@objectstack/cli 10.0.0 → 10.2.0

package/dist/utils/schema-migrate.d.ts

@@ -0,0 +1,26 @@
+import type { ManagedDriftEntry, DriftCategory } from '@objectstack/driver-sql';
+export interface SqlDriverLike {
+    detectManagedDrift(): Promise<ManagedDriftEntry[]>;
+    applyMigrationEntries(entries: ManagedDriftEntry[], opts: {
+        allowDestructive?: boolean;
+    }): Promise<{
+        applied: ManagedDriftEntry[];
+        skipped: ManagedDriftEntry[];
+    }>;
+    config?: any;
+    disconnect?: () => Promise<void>;
+}
+export interface SchemaStack {
+    driver: SqlDriverLike | null;
+    dbLabel: string;
+    managedTableCount: number;
+    shutdown: () => Promise<void>;
+}
+/** Boot the schema stack. Caller MUST call `shutdown()` when done. */
+export declare function bootSchemaStack(opts?: {
+    databaseUrl?: string;
+}): Promise<SchemaStack>;
+export declare function groupByCategory(drift: ManagedDriftEntry[]): Record<DriftCategory, ManagedDriftEntry[]>;
+export declare function renderPlan(drift: ManagedDriftEntry[]): void;
+export declare function summarize(drift: ManagedDriftEntry[]): string;
+//# sourceMappingURL=schema-migrate.d.ts.map

package/dist/utils/schema-migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-migrate.d.ts","sourceRoot":"","sources":["../../src/utils/schema-migrate.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAEhF,MAAM,WAAW,aAAa;IAC5B,kBAAkB,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACnD,qBAAqB,CACnB,OAAO,EAAE,iBAAiB,EAAE,EAC5B,IAAI,EAAE;QAAE,gBAAgB,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAAC,OAAO,EAAE,iBAAiB,EAAE,CAAA;KAAE,CAAC,CAAC;IAC3E,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAyCD,sEAAsE;AACtE,wBAAsB,eAAe,CAAC,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CA4B/F;AAYD,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC,aAAa,EAAE,iBAAiB,EAAE,CAAC,CAItG;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAa3D;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAG5D"}

package/dist/utils/schema-migrate.integration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema-migrate.integration.test.d.ts.map

package/dist/utils/schema-migrate.integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-migrate.integration.test.d.ts","sourceRoot":"","sources":["../../src/utils/schema-migrate.integration.test.ts"],"names":[],"mappings":""}

package/dist/utils/schema-migrate.integration.test.js

@@ -0,0 +1,83 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { mkdtempSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { SqlDriver } from '@objectstack/driver-sql';
+import { bootSchemaStack } from './schema-migrate.js';
+/**
+ * End-to-end (#2186): boot the real standalone stack via `bootSchemaStack`
+ * against a pre-seeded "legacy" SQLite DB (organization_id created NOT NULL),
+ * then verify `os migrate`'s engine detects the drift and reconciles it —
+ * exercising the full createStandaloneStack → AppPlugin → ObjectQL → driver path.
+ */
+describe('bootSchemaStack + migrate engine (integration)', () => {
+    let dir;
+    let dbFile;
+    const savedEnv = {};
+    beforeAll(async () => {
+        dir = mkdtempSync(join(tmpdir(), 'os-mig-'));
+        mkdirSync(join(dir, 'dist'), { recursive: true });
+        mkdirSync(join(dir, 'data'), { recursive: true });
+        dbFile = join(dir, 'data', 'app.db');
+        // Compiled-artifact stand-in: id at top level so AppPlugin registers it.
+        writeFileSync(join(dir, 'dist', 'objectstack.json'), JSON.stringify({
+            id: 'mig_smoke',
+            name: 'Migrate Smoke',
+            objects: [
+                {
+                    name: 'mig_biz_unit',
+                    fields: {
+                        name: { type: 'text', required: true },
+                        organization_id: { type: 'text', required: false }, // optional now
+                    },
+                },
+            ],
+        }));
+        // Seed a "legacy" DB where organization_id is NOT NULL (the #2178 shape).
+        const seed = new SqlDriver({ client: 'better-sqlite3', connection: { filename: dbFile }, useNullAsDefault: true });
+        const k = seed.knex;
+        await k.schema.createTable('mig_biz_unit', (t) => {
+            t.string('id').primary();
+            t.timestamp('created_at');
+            t.timestamp('updated_at');
+            t.string('name').notNullable();
+            t.string('organization_id').notNullable();
+        });
+        await k('mig_biz_unit').insert({ id: '1', name: 'Acme', organization_id: 'org1' });
+        await k.destroy();
+        savedEnv.OS_ARTIFACT_PATH = process.env.OS_ARTIFACT_PATH;
+        savedEnv.NODE_ENV = process.env.NODE_ENV;
+        process.env.OS_ARTIFACT_PATH = join(dir, 'dist', 'objectstack.json');
+        process.env.NODE_ENV = 'production'; // ensure no auto-reconcile masks the drift
+    });
+    afterAll(() => {
+        process.env.OS_ARTIFACT_PATH = savedEnv.OS_ARTIFACT_PATH;
+        process.env.NODE_ENV = savedEnv.NODE_ENV;
+        try {
+            rmSync(dir, { recursive: true, force: true });
+        }
+        catch { /* ignore */ }
+    });
+    it('detects the NOT NULL drift, applies it, and self-verifies in-sync', async () => {
+        const stack = await bootSchemaStack({ databaseUrl: `file:${dbFile}` });
+        try {
+            expect(stack.driver).toBeTruthy();
+            expect(stack.managedTableCount).toBeGreaterThan(0);
+            const drift = await stack.driver.detectManagedDrift();
+            const org = drift.find((d) => d.table === 'mig_biz_unit' && d.column === 'organization_id');
+            expect(org, 'expected drift on mig_biz_unit.organization_id').toBeDefined();
+            expect(org.category).toBe('safe');
+            expect(org.op.type).toBe('relax_not_null');
+            const { applied, skipped } = await stack.driver.applyMigrationEntries(drift, { allowDestructive: false });
+            expect(applied.some((d) => d.op.type === 'relax_not_null')).toBe(true);
+            expect(skipped).toHaveLength(0);
+            const after = await stack.driver.detectManagedDrift();
+            expect(after.find((d) => d.table === 'mig_biz_unit' && d.column === 'organization_id')).toBeUndefined();
+        }
+        finally {
+            await stack.shutdown();
+        }
+    }, 30_000);
+});
+//# sourceMappingURL=schema-migrate.integration.test.js.map

