bank20baht-validator 0.3.5 → 0.3.7

package/dist/index.js

@@ -54,16 +54,16 @@ const FIELD_TYPES = new Set([
 ]);
 export function isWorkflowDefinition(schema) {
     return (isRecord(schema) &&
-        typeof schema['workflow_id'] === 'string' &&
-        Array.isArray(schema['forms']) &&
-        Array.isArray(schema['rules']));
+        typeof schema.workflow_id === 'string' &&
+        Array.isArray(schema.forms) &&
+        Array.isArray(schema.rules));
 }
 export function isFormDefinition(schema) {
     return (isRecord(schema) &&
         !isWorkflowDefinition(schema) &&
-        typeof schema['form_id'] === 'string' &&
-        typeof schema['form_name'] === 'string' &&
-        Array.isArray(schema['fields']));
+        typeof schema.form_id === 'string' &&
+        typeof schema.form_name === 'string' &&
+        Array.isArray(schema.fields));
 }
 function isRecord(v) {
     return typeof v === 'object' && v !== null && !Array.isArray(v);
@@ -81,6 +81,38 @@ function sorted(fields) {
  * Returns a message, or null when the shape is fine. Empty values pass —
  * `required` owns those.
  */
+function shapeMessage(ok) {
+    return ok ? null : t('pattern');
+}
+// value shape follows date_mode; every entry must be a real ISO calendar
+// day. `enable_time` also accepts an ISO local datetime (what the
+// picker actually emits) - a bare day is still fine on that field too,
+// for callers that only ever cared about the date part.
+function dateIssue(field, value) {
+    const isDay = (v) => parseIsoDate(v) !== null || (field.enable_time === true && parseIsoDateTime(v) !== null);
+    const mode = field.date_mode ?? 'single';
+    if (mode === 'range') {
+        return shapeMessage(Array.isArray(value) && value.length === 2 && value.every(isDay));
+    }
+    if (mode === 'multiple')
+        return shapeMessage(Array.isArray(value) && value.every(isDay));
+    return shapeMessage(isDay(value));
+}
+function choiceIssue(value, optionKeys) {
+    if (typeof value !== 'string')
+        return t('pattern');
+    return shapeMessage(!optionKeys || optionKeys.includes(value));
+}
+function multiChoiceIssue(value, optionKeys) {
+    if (!Array.isArray(value) || value.some((v) => typeof v !== 'string'))
+        return t('pattern');
+    return shapeMessage(!optionKeys || value.every((v) => optionKeys.includes(v)));
+}
+function fileIssue(field, value) {
+    if (field.multiple)
+        return shapeMessage(Array.isArray(value) && value.every(isRecord));
+    return shapeMessage(isRecord(value));
+}
 function typeIssue(field, value) {
     if (value === null || value === undefined)
         return null;
@@ -91,54 +123,27 @@ function typeIssue(field, value) {
         case 'textarea':
         case 'email':
         case 'password':
-            return typeof value === 'string' ? null : t('pattern');
-        case 'date': {
-            // value shape follows date_mode; every entry must be a real ISO calendar
-            // day. `enable_time` also accepts an ISO local datetime (what the
-            // picker actually emits) - a bare day is still fine on that field too,
-            // for callers that only ever cared about the date part.
-            const isDay = (v) => parseIsoDate(v) !== null || (field.enable_time && parseIsoDateTime(v) !== null);
-            switch (field.date_mode ?? 'single') {
-                case 'range':
-                    return Array.isArray(value) && value.length === 2 && value.every(isDay)
-                        ? null
-                        : t('pattern');
-                case 'multiple':
-                    return Array.isArray(value) && value.every(isDay) ? null : t('pattern');
-                default:
-                    return isDay(value) ? null : t('pattern');
-            }
-        }
+            return shapeMessage(typeof value === 'string');
+        case 'date':
+            return dateIssue(field, value);
         case 'number':
         case 'currency':
-            return typeof value === 'number' && Number.isFinite(value) ? null : t('pattern');
+            return shapeMessage(typeof value === 'number' && Number.isFinite(value));
         case 'checkbox':
         case 'toggle':
-            return typeof value === 'boolean' ? null : t('pattern');
+            return shapeMessage(typeof value === 'boolean');
         case 'dropdown':
-        case 'radio': {
-            if (typeof value !== 'string')
-                return t('pattern');
-            return optionKeys && !optionKeys.includes(value) ? t('pattern') : null;
-        }
-        case 'multiselect': {
-            if (!Array.isArray(value) || value.some((v) => typeof v !== 'string'))
-                return t('pattern');
-            return optionKeys && value.some((v) => !optionKeys.includes(v))
-                ? t('pattern')
-                : null;
-        }
-        case 'file': {
-            const isFileValue = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
-            if (field.multiple) {
-                return Array.isArray(value) && value.every(isFileValue) ? null : t('pattern');
-            }
-            return isFileValue(value) ? null : t('pattern');
-        }
+        case 'radio':
+            return choiceIssue(value, optionKeys);
+        case 'multiselect':
+            return multiChoiceIssue(value, optionKeys);
+        case 'file':
+            return fileIssue(field, value);
