@object-ui/core 17.6.0 → 18.0.0

package/dist/utils/without-denied-fields.d.ts

@@ -0,0 +1,49 @@
+/**
+ * ObjectUI — the field-read rule for a single record
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * The two members of a loaded permission policy the field-read rule asks.
+ *
+ * Structural on purpose: `usePermissions()` from `@object-ui/permissions`
+ * satisfies it as it is, and so does any caller-supplied policy of the same
+ * shape, so this package depends on neither React nor the permissions package.
+ */
+interface FieldReadPolicy {
+    /** False until a policy has loaded; also false with no provider mounted. */
+    readonly isLoaded: boolean;
+    /** May the viewer READ `field` on `object`? */
+    checkField(object: string, field: string, action: 'read'): boolean;
+}
+/**
+ * `record` as the viewer may READ it on `objectName`: every field the loaded
+ * `policy` denies is removed, which leaves the row ObjectStack's `FieldMasker`
+ * already serves (objectui#10594).
+ *
+ * The renderer-side field-level-security rulings (objectui#7215 /
+ * objectui#7230) say FLS gates the OUTPUT: a value the loaded policy denies is
+ * not drawn, even when a backend serves it. Every surface that builds a display
+ * value from a whole row (a record title, a lookup label, a search-hit label, a
+ * person's name) calls this one function, so a denied field reads as an absent
+ * field on every surface at once, and the display ladder falls through to its
+ * next source exactly as it does for the stripped row. Field-LIST filters (which
+ * columns to head, which relations to `$expand`) are a different shape and are
+ * not this function.
+ *
+ * - `id` and `_id` are never judged, nor is any key in `extraKeep` (a declared
+ *   id field): an id addresses the record and is not a field value the policy
+ *   withholds, and the `Record #<id>` floor reads it.
+ * - Before a policy loads, with no policy, with no object to judge the fields
+ *   against, or for a value that is not an object, `record` comes back as it
+ *   is.
+ * - When nothing is withheld, the SAME object comes back, so a caller can tell
+ *   "nothing withheld" from "something withheld" by identity and a cache keyed
+ *   on the served row keeps hitting.
+ *
+ * Pure: it reads `policy.checkField` and never writes to `record`.
+ */
+export declare function withoutDeniedFields<T>(record: T, policy: FieldReadPolicy | null | undefined, objectName: string | undefined, extraKeep?: readonly string[]): T;
+export {};

package/dist/utils/without-denied-fields.js

@@ -0,0 +1,52 @@
+/**
+ * ObjectUI — the field-read rule for a single record
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * `record` as the viewer may READ it on `objectName`: every field the loaded
+ * `policy` denies is removed, which leaves the row ObjectStack's `FieldMasker`
+ * already serves (objectui#10594).
+ *
+ * The renderer-side field-level-security rulings (objectui#7215 /
+ * objectui#7230) say FLS gates the OUTPUT: a value the loaded policy denies is
+ * not drawn, even when a backend serves it. Every surface that builds a display
+ * value from a whole row (a record title, a lookup label, a search-hit label, a
+ * person's name) calls this one function, so a denied field reads as an absent
+ * field on every surface at once, and the display ladder falls through to its
+ * next source exactly as it does for the stripped row. Field-LIST filters (which
+ * columns to head, which relations to `$expand`) are a different shape and are
+ * not this function.
+ *
+ * - `id` and `_id` are never judged, nor is any key in `extraKeep` (a declared
+ *   id field): an id addresses the record and is not a field value the policy
+ *   withholds, and the `Record #<id>` floor reads it.
+ * - Before a policy loads, with no policy, with no object to judge the fields
+ *   against, or for a value that is not an object, `record` comes back as it
+ *   is.
+ * - When nothing is withheld, the SAME object comes back, so a caller can tell
+ *   "nothing withheld" from "something withheld" by identity and a cache keyed
+ *   on the served row keeps hitting.
+ *
+ * Pure: it reads `policy.checkField` and never writes to `record`.