package/dist/utils/schema-migrate.integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-migrate.integration.test.js","sourceRoot":"","sources":["../../src/utils/schema-migrate.integration.test.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD;;;;;GAKG;AACH,QAAQ,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC9D,IAAI,GAAW,CAAC;IAChB,IAAI,MAAc,CAAC;IACnB,MAAM,QAAQ,GAAuC,EAAE,CAAC;IAExD,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7C,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAErC,yEAAyE;QACzE,aAAa,CACX,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,kBAAkB,CAAC,EACrC,IAAI,CAAC,SAAS,CAAC;YACb,EAAE,EAAE,WAAW;YACf,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,cAAc;oBACpB,MAAM,EAAE;wBACN,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;wBACtC,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,eAAe;qBACpE;iBACF;aACF;SACF,CAAC,CACH,CAAC;QAEF,0EAA0E;QAC1E,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QACnH,MAAM,CAAC,GAAI,IAAY,CAAC,IAAI,CAAC;QAC7B,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC,CAAM,EAAE,EAAE;YACpD,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACzB,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YAC1B,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC;QACnF,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QAElB,QAAQ,CAAC,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACzD,QAAQ,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC,CAAC,2CAA2C;IAClF,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,EAAE;QACZ,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACzC,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,EAAE,WAAW,EAAE,QAAQ,MAAM,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,CAAC;YAClC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YAEnD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAO,CAAC,kBAAkB,EAAE,CAAC;YACvD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,cAAc,IAAI,CAAC,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC;YAC5F,MAAM,CAAC,GAAG,EAAE,gDAAgD,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5E,MAAM,CAAC,GAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,CAAC,GAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAE5C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,MAAO,CAAC,qBAAqB,CAAC,KAAK,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3G,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvE,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAEhC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAO,CAAC,kBAAkB,EAAE,CAAC;YACvD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,cAAc,IAAI,CAAC,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC1G,CAAC;gBAAS,CAAC;YACT,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;QACzB,CAAC;IACH,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC,CAAC,CAAC"}

