@holo-js/forms 0.1.4 → 0.1.5

package/dist/index.mjs

@@ -1,23 +1,508 @@
 import {
-  FormContractError,
-  createFailedSubmission,
-  createSuccessfulSubmission,
-  formsInternals,
-  isFormSchema,
-  schema,
-  validate
-} from "./chunk-663LOLKH.mjs";
-
-// src/index.ts
-import {
+  DEFAULT_VALIDATION_BAG,
+  ValidationException,
   createErrorBag,
   defineSchema,
   field,
+  isFormSchema,
+  isValidationException,
   parse,
-  safeParse
+  schema
+} from "./chunk-GPWXGHZE.mjs";
+import {
+  normalizeFailureErrors,
+  normalizeFailureInput,
+  normalizeStatus,
+  sanitizeFlashedInput,
+  sensitiveInputInternals
+} from "./chunk-WJOAU4V2.mjs";
+import {
+  FormContractError
+} from "./chunk-OFPH5LBY.mjs";
+
+// src/contracts.ts
+import {
+  ValidationException as ValidationException2,
+  createErrorBag as createErrorBag2,
+  safeParse as safeParseInput,
+  validationInternals
 } from "@holo-js/validation";
+var nextHeadersModuleSpecifier = "next/headers";
+var h3RawBodySymbol = /* @__PURE__ */ Symbol.for("h3RawBody");
+function serializeSubmissionState(valid, values, errors, schemaDefinition) {
+  return Object.freeze({
+    valid,
+    submitted: true,
+    values: sanitizeFlashedInput(values, schemaDefinition),
+    errors: errors.flatten()
+  });
+}
+function createSubmission(valid, values, errors, failureStatus = 422, schemaDefinition, failureMetadata = {}) {
+  const normalizedFailureStatus = normalizeStatus(failureStatus, 422);
+  const serialize = () => serializeSubmissionState(valid, values, errors, schemaDefinition);
+  const failure = (input) => {
+    const normalized = normalizeFailureInput(input, normalizedFailureStatus);
+    return {
+      ok: false,
+      status: normalized.status,
+      valid: false,
+      values: sanitizeFlashedInput(values, schemaDefinition),
+      errors: normalizeFailureErrors(errors.flatten(), normalized.errors),
+      ...normalized.status === 429 ? failureMetadata : {}
+    };
+  };
+  const success = (payload, status) => ({
+    ok: true,
+    status: normalizeStatus(status, 200),
+    data: payload
+  });
+  if (valid) {
+    const data = values;
+    return Object.freeze({
+      valid: true,
+      submitted: true,
+      data,
+      values: data,
+      errors,
+      serialize,
+      success,
+      fail(input) {
+        return failure(input);
+      }
+    });
+  }
+  return Object.freeze({
+    valid: false,
+    submitted: true,
+    data: void 0,
+    values,
+    errors,
+    serialize,
+    success,
+    fail(input) {
+      return failure(input);
+    }
+  });
+}
+function createSuccessfulSubmission(schemaDefinition, data) {
+  void schemaDefinition;
+  return createSubmission(
+    true,
+    data,
+    createErrorBag2(),
+    422,
+    schemaDefinition
+  );
+}
+function createFailedSubmission(schemaDefinition, values, flattenedErrors, status = 422, failureMetadata = {}) {
+  void schemaDefinition;
+  const normalizedStatus = normalizeStatus(status, 422);
+  return createSubmission(
+    false,
+    values,
+    createErrorBag2(flattenedErrors),
+    normalizedStatus,
+    schemaDefinition,
+    failureMetadata
+  );
+}
+function isRequestInput(input) {
+  return typeof Request !== "undefined" && input instanceof Request;
+}
+function isRequestLikeBody(value) {
+  if (typeof value === "string" || value instanceof URLSearchParams) {
+    return true;
+  }
+  if (typeof FormData !== "undefined" && value instanceof FormData) {
+    return true;
+  }
+  if (typeof Blob !== "undefined" && value instanceof Blob) {
+    return true;
+  }
+  if (typeof ArrayBuffer !== "undefined" && value instanceof ArrayBuffer) {
+    return true;
+  }
+  if (ArrayBuffer.isView(value)) {
+    return true;
+  }
+  return !!value && typeof value === "object" && (Symbol.asyncIterator in value || "pipe" in value || "getReader" in value);
