@objectstack/cli 9.10.0 → 10.0.0

package/dist/commands/verify.js

@@ -0,0 +1,95 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+import { Command, Flags } from '@oclif/core';
+import chalk from 'chalk';
+import { readEnvWithDeprecation } from '@objectstack/types';
+import { bootStack, runCrudVerification, formatReport, runRlsProofs, formatRlsReport, } from '@objectstack/verify';
+import { loadConfig } from '../utils/config.js';
+/**
+ * `objectstack verify` — boot the app in-process and exercise it through the
+ * real HTTP stack, asserting runtime behavior the static gates can't see:
+ *   - data fidelity: author → write → read → assert, per object/field type
+ *   - authorization (--rls): "you can't write what you can't read" (#1994 class)
+ *
+ * Exits non-zero on real failures so it drops straight into CI.
+ */
+export default class Verify extends Command {
+    static description = 'Boot the app in-process and verify it through the real HTTP stack (CRUD round-trip fidelity + the cross-owner RLS invariant)';
+    static examples = [
+        '<%= config.bin %> verify',
+        '<%= config.bin %> verify --app ./objectstack.config.ts --rls',
+        '<%= config.bin %> verify --rls --multi-tenant --json',
+    ];
+    static flags = {
+        app: Flags.string({
+            char: 'a',
+            description: 'Path to the app config (defaults to ./objectstack.config.{ts,js,mjs})',
+        }),
+        rls: Flags.boolean({
+            description: 'Also run the cross-owner RLS invariant (a fresh member must not write what it cannot read)',
+            default: false,
+        }),
+        'multi-tenant': Flags.boolean({
+            description: 'Boot org-scoped (register plugin-org-scoping) so tenant-isolation RLS policies apply (also honors $OS_MULTI_ORG_ENABLED)',
+            default: false,
+        }),
+        json: Flags.boolean({ description: 'Emit the structured report as JSON', default: false }),
+    };
+    async run() {
+        const { flags } = await this.parse(Verify);
+        const { config, absolutePath } = await loadConfig(flags.app);
+        const multiTenant = flags['multi-tenant'] ||
+            String(readEnvWithDeprecation('OS_MULTI_ORG_ENABLED', 'OS_MULTI_TENANT') ?? 'false').toLowerCase() !==
+                'false';
+        // Data fidelity runs on its own pristine stack.
+        let crud;
+        {
+            const stack = await bootStack(config, { multiTenant });
+            try {
+                const adminToken = await stack.signIn();
+                crud = await runCrudVerification(stack, adminToken, config);
+            }
+            finally {
+                await stack.stop();
+            }
+        }
+        // The RLS proofs run on a SEPARATE, fresh stack. Reusing the fidelity stack
+        // would let the RLS phase's admin-creates collide with the rows the fidelity
+        // phase already wrote on unique-constrained fields (e.g. a unique `sku` or
+        // `account_number`) — a 409 that silently skips the object instead of
+        // proving its authorization.
+        let rls;
+        if (flags.rls) {
+            const rlsStack = await bootStack(config, { multiTenant });
+            try {
+                const adminToken = await rlsStack.signIn();
+                const memberToken = await rlsStack.signUp('verify-member@objectstack.test');
+                rls = await runRlsProofs(rlsStack, adminToken, memberToken, config);
+            }
+            finally {
+                await rlsStack.stop();
+            }
+        }
+        // Failure contract: a "real" runtime break the app's author must see.
+        const hardFailures = crud.summary.createFailed +
+            crud.summary.readFailed +
+            crud.summary.fidelityGaps +
+            (rls?.summary.holes ?? 0);
+        if (flags.json) {
+            this.log(JSON.stringify({ app: crud.app, config: absolutePath, multiTenant, crud, rls, hardFailures }, null, 2));
+        }
+        else {
+            this.log(formatReport(crud));
+            if (rls)
+                this.log(formatRlsReport(rls));
+            this.log('');
+            this.log(hardFailures > 0
+                ? chalk.red(`✗ verify FAILED — ${hardFailures} runtime failure(s)`)
+                : chalk.green('✓ verify passed — no runtime failures'));
+        }
+        // Force process exit: the in-process stack leaves handles open (http server,
+        // sqlite-wasm, better-auth timers) that keep the event loop alive after
+        // stop(), so a bare return would hang. exit() also encodes the CI contract.
+        this.exit(hardFailures > 0 ? 1 : 0);
+    }
+}
+//# sourceMappingURL=verify.js.map

