@object-ui/core 3.1.5 → 3.3.0

package/dist/evaluator/index.d.ts

@@ -9,3 +9,4 @@ export * from './ExpressionContext.js';
 export * from './ExpressionEvaluator.js';
 export * from './ExpressionCache.js';
 export * from './FormulaFunctions.js';
+export * from './SafeExpressionParser.js';

package/dist/evaluator/index.js

@@ -9,3 +9,4 @@ export * from './ExpressionContext.js';
 export * from './ExpressionEvaluator.js';
 export * from './ExpressionCache.js';
 export * from './FormulaFunctions.js';
+export * from './SafeExpressionParser.js';

package/dist/protocols/DndProtocol.js

@@ -35,16 +35,10 @@ export function resolveDndConfig(config) {
  * @returns Component props object for a draggable element
  */
 export function createDragItemProps(item) {
-    const ariaLabel = typeof item.ariaLabel === 'string'
-        ? item.ariaLabel
-        : item.ariaLabel?.defaultValue;
-    const label = typeof item.label === 'string'
-        ? item.label
-        : item.label?.defaultValue;
     return {
         draggable: !(item.disabled ?? false),
         'aria-roledescription': 'draggable',
-        'aria-label': ariaLabel ?? label,
+        'aria-label': item.ariaLabel ?? item.label,
         'aria-describedby': item.ariaDescribedBy,
         role: item.role ?? 'listitem',
         'data-drag-type': item.type,
@@ -63,15 +57,9 @@ export function createDragItemProps(item) {
  * @returns Component props object for a droppable area
  */
 export function createDropZoneProps(zone) {
-    const ariaLabel = typeof zone.ariaLabel === 'string'
-        ? zone.ariaLabel
-        : zone.ariaLabel?.defaultValue;
-    const label = typeof zone.label === 'string'
-        ? zone.label
-        : zone.label?.defaultValue;
     return {
         'aria-dropeffect': zone.dropEffect ?? 'move',
-        'aria-label': ariaLabel ?? label,
+        'aria-label': zone.ariaLabel ?? zone.label,
         'aria-describedby': zone.ariaDescribedBy,
         role: zone.role ?? 'list',
         'data-drop-accept': zone.accept.join(','),

package/dist/protocols/KeyboardProtocol.js

@@ -15,14 +15,11 @@
  * @returns Fully resolved keyboard navigation configuration
  */
 export function resolveKeyboardConfig(config) {
-    const ariaLabel = typeof config.ariaLabel === 'string'
-        ? config.ariaLabel
-        : config.ariaLabel?.defaultValue;
     return {
         shortcuts: config.shortcuts ?? [],
         focusManagement: resolveFocusManagement(config.focusManagement),
         rovingTabindex: config.rovingTabindex ?? false,
-        ariaLabel,
+        ariaLabel: config.ariaLabel,
         ariaDescribedBy: config.ariaDescribedBy,
         role: config.role,
     };

package/dist/protocols/NotificationProtocol.js

@@ -65,16 +65,6 @@ export function resolveNotificationConfig(config) {
 // ============================================================================
 // Spec Notification → Toast
 // ============================================================================
-/**
- * Extract the display string from a translatable value (string or Translation object).
- */
-function resolveTranslatableString(value) {
-    if (value === undefined)
-        return undefined;
-    if (typeof value === 'string')
-        return value;
-    return value.defaultValue;
-}
 /**
  * Convert a spec Notification to a toast-compatible object.
  *
@@ -83,13 +73,13 @@ function resolveTranslatableString(value) {
  */
 export function specNotificationToToast(notification) {
     const actions = (notification.actions ?? []).map((a) => ({
-        label: typeof a.label === 'string' ? a.label : a.label?.defaultValue ?? '',
+        label: a.label,
         action: a.action,
         variant: a.variant ?? 'primary',
     }));
     return {
-        title: resolveTranslatableString(notification.title),
-        description: resolveTranslatableString(notification.message) ?? '',
+        title: notification.title,
+        description: notification.message ?? '',
         variant: mapSeverityToVariant(notification.severity ?? 'info'),
         position: mapPosition(notification.position ?? 'top_right'),
         duration: notification.duration ?? 5000,