         case 'repeater':
-            return Array.isArray(value) ? null : t('pattern');
-        default:
-            return null; // 'label' never reaches here
+            return shapeMessage(Array.isArray(value));
+        case 'label':
+        case 'section':
+            return null; // static blocks carry no value
     }
 }
 /** Shape issues for one field, recursing one level into repeater rows. */
@@ -230,9 +235,9 @@ function submitScriptIssues(form, data, registry, refPrefix = '') {
         setValue: (key, value) => {
             data[key] = value;
         },
-        setState: () => { },
-        resetState: () => { },
-        setFieldMessage: () => { },
+        setState: () => undefined,
+        resetState: () => undefined,
+        setFieldMessage: () => undefined,
         addFormMessage: (m) => {
             messages.push(m);
         },
@@ -266,7 +271,8 @@ function submitScriptIssues(form, data, registry, refPrefix = '') {
 export function validateWorkflowData(workflow, input, registry, locale) {
     return withLocale(locale, () => workflowDataResult(workflow, input, registry));
 }
-function workflowDataResult(workflow, input, registry) {
+/** Early-out for input that is not `{ formName: {…} }`, else null. */
+function workflowInputRejection(input) {
     if (!isRecord(input)) {
         return { valid: false, issues: [{ ref: '$', message: 'data must be an object' }], data: {} };
     }
@@ -279,72 +285,96 @@ function workflowDataResult(workflow, input, registry) {
             };
         }
     }
-    const derived = evaluate(workflow, input);
-    // Schema-integrity errors (unknown rule targets) belong at parseSchema /
-    // store time — the client never surfaces them, so failing submissions on
-    // them would reject data the client happily emits. Only data-dependent
-    // errors (rule non-convergence) gate the submission.
-    const issues = derived.errors
-        .filter((e) => e.kind === 'data')
-        .map((e) => ({ ref: e.ref, message: e.message }));
-    // graph mode (spec 03 §6): only the forms on the path this data takes
-    // validate; off-path branches are as good as skipped, their data dropped
-    const pathList = workflow.transitions && workflow.transitions.length > 0
-        ? walkPath(workflow, derived.data)
-        : null;
-    if (pathList) {
-        const path = new Set(pathList);
-        for (const name of Object.keys(derived.data)) {
-            if (!path.has(name))
-                delete derived.data[name];
-        }
-    }
-    // Forms in the order the client visits them: path order in graph mode,
-    // ascending `order` among visible forms in linear mode.
+    return null;
+}
+/**
+ * Forms in the order the client visits them (path order in graph mode,
+ * ascending `order` among visible forms in linear mode), cut after a rejected
+ * end-on-reject approval: everything after it is unvisited on the client and
+ * must not be demanded here.
+ */
+function visitedForms(workflow, derived, pathList) {
     const byName = new Map(workflow.forms.map((f) => [f.form_name, f]));
     const ordered = pathList
         ? pathList.map((n) => byName.get(n)).filter((f) => f !== undefined)
         : [...workflow.forms]
             .sort((a, b) => a.order - b.order)
             .filter((f) => derived.forms[f.form_name]?.visible !== false);
-    // Rejection cut: everything after a rejected end-on-reject approval is
-    // unvisited on the client and must not be demanded here.
     const cut = ordered.findIndex((form) => {
         if (form.kind !== 'approval')
             return false;
         const on_reject = form.approval?.on_reject ?? { action: 'end' };
-        return on_reject.action === 'end' && derived.data[form.form_name]?.['decision'] === 'rejected';
+        return on_reject.action === 'end' && derived.data[form.form_name]?.decision === 'rejected';
     });
-    const visited = cut >= 0 ? ordered.slice(0, cut + 1) : ordered;
-    for (const form of visited) {
+    return cut >= 0 ? ordered.slice(0, cut + 1) : ordered;
+}
+function workflowFieldIssues(form, field, derived, registry) {
+    const ref = `${form.form_name}.${field.key}`;
+    if (UNSAFE_KEYS.has(field.key))
+        return [{ ref, message: 'unsafe field key' }];
+    const state = derived.fields[ref];
+    if (state && !state.visible)
+        return []; // hidden fields excluded (spec 02 §5)
+    const formData = derived.data[form.form_name] ?? {};
+    const shape = shapeIssues(field, formData[field.key], ref);
+    if (shape.length > 0) {
+        formData[field.key] = defaultValue(field); // junk never reaches canonical data
+        return shape;
+    }
+    const required = state ? state.required : !!field.required;
+    const descriptor = required === !!field.required ? field : { ...field, required };
+    return validateField(descriptor, formData[field.key], registry, formData).map((err) => ({
+        ref,
+        message: err.message,
+    }));
+}
+function formFieldIssues(form, derived, registry) {
+    const issues = [];
+    for (const field of sorted(form.fields)) {
+        if (field.type === 'label')
+            continue;
+        issues.push(...workflowFieldIssues(form, field, derived, registry));
+    }
+    return issues;
+}
+/**
+ * Graph mode (spec 03 §6): only the forms on the path this data takes
+ * validate; off-path branches are as good as skipped, their data dropped.
