@svadmin/core 0.22.1 → 0.23.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/core",
-  "version": "0.22.1",
+  "version": "0.23.0",
   "author": "zuohuadong",
   "repository": {
     "type": "git",

package/src/audit.ts

@@ -45,6 +45,11 @@ export function getAuditLogProvider(): AuditLogProvider | null {
   return auditLogProvider;
 }
 
+export function resetAuditLogProvider(): void {
+  auditLogProvider = null;
+  handler = (entry) => { console.info('[audit]', entry.action, entry.resource, entry.recordId); };
+}
+
 export function audit(entry: Omit<AuditEntry, 'timestamp'>): void {
   const fullEntry: AuditEntry = { ...entry, timestamp: new Date().toISOString() };
   try {

package/src/auth-hooks.svelte.ts

@@ -13,7 +13,7 @@ import type { AuthActionResult, CheckResult, Identity, AuthProvider } from './ty
 interface CreateAuthMutationOptions {
   method: keyof AuthProvider;
   successMessage?: string | null;
-  errorMessage?: string;
+  errorMessage?: string | false;
   onSuccess?: (result: AuthActionResult) => void;
 }
 
@@ -33,13 +33,13 @@ function createAuthMutation(options: CreateAuthMutationOptions) {
         if (options.successMessage) notify({ type: 'success', message: options.successMessage });
         if (options.onSuccess) options.onSuccess(result);
       } else {
-        const msg = result.error?.message ?? options.errorMessage ?? t('common.operationFailed');
-        notify({ type: 'error', message: msg });
+        const msg = result.error?.message ?? (typeof options.errorMessage === 'string' ? options.errorMessage : t('common.operationFailed'));
+        if (options.errorMessage !== false) notify({ type: 'error', message: msg });
       }
       return result;
     } catch (err) {
-      const msg = err instanceof Error ? err.message : (options.errorMessage ?? t('common.operationFailed'));
-      notify({ type: 'error', message: msg });
+      const msg = err instanceof Error ? err.message : (typeof options.errorMessage === 'string' ? options.errorMessage : t('common.operationFailed'));
+      if (options.errorMessage !== false) notify({ type: 'error', message: msg });
       return { success: false, error: { message: msg } };
     } finally {
       isLoading = false;
@@ -54,11 +54,11 @@ function createAuthMutation(options: CreateAuthMutationOptions) {
 
 // ─── useLogin ─────────────────────────────────────────────────
 
-export function useLogin() {
+export function useLogin(opts?: { errorMessage?: string | false }) {
   return createAuthMutation({
     method: 'login',
     successMessage: t('common.operationSuccess'),
-    errorMessage: t('common.loginFailed'),
+    errorMessage: opts?.errorMessage ?? t('common.loginFailed'),
     onSuccess: (result) => { if (result.redirectTo) navigate(result.redirectTo); }
   });
 }
@@ -105,7 +105,7 @@ export function useUpdatePassword() {
 // ─── useGetIdentity ──────────────────────────────────────────
 
 export function useGetIdentity() {
-  const provider = getAuthProvider();
+  const provider = getAuthProvider({ optional: true });
   let data = $state<Identity | null>(null);
   let isLoading = $state(true);
   let error = $state<Error | null>(null);
@@ -138,33 +138,43 @@ export function useGetIdentity() {
 // ─── useIsAuthenticated ──────────────────────────────────────
 
 export function useIsAuthenticated() {
-  const provider = getAuthProvider();
+  const provider = getAuthProvider({ optional: true });
   let isAuthenticated = $state(false);
   let isLoading = $state(true);
+  let checkResult = $state<CheckResult | null>(null);
 
