form0-core 0.1.25 → 0.2.0

package/README.md

@@ -1,82 +1,145 @@
 # form0-core
 
 [![NPM Version](https://img.shields.io/npm/v/form0-core)](https://www.npmjs.com/package/form0-core)
-[![NPM Downloads](https://img.shields.io/npm/dt/form0-core)](https://www.npmjs.com/package/form0-core)
+[![NPM Downloads](https://img.shields.io/npm/dm/form0-core)](https://www.npmjs.com/package/form0-core)
+[![CI](https://github.com/paqu-io/form0-core/actions/workflows/ci.yml/badge.svg)](https://github.com/paqu-io/form0-core/actions/workflows/ci.yml)
 ![NPM License](https://img.shields.io/npm/l/form0-core)
 [![Docs](https://img.shields.io/badge/docs-docs.form0.dev-2563eb)](https://docs.form0.dev)
 [![Website](https://img.shields.io/badge/site-form0.dev-0f172a)](https://form0.dev)
 ![NPM Last Update](https://img.shields.io/npm/last-update/form0-core)
+[![Socket](https://socket.dev/api/badge/npm/package/form0-core)](https://socket.dev/npm/package/form0-core)
 
-> [!WARNING]
-> form0 is in active, very early development. Do not use in production. Expect breaking
-> changes and unstable behavior.
+> [!NOTE]
+> form0 is in active development and is available to use today. Its schema format and core
+> concepts are stable in practice, but releases before 1.0 may include breaking changes. Pin your
+> versions and review the release notes when upgrading. A formally stable release is coming.
 
-form0-core is the schema-driven engine that powers [form0 open-source ecosystem](https://form0.dev). It is framework-agnostic and runs in any JavaScript runtime (Node.js, browsers, React Native, etc.)
+`form0-core` is the framework-agnostic, schema-driven engine behind the
+[form0 open-source ecosystem](https://form0.dev). It evaluates calculations, conditional
+visibility, requirements, read-only rules, validation, and form events in Node.js, browsers, and
+React Native.
 
-## 🚀 Start with the CLI (recommended)
+## 🚀 Start with the CLI
 
-The entry point for most users is [form0-cli](https://github.com/paqu-io/form0-cli). Follow the [quickstart](https://docs.form0.dev/getting-started/quickstart) to create a project and preview
-your schema.
+Most users should begin with [`form0-cli`](https://github.com/paqu-io/form0-cli) rather than install
+the engine directly. Follow the [quickstart](https://docs.form0.dev/getting-started/quickstart) to
+create a project, edit a schema, and preview a form.
 
-## 🗂️ Documentation
+Use `form0-core` directly when you are building a renderer, integration, developer tool, or other
+custom form runtime.
 
-- Overview: https://docs.form0.dev/core/overview
-- Concepts: https://docs.form0.dev/core/concepts
-- Full docs: https://docs.form0.dev
-
-## Direct usage (advanced)
-
-If you are integrating the engine directly:
+## 📦 Installation
 
 ```bash
 npm install form0-core
 ```
 
-`form0-core` owns behavioral schema concerns such as fields, conditions, calculations,
-events, and AI metadata. Applications may still attach optional top-level metadata such as
-`id` (unique form identifier), `status` (publication state), `version` (schema version),
-scope fields like `main_org_id`, and media or location settings. Operational counters like
-`record_count` and `record_last_change_at` should stay platform-owned and be injected at
-application or API boundaries, not treated as engine-authored schema. A top-level
-`form.version` may still exist, but the engine does not bump or consume it.
+## ⚡ Quick example
+
+```javascript
+import { createFormEngine } from 'form0-core';
+
+const schema = {
+  form: {
+    name: 'Contact form',
+    status_field: null,
+    elements: [
+      {
+        type: 'TextField',
+        key: 'name',
+        data_name: 'name',
+        label: 'Name',
+        display: 'default',
+        description: null,
+        description_mode: null,
+        required: true,
+        required_conditions: null,
+        visible: true,
+        visible_conditions: null,
+        read_only: false,
+        read_only_conditions: null,
+        default_value: null,
+        pattern: null,
+        pattern_description: null,
+        supporting_image: false,
+        supporting_image_path: null,
+        supporting_image_display: null,
+      },
+    ],
+  },
+};
+
+const engine = createFormEngine({
+  schema,
+  initialValues: { name: 'Ada' },
+});
+
+engine.eval();
+console.log(engine.getState());
+```
+
+The engine API exposes `eval()` for calculations, conditions, and validation; `trigger()` for form
+events; and `getState()` for current values and evaluated field state.
+
+## 🔒 Security
+
+> [!CAUTION]
+> Schema expressions and event scripts execute JavaScript. Only evaluate schemas from authors you
+> trust. `SAFE` and `CUSTOM` modes provide validation controls; they are not security sandboxes.
+
+Read the [security policy](./SECURITY.md) before evaluating schemas outside a fully trusted
+authoring workflow.
+
+## Schema and record ownership
+
+`form0-core` owns behavioral schema concerns such as fields, conditions, calculations, events, and
+AI metadata. Applications may attach optional top-level metadata such as form identifiers,
+publication state, schema version, organization scope, and media or location settings.
+Operational counters should remain platform-owned and be injected at application or API
+boundaries.
 
