faulting predicate takes —
+ * reported, and answered with the fail direction its key already has. Before
+ * that ruling the normalizer folded it to `undefined`, the same answer as
+ * "absent", so every reader showed / enabled / ran it in silence: ADR-0137 D4's
+ * "a gate predicate that is blank or faulting is diagnosed, never a silent
+ * `true`", broken by a fold.
+ *
+ * Read by the normalizer ({@link toPredicateInput}, which now keeps the state
+ * instead of folding it), the evaluation step
+ * (`ExpressionEvaluator.evaluateCondition`, which reports it and answers it as a
+ * fault), the canonical predicate helper (`evalFieldPredicate`, which tags its
+ * reason) and the dev-mode schema validator (which still refuses it). ⛔ Not
+ * re-exported from the package entry: it is the internal definition those four
+ * share, not public API.
+ *
+ * ⚠️ No client-side reading of what an `ast` MEANT: the client evaluates
+ * `source` text only, so an `ast` with no `source` is not evaluable here,
+ * whatever it says.
+ */
+export declare function isUnevaluablePredicate(value: unknown): boolean;
+/**
+ * The `reason` reported for a gate that is declared but cannot be evaluated,
+ * tagged like an engine reason (`[parse]`, `[type]`, `[blank]`) because it
+ * travels the same two channels — `evalFieldPredicate`'s one-time warning and
+ * its `onFault` passback — and a caller that routes on the tag must tell it
+ * apart from a predicate that faulted with text in it: the fix is to give the
+ * gate a `source` (or delete it), never to debug CEL syntax.
+ */
+export declare const UNEVALUABLE_PREDICATE_REASON: string;

package/dist/evaluator/unevaluablePredicate.js

@@ -0,0 +1,70 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Is this value a gate the author DECLARED but the client cannot EVALUATE?
+ * (objectui#11358)
+ *
+ * A predicate gate (`visible` / `hidden` / `enabled` / `disabled` /
+ * `condition`) is in one of three states, and this is the one place the third
+ * is told apart from the other two:
+ *
+ *   - **absent** — `null` / `undefined` / `''` / blank predicate text. Nothing
+ *     was declared; {@link hasDeclaredPredicate} answers "not declared" (and
+ *     reports a blank one, objectui#8069).
+ *   - **evaluable** — a boolean, a predicate string, or an envelope whose
+ *     `source` is a non-blank string.
+ *   - **declared but not evaluable** — anything else that is present: an
+ *     envelope with no string `source` (the `ast`-only `{ dialect: 'cel', ast }`
+ *     an authoring door can admit), a number (`0`, `42`), an object with no
+ *     `source` (`{}`), an array. This function answers `true` for exactly
+ *     these.
+ *
+ * Triage's ruling on objectui#11358 makes the third state "declared and
+ * faulting": it is a gate, so it is never "no gate", and it cannot be
+ * evaluated, so it takes the path every other faulting predicate takes —
+ * reported, and answered with the fail direction its key already has. Before
+ * that ruling the normalizer folded it to `undefined`, the same answer as
+ * "absent", so every reader showed / enabled / ran it in silence: ADR-0137 D4's
+ * "a gate predicate that is blank or faulting is diagnosed, never a silent
+ * `true`", broken by a fold.
+ *
+ * Read by the normalizer ({@link toPredicateInput}, which now keeps the state
+ * instead of folding it), the evaluation step
+ * (`ExpressionEvaluator.evaluateCondition`, which reports it and answers it as a
+ * fault), the canonical predicate helper (`evalFieldPredicate`, which tags its
+ * reason) and the dev-mode schema validator (which still refuses it). ⛔ Not
+ * re-exported from the package entry: it is the internal definition those four
+ * share, not public API.
+ *
+ * ⚠️ No client-side reading of what an `ast` MEANT: the client evaluates
+ * `source` text only, so an `ast` with no `source` is not evaluable here,
+ * whatever it says.
+ */
+export function isUnevaluablePredicate(value) {
+    if (value === null || value === undefined)
+        return false;
+    if (typeof value === 'boolean' || typeof value === 'string')
+        return false;
+    if (typeof value === 'object') {
+        return typeof value.source !== 'string';
+    }
+    // A number (`0` included — it is present, not absent), a function, a symbol
+    // or a bigint: nothing a predicate is spelled as.
+    return true;
+}
+/**
+ * The `reason` reported for a gate that is declared but cannot be evaluated,
+ * tagged like an engine reason (`[parse]`, `[type]`, `[blank]`) because it
+ * travels the same two channels — `evalFieldPredicate`'s one-time warning and
+ * its `onFault` passback — and a caller that routes on the tag must tell it
+ * apart from a predicate that faulted with text in it: the fix is to give the
+ * gate a `source` (or delete it), never to debug CEL syntax.
+ */
+export const UNEVALUABLE_PREDICATE_REASON = '[unevaluable] the gate is declared but has no `source` to evaluate (an ' +
+    '`ast`-only envelope, a number, an object or an array) — it fails in the ' +
+    'direction its key fails on any fault';

package/dist/index.d.ts

@@ -8,6 +8,7 @@
 export type { SchemaNode, ComponentRendererProps } from './types/index.js';
 export * from './registry/Registry.js';
 export * from './registry/public-blocks.js';
+export * from './registry/html-tier-intrinsics.js';
 export * from './registry/PluginSystem.js';
 export * from './registry/PluginScopeImpl.js';
 export * from './registry/WidgetRegistry.js';
@@ -16,10 +17,14 @@ export * from './builder/schema-builder.js';
 export * from './utils/dom-props.js';
 export * from './utils/filter-converter.js';
 export * from './utils/managedBy.js';
+export * from './utils/affordanceGrants.js';
 export * from './utils/extract-records.js';
+export * from './utils/non-grid-row-ceiling.js';
+export * from './utils/emptiness.js';
 export * from './utils/expand-fields.js';
 export * from './utils/retired-field-types.js';
 export * from './utils/unmaterialized-fields.js';
+export * from './utils/column-sortability.js';
 export * from './utils/column-identity.js';
 export * from './utils/sort-values.js';
 export * from './utils/sort-query.js';
@@ -51,14 +56,24 @@ export * from './utils/dashboard-filters.js';
 export * from './utils/merge-filters.js';
 export * from './utils/compare-to.js';
 export * from './utils/chart-series.js';
+export * from './utils/chart-measure-key.js';
+export * from './utils/chart-category-key.js';
+export * from './utils/object-aggregate-query.js';
 export * from './utils/chart-presentation.js';
 export * from './utils/number-display.js';
+export * from './utils/date-display.js';
+export * from './utils/native-date-value.js';
 export * from './utils/dataset-format.js';
 export * from './utils/dataset-pivot.js';
 export * from './utils/record-title.js';
+export * from './utils/record-color.js';
 export * from './utils/export-filename.js';
 export * from './utils/reference-keys.js';
 export * from './utils/predicate-record.js';
+export * from './utils/without-denied-fields.js';
+export * from './utils/parent-scope.js';
 export * from './utils/predicate-fields.js';
+export * from './utils/grouping-fields.js';
 export * from './utils/normalize-list-view.js';
+export * from './utils/record-source.js';
 export * from './utils/humanize-label.js';