+}
+function isFormDataInput(value) {
+  return typeof FormData !== "undefined" && value instanceof FormData;
+}
+function isHeadersTupleArray(value) {
+  return Array.isArray(value) && value.every((entry) => Array.isArray(entry) && entry.length === 2 && typeof entry[0] === "string" && typeof entry[1] === "string");
+}
+function isPlainObject(value) {
+  return !!value && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype;
+}
+function isHeaderAccessorObject(value) {
+  if (!value || typeof value !== "object" || isPlainObject(value)) {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate.get === "function" || typeof candidate.forEach === "function" || typeof candidate.entries === "function";
+}
+function isRequestLikeHeaders(value) {
+  return value instanceof Headers || isHeadersTupleArray(value) || isHeaderAccessorObject(value);
+}
+function normalizeRequestHeaders(input) {
+  if (input instanceof Headers) {
+    return new Headers(input);
+  }
+  const headers = new Headers();
+  if (isHeadersTupleArray(input)) {
+    for (const [name, value] of input) {
+      headers.append(name, value);
+    }
+    return headers;
+  }
+  if (isHeaderAccessorObject(input)) {
+    if (typeof input.forEach === "function") {
+      input.forEach((value, name) => {
+        headers.append(name, value);
+      });
+      return headers;
+    }
+    if (typeof input.entries === "function") {
+      for (const [name, value] of input.entries()) {
+        headers.append(name, value);
+      }
+      return headers;
+    }
+    throw new TypeError("get-only header accessor is not iterable.");
+  }
+  if (input && typeof input === "object") {
+    for (const [name, value] of Object.entries(input)) {
+      if (typeof value === "string") {
+        headers.append(name, value);
+        continue;
+      }
+      if (Array.isArray(value)) {
+        const separator = name.toLowerCase() === "cookie" ? "; " : ",";
+        const joined = value.filter((entry) => typeof entry === "string").join(separator);
+        if (joined) {
+          headers.append(name, joined);
+        }
+      }
+    }
+  }
+  return headers;
+}
+function createFormDataRequestHeaders(requestHeaders) {
+  const formHeaders = new Headers();
+  requestHeaders.forEach((value, name) => {
+    const normalizedName = name.toLowerCase();
+    if (normalizedName !== "content-length" && normalizedName !== "content-type") {
+      formHeaders.append(name, value);
+    }
+  });
+  return formHeaders;
+}
+function resolveAmbientRequestUrl(headers) {
+  const referer = headers.get("referer");
+  if (referer) {
+    try {
+      return new URL(referer).href;
+    } catch {
+    }
+  }
+  const protocol = headers.get("x-forwarded-proto") ?? "http";
+  const host = headers.get("x-forwarded-host") ?? headers.get("host") ?? "localhost";
+  return `${protocol}://${host}/`;
+}
+function isNextHeadersModule(value) {
+  return !!value && typeof value === "object" && typeof value.headers === "function";
+}
+async function importNextHeadersModule() {
+  try {
+    const runtime = globalThis;
+    const module = runtime.__holoFormsNextHeadersImport__ ? await runtime.__holoFormsNextHeadersImport__() : await import(
+      /* @vite-ignore */
+      nextHeadersModuleSpecifier
+    );
+    if (isNextHeadersModule(module)) {
+      return module;
+    }
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function resolveAmbientFormDataRequest(input) {
+  if (!isFormDataInput(input)) {
+    return void 0;
+  }
+  const nextHeadersModule = await importNextHeadersModule();
+  if (!nextHeadersModule) {
+    return void 0;
+  }
+  const requestHeaders = await nextHeadersModule.headers();
+  return new Request(resolveAmbientRequestUrl(requestHeaders), {