+ */
+export function withoutDeniedFields(record, policy, objectName, extraKeep) {
+    if (!policy?.isLoaded || !objectName || !record || typeof record !== 'object')
+        return record;
+    const shown = {};
+    let withheld = false;
+    for (const [key, value] of Object.entries(record)) {
+        if (key === 'id' ||
+            key === '_id' ||
+            extraKeep?.includes(key) ||
+            policy.checkField(objectName, key, 'read')) {
+            shown[key] = value;
+        }
+        else {
+            withheld = true;
+        }
+    }
+    return withheld ? shown : record;
+}

package/dist/validation/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * @object-ui/core - Validation Module
  *
- * Phase 3.5: Validation engine
+ * Phase 3.5: Validation module
  *
  * Object-level validation. The rule vocabulary is owned by
  * `@objectstack/spec/data` and derived in `@object-ui/types`; canonicity is
@@ -9,11 +9,15 @@
  *
  * The object-level rule ENGINE (`validators/`) is @deprecated (#3110) — the
  * server is the single implementation of rule enforcement. Field/record SHAPE
- * validation (`schema-validator.js`, `validation-engine.js`) is unaffected: it
- * is client-side form validation, not a mirror of a server rule.
+ * validation (`schema-validator.js`) is unaffected: it is client-side form
+ * validation, not a mirror of a server rule.
+ *
+ * The field-rule engine that once sat beside it (`ValidationEngine`, a second
+ * snake_case rule vocabulary no renderer consumed) was retired under ADR-0049
+ * enforce-or-remove (objectui#7659). Client-side field rules are compiled by
+ * `buildValidationRules` in `@object-ui/fields`.
  */
 export * from './required-presence.js';
 export * from './server-owned-value.js';
-export * from './validation-engine.js';
 export * from './schema-validator.js';
 export * from './validators/index.js';

package/dist/validation/index.js

@@ -1,7 +1,7 @@
 /**
  * @object-ui/core - Validation Module
  *
- * Phase 3.5: Validation engine
+ * Phase 3.5: Validation module
  *
  * Object-level validation. The rule vocabulary is owned by
  * `@objectstack/spec/data` and derived in `@object-ui/types`; canonicity is
@@ -9,11 +9,15 @@
  *
  * The object-level rule ENGINE (`validators/`) is @deprecated (#3110) — the
  * server is the single implementation of rule enforcement. Field/record SHAPE
- * validation (`schema-validator.js`, `validation-engine.js`) is unaffected: it
- * is client-side form validation, not a mirror of a server rule.
+ * validation (`schema-validator.js`) is unaffected: it is client-side form
+ * validation, not a mirror of a server rule.
+ *
+ * The field-rule engine that once sat beside it (`ValidationEngine`, a second
+ * snake_case rule vocabulary no renderer consumed) was retired under ADR-0049
+ * enforce-or-remove (objectui#7659). Client-side field rules are compiled by
+ * `buildValidationRules` in `@object-ui/fields`.
  */
 export * from './required-presence.js';
 export * from './server-owned-value.js';
-export * from './validation-engine.js';
 export * from './schema-validator.js';
 export * from './validators/index.js';

package/dist/validation/schema-validator.d.ts

@@ -69,7 +69,7 @@ export interface SchemaNodeValidationResult {
  * }
  * ```
  */
-export declare function validateSchema(schema: any, path?: string): SchemaNodeValidationResult;
+export declare function validateSchema(schema: unknown, path?: string): SchemaNodeValidationResult;
 /**
  * Assert that a schema is valid, throwing an error if not
  *

package/dist/validation/schema-validator.js

@@ -5,6 +5,83 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  */
+import { nodeSlotValues, nodeSlotsFor } from '@object-ui/types';
+import { hasDeclaredPredicate } from '../evaluator/declaredPredicate.js';
+import { isUnevaluablePredicate } from '../evaluator/unevaluablePredicate.js';
+/**
+ * The rule for a PREDICATE GATE key (`visible` / `disabled`) — objectui#6505.
+ *
+ * ## What this rule used to say, and what it cost
+ *
+ * Both keys read `typeof value === 'boolean'`, message `"<key> must be a
+ * boolean"`. Both keys are EXPRESSIONS everywhere else in the system: AGENTS.md
+ * §4 declares the protocol as `hidden?: string; // expression` /
+ * `disabled?: string; // expression`, `SchemaRenderer` evaluates them through
+ * `hasDeclaredPredicate` + `evaluateCondition`, `@objectstack/spec` normalizes
+ * every authored predicate into a `{ dialect, source }` envelope, and the
+ * objectui#3862 / objectui#3955 rulings are entirely about which EXPRESSION
+ * spellings count as declared. So the node the docs teach —
+ * `{ type: 'button', disabled: "${record.stage == 'closed'}" }` — was reported
+ * `disabled must be a boolean` by the dev-mode validator and its host element
+ * got `data-obj-schema-invalid`, the cue apps hang a red outline off.