package/dist/utils/schema-migrate.js

@@ -0,0 +1,123 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+/**
+ * Shared boot + rendering for `os migrate` (issue #2186).
+ *
+ * Boots the data stack (driver + ObjectQL + the compiled artifact's objects)
+ * via the supported `createStandaloneStack` programmatic entry, runs schema
+ * sync, and hands back the live SQL driver so the command can call
+ * `detectManagedDrift()` / `applyMigrationEntries()`.
+ *
+ * Migration only sees the objects present in the loaded metadata (compiled
+ * artifact). Run `os build` first so your objects are visible; tables/columns
+ * not in the loaded metadata are never examined or altered.
+ */
+import chalk from 'chalk';
+const SQL_DRIVER_SERVICES = [
+    'driver.com.objectstack.driver.sql',
+    'driver.com.objectstack.driver.turso',
+    'driver.sql',
+];
+function findSqlDriver(kernel) {
+    for (const name of SQL_DRIVER_SERVICES) {
+        let d;
+        try {
+            d = kernel?.getService?.(name);
+        }
+        catch { /* not registered */ }
+        if (d && typeof d.detectManagedDrift === 'function' && typeof d.applyMigrationEntries === 'function') {
+            return d;
+        }
+    }
+    return null;
+}
+function describeDb(driver) {
+    const cfg = driver?.config;
+    if (!cfg)
+        return 'unknown';
+    const conn = cfg.connection;
+    if (typeof conn === 'string')
+        return redactUrl(conn);
+    if (conn && typeof conn === 'object') {
+        if (conn.filename)
+            return `sqlite:${conn.filename}`;
+        if (conn.host)
+            return `${cfg.client}://${conn.host}${conn.database ? '/' + conn.database : ''}`;
+    }
+    return String(cfg.client ?? 'unknown');
+}
+function redactUrl(url) {
+    try {
+        const u = new URL(url);
+        if (u.password)
+            u.password = '***';
+        return u.toString();
+    }
+    catch {
+        return url.replace(/:\/\/[^@]*@/, '://***@');
+    }
+}
+/** Boot the schema stack. Caller MUST call `shutdown()` when done. */
+export async function bootSchemaStack(opts = {}) {
+    const { createStandaloneStack, Runtime } = await import('@objectstack/runtime');
+    const stack = await createStandaloneStack({
+        projectRoot: process.cwd(),
+        ...(opts.databaseUrl ? { databaseUrl: opts.databaseUrl } : {}),
+    });
+    // No HTTP, no cluster — this is a one-shot schema operation.
+    const runtime = new Runtime({ cluster: false });
+    const kernel = runtime.getKernel();
+    for (const plugin of stack.plugins) {
+        await kernel.use(plugin);
+    }
+    await runtime.start();
+    const driver = findSqlDriver(kernel);
+    const managedTableCount = driver ? driver.managedObjectFields?.size ?? 0 : 0;
+    return {
+        driver,
+        dbLabel: describeDb(driver),
+        managedTableCount,
+        shutdown: async () => {
+            try {
+                await runtime.stop?.();
+            }
+            catch { /* ignore */ }
+            try {
+                await driver?.disconnect?.();
+            }
+            catch { /* ignore */ }
+        },
+    };
+}
+// ── Rendering ───────────────────────────────────────────────────────
+const CATEGORY_ORDER = ['safe', 'needs_confirm', 'destructive'];
+const CATEGORY_META = {
+    safe: { label: 'Safe (loosening — applied without --allow-destructive)', color: chalk.green, icon: '✓' },
+    needs_confirm: { label: 'Needs confirmation', color: chalk.yellow, icon: '~' },
+    destructive: { label: 'Destructive (requires --allow-destructive)', color: chalk.red, icon: '✗' },
+};
+export function groupByCategory(drift) {
+    const out = { safe: [], needs_confirm: [], destructive: [] };
+    for (const d of drift)
+        out[d.category].push(d);
+    return out;
+}
+export function renderPlan(drift) {
+    const grouped = groupByCategory(drift);
+    for (const cat of CATEGORY_ORDER) {
+        const items = grouped[cat];
+        if (items.length === 0)
+            continue;
+        const meta = CATEGORY_META[cat];
+        console.log(`  ${chalk.bold(meta.label)}`);
+        for (const d of items) {
+            console.log(`    ${meta.color(meta.icon)} ${meta.color(`${d.table}.${d.column ?? ''}`)} ${chalk.dim(`[${d.op.type}]`)}`);
+            console.log(`        ${chalk.dim(d.message)}`);
+        }
+        console.log('');
+    }
+}
+export function summarize(drift) {
+    const g = groupByCategory(drift);
+    return `${drift.length} change(s): ${g.safe.length} safe, ${g.needs_confirm.length} needs-confirm, ${g.destructive.length} destructive`;
+}
+//# sourceMappingURL=schema-migrate.js.map