package/dist/utils/debug.js

@@ -66,7 +66,8 @@ export function isDebugEnabled() {
         if (g === true || g === 'true')
             return true;
         // 3. process.env
-        if (typeof process !== 'undefined' && process.env?.OBJECTUI_DEBUG === 'true')
+        const proc = globalThis.process;
+        if (proc?.env?.OBJECTUI_DEBUG === 'true')
             return true;
         return false;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/core",
-  "version": "3.1.5",
+  "version": "3.3.0",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",
@@ -25,14 +25,14 @@
     }
   },
   "dependencies": {
-    "@objectstack/spec": "^3.3.0",
-    "lodash": "^4.17.23",
+    "@objectstack/spec": "^4.0.3",
+    "lodash": "^4.18.1",
     "zod": "^4.3.6",
-    "@object-ui/types": "3.1.5"
+    "@object-ui/types": "3.3.0"
   },
   "devDependencies": {
-    "typescript": "^5.9.3",
-    "vitest": "^4.1.0"
+    "typescript": "^6.0.2",
+    "vitest": "^4.1.4"
   },
   "scripts": {
     "build": "tsc",

package/src/__tests__/protocols/DndProtocol.test.ts

@@ -82,10 +82,10 @@ describe('DndProtocol', () => {
       expect(props['aria-label']).toBe('Aria Label');
     });
 
-    it('should handle translation object for ariaLabel', () => {
+    it('should use ariaLabel when provided as string', () => {
       const item = {
         type: 'card',
-        ariaLabel: { key: 'drag.label', defaultValue: 'Translated label' },
+        ariaLabel: 'Translated label',
       } as unknown as DragItem;
       const props = createDragItemProps(item);
 
@@ -131,10 +131,10 @@ describe('DndProtocol', () => {
       expect(props['data-drop-max-items']).toBe(10);
     });
 
-    it('should handle ariaLabel as translation object', () => {
+    it('should use ariaLabel string when provided', () => {
       const zone = {
         accept: ['card'],
-        ariaLabel: { key: 'drop.label', defaultValue: 'Drop here' },
+        ariaLabel: 'Drop here',
       } as unknown as DropZone;
       const props = createDropZoneProps(zone);
 

package/src/__tests__/protocols/KeyboardProtocol.test.ts

@@ -32,9 +32,9 @@ describe('KeyboardProtocol', () => {
       expect(resolved.ariaLabel).toBe('Navigation');
     });
 
-    it('should resolve ariaLabel from translation object', () => {
+    it('should resolve ariaLabel from string', () => {
       const config = {
-        ariaLabel: { key: 'nav.label', defaultValue: 'Nav panel' },
+        ariaLabel: 'Nav panel',
       } as unknown as KeyboardNavigationConfig;
       const resolved = resolveKeyboardConfig(config);
 

package/src/__tests__/protocols/NotificationProtocol.test.ts

@@ -101,10 +101,10 @@ describe('NotificationProtocol', () => {
       expect(toast.actions).toEqual([]);
     });
 
-    it('should handle translation objects for title and message', () => {
+    it('should handle string title and message', () => {
       const notification = {
-        title: { key: 'notify.title', defaultValue: 'Heads up' },
-        message: { key: 'notify.msg', defaultValue: 'Something happened' },
+        title: 'Heads up',
+        message: 'Something happened',
       } as unknown as SpecNotification;
       const toast = specNotificationToToast(notification);
 

package/src/adapters/ValueDataSource.ts

@@ -11,6 +11,7 @@
 
 import type {
   DataSource,
+  MutationEvent,
   QueryParams,
   QueryResult,
   AggregateParams,
@@ -228,6 +229,7 @@ function selectFields<T>(record: T, fields?: string[]): T {
 export class ValueDataSource<T = any> implements DataSource<T> {
   private items: T[];
   private idField: string | undefined;
+  private mutationListeners = new Set<(event: MutationEvent<T>) => void>();
 
   constructor(config: ValueDataSourceConfig<T>) {
     // Deep clone to prevent external mutation
@@ -235,6 +237,13 @@ export class ValueDataSource<T = any> implements DataSource<T> {
     this.idField = config.idField;
   }
 
