bank20baht-validator 0.0.5 → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nattapong Promthong
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { applyFlags, approvalFields, defaultValue, evaluate, resolveViewFields, setLocale, validateField, type FormDefinition, type NestedData, type Registry, type WorkflowDefinition, type WorkflowForm } from 'bank20baht-ui/engine';
+import { applyFlags, approvalFields, defaultValue, evaluate, resolveViewFields, setLocale, validateField, type FormDefinition, type Locale, type NestedData, type Registry, type WorkflowDefinition, type WorkflowForm } from 'bank20baht-ui/engine';
 export type SchemaDefinition = FormDefinition | WorkflowDefinition;
 /** One violation. `ref` is the field key for forms, `formName.key` for workflows. */
 export interface ValidationIssue {
@@ -24,14 +24,17 @@ export declare function isFormDefinition(schema: unknown): schema is FormDefinit
  * views are client-side display only, the server always validates the full
  * form (a view can never weaken a validation rule).
  */
-export declare function validateFormData(form: FormDefinition, input: unknown, registry?: Registry): ValidationResult;
+export declare function validateFormData(form: FormDefinition, input: unknown, registry?: Registry, locale?: Locale): ValidationResult;
 /**
  * Validate a whole workflow submission — mirrors what `<baht-workflow>`
  * enforces across its steps: rules are evaluated first (`evaluate`), invisible
  * forms/fields are excluded, rule-derived `required` overrides the descriptor,
- * and approval steps demand a decision plus their comment policy.
+ * approval steps demand a decision plus their comment policy, and a rejected
+ * approval with `onReject: end` (the default) stops validation there — the
+ * client fires `baht-complete { status: 'rejected' }` immediately, so later
+ * forms are never visited.
  */
-export declare function validateWorkflowData(workflow: WorkflowDefinition, input: unknown, registry?: Registry): ValidationResult;
+export declare function validateWorkflowData(workflow: WorkflowDefinition, input: unknown, registry?: Registry, locale?: Locale): ValidationResult;
 /**
  * Validate a submission body's `data` against whichever schema kind `id`
  * resolved to. This is the single server entry point:
@@ -39,11 +42,16 @@ export declare function validateWorkflowData(workflow: WorkflowDefinition, input
  *   const schema = store.get(body.id);
  *   const result = validateSubmission(schema, body.data);
  */
-export declare function validateSubmission(schema: SchemaDefinition, data: unknown, registry?: Registry): ValidationResult;
+export declare function validateSubmission(schema: SchemaDefinition, data: unknown, registry?: Registry, locale?: Locale): ValidationResult;
 /**
  * Structural gate for storing builder output — the same checks the builder's
  * Import applies, so the server only ever stores schemas the client could
  * render. Throws with a human-readable message on bad input.
+ *
+ * Beyond shape it validates referential integrity (rule targets, condition
+ * refs, transition endpoints, onReject.goto) and compiles every `pattern`
+ * validator, so authoring defects surface at store time — not as a 500 or a
+ * submission that can never pass.
  */
 export declare function parseSchema(json: unknown): SchemaDefinition;
 export { applyFlags, approvalFields, defaultValue, evaluate, resolveViewFields, setLocale, validateField, };

package/dist/index.js

@@ -6,8 +6,49 @@
 // This package feeds the same JSON through the same engine functions, so a
 // request that bypasses the frontend hits the exact same rules — no codegen,
 // no recompile: swap the stored JSON and validation follows.
+//
+// Unlike the client, this package sits on a trust boundary: `input` is an
+// untrusted request body and the schema may predate parseSchema hardening.
+// Reads are own-property only, prototype-writing keys are rejected, and
+// every value must have the shape the UI control could actually emit before
+// the authored validators run.