package/dist/utils/schema-migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-migrate.js","sourceRoot":"","sources":["../../src/utils/schema-migrate.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,MAAM,OAAO,CAAC;AAoB1B,MAAM,mBAAmB,GAAG;IAC1B,mCAAmC;IACnC,qCAAqC;IACrC,YAAY;CACb,CAAC;AAEF,SAAS,aAAa,CAAC,MAAW;IAChC,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACvC,IAAI,CAAM,CAAC;QACX,IAAI,CAAC;YAAC,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,kBAAkB,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,qBAAqB,KAAK,UAAU,EAAE,CAAC;YACrG,OAAO,CAAkB,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,MAA4B;IAC9C,MAAM,GAAG,GAAQ,MAAM,EAAE,MAAM,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC;IAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,GAAG,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,QAAQ;YAAE,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC;QACnC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAiC,EAAE;IACvE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAEhF,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC;QACxC,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE;QAC1B,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC;IAEH,6DAA6D;IAC7D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IACnC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IAEtB,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,iBAAiB,GAAG,MAAM,CAAC,CAAC,CAAE,MAAc,CAAC,mBAAmB,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtF,OAAO;QACL,MAAM;QACN,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC;QAC3B,iBAAiB;QACjB,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,IAAI,CAAC;gBAAC,MAAO,OAAe,CAAC,IAAI,EAAE,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YAC/D,IAAI,CAAC;gBAAC,MAAM,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC9D,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uEAAuE;AAEvE,MAAM,cAAc,GAAoB,CAAC,MAAM,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;AAEjF,MAAM,aAAa,GAAyF;IAC1G,IAAI,EAAE,EAAE,KAAK,EAAE,wDAAwD,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE;IACxG,aAAa,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE;IAC9E,WAAW,EAAE,EAAE,KAAK,EAAE,4CAA4C,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE;CAClG,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,KAA0B;IACxD,MAAM,GAAG,GAA+C,EAAE,IAAI,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACzG,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAA0B;IACnD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;YACzH,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAA0B;IAClD,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,GAAG,KAAK,CAAC,MAAM,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,CAAC,aAAa,CAAC,MAAM,mBAAmB,CAAC,CAAC,WAAW,CAAC,MAAM,cAAc,CAAC;AAC1I,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/cli",
-  "version": "10.0.0",
+  "version": "10.2.0",
   "description": "Command Line Interface for ObjectStack Protocol",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -47,52 +47,53 @@
     "tsx": "^4.22.4",
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
-    "@objectstack/account": "10.0.0",
-    "@objectstack/client": "10.0.0",
-    "@objectstack/cloud-connection": "10.0.0",
-    "@objectstack/console": "10.0.0",
-    "@objectstack/core": "^10.0.0",
-    "@objectstack/driver-memory": "^10.0.0",
-    "@objectstack/driver-mongodb": "^10.0.0",
-    "@objectstack/driver-sql": "^10.0.0",
-    "@objectstack/driver-sqlite-wasm": "^10.0.0",
-    "@objectstack/formula": "10.0.0",
-    "@objectstack/objectql": "^10.0.0",
-    "@objectstack/observability": "^10.0.0",
