@holo-js/forms 0.3.28 → 0.4.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Holo-JS contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/.holo-build-fingerprint

@@ -0,0 +1 @@
+666f4015b9d1339491c25a709f28c6da08e4247a73c32767f75cd35519173814

package/dist/chunk-TFYWXPME.mjs

@@ -0,0 +1,54 @@
+import {
+  FormContractError
+} from "./chunk-OFPH5LBY.mjs";
+
+// src/failure.ts
+function normalizeStatus(value, fallback) {
+  if (typeof value === "undefined") {
+    return fallback;
+  }
+  if (!Number.isInteger(value) || value < 100) {
+    throw new FormContractError("HTTP status codes must be integers greater than or equal to 100.");
+  }
+  return value;
+}
+function normalizeFailureInput(input, fallbackStatus) {
+  if (typeof input === "number") {
+    return {
+      status: normalizeStatus(input, fallbackStatus)
+    };
+  }
+  return {
+    status: normalizeStatus(input?.status, fallbackStatus),
+    errors: input?.errors
+  };
+}
+function normalizeFailureErrors(fallback, override) {
+  if (!override) {
+    return fallback;
+  }
+  const normalized = { ...fallback };
+  for (const [field, messages] of Object.entries(override)) {
+    if (typeof messages !== "undefined") {
+      normalized[field] = messages;
+    }
+  }
+  return normalized;
+}
+
+// src/sensitiveInput.ts
+import { validationInternals } from "@holo-js/validation";
+function sanitizeFlashedInput(values, schemaDefinition) {
+  return validationInternals.stripSensitiveInput(values, schemaDefinition?.fields, { files: true });
+}
+function clearSensitiveInputValues(values, schemaDefinition) {
+  return validationInternals.clearSensitiveInput(values, schemaDefinition?.fields, { files: true });
+}
+
+export {
+  normalizeStatus,
+  normalizeFailureInput,
+  normalizeFailureErrors,
+  sanitizeFlashedInput,
+  clearSensitiveInputValues
+};

package/dist/{contracts-DzAvmYd0.d.ts → contracts-CN5pB9Tx.d.ts}

@@ -10,12 +10,7 @@ type FormFailureInput = number | FormFailureOptions | undefined;
 declare function normalizeStatus(value: number | undefined, fallback: number): number;
 
 type SensitiveSchema = Pick<ValidationSchema<SchemaInputShape>, 'fields'>;
-declare function collectSensitivePaths(schemaDefinition: SensitiveSchema | undefined): readonly string[];
 declare function sanitizeFlashedInput<TData>(values: Partial<TData> | TData, schemaDefinition?: SensitiveSchema): Partial<TData> | TData;
-declare const sensitiveInputInternals: {
-    collectSensitivePaths: typeof collectSensitivePaths;
-    DEFAULT_DONT_FLASH_FIELDS: readonly string[];
-};
 
 type InferFormData<TSchema extends ValidationSchema> = InferValidationSchemaData<TSchema>;
 interface FormFailurePayload<TData> {
@@ -126,4 +121,5 @@ declare const formsInternals: {
     serializeSubmissionState: typeof serializeSubmissionState;
 };
 
