@holo-js/forms 0.1.1 → 0.1.3

package/dist/chunk-663LOLKH.mjs

@@ -0,0 +1,421 @@
+// src/contracts.ts
+import {
+  createErrorBag,
+  defineSchema,
+  isValidationSchema,
+  validate as validateInput
+} from "@holo-js/validation";
+
+// src/security.ts
+var securityModulePromise;
+function isMissingOptionalPackageError(error) {
+  if (!(error instanceof Error)) {
+    return false;
+  }
+  return [
+    /Cannot find package ['"]?@holo-js\/security['"]?/,
+    /Cannot find module ['"]?@holo-js\/security['"]?/,
+    /Failed to resolve module specifier ['"]?@holo-js\/security['"]?/,
+    /Failed to load url ['"]?@holo-js\/security['"]?/,
+    /Could not resolve ['"]?@holo-js\/security['"]?/
+  ].some((pattern) => pattern.test(error.message));
+}
+function createMissingSecurityPackageError() {
+  return new FormContractError(
+    "[@holo-js/forms] Security-aware form options require the optional @holo-js/security package to be installed."
+  );
+}
+async function importSecurityModule() {
+  const specifier = ["@holo-js", "security"].join("/");
+  if (typeof process !== "undefined" && process.env && process.env.VITEST) {
+    return await import(
+      /* @vite-ignore */
+      specifier
+    );
+  }
+  return await import(specifier);
+}
+async function loadSecurityModule() {
+  const runtime = globalThis;
+  if (runtime.__holoFormsSecurityModule__) {
+    return runtime.__holoFormsSecurityModule__;
+  }
+  securityModulePromise ??= (runtime.__holoFormsSecurityImport__ ? runtime.__holoFormsSecurityImport__() : importSecurityModule()).then((module) => module).catch(async (error) => {
+    securityModulePromise = void 0;
+    if (isMissingOptionalPackageError(error)) {
+      throw createMissingSecurityPackageError();
+    }
+    throw error;
+  });
+  return await securityModulePromise;
+}
+function resetSecurityModuleCache() {
+  securityModulePromise = void 0;
+}
+function parseCookieHeader(header) {
+  const decodeCookiePart = (value) => {
+    try {
+      return decodeURIComponent(value);
+    } catch {
+      return void 0;
+    }
+  };
+  return Object.freeze(Object.fromEntries(
+    header.split(";").map((segment) => segment.trim()).filter(Boolean).map((segment) => {
+      const separator = segment.indexOf("=");
+      if (separator <= 0) {
+        return void 0;
+      }
+      const key = decodeCookiePart(segment.slice(0, separator));
+      const value = decodeCookiePart(segment.slice(separator + 1));
+      if (!key || typeof value === "undefined") {
+        return void 0;
+      }
+      return [
+        key,
+        value
+      ];
+    }).filter((entry) => !!entry)
+  ));
+}
+function isRootSecurityError(error) {
+  const candidate = error;
+  return error instanceof Error && typeof candidate?.status === "number" && (candidate.status === 419 || candidate.status === 429);
+}
+var formsSecurityInternals = {
+  createMissingSecurityPackageError,
+  isMissingOptionalPackageError,
+  isRootSecurityError,
+  parseCookieHeader,
+  resetSecurityModuleCache
+};
+
+// src/contracts.ts
+var FormContractError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "FormContractError";
+  }
+};
+function schema(shapeOrSchema) {
+  const base = isValidationSchema(shapeOrSchema) ? shapeOrSchema : defineSchema(shapeOrSchema);
+  return Object.freeze({
+    ...base,
+    mode: "form"
+  });
+}
+function isFormSchema(value) {
+  return isValidationSchema(value) && value.mode === "form";
+}
+function normalizeStatus(value, fallback) {
+  if (typeof value === "undefined") {
+    return fallback;
+  }
+  if (!Number.isInteger(value) || value < 100) {
+    throw new FormContractError("HTTP status codes must be integers greater than or equal to 100.");
+  }
+  return value;
+}
+function serializeSubmissionState(valid, values, errors) {
+  return Object.freeze({
+    valid,
+    submitted: true,
+    values,
+    errors: errors.flatten()
+  });
+}
+function createSubmission(valid, values, errors, failureStatus = 422) {
+  const normalizedFailureStatus = normalizeStatus(failureStatus, 422);
+  const serialize = () => serializeSubmissionState(valid, values, errors);
+  const failure = () => ({
+    ok: false,
+    status: normalizedFailureStatus,
+    valid: false,
+    values,
+    errors: errors.flatten()
+  });
+  const success = (payload, status) => ({
+    ok: true,
+    status: normalizeStatus(status, 200),
+    data: payload
+  });
+  if (valid) {
+    const data = values;
+    return Object.freeze({
+      valid: true,
+      submitted: true,
+      data,
+      values: data,
+      errors,
+      serialize,
+      success,
+      fail(status) {
+        const payload = failure();
+        return {
+          ...payload,