package/dist/commands/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/commands/verify.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,YAAY,EACZ,YAAY,EACZ,eAAe,GAGhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,CAAC,OAAO,OAAO,MAAO,SAAQ,OAAO;IACzC,MAAM,CAAU,WAAW,GACzB,8HAA8H,CAAC;IAEjI,MAAM,CAAU,QAAQ,GAAG;QACzB,0BAA0B;QAC1B,8DAA8D;QAC9D,sDAAsD;KACvD,CAAC;IAEF,MAAM,CAAU,KAAK,GAAG;QACtB,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC;YAChB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,uEAAuE;SACrF,CAAC;QACF,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC;YACjB,WAAW,EAAE,4FAA4F;YACzG,OAAO,EAAE,KAAK;SACf,CAAC;QACF,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC;YAC5B,WAAW,EAAE,0HAA0H;YACvI,OAAO,EAAE,KAAK;SACf,CAAC;QACF,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,oCAAoC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;KAC3F,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE3C,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE7D,MAAM,WAAW,GACf,KAAK,CAAC,cAAc,CAAC;YACrB,MAAM,CAAC,sBAAsB,CAAC,sBAAsB,EAAE,iBAAiB,CAAC,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE;gBAChG,OAAO,CAAC;QAEZ,gDAAgD;QAChD,IAAI,IAAkB,CAAC;QACvB,CAAC;YACC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;YACvD,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxC,IAAI,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YAC9D,CAAC;oBAAS,CAAC;gBACT,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,6EAA6E;QAC7E,2EAA2E;QAC3E,sEAAsE;QACtE,6BAA6B;QAC7B,IAAI,GAA0B,CAAC;QAC/B,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACd,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC3C,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,gCAAgC,CAAC,CAAC;gBAC5E,GAAG,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;YACtE,CAAC;oBAAS,CAAC;gBACT,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,MAAM,YAAY,GAChB,IAAI,CAAC,OAAO,CAAC,YAAY;YACzB,IAAI,CAAC,OAAO,CAAC,UAAU;YACvB,IAAI,CAAC,OAAO,CAAC,YAAY;YACzB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;QAE5B,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACnH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7B,IAAI,GAAG;gBAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,IAAI,CAAC,GAAG,CACN,YAAY,GAAG,CAAC;gBACd,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,YAAY,qBAAqB,CAAC;gBACnE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,uCAAuC,CAAC,CACzD,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,wEAAwE;QACxE,4EAA4E;QAC5E,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC"}

package/dist/utils/lint-autonumber-formats.d.ts

@@ -0,0 +1,19 @@
+export interface AutonumberLintFinding {
+    where: string;
+    message: string;
+    hint: string;
+    rule: string;
+    severity: 'error' | 'warning';
+}
+type AnyRec = Record<string, unknown>;
+export declare const AUTONUMBER_UNKNOWN_FIELD = "autonumber-references-unknown-field";
+export declare const AUTONUMBER_OPTIONAL_FIELD = "autonumber-references-optional-field";
+export declare const AUTONUMBER_SELF_REFERENCE = "autonumber-references-self";
+export declare const AUTONUMBER_LITERAL_TOKEN = "autonumber-unrecognized-token";
+/**
+ * Lint every `autonumber` field's format for unresolvable / fragile `{field}`
+ * interpolation. Returns a (possibly empty) list of findings; never throws.
+ */
+export declare function lintAutonumberFormats(stack: AnyRec): AutonumberLintFinding[];
+export {};
+//# sourceMappingURL=lint-autonumber-formats.d.ts.map

package/dist/utils/lint-autonumber-formats.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint-autonumber-formats.d.ts","sourceRoot":"","sources":["../../src/utils/lint-autonumber-formats.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;CAC/B;AAED,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEtC,eAAO,MAAM,wBAAwB,wCAAwC,CAAC;AAC9E,eAAO,MAAM,yBAAyB,yCAAyC,CAAC;AAChF,eAAO,MAAM,yBAAyB,+BAA+B,CAAC;AACtE,eAAO,MAAM,wBAAwB,kCAAkC,CAAC;AAUxE;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,qBAAqB,EAAE,CA+E5E"}