-  if (provider) {
-    if (typeof window !== 'undefined') {
-      provider.check().then((result: CheckResult) => {
-        isAuthenticated = result.authenticated;
-        isLoading = false;
-      }).catch(() => {
-        isAuthenticated = false;
-        isLoading = false;
-      });
-    } else {
+  function check() {
+    if (!provider) {
+      isAuthenticated = true;
+      isLoading = false;
+      return;
+    }
+    if (typeof window === 'undefined') {
       // In SSR we assume false to prevent hydration mismatch before check
       isAuthenticated = false;
       isLoading = false;
+      return;
     }
-  } else {
-    // No auth provider — treat as authenticated
-    isAuthenticated = true;
-    isLoading = false;
+    isLoading = true;
+    provider.check().then((result: CheckResult) => {
+      isAuthenticated = result.authenticated;
+      checkResult = result;
+      isLoading = false;
+    }).catch(() => {
+      isAuthenticated = false;
+      checkResult = { authenticated: false };
+      isLoading = false;
+    });
   }
 
+  // Initial check
+  check();
+
   return {
     get isAuthenticated() { return isAuthenticated; },
     get isLoading() { return isLoading; },
+    get data() { return checkResult; },
+    refetch: check,
   };
 }
 
@@ -176,7 +186,7 @@ export function useIsAuthenticated() {
  * If it returns { redirectTo }, navigates there.
  */
 export function useOnError() {
-  const provider = getAuthProvider();
+  const provider = getAuthProvider({ optional: true });
 
   async function mutate(error: unknown) {
     if (!provider?.onError) {

package/src/chatProvider.svelte.ts

@@ -186,36 +186,23 @@ export function getAgentProvider(): AgentProvider | null {
 interface ApprovalCallback {
   (approved: boolean): void;
 }
-const pendingApprovals = new Map<string, ApprovalCallback>();
+interface ApprovalEntry { id: string; callback: ApprovalCallback }
+let pendingApprovals = $state<ApprovalEntry[]>([]);
 
-/**
- * Register a pending approval request. Called internally by the framework
- * when an `approval_request` event is received from the agent.
- */
 export function registerApproval(id: string, callback: ApprovalCallback): void {
-  pendingApprovals.set(id, callback);
+  pendingApprovals = [...pendingApprovals, { id, callback }];
 }
 
-/**
- * Approve or reject a pending tool call.
- *
- * @example
- * ```svelte
- * <button onclick={() => resolveApproval('req-1', true)}>Approve</button>
- * <button onclick={() => resolveApproval('req-1', false)}>Reject</button>
- * ```
- */
 export function resolveApproval(id: string, approved: boolean): boolean {
-  const cb = pendingApprovals.get(id);
-  if (!cb) return false;
-  cb(approved);
-  pendingApprovals.delete(id);
+  const entry = pendingApprovals.find(e => e.id === id);
+  if (!entry) return false;
+  entry.callback(approved);
+  pendingApprovals = pendingApprovals.filter(e => e.id !== id);
   return true;
 }
 
-/** Check if there are any pending approval requests. */
 export function hasPendingApprovals(): boolean {
-  return pendingApprovals.size > 0;
+  return pendingApprovals.length > 0;
 }
 
 // ─── Chat Context singleton ────────────────────────────────────

package/src/context.svelte.ts

@@ -3,6 +3,11 @@
 
 import type { DataProvider, AuthProvider, ResourceDefinition } from './types';
 import type { RouterProvider } from './router-provider';
+import { resetNotificationProvider } from './notification.svelte';
+import { resetAuditLogProvider } from './audit';
+import { resetAccessControlProvider } from './permissions';
+import { resetAdminOptions } from './options.svelte';
+import { resetI18n } from './i18n.svelte';
 
 // ─── DataProvider (supports single or multiple) ─────────────────
 
@@ -122,3 +127,18 @@ export function setLiveProvider(provider: import('./live.svelte').LiveProvider):
 export function getLiveProvider(): import('./live.svelte').LiveProvider | undefined {
   return liveProviderState;
 }
+
+// ─── Reset — for testing / HMR ─────────────────────────────────
+
+export function resetContext(): void {
+  providers = null;
+  authProvider = null;
+  resources = [];
+  routerProvider = undefined;
+  liveProviderState = undefined;
+  resetNotificationProvider();
+  resetAuditLogProvider();
+  resetAccessControlProvider();
+  resetAdminOptions();
+  resetI18n();
+}