+          status: normalizeStatus(status, payload.status)
+        };
+      }
+    });
+  }
+  return Object.freeze({
+    valid: false,
+    submitted: true,
+    data: void 0,
+    values,
+    errors,
+    serialize,
+    success,
+    fail(status) {
+      const payload = failure();
+      return {
+        ...payload,
+        status: normalizeStatus(status, payload.status)
+      };
+    }
+  });
+}
+function createSuccessfulSubmission(schemaDefinition, data) {
+  void schemaDefinition;
+  return createSubmission(true, data, createErrorBag());
+}
+function createFailedSubmission(schemaDefinition, values, flattenedErrors, status = 422) {
+  void schemaDefinition;
+  const normalizedStatus = normalizeStatus(status, 422);
+  return createSubmission(
+    false,
+    values,
+    createErrorBag(flattenedErrors),
+    normalizedStatus
+  );
+}
+function isRequestInput(input) {
+  return typeof Request !== "undefined" && input instanceof Request;
+}
+function isRequestLikeBody(value) {
+  if (typeof value === "string" || value instanceof URLSearchParams) {
+    return true;
+  }
+  if (typeof FormData !== "undefined" && value instanceof FormData) {
+    return true;
+  }
+  if (typeof Blob !== "undefined" && value instanceof Blob) {
+    return true;
+  }
+  if (typeof ArrayBuffer !== "undefined" && value instanceof ArrayBuffer) {
+    return true;
+  }
+  if (ArrayBuffer.isView(value)) {
+    return true;
+  }
+  return !!value && typeof value === "object" && (Symbol.asyncIterator in value || "pipe" in value || "getReader" in value);
+}
+function isHeadersTupleArray(value) {
+  return Array.isArray(value) && value.every((entry) => Array.isArray(entry) && entry.length === 2 && typeof entry[0] === "string" && typeof entry[1] === "string");
+}
+function isRequestLikeHeaders(value) {
+  return value instanceof Headers || isHeadersTupleArray(value) || !!value && typeof value === "object";
+}
+function normalizeRequestHeaders(input) {
+  if (input instanceof Headers) {
+    return new Headers(input);
+  }
+  const headers = new Headers();
+  if (isHeadersTupleArray(input)) {
+    for (const [name, value] of input) {
+      headers.append(name, value);
+    }
+    return headers;
+  }
+  if (input && typeof input === "object") {
+    for (const [name, value] of Object.entries(input)) {
+      if (typeof value === "string") {
+        headers.append(name, value);
+        continue;
+      }
+      if (Array.isArray(value)) {
+        const separator = name.toLowerCase() === "cookie" ? "; " : ",";
+        const joined = value.filter((entry) => typeof entry === "string").join(separator);
+        if (joined) {
+          headers.append(name, joined);
+        }
+      }
+    }
+  }
+  return headers;
+}
+function extractRequestLikeUrl(input, headers) {
+  const url = input.web?.request?.url ?? (typeof input.url === "string" ? input.url : input.url?.toString()) ?? (typeof input.req === "object" && !(input.req instanceof Request) ? input.req.url : void 0) ?? input.node?.req?.url ?? input.path ?? "/";
+  try {
+    return new URL(url).toString();
+  } catch {
+    const protocol = headers.get("x-forwarded-proto") ?? "http";
+    const host = headers.get("x-forwarded-host") ?? headers.get("host") ?? "localhost";
+    return new URL(url, `${protocol}://${host}`).toString();
+  }
+}
+function extractRequestLikeMethod(input) {
+  return input.web?.request?.method ?? input.method ?? (typeof input.req === "object" && !(input.req instanceof Request) ? input.req.method : void 0) ?? input.node?.req?.method ?? "GET";
+}
+function extractRequestLikeBody(input, headers, method) {
+  if (method === "GET" || method === "HEAD") {
+    return void 0;
+  }
+  const rawBody = input.body ?? (typeof input.req === "object" && !(input.req instanceof Request) ? input.req.body : void 0) ?? input.node?.req?.body ?? input.node?.req;
+  if (typeof rawBody === "undefined" || rawBody === null) {
+    return void 0;
+  }
+  if (isRequestLikeBody(rawBody)) {
+    return rawBody;
+  }
+  if (typeof rawBody === "object") {
+    if (!headers.has("content-type")) {
+      headers.set("content-type", "application/json");
+    }
+    return JSON.stringify(rawBody);
+  }
+  return String(rawBody);
+}
+function isRequestLikeInput(input) {
+  if (!input || typeof input !== "object") {
+    return false;
+  }
+  const candidate = input;
+  return candidate.web?.request instanceof Request || candidate.req instanceof Request || typeof candidate.method === "string" || typeof candidate.path === "string" || typeof candidate.url === "string" || candidate.url instanceof URL || isRequestLikeHeaders(candidate.headers) || !!candidate.req && typeof candidate.req === "object" || !!candidate.node?.req && typeof candidate.node.req === "object";