+ *
+ * `BASE_SCHEMA_RULES` was the ONE place in the repo that disagreed with the
+ * protocol, so this restores declared = enforced rather than widening a
+ * contract: the accept set moves to exactly what the runtime already accepts.
+ *
+ * ## Why `hasDeclaredPredicate` and not a check written here
+ *
+ * `evaluator/declaredPredicate.ts` is the repo's single definition of "is a
+ * predicate gate DECLARED on this value?" (objectui#3850's ruling; nothing in
+ * the repo asks that question anywhere else). A second, hand-rolled answer in
+ * this table is how the validator and the renderer come to disagree about the
+ * same value — which is the defect class this rule was already an instance of.
+ * The delegation is behavioural, so it is pinned behaviourally: the drift pin in
+ * `__tests__/predicate-valued-gate-rules.test.ts` asserts this rule's verdict
+ * equals `boolean || (declared && !unevaluable)` across every probe — the second
+ * half since objectui#11358, see below.
+ *
+ * ## Why the boolean arm survives even though it is subsumed
+ *
+ * `hasDeclaredPredicate(true)` and `hasDeclaredPredicate(false)` are both
+ * `true` today (`toPredicateInput` returns a boolean unchanged), so the first
+ * arm changes no verdict. It is kept because it makes this rule's accept set a
+ * provable SUPERSET of the one it replaces, locally: a future narrowing on the
+ * declaredness side cannot silently start reporting `disabled: false` — the
+ * most explicit gate an author can write — as an invalid schema.
+ *
+ * ## What it still REFUSES (the half that is not negotiable)
+ *
+ * `null`, `''`, whitespace-only predicate text and the empty / blank-`source`
+ * envelope (objectui#3960) — what `hasDeclaredPredicate` calls "not declared" —
+ * and a value that IS declared but cannot be evaluated: a number, `{}`, an
+ * array, an envelope with no string `source` (`isUnevaluablePredicate`).
+ * Every one of those was refused before this change too — the accept set
+ * widens and nothing refused becomes accepted. Dropping the two keys from this
+ * table was the option this fix was explicitly forbidden to take: an absent
+ * rule reports nothing at all, which is gate weakening wearing the same green.
+ *
+ * ## Why "declared" alone stopped being this rule's answer (objectui#11358)
+ *
+ * Until objectui#11358 every declared gate was also an evaluable one, so
+ * "declared" answered both questions. That ruling made a present value with no
+ * evaluable `source` DECLARED (and faulting) so that the runtime fails it in
+ * its key's fault direction instead of reading it as no gate — and this rule
+ * asks a different question, "is this a predicate the runtime can evaluate?".
+ * Reading `hasDeclaredPredicate` alone would have widened the accept set to
+ * exactly the shapes that ruling exists to stop. So the rule refuses the
+ * unevaluable state by the same internal definition the runtime uses for it,
+ * not by a list written here.
+ */
+function predicateGateRule(key) {
+    return {
+        required: false,
+        validate: (value) => typeof value === 'boolean' || (!isUnevaluablePredicate(value) && hasDeclaredPredicate(value)),
+        message: `${key} must be a boolean or a declared predicate: an expression string ` +
+            `(bare, e.g. "record.stage == 'closed'", or the "\${...}" template ` +
+            `spelling), or a { dialect, source } expression envelope`,
+    };
+}
 /**
  * Validation rules for base schema
  */
@@ -24,31 +101,39 @@ const BASE_SCHEMA_RULES = {
         validate: (value) => typeof value === 'string',
         message: 'className must be a string'
     },
-    visible: {
-        required: false,
-        validate: (value) => typeof value === 'boolean',
-        message: 'visible must be a boolean'
-    },
-    disabled: {
-        required: false,
-        validate: (value) => typeof value === 'boolean',
-        message: 'disabled must be a boolean'
-    }
+    // objectui#6505 — both keys are EXPRESSIONS in the protocol, not booleans.
