form0-core 0.1.26 → 0.2.0

package/README.md

@@ -1,82 +1,145 @@
 # form0-core
 
 [![NPM Version](https://img.shields.io/npm/v/form0-core)](https://www.npmjs.com/package/form0-core)
-[![NPM Downloads](https://img.shields.io/npm/dt/form0-core)](https://www.npmjs.com/package/form0-core)
+[![NPM Downloads](https://img.shields.io/npm/dm/form0-core)](https://www.npmjs.com/package/form0-core)
+[![CI](https://github.com/paqu-io/form0-core/actions/workflows/ci.yml/badge.svg)](https://github.com/paqu-io/form0-core/actions/workflows/ci.yml)
 ![NPM License](https://img.shields.io/npm/l/form0-core)
 [![Docs](https://img.shields.io/badge/docs-docs.form0.dev-2563eb)](https://docs.form0.dev)
 [![Website](https://img.shields.io/badge/site-form0.dev-0f172a)](https://form0.dev)
 ![NPM Last Update](https://img.shields.io/npm/last-update/form0-core)
+[![Socket](https://socket.dev/api/badge/npm/package/form0-core)](https://socket.dev/npm/package/form0-core)
 
-> [!WARNING]
-> form0 is in active, very early development. Do not use in production. Expect breaking
-> changes and unstable behavior.
+> [!NOTE]
+> form0 is in active development and is available to use today. Its schema format and core
+> concepts are stable in practice, but releases before 1.0 may include breaking changes. Pin your
+> versions and review the release notes when upgrading. A formally stable release is coming.
 
-form0-core is the schema-driven engine that powers [form0 open-source ecosystem](https://form0.dev). It is framework-agnostic and runs in any JavaScript runtime (Node.js, browsers, React Native, etc.)
+`form0-core` is the framework-agnostic, schema-driven engine behind the
+[form0 open-source ecosystem](https://form0.dev). It evaluates calculations, conditional
+visibility, requirements, read-only rules, validation, and form events in Node.js, browsers, and
+React Native.
 
-## 🚀 Start with the CLI (recommended)
+## 🚀 Start with the CLI
 
-The entry point for most users is [form0-cli](https://github.com/paqu-io/form0-cli). Follow the [quickstart](https://docs.form0.dev/getting-started/quickstart) to create a project and preview
-your schema.
+Most users should begin with [`form0-cli`](https://github.com/paqu-io/form0-cli) rather than install
+the engine directly. Follow the [quickstart](https://docs.form0.dev/getting-started/quickstart) to
+create a project, edit a schema, and preview a form.
 
-## 🗂️ Documentation
+Use `form0-core` directly when you are building a renderer, integration, developer tool, or other
+custom form runtime.
 
-- Overview: https://docs.form0.dev/core/overview
-- Concepts: https://docs.form0.dev/core/concepts
-- Full docs: https://docs.form0.dev
-
-## Direct usage (advanced)
-
-If you are integrating the engine directly:
+## 📦 Installation
 
 ```bash
 npm install form0-core
 ```
 
-`form0-core` owns behavioral schema concerns such as fields, conditions, calculations,
-events, and AI metadata. Applications may still attach optional top-level metadata such as
-`id` (unique form identifier), `status` (publication state), `version` (schema version),
-scope fields like `main_org_id`, and media or location settings. Operational counters like
-`record_count` and `record_last_change_at` should stay platform-owned and be injected at
-application or API boundaries, not treated as engine-authored schema. A top-level
-`form.version` may still exist, but the engine does not bump or consume it.
+## ⚡ Quick example
+
+```javascript
+import { createFormEngine } from 'form0-core';
+
+const schema = {
+  form: {
+    name: 'Contact form',
+    status_field: null,
+    elements: [
+      {
+        type: 'TextField',
+        key: 'name',
+        data_name: 'name',
+        label: 'Name',
+        display: 'default',
+        description: null,
+        description_mode: null,
+        required: true,
+        required_conditions: null,
+        visible: true,
+        visible_conditions: null,
+        read_only: false,
+        read_only_conditions: null,
+        default_value: null,
+        pattern: null,
+        pattern_description: null,
+        supporting_image: false,
+        supporting_image_path: null,
+        supporting_image_display: null,
+      },
+    ],
+  },
+};
+
+const engine = createFormEngine({
+  schema,
+  initialValues: { name: 'Ada' },
+});
+
+engine.eval();
+console.log(engine.getState());
+```
+
+The engine API exposes `eval()` for calculations, conditions, and validation; `trigger()` for form
+events; and `getState()` for current values and evaluated field state.
+
+## 🔒 Security
+
+> [!CAUTION]
+> Schema expressions and event scripts execute JavaScript. Only evaluate schemas from authors you
+> trust. `SAFE` and `CUSTOM` modes provide validation controls; they are not security sandboxes.
+
+Read the [security policy](./SECURITY.md) before evaluating schemas outside a fully trusted
+authoring workflow.
+
+## Schema and record ownership
+
+`form0-core` owns behavioral schema concerns such as fields, conditions, calculations, events, and
+AI metadata. Applications may attach optional top-level metadata such as form identifiers,
+publication state, schema version, organization scope, and media or location settings.
+Operational counters should remain platform-owned and be injected at application or API
+boundaries.
 