 // ---------------------------------------------------------------------------
-import { applyFlags, approvalFields, defaultValue, evaluate, resolveViewFields, setLocale, t, validateField, walkPath, } from 'bank20baht-ui/engine';
+import { applyFlags, approvalFields, defaultValue, evaluate, getCatalog, resolveViewFields, setCatalog, setLocale, t, validateField, walkPath, } from 'bank20baht-ui/engine';
+/**
+ * Run `fn` with the catalog switched to `locale`, restoring the previous
+ * catalog after. The engine catalog is module-global; validation is fully
+ * synchronous, so scoping the switch this way is race-free even on a server
+ * interleaving requests with different locales.
+ */
+function withLocale(locale, fn) {
+    if (locale === undefined)
+        return fn();
+    const prev = getCatalog();
+    setLocale(locale);
+    try {
+        return fn();
+    }
+    finally {
+        setCatalog(prev);
+    }
+}
+/** Keys that write through Object.prototype — never valid as field/form names. */
+const UNSAFE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+const FIELD_TYPES = new Set([
+    'text',
+    'textarea',
+    'number',
+    'email',
+    'dropdown',
+    'multiselect',
+    'checkbox',
+    'radio',
+    'toggle',
+    'date',
+    'file',
+    'label',
+    'repeater',
+]);
 export function isWorkflowDefinition(schema) {
     return (isRecord(schema) &&
         typeof schema['workflowId'] === 'string' &&
@@ -27,6 +68,83 @@ function isRecord(v) {
 function sorted(fields) {
     return [...fields].sort((a, b) => a.order - b.order);
 }
+// ---- value-shape conformance -------------------------------------------------
+/**
+ * Client/server parity gate: the UI can only emit values of the field's shape
+ * (a dropdown emits one of its option keys, a number input a number, a toggle
+ * a boolean). A direct API call can send anything — `{"$gt":""}` is not
+ * "empty", `123` skips the email regex — so wrong shapes are rejected before
+ * the authored validators run and never reach canonical data.
+ * Returns a message, or null when the shape is fine. Empty values pass —
+ * `required` owns those.
+ */
+function typeIssue(field, value) {
+    if (value === null || value === undefined)
+        return null;
+    // dynamic options (optionsFrom) can't be checked without the registry fetch
+    const optionKeys = field.optionsFrom ? null : field.options?.map((o) => o.key);
+    switch (field.type) {
+        case 'text':
+        case 'textarea':
+        case 'email':
+        case 'date':
+            return typeof value === 'string' ? null : t('pattern');
+        case 'number':
+            return typeof value === 'number' && Number.isFinite(value) ? null : t('pattern');
+        case 'checkbox':
+        case 'toggle':
+            return typeof value === 'boolean' ? null : t('pattern');
+        case 'dropdown':
+        case 'radio': {
+            if (typeof value !== 'string')
+                return t('pattern');
+            return optionKeys && !optionKeys.includes(value) ? t('pattern') : null;
+        }
+        case 'multiselect': {
+            if (!Array.isArray(value) || value.some((v) => typeof v !== 'string'))
+                return t('pattern');
+            return optionKeys && value.some((v) => !optionKeys.includes(v))
+                ? t('pattern')
+                : null;
+        }
+        case 'file': {
+            const isFileValue = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+            if (field.multiple) {
+                return Array.isArray(value) && value.every(isFileValue) ? null : t('pattern');
+            }
+            return isFileValue(value) ? null : t('pattern');
+        }
+        case 'repeater':
+            return Array.isArray(value) ? null : t('pattern');
+        default:
+            return null; // 'label' never reaches here
+    }
+}
+/** Shape issues for one field, recursing one level into repeater rows. */
+function shapeIssues(field, value, ref) {
+    const message = typeIssue(field, value);
+    if (message !== null)
+        return [{ ref, message }];
+    const issues = [];
+    if (field.type === 'repeater' && Array.isArray(value)) {
+        value.forEach((row, i) => {
+            if (!isRecord(row)) {
+                issues.push({ ref: `${ref}[${i}]`, message: t('pattern') });
+                return;
+            }
+            for (const sub of field.fields ?? []) {
+                if (sub.type === 'label' || UNSAFE_KEYS.has(sub.key))
+                    continue;
+                const v = Object.hasOwn(row, sub.key) ? row[sub.key] : undefined;
+                const m = typeIssue(sub, v);
+                if (m !== null)
+                    issues.push({ ref: `${ref}[${i}].${sub.key}`, message: m });
+            }
+        });
+    }
+    return issues;
+}
+// ---- form validation -----------------------------------------------------------
 /**
  * Validate a standalone form submission — mirrors `<baht-form>.validate()`
  * with no derived field states: every non-label field, missing values fall
@@ -34,18 +152,38 @@ function sorted(fields) {
  * views are client-side display only, the server always validates the full
  * form (a view can never weaken a validation rule).