+ * Returns the path, or null in linear mode.
+ */
+function pruneOffPath(workflow, derived) {
+    const pathList = workflow.transitions && workflow.transitions.length > 0
+        ? walkPath(workflow, derived.data)
+        : null;
+    if (pathList) {
+        const path = new Set(pathList);
+        for (const name of Object.keys(derived.data)) {
+            // eslint-disable-next-line @typescript-eslint/no-dynamic-delete -- pruning off-path forms from a plain-object map keyed by form_name
+            if (!path.has(name))
+                delete derived.data[name];
+        }
+    }
+    return pathList;
+}
+function workflowDataResult(workflow, input, registry) {
+    const rejection = workflowInputRejection(input);
+    if (rejection)
+        return rejection;
+    const derived = evaluate(workflow, input);
+    // Schema-integrity errors (unknown rule targets) belong at parseSchema /
+    // store time — the client never surfaces them, so failing submissions on
+    // them would reject data the client happily emits. Only data-dependent
+    // errors (rule non-convergence) gate the submission.
+    const issues = derived.errors
+        .filter((e) => e.kind === 'data')
+        .map((e) => ({ ref: e.ref, message: e.message }));
+    const pathList = pruneOffPath(workflow, derived);
+    for (const form of visitedForms(workflow, derived, pathList)) {
         if (form.kind === 'approval') {
             issues.push(...approvalIssues(form, derived.data));
             continue;
         }
-        for (const field of sorted(form.fields)) {
-            if (field.type === 'label')
-                continue;
-            const ref = `${form.form_name}.${field.key}`;
-            if (UNSAFE_KEYS.has(field.key)) {
-                issues.push({ ref, message: 'unsafe field key' });
-                continue;
-            }
-            const state = derived.fields[ref];
-            if (state && !state.visible)
-                continue; // hidden fields excluded (spec 02 §5)
-            const formData = derived.data[form.form_name] ?? {};
-            const shape = shapeIssues(field, formData[field.key], ref);
-            if (shape.length > 0) {
-                issues.push(...shape);
-                formData[field.key] = defaultValue(field); // junk never reaches canonical data
-                continue;
-            }
-            const required = state ? state.required : !!field.required;
-            const descriptor = required === !!field.required ? field : { ...field, required };
-            for (const err of validateField(descriptor, formData[field.key], registry, formData)) {
-                issues.push({ ref, message: err.message });
-            }
-        }
+        issues.push(...formFieldIssues(form, derived, registry));
         if (hasScripts(form, 'submit')) {
             const formData = (derived.data[form.form_name] ??= {});
             issues.push(...submitScriptIssues(form, formData, registry, `${form.form_name}.`));
@@ -356,13 +386,14 @@ function workflowDataResult(workflow, input, registry) {
 function approvalIssues(form, data) {
     const issues = [];
     const values = data[form.form_name] ?? {};
-    const decision = values['decision'];
+    const decision = values.decision;
     if (decision !== 'approved' && decision !== 'rejected') {
         issues.push({ ref: `${form.form_name}.decision`, message: t('decisionRequired') });
     }
     const mode = form.approval?.comment ?? 'optional';
     const commentRequired = mode === 'required' || (mode === 'requireOnReject' && decision === 'rejected');
-    if (commentRequired && String(values['comment'] ?? '').trim() === '') {
+    // eslint-disable-next-line @typescript-eslint/no-base-to-string -- mirrors <baht-workflow>.decide(): String(comment ?? '') on an untrusted value
+    if (commentRequired && String(values.comment ?? '').trim() === '') {
         issues.push({ ref: `${form.form_name}.comment`, message: t('commentRequired') });
     }
     return issues;
@@ -406,80 +437,91 @@ export function parseSchema(json) {
         console.warn(`[bank20baht-validator] legacy camelCase schema keys migrated (${renamed.length}): ${renamed.slice(0, 5).join(', ')}${renamed.length > 5 ? ', …' : ''} — re-save the schema with snake_case keys.`);
     }
     if (isWorkflowDefinition(parsed)) {
-        for (const f of parsed.forms) {
-            if (!isRecord(f))
-                throw new Error('invalid form: expected an object');
-            if (typeof f.form_name !== 'string' || f.form_name === '' || !Array.isArray(f.fields)) {
-                throw new Error(`invalid form ${JSON.stringify(f.form_id)}`);
-            }