+    method: "POST",
+    headers: createFormDataRequestHeaders(requestHeaders),
+    body: input
+  });
+}
+function getStructuredWebRequest(input) {
+  return input.web?.request instanceof Request ? void 0 : input.web?.request;
+}
+function extractRequestLikeUrl(input, headers) {
+  const webRequest = getStructuredWebRequest(input);
+  const url = webRequest?.url ?? (typeof input.url === "string" ? input.url : input.url?.toString()) ?? (typeof input.req === "object" && !(input.req instanceof Request) ? input.req.url : void 0) ?? input.node?.req?.url ?? input.path ?? "/";
+  try {
+    return new URL(url).toString();
+  } catch {
+    const protocol = headers.get("x-forwarded-proto") ?? "http";
+    const host = headers.get("x-forwarded-host") ?? headers.get("host") ?? "localhost";
+    return new URL(url, `${protocol}://${host}`).toString();
+  }
+}
+function extractRequestLikeMethod(input) {
+  const webRequest = getStructuredWebRequest(input);
+  return webRequest?.method ?? input.method ?? (typeof input.req === "object" && !(input.req instanceof Request) ? input.req.method : void 0) ?? input.node?.req?.method ?? "GET";
+}
+function extractRequestLikeBody(input, headers, method) {
+  if (method === "GET" || method === "HEAD") {
+    return void 0;
+  }
+  const webRequest = getStructuredWebRequest(input);
+  const rawBody = webRequest?.body ?? input.body ?? (typeof input.req === "object" && !(input.req instanceof Request) ? input.req.body : void 0) ?? input.node?.req?.body ?? input.node?.req;
+  if (typeof rawBody === "undefined" || rawBody === null) {
+    return void 0;
+  }
+  return normalizeRequestLikeBody(rawBody, headers);
+}
+async function resolveRequestLikeBody(input, headers, method) {
+  if (method === "GET" || method === "HEAD") {
+    return void 0;
+  }
+  const nodeRequest = input.node?.req;
+  const rawBody = nodeRequest?.[h3RawBodySymbol] ?? nodeRequest?.rawBody ?? extractRequestLikeBody(input, headers, method);
+  return normalizeRequestLikeBody(await rawBody, headers);
+}
+function normalizeRequestLikeBody(rawBody, headers) {
+  if (typeof rawBody === "undefined" || rawBody === null) {
+    return void 0;
+  }
+  if (isRequestLikeBody(rawBody)) {
+    return rawBody;
+  }
+  if (typeof rawBody === "object") {
+    if (!headers.has("content-type")) {
+      headers.set("content-type", "application/json");
+    }
+    return JSON.stringify(rawBody);
+  }
+  return String(rawBody);
+}
+function isStructuredRequestLikeObject(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate.method === "string" || typeof candidate.path === "string" || typeof candidate.url === "string" || candidate.url instanceof URL || isRequestLikeHeaders(candidate.headers) || typeof candidate.body !== "undefined";
+}
+function isRequestLikeInput(input) {
+  if (!input || typeof input !== "object") {
+    return false;
+  }
+  const candidate = input;
+  if (candidate.web?.request instanceof Request || candidate.req instanceof Request) {
+    return true;
+  }
+  if (isStructuredRequestLikeObject(candidate.web?.request)) {
+    return true;
+  }
+  if (isStructuredRequestLikeObject(candidate.req)) {
+    return true;
+  }
+  if (isStructuredRequestLikeObject(candidate.node?.req)) {
+    return true;
+  }
+  const hasRequestMetadata = typeof candidate.method === "string" || typeof candidate.path === "string" || typeof candidate.url === "string" || candidate.url instanceof URL;
+  const hasStructuredHeaders = isRequestLikeHeaders(candidate.headers);
+  const hasPlainHeaderRecord = isPlainObject(candidate.headers);
+  const hasBody = typeof candidate.body !== "undefined";
+  return hasRequestMetadata && (hasStructuredHeaders || hasPlainHeaderRecord || hasBody);
+}
+function normalizeRequestLikeInput(input) {