-    "@objectstack/platform-objects": "10.0.0",
-    "@objectstack/plugin-approvals": "10.0.0",
-    "@objectstack/plugin-audit": "10.0.0",
-    "@objectstack/plugin-auth": "10.0.0",
-    "@objectstack/plugin-email": "10.0.0",
-    "@objectstack/setup": "10.0.0",
-    "@objectstack/studio": "10.0.0",
-    "@objectstack/plugin-hono-server": "10.0.0",
-    "@objectstack/mcp": "10.0.0",
-    "@objectstack/plugin-org-scoping": "10.0.0",
-    "@objectstack/plugin-reports": "10.0.0",
-    "@objectstack/plugin-security": "10.0.0",
-    "@objectstack/plugin-sharing": "10.0.0",
-    "@objectstack/trigger-record-change": "10.0.0",
-    "@objectstack/trigger-api": "10.0.0",
-    "@objectstack/trigger-schedule": "10.0.0",
-    "@objectstack/plugin-webhooks": "10.0.0",
-    "@objectstack/rest": "10.0.0",
-    "@objectstack/runtime": "^10.0.0",
-    "@objectstack/service-ai": "10.0.0",
-    "@objectstack/service-analytics": "10.0.0",
-    "@objectstack/service-automation": "10.0.0",
-    "@objectstack/service-cache": "10.0.0",
-    "@objectstack/service-datasource": "10.0.0",
-    "@objectstack/service-job": "10.0.0",
-    "@objectstack/service-messaging": "10.0.0",
-    "@objectstack/service-package": "10.0.0",
-    "@objectstack/service-queue": "10.0.0",
-    "@objectstack/service-realtime": "10.0.0",
-    "@objectstack/service-settings": "10.0.0",
-    "@objectstack/service-storage": "10.0.0",
-    "@objectstack/spec": "10.0.0",
-    "@objectstack/types": "10.0.0",
-    "@objectstack/verify": "10.0.0"
+    "@objectstack/account": "10.2.0",
+    "@objectstack/client": "10.2.0",
+    "@objectstack/cloud-connection": "10.2.0",
+    "@objectstack/console": "10.2.0",
+    "@objectstack/core": "^10.2.0",
+    "@objectstack/driver-memory": "^10.2.0",
+    "@objectstack/driver-mongodb": "^10.2.0",
+    "@objectstack/driver-sql": "^10.2.0",
+    "@objectstack/driver-sqlite-wasm": "^10.2.0",
+    "@objectstack/formula": "10.2.0",
+    "@objectstack/lint": "10.2.0",
+    "@objectstack/mcp": "10.2.0",
+    "@objectstack/objectql": "^10.2.0",
+    "@objectstack/observability": "^10.2.0",
+    "@objectstack/platform-objects": "10.2.0",
+    "@objectstack/plugin-approvals": "10.2.0",
+    "@objectstack/plugin-audit": "10.2.0",
+    "@objectstack/plugin-auth": "10.2.0",
+    "@objectstack/plugin-email": "10.2.0",
+    "@objectstack/plugin-hono-server": "10.2.0",
+    "@objectstack/plugin-org-scoping": "10.2.0",
+    "@objectstack/plugin-reports": "10.2.0",
+    "@objectstack/plugin-security": "10.2.0",
+    "@objectstack/plugin-sharing": "10.2.0",
+    "@objectstack/plugin-webhooks": "10.2.0",
+    "@objectstack/rest": "10.2.0",
+    "@objectstack/runtime": "^10.2.0",
+    "@objectstack/service-ai": "10.2.0",
+    "@objectstack/service-analytics": "10.2.0",
+    "@objectstack/service-automation": "10.2.0",
+    "@objectstack/service-cache": "10.2.0",
+    "@objectstack/service-datasource": "10.2.0",
+    "@objectstack/service-job": "10.2.0",
+    "@objectstack/service-messaging": "10.2.0",
+    "@objectstack/service-package": "10.2.0",
+    "@objectstack/service-queue": "10.2.0",
+    "@objectstack/service-realtime": "10.2.0",
+    "@objectstack/service-settings": "10.2.0",
+    "@objectstack/service-storage": "10.2.0",
+    "@objectstack/setup": "10.2.0",
+    "@objectstack/spec": "10.2.0",
+    "@objectstack/studio": "10.2.0",
+    "@objectstack/trigger-api": "10.2.0",
+    "@objectstack/trigger-record-change": "10.2.0",
+    "@objectstack/trigger-schedule": "10.2.0",
+    "@objectstack/types": "10.2.0",
+    "@objectstack/verify": "10.2.0"
   },
   "devDependencies": {
     "@oclif/plugin-help": "^6.2.52",