-            if (UNSAFE_KEYS.has(f.form_name) || f.form_name.includes('.')) {
-                throw new Error(`invalid form_name ${JSON.stringify(f.form_name)}`);
-            }
-            if (typeof f.order !== 'number' || !Number.isFinite(f.order)) {
-                throw new Error(`form ${f.form_name} needs a numeric order`);
-            }
-            if (f.kind !== undefined && f.kind !== 'form' && f.kind !== 'approval') {
-                throw new Error(`invalid form kind ${JSON.stringify(f.kind)} on ${f.form_name}`);
-            }
-            assertValidFields(f);
-            assertValidViews(f);
-            assertValidRepeaters(f);
-            assertValidScripts(f);
-            if (f.view !== undefined && !f.views?.some((v) => v.name === f.view)) {
-                throw new Error(`step view ${JSON.stringify(f.view)} on ${f.form_name} matches no view`);
-            }
-        }
-        const names = parsed.forms.map((f) => f.form_name);
-        if (new Set(names).size !== names.length) {
-            throw new Error('formName must be unique in a workflow');
-        }
-        const nameSet = new Set(names);
-        const refs = fieldRefs(parsed);
-        for (const f of parsed.forms) {
-            const approval = f.approval;
-            if (approval === undefined)
-                continue;
-            if (!isRecord(approval))
-                throw new Error(`invalid approval config on ${f.form_name}`);
-            const on_reject = approval.on_reject;
-            if (on_reject === undefined)
-                continue;
-            if (!isRecord(on_reject) || (on_reject.action !== 'end' && on_reject.action !== 'goto')) {
-                throw new Error(`invalid on_reject on ${f.form_name}`);
-            }
-            if (on_reject.action === 'goto' &&
-                (typeof on_reject.form !== 'string' || !nameSet.has(on_reject.form))) {
-                throw new Error(`on_reject.goto targets unknown form ${JSON.stringify(on_reject.form)} on ${f.form_name}`);
-            }
-        }
-        assertValidRules(parsed, nameSet, refs);
-        if (parsed.transitions !== undefined) {
-            if (!Array.isArray(parsed.transitions))
-                throw new Error('transitions must be an array');
-            for (const tr of parsed.transitions) {
-                if (!isRecord(tr) || typeof tr.from !== 'string' || typeof tr.to !== 'string') {
-                    throw new Error('invalid transition: expected { from, to }');
-                }
-                if (!nameSet.has(tr.from)) {
-                    throw new Error(`transition from unknown form ${JSON.stringify(tr.from)}`);
-                }
-                if (tr.to !== 'end' && !nameSet.has(tr.to)) {
-                    throw new Error(`transition to unknown form ${JSON.stringify(tr.to)}`);
-                }
-                assertValidCondition(tr.when, refs, `transition ${tr.from} -> ${tr.to}`);
-            }
-        }
+        assertValidWorkflow(parsed);
         return parsed;
     }
     if (isFormDefinition(parsed)) {
-        assertValidFields(parsed);
-        assertValidViews(parsed);
-        assertValidRepeaters(parsed);
-        assertValidScripts(parsed);
+        assertFormParts(parsed);
         return parsed;
     }
     throw new Error('missing workflow_id/forms/rules (workflow) or form_id/form_name/fields (form)');
 }
+function assertFormParts(form) {
+    assertValidFields(form);
+    assertValidViews(form);
+    assertValidRepeaters(form);
+    assertValidScripts(form);
+}
+function assertWorkflowForm(f) {
+    if (!isRecord(f))
+        throw new Error('invalid form: expected an object');
+    if (typeof f.form_name !== 'string' || f.form_name === '' || !Array.isArray(f.fields)) {
+        throw new Error(`invalid form ${JSON.stringify(f.form_id)}`);
+    }
+    if (UNSAFE_KEYS.has(f.form_name) || f.form_name.includes('.')) {
+        throw new Error(`invalid form_name ${JSON.stringify(f.form_name)}`);
+    }
+    if (typeof f.order !== 'number' || !Number.isFinite(f.order)) {
+        throw new Error(`form ${f.form_name} needs a numeric order`);
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- runtime guard: value is untrusted JSON
+    if (f.kind !== undefined && f.kind !== 'form' && f.kind !== 'approval') {
+        throw new Error(`invalid form kind ${JSON.stringify(f.kind)} on ${f.form_name}`);
+    }
+    assertFormParts(f);
+    if (f.view !== undefined && !f.views?.some((v) => v.name === f.view)) {
+        throw new Error(`step view ${JSON.stringify(f.view)} on ${f.form_name} matches no view`);
+    }
+}
+function assertApprovalConfig(f, nameSet) {
