@object-ui/plugin-form 17.3.0 → 17.6.0

package/dist/schemaDefaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemaDefaults.d.ts","sourceRoot":"","sources":["../src/schemaDefaults.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAEH,OAAO,EAAwB,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAQzE,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAE5B,qFAAqF;AACrF,UAAU,gBAAgB;IACxB,MAAM,CAAC,EAAE,MAAM,CACb,MAAM,EACN;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CACpG,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAGrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GACpE,OAAO,CAET;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EACxE,YAAY,EAAE,OAAO,GACpB,OAAO,CAIT;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EACjD,GAAG,CAAC,EAAE,WAAW,GAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyBzB;AAqBD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EACjD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACxC,GAAG,CAAC,EAAE,WAAW,GAChB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,YAAY,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GAChD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzB"}

package/dist/sectionFields.d.ts

@@ -8,6 +8,15 @@ export interface SectionFieldsContext {
     readOnly?: boolean;
     /** Form mode — `view` forces every field disabled. */
     mode?: 'create' | 'edit' | 'view';
+    /**
+     * The record this form is editing, if any. Together with `mode` it answers
+     * "is there a persisted record behind this form", which decides whether a
+     * runtime `defaultValue` excuses the field from `required` (#4069) — see
+     * `isCreateFormMode`. Passed rather than derived from `mode` alone because
+     * the containers' own create branch is `mode === 'create' || !recordId`, and
+     * a form that omits `mode` entirely is still a create form to them.
+     */
+    recordId?: unknown;
     /**
      * Translation-aware label resolver (from `useSafeFieldLabel`).
      *
@@ -18,6 +27,15 @@ export interface SectionFieldsContext {
      */
     fieldLabel: (objectName: string, fieldName: string, fallback: string) => string;
 }
+/**
+ * Build a runtime FormField from object-schema metadata for `fieldName`.
+ *
+ * The ONE object-field-to-FormField mapping in this package. Exported because
+ * the flat (no-sections) containers need the identical mapping — see
+ * `flatFields.ts`, and objectui#4755 for what a second hand-copied version
+ * costs.
+ */
+export declare function fromObjectSchema(fieldName: string, ctx: SectionFieldsContext): FormField;
 /**
  * Normalize one section field definition (string | spec object | runtime
  * FormField) into a runtime FormField with a guaranteed `name`.

package/dist/sectionFields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sectionFields.d.ts","sourceRoot":"","sources":["../src/sectionFields.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGlD,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,YAAY,EAAE,GAAG,CAAC;IAClB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,sDAAsD;IACtD,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;IAClC;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;CACjF;AAsED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACtC,GAAG,EAAE,oBAAoB,GACxB,SAAS,CAqEX;AAED,8CAA8C;AAC9C,wBAAgB,kBAAkB,CAChC,OAAO,EAAE;IAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;CAAE,EACxD,GAAG,EAAE,oBAAoB,GACxB,SAAS,EAAE,CAEb"}
+{"version":3,"file":"sectionFields.d.ts","sourceRoot":"","sources":["../src/sectionFields.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAIlD,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,YAAY,EAAE,GAAG,CAAC;IAClB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,sDAAsD;IACtD,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;CACjF;AA2CD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,oBAAoB,GAAG,SAAS,CAgCxF;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACtC,GAAG,EAAE,oBAAoB,GACxB,SAAS,CA2FX;AAED,8CAA8C;AAC9C,wBAAgB,kBAAkB,CAChC,OAAO,EAAE;IAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;CAAE,EACxD,GAAG,EAAE,oBAAoB,GACxB,SAAS,EAAE,CAEb"}