 ### Record-side contract
 
-`form0-core` intentionally uses two different choice-value shapes:
+`form0-core` intentionally uses two choice-value shapes:
 
-- Live engine / renderer values use renderer shape:
-  - single / boolean: `{ choice, other }`
-  - multi: `{ choices, other }`
-- Structured records use canonical stored shape:
-  - single / boolean: `{ choice_value, other_value }`
-  - multi: `{ choices_value, other_value }`
+- Live engine and renderer values:
+  - single choice and boolean: `{ choice, other }`
+  - multiple choice: `{ choices, other }`
+- Canonical structured records:
+  - single choice and boolean: `{ choice_value, other_value }`
+  - multiple choice: `{ choices_value, other_value }`
 
-Record-side utilities follow this contract:
+Record utilities follow this contract:
 
-- `createStructuredRecord()` outputs canonical stored records
-- `normalizeStructuredRecord()` consumes and returns canonical stored records
-- `buildFormRecordSnapshot()` consumes canonical stored records and returns renderer snapshot values
-- `projectDatasetRowValues()` consumes canonical stored rows
-- Choice `FIELD_SPECS` keep separate validators by context:
-  - `valueValidator` validates live engine / renderer values
-  - `recordValueValidator` validates canonical stored record values
+- `createStructuredRecord()` produces canonical stored records.
+- `normalizeStructuredRecord()` consumes and returns canonical stored records.
+- `buildFormRecordSnapshot()` converts canonical records into renderer snapshot values.
+- `projectDatasetRowValues()` consumes canonical stored rows.
 
 Record status remains top-level as `@status`; it is not stored inside `form_values`.
 
-## Security
+## ✅ Requirements
+
+- Node.js 22 or newer
+- An ESM-capable runtime or bundler
+
+## 📚 Documentation
 
-See `SECURITY.md` for security modes and configuration.
+- [Core overview](https://docs.form0.dev/core/overview)
+- [Core concepts](https://docs.form0.dev/core/concepts)
+- [Full documentation](https://docs.form0.dev)
 
-## Requirements
+## 🔗 Related repositories
 
-- Node.js 18+
+- [form0-cli](https://github.com/paqu-io/form0-cli) — recommended project entry point
+- [form0-react](https://github.com/paqu-io/form0-react) — React bindings and renderers
+- [form0-react-native](https://github.com/paqu-io/form0-react-native) — React Native bindings and renderers
 
-## Related repositories
+## 🤝 Support and contributing
 
-- [form0-cli](https://github.com/paqu-io/form0-cli) - Command-line interface
-- [form0-react](https://github.com/paqu-io/form0-react) - React components
-- [form0-react-native](https://github.com/paqu-io/form0-react-native) - React Native components
+See [SUPPORT.md](https://github.com/paqu-io/form0-core/blob/main/SUPPORT.md) for help and
+[CONTRIBUTING.md](https://github.com/paqu-io/form0-core/blob/main/CONTRIBUTING.md) to contribute.
 