+}
+function normalizeRequestLikeInput(input) {
+  if (isRequestInput(input)) {
+    return input;
+  }
+  if (!isRequestLikeInput(input)) {
+    return void 0;
+  }
+  if (input.web?.request instanceof Request) {
+    return input.web.request;
+  }
+  if (input.req instanceof Request) {
+    return input.req;
+  }
+  const headers = normalizeRequestHeaders(
+    input.headers ?? (typeof input.req === "object" && !(input.req instanceof Request) ? input.req.headers : void 0) ?? input.node?.req?.headers
+  );
+  const method = extractRequestLikeMethod(input);
+  const body = extractRequestLikeBody(input, headers, method);
+  return new Request(extractRequestLikeUrl(input, headers), {
+    method,
+    headers,
+    body,
+    // Undici requires duplex when constructing a Request from a stream/async iterable in Node.
+    ...body && typeof body === "object" && (Symbol.asyncIterator in body || "pipe" in body || "getReader" in body) ? { duplex: "half" } : {}
+  });
+}
+async function createSecurityFailureSubmission(input, schemaDefinition, error) {
+  let values = {};
+  let flattenedErrors = {};
+  try {
+    const inspection = await validateInput(input.clone(), schemaDefinition);
+    if (inspection.valid) {
+      values = inspection.data;
+    } else {
+      values = inspection.values;
+      flattenedErrors = inspection.errors.flatten();
+    }
+  } catch {
+    values = {};
+    flattenedErrors = {};
+  }
+  return createFailedSubmission(
+    schemaDefinition,
+    values,
+    {
+      ...flattenedErrors,
+      _root: [
+        ...flattenedErrors._root ?? [],
+        error.message
+      ]
+    },
+    error.status
+  );
+}
+async function validate(input, schemaDefinition, options = {}) {
+  let validatedSubmission;
+  const usesSecurityOptions = options.csrf === true || typeof options.throttle === "string";
+  const normalizedRequestInput = usesSecurityOptions ? normalizeRequestLikeInput(input) : void 0;
+  const validationInput = normalizedRequestInput ?? input;
+  if (usesSecurityOptions && !normalizedRequestInput) {
+    throw new FormContractError(
+      "Security-aware validate() options require a Request or request-like event input."
+    );
+  }
+  if (usesSecurityOptions) {
+    const request = normalizedRequestInput;
+    try {
+      const security = await loadSecurityModule();
+      const verificationRequest = (() => {
+        try {
+          return request.clone();
+        } catch {
+          return request;
+        }
+      })();
+      if (options.csrf === true) {
+        await security.csrf.verify(verificationRequest);
+      }
+      if (typeof options.throttle === "string") {
+        const inspection = await validateInput(request.clone(), schemaDefinition);
+        const throttleValues = inspection.valid ? inspection.data : inspection.values;
+        validatedSubmission = inspection.valid ? createSuccessfulSubmission(schemaDefinition, inspection.data) : createFailedSubmission(schemaDefinition, inspection.values, inspection.errors.flatten());
+        await security.rateLimit(options.throttle, {
+          request,
+          values: throttleValues
+        });
+      }
+    } catch (error) {
+      if (formsSecurityInternals.isRootSecurityError(error)) {
+        if (validatedSubmission) {
+          return createFailedSubmission(
+            schemaDefinition,
+            validatedSubmission.valid ? validatedSubmission.data : validatedSubmission.values,
+            {
+              ...validatedSubmission.valid ? {} : validatedSubmission.errors.flatten(),
+              _root: [
+                ...!validatedSubmission.valid ? validatedSubmission.errors.flatten()._root ?? [] : [],
+                error.message
+              ]
+            },
+            error.status
+          );
+        }
+        return await createSecurityFailureSubmission(request, schemaDefinition, error);
+      }
+      throw error;
+    }
+  }
+  if (validatedSubmission) {
+    return validatedSubmission;
+  }
+  const result = await validateInput(validationInput, schemaDefinition);
+  if (result.valid) {
+    return createSuccessfulSubmission(schemaDefinition, result.data);
+  }
+  return createFailedSubmission(schemaDefinition, result.values, result.errors.flatten());
+}
+var formsInternals = {
+  createSubmission,
+  isRequestLikeHeaders,
+  normalizeRequestLikeInput,
+  normalizeStatus,
+  normalizeRequestHeaders,
+  serializeSubmissionState
+};
+
+export {
+  formsSecurityInternals,
+  FormContractError,
+  schema,
+  isFormSchema,
+  createSuccessfulSubmission,
+  createFailedSubmission,
+  validate,
+  formsInternals
+};