-export { type FormFailureErrors as F, type InferFormData as I, type SerializedFormSubmission as S, type FormFailureInput as a, type FormFailureOptions as b, type FormFailurePayload as c, type FormRequestLikeInput as d, type FormSecurityOptions as e, type FormSubmissionFailure as f, type FormSubmissionResult as g, type FormSubmissionSuccess as h, type FormSuccessPayload as i, createFailedSubmission as j, createSuccessfulSubmission as k, formsInternals as l, sanitizeFlashedInput as m, sensitiveInputInternals as n, safeParse as s, validate as v };
+export { createFailedSubmission as j, createSuccessfulSubmission as k, formsInternals as l, sanitizeFlashedInput as m, safeParse as s, validate as v };
+export type { FormFailureErrors as F, InferFormData as I, SerializedFormSubmission as S, FormFailureInput as a, FormFailureOptions as b, FormFailurePayload as c, FormRequestLikeInput as d, FormSecurityOptions as e, FormSubmissionFailure as f, FormSubmissionResult as g, FormSubmissionSuccess as h, FormSuccessPayload as i };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { F as FormFailureErrors, a as FormFailureInput, b as FormFailureOptions, c as FormFailurePayload, d as FormRequestLikeInput, e as FormSecurityOptions, f as FormSubmissionFailure, g as FormSubmissionResult, h as FormSubmissionSuccess, i as FormSuccessPayload, I as InferFormData, S as SerializedFormSubmission, j as createFailedSubmission, k as createSuccessfulSubmission, l as formsInternals, s as safeParse, m as sanitizeFlashedInput, n as sensitiveInputInternals, v as validate } from './contracts-DzAvmYd0.js';
+export { F as FormFailureErrors, a as FormFailureInput, b as FormFailureOptions, c as FormFailurePayload, d as FormRequestLikeInput, e as FormSecurityOptions, f as FormSubmissionFailure, g as FormSubmissionResult, h as FormSubmissionSuccess, i as FormSuccessPayload, I as InferFormData, S as SerializedFormSubmission, j as createFailedSubmission, k as createSuccessfulSubmission, l as formsInternals, s as safeParse, m as sanitizeFlashedInput, v as validate } from './contracts-CN5pB9Tx.js';
 import '@holo-js/kernel';
 import '@holo-js/validation';
 

package/dist/index.mjs

@@ -2,15 +2,14 @@ import {
   normalizeFailureErrors,
   normalizeFailureInput,
   normalizeStatus,
-  sanitizeFlashedInput,
-  sensitiveInputInternals
-} from "./chunk-WJOAU4V2.mjs";
+  sanitizeFlashedInput
+} from "./chunk-TFYWXPME.mjs";
 import {
   FormContractError
 } from "./chunk-OFPH5LBY.mjs";
 