package/dist/submitRedirect.d.ts

@@ -0,0 +1,148 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * Where a form's `submitBehavior: { kind: 'redirect' }` sends the submitter
+ * (objectui#4989), under the shape objectstack#7496 ruled on 2026-08-11 and
+ * objectstack#7657 landed in `@objectstack/spec` (live on the 17.0.0 GA pin
+ * this package depends on).
+ *
+ * The ruling has three points:
+ *
+ *   1. **relative paths only** — an absolute or protocol-relative URL is
+ *      refused. This is the open-redirect face: the destination is authored
+ *      metadata, which is exactly where an address somebody else chose gets
+ *      copied in.
+ *   2. **interpolation only from declared record fields**, spelled
+ *      `{{record.field_name}}`, with every interpolated value **URL-escaped
+ *      when the redirect is built**.
+ *   3. a **verbatim redirect on the resolved relative path** is the intended
+ *      consumption — the destination is that string with its tokens
+ *      substituted, and nothing else.
+ *
+ * Point 1 is a property of the string, so the spec enforces it at the authoring
+ * door and this module ASKS it rather than restating it. Whether
+ * `{{record.foo}}` names a field the form's object actually declares needs both
+ * the string and the object declaration, so `@objectstack/lint`'s
+ * reference-integrity family owns that. Point 2's "when the redirect is built"
+ * and point 3's consumption are runtime, and this module is where they happen.
+ *
+ * ## The shape verdict is the spec's, not a copy of it
+ *
+ * `@objectstack/spec` does not export its url check as a function, but it does
+ * export the schema the check lives in, so the verdict here is produced by
+ * PARSING the smallest form view that carries this behavior. That costs one
+ * parse per submit and buys the property that matters: there is no second
+ * spelling of a security rule in this repo to drift from the first, and when the
+ * ruling widens (it says an allowlist of absolute origins "waits for measured
+ * demand") this package follows the pin with no edit here.
+ *
+ * The alternative was a local re-implementation of the seven refusal families
+ * kept honest by a parity table. `scripts/check-spec-symbol-derivation.mjs`
+ * exists because this repo has paid for that shape four times
+ * (objectstack#4115, objectui#4074/#4588/#4592): a hand copy passes every value
+ * comparison right up to the release that moves the original.
+ *
+ * Parsing a MINIMAL view is load-bearing, not laziness. A whole stored
+ * `FormView` refuses on any unrelated key the strict schema does not know, and a
+ * redirect must not be refused because some other part of the metadata drifted.
+ * The question asked here is narrow — "is this url a value the contract
+ * allows?" — so only that value is submitted for judgement, and only issues on
+ * that value's path are read back.
+ *
+ * `@objectstack/spec` is already a declared runtime dependency of this package
+ * and already imported by its siblings (`sectionFields.ts`, `sanitize.ts`), so
+ * the import adds no dependency and no chunk.
+ *
+ * ## Relationship to `apps/console`'s `submitRedirect.ts`
+ *
+ * `apps/console` consumes the same ruled key and got the same treatment in
+ * objectui#4190 / PR #4992. The two are deliberately SEMANTICALLY aligned and
+ * physically separate: a published renderer package cannot import an app's
+ * module, and the shared thing — the shape verdict — is not duplicated at all,
+ * because both ask the same `FormViewSchema`. What is written twice is the token
+ * substitution and the escape, ~20 lines the spec exports no substituter for.
+ *
+ * Two deliberate divergences, both named so a future consolidation has a map.
+ * The accepted value: the console resolves to a `path` it hands to a ROUTER
+ * unconditionally, whereas this package resolves to a path it hands to the
+ * host's injected navigate when there is one and to a browser-level navigation
+ * when there is not — a renderer cannot assume a router, which is the whole
+ * subject of `submitRedirectNavigation.ts`. And the split: the console has since
