feat(form-builder): form_field_validation_rules table + polymorphic owner + scope + cascade

api/app/Models/FormBuilder/FormField.php

@@ -111,6 +111,11 @@ final class FormField extends Model
         return $this->morphMany(FormFieldBinding::class, 'owner');
     }
 
+    public function validationRules(): MorphMany
+    {
+        return $this->morphMany(FormFieldValidationRule::class, 'owner');
+    }
+
     /**
      * Nuanced activity log (ARCH §17.1; S1 Phase 4b). Callers choose which
      * events are worth logging — e.g. created/deleted/restored, field_type

api/app/Models/FormBuilder/FormFieldLibrary.php

@@ -69,4 +69,9 @@ final class FormFieldLibrary extends Model
     {
         return $this->morphMany(FormFieldBinding::class, 'owner');
     }
+
+    public function validationRules(): MorphMany
+    {
+        return $this->morphMany(FormFieldValidationRule::class, 'owner');
+    }
 }

api/app/Models/FormBuilder/FormFieldValidationRule.php

@@ -0,0 +1,55 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models\FormBuilder;
+
+use App\Enums\FormBuilder\FormFieldValidationRuleType;
+use App\Models\Scopes\FormFieldValidationRuleScope;
+use Illuminate\Database\Eloquent\Concerns\HasUlids;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\MorphTo;
+
+/**
+ * Relational home for what was `form_fields.validation_rules` and
+ * `form_field_library.validation_rules` JSON. Polymorphic owner — morph
+ * aliases `form_field` and `form_field_library`. See ARCH-FORM-BUILDER
+ * §17.4 and ARCH-CONSOLIDATION-ADDENDUM-2026-04-24 §Q3.
+ *
+ * One row per (owner, rule_type). `parameters` JSON holds the rule-type-
+ * specific configuration (e.g. `{ "value": 3 }` for `min_length`, or
+ * `{ "mime_types": [...] }` for `allowed_mime_types`). Parameter shape
+ * validation lives in `FormFieldValidationRuleService`, not on the model.
+ */
+final class FormFieldValidationRule extends Model
+{
+    use HasFactory;
+    use HasUlids;
+
+    protected $table = 'form_field_validation_rules';
+
+    protected static function booted(): void
+    {
+        static::addGlobalScope(new FormFieldValidationRuleScope());
+    }
+
+    protected $fillable = [
+        'owner_type',
+        'owner_id',
+        'rule_type',
+        'parameters',
+        'error_message_key',
+    ];
+
+    /** @var array<string, string> */
+    protected $casts = [
+        'rule_type' => FormFieldValidationRuleType::class,
+        'parameters' => 'array',
+    ];
+
+    public function owner(): MorphTo
+    {
+        return $this->morphTo('owner', 'owner_type', 'owner_id');
+    }
+}

api/app/Models/Scopes/FormFieldValidationRuleScope.php

@@ -0,0 +1,102 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models\Scopes;
+
+use App\Models\FormBuilder\FormField;
+use App\Models\FormBuilder\FormFieldLibrary;
+use App\Models\FormBuilder\FormSchema;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Scope;
+
+/**
+ * Multi-tenant isolation for `form_field_validation_rules`. Sibling to
+ * `FormFieldBindingScope` — the two share the same UNION shape over the
+ * polymorphic owner's two possible parents (`form_field → form_schema →
+ * organisation_id` ∪ `form_field_library → organisation_id`).
+ *
+ * Duplicate code with `FormFieldBindingScope` is acknowledged; base-class
+ * extraction is deferred to WS-5d per the architect addendum Q3 decision:
+ * premature abstraction from two is still premature, and WS-5d adds a
+ * third sibling that will make what truly varies visible.
+ *
+ * Organisation context resolution mirrors `OrganisationScope` — explicit
+ * override via constructor, then `organisation` / `event` route parameter
+ * fallbacks. CLI, queues, and unauthenticated flows skip the scope.
+ *
+ * Escape hatch:
+ * `FormFieldValidationRule::withoutGlobalScope(FormFieldValidationRuleScope::class)`.
+ */
+final class FormFieldValidationRuleScope implements Scope
+{
+    public function __construct(
+        private readonly ?string $organisationId = null,
+    ) {}
+
+    public function apply(Builder $builder, Model $model): void
+    {
+        $orgId = $this->resolveOrganisationId();
+        if ($orgId === null) {
+            return;
+        }
+
+        $fieldIds = FormField::query()
+            ->withoutGlobalScope(OrganisationScope::class)
+            ->whereIn(
+                'form_schema_id',
+                FormSchema::query()
+                    ->withoutGlobalScope(OrganisationScope::class)
+                    ->where('organisation_id', $orgId)
+                    ->select('id'),
+            )
+            ->select('id');
+
+        $libraryIds = FormFieldLibrary::query()
+            ->withoutGlobalScope(OrganisationScope::class)
+            ->where('organisation_id', $orgId)
+            ->select('id');
+
+        $table = $model->getTable();
+
+        $builder->where(function (Builder $outer) use ($table, $fieldIds, $libraryIds): void {
+            $outer->where(function (Builder $q) use ($table, $fieldIds): void {
+                $q->where("$table.owner_type", 'form_field')
+                    ->whereIn("$table.owner_id", $fieldIds);
+            })->orWhere(function (Builder $q) use ($table, $libraryIds): void {
+                $q->where("$table.owner_type", 'form_field_library')
+                    ->whereIn("$table.owner_id", $libraryIds);
+            });
+        });
+    }
+
+    private function resolveOrganisationId(): ?string
+    {
+        if ($this->organisationId !== null) {
+            return $this->organisationId;
+        }
+
+        $route = request()->route();
+        if ($route === null) {
+            return null;
+        }
+
+        $org = $route->parameter('organisation');
+
+        if ($org instanceof \App\Models\Organisation) {
+            return $org->id;
+        }
+
+        if (is_string($org) && $org !== '') {
+            return $org;
+        }
+
+        $event = $route->parameter('event');
+        if ($event instanceof \App\Models\Event) {
+            return $event->organisation_id;
+        }
+
+        return null;
+    }
+}