 // src/contracts.ts
-import { resolveRequestUrl } from "@holo-js/kernel";
+import { HoloRequestBodyTooLargeError, readBoundedRequestBody, requestUrlInternals } from "@holo-js/kernel";
 import {
   ValidationException,
   createErrorBag,
@@ -216,7 +215,7 @@ async function resolveAmbientFormDataRequest(input) {
     return void 0;
   }
   const requestHeaders = await nextHeadersModule.headers();
-  return new Request(resolveRequestUrl({ headers: requestHeaders }), {
+  return new Request(requestUrlInternals.resolveRoutedRequestUrl({ headers: requestHeaders }), {
     method: "POST",
     headers: createFormDataRequestHeaders(requestHeaders),
     body: input
@@ -226,7 +225,7 @@ function getStructuredWebRequest(input) {
   return input.web?.request instanceof Request ? void 0 : input.web?.request;
 }
 function extractRequestLikeUrl(input, headers) {
-  return resolveRequestUrl({ ...input, headers }).href;
+  return requestUrlInternals.resolveRoutedRequestUrl({ ...input, headers }).href;
 }
 function extractRequestLikeMethod(input) {
   const webRequest = getStructuredWebRequest(input);
@@ -357,37 +356,33 @@ function createSecurityFailureMetadata(error) {
     ...typeof retryAt === "string" ? { retryAt } : {}
   };
 }
-async function createSecurityFailureSubmission(input, schemaDefinition, error) {
-  let values = {};
-  let flattenedErrors = {};
-  try {
-    const inspection = await safeParseInput(input.clone(), schemaDefinition);
-    if (inspection.valid) {
-      values = inspection.data;
-    } else {
-      values = inspection.values;
-      flattenedErrors = inspection.errors.flatten();
-    }
-  } catch {
-    values = {};
-    flattenedErrors = {};
-  }
-  return createFailedSubmission(
-    schemaDefinition,
-    values,
-    {
-      ...flattenedErrors,
-      _root: [
-        ...flattenedErrors._root ?? [],
-        error.message
-      ]
-    },
-    error.status,
-    createSecurityFailureMetadata(error)
-  );
+function captureBodyTooLarge(error) {
+  if (error instanceof HoloRequestBodyTooLargeError) return error;
+  throw error;
+}
+function submittedRequestInit(request, body) {
+  return {
+    method: request.method,
+    headers: new Headers(request.headers),
+    body,
+    duplex: "half",
+    signal: request.signal,
+    credentials: request.credentials,
+    redirect: request.redirect,
+    referrer: request.referrer,
+    referrerPolicy: request.referrerPolicy,
+    integrity: request.integrity,
+    keepalive: request.keepalive,
+    cache: request.cache === "only-if-cached" ? void 0 : request.cache,
+    mode: request.mode === "navigate" ? void 0 : request.mode
+  };
+}
+async function bufferSubmittedRequest(request) {
+  if (request.method === "GET" || request.method === "HEAD") return request;
+  const body = await readBoundedRequestBody(request.clone());
+  return new Request(request.url, submittedRequestInit(request, body));
 }
 async function safeParse(input, schemaDefinition, options = {}) {
-  let validatedSubmission;
   const throttle = typeof options.throttle === "string" ? options.throttle : void 0;
   const usesSecurityOptions = typeof throttle === "string";
   const normalizedRequestInput = await normalizeRequestLikeInputForValidation(input) ?? (usesSecurityOptions ? await resolveAmbientFormDataRequest(input) : void 0);
@@ -397,45 +392,49 @@ async function safeParse(input, schemaDefinition, options = {}) {
       "Security-aware safeParse() options require a Request or request-like event input."
     );
   }
+  const submitted = usesSecurityOptions ? await bufferSubmittedRequest(normalizedRequestInput).catch(captureBodyTooLarge) : validationInput;
+  if (submitted instanceof HoloRequestBodyTooLargeError) {
+    return createFailedSubmission(schemaDefinition, {}, {
+      _root: [submitted.message]
+    }, submitted.status);
+  }
+  const parsedInput = usesSecurityOptions ? submitted.clone() : submitted;
+  const result = await safeParseInput(parsedInput, schemaDefinition).catch(captureBodyTooLarge);
+  if (result instanceof HoloRequestBodyTooLargeError) {
+    return createFailedSubmission(schemaDefinition, {}, {
+      _root: [result.message]
+    }, result.status);
+  }
   if (usesSecurityOptions) {
-    const request = normalizedRequestInput;
+    const request = submitted;
     try {
       const { loadSecurityModule } = await import("./security-YE5UGG47.mjs");
       const security = await loadSecurityModule();
-      const inspection = await safeParseInput(request.clone(), schemaDefinition);
-      const throttleValues = inspection.valid ? inspection.data : inspection.values;
-      validatedSubmission = inspection.valid ? createSuccessfulSubmission(schemaDefinition, inspection.data) : createFailedSubmission(schemaDefinition, inspection.values, inspection.errors.flatten());
       await security.rateLimit(throttle, {
         request,
-        values: throttleValues
+        values: result.valid ? result.data : void 0
       });
     } catch (error) {
       const { formsSecurityInternals } = await import("./security-YE5UGG47.mjs");
       if (formsSecurityInternals.isRootSecurityError(error)) {
-        if (validatedSubmission) {
-          return createFailedSubmission(
-            schemaDefinition,
-            validatedSubmission.valid ? validatedSubmission.data : validatedSubmission.values,
-            {
-              ...validatedSubmission.valid ? {} : validatedSubmission.errors.flatten(),
-              _root: [
-                ...!validatedSubmission.valid ? validatedSubmission.errors.flatten()._root ?? [] : [],
-                error.message
-              ]
-            },
-            error.status,
-            createSecurityFailureMetadata(error)
-          );
-        }
-        return await createSecurityFailureSubmission(request, schemaDefinition, error);
+        const fieldErrors = result.valid ? {} : result.errors.flatten();
+        return createFailedSubmission(
+          schemaDefinition,
+          result.valid ? result.data : result.values,
+          {
+            ...fieldErrors,
+            _root: [
+              ...fieldErrors._root ?? [],
+              error.message
+            ]
+          },
+          error.status,
+          createSecurityFailureMetadata(error)
+        );
       }
       throw error;
     }
   }
-  if (validatedSubmission) {
-    return validatedSubmission;
-  }
-  const result = await safeParseInput(validationInput, schemaDefinition);
   if (result.valid) {
     return createSuccessfulSubmission(schemaDefinition, result.data);
   }
@@ -451,7 +450,8 @@ async function validate(input, schemaDefinition, options = {}) {
     ValidationException.withMessages(result.errors.flatten(), {
       bag: options.bag
     }),
-    result.values
+    result.values,
+    schemaDefinition
   );
   validationInternals.setValidationExceptionStatus(exception, failure.status);
   validationInternals.setValidationExceptionMetadata(exception, {
@@ -477,6 +477,5 @@ export {
   formsInternals,
   safeParse,
   sanitizeFlashedInput,
-  sensitiveInputInternals,
   validate
 };