+    // See `predicateGateRule` above for the accept set and what it still refuses.
+    visible: predicateGateRule('visible'),
+    disabled: predicateGateRule('disabled')
 };
+/**
+ * The ONE narrowing between {@link validateSchema}'s `unknown` parameter and
+ * every rule below it (objectui#8416).
+ *
+ * The VERDICT is the guard this replaces, spelled the same way: the
+ * `!schema || typeof schema !== 'object'` test that used to sit at the top of
+ * `validateBaseSchema`. `null`, `undefined` and every primitive are refused;
+ * arrays and plain objects pass, exactly as before.
+ *
+ * What changes is WHERE it runs. Only ONE of the four rules ever had it, and
+ * `validateSchema` calls all four unconditionally: `validateFormSchema` read
+ * `schema.type` and `validateChildren` read `schema.children` with no guard at
+ * all, so `validateSchema(null)` and `validateSchema(undefined)` threw a raw
+ * `TypeError: Cannot read properties of null (reading 'type')` — measured on
+ * 256c709e2 — instead of returning the `INVALID_SCHEMA` result this function's
+ * own contract promises, and `isValidSchema(null)` threw instead of answering
+ * `false`. `SchemaRenderer` wraps its call in a `try`/`catch` whose comment
+ * reads "Validator itself failed — surface but don't crash render"; that catch
+ * is where the crash was landing.
+ */
+function isSchemaNodeShape(value) {
+    return !!value && typeof value === 'object';
+}
 /**
  * Validate a schema against base rules
  */
 function validateBaseSchema(schema, path = 'schema') {
     const errors = [];
-    if (!schema || typeof schema !== 'object') {
-        errors.push({
-            path,
-            message: 'Schema must be an object',
-            type: 'error',
-            code: 'INVALID_SCHEMA'
-        });
-        return errors;
-    }
     // Validate required and optional properties
     Object.entries(BASE_SCHEMA_RULES).forEach(([key, rule]) => {
         const value = schema[key];
@@ -72,56 +157,66 @@ function validateBaseSchema(schema, path = 'schema') {
     return errors;
 }
 /**
- * Validate CRUD schema specific properties
+ * TOMBSTONE table — node `type` spellings this renderer has RETIRED, mapped to
+ * the prescription an author must follow instead (ADR-0049 enforce-or-remove).
+ *
+ * A retired spelling is not merely absent from this file. Absence here means
+ * {@link validateSchema} runs `validateBaseSchema` — which only asks that
+ * `type` be a non-empty string — finds nothing type-specific to say, and
+ * returns `valid: true`. That silence is the failure mode this table exists to
+ * prevent: the author is told their schema is fine and then gets the OBJUI-001
+ * "Unknown component type" panel at render time, one layer too late to act on.
+ * So a retired spelling is refused BY NAME, with the migration in the message.
+ *
+ * `crud` (objectui#5373, maintainer ruling of 2026-08-20): `CRUDSchema` carried
+ * FOUR declaration faces — the TS interface, the zod mirror, a dedicated branch
+ * in this very function, and `CRUDBuilder` — and never once had a registered
+ * renderer, for the whole life of the key. Every face taught an author (and an
+ * AI author reading the published reference page) that the type existed. The
+ * branch that used to sit here is what made this validator the loudest of the
+ * four lies: it read `schema.type === 'crud'`, checked that `columns` was an
+ * array, and returned no error — an affirmative "your CRUD schema is valid"
+ * for a node that renders nothing.
+ *
+ * Keyed by the authored spelling, and quantified over the table rather than
+ * written per spelling, so the next retirement closes this face the day it
+ * lands here.
