stimeo-ui 0.16.0 → 0.18.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 725d3da54257b2c556c30de96e34c325ed04ccfd06a9c065484aab388f5f969c
-  data.tar.gz: ea9c6e5c0c2fd7dea325e6769af6b51f51e74a179575cbb05695cf965a141357
+  metadata.gz: 05c2871de0e4c97223dfb10803e8c4fa84abc3a0cf5e9c946d6570d88c46f065
+  data.tar.gz: a772dc1b21e16d21ea37af8dbb2f6a56618fa94252fe43eebcbede4ab296c2a2
 SHA512:
-  metadata.gz: b080427c85f5accf04f627e757046fac13eda2a48b0ea1e27c548fbd035cb8bc90ddfcbfdb79f3bd63c7899e16649d873efcbdc6a964c5a4e2682271ccf48749
-  data.tar.gz: b0d2bcd93e2beb311c4fe4e9a09f843b89cdc87e43ad88f8fd5a13e5146e939b8b9abce3adda89922c486337a141d854cfe74778a04b6249780554761cb3d4d5
+  metadata.gz: a74a9a638fadb04fcec7c72ced80825fb75215051533508d2e58c40fc64ef4eb3aa41a0b76ee85ab9697004f9861d6b6a46b75ec62c39b013d274487f7986d42
+  data.tar.gz: 2b0ff0e66bc0f7062c241ee01032888206b300eb74c552561c3638638a9255a19ea69b1a9555fa5e72b50ab1e8bd8479f9b37f8e79743077df6da59ee65e2409

data/CHANGELOG.md

@@ -7,6 +7,139 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 While the version is `0.x`, the public API (the `stimeo--*` data attributes) may
 change between releases.
 