+ * separated its shape verdict
+ * into `checkSubmitRedirectUrl` because it also owns an authoring door
+ * (`PublicFormsPage` asks it before saving), which this package has no
+ * counterpart to — a renderer only ever consumes.
+ */
+/** Accepted: `url` is the resolved relative destination to navigate to. */
+interface SubmitRedirectAccepted {
+    ok: true;
+    url: string;
+}
+/** Refused: `refusal` is author-facing prose explaining what to write instead. */
+interface SubmitRedirectRefused {
+    ok: false;
+    refusal: string;
+}
+export type SubmitRedirectVerdict = SubmitRedirectAccepted | SubmitRedirectRefused;
+/**
+ * The token scope for one submit: "the record this submit just wrote".
+ *
+ * The values as submitted, with whatever the DataSource answered layered over
+ * them — defaults, computed columns and the new id are canonical there, and the
+ * submitted values are what a `create` that echoes nothing back still has. Both
+ * form components call this so a `{{record.id}}` token cannot resolve one way in
+ * `ObjectForm` and another in `WizardForm`.
+ */
+export declare function submitRedirectScope(submittedValues: unknown, result: unknown): Record<string, unknown>;
+/**
+ * Resolve an authored `submitBehavior.url` into the relative destination to
+ * navigate to, or refuse it.
+ *
+ * @param url    the authored value, exactly as the metadata carries it
+ * @param record the record this submit just wrote — the token scope
+ *
+ * Refusal is fail-closed and quotable: the message is the spec's own
+ * prescription (it names the key, the rule, and what to write instead, including
+ * that a deliberately external destination is an app navigation item rather than
+ * this key), so the author reads the same sentence here that the authoring door
+ * would have told them. Callers must SHOW it — the write already succeeded, and
+ * dropping the refusal leaves the submitter looking at a still-filled form with
+ * no idea why nothing happened, which is objectui#4989's defect 2 and the one
+ * outcome the ruling's consumer half rules out.
+ *
+ * ## Why substitution cannot widen the destination
+ *
+ * Every interpolated value goes through `encodeURIComponent`, which escapes the
+ * characters that could add structure — `/` and `:`, along with `?`, `#` and the
+ * rest. So a field carrying an address, a traversal, or a space becomes one
+ * opaque segment or query value: a token is a VALUE in the path, never a way to
+ * add path structure.
+ *
+ * That escape carries the whole weight of the property, and re-parsing the
+ * result would NOT be enough on its own. Interpolated raw,
+ * `/t/{{record.slug}}` with an address in `slug` becomes
+ * `/t/https://evil.example/steal` — which still starts with `/` and carries no
+ * leading scheme, i.e. a spec-VALID relative path pointing somewhere the author
+ * never wrote. Relative-only is a rule about where a path STARTS, so it has
+ * nothing to say about structure injected further along. `submitRedirect.test.ts`
+ * therefore pins both halves.
+ *
+ * ## What this module does not answer: WHO travels (objectui#4989 defect 4)
+ *
+ * An accepted value is a rooted relative path, and a rooted path resolves
+ * against the ORIGIN root when a browser-level navigation performs it — so
+ * under a host mounted at a sub-path a ruled in-app `/thanks` used to leave the
+ * app. That is defect 4 of the card, and it is not a property of the string:
+ * the same accepted path is correct or wrong depending on who travels to it.
+ * It is therefore answered one layer out, in `submitRedirectNavigation.ts`,
+ * where the host's optionally injected navigate is used when present
+ * (maintainer ruling, 2026-08-17) and `window.location.assign` otherwise.
+ *
+ * Nothing about the verdict changes with the seam: an injected host navigate is
+ * never a laundering route for a value this module refuses, because it is only
+ * ever handed a path this module already accepted.
+ */
+export declare function resolveSubmitRedirect(url: string, record: Record<string, unknown>): SubmitRedirectVerdict;
+export {};
+//# sourceMappingURL=submitRedirect.d.ts.map