  */
-function validateCRUDSchema(schema, path = 'schema') {
-    const errors = [];
-    if (schema.type === 'crud') {
-        // Check required properties for CRUD
-        if (!schema.columns || !Array.isArray(schema.columns)) {
-            errors.push({
-                path: `${path}.columns`,
-                message: 'CRUD schema requires columns array',
-                type: 'error',
-                code: 'MISSING_COLUMNS'
-            });
-        }
-        if (!schema.api && !schema.dataSource) {
-            errors.push({
-                path: `${path}.api`,
-                message: 'CRUD schema requires api or dataSource',
-                type: 'warning',
-                code: 'MISSING_DATA_SOURCE'
-            });
-        }
-        // Validate columns
-        if (schema.columns && Array.isArray(schema.columns)) {
-            schema.columns.forEach((column, index) => {
-                if (!column.name) {
-                    errors.push({
-                        path: `${path}.columns[${index}]`,
-                        message: 'Column requires name property',
-                        type: 'error',
-                        code: 'MISSING_COLUMN_NAME'
-                    });
-                }
-            });
-        }
-        // Validate fields if present
-        if (schema.fields && Array.isArray(schema.fields)) {
-            schema.fields.forEach((field, index) => {
-                if (!field.name) {
-                    errors.push({
-                        path: `${path}.fields[${index}]`,
-                        message: 'Field requires name property',
-                        type: 'error',
-                        code: 'MISSING_FIELD_NAME'
-                    });
-                }
-            });
-        }
-    }
-    return errors;
+const RETIRED_NODE_TYPES = Object.freeze({
+    crud: "Node type `crud` was RETIRED (objectui#5373, ADR-0049 enforce-or-remove). " +
+        "`CRUDSchema` declared it in four places and no renderer ever registered it, " +
+        "so a node spelling it painted the OBJUI-001 \"Unknown component type\" panel. " +
+        "Compose the shapes that DO render instead: `object-grid` for the record " +
+        "table with its toolbar, filters, pagination and row/batch actions, " +
+        "`object-form` for the create/edit form, and `detail` for the record view.",
+});
+/**
+ * Refuse a retired node-type spelling by name.
+ *
+ * Severity is `error`, not `warning`, and that is the whole point of the
+ * retirement: a warning leaves `result.valid === true`, so `assertValidSchema`
+ * would still not throw and `isValidSchema` would still answer `true` — the
+ * same silence, one console line louder.
+ *
+ * `hasOwnProperty` rather than a plain index read: a `type` of `'constructor'`
+ * or `'toString'` reaches `Object.prototype` and would answer truthy.
+ *
+ * Reached for every node in the tree, not just the root — {@link validateSchema}
+ * is what `validateChildren` recurses with, so a retired spelling nested inside
+ * a `children` array is refused with its own path.
+ */
+function validateRetiredNodeType(schema, path = 'schema') {
+    const type = schema.type;
+    if (typeof type !== 'string')
+        return [];
+    if (!Object.prototype.hasOwnProperty.call(RETIRED_NODE_TYPES, type))
+        return [];
+    return [{
+            path: `${path}.type`,
+            message: RETIRED_NODE_TYPES[type],
+            type: 'error',
+            code: 'RETIRED_TYPE'
+        }];
 }
 /**
  * The ONE namespace a form field's widget id may name — objectui#5254,
@@ -228,8 +323,15 @@ function validateFieldWidgetNamespace(field, path) {
 function validateFormSchema(schema, path = 'schema') {
     const errors = [];
     if (schema.type === 'form') {
-        if (schema.fields && Array.isArray(schema.fields)) {
-            schema.fields.forEach((field, index) => {
+        const fields = schema.fields;
+        if (Array.isArray(fields)) {
+            fields.forEach((entry, index) => {
+                // Narrowed before it is read, for the same reason the root is: a
+                // `fields` array is authored data too, and reading `field.name` off
+                // whatever an author put there made `fields: [null]` throw the same raw
+                // `TypeError` a `null` root did. A non-object entry keeps its old
+                // verdict — every key reads `undefined`, so `MISSING_FIELD_NAME`.
+                const field = isSchemaNodeShape(entry) ? entry : {};
                 if (!field.name) {
                     errors.push({
                         path: `${path}.fields[${index}]`,
@@ -245,11 +347,11 @@ function validateFormSchema(schema, path = 'schema') {
                     errors.push(namespaceError);
                 }
                 // Check for duplicate field names
-                const duplicates = schema.fields.filter((f) => f.name === field.name);
+                const duplicates = fields.filter((other) => (isSchemaNodeShape(other) ? other.name : undefined) === field.name);
                 if (duplicates.length > 1) {
                     errors.push({
                         path: `${path}.fields[${index}]`,
-                        message: `Duplicate field name: ${field.name}`,
+                        message: `Duplicate field name: ${String(field.name)}`,
                         type: 'warning',
                         code: 'DUPLICATE_FIELD_NAME'
                     });
@@ -259,26 +361,53 @@ function validateFormSchema(schema, path = 'schema') {
     }
     return errors;
 }
+/** `schema.items[0].content[1]`: the child's path, spelled the way `children[0]` already is. */
+function spellSlotPath(path, segments) {
+    return segments.reduce((spelled, segment) => (typeof segment === 'number' ? `${spelled}[${segment}]` : `${spelled}.${segment}`), path);
+}
 /**
- * Validate child schemas recursively
+ * Validate child schemas recursively: what `children` holds on every node,
+ * and what the node slots declared for this node's type hold.