package/dist/client.d.ts

@@ -13,6 +13,7 @@ type ClientSubmitResult<TData> = FormSubmissionResult<TData> | SerializedFormSub
 interface UseFormOptions<TData> {
     readonly action?: string;
     readonly method?: string;
+    readonly csrf?: boolean;
     readonly validateOn?: ValidateOnMode;
     readonly initialValues?: Partial<TData>;
     readonly initialState?: SerializedFormSubmission<TData>;
@@ -28,7 +29,7 @@ interface FormFieldState<TValue> {
     onBlur(): Promise<void>;
     validate(): Promise<readonly string[]>;
 }
-type FormFieldTree<TData> = TData extends readonly unknown[] ? FormFieldState<TData> : TData extends PrimitiveLike ? FormFieldState<TData> : TData extends Record<string, unknown> ? {
+type FormFieldTree<TData> = [TData] extends [readonly unknown[]] ? FormFieldState<TData> : [TData] extends [PrimitiveLike] ? FormFieldState<TData> : [TData] extends [Record<string, unknown>] ? {
     readonly [K in keyof TData]: FormFieldTree<TData[K]>;
 } : FormFieldState<TData>;
 interface UseFormResult<TData> {

package/dist/client.mjs

@@ -1,11 +1,61 @@
 import {
+  FormContractError,
   createFailedSubmission,
   createSuccessfulSubmission,
+  formsSecurityInternals,
   validate
-} from "./chunk-Z6TEFT7S.mjs";
+} from "./chunk-663LOLKH.mjs";
 