+  /** Notify all mutation subscribers */
+  private emitMutation(event: MutationEvent<T>): void {
+    for (const listener of this.mutationListeners) {
+      try { listener(event); } catch (err) { console.warn('ValueDataSource: mutation listener error', err); }
+    }
+  }
+
   // -----------------------------------------------------------------------
   // DataSource interface
   // -----------------------------------------------------------------------
@@ -308,6 +317,7 @@ export class ValueDataSource<T = any> implements DataSource<T> {
       (record as any)[field] = `auto_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
     }
     this.items.push(record);
+    this.emitMutation({ type: 'create', resource: _resource, record: { ...record } });
     return { ...record };
   }
 
@@ -323,6 +333,7 @@ export class ValueDataSource<T = any> implements DataSource<T> {
       throw new Error(`ValueDataSource: Record with id "${id}" not found`);
     }
     this.items[index] = { ...this.items[index], ...data };
+    this.emitMutation({ type: 'update', resource: _resource, id, record: { ...this.items[index] } });
     return { ...this.items[index] };
   }
 
@@ -332,6 +343,7 @@ export class ValueDataSource<T = any> implements DataSource<T> {
     );
     if (index === -1) return false;
     this.items.splice(index, 1);
+    this.emitMutation({ type: 'delete', resource: _resource, id });
     return true;
   }
 
@@ -422,6 +434,15 @@ export class ValueDataSource<T = any> implements DataSource<T> {
     });
   }
 
+  // -----------------------------------------------------------------------
+  // Mutation subscription (P2 — Event Bus)
+  // -----------------------------------------------------------------------
+
+  onMutation(callback: (event: MutationEvent<T>) => void): () => void {
+    this.mutationListeners.add(callback);
+    return () => { this.mutationListeners.delete(callback); };
+  }
+
   // -----------------------------------------------------------------------
   // Extra utilities
   // -----------------------------------------------------------------------

package/src/adapters/__tests__/ValueDataSource.test.ts

@@ -470,3 +470,102 @@ describe('ValueDataSource — aggregate', () => {
     expect(result.find((r: any) => r.category === 'B')?.amount).toBe(50);
   });
 });
+
+// ---------------------------------------------------------------------------
+// onMutation (P2 — Event Bus)
+// ---------------------------------------------------------------------------
+
+describe('ValueDataSource — onMutation', () => {
+  it('should emit "create" event when a record is created', async () => {
+    const ds = createDS();
+    const events: any[] = [];
+    ds.onMutation((e) => events.push(e));
+
+    await ds.create('users', { name: 'Zara', age: 40 });
+
+    expect(events).toHaveLength(1);
+    expect(events[0].type).toBe('create');
+    expect(events[0].resource).toBe('users');
+    expect(events[0].record.name).toBe('Zara');
+  });
+
+  it('should emit "update" event when a record is updated', async () => {
+    const ds = createDS();
+    const events: any[] = [];
+    ds.onMutation((e) => events.push(e));
+
+    await ds.update('users', '1', { age: 31 });
+
+    expect(events).toHaveLength(1);
+    expect(events[0].type).toBe('update');
+    expect(events[0].resource).toBe('users');
+    expect(events[0].id).toBe('1');
+    expect(events[0].record.age).toBe(31);
+  });
+
+  it('should emit "delete" event when a record is deleted', async () => {
+    const ds = createDS();
+    const events: any[] = [];
+    ds.onMutation((e) => events.push(e));
+
+    await ds.delete('users', '2');
+
+    expect(events).toHaveLength(1);
+    expect(events[0].type).toBe('delete');
+    expect(events[0].resource).toBe('users');
+    expect(events[0].id).toBe('2');
+    expect(events[0].record).toBeUndefined();
+  });
+
+  it('should not emit "delete" for non-existent record', async () => {
+    const ds = createDS();
+    const events: any[] = [];
+    ds.onMutation((e) => events.push(e));
+
+    await ds.delete('users', '999');
+
+    expect(events).toHaveLength(0);
+  });
+
+  it('should support multiple subscribers', async () => {
+    const ds = createDS();
+    const eventsA: any[] = [];
+    const eventsB: any[] = [];
+    ds.onMutation((e) => eventsA.push(e));
+    ds.onMutation((e) => eventsB.push(e));
+
+    await ds.create('users', { name: 'Multi' });
+
+    expect(eventsA).toHaveLength(1);
+    expect(eventsB).toHaveLength(1);
+  });
+
+  it('should unsubscribe correctly', async () => {
+    const ds = createDS();
+    const events: any[] = [];
+    const unsub = ds.onMutation((e) => events.push(e));
+
+    await ds.create('users', { name: 'Before' });
+    expect(events).toHaveLength(1);
+
+    unsub();
+
+    await ds.create('users', { name: 'After' });
+    expect(events).toHaveLength(1); // No new event
+  });
+
+  it('should emit events for bulk operations', async () => {
+    const ds = createDS();
+    const events: any[] = [];
+    ds.onMutation((e) => events.push(e));
+
+    await ds.bulk!('users', 'create', [
+      { name: 'Bulk1' },
+      { name: 'Bulk2' },
+    ]);
+
+    // Bulk create calls create() for each item
+    expect(events).toHaveLength(2);
+    expect(events.every((e: any) => e.type === 'create')).toBe(true);
+  });
+});