package/dist/utils/lint-autonumber-formats.js

@@ -0,0 +1,123 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+/**
+ * Build-time lint for `autonumber` field formats. An `autonumberFormat` may
+ * interpolate other fields of the same record (`{plan_no}{000}`,
+ * `{section}{island_zone}{000}`). That field value forms the counter SCOPE, so
+ * if it is missing at create time the record number silently collapses into the
+ * wrong scope — and the runtime now throws rather than emit a wrong number
+ * (see sql-driver / engine `missingFieldValues`). This lint catches the two
+ * ways an author (very often an AI generating templates) gets that wrong,
+ * BEFORE it ships:
+ *
+ *   - ERROR: `{field}` names a field that does not exist on the object — the
+ *     generation will always throw. This is broken, so it fails the build.
+ *   - WARNING: `{field}` names an OPTIONAL field — generation throws on any
+ *     record left blank. The robust shape marks the referenced field
+ *     `required: true` (mirroring ERPNext/Odoo, where a field that drives the
+ *     naming series must be mandatory). Advisory; does not fail the build.
+ *
+ * A self-reference (`{self}` on the autonumber field itself) is always an
+ * ERROR — the value does not exist yet when the format renders.
+ */
+import { parseAutonumberFormat, referencedFields } from '@objectstack/spec/data';
+export const AUTONUMBER_UNKNOWN_FIELD = 'autonumber-references-unknown-field';
+export const AUTONUMBER_OPTIONAL_FIELD = 'autonumber-references-optional-field';
+export const AUTONUMBER_SELF_REFERENCE = 'autonumber-references-self';
+export const AUTONUMBER_LITERAL_TOKEN = 'autonumber-unrecognized-token';
+function asArray(v) {
+    if (Array.isArray(v))
+        return v;
+    if (v && typeof v === 'object') {
+        return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+    }
+    return [];
+}
+/**
+ * Lint every `autonumber` field's format for unresolvable / fragile `{field}`
+ * interpolation. Returns a (possibly empty) list of findings; never throws.
+ */
+export function lintAutonumberFormats(stack) {
+    const findings = [];
+    for (const obj of asArray(stack.objects)) {
+        const objectName = typeof obj.name === 'string' ? obj.name : '(unnamed object)';
+        const fields = asArray(obj.fields);
+        // name → required?, for schema-aware reference checks.
+        const fieldMeta = new Map();
+        for (const f of fields) {
+            if (typeof f.name === 'string')
+                fieldMeta.set(f.name, { required: f.required === true });
+        }
+        for (const f of fields) {
+            if (f.type !== 'autonumber')
+                continue;
+            const name = typeof f.name === 'string' ? f.name : '(unnamed field)';
+            const fmt = typeof f.autonumberFormat === 'string'
+                ? f.autonumberFormat
+                : (typeof f.format === 'string' ? f.format : '');
+            if (!fmt)
+                continue;
+            const tokens = parseAutonumberFormat(fmt);
+            const refs = referencedFields(tokens);
+            const where = `object '${objectName}' · field '${name}' (autonumber "${fmt}")`;
+            // An unrecognized `{...}` group is kept as literal text by the parser, so
+            // it ships VERBATIM in the record number. This catches case/spacing/typo
+            // mistakes the field-reference checks miss — date tokens are exact
+            // (`{YYYY}`, not `{yyyy}` or `{ YYYY }`), and only one `{0..0}` slot counts.
+            for (const t of tokens) {
+                if (t.kind !== 'literal')
+                    continue;
+                const braced = t.text.match(/\{[^{}]*\}/g);
+                if (!braced)
+                    continue;
+                for (const tok of braced) {
+                    const body = tok.slice(1, -1);
+                    const isExtraSeq = /^0+$/.test(body);
+                    findings.push({
+                        where,
+                        message: isExtraSeq
+                            ? `format has a second sequence slot \`${tok}\` — only the first \`{0..0}\` counts; this one renders literally as "${tok}".`
+                            : `format has an unrecognized token \`${tok}\` — it is not a counter/date/{field} token, so it renders literally as "${tok}" in every record number.`,
+                        hint: isExtraSeq
+                            ? `Use a single \`{0000}\` slot; fold any second number into a literal or a {field} token.`
+                            : `Date tokens are case-sensitive and exact: {YYYY} {YY} {MM} {DD} {YYYYMMDD} (no spaces/punctuation inside). For a field value use {field_name}.`,
