@mccaskie-labs/workbench-config 0.1.26 → 0.1.27

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @mccaskie-labs/workbench-config
 
+## 0.1.27
+
+### Patch Changes
+
+- The forms manifest (`capabilities/forms.json`): five rules for `workbench-forms` (the endpoint decides, one verdict on the page and at the endpoint, codes turned into words by the strings catalogue, bounds from the limits register, no members on a form) and two no-cost probes, `forms.validate` and `forms.browser`. `forms` joins the component list.
+
 ## 0.1.26
 
 ### Patch Changes

package/capabilities/forms.json

@@ -0,0 +1,93 @@
+{
+  "$schema": "./schema.json",
+  "format": 1,
+  "component": "forms",
+  "title": "Form validation",
+  "summary": "workbench-forms checks what people type into a form with one validator that runs the same on the page and at the endpoint. It returns every problem at once as permanent codes, the tidied value to show back in each field and the value to store, with limits from the app's own register and country shapes from workbench-country. It runs in the app itself, with no Gateway call and no cost.",
+  "status": "built",
+  "surfaces": {
+    "package": [
+      "defineForm",
+      "text",
+      "longText",
+      "email",
+      "phone",
+      "money",
+      "whole",
+      "date",
+      "choice",
+      "validate",
+      "readForm",
+      "embedConfig",
+      "inputAttributes",
+      "messageKeys",
+      "tidyLine",
+      "tidyText",
+      "CODES",
+      "FormsSetupError"
+    ]
+  },
+  "rules": [
+    {
+      "id": "forms.endpoint-decides",
+      "kind": "must",
+      "text": "Validate every form at the endpoint with validate() and store only result.values; the page's copy of the validator (FORMS_SCRIPT) only helps the person, it never decides.",
+      "enforced_by": "review",
+      "probe": "forms.validate"
+    },
+    {
+      "id": "forms.same-verdict",
+      "kind": "must",
+      "text": "Put the form on the page with embedConfig and FORMS_SCRIPT, never a second set of rules, so the page and the endpoint reach the same verdict.",
+      "enforced_by": "review",
+      "probe": "forms.browser"
+    },
+    {
+      "id": "forms.codes-not-sentences",
+      "kind": "must",
+      "text": "Turn problem codes into words through the strings catalogue (messageKeys: validation.<form>.<field>.<code>, then validation.<code>), never words written in code.",
+      "enforced_by": "review",
+      "probe": "forms.validate"
+    },
+    {
+      "id": "forms.limits-register",
+      "kind": "must",
+      "text": "Take every length, amount and date bound from the app's limits register (defineLimits, boundsFor), and keep it matched to the database with workbench-supabase check:limits.",
+      "enforced_by": "types",
+      "probe": "forms.validate"
+    },
+    {
+      "id": "forms.no-members-on-a-form",
+      "kind": "must_not",
+      "text": "List a choice field's members on the form: the vocabulary owns them, and the app passes them in context.choices.",
+      "enforced_by": "types",
+      "probe": "forms.validate"
+    }
+  ],
+  "examples": [
+    {
+      "id": "forms.example.endpoint",
+      "title": "Check a posted form at the endpoint",
+      "lang": "ts",
+      "probe": "forms.validate",
+      "code": "import { defineForm, email, money, readForm, text, validate } from '@mccaskie-labs/workbench-forms'\nimport { boundsFor } from '@mccaskie-labs/workbench-forms/limits'\nimport { COUNTRY_PACKS } from '@mccaskie-labs/workbench-country'\n\nconst lead = defineForm('lead', { name: text({ limit: 'lead.name', required: true }), email: email({ required: true }), budget: money({ limit: 'lead.budget' }) })\nconst result = validate(lead, readForm(lead, await request.formData()), { bounds: boundsFor(LIMITS, lead), country: COUNTRY_PACKS.PH! })\nif (!result.ok) return show(result.problems, result.shown)\nawait db.from('leads').insert(result.values)"
+    }
+  ],
+  "probes": [
+    {
+      "id": "forms.validate",
+      "half": "runtime",
+      "expect": "pass",
+      "smoke": true,
+      "cost_hint_usd": 0,
+      "note": "In the Worker itself: validates a fixed form (text, email, phone, money, date, choice) for PH with one good and one bad input, and compares the stored values (E.164 phone, decimal-string amount, ISO date) and the problem codes with the expected ones"
+    },
+    {
+      "id": "forms.browser",
+      "half": "runtime",
+      "expect": "pass",
+      "cost_hint_usd": 0,
+      "note": "The probe page loads FORMS_SCRIPT and the form's embedConfig block, runs the same inputs in the browser and checks the verdict matches the Worker's; no Gateway call"
+    }
+  ]
+}