-## Contributing
+## 📄 License
 
-Contributions are welcome! Please feel free to submit [issues](https://github.com/paqu-io/form0-core/issues) and [pull requests](https://github.com/paqu-io/form0-core/pulls).
+[MIT](./LICENSE)

package/SECURITY.md

@@ -1,189 +1,53 @@
-# Security Features
+# Security Policy
 
-> [!CAUTION] > `SAFE` and `CUSTOM` mode are validation aids, not security sandboxes. The
-> evaluator compiles customer expressions with `new Function`; blocked-pattern
-> checks can be bypassed through dynamic property access, and
-> `maxExecutionTime` is not currently enforced. Do not execute untrusted
-> schemas in a privileged server or browser context. See
-> `analyses/SAFE_MODE_SECURITY_ANALYSIS.md` for the accepted critical finding
-> and `analyses/UNTRUSTED_JAVASCRIPT_EXECUTION_ARCHITECTURE.md` for the selected
-> isolation architecture that preserves vanilla JavaScript and imperative event scripts.
+Security reports are taken seriously. Please report vulnerabilities privately so they can be
+investigated and fixed before public disclosure.
 
-form0-core provides configurable security options for expression evaluation to balance flexibility and safety.
+## Reporting a vulnerability
 
-## Security Modes
+Use the
+[form0-core private vulnerability report](https://github.com/paqu-io/form0-core/security/advisories/new).
+Do not open a public issue for a suspected vulnerability.
 
-### TRUSTED (Default)
+Include:
 
-- **Full JavaScript access** - Current behavior maintained
-- **No restrictions** - All expressions execute as-is
-- **Use case**: Internal tools, trusted developers, client-side only
+- the affected version and runtime;
+- a minimal reproduction or proof of concept;
+- the impact you believe is possible;
+- any mitigations you have already identified; and
+- whether the issue has been disclosed anywhere else.
 
-```javascript
-import { createFormEngine } from 'form0-core';
+Reports affecting any version are welcome. When possible, reproduce the issue with the latest
+release. Security fixes are normally released for the latest version; older versions are assessed
+case by case.
 
-// Default behavior - no security parameter needed
-const engine = createFormEngine({ schema });
+Maintainers will review the report, may ask for more information, and will coordinate disclosure
+after a fix or mitigation is available. Please keep the report private during that process.
 
-// Or explicitly set trusted mode
-const engine = createFormEngine({
-  schema,
-  security: { mode: 'trusted' },
-});
-```
+## Trust model
 
-### SAFE (validation only; not a trust boundary)
+form0-core supports JavaScript expressions and imperative event scripts. These expressions and
+scripts are executable code, so schemas that contain them must come from authors you trust.
 
-- **Restricted context** - Only whitelisted globals available
-- **Pattern blocking** - Dangerous patterns are blocked
-- **Use case**: Diagnostics for trusted authors. It is not suitable for
-  adversarial or otherwise untrusted expressions.
+**SAFE** and **CUSTOM** modes provide validation and configuration controls. They are not security
+sandboxes, and pattern-based restrictions must not be used as a boundary for executing adversarial
+schemas in a privileged browser, server, CLI, or mobile context.
 
-```javascript
-import { createFormEngine, SECURITY_MODES, SAFE_SECURITY_CONFIG } from 'form0-core';
+Giving an untrusted user control over executable schema expressions and then observing that the
+expressions can execute JavaScript is outside this project's security boundary. Reports remain in
+scope when behavior crosses a documented boundary—for example, when data that is not intended to
+be executable becomes code, or when an attacker can affect a schema or runtime context they were
+not authorized to control.
 
-// Simple safe mode
-const engine = createFormEngine({
-  schema,
-  security: { mode: SECURITY_MODES.SAFE },
-});
+Applications are responsible for authenticating schema authors, authorizing schema changes, and
+isolating execution when schemas cannot be trusted.
 
-// Or use predefined safe config
-const engine = createFormEngine({
-  schema,
-  security: SAFE_SECURITY_CONFIG,
-});
-```
+## Maintainer security documents
 
-### CUSTOM
+The public documents in
+[analyses](https://github.com/paqu-io/form0-core/tree/main/analyses) record the current threat model,
+known limitations, and the planned isolation architecture. They are maintainer-oriented
+engineering documents, not claims that the current validation modes provide isolation.
 