 // src/client.ts
 import { createErrorBag } from "@holo-js/validation";
+
+// src/client-security.ts
+var securityClientModulePromise;
+async function importSecurityClientModule() {
+  if (process.env.VITEST) {
+    return await import(
+      /* @vite-ignore */
+      "@holo-js/security/client"
+    );
+  }
+  return await import("@holo-js/security/client");
+}
+async function loadSecurityClientModule() {
+  const runtime = globalThis;
+  if (runtime.__holoFormsSecurityClientModule__) {
+    return runtime.__holoFormsSecurityClientModule__;
+  }
+  securityClientModulePromise ??= (runtime.__holoFormsSecurityClientImport__ ? runtime.__holoFormsSecurityClientImport__() : importSecurityClientModule()).then((module) => module).catch(async (error) => {
+    securityClientModulePromise = void 0;
+    if (formsSecurityInternals.isMissingOptionalPackageError(error)) {
+      throw formsSecurityInternals.createMissingSecurityPackageError();
+    }
+    throw error;
+  });
+  return await securityClientModulePromise;
+}
+async function getClientCsrfField() {
+  const runtime = globalThis;
+  if (!runtime.document || typeof runtime.document.cookie !== "string") {
+    throw new FormContractError(
+      "[@holo-js/forms] useForm({ csrf: true }) requires a browser-like document.cookie environment."
+    );
+  }
+  const security = await loadSecurityClientModule();
+  const config = security.getSecurityClientConfig().csrf;
+  const value = formsSecurityInternals.parseCookieHeader(runtime.document.cookie)[config.cookie];
+  if (!value) {
+    throw new FormContractError(
+      `[@holo-js/forms] Missing CSRF cookie "${config.cookie}" required by useForm({ csrf: true }).`
+    );
+  }
+  return Object.freeze({
+    name: config.field,
+    value
+  });
+}
+
+// src/client.ts
 function isPlainObject(value) {
   return !!value && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date) && !(value instanceof Blob);
 }
@@ -323,6 +373,10 @@ async function defaultSubmitter(context) {
   });
   return await normalizeFetchResponse(response, context.values);
 }
+function isSafeMethod(method) {
+  const normalized = method.trim().toUpperCase();
+  return normalized === "GET" || normalized === "HEAD" || normalized === "OPTIONS" || normalized === "TRACE";
+}
 function useForm(schemaDefinition, options = {}) {
   const initialValues = mergeValues(
     normalizeObject(options.initialState?.values),
@@ -392,11 +446,17 @@ function useForm(schemaDefinition, options = {}) {
           return local;
         }
         const submitter = options.submitter ?? defaultSubmitter;
+        const method = options.method ?? "POST";
+        const formData = buildFormData(state.values);
+        if (options.csrf === true && !isSafeMethod(method)) {
+          const csrfField = await getClientCsrfField();
+          formData.set(csrfField.name, csrfField.value);
+        }
         const response = await submitter({
           action: options.action,
-          method: options.method ?? "POST",
+          method,
           values: state.values,
-          formData: buildFormData(state.values)
+          formData
         });
         return this.applyServerState(response);
       } finally {

package/dist/index.d.ts

@@ -3,6 +3,7 @@ export { ErrorTree, ErrorTreeNode, FieldDefinition, FieldRule, InferSchemaData,
 