 ### Record-side contract
 
-`form0-core` intentionally uses two different choice-value shapes:
+`form0-core` intentionally uses two choice-value shapes:
 
-- Live engine / renderer values use renderer shape:
-  - single / boolean: `{ choice, other }`
-  - multi: `{ choices, other }`
-- Structured records use canonical stored shape:
-  - single / boolean: `{ choice_value, other_value }`
-  - multi: `{ choices_value, other_value }`
+- Live engine and renderer values:
+  - single choice and boolean: `{ choice, other }`
+  - multiple choice: `{ choices, other }`
+- Canonical structured records:
+  - single choice and boolean: `{ choice_value, other_value }`
+  - multiple choice: `{ choices_value, other_value }`
 
-Record-side utilities follow this contract:
+Record utilities follow this contract:
 
-- `createStructuredRecord()` outputs canonical stored records
-- `normalizeStructuredRecord()` consumes and returns canonical stored records
-- `buildFormRecordSnapshot()` consumes canonical stored records and returns renderer snapshot values
-- `projectDatasetRowValues()` consumes canonical stored rows
-- Choice `FIELD_SPECS` keep separate validators by context:
-  - `valueValidator` validates live engine / renderer values
-  - `recordValueValidator` validates canonical stored record values
+- `createStructuredRecord()` produces canonical stored records.
+- `normalizeStructuredRecord()` consumes and returns canonical stored records.
+- `buildFormRecordSnapshot()` converts canonical records into renderer snapshot values.
+- `projectDatasetRowValues()` consumes canonical stored rows.
 
 Record status remains top-level as `@status`; it is not stored inside `form_values`.
 
-## Security
+## ✅ Requirements
+
+- Node.js 22 or newer
+- An ESM-capable runtime or bundler
+
+## 📚 Documentation
 
-See `SECURITY.md` for security modes and configuration.
+- [Core overview](https://docs.form0.dev/core/overview)
+- [Core concepts](https://docs.form0.dev/core/concepts)
+- [Full documentation](https://docs.form0.dev)
 
-## Requirements
+## 🔗 Related repositories
 
-- Node.js 18+
+- [form0-cli](https://github.com/paqu-io/form0-cli) — recommended project entry point
+- [form0-react](https://github.com/paqu-io/form0-react) — React bindings and renderers
+- [form0-react-native](https://github.com/paqu-io/form0-react-native) — React Native bindings and renderers
 
-## Related repositories
+## 🤝 Support and contributing
 
-- [form0-cli](https://github.com/paqu-io/form0-cli) - Command-line interface
-- [form0-react](https://github.com/paqu-io/form0-react) - React components
-- [form0-react-native](https://github.com/paqu-io/form0-react-native) - React Native components
+See [SUPPORT.md](https://github.com/paqu-io/form0-core/blob/main/SUPPORT.md) for help and
+[CONTRIBUTING.md](https://github.com/paqu-io/form0-core/blob/main/CONTRIBUTING.md) to contribute.
 