+## [Unreleased]
+
+## [0.18.0] - 2026-10-22
+
+Minor release with no new components. IME composition, Turbo morphs, and form
+submission now behave consistently across the input components, and several
+contracts change, so read Changed before upgrading. The Inspector manifest moves
+to schema v16; update `stimeo check` and the VS Code extension together and run
+`stimeo check` before deploying.
+
+### Added
+
+- time-picker: `amLabel` and `pmLabel` Values set the meridiem text and its
+  speech, and `hour12ZeroBased` shows and enters a twelve-hour clock's hours as
+  0–11, as `午前` / `午後` time is written. The submitted value stays on the
+  24-hour clock.
+
+### Changed
+
+- **Breaking** input-mask: a synchronized hidden field carries a unique internal
+  DOM name; native FormData and native / Turbo submission restore the original
+  name, and removing the source submits an empty entry. Find managed fields by id
+  or the pairing attribute, use native FormData, and call
+  `prepareInputMaskForm(form)` before reading FormData from a new detached form.
+  input-mask clears only the raw value it wrote.
+- **Breaking** otp: a pattern drop held for a composition is reported as
+  `reconcile` before the edit's own `change` / `complete` / `invalid`, and a
+  reconnect under another `pattern` drops what it rejects as `reconcile`. Use the
+  edit events for submission.
+- **Breaking** number-input: a range or step change made during IME composition
+  applies when the user confirms, reported as `change`; a morph that changes
+  neither holds nothing.
+- **Breaking** currency-input: actions and events act only on the first `display`
+  target, and a display already focused when the controller connects starts
+  formatting at its next ordinary edit or composition end. Render the initial
+  hidden and accessible values on the server. `stimeo check` warns about extra
+  displays.
+- **Breaking** tabs, calendar, date-range-picker, slider, range-slider,
+  color-picker, multi-select, and tags-input read the writing direction from their
+  layout targets instead of the root; carousel gains a `pickerList` and
+  navigation-menu a `list` target.
+- **Breaking** dirty-form and optimistic accept only the terminal event matching
+  the latest start's source and token, and only `success: true` succeeds. For a
+  custom save, call `markClean` or dispatch the paired events with `success`.
+- **Breaking** local-time and relative-time read `datetime` strictly: a clock
+  without a zone is UTC (relative-time read it as local time), and an incomplete
+  or invalid value keeps the current display.
+- **Breaking** presence and typing-indicator templates use `{count}`, `{name}`,
+  and `{names}` instead of `%{…}`.
+- **Breaking** modified `Home` / `End` / `PageUp` / `PageDown` go to the browser
+  in widgets without a dedicated binding; pointer-drag cancels a keyboard grab
+  when focus leaves the handle; time-picker accepts digits typed with `Shift`.
+- **Breaking** progress, meter, pointer-drag, countdown, overflow-menu, listbox,
+  submit-once, clipboard, announcer, and currency-input change their ownership
+  markers (pointer-drag: `data-stimeo--pointer-drag-tabindex-loan`, listbox:
+  `owns-label`); re-render persisted HTML from authored markup. progress and meter
+  restore the authored `aria-valuetext` when the template is cleared or the
+  controller disconnects.
+- **Breaking** menubar, navigation-menu, menu, and context-menu treat an entry
+  inside an `aria-disabled="true"` ancestor as disabled (it stays reachable with
+  the arrow keys), and with nested entries refuse an action when any entry holding
+  its target is disabled. A click is judged when it reaches the component, so a
+  handler inside the component that disables its entry during the click keeps the
+  open or close it started; a menubar top it leaves natively `disabled` then has
+  its menu closed again, without a `close` event.
+- **Breaking** pointer-drag: `reset()` returns the inline `translate` to the
+  origin only when `follow` is on; otherwise it cancels the gesture in flight and
+  leaves the author's `translate` alone.
+- toggle-group writes `aria-pressed`, time-picker `aria-valuenow`, and radio-group
+  its arrival and release `tabindex` only when the value changes.
+- context-menu: the region contract drops `aria-haspopup`; give the region a role
+  and name that fit its content and advertise the key with
+  `aria-keyshortcuts="Shift+F10"`.
+- `stimeo check` reports `missing-announcer` for the `stimeo-ui/cable`
+  controllers (live-counter, presence, typing-indicator), and the
+  `stimeo:install` generator writes commented-out pins and registrations for the
+  opt-in `stimeo-ui/cable` and `stimeo-ui/positioning` entry points.
+
+### Removed
+
+- character-counter: the `announceTextValueChanged()` callback is gone from the
+  shipped types; pending announcements still read the current `announceText`.
+
+### Fixed
+
+- IME composition no longer sticks after a page write, a move, or a Turbo morph
+  in auto-submit, character-counter, combobox, command-palette, currency-input,
+  editable, input-mask, multi-select, number-input, otp, tags-input, and toolbar.
+  A morph leaves a field mid-composition alone, and a focused draft survives
+  morphs and reconnection.
+- switch, otp, currency-input, and input-mask keep their hidden form values right
+  across Turbo morphs and removal.
+- State events and reconciliation stay right when a `change` listener disconnects
+  the controller or the page edits state during a repair.
+- Components release what an earlier connection registered when connected twice,
+  and keep authored text, ARIA, and tab stops through restores.
+- relative-time follows live `datetime` changes; template substitution leaves
+  inherited names such as `{constructor}` unchanged.
+- menubar, navigation-menu, menu, and context-menu refuse a `hidden`, natively
+  `disabled`, or `aria-disabled` entry on every route — an explicit element, any
+  event, or hover — as a click on it already was; `context-menu#activate` takes
+  the optional event.
+- The MCP server accepts JSON-RPC batches in sessions that negotiated protocol
+  version 2025-03-26; other versions, and batches before `initialize`, are still
+  rejected.
+
+## [0.17.0] - 2026-10-04
+
+### Changed
+
+- **Breaking** Replace `reset-before-cache` with `reset-on-restore` (class, export,
+  and subpath).
+  Reset runs on restoration; remove `dispatchReset` and `:request` bindings.
+  Restored drawers and command palettes start closed.
+- **Breaking** Rename calendar, combobox, and command-palette `selectByClick`, and
+  tree-view `onClick`, to `select`; replace calendar `selectDayElement` with
+  `select(element)`.
+  Accordion `toggle`, theme `set`, and scrollspy `scrollTo` require owned targets.
+- **Breaking** State events are silent for unchanged state and superseded pending
+  reports.
+  For child edits within partial checkbox groups, use the children's native `change`.
+  Number Values and action params enforce finite values and their declared domains.
+  Update Inspector integrations to schema v15 and run `stimeo check` before deploying.
+- Target actions accept owned elements; user state reports include `detail.reason`.
+  Toast duration, persist debounce, and count-up duration changes apply to the next
+  operation. Portal destination changes update mounts; Cable params cannot replace
+  the declared channel.
+
+### Fixed
+
+- Preserve live state across Turbo caching, repair derived state after retained
+  morphs, and restore focus reliably across nested layers and Shadow DOM.
+
 ## [0.16.0] - 2026-09-26
 
 Minor release with no new components. Widgets now report their own state
@@ -1278,6 +1411,9 @@ Initial public alpha: 101 behavior-only, accessible Stimulus controllers driven
 by `data-*` attributes, shipping no CSS. Published to npm (with provenance) and
 RubyGems.
 
+[Unreleased]: https://github.com/taiyaky/stimeo-ui/compare/v0.18.0...HEAD
+[0.18.0]: https://github.com/taiyaky/stimeo-ui/releases/tag/v0.18.0
+[0.17.0]: https://github.com/taiyaky/stimeo-ui/releases/tag/v0.17.0
 [0.16.0]: https://github.com/taiyaky/stimeo-ui/releases/tag/v0.16.0
 [0.15.0]: https://github.com/taiyaky/stimeo-ui/releases/tag/v0.15.0
 [0.14.0]: https://github.com/taiyaky/stimeo-ui/releases/tag/v0.14.0

data/README.md

@@ -15,9 +15,9 @@
 owns the look entirely.
 