package/src/data-transfer.svelte.ts

@@ -57,14 +57,13 @@ export function useExport<TData extends BaseRecord = BaseRecord>(options: UseExp
 
       if (options.download !== false && typeof document !== 'undefined') {
         const fields = Object.keys(mapped[0]);
-        const header = fields.join(',');
+        const escapeCsvField = (s: string) => s.includes(',') || s.includes('"') || s.includes('\n') || s.includes('\r') ? `"${s.replace(/"/g, '""')}"` : s;
+        const header = fields.map(escapeCsvField).join(',');
         const rows = mapped.map(record =>
           fields.map(f => {
             const val = record[f];
-            const str = val === null || val === undefined ? '' : String(val);
-            return str.includes(',') || str.includes('"') || str.includes('\n')
-              ? `"${str.replace(/"/g, '""')}"`
-              : str;
+            const str = val === null || val === undefined ? '' : typeof val === 'object' ? JSON.stringify(val) : String(val);
+            return escapeCsvField(str);
           }).join(',')
         );
 
@@ -200,6 +199,7 @@ function parseCSV(text: string): string[][] {
   let currentRow: string[] = [];
   let currentVal = '';
   let inQuotes = false;
+  let wasQuoted = false;
 
   for (let i = 0; i < text.length; i++) {
     const ch = text[i];
@@ -207,7 +207,7 @@ function parseCSV(text: string): string[][] {
       if (ch === '"') {
         if (i + 1 < text.length && text[i + 1] === '"') {
           currentVal += '"';
-          i++; // skip escaped quote
+          i++;
         } else {
           inQuotes = false;
         }
@@ -217,18 +217,21 @@ function parseCSV(text: string): string[][] {
     } else {
       if (ch === '"') {
         inQuotes = true;
+        wasQuoted = true;
       } else if (ch === ',') {
-        currentRow.push(currentVal.trim());
+        currentRow.push(wasQuoted ? currentVal : currentVal.trim());
         currentVal = '';
+        wasQuoted = false;
       } else if (ch === '\n' || ch === '\r') {
-        currentRow.push(currentVal.trim());
+        currentRow.push(wasQuoted ? currentVal : currentVal.trim());
         if (currentRow.some(v => v !== '')) {
           rows.push(currentRow);
         }
         currentRow = [];
         currentVal = '';
+        wasQuoted = false;
         if (ch === '\r' && i + 1 < text.length && text[i + 1] === '\n') {
-          i++; // consume \n of \r\n
+          i++;
         }
       } else {
         currentVal += ch;
@@ -237,7 +240,7 @@ function parseCSV(text: string): string[][] {
   }
   
   if (currentVal || currentRow.length > 0) {
-    currentRow.push(currentVal.trim());
+    currentRow.push(wasQuoted ? currentVal : currentVal.trim());
     if (currentRow.some(v => v !== '')) {
       rows.push(currentRow);
     }

package/src/form-hooks.svelte.ts

@@ -1,14 +1,17 @@
 import { useQueryClient } from '@tanstack/svelte-query';
 import { useParsed } from './useParsed.svelte';
 import { getAdminOptions } from './options.svelte';
-import { getDataProviderForResource, getResource } from './context.svelte';
+import { getDataProviderForResource, getResource, getLiveProvider } from './context.svelte';
 import { createQuery, createMutation } from '@tanstack/svelte-query';
 import { notify } from './notification.svelte';
 import { t } from './i18n.svelte';
 import { audit } from './audit';
 import { navigate, currentPath } from './router';
-import { HttpError } from './types';
+import { HttpError, UndoError } from './types';
 import type { BaseRecord, MutationMode, KnownResources } from './types';
+import { checkError } from './hook-utils.svelte';
+import { toast } from './toast.svelte';
+import { deepMerge, invalidateByScopes } from './mutation-hooks.svelte';
 