package/dist/internal/client.d.ts

@@ -1,4 +1,5 @@
-import { S as SerializedFormSubmission, c as FormFailurePayload, i as FormSuccessPayload, g as FormSubmissionResult, I as InferFormData } from '../contracts-DzAvmYd0.js';
+import { SerializedFormSubmission, FormFailurePayload, FormSuccessPayload, FormSubmissionResult, InferFormData } from '../index.js';
+export { m as sanitizeFlashedInput } from '../contracts-CN5pB9Tx.js';
 import { ValidationErrorBag, WebFileLike, ValidationSchema, SchemaInputShape, FieldBuilderInput, InferFieldOutput } from '@holo-js/validation';
 import '@holo-js/kernel';
 
@@ -102,4 +103,5 @@ declare function runWithBrowserFormElement<TData, TSuccess>(formClient: Pick<Use
  */
 declare function createFormClient<TSchema extends ValidationSchema, TSuccess = unknown>(schemaDefinition: TSchema, options?: UseFormOptions<InferFormData<TSchema>, TSuccess>): UseFormResult<InferFormData<TSchema>, TSuccess, InferFormFieldTree<TSchema>>;
 
-export { type ClientCsrfOptions, type ClientSubmitContext, type ClientSubmitResult, FormClientState, type FormFieldState, type FormFieldTree, type FormRequestCredentials, type InferFormFieldTree, type UseFormOptions, type UseFormResult, type ValidateOnMode, collectFormDirtyPaths, createFormClient, markClientSubmitControlFlowError, runWithBrowserFormElement };
+export { FormClientState, collectFormDirtyPaths, createFormClient, markClientSubmitControlFlowError, runWithBrowserFormElement };
+export type { ClientCsrfOptions, ClientSubmitContext, ClientSubmitResult, FormFieldState, FormFieldTree, FormRequestCredentials, InferFormFieldTree, UseFormOptions, UseFormResult, ValidateOnMode };

package/dist/internal/client.mjs

@@ -4,7 +4,7 @@ import {
   normalizeFailureInput,
   normalizeStatus,
   sanitizeFlashedInput
-} from "../chunk-WJOAU4V2.mjs";
+} from "../chunk-TFYWXPME.mjs";
 import {
   createMissingSecurityPackageError,
   isMissingOptionalPackageError,
@@ -32,20 +32,29 @@ async function loadSecurityClientModule() {
   });
   return await securityClientModulePromise;
 }
-async function getClientCsrfField() {
-  const runtime = globalThis;
-  if (!runtime.document || typeof runtime.document.cookie !== "string") {
-    return void 0;
-  }
-  let security;
+async function loadInstalledSecurityClientModule() {
   try {
-    security = await loadSecurityClientModule();
+    return await loadSecurityClientModule();
   } catch (error) {
     if (error instanceof FormContractError) {
       return void 0;
     }
     throw error;
   }
+}
+async function getClientCsrfConfig() {
+  const config = (await loadInstalledSecurityClientModule())?.getSecurityClientConfig().csrf;
+  return { field: config?.field ?? "_token", header: config?.header ?? "X-CSRF-TOKEN" };
+}
+async function getClientCsrfField() {
+  const runtime = globalThis;
+  if (!runtime.document || typeof runtime.document.cookie !== "string") {
+    return void 0;
+  }
+  const security = await loadInstalledSecurityClientModule();
+  if (!security) {
+    return void 0;
+  }
   const config = security.getSecurityClientConfig().csrf;
   const value = parseCookieHeader(runtime.document.cookie)[config.cookie];
   if (!value) {
@@ -58,10 +67,7 @@ async function getClientCsrfField() {
 }
 