  */
 function validateChildren(schema, path = 'schema') {
     const errors = [];
-    const children = schema.children || schema.body;
+    // One child-list spelling. This walker resolved `children || body` for ANY
+    // node type, so it outlived every per-registration read of the dialect —
+    // objectui#6771 retired it, and a recursive validator that still descended
+    // `body` on every node would keep validating a child list no renderer puts
+    // on the page.
+    const children = schema.children;
     if (children) {
         if (Array.isArray(children)) {
             children.forEach((child, index) => {
-                if (typeof child === 'object' && child !== null) {
+                if (isSchemaNodeShape(child)) {
                     const childResult = validateSchema(child, `${path}.children[${index}]`);
                     errors.push(...childResult.errors, ...childResult.warnings);
                 }
             });
         }
-        else if (typeof children === 'object' && children !== null) {
+        else if (isSchemaNodeShape(children)) {
             const childResult = validateSchema(children, `${path}.children`);
             errors.push(...childResult.errors, ...childResult.warnings);
         }
     }
+    // The node slots THIS type's renderer reads — a dialog's `trigger`, a tab
+    // item's `content`, a page's `regions[].components` — from the one
+    // declaration in `@object-ui/types` (`nodeSlotsFor`, objectui#11170), which
+    // the `objectui check` gate and the SDUI parser read too. Per type, never a
+    // second generic spelling: `page:card`'s retired `body` is walked because
+    // that renderer is measured still painting it; `body` on any other type is
+    // not, which is the objectui#6771 line above, kept.
+    if (typeof schema.type === 'string') {
+        for (const slot of nodeSlotsFor(schema.type)) {
+            for (const { segments, value } of nodeSlotValues(schema, slot.path)) {
+                if (!isSchemaNodeShape(value))
+                    continue;
+                const childResult = validateSchema(value, spellSlotPath(path, segments));
+                errors.push(...childResult.errors, ...childResult.warnings);
+            }
+        }
+    }
     return errors;
 }
 /**
@@ -304,13 +433,26 @@ function validateChildren(schema, path = 'schema') {
  */
 export function validateSchema(schema, path = 'schema') {
     const allErrors = [];
-    // Validate base schema
-    allErrors.push(...validateBaseSchema(schema, path));
-    // Validate type-specific schemas
-    allErrors.push(...validateCRUDSchema(schema, path));
-    allErrors.push(...validateFormSchema(schema, path));
-    // Validate children recursively
-    allErrors.push(...validateChildren(schema, path));
+    // Narrow ONCE, here, before any rule reads a key off the value — see
+    // `isSchemaNodeShape`. Every rule below is handed a value already proven to
+    // be an object, which is why none of them re-tests it.
+    if (!isSchemaNodeShape(schema)) {
+        allErrors.push({
+            path,
+            message: 'Schema must be an object',
+            type: 'error',
+            code: 'INVALID_SCHEMA'
+        });
+    }
+    else {
+        // Validate base schema
+        allErrors.push(...validateBaseSchema(schema, path));
+        // Validate type-specific schemas
+        allErrors.push(...validateRetiredNodeType(schema, path));
+        allErrors.push(...validateFormSchema(schema, path));
+        // Validate children recursively
+        allErrors.push(...validateChildren(schema, path));
+    }
     const errors = allErrors.filter(e => e.type === 'error');
     const warnings = allErrors.filter(e => e.type === 'warning');
     return {

package/dist/validation/server-owned-value.d.ts

@@ -21,7 +21,11 @@
  *   2. the create-mode static `required` rule (#4069) —
  *      `isRequiredInForm` in `@object-ui/plugin-form`;
  *   3. the create-mode `requiredWhen` rule (#4085) —
- *      {@link isServerOwnedValue}, read by `resolveFieldRuleState`.