 // ─── Types ───────────────────────────────────────────────────────────
 
@@ -18,7 +21,7 @@ export interface UseFormOptions<
   TError = HttpError,
 > {
   resource?: KnownResources;
-  action?: 'create' | 'edit' | 'clone';
+  action?: 'create' | 'edit' | 'clone' | 'show';
   id?: string | number;
   redirect?: 'list' | 'edit' | 'show' | false;
 
@@ -41,7 +44,7 @@ export interface UseFormOptions<
   /** Called every time a field value changes. */
   onChange?: (event: { field: string; value: unknown; values: TVariables }) => void;
   /** Called before mutation. Return false or call cancel() to prevent submission. */
-  onSubmit?: (ctx: { values: TVariables; action: 'create' | 'edit' | 'clone'; cancel: () => void }) => void | boolean;
+  onSubmit?: (ctx: { values: TVariables; action: 'create' | 'edit' | 'clone' | 'show'; cancel: () => void }) => void | boolean;
 
   // ─── Meta ─────────────────────────────────────────────────────
   meta?: Record<string, unknown>;
@@ -95,6 +98,7 @@ export interface UseFormReturn<
   // ─── Tainted (dirty) ──────────────────────────────────────────
   readonly tainted: Record<string, boolean>;
   isTainted: (field?: string) => boolean;
+  untaint: () => void;
 
   // ─── Errors ───────────────────────────────────────────────────
   readonly errors: Record<string, string>;
@@ -113,12 +117,12 @@ export interface UseFormReturn<
   // ─── State ──────────────────────────────────────────────────────
   readonly loading: boolean;
   readonly submitting: boolean;
-  readonly action: 'create' | 'edit' | 'clone';
+  readonly action: 'create' | 'edit' | 'clone' | 'show';
   readonly resource: string;
   readonly id: string | number | undefined;
   readonly isDirty: boolean;
   setId: (id: string | number | undefined) => void;
-  setAction: (action: 'create' | 'edit' | 'clone') => void;
+  setAction: (action: 'create' | 'edit' | 'clone' | 'show') => void;
   mutationMode: MutationMode;
   redirect: (to: 'list' | 'edit' | 'show' | false) => void;
 
@@ -143,7 +147,7 @@ export function useForm<
   const adminOptions = getAdminOptions();
 
   const resource = $derived(options.resource ?? parsed.resource ?? '');
-  let action = $state<'create' | 'edit' | 'clone'>(options.action ?? (parsed.action === 'list' ? 'create' : parsed.action as 'create' | 'edit' | 'clone') ?? 'create');
+  let action = $state<'create' | 'edit' | 'clone' | 'show'>(options.action ?? (parsed.action === 'list' ? 'create' : parsed.action as 'create' | 'edit' | 'clone' | 'show') ?? 'create');
   let currentId = $state<string | number | undefined>(options.id ?? parsed.id);
 
   const defaultRedirectOpt = $derived(action === 'clone' ? adminOptions.redirect?.afterClone : action === 'edit' ? adminOptions.redirect?.afterEdit : adminOptions.redirect?.afterCreate);
@@ -166,12 +170,11 @@ export function useForm<
   const redirectDefault = $derived(redirectOption ?? defaultRedirectOpt ?? 'list');
 
   const provider = $derived(getDataProviderForResource(resource, dataProviderName));
-  const parsedMeta = useParsed().params || {};
-  const queryMeta = { ...parsedMeta, ...hookMeta, ...hookQueryMeta };
-  const mutationMeta = { ...parsedMeta, ...hookMeta, ...hookMutationMeta };
+  const queryMeta = $derived({ ...useParsed().params, ...hookMeta, ...hookQueryMeta });
+  const mutationMeta = $derived({ ...useParsed().params, ...hookMeta, ...hookMutationMeta });
 
   function setId(newId: string | number | undefined) { currentId = newId; }
-  function setAction(newAction: 'create' | 'edit' | 'clone') { action = newAction; }
+  function setAction(newAction: 'create' | 'edit' | 'clone' | 'show') { action = newAction; }
 