 // src/internal/validation-exception.ts
-import {
-  isValidationException
-} from "@holo-js/validation";
-import { parseValidationExceptionDigest } from "@holo-js/validation/internal/compiled";
+import { serializeValidationException } from "@holo-js/validation";
 function isPlainObject(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
@@ -91,20 +97,7 @@ function formFailurePayloadFromError(error) {
   return candidates.find((candidate) => isFormFailurePayload(candidate));
 }
 function validationExceptionToFailure(error, fallbackValues = {}) {
-  const payload = isValidationException(error) ? error.toJSON() : parseValidationExceptionDigest(error);
-  if (payload) {
-    return {
-      ok: false,
-      status: payload.status,
-      submitted: true,
-      valid: false,
-      values: payload.values && Object.keys(payload.values).length > 0 ? payload.values : fallbackValues,
-      errors: payload.errors,
-      ...typeof payload.retryAfterSeconds === "number" ? { retryAfterSeconds: payload.retryAfterSeconds } : {},
-      ...typeof payload.retryAt === "string" ? { retryAt: payload.retryAt } : {}
-    };
-  }
-  const formFailurePayload = formFailurePayloadFromError(error);
+  const formFailurePayload = formFailurePayloadFromError(serializeValidationException(error) ?? error);
   if (formFailurePayload) {
     return {
       ok: false,
@@ -184,8 +177,10 @@ function getFormValueAtPath(root, path) {
   }
   return cursor;
 }
+var UNSAFE_FORM_PATH_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function setFormValueAtPath(root, path, value) {
   const parts = splitFormPath(path);
+  if (parts.some((part) => UNSAFE_FORM_PATH_SEGMENTS.has(part))) return;
   let cursor = root;
   for (const [index, part] of parts.entries()) {
     const last = index === parts.length - 1;
@@ -702,7 +697,16 @@ async function defaultSubmitter(context, options) {
     if (!csrfPayload || typeof csrfPayload !== "object" || !("token" in csrfPayload) || typeof csrfPayload.token !== "string" || !csrfPayload.token) {
       return createTransportFailure(context.values);
     }
-    headers.set("X-CSRF-TOKEN", csrfPayload.token);
+    if ("field" in csrfPayload && typeof csrfPayload.field === "string" && csrfPayload.field) {
+      context.formData.set(csrfPayload.field, csrfPayload.token);
+    } else {
+      const config = await getClientCsrfConfig();
+      if (config.header.toLowerCase() === "x-xsrf-token") {
+        context.formData.set(config.field, csrfPayload.token);
+      } else {
+        headers.set(config.header, csrfPayload.token);
+      }
+    }
   }
   const response = await fetch(context.action, {
     method,
@@ -758,16 +762,14 @@ function createFormClient(schemaDefinition, options = {}) {
         values: sanitizeFlashedInput(normalized.values, schemaDefinition)
       };
       if (applies) {
-        const values = mergeFormValues(state.values, sanitized.values);
-        clearSensitiveInputValues(values, schemaDefinition);
+        const values = clearSensitiveInputValues(mergeFormValues(state.values, sanitized.values), schemaDefinition);
         state.applyServer(values, sanitized.errors, sanitized);
       }
       return sanitized;
     }
     const normalizedSubmission = normalized;
     if (applies) {
-      const values = mergeFormValues(state.values, normalizedSubmission.values);
-      clearSensitiveInputValues(values, schemaDefinition);
+      const values = clearSensitiveInputValues(mergeFormValues(state.values, normalizedSubmission.values), schemaDefinition);
       state.applyServer(values, normalizedSubmission.errors.flatten(), normalizedSubmission.valid ? void 0 : normalizedSubmission.fail());
     }
     return normalizedSubmission;
@@ -793,9 +795,9 @@ function createFormClient(schemaDefinition, options = {}) {
       if (!localSubmission.valid) {
         return localSubmission;
       }
-      if (!isSafeMethod(method)) {
+      if (!isSafeMethod(method) && !(options.csrf && !options.submitter)) {
         const csrfField = await getClientCsrfField();
-        if (csrfField) {
+        if (csrfField && !formData.has(csrfField.name)) {
           formData.set(csrfField.name, csrfField.value);
         }
       }
@@ -883,5 +885,6 @@ export {
   collectFormDirtyPaths,
   createFormClient,
   markClientSubmitControlFlowError,
-  runWithBrowserFormElement
+  runWithBrowserFormElement,
+  sanitizeFlashedInput
 };