  */
-export function validateFormData(form, input, registry) {
+export function validateFormData(form, input, registry, locale) {
+    return withLocale(locale, () => formDataResult(form, input, registry));
+}
+function formDataResult(form, input, registry) {
     if (!isRecord(input)) {
         return { valid: false, issues: [{ ref: '$', message: 'data must be an object' }], data: {} };
     }
     const issues = [];
-    const fields = sorted(form.field_data).filter((f) => f.type !== 'label');
-    // canonical data first, so compare validators see every sibling
+    const fields = [];
+    for (const f of sorted(form.field_data)) {
+        if (f.type === 'label')
+            continue;
+        if (UNSAFE_KEYS.has(f.key)) {
+            issues.push({ ref: f.key, message: 'unsafe field key' });
+            continue;
+        }
+        fields.push(f);
+    }
+    // canonical data first, so compare validators see every sibling.
+    // Own-property reads only: `'toString' in input` is true via the prototype
+    // chain and would smuggle the inherited function in as the value.
     const data = {};
     for (const field of fields) {
-        data[field.key] = field.key in input ? input[field.key] : defaultValue(field);
+        data[field.key] = Object.hasOwn(input, field.key) ? input[field.key] : defaultValue(field);
     }
     for (const field of fields) {
+        const shape = shapeIssues(field, data[field.key], field.key);
+        if (shape.length > 0) {
+            issues.push(...shape);
+            data[field.key] = defaultValue(field); // junk never reaches canonical data
+            continue;
+        }
         for (const err of validateField(field, data[field.key], registry, data)) {
             issues.push({ ref: err.key, message: err.message });
         }
@@ -56,9 +194,15 @@ export function validateFormData(form, input, registry) {
  * Validate a whole workflow submission — mirrors what `<baht-workflow>`
  * enforces across its steps: rules are evaluated first (`evaluate`), invisible
  * forms/fields are excluded, rule-derived `required` overrides the descriptor,
- * and approval steps demand a decision plus their comment policy.
+ * approval steps demand a decision plus their comment policy, and a rejected
+ * approval with `onReject: end` (the default) stops validation there — the
+ * client fires `baht-complete { status: 'rejected' }` immediately, so later
+ * forms are never visited.
  */
-export function validateWorkflowData(workflow, input, registry) {
+export function validateWorkflowData(workflow, input, registry, locale) {
+    return withLocale(locale, () => workflowDataResult(workflow, input, registry));
+}
+function workflowDataResult(workflow, input, registry) {
     if (!isRecord(input)) {
         return { valid: false, issues: [{ ref: '$', message: 'data must be an object' }], data: {} };
     }
@@ -72,24 +216,43 @@ export function validateWorkflowData(workflow, input, registry) {
         }
     }
     const derived = evaluate(workflow, input);
-    const issues = [...derived.errors];
+    // Schema-integrity errors (unknown rule targets) belong at parseSchema /
+    // store time — the client never surfaces them, so failing submissions on
+    // them would reject data the client happily emits. Only data-dependent
+    // errors (rule non-convergence) gate the submission.