-- **User-defined rules** - Configure your own security settings
-- **Flexible restrictions** - Mix and match security features
-- **Use case**: Specific security requirements
-
-```javascript
-const engine = createFormEngine({
-  schema,
-  security: {
-    mode: SECURITY_MODES.CUSTOM,
-    maxExecutionTime: 1000,
-    allowedGlobals: ['Math', 'Date', 'Number'],
-    blockedPatterns: [/\bwindow\b/, /\bdocument\b/, /\bfetch\b/],
-  },
-});
-```
-
-## Security Configuration Options
-
-```javascript
-// TRUSTED mode (default) - no additional config needed
-const trustedConfig = {
-  mode: 'trusted', // Full JavaScript access
-};
-
-// SAFE mode - uses predefined safe settings
-const safeConfig = {
-  mode: 'safe', // Automatically applies safe defaults
-};
-
-// CUSTOM mode - define your own rules
-const customConfig = {
-  mode: 'custom',
-  maxExecutionTime: 1000, // Milliseconds (future feature)
-  maxCallStackDepth: 100, // Maximum recursion depth (future feature)
-  allowedGlobals: ['Math', 'Date', 'JSON'], // Whitelisted global objects
-  blockedPatterns: [/\beval\b/, /\bwindow\b/], // Regex patterns to block
-};
-```
-
-## Default Blocked Patterns (Safe Mode)
-
-The following patterns are blocked by default in safe mode:
-
-- `eval`, `Function` - Code execution
-- `window`, `document` - Browser globals
-- `process`, `require` - Node.js globals
-- `fetch`, `XMLHttpRequest` - Network requests
-- `localStorage`, `sessionStorage` - Storage APIs
-- `__proto__`, `constructor`, `prototype` - Prototype pollution
-
-## Migration Guide
-
-### No Changes Needed
-
-Existing code continues to work unchanged:
-
-```javascript
-// This still works exactly as before
-const engine = createFormEngine({ schema, initialValues });
-```
-
-### Adding Security
-
-To add security, simply include the security parameter:
-
-```javascript
-// Add validation-oriented safe mode. This is not a sandbox.
-const engine = createFormEngine({
-  schema,
-  initialValues,
-  security: { mode: 'safe' },
-});
-```
-
-## Examples
-
-### Safe Mathematical Calculations
-
-```javascript
-const schema = {
-  form: {
-    elements: [
-      {
-        type: 'CalculatedField',
-        data_name: 'result',
-        calculate: 'Math.max($value1, $value2) * 1.1', // ✅ Works in safe mode
-      },
-    ],
-  },
-};
-```
-
-### Blocked Dangerous Expressions
-
-```javascript
-const schema = {
-  form: {
-    elements: [
-      {
-        type: 'CalculatedField',
-        data_name: 'result',
-        calculate: 'window.alert("hello")', // ❌ Blocked in safe mode
-      },
-    ],
-  },
-};
-```
-
-### Custom Security Rules
-
-```javascript
-const engine = createFormEngine({
-  schema,
-  security: {
-    mode: 'custom',
-    allowedGlobals: ['Math'], // Only Math allowed
-    blockedPatterns: [/\bDate\b/], // Block Date usage
-  },
-});
-```
-
-## Testing Security
-
-Use the included test file to verify security behavior:
-
-```bash
-node test/security-test.js
-```
-
-This will show how different expressions behave under different security modes.
+For ordinary usage questions, see
+[SUPPORT.md](https://github.com/paqu-io/form0-core/blob/main/SUPPORT.md).