package/capabilities/schema.json

@@ -33,7 +33,8 @@
         "kv",
         "github",
         "strings",
-        "ui"
+        "ui",
+        "forms"
       ]
     },
     "title": {

package/dist/capabilities.gen.d.ts

@@ -1,4 +1,4 @@
-export declare const MANIFEST_VERSION: "7d046814165b";
+export declare const MANIFEST_VERSION: "c83a7c612319";
 export declare const capabilities: {
     readonly ai: {
         readonly $schema: "./schema.json";
@@ -1084,6 +1084,69 @@ export declare const capabilities: {
             readonly note: "Another project's namespace";
         }];
     };
+    readonly forms: {
+        readonly $schema: "./schema.json";
+        readonly format: 1;
+        readonly component: "forms";
+        readonly title: "Form validation";
+        readonly summary: "workbench-forms checks what people type into a form with one validator that runs the same on the page and at the endpoint. It returns every problem at once as permanent codes, the tidied value to show back in each field and the value to store, with limits from the app's own register and country shapes from workbench-country. It runs in the app itself, with no Gateway call and no cost.";
+        readonly status: "built";
+        readonly surfaces: {
+            readonly package: readonly ["defineForm", "text", "longText", "email", "phone", "money", "whole", "date", "choice", "validate", "readForm", "embedConfig", "inputAttributes", "messageKeys", "tidyLine", "tidyText", "CODES", "FormsSetupError"];
+        };
+        readonly rules: readonly [{
+            readonly id: "forms.endpoint-decides";
+            readonly kind: "must";
+            readonly text: "Validate every form at the endpoint with validate() and store only result.values; the page's copy of the validator (FORMS_SCRIPT) only helps the person, it never decides.";
+            readonly enforced_by: "review";
+            readonly probe: "forms.validate";
+        }, {
+            readonly id: "forms.same-verdict";
+            readonly kind: "must";
+            readonly text: "Put the form on the page with embedConfig and FORMS_SCRIPT, never a second set of rules, so the page and the endpoint reach the same verdict.";
+            readonly enforced_by: "review";
+            readonly probe: "forms.browser";
+        }, {
+            readonly id: "forms.codes-not-sentences";
+            readonly kind: "must";
+            readonly text: "Turn problem codes into words through the strings catalogue (messageKeys: validation.<form>.<field>.<code>, then validation.<code>), never words written in code.";
+            readonly enforced_by: "review";
+            readonly probe: "forms.validate";
+        }, {
+            readonly id: "forms.limits-register";
+            readonly kind: "must";
+            readonly text: "Take every length, amount and date bound from the app's limits register (defineLimits, boundsFor), and keep it matched to the database with workbench-supabase check:limits.";
+            readonly enforced_by: "types";
+            readonly probe: "forms.validate";
+        }, {
+            readonly id: "forms.no-members-on-a-form";
+            readonly kind: "must_not";
+            readonly text: "List a choice field's members on the form: the vocabulary owns them, and the app passes them in context.choices.";
+            readonly enforced_by: "types";
+            readonly probe: "forms.validate";
+        }];
+        readonly examples: readonly [{
+            readonly id: "forms.example.endpoint";
+            readonly title: "Check a posted form at the endpoint";
+            readonly lang: "ts";
+            readonly code: "import { defineForm, email, money, readForm, text, validate } from '@mccaskie-labs/workbench-forms'\nimport { boundsFor } from '@mccaskie-labs/workbench-forms/limits'\nimport { COUNTRY_PACKS } from '@mccaskie-labs/workbench-country'\n\nconst lead = defineForm('lead', { name: text({ limit: 'lead.name', required: true }), email: email({ required: true }), budget: money({ limit: 'lead.budget' }) })\nconst result = validate(lead, readForm(lead, await request.formData()), { bounds: boundsFor(LIMITS, lead), country: COUNTRY_PACKS.PH! })\nif (!result.ok) return show(result.problems, result.shown)\nawait db.from('leads').insert(result.values)";
+            readonly probe: "forms.validate";
+        }];
+        readonly probes: readonly [{
+            readonly id: "forms.validate";
+            readonly half: "runtime";
+            readonly expect: "pass";
+            readonly smoke: true;
+            readonly cost_hint_usd: 0;
+            readonly note: "In the Worker itself: validates a fixed form (text, email, phone, money, date, choice) for PH with one good and one bad input, and compares the stored values (E.164 phone, decimal-string amount, ISO date) and the problem codes with the expected ones";
+        }, {
+            readonly id: "forms.browser";
+            readonly half: "runtime";
+            readonly expect: "pass";
+            readonly cost_hint_usd: 0;
+            readonly note: "The probe page loads FORMS_SCRIPT and the form's embedConfig block, runs the same inputs in the browser and checks the verdict matches the Worker's; no Gateway call";
+        }];
+    };
     readonly gateway: {
         readonly $schema: "./schema.json";
         readonly format: 1;