+    const approval = f.approval;
+    if (approval === undefined)
+        return;
+    if (!isRecord(approval))
+        throw new Error(`invalid approval config on ${f.form_name}`);
+    const on_reject = approval.on_reject;
+    if (on_reject === undefined)
+        return;
+    if (!isRecord(on_reject) || (on_reject.action !== 'end' && on_reject.action !== 'goto')) {
+        throw new Error(`invalid on_reject on ${f.form_name}`);
+    }
+    if (on_reject.action === 'goto' &&
+        (typeof on_reject.form !== 'string' || !nameSet.has(on_reject.form))) {
+        throw new Error(`on_reject.goto targets unknown form ${JSON.stringify(on_reject.form)} on ${f.form_name}`);
+    }
+}
+function assertTransitions(wf, nameSet, refs) {
+    if (wf.transitions === undefined)
+        return;
+    if (!Array.isArray(wf.transitions))
+        throw new Error('transitions must be an array');
+    for (const tr of wf.transitions) {
+        if (!isRecord(tr) || typeof tr.from !== 'string' || typeof tr.to !== 'string') {
+            throw new Error('invalid transition: expected { from, to }');
+        }
+        if (!nameSet.has(tr.from)) {
+            throw new Error(`transition from unknown form ${JSON.stringify(tr.from)}`);
+        }
+        if (tr.to !== 'end' && !nameSet.has(tr.to)) {
+            throw new Error(`transition to unknown form ${JSON.stringify(tr.to)}`);
+        }
+        assertValidCondition(tr.when, refs, `transition ${tr.from} -> ${tr.to}`);
+    }
+}
+function assertValidWorkflow(parsed) {
+    for (const f of parsed.forms)
+        assertWorkflowForm(f);
+    const names = parsed.forms.map((f) => f.form_name);
+    if (new Set(names).size !== names.length) {
+        throw new Error('formName must be unique in a workflow');
+    }
+    const nameSet = new Set(names);
+    const refs = fieldRefs(parsed);
+    for (const f of parsed.forms)
+        assertApprovalConfig(f, nameSet);
+    assertValidRules(parsed, nameSet, refs);
+    assertTransitions(parsed, nameSet, refs);
+}
 // ---- parseSchema internals ----------------------------------------------------
 /** Every addressable "formName.key" a rule/condition/expression may reference. */
 function fieldRefs(wf) {
@@ -493,6 +535,19 @@ function fieldRefs(wf) {
     }
     return refs;
 }
+function assertSubFields(field, form_name) {
+    if (field.fields === undefined)
+        return;
+    if (!Array.isArray(field.fields)) {
+        throw new Error(`fields[] on ${form_name}.${field.key} must be an array`);
+    }
+    for (const sub of field.fields) {
+        if (!isRecord(sub)) {
+            throw new Error(`invalid sub-field on ${form_name}.${field.key}: expected an object`);
+        }
+        assertFieldShape(sub, form_name);
+    }
+}
 function assertValidFields(form) {
     const seen = new Set();
     for (const raw of form.fields) {
@@ -500,23 +555,14 @@ function assertValidFields(form) {
             throw new Error(`invalid field on ${form.form_name}: expected an object`);
         const field = raw;
         assertFieldShape(field, form.form_name);
+        // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- runtime guard: value is untrusted JSON
         if (field.key !== undefined) {
             if (seen.has(field.key)) {
                 throw new Error(`duplicate field key ${JSON.stringify(field.key)} on ${form.form_name}`);
             }
             seen.add(field.key);
         }
-        if (field.fields !== undefined) {
-            if (!Array.isArray(field.fields)) {
-                throw new Error(`fields[] on ${form.form_name}.${field.key} must be an array`);
-            }
-            for (const sub of field.fields) {
-                if (!isRecord(sub)) {
-                    throw new Error(`invalid sub-field on ${form.form_name}.${field.key}: expected an object`);
-                }
-                assertFieldShape(sub, form.form_name);
-            }
-        }
+        assertSubFields(field, form.form_name);
     }
 }
 /**
@@ -538,53 +584,62 @@ function hasNestedUnboundedQuantifier(pattern) {
     const unbounded = '(?:[*+]|\\{\\d+,\\})';
     return new RegExp(`\\((?:\\?:)?[^()|]${unbounded}\\??\\)${unbounded}`).test(stripped);
 }
+function assertFieldKey(field, form_name) {
+    // labels are static blocks and may omit the key; everything else needs one
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- runtime guard: value is untrusted JSON
+    if (field.type === 'label' && field.key === undefined)
+        return;
+    if (typeof field.key !== 'string' || field.key === '') {
+        throw new Error(`field on ${form_name} needs a non-empty string key`);
+    }