+                        rule: AUTONUMBER_LITERAL_TOKEN,
+                        severity: 'warning',
+                    });
+                }
+            }
+            for (const ref of refs) {
+                if (ref === name) {
+                    findings.push({
+                        where,
+                        message: `format interpolates \`{${ref}}\` — its own value, which does not exist yet when the number is generated.`,
+                        hint: `Reference a DIFFERENT field that is set before create (e.g. \`{plan_no}{000}\`), or drop the token.`,
+                        rule: AUTONUMBER_SELF_REFERENCE,
+                        severity: 'error',
+                    });
+                    continue;
+                }
+                const meta = fieldMeta.get(ref);
+                if (!meta) {
+                    findings.push({
+                        where,
+                        message: `format interpolates \`{${ref}}\`, but object '${objectName}' has no field named '${ref}' — generation will always throw.`,
+                        hint: `Reference an existing field, or remove the \`{${ref}}\` token from the format.`,
+                        rule: AUTONUMBER_UNKNOWN_FIELD,
+                        severity: 'error',
+                    });
+                }
+                else if (!meta.required) {
+                    findings.push({
+                        where,
+                        message: `format interpolates \`{${ref}}\`, but '${ref}' is optional — any record left blank fails autonumber generation at create time.`,
+                        hint: `Mark '${ref}' as \`required: true\` so it is always set before the record number is rendered.`,
+                        rule: AUTONUMBER_OPTIONAL_FIELD,
+                        severity: 'warning',
+                    });
+                }
+            }
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=lint-autonumber-formats.js.map

package/dist/utils/lint-autonumber-formats.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint-autonumber-formats.js","sourceRoot":"","sources":["../../src/utils/lint-autonumber-formats.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAYjF,MAAM,CAAC,MAAM,wBAAwB,GAAG,qCAAqC,CAAC;AAC9E,MAAM,CAAC,MAAM,yBAAyB,GAAG,sCAAsC,CAAC;AAChF,MAAM,CAAC,MAAM,yBAAyB,GAAG,4BAA4B,CAAC;AACtE,MAAM,CAAC,MAAM,wBAAwB,GAAG,+BAA+B,CAAC;AAExE,SAAS,OAAO,CAAC,CAAU;IACzB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAa,CAAC;IAC3C,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,OAAO,CAAC,CAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAI,GAAc,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAChF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,uDAAuD;QACvD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiC,CAAC;QAC3D,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;gBAAE,SAAS;YACtC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC;YACrE,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ;gBAChD,CAAC,CAAC,CAAC,CAAC,gBAAgB;gBACpB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,WAAW,UAAU,cAAc,IAAI,kBAAkB,GAAG,IAAI,CAAC;YAE/E,0EAA0E;YAC1E,yEAAyE;YACzE,mEAAmE;YACnE,6EAA6E;YAC7E,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;oBAAE,SAAS;gBACnC,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;gBAC3C,IAAI,CAAC,MAAM;oBAAE,SAAS;gBACtB,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;oBACzB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;oBAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACrC,QAAQ,CAAC,IAAI,CAAC;wBACZ,KAAK;wBACL,OAAO,EAAE,UAAU;4BACjB,CAAC,CAAC,uCAAuC,GAAG,yEAAyE,GAAG,IAAI;4BAC5H,CAAC,CAAC,sCAAsC,GAAG,4EAA4E,GAAG,2BAA2B;wBACvJ,IAAI,EAAE,UAAU;4BACd,CAAC,CAAC,yFAAyF;4BAC3F,CAAC,CAAC,gJAAgJ;wBACpJ,IAAI,EAAE,wBAAwB;wBAC9B,QAAQ,EAAE,SAAS;qBACpB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;oBACjB,QAAQ,CAAC,IAAI,CAAC;wBACZ,KAAK;wBACL,OAAO,EAAE,0BAA0B,GAAG,6EAA6E;wBACnH,IAAI,EAAE,qGAAqG;wBAC3G,IAAI,EAAE,yBAAyB;wBAC/B,QAAQ,EAAE,OAAO;qBAClB,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAChC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,QAAQ,CAAC,IAAI,CAAC;wBACZ,KAAK;wBACL,OAAO,EAAE,0BAA0B,GAAG,oBAAoB,UAAU,yBAAyB,GAAG,mCAAmC;wBACnI,IAAI,EAAE,iDAAiD,GAAG,4BAA4B;wBACtF,IAAI,EAAE,wBAAwB;wBAC9B,QAAQ,EAAE,OAAO;qBAClB,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAC1B,QAAQ,CAAC,IAAI,CAAC;wBACZ,KAAK;wBACL,OAAO,EAAE,0BAA0B,GAAG,aAAa,GAAG,mFAAmF;wBACzI,IAAI,EAAE,SAAS,GAAG,mFAAmF;wBACrG,IAAI,EAAE,yBAAyB;wBAC/B,QAAQ,EAAE,SAAS;qBACpB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/utils/lint-autonumber-formats.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=lint-autonumber-formats.test.d.ts.map

