form0-core 0.1.22 → 0.1.24

package/SECURITY.md

@@ -1,5 +1,14 @@
 # Security Features
 
+> [!CAUTION] > `SAFE` and `CUSTOM` mode are validation aids, not security sandboxes. The
+> evaluator compiles customer expressions with `new Function`; blocked-pattern
+> checks can be bypassed through dynamic property access, and
+> `maxExecutionTime` is not currently enforced. Do not execute untrusted
+> schemas in a privileged server or browser context. See
+> `analyses/SAFE_MODE_SECURITY_ANALYSIS.md` for the accepted critical finding
+> and `analyses/UNTRUSTED_JAVASCRIPT_EXECUTION_ARCHITECTURE.md` for the selected
+> isolation architecture that preserves vanilla JavaScript and imperative event scripts.
+
 form0-core provides configurable security options for expression evaluation to balance flexibility and safety.
 
 ## Security Modes
@@ -23,11 +32,12 @@ const engine = createFormEngine({
 });
 ```
 
-### SAFE
+### SAFE (validation only; not a trust boundary)
 
 - **Restricted context** - Only whitelisted globals available
 - **Pattern blocking** - Dangerous patterns are blocked
-- **Use case**: User-generated expressions, safer environments
+- **Use case**: Diagnostics for trusted authors. It is not suitable for
+  adversarial or otherwise untrusted expressions.
 
 ```javascript
 import { createFormEngine, SECURITY_MODES, SAFE_SECURITY_CONFIG } from 'form0-core';
@@ -113,7 +123,7 @@ const engine = createFormEngine({ schema, initialValues });
 To add security, simply include the security parameter:
 
 ```javascript
-// Add safe mode
+// Add validation-oriented safe mode. This is not a sandbox.
 const engine = createFormEngine({
   schema,
   initialValues,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "form0-core",
-  "version": "0.1.22",
+  "version": "0.1.24",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/"
   },

package/src/index.js

@@ -36,6 +36,7 @@ export { buildRepeatableMetadata } from './utilities/repeatable-helpers.js';
 export {
   buildDatasetDescriptors,
   buildFieldIdentityMap,
+  getFieldExportKind,
   getFieldQuerySemantics,
   projectDatasetRowValues,
   resolveDatasetDescriptorById,

package/src/utilities/dataset-descriptors.js

@@ -237,6 +237,39 @@ const DISPLAY_ONLY_SEMANTICS = {
   allowed_operators: [],
 };
 
+const MEDIA_FIELD_TYPES = new Set([
+  'PhotoField',
+  'VideoField',
+  'SignatureField',
+  'Photo',
+  'Video',
+  'Signature',
+]);
+const NON_DATA_FIELD_TYPES = new Set([
+  'LabelField',
+  'Section',
+  'RepeatableSection',
+  'BuildingPlanSection',
+]);
+
+/**
+ * Exportability is intentionally independent from query semantics. Media fields are
+ * display-only in the query engine, but are first-class export columns whose values
+ * are resolved by an authorized media gateway.
+ */
+export function getFieldExportKind(field) {
+  const fieldType = toTrimmedString(field?.type ?? field?.field_type);
+  if (!fieldType || NON_DATA_FIELD_TYPES.has(fieldType)) {
+    return 'none';
+  }
+
+  if (MEDIA_FIELD_TYPES.has(fieldType)) {
+    return 'media';
+  }
+
+  return 'value';
+}
+
 const getCalculatedFieldSemantics = (field) => {
   const style = getCalculatedDisplayStyle(field);
 
@@ -402,6 +435,7 @@ const buildDatasetFieldDescriptor = (field, dataset) => {
     data_name: toTrimmedString(field.data_name),
     label: toFieldLabel(field),
     field_type: toTrimmedString(field.type) ?? 'UnknownField',
+    export_kind: getFieldExportKind(field),
     choices: Array.isArray(field.choices)
       ? field.choices.filter((choice) => isRecord(choice)).map((choice) => ({ ...choice }))
       : undefined,