+    if (UNSAFE_KEYS.has(field.key) || field.key.includes('.')) {
+        throw new Error(`invalid field key ${JSON.stringify(field.key)} on ${form_name}`);
+    }
+}
+function assertPatternValidator(v, where) {
+    // compile now — an invalid regex would otherwise throw (or hang, if
+    // catastrophic) inside validateField on every future submission
+    const pattern = String(v.value);
+    try {
+        new RegExp(pattern);
+    }
+    catch {
+        throw new Error(`invalid pattern ${JSON.stringify(v.value)} on ${where}`);
+    }
+    if (hasNestedUnboundedQuantifier(pattern)) {
+        throw new Error(`pattern on ${where} nests unbounded quantifiers ` +
+            `(e.g. "(a+)+") — this backtracks catastrophically on hostile input; ` +
+            `an equivalent single quantifier matches the same strings`);
+    }
+}
+function assertFieldValidators(field, form_name) {
+    if (field.validators === undefined)
+        return;
+    const where = `${form_name}.${field.key}`;
+    if (!Array.isArray(field.validators)) {
+        throw new Error(`validators on ${where} must be an array`);
+    }
+    for (const v of field.validators) {
+        if (!isRecord(v) || typeof v.type !== 'string') {
+            throw new Error(`invalid validator on ${where}`);
+        }
+        if (v.type === 'pattern')
+            assertPatternValidator(v, where);
+    }
+}
 function assertFieldShape(field, form_name) {
     if (typeof field.type !== 'string' || !FIELD_TYPES.has(field.type)) {
         throw new Error(`unknown field type ${JSON.stringify(field.type)} on ${form_name}`);
     }
-    // labels are static blocks and may omit the key; everything else needs one
-    if (field.type !== 'label' || field.key !== undefined) {
-        if (typeof field.key !== 'string' || field.key === '') {
-            throw new Error(`field on ${form_name} needs a non-empty string key`);
-        }
-        if (UNSAFE_KEYS.has(field.key) || field.key.includes('.')) {
-            throw new Error(`invalid field key ${JSON.stringify(field.key)} on ${form_name}`);
-        }
-    }
+    assertFieldKey(field, form_name);
     if (field.type === 'date')
         assertDateProps(field, form_name);
-    if (field.options !== undefined) {
-        if (!Array.isArray(field.options) ||
-            field.options.some((o) => !isRecord(o) || typeof o.key !== 'string')) {
-            throw new Error(`invalid options on ${form_name}.${field.key}: expected { key, label } items`);
-        }
-    }
-    if (field.validators !== undefined) {
-        if (!Array.isArray(field.validators)) {
-            throw new Error(`validators on ${form_name}.${field.key} must be an array`);
-        }
-        for (const v of field.validators) {
-            if (!isRecord(v) || typeof v.type !== 'string') {
-                throw new Error(`invalid validator on ${form_name}.${field.key}`);
-            }
-            if (v.type === 'pattern') {
-                // compile now — an invalid regex would otherwise throw (or hang, if
-                // catastrophic) inside validateField on every future submission
-                const pattern = String(v.value);
-                try {
-                    new RegExp(pattern);
-                }
-                catch {
-                    throw new Error(`invalid pattern ${JSON.stringify(v.value)} on ${form_name}.${field.key}`);
-                }
-                if (hasNestedUnboundedQuantifier(pattern)) {
-                    throw new Error(`pattern on ${form_name}.${field.key} nests unbounded quantifiers ` +
-                        `(e.g. "(a+)+") — this backtracks catastrophically on hostile input; ` +
-                        `an equivalent single quantifier matches the same strings`);
-                }
-            }
-        }
+    if (field.options !== undefined &&
+        (!Array.isArray(field.options) ||
+            field.options.some((o) => !isRecord(o) || typeof o.key !== 'string'))) {
+        throw new Error(`invalid options on ${form_name}.${field.key}: expected { key, label } items`);
     }
+    assertFieldValidators(field, form_name);
 }
 /** Calendar constraints must be well-formed or the picker silently ignores them. */
 function assertDateProps(field, form_name) {
@@ -612,47 +667,52 @@ function assertDateProps(field, form_name) {
             throw new Error(`disabled_weekdays on ${where} must be integers 0 (Sun) … 6 (Sat)`);
     }
 }
+function assertRuleAction(rawAction, where, formNames, refs) {
+    if (!isRecord(rawAction) || typeof rawAction.action !== 'string') {
+        throw new Error(`${where}: invalid action`);
+    }
+    const target = rawAction.target;