+    const issues = derived.errors
+        .filter((e) => e.kind === 'data')
+        .map((e) => ({ ref: e.ref, message: e.message }));
     // graph mode (spec 03 §6): only the forms on the path this data takes
     // validate; off-path branches are as good as skipped, their data dropped
-    const path = workflow.transitions && workflow.transitions.length > 0
-        ? new Set(walkPath(workflow, derived.data))
+    const pathList = workflow.transitions && workflow.transitions.length > 0
+        ? walkPath(workflow, derived.data)
         : null;
-    if (path) {
+    if (pathList) {
+        const path = new Set(pathList);
         for (const name of Object.keys(derived.data)) {
             if (!path.has(name))
                 delete derived.data[name];
         }
     }
-    const forms = [...workflow.forms].sort((a, b) => a.order - b.order);
-    for (const form of forms) {
-        if (derived.forms[form.formName]?.visible === false)
-            continue;
-        if (path && !path.has(form.formName))
-            continue;
+    // Forms in the order the client visits them: path order in graph mode,
+    // ascending `order` among visible forms in linear mode.
+    const byName = new Map(workflow.forms.map((f) => [f.formName, f]));
+    const ordered = pathList
+        ? pathList.map((n) => byName.get(n)).filter((f) => f !== undefined)
+        : [...workflow.forms]
+            .sort((a, b) => a.order - b.order)
+            .filter((f) => derived.forms[f.formName]?.visible !== false);
+    // Rejection cut: everything after a rejected end-on-reject approval is
+    // unvisited on the client and must not be demanded here.
+    const cut = ordered.findIndex((form) => {
+        if (form.kind !== 'approval')
+            return false;
+        const onReject = form.approval?.onReject ?? { action: 'end' };
+        return onReject.action === 'end' && derived.data[form.formName]?.['decision'] === 'rejected';
+    });
+    const visited = cut >= 0 ? ordered.slice(0, cut + 1) : ordered;
+    for (const form of visited) {
         if (form.kind === 'approval') {
             issues.push(...approvalIssues(form, derived.data));
             continue;
@@ -98,12 +261,22 @@ export function validateWorkflowData(workflow, input, registry) {
             if (field.type === 'label')
                 continue;
             const ref = `${form.formName}.${field.key}`;
+            if (UNSAFE_KEYS.has(field.key)) {
+                issues.push({ ref, message: 'unsafe field key' });
+                continue;
+            }
             const state = derived.fields[ref];
             if (state && !state.visible)
                 continue; // hidden fields excluded (spec 02 §5)
+            const formData = derived.data[form.formName] ?? {};
+            const shape = shapeIssues(field, formData[field.key], ref);
+            if (shape.length > 0) {
+                issues.push(...shape);
+                formData[field.key] = defaultValue(field); // junk never reaches canonical data
+                continue;
+            }
             const required = state ? state.required : !!field.required;
             const descriptor = required === !!field.required ? field : { ...field, required };
-            const formData = derived.data[form.formName] ?? {};
             for (const err of validateField(descriptor, formData[field.key], registry, formData)) {
                 issues.push({ ref, message: err.message });
             }
@@ -133,11 +306,11 @@ function approvalIssues(form, data) {
  *   const schema = store.get(body.id);
  *   const result = validateSubmission(schema, body.data);
  */
-export function validateSubmission(schema, data, registry) {
+export function validateSubmission(schema, data, registry, locale) {
     if (isWorkflowDefinition(schema))
-        return validateWorkflowData(schema, data, registry);
+        return validateWorkflowData(schema, data, registry, locale);
     if (isFormDefinition(schema))
-        return validateFormData(schema, data, registry);
+        return validateFormData(schema, data, registry, locale);
     return {
         valid: false,
         issues: [{ ref: '$', message: 'unrecognized schema: neither a form nor a workflow' }],
@@ -148,6 +321,11 @@ export function validateSubmission(schema, data, registry) {
  * Structural gate for storing builder output — the same checks the builder's
  * Import applies, so the server only ever stores schemas the client could
  * render. Throws with a human-readable message on bad input.
+ *
+ * Beyond shape it validates referential integrity (rule targets, condition
+ * refs, transition endpoints, onReject.goto) and compiles every `pattern`
+ * validator, so authoring defects surface at store time — not as a 500 or a
+ * submission that can never pass.
