@verbb/formie-core 1.0.9 → 1.0.11

package/CHANGELOG.md

@@ -2,7 +2,17 @@
 
 ## Unreleased
 
-## 1.0.9 - 2026-06-24
+## 1.0.11 - 2026-06-26
+
+### Changed
+- Send CSRF tokens from `session.tokens.csrf` on client REST `submit`, `refreshSession`, and `setPage` requests when guest CSRF validation is enabled on the server.
+
+## 1.0.10 - 2026-06-26
+
+### Changed
+- Align headless client-side validation messages with server-side Formie copy, including field labels in required, email, number, min/max, URL, and match validation errors. ([#2907](https://github.com/verbb/formie/issues/2907))
+
+## 1.0.9 - 2026-06-25
 
 ### Added
 - Extend `FrontendSubmitResult` and `submitFormieClientForm` GraphQL selections with payment follow-up fields (`paymentStatus`, `paymentMessage`, `paymentRedirectUrl`, `paymentAction`, `paymentDecision`, `keepSubmitLoading`), plus `quizResult` and `clientEvents`. ([#1375](https://github.com/verbb/formie/issues/1375))

package/dist/form-instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"form-instance.d.ts","sourceRoot":"","sources":["../src/form-instance.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAER,oBAAoB,EACpB,oBAAoB,EAIpB,iBAAiB,EACpB,MAAM,SAAS,CAAC;AAEjB,KAAK,iCAAiC,GAAG;IACrC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,iBAAiB,CAAC;CAChC,CAAC;AAicF,wBAAgB,0BAA0B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,iCAAiC,GAAG,oBAAoB,CA8R3H"}
+{"version":3,"file":"form-instance.d.ts","sourceRoot":"","sources":["../src/form-instance.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAER,oBAAoB,EACpB,oBAAoB,EAIpB,iBAAiB,EACpB,MAAM,SAAS,CAAC;AAEjB,KAAK,iCAAiC,GAAG;IACrC,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,EAAE,iBAAiB,CAAC;CAChC,CAAC;AAucF,wBAAgB,0BAA0B,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,iCAAiC,GAAG,oBAAoB,CA8R3H"}