package/dist/capabilities.gen.js

@@ -1,6 +1,6 @@
 // Generated by `npm run capabilities:build` from capabilities/*.json. Do not edit.
 // check:capabilities fails in Checks when this file is stale.
-export const MANIFEST_VERSION = "7d046814165b";
+export const MANIFEST_VERSION = "c83a7c612319";
 export const capabilities = {
     "ai": {
         "$schema": "./schema.json",
@@ -1475,6 +1475,99 @@ export const capabilities = {
             }
         ]
     },
+    "forms": {
+        "$schema": "./schema.json",
+        "format": 1,
+        "component": "forms",
+        "title": "Form validation",
+        "summary": "workbench-forms checks what people type into a form with one validator that runs the same on the page and at the endpoint. It returns every problem at once as permanent codes, the tidied value to show back in each field and the value to store, with limits from the app's own register and country shapes from workbench-country. It runs in the app itself, with no Gateway call and no cost.",
+        "status": "built",
+        "surfaces": {
+            "package": [
+                "defineForm",
+                "text",
+                "longText",
+                "email",
+                "phone",
+                "money",
+                "whole",
+                "date",
+                "choice",
+                "validate",
+                "readForm",
+                "embedConfig",
+                "inputAttributes",
+                "messageKeys",
+                "tidyLine",
+                "tidyText",
+                "CODES",
+                "FormsSetupError"
+            ]
+        },
+        "rules": [
+            {
+                "id": "forms.endpoint-decides",
+                "kind": "must",
+                "text": "Validate every form at the endpoint with validate() and store only result.values; the page's copy of the validator (FORMS_SCRIPT) only helps the person, it never decides.",
+                "enforced_by": "review",
+                "probe": "forms.validate"
+            },
+            {
+                "id": "forms.same-verdict",
+                "kind": "must",
+                "text": "Put the form on the page with embedConfig and FORMS_SCRIPT, never a second set of rules, so the page and the endpoint reach the same verdict.",
+                "enforced_by": "review",
+                "probe": "forms.browser"
+            },
+            {
+                "id": "forms.codes-not-sentences",
+                "kind": "must",
+                "text": "Turn problem codes into words through the strings catalogue (messageKeys: validation.<form>.<field>.<code>, then validation.<code>), never words written in code.",
+                "enforced_by": "review",
+                "probe": "forms.validate"
+            },
+            {
+                "id": "forms.limits-register",
+                "kind": "must",
+                "text": "Take every length, amount and date bound from the app's limits register (defineLimits, boundsFor), and keep it matched to the database with workbench-supabase check:limits.",
+                "enforced_by": "types",
+                "probe": "forms.validate"
+            },
+            {
+                "id": "forms.no-members-on-a-form",
+                "kind": "must_not",
+                "text": "List a choice field's members on the form: the vocabulary owns them, and the app passes them in context.choices.",
+                "enforced_by": "types",
+                "probe": "forms.validate"
+            }
+        ],
+        "examples": [
+            {
+                "id": "forms.example.endpoint",
+                "title": "Check a posted form at the endpoint",
+                "lang": "ts",
+                "code": "import { defineForm, email, money, readForm, text, validate } from '@mccaskie-labs/workbench-forms'\nimport { boundsFor } from '@mccaskie-labs/workbench-forms/limits'\nimport { COUNTRY_PACKS } from '@mccaskie-labs/workbench-country'\n\nconst lead = defineForm('lead', { name: text({ limit: 'lead.name', required: true }), email: email({ required: true }), budget: money({ limit: 'lead.budget' }) })\nconst result = validate(lead, readForm(lead, await request.formData()), { bounds: boundsFor(LIMITS, lead), country: COUNTRY_PACKS.PH! })\nif (!result.ok) return show(result.problems, result.shown)\nawait db.from('leads').insert(result.values)",
+                "probe": "forms.validate"
+            }
+        ],
+        "probes": [
+            {
+                "id": "forms.validate",
+                "half": "runtime",
+                "expect": "pass",
+                "smoke": true,
+                "cost_hint_usd": 0,
+                "note": "In the Worker itself: validates a fixed form (text, email, phone, money, date, choice) for PH with one good and one bad input, and compares the stored values (E.164 phone, decimal-string amount, ISO date) and the problem codes with the expected ones"
+            },
+            {
+                "id": "forms.browser",
+                "half": "runtime",
+                "expect": "pass",
+                "cost_hint_usd": 0,
+                "note": "The probe page loads FORMS_SCRIPT and the form's embedConfig block, runs the same inputs in the browser and checks the verdict matches the Worker's; no Gateway call"
+            }
+        ]
+    },
     "gateway": {
         "$schema": "./schema.json",
         "format": 1,