package/src/errors/index.ts

@@ -120,8 +120,8 @@ export class ObjectUIError extends Error {
     this.name = 'ObjectUIError';
 
     // Maintains proper stack trace for where error was thrown (only in V8)
-    if (Error.captureStackTrace) {
-      Error.captureStackTrace(this, this.constructor);
+    if ((Error as any).captureStackTrace) {
+      (Error as any).captureStackTrace(this, this.constructor);
     }
   }
 
@@ -203,7 +203,7 @@ function interpolate(
   params: Record<string, string>,
 ): string {
   return template.replace(/\$\{(\w+)\}/g, (_match, key: string) => {
-    if (!(key in params) && typeof process !== 'undefined' && process.env?.NODE_ENV !== 'production') {
+    if (!(key in params) && (globalThis as any).process?.env?.NODE_ENV !== 'production') {
       console.warn(`[ObjectUI] Missing interpolation parameter "${key}" in error message template.`);
     }
     return params[key] ?? `\${${key}}`;
@@ -254,8 +254,7 @@ export function createError(
  */
 export function formatErrorMessage(
   error: ObjectUIError,
-  isDev: boolean = typeof process !== 'undefined' &&
-    process.env?.NODE_ENV !== 'production',
+  isDev: boolean = (globalThis as any).process?.env?.NODE_ENV !== 'production',
 ): string {
   const entry = ERROR_CODES[error.code];
 

package/src/evaluator/ExpressionCache.ts

@@ -8,14 +8,16 @@
 
 /**
  * @object-ui/core - Expression Cache
- * 
+ *
  * Caches compiled expressions to avoid re-parsing on every render.
  * Provides significant performance improvement for frequently evaluated expressions.
- * 
+ *
  * @module evaluator
  * @packageDocumentation
  */
 
+import { SafeExpressionParser } from './SafeExpressionParser.js';
+
 /**
  * A compiled expression function that can be executed with context values
  */
@@ -112,16 +114,28 @@ export class ExpressionCache {
   }
   
   /**
-   * Compile an expression into a function
+   * Compile an expression into a CSP-safe callable function.
+   *
+   * Uses `SafeExpressionParser` — a recursive-descent interpreter — instead of
+   * `new Function()` so that the expression engine works under strict
+   * Content Security Policy headers that forbid `'unsafe-eval'`.
+   *
+   * A single parser instance is created per compiled expression and reused
+   * across all invocations of the returned closure (`evaluate()` resets all
+   * internal state on every call), avoiding repeated allocations on hot paths.
    */
   private compileExpression(expression: string, varNames: string[]): CompiledExpression {
-    // SECURITY NOTE: Using Function constructor for expression evaluation.
-    // This is a controlled use case with:
-    // 1. Sanitization check (isDangerous) performed by caller
-    // 2. Strict mode enabled ("use strict")
-    // 3. Limited scope (only varNames variables available)
-    // 4. No access to global objects (process, window, etc.)
-    return new Function(...varNames, `"use strict"; return (${expression});`) as CompiledExpression;
+    // One parser per compiled expression — reused across hot-path calls.
+    const parser = new SafeExpressionParser();
+
+    return (...args: unknown[]) => {
+      // Reconstruct the named variable context from positional arguments.
+      const context: Record<string, unknown> = {};
+      for (let i = 0; i < varNames.length; i++) {
+        context[varNames[i]] = args[i];
+      }
+      return parser.evaluate(expression, context);
+    };
   }
   
   /**