@k8ordo/form 0.1.0 → 0.1.1

package/README.md

@@ -96,6 +96,12 @@ async per-field checks, components that render no input of their own, and what
 the package guarantees (nothing dropped in silence, native validation kept
 without JavaScript, secrets never echoed).
 
+A check HTML cannot express — a `refine`, a regex the `pattern` attribute
+would reinterpret — is returned in `dropped` (typed as `DroppedCheck`, exported
+from both entries) and, outside production, logged once per schema with
+`console.warn`, so it is seen without anyone remembering to read it. It still
+runs on the server.
+
 ## AI Agent Documentation
 
 The docs ship **inside the package**, so an agent always reads the exact

package/dist/derive/form-fields.mjs

@@ -21,6 +21,30 @@ const patternFlags = (schema, source) => {
 /** What a `datetime-local` control actually submits: no seconds, no zone. */
 const DATETIME_LOCAL_PROBE = "2000-01-01T00:00";
 /**
+* Schemas whose `dropped` list has already been reported. `formFields` is not
+* memoized, so a schema derived in every request would otherwise warn on
+* every request; keyed by the schema object, an HMR re-evaluation still gets
+* its warning back, because it is a new object.
+*/
+const warned = /* @__PURE__ */ new WeakSet();
+/**
+* `dropped` is returned, but a return value is only seen by whoever reads
+* it. Outside production the list is also written to the console, once per
+* schema, so the checks the browser will never run are noticed without
+* anyone remembering to look.
+*/
+const warnDropped = (schema, dropped) => {
+	if (process.env.NODE_ENV === "production") return;
+	if (dropped.length === 0 || warned.has(schema)) return;
+	warned.add(schema);
+	const lines = dropped.map(({ field, reason }) => `  - ${field}: ${reason}`);
+	console.warn([
+		"[@k8ordo/form] クライアントでは検査されないチェックがあります（サーバーでは検査されます）。",
+		...lines,
+		"  ブラウザ側でも検査するには、formFields の戻り値 dropped を確認してください。"
+	].join("\n"));
+};
+/**
 * Derive input attributes and messages from one zod object schema.
 *
 * Call this on the server — in a Server Component or at module scope. The
@@ -72,6 +96,7 @@ const formFields = (input) => {
 		field: "(schema)",
 		reason: `${String(objectChecks)}件のオブジェクト階層のチェック（refine など）は HTML の制約属性に落ちないため、クライアントでは検査されません`
 	});
+	warnDropped(schema, dropped);
 	return {
 		fields,
 		arrays,

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import { AsyncCheck, useAsyncCheck } from "./async-check.mjs";
 import { Rule } from "./rules/rules.mjs";
-import { DerivedArray, DerivedField, FieldInput, FormFields, FormState, ValidityFlag } from "./types.mjs";
+import { DerivedArray, DerivedField, DroppedCheck, FieldInput, FormFields, FormState, ValidityFlag } from "./types.mjs";
 import { HiddenValue } from "./hidden-value.mjs";
 import { ArrayView, FieldView, RowView, UseFormReturn, useForm } from "./use-form.mjs";
-export { type ArrayView, type AsyncCheck, type DerivedArray, type DerivedField, type FieldInput, type FieldView, type FormFields, type FormState, HiddenValue, type RowView, type Rule, type UseFormReturn, type ValidityFlag, useAsyncCheck, useForm };
+export { type ArrayView, type AsyncCheck, type DerivedArray, type DerivedField, type DroppedCheck, type FieldInput, type FieldView, type FormFields, type FormState, HiddenValue, type RowView, type Rule, type UseFormReturn, type ValidityFlag, useAsyncCheck, useForm };

package/docs/GUIDE.md

@@ -121,7 +121,8 @@ cross-field rules, an exclusive bound on a float, a regex whose flags or
 anchoring the `pattern` attribute would silently reinterpret, a
 `z.iso.datetime()` no `datetime-local` control can ever satisfy — are returned
 in `dropped`. They still run on the server; you are told they do not run on
-the client.
+the client. Outside production `formFields` also logs the list once per schema
+with `console.warn`, so it is seen without anyone remembering to read it.
 
 **A schema this package cannot express fails at derive time.** `z.record`,
 tuples, a repeat nested inside a repeat, nullable objects, keys containing

package/docs/llms.txt

@@ -23,10 +23,15 @@ When installed via npm, these docs live under `node_modules/@k8ordo/form/docs/`.
   `field(path)` accessor giving input attributes, the current error, and
   `invalid` / `required`, an `array(path)` accessor for repeated rows, and
   `isDirty`. Also `useAsyncCheck` for server-answered per-field checks and
-  `HiddenValue` for components that render no input of their own.
+  `HiddenValue` for components that render no input of their own. The types
+  of the `formFields` result (`FormFields`, `DerivedField`, `DerivedArray`,
+  `DroppedCheck`) are exported here as well, since the result crosses to the
+  client as a prop.
 - `@k8ordo/form/server` — server. `formFields(schema)` derives serializable
-  fields plus a `dropped` list of checks HTML cannot express, and throws on a
-  schema no form can represent; `parseForm(schema, formData)` validates a
+  fields plus a `dropped` list of checks HTML cannot express (outside
+  production the list is also logged once per schema with `console.warn`),
+  and throws on a schema no form can represent;
+  `parseForm(schema, formData)` validates a
   submission and returns typed data or per-field errors with the submitted
   values. `defineForm(schema, rules)` attaches cross-field rules (`sameAs`,
   `minChecked`, `requiredWhen`) typed against the schema's paths.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@k8ordo/form",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Derive HTML constraint attributes and per-field errors from one zod schema. Works without JavaScript.",
   "keywords": [
     "constraint-validation",
@@ -11,6 +11,9 @@
     "zod"
   ],
   "homepage": "https://ordo.k8o.me",
+  "bugs": {
+    "url": "https://github.com/k35o/k8ordo/issues"
+  },
   "license": "MIT",
   "author": "k8o <kosakanoki@gmail.com>",
   "repository": {
@@ -39,9 +42,11 @@
     "registry": "https://registry.npmjs.org"
   },
   "devDependencies": {
+    "@arethetypeswrong/cli": "0.18.5",
     "@types/react": "19.2.18",
     "@vitejs/plugin-react": "6.0.5",
     "@vitest/browser-playwright": "4.1.10",
+    "publint": "0.3.23",
     "react": "19.2.8",
     "react-dom": "19.2.8",
     "typescript": "7.0.2",
@@ -71,6 +76,7 @@
     "test": "vp test",
     "typecheck": "tsc --noEmit",
     "check": "vp check",
-    "check:write": "vp check --fix"
+    "check:write": "vp check --fix",
+    "check:package": "publint && attw --pack . --profile esm-only"
   }
 }