   // ─── Form values (single source of truth) ───────────────────────
   let values = $state<TVariables>((options.defaultValues ?? {}) as TVariables);
@@ -243,10 +246,13 @@ export function useForm<
     values = { ...initialValues } as TVariables;
     tainted = {};
     clearErrors();
+    queryInitializedId = undefined;
   }
 
   // ─── Server error handling ──────────────────────────────────────
+
   function handleHttpError(error: Error) {
+    checkError(error);
     if (error instanceof HttpError && error.errors && !disableServerSideValidation) {
       for (const [field, messages] of Object.entries(error.errors)) {
         const msg = Array.isArray(messages) ? messages[0] : messages;
@@ -262,12 +268,12 @@ export function useForm<
   // Always create the query — use `enabled` to conditionally activate.
   // This ensures setAction('edit') at runtime will trigger a fetch.
   const query = createQuery(() => ({
-    queryKey: [resource, 'one', currentId],
+    queryKey: [options.dataProviderName, resource, 'one', currentId, queryMeta],
     queryFn: async () => {
       const result = await provider.getOne<BaseRecord>({ resource, id: currentId!, meta: queryMeta });
-      return result.data;
+      return result;
     },
-    enabled: (queryOptions?.enabled ?? true) && (action === 'edit' || action === 'clone') && currentId != null,
+    enabled: (queryOptions?.enabled ?? true) && (action === 'edit' || action === 'clone' || action === 'show') && currentId != null,
     staleTime: queryOptions?.staleTime,
   }));
 
@@ -276,21 +282,23 @@ export function useForm<
   {
     $effect.pre(() => {
       // Discard previous fetch lock and default when switched strictly back to create
-      if (action === 'create' && currentId === undefined && queryInitializedId !== undefined) {
+      if (action === 'create' && queryInitializedId !== undefined) {
         queryInitializedId = undefined;
         const def = (options.defaultValues ?? {}) as TVariables;
         values = { ...def };
         initialValues = { ...def };
+        tainted = {};
+        clearErrors();
         return;
       }
       if (queryInitializedId === currentId) return;
-      const data = query.data as Record<string, unknown> | undefined;
+      const record = (query.data as { data: Record<string, unknown> } | undefined)?.data;
       const pk = getResource(resource).primaryKey ?? 'id';
-      if (data && (currentId == null || String(data[pk]) === String(currentId) || !data[pk])) {
-        // In clone mode, strip out identifiers
+      if (record && String(record[pk]) === String(currentId)) {
+        const cloneStripKeys = new Set(['id', '_id', pk, 'createdAt', 'updatedAt', 'created_at', 'updated_at', 'createdBy', 'updated_by', 'created_by', 'updatedBy']);
         const targetData = action === 'clone' 
-          ? Object.fromEntries(Object.entries(data).filter(([k]) => k !== 'id' && k !== '_id' && k !== pk))
-          : data;
+          ? Object.fromEntries(Object.entries(record).filter(([k]) => !cloneStripKeys.has(k)))
+          : record;
         // Merge: defaultValues < query data
         const merged = { ...(options.defaultValues ?? {}), ...targetData } as TVariables;
         values = merged;
@@ -307,13 +315,18 @@ export function useForm<
     ...options.createMutationOptions,
     mutationFn: (variables: TVariables) => provider.create<TData, TVariables>({ resource, variables, meta: mutationMeta }),
     onSuccess: (data: { data: TData }) => {
-      if (invalidateScopes !== false) queryClient.invalidateQueries({ queryKey: [resource] });
+      invalidateByScopes(queryClient, resource, invalidateScopes, ['list', 'many']);
       if (successNotification !== false) notify({ type: 'success', message: typeof successNotification === 'string' ? successNotification : t('common.createSuccess') });
       const pk = getResource(resource).primaryKey ?? 'id';
-      audit({ action: 'create', resource, recordId: String((data.data as Record<string, unknown>)[pk]) });
+      const newId = (data.data as Record<string, unknown>)[pk];
+      audit({ action: 'create', resource, recordId: String(newId) });
+      // Publish live event
+      try {
+        const lp = getLiveProvider();
+        if (lp?.publish) lp.publish({ type: 'INSERT', resource, payload: { ids: newId != null ? [newId as string | number] : [] } });
+      } catch { /* no live provider */ }
       onMutationSuccess?.(data);
       if (redirectOverride !== false) {
-        const newId = (data.data as Record<string, unknown>)[pk];
         if (newId != null) currentId = newId as string | number;
         doRedirect(redirectOverride ?? redirectDefault);
       }
@@ -321,17 +334,60 @@ export function useForm<
     onError: (error: Error) => { handleHttpError(error); onMutationError?.(error); },
   }));
 