package/package.json

@@ -1,16 +1,25 @@
 {
   "name": "form0-core",
-  "version": "0.1.25",
+  "version": "0.2.0",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/"
   },
-  "description": "Schema-driven engine that powers form0 ecosystem. Looking for the full form0 ecosystem? Install the CLI: `npm install -g form0-cli`",
+  "description": "The schema-driven form engine behind form0, the open-source form ecosystem by paqu.io. Framework-agnostic: conditional visibility, validation and calculations from a JSON schema, in Node.js, browsers and React Native.",
   "main": "src/index.js",
   "type": "module",
+  "files": [
+    "src",
+    "SECURITY.md"
+  ],
   "scripts": {
-    "test": "node tests/form0-core.test.js && node tests/numeric-field-schema.test.js && node tests/dataset-descriptors.test.js && node tests/structured-record.test.js && node tests/builtin-metadata.test.js && node tests/calculation-editor.test.js && node tests/form-event-editor.test.js && node tests/security-test.js",
-    "format": "prettier --write \"**/*.{js,jsx,json,ts,tsx,md}\"",
-    "format:check": "prettier --check \"**/*.{js,jsx,json,ts,tsx,md}\""
+    "test": "node tests/form0-core.test.js && node tests/numeric-field-schema.test.js && node tests/dataset-descriptors.test.js && node tests/structured-record.test.js && node tests/title-fields.test.js && node tests/builtin-metadata.test.js && node tests/calculation-expression-utils.test.js && node tests/calculation-editor.test.js && node tests/form-event-editor.test.js && node tests/security-test.js",
+    "format": "prettier --write \"src/**/*.{js,jsx}\" \"tests/**/*.{js,jsx}\" \"scripts/**/*.{js,mjs}\" package.json README.md SECURITY.md SUPPORT.md CONTRIBUTING.md eslint.config.js .github/workflows/ci.yml .github/workflows/publish.yml",
+    "format:check": "prettier --check \"src/**/*.{js,jsx}\" \"tests/**/*.{js,jsx}\" \"scripts/**/*.{js,mjs}\" package.json README.md SECURITY.md SUPPORT.md CONTRIBUTING.md eslint.config.js .github/workflows/ci.yml .github/workflows/publish.yml",
+    "lint:check": "eslint src tests",
+    "package:check": "node scripts/check-package-contents.mjs",
+    "security:audit:prod": "npm audit --omit=dev --omit=peer --audit-level=high",
+    "check": "npm run format:check && npm run lint:check && npm test",
+    "release:check": "npm run check && npm run security:audit:prod && npm run package:check"
   },
   "exports": {
     ".": {
@@ -22,15 +31,17 @@
     "url": "git+https://github.com/paqu-io/form0-core.git"
   },
   "keywords": [
-    "form",
-    "form-builder",
-    "form-generator",
+    "form0",
+    "paqu-io",
     "form-engine",
-    "schema",
+    "schema-driven-forms",
     "json-schema",
-    "react",
-    "react-native",
-    "dynamic-forms"
+    "dynamic-forms",
+    "conditional-logic",
+    "form-validation",
+    "calculated-fields",
+    "headless-forms",
+    "framework-agnostic"
   ],
   "author": "paqu.io <hello@paqu.io> (https://paqu.io/)",
   "contributors": [
@@ -44,9 +55,12 @@
   },
   "homepage": "https://form0.dev",
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=22.0.0"
   },
   "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "eslint": "^10.5.0",
+    "globals": "^17.12.0",
     "ignore": "^7.0.5",
     "prettier": "^3.5.3"
   }

package/src/builtins/registry.js

@@ -118,10 +118,7 @@ export const calculationBuiltins = buildBuiltinObject([
   ...CALCULATION_ONLY_ENTRIES,
 ]);
 
-export const eventBuiltins = buildBuiltinObject([
-  ...COMMON_RUNTIME_ENTRIES,
-  ...EVENT_ONLY_ENTRIES,
-]);
+export const eventBuiltins = buildBuiltinObject([...COMMON_RUNTIME_ENTRIES, ...EVENT_ONLY_ENTRIES]);
 
 // Backward-compatible alias for calculation runtime helpers.
 export const builtins = calculationBuiltins;

package/src/index.js

@@ -39,6 +39,7 @@ export {
   getFieldExportKind,
   getFieldQuerySemantics,
   projectDatasetRowValues,
+  resolveDatasetRowTitle,
   resolveDatasetDescriptorById,
 } from './utilities/dataset-descriptors.js';
 export { generateUuidV7 } from './utilities/uuid.js';

package/src/schema/ai-metadata-validator.js

@@ -211,9 +211,7 @@ function validateFillStrategy(strategy, errors, prefix) {
   }
 
   if (!FILL_STRATEGIES.has(strategy)) {
-    errors.push(
-      `${prefix}fillStrategy must be one of: ${Array.from(FILL_STRATEGIES).join(', ')}`
-    );
+    errors.push(`${prefix}fillStrategy must be one of: ${Array.from(FILL_STRATEGIES).join(', ')}`);
   }
 }
 

package/src/schema/building-plan-expander.js

@@ -19,7 +19,8 @@ function appendSuffix(base, suffix, maxLength = null) {
 }
 
 function createScopedKey(baseKey, suffix) {
-  const cleanBase = typeof baseKey === 'string' ? baseKey.replace(/^~+/, '').replace(/_+$/, '') : '';
+  const cleanBase =
+    typeof baseKey === 'string' ? baseKey.replace(/^~+/, '').replace(/_+$/, '') : '';
   const scopedBase = appendSuffix(cleanBase, suffix);
   return `~${scopedBase}`;
 }