 interface FormSchema<TShape extends SchemaInputShape = SchemaInputShape> extends ValidationSchema<TShape> {
     readonly mode: 'form';
+    readonly fields: ValidationSchema<TShape>['fields'];
     readonly $values?: Partial<InferSchemaData<TShape>>;
 }
 interface FormFailurePayload<TData> {
@@ -23,6 +24,35 @@ interface SerializedFormSubmission<TData> {
     readonly values: Partial<TData> | TData;
     readonly errors: Record<string, readonly string[]>;
 }
+interface FormSecurityOptions {
+    readonly csrf?: boolean;
+    readonly throttle?: string;
+}
+type RequestLikeHeaders = Headers | ReadonlyArray<readonly [string, string]> | Record<string, string | readonly string[] | undefined>;
+interface FormRequestLikeInput {
+    readonly method?: string;
+    readonly path?: string;
+    readonly url?: string | URL;
+    readonly headers?: RequestLikeHeaders;
+    readonly body?: unknown;
+    readonly req?: Request | {
+        readonly method?: string;
+        readonly url?: string;
+        readonly headers?: RequestLikeHeaders;
+        readonly body?: unknown;
+    };
+    readonly node?: {
+        readonly req?: {
+            readonly method?: string;
+            readonly url?: string;
+            readonly headers?: RequestLikeHeaders;
+            readonly body?: unknown;
+        };
+    };
+    readonly web?: {
+        readonly request?: Request;
+    };
+}
 interface FormSubmissionSuccess<TData> {
     readonly valid: true;
     readonly submitted: true;
@@ -53,14 +83,20 @@ declare function schema<TShape extends SchemaInputShape>(shapeOrSchema: TShape |
 declare function isFormSchema(value: unknown): value is FormSchema;
 declare function normalizeStatus(value: number | undefined, fallback: number): number;
 declare function serializeSubmissionState<TData>(valid: boolean, values: Partial<TData> | TData, errors: ValidationErrorBag<TData>): SerializedFormSubmission<TData>;
-declare function createSubmission<TData>(valid: boolean, values: Partial<TData> | TData, errors: ValidationErrorBag<TData>): FormSubmissionResult<TData>;
-declare function createSuccessfulSubmission<TShape extends SchemaInputShape, TSchema extends FormSchema<TShape>>(schemaDefinition: TSchema, data: InferSchemaData<TShape>): FormSubmissionSuccess<InferSchemaData<TShape>>;
-declare function createFailedSubmission<TShape extends SchemaInputShape, TSchema extends FormSchema<TShape>>(schemaDefinition: TSchema, values: Partial<InferSchemaData<TShape>>, flattenedErrors: Record<string, readonly string[]>): FormSubmissionFailure<InferSchemaData<TShape>>;
-declare function validate<TShape extends SchemaInputShape, TSchema extends FormSchema<TShape>>(input: FormLikeValidationInput, schemaDefinition: TSchema): Promise<FormSubmissionResult<InferSchemaData<TShape>>>;
+declare function createSubmission<TData>(valid: boolean, values: Partial<TData> | TData, errors: ValidationErrorBag<TData>, failureStatus?: number): FormSubmissionResult<TData>;
+declare function createSuccessfulSubmission<TShape extends SchemaInputShape>(schemaDefinition: FormSchema<TShape>, data: InferSchemaData<TShape>): FormSubmissionSuccess<InferSchemaData<TShape>>;
+declare function createFailedSubmission<TShape extends SchemaInputShape>(schemaDefinition: FormSchema<TShape>, values: Partial<InferSchemaData<TShape>>, flattenedErrors: Record<string, readonly string[]>, status?: number): FormSubmissionFailure<InferSchemaData<TShape>>;
+declare function isRequestLikeHeaders(value: unknown): value is RequestLikeHeaders;
+declare function normalizeRequestHeaders(input: unknown): Headers;
+declare function normalizeRequestLikeInput(input: FormLikeValidationInput | FormRequestLikeInput | null | undefined): Request | undefined;
+declare function validate<TShape extends SchemaInputShape>(input: FormLikeValidationInput | FormRequestLikeInput, schemaDefinition: FormSchema<TShape>, options?: FormSecurityOptions): Promise<FormSubmissionResult<InferSchemaData<TShape>>>;
 declare const formsInternals: {
     createSubmission: typeof createSubmission;
+    isRequestLikeHeaders: typeof isRequestLikeHeaders;
+    normalizeRequestLikeInput: typeof normalizeRequestLikeInput;
     normalizeStatus: typeof normalizeStatus;
+    normalizeRequestHeaders: typeof normalizeRequestHeaders;
     serializeSubmissionState: typeof serializeSubmissionState;
 };
 
-export { FormContractError, type FormFailurePayload, type FormSchema, type FormSubmissionFailure, type FormSubmissionResult, type FormSubmissionSuccess, type FormSuccessPayload, type SerializedFormSubmission, createFailedSubmission, createSuccessfulSubmission, formsInternals, isFormSchema, schema, validate };
+export { FormContractError, type FormFailurePayload, type FormRequestLikeInput, type FormSchema, type FormSecurityOptions, type FormSubmissionFailure, type FormSubmissionResult, type FormSubmissionSuccess, type FormSuccessPayload, type SerializedFormSubmission, createFailedSubmission, createSuccessfulSubmission, formsInternals, isFormSchema, schema, validate };

package/dist/index.mjs

@@ -6,7 +6,7 @@ import {
   isFormSchema,
   schema,
   validate
-} from "./chunk-Z6TEFT7S.mjs";
+} from "./chunk-663LOLKH.mjs";
 