-## Contributing
+## 📄 License
 
-Contributions are welcome! Please feel free to submit [issues](https://github.com/paqu-io/form0-core/issues) and [pull requests](https://github.com/paqu-io/form0-core/pulls).
+[MIT](./LICENSE)

package/SECURITY.md

@@ -1,189 +1,53 @@
-# Security Features
+# Security Policy
 
-> [!CAUTION] > `SAFE` and `CUSTOM` mode are validation aids, not security sandboxes. The
-> evaluator compiles customer expressions with `new Function`; blocked-pattern
-> checks can be bypassed through dynamic property access, and
-> `maxExecutionTime` is not currently enforced. Do not execute untrusted
-> schemas in a privileged server or browser context. See
-> `analyses/SAFE_MODE_SECURITY_ANALYSIS.md` for the accepted critical finding
-> and `analyses/UNTRUSTED_JAVASCRIPT_EXECUTION_ARCHITECTURE.md` for the selected
-> isolation architecture that preserves vanilla JavaScript and imperative event scripts.
+Security reports are taken seriously. Please report vulnerabilities privately so they can be
+investigated and fixed before public disclosure.
 
-form0-core provides configurable security options for expression evaluation to balance flexibility and safety.
+## Reporting a vulnerability
 
-## Security Modes
+Use the
+[form0-core private vulnerability report](https://github.com/paqu-io/form0-core/security/advisories/new).
+Do not open a public issue for a suspected vulnerability.
 
-### TRUSTED (Default)
+Include:
 
-- **Full JavaScript access** - Current behavior maintained
-- **No restrictions** - All expressions execute as-is
-- **Use case**: Internal tools, trusted developers, client-side only
+- the affected version and runtime;
+- a minimal reproduction or proof of concept;
+- the impact you believe is possible;
+- any mitigations you have already identified; and
+- whether the issue has been disclosed anywhere else.
 
-```javascript
-import { createFormEngine } from 'form0-core';
+Reports affecting any version are welcome. When possible, reproduce the issue with the latest
+release. Security fixes are normally released for the latest version; older versions are assessed
+case by case.
 
-// Default behavior - no security parameter needed
-const engine = createFormEngine({ schema });
+Maintainers will review the report, may ask for more information, and will coordinate disclosure
+after a fix or mitigation is available. Please keep the report private during that process.
 
-// Or explicitly set trusted mode
-const engine = createFormEngine({
-  schema,
-  security: { mode: 'trusted' },
-});
-```
+## Trust model
 
-### SAFE (validation only; not a trust boundary)
+form0-core supports JavaScript expressions and imperative event scripts. These expressions and
+scripts are executable code, so schemas that contain them must come from authors you trust.
 
-- **Restricted context** - Only whitelisted globals available
-- **Pattern blocking** - Dangerous patterns are blocked
-- **Use case**: Diagnostics for trusted authors. It is not suitable for
-  adversarial or otherwise untrusted expressions.
+**SAFE** and **CUSTOM** modes provide validation and configuration controls. They are not security
+sandboxes, and pattern-based restrictions must not be used as a boundary for executing adversarial
+schemas in a privileged browser, server, CLI, or mobile context.
 
-```javascript
-import { createFormEngine, SECURITY_MODES, SAFE_SECURITY_CONFIG } from 'form0-core';
+Giving an untrusted user control over executable schema expressions and then observing that the
+expressions can execute JavaScript is outside this project's security boundary. Reports remain in
+scope when behavior crosses a documented boundary—for example, when data that is not intended to
+be executable becomes code, or when an attacker can affect a schema or runtime context they were
+not authorized to control.
 
-// Simple safe mode
-const engine = createFormEngine({
-  schema,
-  security: { mode: SECURITY_MODES.SAFE },
-});
+Applications are responsible for authenticating schema authors, authorizing schema changes, and
+isolating execution when schemas cannot be trusted.
 
-// Or use predefined safe config
-const engine = createFormEngine({
-  schema,
-  security: SAFE_SECURITY_CONFIG,
-});
-```
+## Maintainer security documents
 
-### CUSTOM
+The public documents in
+[analyses](https://github.com/paqu-io/form0-core/tree/main/analyses) record the current threat model,
+known limitations, and the planned isolation architecture. They are maintainer-oriented
+engineering documents, not claims that the current validation modes provide isolation.
 