+  if (isRequestInput(input)) {
+    return input;
+  }
+  if (!isRequestLikeInput(input)) {
+    return void 0;
+  }
+  if (input.web?.request instanceof Request) {
+    return input.web.request;
+  }
+  if (input.req instanceof Request) {
+    return input.req;
+  }
+  const headers = normalizeRequestHeaders(
+    getStructuredWebRequest(input)?.headers ?? input.headers ?? (typeof input.req === "object" && !(input.req instanceof Request) ? input.req.headers : void 0) ?? input.node?.req?.headers
+  );
+  const method = extractRequestLikeMethod(input);
+  const body = extractRequestLikeBody(input, headers, method);
+  return createRequestFromParts(input, headers, method, body);
+}
+async function normalizeRequestLikeInputForValidation(input) {
+  if (isRequestInput(input)) {
+    return input;
+  }
+  if (!isRequestLikeInput(input)) {
+    return void 0;
+  }
+  if (input.web?.request instanceof Request) {
+    return input.web.request;
+  }
+  if (input.req instanceof Request) {
+    return input.req;
+  }
+  const headers = normalizeRequestHeaders(
+    getStructuredWebRequest(input)?.headers ?? input.headers ?? (typeof input.req === "object" && !(input.req instanceof Request) ? input.req.headers : void 0) ?? input.node?.req?.headers
+  );
+  const method = extractRequestLikeMethod(input);
+  const body = await resolveRequestLikeBody(input, headers, method);
+  return createRequestFromParts(input, headers, method, body);
+}
+function createRequestFromParts(input, headers, method, body) {
+  return new Request(extractRequestLikeUrl(input, headers), {
+    method,
+    headers,
+    body,
+    // Undici requires duplex when constructing a Request from a stream/async iterable in Node.
+    ...body && typeof body === "object" && (Symbol.asyncIterator in body || "pipe" in body || "getReader" in body) ? { duplex: "half" } : {}
+  });
+}
+function createSecurityFailureMetadata(error) {
+  if (error.status !== 429) {
+    return {};
+  }
+  const candidate = error;
+  const retryAfterSeconds = typeof candidate.retryAfterSeconds === "number" && Number.isFinite(candidate.retryAfterSeconds) ? candidate.retryAfterSeconds : void 0;
+  const retryAt = candidate.snapshot?.expiresAt instanceof Date ? candidate.snapshot.expiresAt.toISOString() : void 0;
+  return {
+    ...typeof retryAfterSeconds === "number" ? { retryAfterSeconds } : {},
+    ...typeof retryAt === "string" ? { retryAt } : {}
+  };
+}
+async function createSecurityFailureSubmission(input, schemaDefinition, error) {
+  let values = {};
+  let flattenedErrors = {};
+  try {
+    const inspection = await safeParseInput(input.clone(), schemaDefinition);
+    if (inspection.valid) {
+      values = inspection.data;
+    } else {
+      values = inspection.values;
+      flattenedErrors = inspection.errors.flatten();
+    }
+  } catch {
+    values = {};
+    flattenedErrors = {};
+  }
+  return createFailedSubmission(
+    schemaDefinition,
+    values,
+    {
+      ...flattenedErrors,
+      _root: [
+        ...flattenedErrors._root ?? [],
+        error.message
+      ]
+    },
+    error.status,
+    createSecurityFailureMetadata(error)
+  );
+}
+async function safeParse(input, schemaDefinition, options = {}) {
+  let validatedSubmission;
+  const throttle = typeof options.throttle === "string" ? options.throttle : void 0;
+  const usesSecurityOptions = typeof throttle === "string";
+  const normalizedRequestInput = await normalizeRequestLikeInputForValidation(input) ?? (usesSecurityOptions ? await resolveAmbientFormDataRequest(input) : void 0);
+  const validationInput = normalizedRequestInput ?? input;
+  if (usesSecurityOptions && !normalizedRequestInput) {
+    throw new FormContractError(
+      "Security-aware safeParse() options require a Request or request-like event input."