package/dist/submitRedirect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submitRedirect.d.ts","sourceRoot":"","sources":["../src/submitRedirect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AAsBH,2EAA2E;AAC3E,UAAU,sBAAsB;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,GAAG,EAAE,MAAM,CAAC;CACb;AAED,kFAAkF;AAClF,UAAU,qBAAqB;IAC7B,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,qBAAqB,GAAG,sBAAsB,GAAG,qBAAqB,CAAC;AAoBnF;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,OAAO,GACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,qBAAqB,CAgDvB"}

package/dist/submitRedirectNavigation.d.ts

@@ -0,0 +1,82 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * How an ACCEPTED `submitBehavior: { kind: 'redirect' }` destination is
+ * actually travelled to — objectui#4989 **defect 4, mount-blindness**, the
+ * reopened half of that card.
+ *
+ * `submitRedirect.ts` answers WHETHER a destination may be followed and WHAT
+ * the resolved relative path is. This module answers WHO performs the
+ * navigation, and it is a separate question because the right answer is not
+ * this package's to pick: a rooted path such as `/thanks` handed to
+ * `window.location.assign` resolves against the ORIGIN, so under a host mounted
+ * at a sub-path (the framework CLI configures one for every embedded
+ * deployment) a ruled in-app destination leaves the application. Only the host
+ * knows its mount.
+ *
+ * ## The mechanism, and why it is this one
+ *
+ * Maintainer ruling, 2026-08-17: **optional injected navigation**. The host
+ * offers its own router-aware, basename-aware navigate through
+ * `HostNavigationContext` (`@object-ui/react`); this package uses it when it is
+ * there and keeps today's `window.location.assign` when it is not. Two other
+ * mechanisms were weighed and REJECTED in that ruling, recorded here so the
+ * next reader does not re-derive them as improvements:
+ *
+ *   - **reading React Router's context when a router happens to be present** —
+ *     implicit, and unavailable regardless: a React context is a module-instance
+ *     object, so reading the host's requires importing `react-router` here.
+ *     This package declares it in none of its four dependency fields, its Vite
+ *     build externalises every bare specifier, and two real consumers
+ *     (`apps/site`, `packages/plugin-view`) have no react-router to resolve —
+ *     the published `dist` would break their builds. Declaring it as a normal
+ *     dependency does not help either: that yields this package its OWN
+ *     react-router instance, whose context object is not the host's, so the
+ *     read answers null forever.
+ *   - **a `react-router` peer requirement** — the honest version of the above,
+ *     and it costs this package the property that it drops into ANY React
+ *     application.
+ *
+ * ## Absent seam is not a degraded mode
+ *
+ * With no provider the behaviour is byte-for-byte what it was: one
+ * `window.location.assign` of the resolved path after the declared delay. A
+ * host with no router has no basename, so origin-rooted resolution is already
+ * correct there — the seam changes what a MOUNTED host gets, and nothing else.
+ *
+ * ## What the host takes on by supplying it
+ *
+ * A host navigate is a client-side transition, so the destination must be a
+ * path the host's router can match; an in-app path with no route renders the
+ * host's not-found instead of a full page load. That is the host's routing
+ * table to answer for, which is exactly why the choice is the host's. The
+ * verdict is NOT relaxed for injected hosts: a destination the contract refuses
+ * is refused identically either way (`submitRedirect.ts`), so a supplied
+ * navigate can never become a laundering route for a value the authoring door
+ * rejects.
+ */
+/**
+ * An accepted destination plus the delay declared with it, captured at the
+ * moment the write was accepted. Held in component state by each form so the
+ * wait belongs to the mounted component (objectui#5033) — see the state's own
+ * comment at each call site.
+ */
+export interface PendingSubmitRedirect {
+    url: string;
+    delayMs: number;
+}
+/**
+ * Own the delayed leg of an accepted `redirect` submit behaviour: wait the
+ * declared `delayMs`, then travel to `pending.url` through the host's navigate
+ * if one was injected, else through `window.location.assign`.
+ *
+ * Unmounting cancels the wait, which is the property objectui#5033 bought and
+ * this extraction preserves: the hook's effect is the same effect both forms
+ * used to declare inline, now written once so the two cannot disagree about
+ * either the wait or the seam.
+ *
+ * Pass `null` when nothing is pending.
+ */
+export declare function useSubmitRedirectNavigation(pending: PendingSubmitRedirect | null): void;
+//# sourceMappingURL=submitRedirectNavigation.d.ts.map