-- **User-defined rules** - Configure your own security settings
-- **Flexible restrictions** - Mix and match security features
-- **Use case**: Specific security requirements
-
-```javascript
-const engine = createFormEngine({
-  schema,
-  security: {
-    mode: SECURITY_MODES.CUSTOM,
-    maxExecutionTime: 1000,
-    allowedGlobals: ['Math', 'Date', 'Number'],
-    blockedPatterns: [/\bwindow\b/, /\bdocument\b/, /\bfetch\b/],
-  },
-});
-```
-
-## Security Configuration Options
-
-```javascript
-// TRUSTED mode (default) - no additional config needed
-const trustedConfig = {
-  mode: 'trusted', // Full JavaScript access
-};
-
-// SAFE mode - uses predefined safe settings
-const safeConfig = {
-  mode: 'safe', // Automatically applies safe defaults
-};
-
-// CUSTOM mode - define your own rules
-const customConfig = {
-  mode: 'custom',
-  maxExecutionTime: 1000, // Milliseconds (future feature)
-  maxCallStackDepth: 100, // Maximum recursion depth (future feature)
-  allowedGlobals: ['Math', 'Date', 'JSON'], // Whitelisted global objects
-  blockedPatterns: [/\beval\b/, /\bwindow\b/], // Regex patterns to block
-};
-```
-
-## Default Blocked Patterns (Safe Mode)
-
-The following patterns are blocked by default in safe mode:
-
-- `eval`, `Function` - Code execution
-- `window`, `document` - Browser globals
-- `process`, `require` - Node.js globals
-- `fetch`, `XMLHttpRequest` - Network requests
-- `localStorage`, `sessionStorage` - Storage APIs
-- `__proto__`, `constructor`, `prototype` - Prototype pollution
-
-## Migration Guide
-
-### No Changes Needed
-
-Existing code continues to work unchanged:
-
-```javascript
-// This still works exactly as before
-const engine = createFormEngine({ schema, initialValues });
-```
-
-### Adding Security
-
-To add security, simply include the security parameter:
-
-```javascript
-// Add validation-oriented safe mode. This is not a sandbox.
-const engine = createFormEngine({
-  schema,
-  initialValues,
-  security: { mode: 'safe' },
-});
-```
-
-## Examples
-
-### Safe Mathematical Calculations
-
-```javascript
-const schema = {
-  form: {
-    elements: [
-      {
-        type: 'CalculatedField',
-        data_name: 'result',
-        calculate: 'Math.max($value1, $value2) * 1.1', // ✅ Works in safe mode
-      },
-    ],
-  },
-};
-```
-
-### Blocked Dangerous Expressions
-
-```javascript
-const schema = {
-  form: {
-    elements: [
-      {
-        type: 'CalculatedField',
-        data_name: 'result',
-        calculate: 'window.alert("hello")', // ❌ Blocked in safe mode
-      },
-    ],
-  },
-};
-```
-
-### Custom Security Rules
-
-```javascript
-const engine = createFormEngine({
-  schema,
-  security: {
-    mode: 'custom',
-    allowedGlobals: ['Math'], // Only Math allowed
-    blockedPatterns: [/\bDate\b/], // Block Date usage
-  },
-});
-```
-
-## Testing Security
-
-Use the included test file to verify security behavior:
-
-```bash
-node test/security-test.js
-```
-
-This will show how different expressions behave under different security modes.
+For ordinary usage questions, see
+[SUPPORT.md](https://github.com/paqu-io/form0-core/blob/main/SUPPORT.md).