+    if (!isRecord(target) || typeof target.form !== 'string') {
+        throw new Error(`${where}: action needs a target form`);
+    }
+    if (!formNames.has(target.form)) {
+        throw new Error(`${where} targets unknown form ${JSON.stringify(target.form)}`);
+    }
+    const formLevel = rawAction.action === 'showForm' ||
+        rawAction.action === 'hideForm' ||
+        rawAction.action === 'skipForm';
+    if (!formLevel) {
+        const ref = `${target.form}.${String(target.field)}`;
+        if (typeof target.field !== 'string' || !refs.has(ref)) {
+            throw new Error(`${where} targets unknown field ${JSON.stringify(ref)}`);
+        }
+    }
+    if (rawAction.action === 'setValue') {
+        assertValidExpr(rawAction.value, refs, where);
+    }
+}
+function assertRule(raw, i, formNames, refs) {
+    if (!isRecord(raw))
+        throw new Error(`invalid rule at index ${i}: expected an object`);
+    const rule = raw;
+    const where = `rule ${typeof rule.id === 'string' ? JSON.stringify(rule.id) : i}`;
+    if (rule.priority !== undefined && typeof rule.priority !== 'number') {
+        throw new Error(`${where}: priority must be a number`);
+    }
+    assertValidCondition(rule.when, refs, where);
+    for (const branch of ['then', 'else']) {
+        const actions = rule[branch];
+        if (actions === undefined)
+            continue;
+        if (!Array.isArray(actions))
+            throw new Error(`${where}: ${branch} must be an array`);
+        for (const rawAction of actions)
+            assertRuleAction(rawAction, where, formNames, refs);
+    }
+}
 function assertValidRules(wf, formNames, refs) {
     wf.rules.forEach((raw, i) => {
-        if (!isRecord(raw))
-            throw new Error(`invalid rule at index ${i}: expected an object`);
-        const rule = raw;
-        const where = `rule ${typeof rule.id === 'string' ? JSON.stringify(rule.id) : i}`;
-        if (rule.priority !== undefined && typeof rule.priority !== 'number') {
-            throw new Error(`${where}: priority must be a number`);
-        }
-        assertValidCondition(rule.when, refs, where);
-        for (const branch of ['then', 'else']) {
-            const actions = rule[branch];
-            if (actions === undefined)
-                continue;
-            if (!Array.isArray(actions))
-                throw new Error(`${where}: ${branch} must be an array`);
-            for (const rawAction of actions) {
-                if (!isRecord(rawAction) || typeof rawAction.action !== 'string') {
-                    throw new Error(`${where}: invalid action`);
-                }
-                const target = rawAction.target;
-                if (!isRecord(target) || typeof target.form !== 'string') {
-                    throw new Error(`${where}: action needs a target form`);
-                }
-                if (!formNames.has(target.form)) {
-                    throw new Error(`${where} targets unknown form ${JSON.stringify(target.form)}`);
-                }
-                const formLevel = rawAction.action === 'showForm' ||
-                    rawAction.action === 'hideForm' ||
-                    rawAction.action === 'skipForm';
-                if (!formLevel) {
-                    const ref = `${target.form}.${String(target.field)}`;
-                    if (typeof target.field !== 'string' || !refs.has(ref)) {
-                        throw new Error(`${where} targets unknown field ${JSON.stringify(ref)}`);
-                    }
-                }
-                if (rawAction.action === 'setValue') {
-                    assertValidExpr(rawAction.value, refs, where);
-                }
-            }
-        }
+        assertRule(raw, i, formNames, refs);
     });
 }
 function assertValidCondition(cond, refs, where) {
@@ -661,7 +721,7 @@ function assertValidCondition(cond, refs, where) {
     if (!isRecord(cond))
         throw new Error(`invalid condition in ${where}`);
     if ('and' in cond || 'or' in cond) {
-        const list = cond['and'] ?? cond['or'];
+        const list = cond.and ?? cond.or;
         if (!Array.isArray(list))
             throw new Error(`invalid condition in ${where}`);
         for (const c of list)
@@ -669,13 +729,13 @@ function assertValidCondition(cond, refs, where) {
         return;
     }
     if ('not' in cond) {
-        assertValidCondition(cond['not'], refs, where);
+        assertValidCondition(cond.not, refs, where);
         return;
     }
-    if (typeof cond['field'] !== 'string' || !refs.has(cond['field'])) {
-        throw new Error(`${where} references unknown field ${JSON.stringify(cond['field'])}`);
+    if (typeof cond.field !== 'string' || !refs.has(cond.field)) {