-  const updateMut = createMutation(() => ({
+  const updateMut = createMutation<{ data: TData }, unknown, TVariables>(() => ({
     ...options.updateMutationOptions,
-    mutationFn: (variables: TVariables) => provider.update<TData, TVariables>({ resource, id: currentId!, variables, meta: mutationMeta }),
-    onSuccess: (data: { data: TData }) => {
-      if (invalidateScopes !== false) queryClient.invalidateQueries({ queryKey: [resource] });
+    mutationFn: async (variables: TVariables) => {
+      if (mutationMode === 'undoable') {
+        await new Promise<void>((resolve, reject) => {
+          toast.undoable(t('common.actionCanBeUndone'), undoableTimeout, () => {
+            reject(new UndoError());
+          }, resolve);
+        });
+      }
+      return provider.update<TData, TVariables>({ resource, id: currentId!, variables, meta: mutationMeta });
+    },
+    onMutate: async (variables: TVariables) => {
+      if (mutationMode === 'pessimistic') return;
+      await queryClient.cancelQueries({ predicate: (q) => q.queryKey[1] === resource });
+      const previousQueries = queryClient.getQueriesData({ predicate: (q) => q.queryKey[1] === resource });
+      if (optimisticUpdateMap?.list !== false) {
+        queryClient.setQueriesData({ predicate: (q) => q.queryKey[1] === resource && q.queryKey[2] === 'list' }, (old: unknown) => {
+          if (!old || typeof old !== 'object' || !('data' in old)) return old;
+          const o = old as { data: Record<string, unknown>[] };
+          const pk = getResource(resource).primaryKey ?? 'id';
+          return { ...o, data: o.data.map((item) => String(item[pk]) === String(currentId) ? deepMerge(item, variables) : item) };
+        });
+      }
+      if (optimisticUpdateMap?.detail !== false && currentId != null) {
+        queryClient.setQueriesData({ predicate: (q) => q.queryKey[1] === resource && q.queryKey[2] === 'one' && q.queryKey[3] === currentId }, (old: Record<string, unknown> | undefined) => old ? { ...old, data: deepMerge((old as Record<string, unknown>).data || {}, variables) } : old);
+      }
+      return { previousQueries };
+    },
+    onSuccess: (data: unknown) => {
       if (successNotification !== false) notify({ type: 'success', message: typeof successNotification === 'string' ? successNotification : t('common.updateSuccess') });
       audit({ action: 'update', resource, recordId: String(currentId) });
+      try {
+        const lp = getLiveProvider();
+        if (lp?.publish) lp.publish({ type: 'UPDATE', resource, payload: { ids: currentId != null ? [currentId] : [] } });
+      } catch { /* no live provider */ }
       onMutationSuccess?.(data);
       if (redirectOverride !== false) doRedirect(redirectOverride ?? redirectDefault);
     },
-    onError: (error: Error) => { handleHttpError(error); onMutationError?.(error); },
+    onSettled: (_data: unknown, error: unknown) => {
+      if (error instanceof UndoError) return;
+      invalidateByScopes(queryClient, resource, invalidateScopes, ['list', 'many', 'detail'], currentId ?? undefined);
+    },
+    onError: (error: unknown, _vars: unknown, context: unknown) => {
+      const ctx = context as { previousQueries?: [unknown, unknown][] } | undefined;
+      if (ctx?.previousQueries) {
+        for (const [queryKey, data] of ctx.previousQueries) {
+          queryClient.setQueryData(queryKey as string[], data);
+        }
+      }
+      if (error instanceof UndoError) return;
+      handleHttpError(error as Error);
+      onMutationError?.(error as Error);
+    },
   }));
 
   function doRedirect(to: 'list' | 'edit' | 'show' | false) {
@@ -347,7 +403,7 @@ export function useForm<
 