package/dist/submitRedirectNavigation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submitRedirectNavigation.d.ts","sourceRoot":"","sources":["../src/submitRedirectNavigation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAKH;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,GAAG,IAAI,CA8BvF"}

package/dist/successBehavior.d.ts

@@ -13,7 +13,24 @@
  * → here), so the same-origin check is inlined.
  */
 export type { SubmitBehavior } from '@object-ui/types';
-/** Same-origin guard for declarative navigation (relative or absolute URLs). */
+/**
+ * Same-origin guard for declarative navigation (relative or absolute URLs).
+ *
+ * **Scope note (objectui#4989).** This guard used to gate `submitBehavior:
+ * { kind: 'redirect' }` too. It no longer does: objectstack#7496 ruled that key
+ * RELATIVE-ONLY, and `submitRedirect.ts` gets that verdict from the spec's own
+ * `FormViewSchema`. Relative-only is strictly stronger than same-origin — a
+ * rooted relative path is same-origin by construction — so keeping this call in
+ * that arm as defence-in-depth would add no defence, while its converse (it says
+ * yes to `https://own-host/thanks`) was exactly the defect: this consumer
+ * accepted a spelling the authoring door now refuses, which is how a rejected
+ * spelling stays alive in a corpus.
+ *
+ * It survives because {@link resolveSuccessNavigate} still needs it. That serves
+ * `navigateOnSuccess` — a DIFFERENT declared key with its own `{id}` /
+ * `{recordId}` dialect, no relative-only ruling, and its own contract question
+ * still open. Deleting the guard would silently widen that key.
+ */
 export declare function isSameOriginUrl(rawUrl: string): boolean;
 /**
  * Resolve a `navigateOnSuccess` template into a safe URL: interpolate

package/dist/successBehavior.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"successBehavior.d.ts","sourceRoot":"","sources":["../src/successBehavior.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAQvD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,GAAG,GACV,MAAM,GAAG,IAAI,CAMf"}
+{"version":3,"file":"successBehavior.d.ts","sourceRoot":"","sources":["../src/successBehavior.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAQvD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,GAAG,GACV,MAAM,GAAG,IAAI,CAMf"}

package/dist/thankYouRedirectCountdown.d.ts

@@ -0,0 +1,17 @@
+import { PendingThankYouRedirect } from './thankYouRedirectNavigation';
+/** One tick per displayed second — matches the `{{seconds}}` unit the copy promises. */
+export declare const REDIRECT_COUNTDOWN_TICK_MS = 1000;
+/**
+ * The remaining whole seconds of an accepted thank-you redirect wait, ticking
+ * down once per second until it reaches 0. `null` while nothing is pending —
+ * the panel keeps deciding on its own whether a countdown renders at all (a
+ * refused destination, objectui#5073, never reaches this hook with a
+ * non-null `pending`).
+ *
+ * Pass the same `PendingThankYouRedirect | null` value given to
+ * `useThankYouRedirectNavigation`. This hook does not navigate anything and
+ * does not judge the destination — it only counts down the delay that was
+ * captured alongside it.
+ */
+export declare function useRedirectCountdownSeconds(pending: PendingThankYouRedirect | null): number | null;
+//# sourceMappingURL=thankYouRedirectCountdown.d.ts.map

package/dist/thankYouRedirectCountdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"thankYouRedirectCountdown.d.ts","sourceRoot":"","sources":["../src/thankYouRedirectCountdown.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAGH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAE5E,wFAAwF;AACxF,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAM/C;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAmClG"}