package/dist/utils/validate-expressions.d.ts

@@ -1,19 +0,0 @@
-export interface ExprIssue {
-    where: string;
-    message: string;
-    source: string;
-    /**
-     * `error` fails the build (e.g. a bare ref in a record-scoped formula). `warning`
-     * is advisory and never fails it (e.g. a possible field typo in a flattened flow
-     * condition, which might be a flow variable). Absent ⇒ treat as `error`.
-     */
-    severity?: 'error' | 'warning';
-}
-type AnyRec = Record<string, unknown>;
-/**
- * Validate every predicate in the stack. Returns the list of issues (empty =
- * clean). Caller decides how to surface / whether to fail the build.
- */
-export declare function validateStackExpressions(stack: AnyRec): ExprIssue[];
-export {};
-//# sourceMappingURL=validate-expressions.d.ts.map

package/dist/utils/validate-expressions.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"validate-expressions.d.ts","sourceRoot":"","sources":["../../src/utils/validate-expressions.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAChC;AAED,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AA0BtC;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,CAoKnE"}

package/dist/utils/validate-expressions.js

@@ -1,201 +0,0 @@
-// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
-/**
- * Build-time expression validation (ADR-0032 §Decision 1a + 1b).
- *
- * Runs at `objectstack compile`, where the whole normalized stack is in hand —
- * so flow conditions can be checked against the *resolved* object schema
- * (field existence) in addition to CEL syntax. Uses the one shared validator
- * from `@objectstack/formula`, so the verdict matches `registerFlow` and the
- * agent `validate_expression` tool exactly.
- *
- * Scope (v1): flow predicates (start/decision `config.condition` + edge
- * `condition`), object validation-rule / formula predicates, and UI action
- * `visible` / `disabled` predicates. Each error is located (flow/object/action
- * + node/edge/field) with a corrective message.
- */
-import { validateExpression } from '@objectstack/formula';
-/** Coerce an `objects` collection (array or name-keyed map) to an array. */
-function asArray(v) {
-    if (Array.isArray(v))
-        return v;
-    if (v && typeof v === 'object') {
-        return Object.entries(v).map(([name, def]) => ({ name, ...def }));
-    }
-    return [];
-}
-/** object name → set of its field names, for schema-aware field checks. */
-function buildFieldIndex(objects) {
-    const idx = new Map();
-    for (const obj of objects) {
-        const name = typeof obj.name === 'string' ? obj.name : undefined;
-        if (!name)
-            continue;
-        const fields = obj.fields;
-        let names = [];
-        if (Array.isArray(fields))
-            names = fields.map(f => f.name).filter((n) => typeof n === 'string');
-        else if (fields && typeof fields === 'object')
-            names = Object.keys(fields);
-        idx.set(name, names);
-    }
-    return idx;
-}
-/**
- * Validate every predicate in the stack. Returns the list of issues (empty =
- * clean). Caller decides how to surface / whether to fail the build.
- */
-export function validateStackExpressions(stack) {
-    const issues = [];
-    const objects = asArray(stack.objects);
-    const fieldIndex = buildFieldIndex(objects);
-    const check = (where, raw, objectName, scope = 'flattened') => {
-        if (raw == null)
-            return;
-        const fields = objectName ? fieldIndex.get(objectName) : undefined;
-        const res = validateExpression('predicate', raw, objectName ? { objectName, fields, scope } : { scope });
-        for (const e of res.errors)
-            issues.push({ where, message: e.message, source: e.source, severity: 'error' });
-        for (const w of res.warnings)
-            issues.push({ where, message: w.message, source: w.source, severity: 'warning' });
-    };
-    // ── Flows ──────────────────────────────────────────────────────────
-    for (const flow of asArray(stack.flows)) {
-        const flowName = typeof flow.name === 'string' ? flow.name : '(unnamed flow)';
-        const nodes = Array.isArray(flow.nodes) ? flow.nodes : [];
-        const edges = Array.isArray(flow.edges) ? flow.edges : [];
-        // The record-change target object — `record.*` refs resolve against it.
-        const startNode = nodes.find(n => n.type === 'start');
-        const startCfg = (startNode?.config ?? {});
-        const objectName = typeof startCfg.objectName === 'string' ? startCfg.objectName : undefined;
-        for (const node of nodes) {
-            const cfg = (node.config ?? {});
-            check(`flow '${flowName}' · node '${node.id}' (${node.type}) condition`, cfg.condition, objectName);
-            // #1870 — a `script` node must declare a callable target (`actionType` or
-            // `function`). A node with neither is a silent no-op that otherwise passes
-            // build. (Function *existence* isn't checkable here — functions are code,
-            // not serialized into the artifact — so this is a structural check; the
-            // runtime verifies the named function is actually registered.)
-            if (node.type === 'script') {
-                // `function` is canonical; `functionName` is an accepted alias.
-                const fn = (typeof cfg.function === 'string' ? cfg.function.trim() : '') ||
-                    (typeof cfg.functionName === 'string' ? cfg.functionName.trim() : '');
-                const action = typeof cfg.actionType === 'string' ? cfg.actionType.trim() : '';
-                // Inline `config.script` (a JS body) is also a declared form — the
-                // built-in runtime doesn't execute it (warned at run time), but the node
-                // is not the empty no-op this check targets, so don't flag it.
-                const inline = typeof cfg.script === 'string' ? cfg.script.trim() : '';
-                if (!fn && !action && !inline) {
-                    issues.push({
-                        where: `flow '${flowName}' · node '${node.id}' (script) callable`,
-                        message: `script node declares neither \`actionType\` nor \`function\` — it would do nothing at runtime. ` +
-                            `Name a built-in action (e.g. \`actionType: 'email'\`) or a registered function ` +
-                            `(\`function: 'my_fn'\`, registered via \`defineStack({ functions })\`).`,
-                        source: JSON.stringify({ id: node.id, type: node.type, config: cfg }),
-                    });
-                }