+    );
+  }
+  if (usesSecurityOptions) {
+    const request = normalizedRequestInput;
+    try {
+      const { loadSecurityModule } = await import("./security-ODATEIFI.mjs");
+      const security = await loadSecurityModule();
+      const inspection = await safeParseInput(request.clone(), schemaDefinition);
+      const throttleValues = inspection.valid ? inspection.data : inspection.values;
+      validatedSubmission = inspection.valid ? createSuccessfulSubmission(schemaDefinition, inspection.data) : createFailedSubmission(schemaDefinition, inspection.values, inspection.errors.flatten());
+      await security.rateLimit(throttle, {
+        request,
+        values: throttleValues
+      });
+    } catch (error) {
+      const { formsSecurityInternals } = await import("./security-ODATEIFI.mjs");
+      if (formsSecurityInternals.isRootSecurityError(error)) {
+        if (validatedSubmission) {
+          return createFailedSubmission(
+            schemaDefinition,
+            validatedSubmission.valid ? validatedSubmission.data : validatedSubmission.values,
+            {
+              ...validatedSubmission.valid ? {} : validatedSubmission.errors.flatten(),
+              _root: [
+                ...!validatedSubmission.valid ? validatedSubmission.errors.flatten()._root ?? [] : [],
+                error.message
+              ]
+            },
+            error.status,
+            createSecurityFailureMetadata(error)
+          );
+        }
+        return await createSecurityFailureSubmission(request, schemaDefinition, error);
+      }
+      throw error;
+    }
+  }
+  if (validatedSubmission) {
+    return validatedSubmission;
+  }
+  const result = await safeParseInput(validationInput, schemaDefinition);
+  if (result.valid) {
+    return createSuccessfulSubmission(schemaDefinition, result.data);
+  }
+  return createFailedSubmission(schemaDefinition, result.values, result.errors.flatten());
+}
+async function validate(input, schemaDefinition, options = {}) {
+  const result = await safeParse(input, schemaDefinition, options);
+  if (result.valid) {
+    return result.data;
+  }
+  const failure = result.fail();
+  const exception = validationInternals.setValidationExceptionValues(
+    ValidationException2.withMessages(result.errors.flatten(), {
+      bag: options.bag
+    }),
+    result.values
+  );
+  validationInternals.setValidationExceptionStatus(exception, failure.status);
+  validationInternals.setValidationExceptionMetadata(exception, {
+    ...typeof failure.retryAfterSeconds === "number" ? { retryAfterSeconds: failure.retryAfterSeconds } : {},
+    ...typeof failure.retryAt === "string" ? { retryAt: failure.retryAt } : {}
+  });
+  return validationInternals.throwValidationException(exception);
+}
+var formsInternals = {
+  createSubmission,
+  isRequestLikeHeaders,
+  normalizeRequestLikeInput,
+  normalizeStatus,
+  normalizeRequestHeaders,
+  sanitizeFlashedInput,
+  serializeSubmissionState
+};
 export {
+  DEFAULT_VALIDATION_BAG,
   FormContractError,
+  ValidationException,
   createErrorBag,
   createFailedSubmission,
   createSuccessfulSubmission,
@@ -25,8 +510,11 @@ export {
   field,
   formsInternals,
   isFormSchema,
+  isValidationException,
   parse,
   safeParse,
+  sanitizeFlashedInput,
   schema,
+  sensitiveInputInternals,
   validate
 };

package/dist/internal/client.d.ts

@@ -0,0 +1,68 @@
+import { g as FormSubmissionResult, S as SerializedFormSubmission, c as FormFailurePayload, i as FormSuccessPayload } from '../contracts-D1dERmQn.js';
+import { WebFileLike, SchemaInputShape, FieldBuilderInput, InferFieldOutput, ValidationErrorBag } from '@holo-js/validation';
+import { FormSchema, InferFormData } from '../schema.js';
+