package/dist/thankYouRedirectNavigation.d.ts

@@ -0,0 +1,111 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * WHO travels to an ACCEPTED `thankYouPage.redirectUrl` — objectui#5112, the
+ * mount-blindness of `EmbeddableForm`'s thank-you redirect.
+ *
+ * `EmbeddableForm.isRedirectUrlSafe` answers WHETHER a destination may be
+ * followed. This module answers who performs the navigation, and it is a
+ * separate question for the reason objectui#4989 defect 4 established: a rooted
+ * path such as `/thanks` handed to a browser-level navigation resolves against
+ * the ORIGIN root, so under a host mounted at a sub-path (the framework CLI
+ * configures one for every embedded deployment; the console runs at basename
+ * `/_console`) a same-origin in-app destination leaves the application. Only the
+ * host knows its mount, and it offers its mount-aware navigate through
+ * `HostNavigationContext` (`@object-ui/react`, landed by PR #5111).
+ *
+ * ## Why this is a sibling of `submitRedirectNavigation.ts` and not a call into it
+ *
+ * That module serves `submitBehavior.url`, whose accepted set objectstack#7496
+ * ruled **relative-only**: every destination it ever holds is already in-app, so
+ * it hands the seam whatever it was given. This key is deliberately more
+ * permissive — same-origin OR a host in the author's `allowedRedirectHosts`
+ * allowlist — because a public form's thank-you page is often a real external
+ * marketing page. So this key needs an arm the other one does not have, and
+ * putting that arm inside the shared hook would make every `submitBehavior`
+ * consumer carry a branch its contract can never reach. The acceptance set
+ * itself is untouched here (objectui#5112 is explicitly not the card that
+ * revisits it, and objectstack#7496's relative-only rule is NOT imported onto
+ * this key).
+ *
+ * ## The arm split, and the invariant it buys
+ *
+ * - **an app-relative destination** goes through the host's navigate when a
+ *   host supplied one, and falls back to today's browser navigation when none
+ *   was supplied;
+ * - **anything else** — an external destination admitted by the allowlist, and
+ *   equally an ABSOLUTE same-origin URL the author spelled out in full — keeps
+ *   browser-level navigation unconditionally.
+ *
+ * The second arm is not a conservatism, it is the seam's own declared input
+ * contract: `HostNavigationValue.navigate` documents `to` as "an already-resolved,
+ * application-relative path, never an absolute URL: a renderer that holds an
+ * external destination must not launder it through the host's router". A host
+ * navigate is a client-side router transition; an absolute URL is not a path a
+ * router can match, and a cross-origin one is not the router's to attempt at
+ * all. So the discriminant is the seam's admission rule restated as a predicate
+ * on the string, which yields the invariant worth stating out loud and pinning:
+ * **the host seam can never be handed a cross-origin URL**, because a relative
+ * reference cannot carry an authority (RFC 3986) and therefore always resolves
+ * to the base's origin.
+ *
+ * An absolute same-origin URL landing in the browser arm is a deliberate call,
+ * not an oversight. It is the one destination shape the card's two named arms do
+ * not cover, and routing it through the seam would mean this package rewriting
+ * `https://forms.example/thanks` into `/thanks` for a router that would then
+ * place it at `/_console/thanks` — a DIFFERENT address from the one the author
+ * wrote. An author who spelled the whole address asked for that address; the
+ * mount-blindness this card fixes is the one where the author wrote no origin at
+ * all and had no way to express the mount.
+ *
+ * ## Absent seam is not a degraded mode
+ *
+ * With no provider the behaviour is byte-for-byte what it was: one
+ * `window.location.href` assignment of the authored destination after the
+ * declared delay. A host with no router has no basename, so origin-rooted
+ * resolution is already correct there.
+ */
+/**
+ * An accepted thank-you destination plus the delay declared with it, captured at
+ * the moment the write was accepted (objectui#5049) — see the state's own
+ * comment in `EmbeddableForm`.
+ */
+export interface PendingThankYouRedirect {
+    url: string;
+    delayMs: number;
+}
+/**
+ * Is `rawUrl` an application-relative reference — i.e. a destination the host's
+ * router can be asked to place?
+ *
+ * True for `/thanks`, `thanks`, `?ok=1`, `#done`. False for `https://x/y`,
+ * `//x/y` (protocol-relative carries an authority), `javascript:…`, and for a
+ * same-origin ABSOLUTE URL — see the module docblock for why that last one is
+ * deliberate.
+ *
+ * The question is answered by the URL parser rather than by a hand-written
+ * scheme grammar, so leading whitespace and C0 controls are handled exactly the
+ * way the parser handles them and there is no second spelling of RFC 3986 in
+ * this repo to drift from the first.
+ *
+ * This predicate does NOT judge whether a destination may be followed —
+ * `isRedirectUrlSafe` already did that, and this runs only on values it
+ * accepted. It picks who travels, nothing more.
+ */
+export declare function isAppRelativeDestination(rawUrl: string): boolean;
+/**
+ * Own the delayed leg of an accepted thank-you redirect: wait the declared
+ * `delayMs`, then travel to `pending.url` through the host's navigate if one was
+ * injected AND the destination is app-relative, else through
+ * `window.location.href`.
+ *
+ * Unmounting, or dropping the destination, cancels the wait — the property
+ * objectui#5049 bought, preserved here unchanged: this hook is the effect
+ * `EmbeddableForm` used to declare inline, with the seam added and nothing else
+ * moved.
+ *
+ * Pass `null` when nothing is pending.
+ */
+export declare function useThankYouRedirectNavigation(pending: PendingThankYouRedirect | null): void;
+//# sourceMappingURL=thankYouRedirectNavigation.d.ts.map