package/package.json

@@ -1,16 +1,25 @@
 {
   "name": "form0-core",
-  "version": "0.1.26",
+  "version": "0.2.0",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/"
   },
   "description": "The schema-driven form engine behind form0, the open-source form ecosystem by paqu.io. Framework-agnostic: conditional visibility, validation and calculations from a JSON schema, in Node.js, browsers and React Native.",
   "main": "src/index.js",
   "type": "module",
+  "files": [
+    "src",
+    "SECURITY.md"
+  ],
   "scripts": {
-    "test": "node tests/form0-core.test.js && node tests/numeric-field-schema.test.js && node tests/dataset-descriptors.test.js && node tests/structured-record.test.js && node tests/title-fields.test.js && node tests/builtin-metadata.test.js && node tests/calculation-editor.test.js && node tests/form-event-editor.test.js && node tests/security-test.js",
-    "format": "prettier --write \"**/*.{js,jsx,json,ts,tsx,md}\"",
-    "format:check": "prettier --check \"**/*.{js,jsx,json,ts,tsx,md}\""
+    "test": "node tests/form0-core.test.js && node tests/numeric-field-schema.test.js && node tests/dataset-descriptors.test.js && node tests/structured-record.test.js && node tests/title-fields.test.js && node tests/builtin-metadata.test.js && node tests/calculation-expression-utils.test.js && node tests/calculation-editor.test.js && node tests/form-event-editor.test.js && node tests/security-test.js",
+    "format": "prettier --write \"src/**/*.{js,jsx}\" \"tests/**/*.{js,jsx}\" \"scripts/**/*.{js,mjs}\" package.json README.md SECURITY.md SUPPORT.md CONTRIBUTING.md eslint.config.js .github/workflows/ci.yml .github/workflows/publish.yml",
+    "format:check": "prettier --check \"src/**/*.{js,jsx}\" \"tests/**/*.{js,jsx}\" \"scripts/**/*.{js,mjs}\" package.json README.md SECURITY.md SUPPORT.md CONTRIBUTING.md eslint.config.js .github/workflows/ci.yml .github/workflows/publish.yml",
+    "lint:check": "eslint src tests",
+    "package:check": "node scripts/check-package-contents.mjs",
+    "security:audit:prod": "npm audit --omit=dev --omit=peer --audit-level=high",
+    "check": "npm run format:check && npm run lint:check && npm test",
+    "release:check": "npm run check && npm run security:audit:prod && npm run package:check"
   },
   "exports": {
     ".": {
@@ -46,9 +55,12 @@
   },
   "homepage": "https://form0.dev",
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=22.0.0"
   },
   "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "eslint": "^10.5.0",
+    "globals": "^17.12.0",
     "ignore": "^7.0.5",
     "prettier": "^3.5.3"
   }

package/src/builtins/registry.js

@@ -118,10 +118,7 @@ export const calculationBuiltins = buildBuiltinObject([
   ...CALCULATION_ONLY_ENTRIES,
 ]);
 
-export const eventBuiltins = buildBuiltinObject([
-  ...COMMON_RUNTIME_ENTRIES,
-  ...EVENT_ONLY_ENTRIES,
-]);
+export const eventBuiltins = buildBuiltinObject([...COMMON_RUNTIME_ENTRIES, ...EVENT_ONLY_ENTRIES]);
 
 // Backward-compatible alias for calculation runtime helpers.
 export const builtins = calculationBuiltins;

package/src/schema/ai-metadata-validator.js

@@ -211,9 +211,7 @@ function validateFillStrategy(strategy, errors, prefix) {
   }
 
   if (!FILL_STRATEGIES.has(strategy)) {
-    errors.push(
-      `${prefix}fillStrategy must be one of: ${Array.from(FILL_STRATEGIES).join(', ')}`
-    );
+    errors.push(`${prefix}fillStrategy must be one of: ${Array.from(FILL_STRATEGIES).join(', ')}`);
   }
 }
 

package/src/schema/building-plan-expander.js

@@ -19,7 +19,8 @@ function appendSuffix(base, suffix, maxLength = null) {
 }
 
 function createScopedKey(baseKey, suffix) {
-  const cleanBase = typeof baseKey === 'string' ? baseKey.replace(/^~+/, '').replace(/_+$/, '') : '';
+  const cleanBase =
+    typeof baseKey === 'string' ? baseKey.replace(/^~+/, '').replace(/_+$/, '') : '';
   const scopedBase = appendSuffix(cleanBase, suffix);
   return `~${scopedBase}`;
 }

package/src/utilities/ai-metadata.js

@@ -38,7 +38,11 @@ export function getFormAITasks(form) {
 
 export function getFormAINamingPolicy(form) {
   const metadata = getFormAIMetadata(form);
-  if (!metadata || typeof metadata.namingPolicy !== 'object' || Array.isArray(metadata.namingPolicy)) {
+  if (
+    !metadata ||
+    typeof metadata.namingPolicy !== 'object' ||
+    Array.isArray(metadata.namingPolicy)
+  ) {
     return null;
   }
   return metadata.namingPolicy;
@@ -78,7 +82,11 @@ export function isFieldAIInferrable(field) {
 