package/dist/capability-schema.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-export declare const COMPONENTS: readonly ["gateway", "ai", "images", "image-search", "config", "email", "email-inbound", "email-sending", "database", "workers", "domains", "dns", "analytics", "country", "pdf", "access", "r2", "kv", "github", "strings", "ui"];
+export declare const COMPONENTS: readonly ["gateway", "ai", "images", "image-search", "config", "email", "email-inbound", "email-sending", "database", "workers", "domains", "dns", "analytics", "country", "pdf", "access", "r2", "kv", "github", "strings", "ui", "forms"];
 export type Component = (typeof COMPONENTS)[number];
 export declare const allowedSchemas: {
     gateway: z.ZodObject<{
@@ -103,6 +103,7 @@ export declare const capabilitySchema: z.ZodObject<{
         email: "email";
         "email-inbound": "email-inbound";
         "email-sending": "email-sending";
+        forms: "forms";
         gateway: "gateway";
         github: "github";
         "image-search": "image-search";

package/dist/capability-schema.js

@@ -24,6 +24,7 @@ export const COMPONENTS = [
     "github",
     "strings",
     "ui",
+    "forms",
 ];
 const id = z.string().regex(/^[a-z0-9][a-z0-9.-]*$/, "lower case, digits, dots and hyphens");
 const code = z.string().regex(/^[a-z][a-z0-9_]*$/, "a snake_case error code");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mccaskie-labs/workbench-config",
-  "version": "0.1.26",
+  "version": "0.1.27",
   "description": "Workbench app configuration: WORKBENCH_ENV, typed variables that fail by name, secrets that are never printed, and the capabilities manifest.",
   "license": "UNLICENSED",
   "type": "module",