-                else if (action === 'invoke_function' && !fn) {
-                    // `actionType: 'invoke_function'` is a marker that names no callable on
-                    // its own — the function name must be in `function`/`functionName`.
-                    issues.push({
-                        where: `flow '${flowName}' · node '${node.id}' (script) callable`,
-                        message: `script node uses \`actionType: 'invoke_function'\` but no \`function\` (or \`functionName\`) — ` +
-                            `it names no callable. Set \`function: 'my_fn'\` and register it via \`defineStack({ functions })\`.`,
-                        source: JSON.stringify({ id: node.id, type: node.type, config: cfg }),
-                    });
-                }
-            }
-        }
-        for (const edge of edges) {
-            check(`flow '${flowName}' · edge '${edge.id}' (${edge.source}→${edge.target}) condition`, edge.condition, objectName);
-        }
-    }
-    // ── Object validation-rule + formula predicates ────────────────────
-    for (const obj of objects) {
-        const objectName = typeof obj.name === 'string' ? obj.name : undefined;
-        const validations = obj.validations ?? obj.validationRules;
-        for (const rule of asArray(validations)) {
-            const where = `object '${objectName}' · validation '${rule.name ?? '?'}'`;
-            // Common predicate keys across rule shapes. Validation predicates are
-            // `record`-scoped — no field flattening — so bare refs are flagged (#1928).
-            check(where, rule.expression ?? rule.predicate ?? rule.condition ?? rule.formula, objectName, 'record');
-            // `conditional` rules carry a nested `when` predicate (record-scoped).
-            check(`${where} when`, rule.when, objectName, 'record');
-        }
-        // Field-level formulas (computed fields) reference the same object.
-        const fields = obj.fields;
-        const fieldList = Array.isArray(fields)
-            ? fields
-            : (fields && typeof fields === 'object' ? Object.values(fields) : []);
-        for (const f of fieldList) {
-            // Field-level conditional rules are server-enforced (rule-validator) and
-            // record-scoped — a bare ref silently fails the rule (required/readonly
-            // not enforced = data-integrity hole). #1928 class, same as actions.
-            if (f && typeof f === 'object') {
-                const fname = f.name ?? '?';
-                for (const key of ['requiredWhen', 'readonlyWhen', 'conditionalRequired', 'visibleWhen']) {
-                    check(`object '${objectName}' · field '${fname}' ${key}`, f[key], objectName, 'record');
-                }
-            }
-            if (f && typeof f === 'object' && f.formula) {
-                // formulas are `value` role (any return type), still CEL. They are
-                // `record`-scoped — `record.<field>`, never bare — so flag bare refs (#1928).
-                const res = validateExpression('value', f.formula, objectName ? { objectName, fields: fieldIndex.get(objectName), scope: 'record' } : { scope: 'record' });
-                const fieldWhere = `object '${objectName}' · field '${f.name ?? '?'}' formula`;
-                for (const e of res.errors)
-                    issues.push({ where: fieldWhere, message: e.message, source: e.source, severity: 'error' });
-                for (const w of res.warnings)
-                    issues.push({ where: fieldWhere, message: w.message, source: w.source, severity: 'warning' });
-            }
-        }
-    }
-    // ── Action `visible` / `disabled` predicates ───────────────────────
-    // Record-scoped, same as validation rules: a record-header / row action's
-    // `visible` is evaluated by ActionEngine against `{ record, recordId,
-    // objectName, user, … }` with fail-closed semantics, so a BARE field ref
-    // (`done` instead of `record.done`) throws and the action is silently hidden
-    // on every record (the trap behind the #2183 "Mark Done never hides" hunt).
-    // Flagging it here turns that into a build error with a corrective message.
-    // `disabled` may be a boolean (skip) or a predicate (check).
-    const seenActions = new Set();
-    const checkAction = (where, action, objectName) => {
-        const obj = objectName
-            ?? (typeof action.objectName === 'string' ? action.objectName : undefined)
-            ?? (typeof action.object === 'string' ? action.object : undefined);
-        const name = typeof action.name === 'string' ? action.name : '?';
-        const key = `${obj ?? ''}:${name}`;
-        if (seenActions.has(key))
-            return; // de-dup (actions are merged onto objects AND kept top-level)
-        seenActions.add(key);
-        check(`${where} · action '${name}' visible`, action.visible, obj, 'record');
-        if (typeof action.disabled !== 'boolean') {
-            check(`${where} · action '${name}' disabled`, action.disabled, obj, 'record');
-        }
-    };
-    for (const action of asArray(stack.actions)) {
-        checkAction('stack', action);
-    }
-    for (const obj of objects) {
-        const objectName = typeof obj.name === 'string' ? obj.name : undefined;
-        for (const action of asArray(obj.actions)) {
-            checkAction(`object '${objectName}'`, action, objectName);
-        }
-    }
-    // ── Sharing-rule predicates (security-critical, record-scoped) ─────
-    // A criteria sharing rule's `condition` decides which rows a principal sees.
-    // It is evaluated against the record, so a bare ref silently changes access.
-    for (const rule of asArray(stack.sharingRules)) {
-        const ruleObj = typeof rule.object === 'string' ? rule.object : undefined;
-        const where = `sharingRule '${rule.name ?? '?'}'${ruleObj ? ` (${ruleObj})` : ''} condition`;
-        check(where, rule.condition ?? rule.criteria ?? rule.predicate, ruleObj, 'record');
-    }
-    // ── Hook `condition` predicates (record-scoped gate) ───────────────
-    // A lifecycle hook's `condition` skips the handler when false; it is
-    // evaluated against the record, so a bare ref silently makes the hook
-    // run on every record (or never) instead of the intended subset.
-    for (const hook of asArray(stack.hooks)) {
-        const hookObj = typeof hook.object === 'string' ? hook.object : undefined; // array targets → no single field set
-        check(`hook '${hook.name ?? '?'}'${hookObj ? ` (${hookObj})` : ''} condition`, hook.condition, hookObj, 'record');
-    }
-    return issues;
-}
-//# sourceMappingURL=validate-expressions.js.map