 export function getFieldAIChoicePolicy(field) {
   const metadata = getFieldAIMetadata(field);
-  if (!metadata || typeof metadata.choicePolicy !== 'object' || Array.isArray(metadata.choicePolicy)) {
+  if (
+    !metadata ||
+    typeof metadata.choicePolicy !== 'object' ||
+    Array.isArray(metadata.choicePolicy)
+  ) {
     return null;
   }
   return metadata.choicePolicy;
@@ -86,7 +94,11 @@ export function getFieldAIChoicePolicy(field) {
 
 export function getFieldAIProviderHints(field) {
   const metadata = getFieldAIMetadata(field);
-  if (!metadata || typeof metadata.providerHints !== 'object' || Array.isArray(metadata.providerHints)) {
+  if (
+    !metadata ||
+    typeof metadata.providerHints !== 'object' ||
+    Array.isArray(metadata.providerHints)
+  ) {
     return null;
   }
   return metadata.providerHints;

package/src/utilities/calculation-dependencies.js

@@ -260,12 +260,7 @@ function extractEvalCallArguments(code) {
 
       if (char === "'" && !inDoubleQuote && !inBacktick && !isEscapedCharacter(source, i)) {
         inSingleQuote = !inSingleQuote;
-      } else if (
-        char === '"' &&
-        !inSingleQuote &&
-        !inBacktick &&
-        !isEscapedCharacter(source, i)
-      ) {
+      } else if (char === '"' && !inSingleQuote && !inBacktick && !isEscapedCharacter(source, i)) {
         inDoubleQuote = !inDoubleQuote;
       } else if (
         char === '`' &&

package/src/utilities/calculation-expression-utils.js

@@ -10,6 +10,16 @@ export function isMultilineCalculationExpression(expression) {
 
 export function normalizeInlineCalculationExpression(expression) {
   const normalizedExpression = typeof expression === 'string' ? expression : '';
+  const expressionWithoutTrailingWhitespace = normalizedExpression.trimEnd();
 
-  return normalizedExpression.replace(/;+\s*$/u, '');
+  if (!expressionWithoutTrailingWhitespace.endsWith(';')) {
+    return normalizedExpression;
+  }
+
+  let expressionEnd = expressionWithoutTrailingWhitespace.length;
+  while (expressionEnd > 0 && expressionWithoutTrailingWhitespace[expressionEnd - 1] === ';') {
+    expressionEnd -= 1;
+  }
+
+  return expressionWithoutTrailingWhitespace.slice(0, expressionEnd);
 }

package/src/utilities/field-helpers.js

@@ -10,7 +10,11 @@ export function flattenFields(elements) {
   }
 
   return elements.flatMap((el) => {
-    if (el.type === 'Section' || el.type === 'RepeatableSection' || el.type === 'BuildingPlanSection') {
+    if (
+      el.type === 'Section' ||
+      el.type === 'RepeatableSection' ||
+      el.type === 'BuildingPlanSection'
+    ) {
       return [el, ...flattenFields(el.elements)];
     }
 

package/src/utilities/form-event-editor.js

@@ -17,11 +17,7 @@ const COMMON_GLOBAL_FUNCTIONS = new Set([
   'Boolean',
 ]);
 
-const STRUCTURAL_FIELD_TYPES = new Set([
-  'Section',
-  'RepeatableSection',
-  'BuildingPlanSection',
-]);
+const STRUCTURAL_FIELD_TYPES = new Set(['Section', 'RepeatableSection', 'BuildingPlanSection']);
 
 const FORM_EVENT_BUILTIN_STATUS_BY_NAME = Object.freeze({
   EVAL: 'advanced',
@@ -296,11 +292,7 @@ export function getFormEventReferenceCatalog({ schema }) {
  *   referencedFields: string[],
  * }}
  */
-export function analyzeFormEventCode({
-  code,
-  schema,
-  securityConfig = DEFAULT_SECURITY_CONFIG,
-}) {
+export function analyzeFormEventCode({ code, schema, securityConfig = DEFAULT_SECURITY_CONFIG }) {
   const issues = [];
   const issueKeys = new Set();
   const usedBuiltins = [];

package/src/utilities/form-link-helpers.js

@@ -235,16 +235,22 @@ export function applyLinkedRecordSelection({
   }
 
   if (!values || typeof values !== 'object') {
-    throw new Error('applyLinkedRecordSelection requires a values object from the form engine state');
+    throw new Error(
+      'applyLinkedRecordSelection requires a values object from the form engine state'
+    );
   }
 