package/dist/utils/lint-autonumber-formats.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint-autonumber-formats.test.d.ts","sourceRoot":"","sources":["../../src/utils/lint-autonumber-formats.test.ts"],"names":[],"mappings":""}

package/dist/utils/lint-autonumber-formats.test.js

@@ -0,0 +1,114 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+import { describe, it, expect } from 'vitest';
+import { lintAutonumberFormats, AUTONUMBER_UNKNOWN_FIELD, AUTONUMBER_OPTIONAL_FIELD, AUTONUMBER_SELF_REFERENCE, AUTONUMBER_LITERAL_TOKEN, } from './lint-autonumber-formats.js';
+describe('lintAutonumberFormats', () => {
+    it('passes a date-only / fixed-prefix format with no {field} tokens', () => {
+        const stack = {
+            objects: [
+                { name: 'audit', fields: { audit_no: { type: 'autonumber', autonumberFormat: 'AD{YYYYMMDD}{0000}' } } },
+                { name: 'case', fields: { case_no: { type: 'autonumber', autonumberFormat: 'CASE-{0000}' } } },
+            ],
+        };
+        expect(lintAutonumberFormats(stack)).toEqual([]);
+    });
+    it('passes when every {field} token is a required field on the object', () => {
+        const stack = {
+            objects: [
+                {
+                    name: 'task',
+                    fields: {
+                        section: { type: 'text', required: true },
+                        island_zone: { type: 'text', required: true },
+                        task_no: { type: 'autonumber', autonumberFormat: '{section}{island_zone}{000}' },
+                    },
+                },
+            ],
+        };
+        expect(lintAutonumberFormats(stack)).toEqual([]);
+    });
+    it('errors when a {field} token names a non-existent field', () => {
+        const stack = {
+            objects: [
+                { name: 'task', fields: { task_no: { type: 'autonumber', autonumberFormat: '{plan_no}{000}' } } },
+            ],
+        };
+        const out = lintAutonumberFormats(stack);
+        expect(out).toHaveLength(1);
+        expect(out[0].severity).toBe('error');
+        expect(out[0].rule).toBe(AUTONUMBER_UNKNOWN_FIELD);
+    });
+    it('warns when a {field} token names an optional field', () => {
+        const stack = {
+            objects: [
+                {
+                    name: 'task',
+                    fields: {
+                        plan_no: { type: 'text' }, // not required
+                        task_no: { type: 'autonumber', autonumberFormat: '{plan_no}{000}' },
+                    },
+                },
+            ],
+        };
+        const out = lintAutonumberFormats(stack);
+        expect(out).toHaveLength(1);
+        expect(out[0].severity).toBe('warning');
+        expect(out[0].rule).toBe(AUTONUMBER_OPTIONAL_FIELD);
+    });
+    it('errors when the format interpolates the autonumber field itself', () => {
+        const stack = {
+            objects: [
+                { name: 'task', fields: { task_no: { type: 'autonumber', autonumberFormat: '{task_no}{000}' } } },
+            ],
+        };
+        const out = lintAutonumberFormats(stack);
+        expect(out).toHaveLength(1);
+        expect(out[0].severity).toBe('error');
+        expect(out[0].rule).toBe(AUTONUMBER_SELF_REFERENCE);
+    });
+    it('warns on an unrecognized token that would render literally', () => {
+        const stack = {
+            objects: [
+                { name: 'wo', fields: { wo_no: { type: 'autonumber', autonumberFormat: 'WO-{ YYYY }-{0000}' } } },
+            ],
+        };
+        const out = lintAutonumberFormats(stack);
+        expect(out).toHaveLength(1);
+        expect(out[0].severity).toBe('warning');
+        expect(out[0].rule).toBe(AUTONUMBER_LITERAL_TOKEN);
+        expect(out[0].message).toContain('{ YYYY }');
+    });
+    it('warns on a second sequence slot (only the first counts)', () => {
+        const stack = {
+            objects: [
+                { name: 'wo', fields: { wo_no: { type: 'autonumber', autonumberFormat: '{0000}-{000}' } } },
+            ],
+        };
+        const out = lintAutonumberFormats(stack);
+        expect(out).toHaveLength(1);
+        expect(out[0].rule).toBe(AUTONUMBER_LITERAL_TOKEN);
+        expect(out[0].message).toContain('second sequence slot');
+    });
+    it('does not warn on valid date/counter tokens', () => {
+        const stack = {
+            objects: [
+                { name: 'audit', fields: { audit_no: { type: 'autonumber', autonumberFormat: 'AD{YYYYMMDD}{0000}' } } },
+            ],
+        };
+        expect(lintAutonumberFormats(stack)).toEqual([]);
+    });
+    it('handles array-shaped fields and the `format` shorthand', () => {
+        const stack = {
+            objects: [
+                {
+                    name: 'task',
+                    fields: [
+                        { name: 'plan_no', type: 'text', required: true },
+                        { name: 'task_no', type: 'autonumber', format: '{plan_no}{000}' },
+                    ],
+                },
+            ],
+        };
+        expect(lintAutonumberFormats(stack)).toEqual([]);
+    });
+});
+//# sourceMappingURL=lint-autonumber-formats.test.js.map