+        throw new Error(`${where} references unknown field ${JSON.stringify(cond.field)}`);
     }
-    const value_field = cond['value_field'];
+    const value_field = cond.value_field;
     if (value_field !== undefined && (typeof value_field !== 'string' || !refs.has(value_field))) {
         throw new Error(`${where} references unknown field ${JSON.stringify(value_field)}`);
     }
@@ -684,23 +744,23 @@ function assertValidExpr(expr, refs, where) {
     if (!isRecord(expr))
         throw new Error(`${where}: invalid value expression`);
     if ('ref' in expr) {
-        if (typeof expr['ref'] !== 'string' || !refs.has(expr['ref'])) {
-            throw new Error(`${where} references unknown field ${JSON.stringify(expr['ref'])}`);
+        if (typeof expr.ref !== 'string' || !refs.has(expr.ref)) {
+            throw new Error(`${where} references unknown field ${JSON.stringify(expr.ref)}`);
         }
         return;
     }
     if ('const' in expr)
         return;
     if ('op' in expr) {
-        if (!Array.isArray(expr['args'])) {
+        if (!Array.isArray(expr.args)) {
             throw new Error(`${where}: expression args must be an array`);
         }
-        for (const a of expr['args'])
+        for (const a of expr.args)
             assertValidExpr(a, refs, where);
         return;
     }
     if ('if' in expr) {
-        const triple = expr['if'];
+        const triple = expr.if;
         if (!Array.isArray(triple) || triple.length !== 3) {
             throw new Error(`${where}: if expression needs [condition, then, else]`);
         }
@@ -739,6 +799,24 @@ function assertValidRepeaters(form) {
 }
 const SCRIPT_EVENTS = new Set(['load', 'change', 'submit']);
 /** `scripts[]` (spec 01 §14): known `on`, a handler name, and a real field for `change`. */
+function assertScript(s, form_name, keys) {
+    if (!isRecord(s))
+        throw new Error(`invalid script on ${form_name}: expected an object`);
+    if (typeof s.on !== 'string' || !SCRIPT_EVENTS.has(s.on)) {
+        throw new Error(`invalid script on=${JSON.stringify(s.on)} on ${form_name}`);
+    }
+    if (typeof s.handler !== 'string' || s.handler === '') {
+        throw new Error(`script on ${form_name} needs a handler name`);
+    }
+    if (s.on !== 'change')
+        return;
+    if (typeof s.field !== 'string' || s.field === '') {
+        throw new Error(`change script "${s.handler}" on ${form_name} needs a field`);
+    }
+    if (!keys.has(s.field)) {
+        throw new Error(`change script "${s.handler}" on ${form_name} targets unknown field ${JSON.stringify(s.field)}`);
+    }
+}
 function assertValidScripts(form) {
     if (form.scripts === undefined)
         return;
@@ -746,24 +824,8 @@ function assertValidScripts(form) {
         throw new Error(`scripts must be an array on ${form.form_name}`);
     }
     const keys = new Set(form.fields.map((f) => f.key));
-    for (const s of form.scripts) {
-        if (!isRecord(s))
-            throw new Error(`invalid script on ${form.form_name}: expected an object`);
-        if (typeof s.on !== 'string' || !SCRIPT_EVENTS.has(s.on)) {
-            throw new Error(`invalid script on=${JSON.stringify(s.on)} on ${form.form_name}`);
-        }
-        if (typeof s.handler !== 'string' || s.handler === '') {
-            throw new Error(`script on ${form.form_name} needs a handler name`);
-        }
-        if (s.on === 'change') {
-            if (typeof s.field !== 'string' || s.field === '') {
-                throw new Error(`change script "${s.handler}" on ${form.form_name} needs a field`);
-            }
-            if (!keys.has(s.field)) {
-                throw new Error(`change script "${s.handler}" on ${form.form_name} targets unknown field ${JSON.stringify(s.field)}`);
-            }
-        }
-    }
+    for (const s of form.scripts)
+        assertScript(s, form.form_name, keys);
 }
 function assertValidViews(form) {
     if (form.views === undefined)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bank20baht-validator",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "type": "module",
   "description": "Runtime validation for bahtui form/workflow JSON \u2014 the exact engine rules the client runs, on the server.",
   "license": "MIT",
@@ -37,15 +37,16 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage"
   },
   "devDependencies": {
-    "bank20baht-ui": "^0.8.0",
+    "bank20baht-ui": "^0.10.0",
     "typescript": "^5.8.3",
     "vitest": "^3.2.4"
   },
   "peerDependencies": {
-    "bank20baht-ui": ">=0.5.0 <0.9.0"
+    "bank20baht-ui": ">=0.5.0 <0.11.0"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",