  */
 export function parseSchema(json) {
     const parsed = typeof json === 'string' ? JSON.parse(json) : json;
@@ -155,12 +333,21 @@ export function parseSchema(json) {
         throw new Error('not an object');
     if (isWorkflowDefinition(parsed)) {
         for (const f of parsed.forms) {
-            if (typeof f.formName !== 'string' || !Array.isArray(f.field_data)) {
+            if (!isRecord(f))
+                throw new Error('invalid form: expected an object');
+            if (typeof f.formName !== 'string' || f.formName === '' || !Array.isArray(f.field_data)) {
                 throw new Error(`invalid form ${JSON.stringify(f.formId)}`);
             }
+            if (UNSAFE_KEYS.has(f.formName) || f.formName.includes('.')) {
+                throw new Error(`invalid formName ${JSON.stringify(f.formName)}`);
+            }
+            if (typeof f.order !== 'number' || !Number.isFinite(f.order)) {
+                throw new Error(`form ${f.formName} needs a numeric order`);
+            }
             if (f.kind !== undefined && f.kind !== 'form' && f.kind !== 'approval') {
                 throw new Error(`invalid form kind ${JSON.stringify(f.kind)} on ${f.formName}`);
             }
+            assertValidFields(f);
             assertValidViews(f);
             assertValidRepeaters(f);
             if (f.view !== undefined && !f.views?.some((v) => v.name === f.view)) {
@@ -171,10 +358,29 @@ export function parseSchema(json) {
         if (new Set(names).size !== names.length) {
             throw new Error('formName must be unique in a workflow');
         }
+        const nameSet = new Set(names);
+        const refs = fieldRefs(parsed);
+        for (const f of parsed.forms) {
+            const approval = f.approval;
+            if (approval === undefined)
+                continue;
+            if (!isRecord(approval))
+                throw new Error(`invalid approval config on ${f.formName}`);
+            const onReject = approval.onReject;
+            if (onReject === undefined)
+                continue;
+            if (!isRecord(onReject) || (onReject.action !== 'end' && onReject.action !== 'goto')) {
+                throw new Error(`invalid onReject on ${f.formName}`);
+            }
+            if (onReject.action === 'goto' &&
+                (typeof onReject.form !== 'string' || !nameSet.has(onReject.form))) {
+                throw new Error(`onReject.goto targets unknown form ${JSON.stringify(onReject.form)} on ${f.formName}`);
+            }
+        }
+        assertValidRules(parsed, nameSet, refs);
         if (parsed.transitions !== undefined) {
             if (!Array.isArray(parsed.transitions))
                 throw new Error('transitions must be an array');
-            const nameSet = new Set(names);
             for (const tr of parsed.transitions) {
                 if (!isRecord(tr) || typeof tr.from !== 'string' || typeof tr.to !== 'string') {
                     throw new Error('invalid transition: expected { from, to }');
@@ -185,17 +391,197 @@ export function parseSchema(json) {
                 if (tr.to !== 'end' && !nameSet.has(tr.to)) {
                     throw new Error(`transition to unknown form ${JSON.stringify(tr.to)}`);
                 }
+                assertValidCondition(tr.when, refs, `transition ${tr.from} -> ${tr.to}`);
             }
         }
         return parsed;
     }
     if (isFormDefinition(parsed)) {
+        assertValidFields(parsed);
         assertValidViews(parsed);
         assertValidRepeaters(parsed);
         return parsed;
     }
     throw new Error('missing workflowId/forms/rules (workflow) or formId/formName/field_data (form)');
 }
+// ---- parseSchema internals ----------------------------------------------------
+/** Every addressable "formName.key" a rule/condition/expression may reference. */
+function fieldRefs(wf) {
+    const refs = new Set();
+    for (const form of wf.forms) {
+        for (const field of [...form.field_data, ...approvalFields(form)]) {
+            if (field.type === 'label')
+                continue;
+            refs.add(`${form.formName}.${field.key}`);
+        }
+    }