   // ─── Submit ─────────────────────────────────────────────────────
   async function submit(overrides?: { redirect?: 'list' | 'edit' | 'show' | false }) {
-    // onSubmit pre-hook
+    if (autoSaveTimer) { clearTimeout(autoSaveTimer); autoSaveTimer = null; }
     if (onSubmitFn) {
       let cancelled = false;
       const result = onSubmitFn({ values, action, cancel: () => { cancelled = true; } });
@@ -359,11 +415,9 @@ export function useForm<
     try {
       if (action === 'create' || action === 'clone') await createMut.mutateAsync(values);
       else await updateMut.mutateAsync(values);
-      // Untaint on success
       tainted = {};
-    } catch (error) {
-      // Errors are already handled by the mutation's onError callback.
-      // We catch here to prevent unhandled promise rejections.
+    } catch {
+      // Errors already handled by mutation's onError callback
     }
   }
 
@@ -373,36 +427,41 @@ export function useForm<
   let lastAutoSaveData = $state<unknown>(null);
   let lastAutoSaveError = $state<unknown>(null);
 
+  $effect(() => {
+    return () => {
+      if (autoSaveTimer) clearTimeout(autoSaveTimer);
+    };
+  });
+
   function triggerAutoSave() {
-    const currentAction = action; // read $state reactively at call time
-    if (!autoSaveOpts?.enabled || currentAction === 'create' || currentAction === 'clone') return;
+    const currentAction = action;
+    if (!autoSaveOpts?.enabled || currentAction === 'create' || currentAction === 'clone' || currentId == null) return;
+    if (createMut.isPending || updateMut.isPending) return;
     if (autoSaveTimer) clearTimeout(autoSaveTimer);
 
+    const safeId = currentId;
     autoSaveTimer = setTimeout(async () => {
       const finalValues = autoSaveOpts.onFinish ? autoSaveOpts.onFinish(values) : values;
       autoSaveStatus = 'saving';
       try {
-        await provider.update<TData, TVariables>({ resource, id: currentId!, variables: finalValues, meta: mutationMeta });
+        await provider.update<TData, TVariables>({ resource, id: safeId as string | number, variables: finalValues, meta: mutationMeta });
         const scopes = autoSaveOpts.invalidates ?? ['resourceAll'];
-        for (const scope of scopes) {
-          if (scope === 'resourceAll') queryClient.invalidateQueries({ queryKey: [resource] });
-          else if (scope === 'detail' && currentId) queryClient.invalidateQueries({ queryKey: [resource, 'one', currentId] });
-          else if (scope === 'list') queryClient.invalidateQueries({ queryKey: [resource, 'list'] });
-        }
+        invalidateByScopes(queryClient, resource, scopes, ['resourceAll'], safeId ?? undefined);
         autoSaveStatus = 'saved';
-        lastAutoSaveData = undefined;
+        lastAutoSaveData = finalValues;
         lastAutoSaveError = null;
         setTimeout(() => { autoSaveStatus = 'idle'; }, 2000);
       } catch (e) {
         autoSaveStatus = 'error';
         lastAutoSaveError = e;
+        checkError(e);
       }
     }, autoSaveOpts.debounce ?? 1000);
   }
 
   if (autoSaveOpts?.invalidateOnUnmount) {
     $effect(() => {
-      return () => queryClient.invalidateQueries({ queryKey: [resource] });
+      return () => queryClient.invalidateQueries({ predicate: (q) => q.queryKey[1] === resource });
     });
   }
 
@@ -430,6 +489,7 @@ export function useForm<
     // Tainted
     get tainted() { return tainted; },
     isTainted,
+    untaint: () => { tainted = {}; },
 
     // Errors
     get errors() { return errors; },