package/dist/utils/lint-autonumber-formats.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lint-autonumber-formats.test.js","sourceRoot":"","sources":["../../src/utils/lint-autonumber-formats.test.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,8BAA8B,CAAC;AAEtC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,KAAK,GAAG;YACZ,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,EAAE,EAAE;gBACvG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,EAAE,EAAE;aAC/F;SACF,CAAC;QACF,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,KAAK,GAAG;YACZ,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE;wBACN,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;wBACzC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;wBAC7C,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,6BAA6B,EAAE;qBACjF;iBACF;aACF;SACF,CAAC;QACF,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,KAAK,GAAG;YACZ,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,EAAE,EAAE;aAClG;SACF,CAAC;QACF,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,KAAK,GAAG;YACZ,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE;wBACN,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,eAAe;wBAC1C,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE;qBACpE;iBACF;aACF;SACF,CAAC;QACF,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,KAAK,GAAG;YACZ,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,EAAE,EAAE;aAClG;SACF,CAAC;QACF,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,KAAK,GAAG;YACZ,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,EAAE,EAAE;aAClG;SACF,CAAC;QACF,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,KAAK,GAAG;YACZ,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,EAAE,EAAE;aAC5F;SACF,CAAC;QACF,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,KAAK,GAAG;YACZ,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,EAAE,EAAE;aACxG;SACF,CAAC;QACF,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,KAAK,GAAG;YACZ,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE;wBACN,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;wBACjD,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE;qBAClE;iBACF;aACF;SACF,CAAC;QACF,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/utils/validate-expressions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-expressions.d.ts","sourceRoot":"","sources":["../../src/utils/validate-expressions.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAChC;AAED,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AA0BtC;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,CAuGnE"}
+{"version":3,"file":"validate-expressions.d.ts","sourceRoot":"","sources":["../../src/utils/validate-expressions.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAChC;AAED,KAAK,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AA0BtC;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,CAoKnE"}

package/dist/utils/validate-expressions.js

@@ -9,8 +9,9 @@
  * agent `validate_expression` tool exactly.
  *
  * Scope (v1): flow predicates (start/decision `config.condition` + edge
- * `condition`) and object validation-rule / formula predicates. Each error is
- * located (flow/object + node/edge/field) with a corrective message.
+ * `condition`), object validation-rule / formula predicates, and UI action
+ * `visible` / `disabled` predicates. Each error is located (flow/object/action
+ * + node/edge/field) with a corrective message.
  */
 import { validateExpression } from '@objectstack/formula';
 /** Coerce an `objects` collection (array or name-keyed map) to an array. */
@@ -117,6 +118,8 @@ export function validateStackExpressions(stack) {
             // Common predicate keys across rule shapes. Validation predicates are
             // `record`-scoped — no field flattening — so bare refs are flagged (#1928).
             check(where, rule.expression ?? rule.predicate ?? rule.condition ?? rule.formula, objectName, 'record');
+            // `conditional` rules carry a nested `when` predicate (record-scoped).
+            check(`${where} when`, rule.when, objectName, 'record');
         }
         // Field-level formulas (computed fields) reference the same object.
         const fields = obj.fields;
@@ -124,6 +127,15 @@ export function validateStackExpressions(stack) {
             ? fields
             : (fields && typeof fields === 'object' ? Object.values(fields) : []);
         for (const f of fieldList) {
+            // Field-level conditional rules are server-enforced (rule-validator) and
+            // record-scoped — a bare ref silently fails the rule (required/readonly
+            // not enforced = data-integrity hole). #1928 class, same as actions.
+            if (f && typeof f === 'object') {
+                const fname = f.name ?? '?';
+                for (const key of ['requiredWhen', 'readonlyWhen', 'conditionalRequired', 'visibleWhen']) {
+                    check(`object '${objectName}' · field '${fname}' ${key}`, f[key], objectName, 'record');
+                }
+            }
             if (f && typeof f === 'object' && f.formula) {
                 // formulas are `value` role (any return type), still CEL. They are
                 // `record`-scoped — `record.<field>`, never bare — so flag bare refs (#1928).
@@ -136,6 +148,54 @@ export function validateStackExpressions(stack) {
             }
         }
     }
+    // ── Action `visible` / `disabled` predicates ───────────────────────
+    // Record-scoped, same as validation rules: a record-header / row action's
+    // `visible` is evaluated by ActionEngine against `{ record, recordId,
+    // objectName, user, … }` with fail-closed semantics, so a BARE field ref
+    // (`done` instead of `record.done`) throws and the action is silently hidden
+    // on every record (the trap behind the #2183 "Mark Done never hides" hunt).
+    // Flagging it here turns that into a build error with a corrective message.
+    // `disabled` may be a boolean (skip) or a predicate (check).
+    const seenActions = new Set();
+    const checkAction = (where, action, objectName) => {
+        const obj = objectName
+            ?? (typeof action.objectName === 'string' ? action.objectName : undefined)
+            ?? (typeof action.object === 'string' ? action.object : undefined);
+        const name = typeof action.name === 'string' ? action.name : '?';
+        const key = `${obj ?? ''}:${name}`;
+        if (seenActions.has(key))
+            return; // de-dup (actions are merged onto objects AND kept top-level)
+        seenActions.add(key);
+        check(`${where} · action '${name}' visible`, action.visible, obj, 'record');
+        if (typeof action.disabled !== 'boolean') {
+            check(`${where} · action '${name}' disabled`, action.disabled, obj, 'record');
+        }
+    };
+    for (const action of asArray(stack.actions)) {
+        checkAction('stack', action);
+    }
+    for (const obj of objects) {
+        const objectName = typeof obj.name === 'string' ? obj.name : undefined;
+        for (const action of asArray(obj.actions)) {
+            checkAction(`object '${objectName}'`, action, objectName);
+        }
+    }
+    // ── Sharing-rule predicates (security-critical, record-scoped) ─────
+    // A criteria sharing rule's `condition` decides which rows a principal sees.
+    // It is evaluated against the record, so a bare ref silently changes access.
+    for (const rule of asArray(stack.sharingRules)) {
+        const ruleObj = typeof rule.object === 'string' ? rule.object : undefined;
+        const where = `sharingRule '${rule.name ?? '?'}'${ruleObj ? ` (${ruleObj})` : ''} condition`;
+        check(where, rule.condition ?? rule.criteria ?? rule.predicate, ruleObj, 'record');
+    }
+    // ── Hook `condition` predicates (record-scoped gate) ───────────────
+    // A lifecycle hook's `condition` skips the handler when false; it is
+    // evaluated against the record, so a bare ref silently makes the hook
+    // run on every record (or never) instead of the intended subset.
+    for (const hook of asArray(stack.hooks)) {
+        const hookObj = typeof hook.object === 'string' ? hook.object : undefined; // array targets → no single field set
+        check(`hook '${hook.name ?? '?'}'${hookObj ? ` (${hookObj})` : ''} condition`, hook.condition, hookObj, 'record');
+    }
     return issues;
 }
 //# sourceMappingURL=validate-expressions.js.map