package/src/schema/field-specs.js

@@ -932,6 +932,7 @@ export const FIELD_SPECS = {
       visible_conditions: { type: 'object', required: true, nullable: true },
       location_enabled: { type: 'boolean', required: true, nullable: false },
       location_required: { type: 'boolean', required: true, nullable: false },
+      title_field: { type: 'object', required: false, nullable: true },
       elements: { type: 'array', required: true, nullable: false },
     },
     schemaValidators: [

package/src/schema/schema-validator.js

@@ -3,6 +3,73 @@ import { validateFieldSchema, validateDefaultValue } from './field-schema-regist
 import { isSupportedFieldType } from '../utilities/field-types.js';
 import { validateFieldConditions } from './operators.js';
 import { validateFormAIMetadata } from './ai-metadata-validator.js';
+import { buildDatasetDescriptors } from '../utilities/dataset-descriptors.js';
+
+const toNonEmptyString = (value) =>
+  typeof value === 'string' && value.trim().length > 0 ? value.trim() : null;
+
+const getDescriptorFieldReferences = (field) =>
+  new Set(
+    [field?.field_id, field?.output_key, field?.key, field?.data_name, ...(field?.aliases || [])]
+      .map(toNonEmptyString)
+      .filter(Boolean)
+  );
+
+const validateScopedTitleFields = (form, errors) => {
+  const descriptors = buildDatasetDescriptors({ form });
+  const allReferenceDatasets = new Map();
+
+  descriptors.forEach((descriptor) => {
+    (descriptor.fields || []).forEach((field) => {
+      getDescriptorFieldReferences(field).forEach((reference) => {
+        if (!allReferenceDatasets.has(reference)) {
+          allReferenceDatasets.set(reference, new Set());
+        }
+        allReferenceDatasets.get(reference).add(descriptor.id);
+      });
+    });
+  });
+
+  descriptors.forEach((descriptor) => {
+    const titleField = descriptor.title_field;
+    if (!titleField) {
+      return;
+    }
+
+    const scopeLabel = descriptor.kind === 'root' ? 'title_field' : `RepeatableSection title_field`;
+    const titleValidation = validateFieldSchema(titleField);
+    if (!titleValidation.isValid) {
+      errors.push(...titleValidation.errors.map((error) => `${scopeLabel}: ${error}`));
+      return;
+    }
+
+    const scopedFields = descriptor.fields || [];
+    titleField.elements.forEach((entry) => {
+      const reference = toNonEmptyString(entry);
+      if (!reference) {
+        return;
+      }
+
+      const matchedField = scopedFields.find((field) =>
+        getDescriptorFieldReferences(field).has(reference)
+      );
+      if (!matchedField) {
+        if (allReferenceDatasets.has(reference)) {
+          errors.push(`${scopeLabel} reference "${reference}" is outside its record scope`);
+        } else {
+          errors.push(`${scopeLabel} reference "${reference}" does not match any field`);
+        }
+        return;
+      }
+
+      if (matchedField.title_eligible !== true) {
+        errors.push(
+          `${scopeLabel} reference "${reference}" uses unsupported field type ${matchedField.field_type}`
+        );
+      }
+    });
+  });
+};
 
 export function validateSchema(form) {
   const fields = flattenFields(form.elements);
@@ -180,12 +247,7 @@ export function validateSchema(form) {
       }
     }
   }
-  if (form.title_field) {
-    const titleValidation = validateFieldSchema(form.title_field);
-    if (!titleValidation.isValid) {
-      errors.push(...titleValidation.errors.map((e) => `title_field: ${e}`));
-    }
-  }
+  validateScopedTitleFields(form, errors);
 
   // Add duplicate errors to the main errors array
   if (duplicateDataNames.size > 0) {
@@ -225,7 +287,11 @@ export function validateSchema(form) {
               }
             }
 
-            if (!entry.form_id || typeof entry.form_id !== 'string' || entry.form_id.trim() === '') {
+            if (
+              !entry.form_id ||
+              typeof entry.form_id !== 'string' ||
+              entry.form_id.trim() === ''
+            ) {
               errors.push(`form_links.to[${index}].form_id must be a non-empty string`);
             }
           });
@@ -242,7 +308,11 @@ export function validateSchema(form) {
               return;
             }
 
-            if (!entry.form_id || typeof entry.form_id !== 'string' || entry.form_id.trim() === '') {
+            if (
+              !entry.form_id ||
+              typeof entry.form_id !== 'string' ||
+              entry.form_id.trim() === ''
+            ) {
               errors.push(`form_links.from[${index}].form_id must be a non-empty string`);
             }