Add programmatic form validation

Programmatic forms use the same server-side POM Forms validation pipeline as saved forms. Declare field type and rules in the field definition; do not rely on browser required, JavaScript or a hidden field alone.

Supported validation covers type-specific email, telephone, URL, number, date/time, choices and uploads, plus configured required state, lengths, pattern, numeric bounds/step, allowed email domains, HTTPS and file limits where applicable.

Messages

pom_forms_get_default_config() starts with the site defaults. Override only specific keys:

$config['messages']['required']      = 'Complete this field.';
$config['messages']['invalid_email'] = 'Enter a valid work email address.';

Messages can use the documented placeholders such as {min}, {max}, {step}, {domains} or {date} where that validation supplies one.

Conditional fields

Validation resolves conditional visibility before validating the submission. A field hidden by an inactive branch should not block submission and its hidden value/file is removed from the active payload. Test branch activation, deactivation after entering a value and direct crafted requests.

Integration-specific business rules

If the owning plugin must enforce a rule beyond the public field schema, perform it at the integration's trusted processing boundary. Never weaken POM's normal sanitization or file checks. Return a user-safe message and do not leak raw validation input to logs.

Test valid, missing, malformed, boundary and tampered values while signed out.