   const field = resolveFormField(form, fieldIdentifier);
   if (!field) {
-    throw new Error(`applyLinkedRecordSelection could not find field "${fieldIdentifier}" in the provided form`);
+    throw new Error(
+      `applyLinkedRecordSelection could not find field "${fieldIdentifier}" in the provided form`
+    );
   }
 
   if (field.type !== 'FormLinkField') {
-    throw new Error(`applyLinkedRecordSelection can only target FormLinkField fields (received ${field.type})`);
+    throw new Error(
+      `applyLinkedRecordSelection can only target FormLinkField fields (received ${field.type})`
+    );
   }
 
   const normalizedRecords = normalizeLinkedRecords(records);
@@ -255,7 +261,8 @@ export function applyLinkedRecordSelection({
     );
   }
 
-  const selectedRecords = field.allow_multiple_records === true ? normalizedRecords : normalizedRecords.slice(0, 1);
+  const selectedRecords =
+    field.allow_multiple_records === true ? normalizedRecords : normalizedRecords.slice(0, 1);
 
   values[field.data_name] = selectedRecords.map((record) => ({
     record_id: record.record_id,
@@ -275,7 +282,11 @@ export function applyLinkedRecordSelection({
       }
 
       if (field.allow_multiple_records === true) {
-        const aggregated = aggregateDefaultValues(selectedRecords, mapping.source_field_id, delimiter);
+        const aggregated = aggregateDefaultValues(
+          selectedRecords,
+          mapping.source_field_id,
+          delimiter
+        );
         values[destinationField.data_name] = aggregated;
         return;
       }

package/src/utilities/repeatable-helpers.js

@@ -19,11 +19,12 @@ export function buildRepeatableSectionTree(
   fieldOwnership = new Map(),
   sectionFields = new Set()
 ) {
-  if (!Array.isArray(elements)) return {
-    repeatableSectionTree,
-    fieldOwnership,
-    sectionFields,
-  };
+  if (!Array.isArray(elements))
+    return {
+      repeatableSectionTree,
+      fieldOwnership,
+      sectionFields,
+    };
 
   elements.forEach((element) => {
     if (element.type === 'Section' || element.type === 'BuildingPlanSection') {

package/src/utilities/uuid.js

@@ -6,7 +6,8 @@
 
 function getRandomBytes(length) {
   const array = new Uint8Array(length);
-  const cryptoObj = (typeof globalThis !== 'undefined' && (globalThis.crypto || globalThis.msCrypto)) || null;
+  const cryptoObj =
+    (typeof globalThis !== 'undefined' && (globalThis.crypto || globalThis.msCrypto)) || null;
 
   if (cryptoObj && typeof cryptoObj.getRandomValues === 'function') {
     cryptoObj.getRandomValues(array);

package/scripts/legacy-postinstall-message.cjs

@@ -1,42 +0,0 @@
-// Legacy reference only.
-// This script is intentionally not wired into package.json lifecycle hooks.
-// It is retained as a reference for the previous install-time guidance message.
-
-const PACKAGE_NAME = 'form0-core';
-
-const npmUserAgent = process.env.npm_config_user_agent || '';
-const npmArgv = process.env.npm_config_argv;
-
-const isSupportedManager = /(npm|pnpm|yarn|bun)\//.test(npmUserAgent);
-
-const parseNpmArgv = (raw) => {
-  if (!raw) return null;
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-};
-
-const includesExplicitPackage = (argv) => {
-  if (!argv) return false;
-  const args = Array.isArray(argv.original) ? argv.original : argv.cooked || [];
-  return args.some(
-    (arg) => arg === PACKAGE_NAME || arg.startsWith(`${PACKAGE_NAME}@`),
-  );
-};
-
-if (isSupportedManager && includesExplicitPackage(parseNpmArgv(npmArgv))) {
-  // Keep message short to avoid noisy installs.
-  console.warn(
-    [
-      '',
-      'form0-core is the engine only.',
-      'For the full form0 ecosystem, install the CLI:',
-      '  npm install -g form0-cli',
-      'Docs: https://docs.form0.dev/getting-started/quickstart',
-      'If you are integrating the engine directly, you can ignore this warning.',
-      '',
-    ].join('\n'),
-  );
-}