package/dist/utils/validate-expressions.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate-expressions.js","sourceRoot":"","sources":["../../src/utils/validate-expressions.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAgB1D,4EAA4E;AAC5E,SAAS,OAAO,CAAC,CAAU;IACzB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAa,CAAC;IAC3C,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,OAAO,CAAC,CAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAI,GAAc,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,2EAA2E;AAC3E,SAAS,eAAe,CAAC,OAAiB;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAoB,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAY,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;aACpH,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAgB,CAAC,CAAC;QACrF,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAE5C,MAAM,KAAK,GAAG,CACZ,KAAa,EACb,GAAY,EACZ,UAAmB,EACnB,QAAgC,WAAW,EACrC,EAAE;QACR,IAAI,GAAG,IAAI,IAAI;YAAE,OAAO;QACxB,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,GAAG,GAAG,kBAAkB,CAAC,WAAW,EAAE,GAAqD,EAC/F,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5G,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAClH,CAAC,CAAC;IAEF,sEAAsE;IACtE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,wEAAwE;QACxE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,MAAM,IAAI,EAAE,CAAW,CAAC;QACrD,MAAM,UAAU,GAAG,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QAE7F,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAW,CAAC;YAC1C,KAAK,CAAC,SAAS,QAAQ,aAAa,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,IAAI,aAAa,EAAE,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YACpG,0EAA0E;YAC1E,2EAA2E;YAC3E,0EAA0E;YAC1E,wEAAwE;YACxE,+DAA+D;YAC/D,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,gEAAgE;gBAChE,MAAM,EAAE,GACN,CAAC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7D,CAAC,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxE,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,mEAAmE;gBACnE,yEAAyE;gBACzE,+DAA+D;gBAC/D,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;oBAC9B,MAAM,CAAC,IAAI,CAAC;wBACV,KAAK,EAAE,SAAS,QAAQ,aAAa,IAAI,CAAC,EAAE,qBAAqB;wBACjE,OAAO,EACL,iGAAiG;4BACjG,iFAAiF;4BACjF,yEAAyE;wBAC3E,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;qBACtE,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,MAAM,KAAK,iBAAiB,IAAI,CAAC,EAAE,EAAE,CAAC;oBAC/C,wEAAwE;oBACxE,oEAAoE;oBACpE,MAAM,CAAC,IAAI,CAAC;wBACV,KAAK,EAAE,SAAS,QAAQ,aAAa,IAAI,CAAC,EAAE,qBAAqB;wBACjE,OAAO,EACL,iGAAiG;4BACjG,qGAAqG;wBACvG,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;qBACtE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,KAAK,CAAC,SAAS,QAAQ,aAAa,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACxH,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,eAAe,CAAC;QAC3D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,WAAW,UAAU,mBAAoB,IAAI,CAAC,IAAe,IAAI,GAAG,GAAG,CAAC;YACtF,sEAAsE;YACtE,4EAA4E;YAC5E,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC1G,CAAC;QACD,oEAAoE;QACpE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACrC,CAAC,CAAE,MAAmB;YACtB,CAAC,CAAC,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAgB,CAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9F,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC5C,mEAAmE;gBACnE,8EAA8E;gBAC9E,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,EAAE,CAAC,CAAC,OAAyD,EACjG,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC1G,MAAM,UAAU,GAAG,WAAW,UAAU,cAAe,CAAC,CAAC,IAAe,IAAI,GAAG,WAAW,CAAC;gBAC3F,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM;oBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;gBACxH,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;oBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9H,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"validate-expressions.js","sourceRoot":"","sources":["../../src/utils/validate-expressions.ts"],"names":[],"mappings":"AAAA,yEAAyE;AAEzE;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAgB1D,4EAA4E;AAC5E,SAAS,OAAO,CAAC,CAAU;IACzB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAa,CAAC;IAC3C,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,OAAO,CAAC,CAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAI,GAAc,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,2EAA2E;AAC3E,SAAS,eAAe,CAAC,OAAiB;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAoB,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAY,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;aACpH,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAgB,CAAC,CAAC;QACrF,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAE5C,MAAM,KAAK,GAAG,CACZ,KAAa,EACb,GAAY,EACZ,UAAmB,EACnB,QAAgC,WAAW,EACrC,EAAE;QACR,IAAI,GAAG,IAAI,IAAI;YAAE,OAAO;QACxB,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,GAAG,GAAG,kBAAkB,CAAC,WAAW,EAAE,GAAqD,EAC/F,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5G,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAClH,CAAC,CAAC;IAEF,sEAAsE;IACtE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,wEAAwE;QACxE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,MAAM,IAAI,EAAE,CAAW,CAAC;QACrD,MAAM,UAAU,GAAG,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QAE7F,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAW,CAAC;YAC1C,KAAK,CAAC,SAAS,QAAQ,aAAa,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,IAAI,aAAa,EAAE,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YACpG,0EAA0E;YAC1E,2EAA2E;YAC3E,0EAA0E;YAC1E,wEAAwE;YACxE,+DAA+D;YAC/D,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,gEAAgE;gBAChE,MAAM,EAAE,GACN,CAAC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7D,CAAC,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACxE,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,mEAAmE;gBACnE,yEAAyE;gBACzE,+DAA+D;gBAC/D,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;oBAC9B,MAAM,CAAC,IAAI,CAAC;wBACV,KAAK,EAAE,SAAS,QAAQ,aAAa,IAAI,CAAC,EAAE,qBAAqB;wBACjE,OAAO,EACL,iGAAiG;4BACjG,iFAAiF;4BACjF,yEAAyE;wBAC3E,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;qBACtE,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,MAAM,KAAK,iBAAiB,IAAI,CAAC,EAAE,EAAE,CAAC;oBAC/C,wEAAwE;oBACxE,oEAAoE;oBACpE,MAAM,CAAC,IAAI,CAAC;wBACV,KAAK,EAAE,SAAS,QAAQ,aAAa,IAAI,CAAC,EAAE,qBAAqB;wBACjE,OAAO,EACL,iGAAiG;4BACjG,qGAAqG;wBACvG,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;qBACtE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,KAAK,CAAC,SAAS,QAAQ,aAAa,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACxH,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,eAAe,CAAC;QAC3D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,WAAW,UAAU,mBAAoB,IAAI,CAAC,IAAe,IAAI,GAAG,GAAG,CAAC;YACtF,sEAAsE;YACtE,4EAA4E;YAC5E,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;YACxG,uEAAuE;YACvE,KAAK,CAAC,GAAG,KAAK,OAAO,EAAG,IAAe,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QACtE,CAAC;QACD,oEAAoE;QACpE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACrC,CAAC,CAAE,MAAmB;YACtB,CAAC,CAAC,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAgB,CAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9F,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,yEAAyE;YACzE,wEAAwE;YACxE,qEAAqE;YACrE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAI,CAAC,CAAC,IAAe,IAAI,GAAG,CAAC;gBACxC,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,cAAc,EAAE,qBAAqB,EAAE,aAAa,CAAU,EAAE,CAAC;oBAClG,KAAK,CAAC,WAAW,UAAU,cAAc,KAAK,KAAK,GAAG,EAAE,EAAG,CAAY,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACtG,CAAC;YACH,CAAC;YACD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC5C,mEAAmE;gBACnE,8EAA8E;gBAC9E,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,EAAE,CAAC,CAAC,OAAyD,EACjG,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC1G,MAAM,UAAU,GAAG,WAAW,UAAU,cAAe,CAAC,CAAC,IAAe,IAAI,GAAG,WAAW,CAAC;gBAC3F,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM;oBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;gBACxH,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;oBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9H,CAAC;QACH,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,sEAAsE;IACtE,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,UAAmB,EAAQ,EAAE;QAC/E,MAAM,GAAG,GAAG,UAAU;eACjB,CAAC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;eACvE,CAAC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QACjE,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;QACnC,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,8DAA8D;QAChG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,KAAK,CAAC,GAAG,KAAK,cAAc,IAAI,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC5E,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzC,KAAK,CAAC,GAAG,KAAK,cAAc,IAAI,YAAY,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChF,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,WAAW,CAAC,WAAW,UAAU,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,6EAA6E;IAC7E,6EAA6E;IAC7E,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM,KAAK,GAAG,gBAAiB,IAAI,CAAC,IAAe,IAAI,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC;QACzG,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrF,CAAC;IAED,sEAAsE;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,iEAAiE;IACjE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,sCAAsC;QACjH,KAAK,CAAC,SAAU,IAAI,CAAC,IAAe,IAAI,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChI,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/utils/validate-expressions.test.js