package/package.json

@@ -1,9 +1,14 @@
 {
   "name": "@holo-js/forms",
-  "version": "0.3.28",
+  "version": "0.4.1",
   "description": "Holo-JS Framework - forms-first validation and submission contracts",
   "type": "module",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cobraprojects/holo-js.git",
+    "directory": "packages/forms"
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -19,7 +24,8 @@
   "main": "./dist/index.mjs",
   "types": "./dist/index.d.ts",
   "files": [
-    "dist"
+    "dist",
+    "LICENSE"
   ],
   "scripts": {
     "build": "tsup",
@@ -28,11 +34,11 @@
     "test": "vitest --run && node --test --test-concurrency=3 ../../tests/forms-native-browser.mjs ../../tests/forms-native-packages.mjs"
   },
   "dependencies": {
-    "@holo-js/kernel": "^0.3.28",
-    "@holo-js/validation": "^0.3.28"
+    "@holo-js/kernel": "^0.4.1",
+    "@holo-js/validation": "^0.4.1"
   },
   "peerDependencies": {
-    "@holo-js/security": "^0.3.28"
+    "@holo-js/security": "^0.4.1"
   },
   "peerDependenciesMeta": {
     "@holo-js/security": {
@@ -40,12 +46,12 @@
     }
   },
   "devDependencies": {
-    "@types/node": "^22.10.2",
-    "tsup": "^8.3.5",
-    "typescript": "^5.7.2",
-    "vitest": "^4.1.5"
+    "@types/node": "^22.20.5",
+    "tsup": "^9.0.0",
+    "typescript": "^6.0.3",
+    "vitest": "^5.0.5"
   },
   "engines": {
-    "node": "^22.12.0 || ^24.0.0 || ^26.0.0"
+    "node": "^22.18.0 || ^24.0.0 || ^26.0.0"
   }
 }