+ *      {@link isServerOwnedValue}, read by `resolveFieldRuleState`;
+ *   4. the "Set automatically when saved." hint (objectui#12108) — the form
+ *      renderer reads the same {@link isServerOwnedValue} answer it hands to
+ *      `resolveFieldRuleState`, so the hint and the lowered `required` are
+ *      one verdict.
  */
 export declare function isRuntimeDefault(v: unknown): boolean;
 /**

package/dist/validation/server-owned-value.js

@@ -67,7 +67,11 @@ function isExpressionEnvelope(v) {
  *   2. the create-mode static `required` rule (#4069) —
  *      `isRequiredInForm` in `@object-ui/plugin-form`;
  *   3. the create-mode `requiredWhen` rule (#4085) —
- *      {@link isServerOwnedValue}, read by `resolveFieldRuleState`.
+ *      {@link isServerOwnedValue}, read by `resolveFieldRuleState`;
+ *   4. the "Set automatically when saved." hint (objectui#12108) — the form
+ *      renderer reads the same {@link isServerOwnedValue} answer it hands to
+ *      `resolveFieldRuleState`, so the hint and the lowered `required` are
+ *      one verdict.
  */
 export function isRuntimeDefault(v) {
     return isRuntimeDefaultToken(v) || isExpressionEnvelope(v);

package/dist/validation/validators/object-validation-engine.d.ts

@@ -186,7 +186,7 @@ export declare class ObjectValidationEngine {
      *   - no `initialStates` declared        → allow (legacy no-op)
      *   - field absent from the write        → allow (requiredness is not our job)
      *   - value empty                        → allow (ditto)
-     *   - value ∉ initialStates              → reject (the FSM entry point, #3165)
+     *   - value ∉ initialStates              → reject (the FSM entry point, objectstack-ai/objectstack#3165)
      *
      *   UPDATE
      *   - field absent from the write        → allow (no transition to police)

package/dist/validation/validators/object-validation-engine.js

@@ -53,7 +53,15 @@ function priorityOf(rule) {
  * Simple expression evaluator using a simple parser (no dynamic code execution)
  *
  * SECURITY: This implementation parses expressions into an AST and evaluates them
- * without using eval() or new Function(). It supports:
+ * without using eval() or new Function(). That is a remediation, not a style
+ * preference: an earlier revision compiled the predicate with
+ * `new Function(...contextKeys, "'use strict'; return (" + expression + ")")`,
+ * and CodeQL flagged it as "Unsafe code constructed from library input" —
+ * expressions reach this class from validation metadata, so that shape is a
+ * code-injection vector in any consumer that renders metadata it does not
+ * control. Never reintroduce eval(), new Function() or any other dynamic-code
+ * path here to buy expressiveness or speed; extend the parser, or inject a
+ * richer evaluator through the constructor (see NOT CEL below). Supports:
  * - Comparison operators: ==, !=, >, <, >=, <=
  * - Logical operators: &&, ||, !
  * - Property access: record.field, record['field']
@@ -72,7 +80,10 @@ function priorityOf(rule) {
  * pre-check agree with the server on richer predicates, pass a CEL-backed
  * `ValidationExpressionEvaluator` to the constructor.
  *
- * @see https://github.com/objectstack-ai/objectui/blob/main/SECURITY_FIX_SUMMARY.md
+ * The write-up this block used to link to (`SECURITY_FIX_SUMMARY.md`) was
+ * deleted with no successor; its load-bearing reasoning is inline above, and
+ * the original text remains readable at
+ * `git show ea72f1886^:SECURITY_FIX_SUMMARY.md`.
  */
 class SimpleExpressionEvaluator {
     evaluate(expression, context) {
@@ -384,7 +395,7 @@ export class ObjectValidationEngine {
      *   - no `initialStates` declared        → allow (legacy no-op)
      *   - field absent from the write        → allow (requiredness is not our job)
      *   - value empty                        → allow (ditto)
-     *   - value ∉ initialStates              → reject (the FSM entry point, #3165)
+     *   - value ∉ initialStates              → reject (the FSM entry point, objectstack-ai/objectstack#3165)
      *
      *   UPDATE
      *   - field absent from the write        → allow (no transition to police)