package/dist/thankYouRedirectNavigation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"thankYouRedirectNavigation.d.ts","sourceRoot":"","sources":["../src/thankYouRedirectNavigation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAKH;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAaD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAYhE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI,GAAG,IAAI,CA+B3F"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-form",
-  "version": "17.3.0",
+  "version": "17.6.0",
   "type": "module",
   "license": "MIT",
   "description": "Form plugin for Object UI",
@@ -15,15 +15,15 @@
     }
   },
   "dependencies": {
-    "@objectstack/spec": "^17.0.0-rc.2",
-    "lucide-react": "^1.28.0",
-    "@object-ui/components": "17.3.0",
-    "@object-ui/core": "17.3.0",
-    "@object-ui/fields": "17.3.0",
-    "@object-ui/i18n": "17.3.0",
-    "@object-ui/permissions": "17.3.0",
-    "@object-ui/react": "17.3.0",
-    "@object-ui/types": "17.3.0"
+    "@objectstack/spec": "^17.0.0",
+    "lucide-react": "^1.31.0",
+    "@object-ui/components": "17.6.0",
+    "@object-ui/core": "17.6.0",
+    "@object-ui/fields": "17.6.0",
+    "@object-ui/i18n": "17.6.0",
+    "@object-ui/permissions": "17.6.0",
+    "@object-ui/react": "17.6.0",
+    "@object-ui/types": "17.6.0"
   },
   "peerDependencies": {
     "react": "^18.0.0 || ^19.0.0",
@@ -33,9 +33,9 @@
     "@vitejs/plugin-react": "^6.0.5",
     "msw": "^2.15.0",
     "typescript": "^6.0.3",
-    "vite": "^8.2.0",
+    "vite": "^8.2.1",
     "vite-plugin-dts": "^5.0.3",
-    "@object-ui/data-objectstack": "17.3.0"
+    "@object-ui/data-objectstack": "17.6.0"
   },
   "keywords": [
     "objectui",
@@ -72,7 +72,7 @@
   "scripts": {
     "build": "vite build",
     "test": "vitest run",
-    "type-check": "tsc --noEmit && tsc -p tsconfig.typetests.json",
+    "type-check": "tsc --noEmit && tsc -p tsconfig.test.json",
     "lint": "eslint ."
   }
 }