+    return refs;
+}
+function assertValidFields(form) {
+    const seen = new Set();
+    for (const raw of form.field_data) {
+        if (!isRecord(raw))
+            throw new Error(`invalid field on ${form.formName}: expected an object`);
+        const field = raw;
+        assertFieldShape(field, form.formName);
+        if (field.key !== undefined) {
+            if (seen.has(field.key)) {
+                throw new Error(`duplicate field key ${JSON.stringify(field.key)} on ${form.formName}`);
+            }
+            seen.add(field.key);
+        }
+        if (field.fields !== undefined) {
+            if (!Array.isArray(field.fields)) {
+                throw new Error(`fields[] on ${form.formName}.${field.key} must be an array`);
+            }
+            for (const sub of field.fields) {
+                if (!isRecord(sub)) {
+                    throw new Error(`invalid sub-field on ${form.formName}.${field.key}: expected an object`);
+                }
+                assertFieldShape(sub, form.formName);
+            }
+        }
+    }
+}
+function assertFieldShape(field, formName) {
+    if (typeof field.type !== 'string' || !FIELD_TYPES.has(field.type)) {
+        throw new Error(`unknown field type ${JSON.stringify(field.type)} on ${formName}`);
+    }
+    // labels are static blocks and may omit the key; everything else needs one
+    if (field.type !== 'label' || field.key !== undefined) {
+        if (typeof field.key !== 'string' || field.key === '') {
+            throw new Error(`field on ${formName} needs a non-empty string key`);
+        }
+        if (UNSAFE_KEYS.has(field.key) || field.key.includes('.')) {
+            throw new Error(`invalid field key ${JSON.stringify(field.key)} on ${formName}`);
+        }
+    }
+    if (field.options !== undefined) {
+        if (!Array.isArray(field.options) ||
+            field.options.some((o) => !isRecord(o) || typeof o.key !== 'string')) {
+            throw new Error(`invalid options on ${formName}.${field.key}: expected { key, label } items`);
+        }
+    }
+    if (field.validators !== undefined) {
+        if (!Array.isArray(field.validators)) {
+            throw new Error(`validators on ${formName}.${field.key} must be an array`);
+        }
+        for (const v of field.validators) {
+            if (!isRecord(v) || typeof v.type !== 'string') {
+                throw new Error(`invalid validator on ${formName}.${field.key}`);
+            }
+            if (v.type === 'pattern') {
+                // compile now — an invalid regex would otherwise throw (or hang, if
+                // catastrophic) inside validateField on every future submission
+                try {
+                    new RegExp(String(v.value));
+                }
+                catch {
+                    throw new Error(`invalid pattern ${JSON.stringify(v.value)} on ${formName}.${field.key}`);
+                }
+            }
+        }
+    }
+}
+function assertValidRules(wf, formNames, refs) {
+    wf.rules.forEach((raw, i) => {
+        if (!isRecord(raw))
+            throw new Error(`invalid rule at index ${i}: expected an object`);
+        const rule = raw;
+        const where = `rule ${typeof rule.id === 'string' ? JSON.stringify(rule.id) : i}`;
+        if (rule.priority !== undefined && typeof rule.priority !== 'number') {
+            throw new Error(`${where}: priority must be a number`);
+        }
+        assertValidCondition(rule.when, refs, where);
+        for (const branch of ['then', 'else']) {
+            const actions = rule[branch];
+            if (actions === undefined)
+                continue;
+            if (!Array.isArray(actions))
+                throw new Error(`${where}: ${branch} must be an array`);
+            for (const rawAction of actions) {
+                if (!isRecord(rawAction) || typeof rawAction.action !== 'string') {
+                    throw new Error(`${where}: invalid action`);
+                }
+                const target = rawAction.target;
+                if (!isRecord(target) || typeof target.form !== 'string') {
+                    throw new Error(`${where}: action needs a target form`);