package/dist/utils/validate-expressions.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"validate-expressions.js","sourceRoot":"","sources":["../../src/utils/validate-expressions.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAgB1D,4EAA4E;AAC5E,SAAS,OAAO,CAAC,CAAU;IACzB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAa,CAAC;IAC3C,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,OAAO,CAAC,CAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAI,GAAc,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,2EAA2E;AAC3E,SAAS,eAAe,CAAC,OAAiB;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAoB,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAY,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;aACpH,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAgB,CAAC,CAAC;QACrF,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAE5C,MAAM,KAAK,GAAG,CACZ,KAAa,EACb,GAAY,EACZ,UAAmB,EACnB,QAAgC,WAAW,EACrC,EAAE;QACR,IAAI,GAAG,IAAI,IAAI;YAAE,OAAO;QACxB,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,GAAG,GAAG,kBAAkB,CAAC,WAAW,EAAE,GAAqD,EAC/F,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5G,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAClH,CAAC,CAAC;IAEF,sEAAsE;IACtE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,wEAAwE;QACxE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,MAAM,IAAI,EAAE,CAAW,CAAC;QACrD,MAAM,UAAU,GAAG,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QAE7F,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAW,CAAC;YAC1C,KAAK,CAAC,SAAS,QAAQ,aAAa,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,IAAI,aAAa,EAAE,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YACpG,0EAA0E;YAC1E,2EAA2E;YAC3E,0EAA0E;YAC1E,wEAAwE;YACxE,+DAA+D;YAC/D,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,gEAAgE;gBAChE,MAAM,EAAE,GACN,CAAC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7D,CAAC,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxE,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,mEAAmE;gBACnE,yEAAyE;gBACzE,+DAA+D;gBAC/D,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;oBAC9B,MAAM,CAAC,IAAI,CAAC;wBACV,KAAK,EAAE,SAAS,QAAQ,aAAa,IAAI,CAAC,EAAE,qBAAqB;wBACjE,OAAO,EACL,iGAAiG;4BACjG,iFAAiF;4BACjF,yEAAyE;wBAC3E,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;qBACtE,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,MAAM,KAAK,iBAAiB,IAAI,CAAC,EAAE,EAAE,CAAC;oBAC/C,wEAAwE;oBACxE,oEAAoE;oBACpE,MAAM,CAAC,IAAI,CAAC;wBACV,KAAK,EAAE,SAAS,QAAQ,aAAa,IAAI,CAAC,EAAE,qBAAqB;wBACjE,OAAO,EACL,iGAAiG;4BACjG,qGAAqG;wBACvG,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;qBACtE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,KAAK,CAAC,SAAS,QAAQ,aAAa,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACxH,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,eAAe,CAAC;QAC3D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,WAAW,UAAU,mBAAoB,IAAI,CAAC,IAAe,IAAI,GAAG,GAAG,CAAC;YACtF,sEAAsE;YACtE,4EAA4E;YAC5E,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACxG,uEAAuE;YACvE,KAAK,CAAC,GAAG,KAAK,OAAO,EAAG,IAAe,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QACtE,CAAC;QACD,oEAAoE;QACpE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACrC,CAAC,CAAE,MAAmB;YACtB,CAAC,CAAC,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAgB,CAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9F,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,yEAAyE;YACzE,wEAAwE;YACxE,qEAAqE;YACrE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAI,CAAC,CAAC,IAAe,IAAI,GAAG,CAAC;gBACxC,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,cAAc,EAAE,qBAAqB,EAAE,aAAa,CAAU,EAAE,CAAC;oBAClG,KAAK,CAAC,WAAW,UAAU,cAAc,KAAK,KAAK,GAAG,EAAE,EAAG,CAAY,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACtG,CAAC;YACH,CAAC;YACD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC5C,mEAAmE;gBACnE,8EAA8E;gBAC9E,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,EAAE,CAAC,CAAC,OAAyD,EACjG,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC1G,MAAM,UAAU,GAAG,WAAW,UAAU,cAAe,CAAC,CAAC,IAAe,IAAI,GAAG,WAAW,CAAC;gBAC3F,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM;oBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;gBACxH,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;oBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9H,CAAC;QACH,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,sEAAsE;IACtE,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,UAAmB,EAAQ,EAAE;QAC/E,MAAM,GAAG,GAAG,UAAU;eACjB,CAAC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;eACvE,CAAC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QACjE,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;QACnC,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,8DAA8D;QAChG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,KAAK,CAAC,GAAG,KAAK,cAAc,IAAI,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC5E,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzC,KAAK,CAAC,GAAG,KAAK,cAAc,IAAI,YAAY,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChF,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,WAAW,CAAC,WAAW,UAAU,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,6EAA6E;IAC7E,6EAA6E;IAC7E,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM,KAAK,GAAG,gBAAiB,IAAI,CAAC,IAAe,IAAI,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC;QACzG,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrF,CAAC;IAED,sEAAsE;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,iEAAiE;IACjE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,sCAAsC;QACjH,KAAK,CAAC,SAAU,IAAI,CAAC,IAAe,IAAI,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChI,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/utils/validate-expressions.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=validate-expressions.test.d.ts.map

package/dist/utils/validate-expressions.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"validate-expressions.test.d.ts","sourceRoot":"","sources":["../../src/utils/validate-expressions.test.ts"],"names":[],"mappings":""}