+type PrimitiveLike = string | number | boolean | bigint | symbol | null | undefined | Date | Blob | WebFileLike;
+type ValidateOnMode = 'submit' | 'blur' | 'change';
+interface ClientSubmitContext<TData> {
+    readonly action?: string;
+    readonly method: string;
+    readonly values: TData;
+    readonly formData: FormData;
+}
+type ClientSubmitResult<TData, TSuccess = unknown> = FormSubmissionResult<TData> | SerializedFormSubmission<TData> | FormFailurePayload<TData> | FormSuccessPayload<TSuccess> | {
+    readonly ok: boolean;
+    readonly status: number;
+    readonly data: TSuccess;
+};
+type BrowserFormElement = {
+    readonly action?: string;
+    readonly method?: string;
+};
+interface UseFormOptions<TData, TSuccess = unknown> {
+    readonly action?: string;
+    readonly method?: string;
+    readonly validateOn?: ValidateOnMode;
+    readonly initialValues?: Partial<TData>;
+    readonly initialState?: SerializedFormSubmission<TData> | FormFailurePayload<TData> | null;
+    readonly submitter?: (context: ClientSubmitContext<TData>) => Promise<ClientSubmitResult<TData, TSuccess> | void> | ClientSubmitResult<TData, TSuccess> | void;
+}
+interface FormFieldState<TValue> {
+    value: TValue;
+    readonly errors: readonly string[];
+    readonly touched: boolean;
+    readonly dirty: boolean;
+    set(value: TValue): Promise<void>;
+    onInput(value: TValue): Promise<void>;
+    onBlur(): Promise<void>;
+    validate(): Promise<readonly string[]>;
+}
+type FormFieldTree<TData> = [TData] extends [readonly unknown[]] ? FormFieldState<TData> : [TData] extends [PrimitiveLike] ? FormFieldState<TData> : [TData] extends [Record<string, unknown>] ? {
+    readonly [K in keyof TData]: FormFieldTree<TData[K]>;
+} : FormFieldState<TData>;
+type FormFieldTreeFromShape<TShape extends SchemaInputShape> = {
+    readonly [K in Extract<keyof TShape, string>]: TShape[K] extends FieldBuilderInput ? FormFieldState<InferFieldOutput<TShape[K]>> : TShape[K] extends SchemaInputShape ? FormFieldTreeFromShape<TShape[K]> : never;
+};
+type InferFormFieldTree<TSchema extends FormSchema> = TSchema extends FormSchema<infer TShape> ? FormFieldTreeFromShape<TShape> : never;
+interface UseFormResult<TData, TSuccess = unknown, TFields = FormFieldTree<TData>> {
+    readonly fields: TFields;
+    readonly values: TData;
+    readonly errors: ValidationErrorBag<TData>;
+    readonly submitting: boolean;
+    readonly valid: boolean;
+    readonly lastSubmission?: SerializedFormSubmission<TData> | FormFailurePayload<TData> | FormSuccessPayload<TSuccess>;
+    subscribe(listener: () => void): () => void;
+    validate(): Promise<FormSubmissionResult<TData>>;
+    validateField(path: string): Promise<readonly string[]>;
+    submit(): Promise<ClientSubmitResult<TData, TSuccess>>;
+    reset(values?: Partial<TData>): void;
+    setValue(path: string, value: unknown): Promise<void>;
+    applyServerState(result: ClientSubmitResult<TData, TSuccess>): ClientSubmitResult<TData, TSuccess>;
+}
+declare function runWithBrowserFormElement<TData, TSuccess>(formClient: Pick<UseFormResult<TData, TSuccess>, 'submit'>, form: BrowserFormElement): Promise<ClientSubmitResult<TData, TSuccess>>;
+/**
+ * @internal Shared headless form runtime for framework adapters.
+ */
+declare function createFormClient<TSchema extends FormSchema, TSuccess = unknown>(schemaDefinition: TSchema, options?: UseFormOptions<InferFormData<TSchema>, TSuccess>): UseFormResult<InferFormData<TSchema>, TSuccess, InferFormFieldTree<TSchema>>;
+
+export { type ClientSubmitContext, type ClientSubmitResult, type FormFieldState, type FormFieldTree, type InferFormFieldTree, type UseFormOptions, type UseFormResult, type ValidateOnMode, createFormClient, runWithBrowserFormElement };