 // src/index.ts
 import {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holo-js/forms",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Holo-JS Framework - forms-first validation and submission contracts",
   "type": "module",
   "license": "MIT",
@@ -28,7 +28,15 @@
     "test": "vitest --run"
   },
   "dependencies": {
-    "@holo-js/validation": "^0.1.1"
+    "@holo-js/validation": "^0.1.3"
+  },
+  "peerDependencies": {
+    "@holo-js/security": "^0.1.3"
+  },
+  "peerDependenciesMeta": {
+    "@holo-js/security": {
+      "optional": true
+    }
   },
   "devDependencies": {
     "@types/node": "^22.10.2",

package/dist/chunk-Z6TEFT7S.mjs

@@ -1,124 +0,0 @@
-// src/contracts.ts
-import {
-  createErrorBag,
-  defineSchema,
-  isValidationSchema,
-  validate as validateInput
-} from "@holo-js/validation";
-var FormContractError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "FormContractError";
-  }
-};
-function schema(shapeOrSchema) {
-  const base = isValidationSchema(shapeOrSchema) ? shapeOrSchema : defineSchema(shapeOrSchema);
-  return Object.freeze({
-    ...base,
-    mode: "form"
-  });
-}
-function isFormSchema(value) {
-  return isValidationSchema(value) && value.mode === "form";
-}
-function normalizeStatus(value, fallback) {
-  if (typeof value === "undefined") {
-    return fallback;
-  }
-  if (!Number.isInteger(value) || value < 100) {
-    throw new FormContractError("HTTP status codes must be integers greater than or equal to 100.");
-  }
-  return value;
-}
-function serializeSubmissionState(valid, values, errors) {
-  return Object.freeze({
-    valid,
-    submitted: true,
-    values,
-    errors: errors.flatten()
-  });
-}
-function createSubmission(valid, values, errors) {
-  const serialize = () => serializeSubmissionState(valid, values, errors);
-  const failure = () => ({
-    ok: false,
-    status: 422,
-    valid: false,
-    values,
-    errors: errors.flatten()
-  });
-  const success = (payload, status) => ({
-    ok: true,
-    status: normalizeStatus(status, 200),
-    data: payload
-  });
-  if (valid) {
-    const data = values;
-    return Object.freeze({
-      valid: true,
-      submitted: true,
-      data,
-      values: data,
-      errors,
-      serialize,
-      success,
-      fail(status) {
-        const payload = failure();
-        return {
-          ...payload,
-          status: normalizeStatus(status, payload.status)
-        };
-      }
-    });
-  }
-  return Object.freeze({
-    valid: false,
-    submitted: true,
-    data: void 0,
-    values,
-    errors,
-    serialize,
-    success,
-    fail(status) {
-      const payload = failure();
-      return {
-        ...payload,
-        status: normalizeStatus(status, payload.status)
-      };
-    }
-  });
-}
-function createSuccessfulSubmission(schemaDefinition, data) {
-  void schemaDefinition;
-  return createSubmission(true, data, createErrorBag());
-}
-function createFailedSubmission(schemaDefinition, values, flattenedErrors) {
-  void schemaDefinition;
-  return createSubmission(
-    false,
-    values,
-    createErrorBag(flattenedErrors)
-  );
-}
-async function validate(input, schemaDefinition) {
-  const result = await validateInput(input, schemaDefinition);
-  if (result.valid) {
-    return createSuccessfulSubmission(schemaDefinition, result.data);
-  }
-  return createFailedSubmission(schemaDefinition, result.values, result.errors.flatten());
-}
-var formsInternals = {
-  createSubmission,
-  normalizeStatus,
-  serializeSubmissionState
-};
-
-export {
-  FormContractError,
-  schema,
-  isFormSchema,
-  createSuccessfulSubmission,
-  createFailedSubmission,
-  validate,
-  formsInternals
-};