+                }
+                if (!formNames.has(target.form)) {
+                    throw new Error(`${where} targets unknown form ${JSON.stringify(target.form)}`);
+                }
+                const formLevel = rawAction.action === 'showForm' ||
+                    rawAction.action === 'hideForm' ||
+                    rawAction.action === 'skipForm';
+                if (!formLevel) {
+                    const ref = `${target.form}.${String(target.field)}`;
+                    if (typeof target.field !== 'string' || !refs.has(ref)) {
+                        throw new Error(`${where} targets unknown field ${JSON.stringify(ref)}`);
+                    }
+                }
+                if (rawAction.action === 'setValue') {
+                    assertValidExpr(rawAction.value, refs, where);
+                }
+            }
+        }
+    });
+}
+function assertValidCondition(cond, refs, where) {
+    if (cond === undefined)
+        return; // omitted = always true
+    if (!isRecord(cond))
+        throw new Error(`invalid condition in ${where}`);
+    if ('and' in cond || 'or' in cond) {
+        const list = cond['and'] ?? cond['or'];
+        if (!Array.isArray(list))
+            throw new Error(`invalid condition in ${where}`);
+        for (const c of list)
+            assertValidCondition(c, refs, where);
+        return;
+    }
+    if ('not' in cond) {
+        assertValidCondition(cond['not'], refs, where);
+        return;
+    }
+    if (typeof cond['field'] !== 'string' || !refs.has(cond['field'])) {
+        throw new Error(`${where} references unknown field ${JSON.stringify(cond['field'])}`);
+    }
+    const valueField = cond['valueField'];
+    if (valueField !== undefined && (typeof valueField !== 'string' || !refs.has(valueField))) {
+        throw new Error(`${where} references unknown field ${JSON.stringify(valueField)}`);
+    }
+}
+function assertValidExpr(expr, refs, where) {
+    if (!isRecord(expr))
+        throw new Error(`${where}: invalid value expression`);
+    if ('ref' in expr) {
+        if (typeof expr['ref'] !== 'string' || !refs.has(expr['ref'])) {
+            throw new Error(`${where} references unknown field ${JSON.stringify(expr['ref'])}`);
+        }
+        return;
+    }
+    if ('const' in expr)
+        return;
+    if ('op' in expr) {
+        if (!Array.isArray(expr['args'])) {
+            throw new Error(`${where}: expression args must be an array`);
+        }
+        for (const a of expr['args'])
+            assertValidExpr(a, refs, where);
+        return;
+    }
+    if ('if' in expr) {
+        const triple = expr['if'];
+        if (!Array.isArray(triple) || triple.length !== 3) {
+            throw new Error(`${where}: if expression needs [condition, then, else]`);
+        }
+        assertValidCondition(triple[0], refs, where);
+        assertValidExpr(triple[1], refs, where);
+        assertValidExpr(triple[2], refs, where);
+        return;
+    }
+    throw new Error(`${where}: invalid value expression`);
+}
 /**
  * View integrity — views are client-side display projections, but a stored
  * one must always resolve on the client: names unique and shaped right, every

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bank20baht-validator",
-  "version": "0.0.5",
+  "version": "0.1.0",
   "type": "module",
   "description": "Runtime validation for bahtui form/workflow JSON — the exact engine rules the client runs, on the server.",
   "license": "MIT",
@@ -18,8 +18,7 @@
     "forms",
     "workflow",
     "validation",
-    "server",
-    "json-schema"
+    "server"
   ],
   "publishConfig": {
     "access": "public"
@@ -30,19 +29,25 @@
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
-    }
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "test": "vitest run",
     "test:watch": "vitest"
   },
-  "dependencies": {
-    "bank20baht-ui": "^0.0.11"
-  },
   "devDependencies": {
+    "bank20baht-ui": "^0.1.0",
     "typescript": "^5.8.3",
     "vitest": "^3.2.4"
-  }
+  },
+  "peerDependencies": {
+    "bank20baht-ui": ">=0.1.0 <0.2.0"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false
 }