package/dist/chunk-WJOAU4V2.mjs

@@ -1,162 +0,0 @@
-import {
-  FormContractError
-} from "./chunk-OFPH5LBY.mjs";
-
-// src/failure.ts
-function normalizeStatus(value, fallback) {
-  if (typeof value === "undefined") {
-    return fallback;
-  }
-  if (!Number.isInteger(value) || value < 100) {
-    throw new FormContractError("HTTP status codes must be integers greater than or equal to 100.");
-  }
-  return value;
-}
-function normalizeFailureInput(input, fallbackStatus) {
-  if (typeof input === "number") {
-    return {
-      status: normalizeStatus(input, fallbackStatus)
-    };
-  }
-  return {
-    status: normalizeStatus(input?.status, fallbackStatus),
-    errors: input?.errors
-  };
-}
-function normalizeFailureErrors(fallback, override) {
-  if (!override) {
-    return fallback;
-  }
-  const normalized = { ...fallback };
-  for (const [field, messages] of Object.entries(override)) {
-    if (typeof messages !== "undefined") {
-      normalized[field] = messages;
-    }
-  }
-  return normalized;
-}
-
-// src/sensitiveInput.ts
-var DEFAULT_DONT_FLASH_FIELDS = Object.freeze([
-  "confirm_password",
-  "confirmPassword",
-  "current_password",
-  "currentPassword",
-  "new_password",
-  "newPassword",
-  "password",
-  "password_confirmation",
-  "passwordConfirmation"
-]);
-var DEFAULT_DONT_FLASH_FIELD_SET = new Set(DEFAULT_DONT_FLASH_FIELDS);
-function isPlainObject(value) {
-  return !!value && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date) && !(value instanceof Blob);
-}
-function isFieldDefinition(value) {
-  return isPlainObject(value) && typeof value.kind === "string" && Array.isArray(value.rules);
-}
-function isSchemaField(value) {
-  return isPlainObject(value) && value.kind === "field" && isFieldDefinition(value.definition);
-}
-function collectSensitivePathsFromFields(fields, prefix = "", output = []) {
-  for (const [key, value] of Object.entries(fields)) {
-    const path = prefix ? `${prefix}.${key}` : key;
-    if (DEFAULT_DONT_FLASH_FIELD_SET.has(key)) {
-      output.push(path);
-    }
-    if (isSchemaField(value)) {
-      if (value.definition.sensitive === true || value.definition.kind === "file") {
-        output.push(path);
-      }
-      continue;
-    }
-    if (isPlainObject(value)) {
-      collectSensitivePathsFromFields(value, path, output);
-    }
-  }
-  return output;
-}
-function collectSensitivePaths(schemaDefinition) {
-  if (!schemaDefinition) {
-    return [];
-  }
-  return collectSensitivePathsFromFields(schemaDefinition.fields);
-}
-function deletePath(root, path) {
-  const parts = path.split(".").filter(Boolean);
-  const leaf = parts.at(-1);
-  if (!leaf) {
-    return;
-  }
-  let cursor = root;
-  for (const part of parts.slice(0, -1)) {
-    if (!isPlainObject(cursor)) {
-      return;
-    }
-    cursor = cursor[part];
-  }
-  if (isPlainObject(cursor)) {
-    delete cursor[leaf];
-  }
-}
-function clearPath(root, path) {
-  const parts = path.split(".").filter(Boolean);
-  const leaf = parts.at(-1);
-  if (!leaf) {
-    return;
-  }
-  let cursor = root;
-  for (const part of parts.slice(0, -1)) {
-    if (!isPlainObject(cursor)) {
-      return;
-    }
-    cursor = cursor[part];
-  }
-  if (isPlainObject(cursor) && leaf in cursor) {
-    cursor[leaf] = "";
-  }
-}
-function sanitizePlainObject(values, sensitivePaths) {
-  if (!isPlainObject(values)) {
-    return values;
-  }
-  const output = structuredClone(values);
-  for (const field of DEFAULT_DONT_FLASH_FIELD_SET) {
-    delete output[field];
-  }
-  for (const path of sensitivePaths) {
-    deletePath(output, path);
-  }
-  return output;
-}
-function sanitizeFlashedInput(values, schemaDefinition) {
-  return sanitizePlainObject(values, collectSensitivePaths(schemaDefinition));
-}
-function clearSensitiveInputValues(values, schemaDefinition) {
-  if (!isPlainObject(values)) {
-    return values;
-  }
-  const mutableValues = values;
-  for (const field of DEFAULT_DONT_FLASH_FIELD_SET) {
-    if (field in mutableValues) {
-      mutableValues[field] = "";
-    }
-  }
-  for (const path of collectSensitivePaths(schemaDefinition)) {
-    clearPath(mutableValues, path);
-  }
-  return values;
-}
-var sensitiveInputInternals = {
-  collectSensitivePaths,
-  DEFAULT_DONT_FLASH_FIELDS
-};
-
-export {
-  normalizeStatus,
-  normalizeFailureInput,
-  normalizeFailureErrors,
-  sanitizeFlashedInput,
-  clearSensitiveInputValues,
-  sensitiveInputInternals
-};