 - Lean by design: the **core** needs only `@hotwired/stimulus` at runtime (kept
-  external in the build). The opt-in `stimeo-ui/positioning` module is the one
-  exception — it uses `@floating-ui/dom` (an optional **peer dependency**; see the
-  Peer dependencies note below).
+  external in the build). Two opt-in subpaths each add one optional **peer
+  dependency**: `stimeo-ui/positioning` (`@floating-ui/dom`) and `stimeo-ui/cable`
+  (`@rails/actioncable`); see the Peer dependencies note below.
 - Accessibility first: every controller follows the relevant WAI-ARIA APG pattern
   and the related WCAG 2.2 AA criteria.
 - Public controller identifiers use the `stimeo--` namespace (e.g.
@@ -36,8 +36,12 @@ bin/rails generate stimeo:install
 ```
 
 The generator vendors the prebuilt JS into `vendor/javascript/stimeo/`, pins
-`stimeo-ui` in `config/importmap.rb`, and registers all controllers with your
-Stimulus application. Then drive components from HTML alone:
+`stimeo-ui` in `config/importmap.rb`, and registers the core controllers with your
+Stimulus application (`app/javascript/controllers/stimeo.js`). It writes the opt-in
+`stimeo-ui/positioning` and `stimeo-ui/cable` entry points into those two files
+commented out; to enable one, uncomment its lines. The cable lines include the pin
+for its `@rails/actioncable` peer; positioning also needs a pin for
+`@floating-ui/dom`. Then drive components from HTML alone:
 
 ```erb
 <div data-controller="stimeo--dropdown">
@@ -58,15 +62,26 @@ import { Application } from "@hotwired/stimulus";
 import { registerStimeo } from "stimeo-ui";
 
 const application = Application.start();
-registerStimeo(application); // registers every stimeo--* controller
+registerStimeo(application); // registers every controller of the core entry point
 ```
 
+The opt-in `stimeo-ui/positioning` and `stimeo-ui/cable` entry points register
+theirs with `registerPositioning` / `registerCable`.
+
 Need only a few controllers? Import them individually from
-`stimeo-ui/controllers/*` and register them under your own identifiers.
+`stimeo-ui/controllers/*` and register them under your own identifiers. Each
+file loads on its own, yet the coordination between components — which layer
+Escape closes, a focus trap's `Tab` and background, the value two components
+lend the same attribute — is kept once per page, whichever files the
+controllers came from, `stimeo-ui` itself included.
+Copies of the same controller also share dirty-form confirmations, highlight
+deadlines and portal origins. Opt-in Cable copies share the consumer, subscriptions
+and peer departure decisions; generated ARIA ids stay distinct across copies too.
 
 - **Peer dependencies:** `@hotwired/stimulus` (always), `@floating-ui/dom` (only
   if you use the opt-in `stimeo-ui/positioning` module — tooltips, popovers, etc.
-  work without it via the default flow layout).
+  work without it via the default flow layout), and `@rails/actioncable` (only if
+  you use the opt-in `stimeo-ui/cable` module).
 - **No CSS is shipped.** Style the components yourself; controllers only toggle
   ARIA state and `data-*` hooks.
 
@@ -111,8 +126,9 @@ keep the rules on everywhere else. For Biome:
 The `eslint-plugin-jsx-a11y` equivalents are
 `no-noninteractive-element-to-interactive-role`, `no-redundant-roles`,
 `prefer-tag-over-role`, `interactive-supports-focus`, and
-`no-noninteractive-tabindex`. These components' real accessibility is exercised
-with axe-core and real screen readers in this project's own test suite.
+`no-noninteractive-tabindex`. This repository's tests check these components
+with axe-core and with a virtual screen reader for speech order; neither stands
+in for a real screen reader on your own pages.
 
 ## Composing components
 
@@ -272,7 +288,7 @@ or in `.mcp.json` (Claude Code) / `.cursor/mcp.json` (Cursor):
 It exposes four read-only tools — `stimeo_check` (validate a source string),
 `stimeo_catalog`, `stimeo_controller` (one controller's full contract,
 accessibility requirements included), and `stimeo_example` (verified example
-markup: the official catalog demo under [`examples/`](examples/), bundled at
+markup: the controller's demo under [`examples/`](examples/), bundled at
 build time and guaranteed to pass the checker) — plus MCP resources
 (`stimeo://manifest`, `stimeo://examples/<id>`) for preloading context without
 a tool round-trip. The server reads only its bundled manifest and example