@@ -217,5 +217,104 @@ describe('validateStackExpressions (ADR-0032 build-time)', () => {
             expect(issues[0].severity).toBe('error');
         });
     });
+    describe('action visible/disabled predicates (record-scoped) — #2183 class', () => {
+        it('flags a bare-field `visible` on a stack action (the trap that hid Mark Done)', () => {
+            const issues = validateStackExpressions({
+                objects: [{ name: 'showcase_task', fields: { done: { type: 'boolean' }, status: { type: 'select' } } }],
+                actions: [{ name: 'mark_done', objectName: 'showcase_task', type: 'script', locations: ['record_header'], visible: '!done' }],
+            });
+            const v = issues.filter(i => i.where.includes("action 'mark_done' visible"));
+            expect(v).toHaveLength(1);
+            expect(v[0].severity).toBe('error');
+            expect(v[0].message).toMatch(/bare reference `done`/);
+        });
+        it('accepts the record-qualified form', () => {
+            const issues = validateStackExpressions({
+                objects: [{ name: 'showcase_task', fields: { done: { type: 'boolean' } } }],
+                actions: [{ name: 'mark_done', objectName: 'showcase_task', type: 'script', visible: '!record.done' }],
+            });
+            expect(issues).toHaveLength(0);
+        });
+        it('accepts ambient globals (ctx / features / user) used by platform actions', () => {
+            const issues = validateStackExpressions({
+                objects: [{ name: 'sys_user', fields: { id: { type: 'text' }, email_verified: { type: 'boolean' } } }],
+                actions: [{ name: 'verify_email', objectName: 'sys_user', visible: 'record.id == ctx.user.id && record.email_verified == false && features.x != true' }],
+            });
+            expect(issues).toHaveLength(0);
+        });
+        it('flags a bare-field `disabled` predicate but ignores a boolean `disabled`', () => {
+            const bad = validateStackExpressions({
+                objects: [{ name: 'crm_lead', fields: { status: { type: 'select' } } }],
+                actions: [{ name: 'park', objectName: 'crm_lead', disabled: 'status == "converted"' }],
+            });
+            expect(bad.filter(i => i.where.includes("action 'park' disabled"))).toHaveLength(1);
+            const ok = validateStackExpressions({
+                objects: [{ name: 'crm_lead', fields: { status: { type: 'select' } } }],
+                actions: [{ name: 'park', objectName: 'crm_lead', disabled: true }],
+            });
+            expect(ok).toHaveLength(0);
+        });
+        it('validates an action attached to an object (record scope = parent object)', () => {
+            const issues = validateStackExpressions({
+                objects: [{
+                        name: 'showcase_task',
+                        fields: { done: { type: 'boolean' } },
+                        actions: [{ name: 'mark_done', type: 'script', visible: '!done' }],
+                    }],
+            });
+            expect(issues.filter(i => i.where.includes("action 'mark_done' visible"))).toHaveLength(1);
+        });
+    });
+    describe('record-scoped coverage extensions (field rules / sharing / hooks / nested when)', () => {
+        it('flags a bare-field `readonlyWhen`/`requiredWhen` on a field', () => {
+            const issues = validateStackExpressions({
+                objects: [{
+                        name: 'showcase_task',
+                        fields: {
+                            done: { type: 'boolean', readonlyWhen: 'done == true' },
+                            title: { type: 'text', requiredWhen: 'status == "x"' },
+                        },
+                    }],
+            });
+            expect(issues.some(i => i.where.includes('readonlyWhen') && /bare reference `done`/.test(i.message))).toBe(true);
+            expect(issues.some(i => i.where.includes('requiredWhen') && /bare reference `status`/.test(i.message))).toBe(true);
+        });
+        it('accepts record-qualified field rules and the master-detail `parent` namespace', () => {
+            const issues = validateStackExpressions({
+                objects: [{
+                        name: 'inv_line',
+                        fields: {
+                            qty: { type: 'number', readonlyWhen: "parent.status == 'paid'" },
+                            note: { type: 'text', requiredWhen: 'record.qty >= 100' },
+                        },
+                    }],
+            });
+            expect(issues).toHaveLength(0);
+        });
+        it('flags a bare-field sharing-rule condition', () => {
+            const issues = validateStackExpressions({
+                objects: [{ name: 'crm_account', fields: { region: { type: 'text' } } }],
+                sharingRules: [{ name: 'sales_region', object: 'crm_account', condition: 'region == "EMEA"' }],
+            });
+            expect(issues.some(i => i.where.includes("sharingRule 'sales_region'") && /bare reference `region`/.test(i.message))).toBe(true);
+        });
+        it('flags a bare-field hook condition', () => {
+            const issues = validateStackExpressions({
+                objects: [{ name: 'crm_lead', fields: { status: { type: 'select' } } }],
+                hooks: [{ name: 'on_close', object: 'crm_lead', condition: 'status == "closed"' }],
+            });
+            expect(issues.some(i => i.where.includes("hook 'on_close'") && /bare reference `status`/.test(i.message))).toBe(true);
+        });
+        it('flags a bare-field nested `when` on a conditional validation rule', () => {
+            const issues = validateStackExpressions({
+                objects: [{
+                        name: 'crm_account',
+                        fields: { tier: { type: 'select' } },
+                        validations: [{ name: 'cond', type: 'conditional', when: 'tier == "gold"', then: { type: 'required' } }],
+                    }],
+            });
+            expect(issues.some(i => i.where.includes('when') && /bare reference `tier`/.test(i.message))).toBe(true);
+        });
+    });
 });
 //# sourceMappingURL=validate-expressions.test.js.map