package/dist/index.js

@@ -438,43 +438,47 @@ function Y(e) {
 function he(e, t) {
 	return e.type === "checkboxes" ? !Array.isArray(t) || t.length === 0 : O(e) ? t !== !0 : E(e) || T(e) || D(e) ? !Array.isArray(t) || t.length === 0 : w(e) && t && typeof t == "object" ? Object.values(t).every((e) => e == null || typeof e == "string" && e.trim() === "") : t == null ? !0 : typeof t == "string" ? t.trim() === "" : !1;
 }
+function X(e) {
+	return e.label?.trim() || e.handle;
+}
 function ge(e, t, n, r, i) {
 	let a = new Set(e.validation.map((e) => e.type)), o = e.input;
 	if ((e.required || a.has("required")) && he(e, t)) {
-		i[r] = ["This field is required."];
+		i[r] = [`${X(e)} cannot be blank.`];
 		return;
 	}
 	if ((te(e) || a.has("email")) && typeof t == "string" && t.trim() !== "" && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(t)) {
-		i[r] = ["Please enter a valid email address."];
+		i[r] = [`${X(e)} is not a valid email address.`];
 		return;
 	}
 	if ((k(e) || a.has("number")) && typeof t == "string" && t.trim() !== "") {
 		let n = Number.parseFloat(t);
 		if (!Number.isFinite(n)) {
-			i[r] = ["Please enter a valid number."];
+			i[r] = [`${X(e)} is not a valid number.`];
 			return;
 		}
 		let a = e.validation.find((e) => e.type === "number"), s = Number(o.min ?? a?.min ?? NaN), c = Number(o.max ?? a?.max ?? NaN);
 		if (Number.isFinite(s) && n < s) {
-			i[r] = [`Please enter a value greater than or equal to ${s}.`];
+			i[r] = [`${X(e)} must be no less than ${s}.`];
 			return;
 		}
 		if (Number.isFinite(c) && n > c) {
-			i[r] = [`Please enter a value less than or equal to ${c}.`];
+			i[r] = [`${X(e)} must be no greater than ${c}.`];
 			return;
 		}
 	}
 	if (a.has("url") && typeof t == "string" && t.trim() !== "") try {
 		new URL(t);
 	} catch {
-		i[r] = ["Please enter a valid URL."];
+		i[r] = [`${X(e)} is not a valid URL.`];
 		return;
 	}
 	let s = e.validation.find((e) => e.type === "match");
 	if (s && typeof t == "string" && t.trim() !== "") {
-		let e = (s.fieldId ? y(n.definition, s.fieldId) : void 0) || (s.fieldHandle ? b(n.definition, s.fieldHandle) : void 0), a = e ? n.values[e.id] : void 0;
-		if (typeof a == "string" && a !== t) {
-			i[r] = ["This value must match the related field."];
+		let a = (s.fieldId ? y(n.definition, s.fieldId) : void 0) || (s.fieldHandle ? b(n.definition, s.fieldHandle) : void 0), o = a ? n.values[a.id] : void 0;
+		if (typeof o == "string" && o !== t) {
+			let t = a ? X(a) : e.handle;
+			i[r] = [`${X(e)} must match ${t}.`];
 			return;
 		}
 	}
@@ -3323,79 +3327,84 @@ function ke(e, t, n) {
 }
 //#endregion
 //#region src/rest.ts
-function X(e, t) {
+function Z(e, t) {
 	if (t.startsWith("http://") || t.startsWith("https://")) return t;
 	if (e.startsWith("http://") || e.startsWith("https://")) return new URL(t, e).toString();
 	let n = e.trim();
 	return !n || n === "/" ? t : `${n.replace(/\/+$/, "")}${t}`;
 }
-async function Z(e, t) {
+async function Q(e, t) {
 	let n = await fetch(e, t);
 	if (!n.ok) throw Error(`Request failed with status ${n.status}.`);
 	return n.json();
 }
-async function Ae(e) {
-	let t = X(e.endpoint, "/actions/formie/client/forms/load"), n = JSON.stringify({
+function Ae(e, t) {
+	let n = t?.tokens?.csrf;
+	!n?.name || !n.value || (e[n.name] = n.value);
+}
+async function je(e) {
+	let t = Z(e.endpoint, "/actions/formie/client/forms/load"), n = JSON.stringify({
 		handle: e.formHandle,
 		siteId: e.siteId
 	});
-	return Z(t, {
+	return Q(t, {
 		method: "POST",
 		credentials: e.credentials ?? "same-origin",
 		headers: { "Content-Type": "application/json" },
 		body: n
 	});
 }
-function je(e) {
+function Me(e) {
 	return {
 		async submit({ definition: t, session: n, values: r, action: i }) {
-			let a = X(e.endpoint, "/actions/formie/client/submissions/submit"), o = await R(t, r);
-			return Z(a, {
+			let a = Z(e.endpoint, "/actions/formie/client/submissions/submit"), o = await R(t, r), s = {
+				handle: e.formHandle,
+				siteId: e.siteId,
+				action: i,
+				session: n,
+				values: o
+			};
+			return Ae(s, n), Q(a, {
 				method: "POST",
 				credentials: e.credentials ?? "same-origin",
 				headers: { "Content-Type": "application/json" },
-				body: JSON.stringify({
-					handle: e.formHandle,
-					siteId: e.siteId,
-					action: i,
-					session: n,
-					values: o
-				})
+				body: JSON.stringify(s)
 			});
 		},
 		async refreshSession({ session: t }) {
-			return Z(X(e.endpoint, "/actions/formie/client/sessions/refresh"), {
+			let n = Z(e.endpoint, "/actions/formie/client/sessions/refresh"), r = {
+				handle: e.formHandle,
+				siteId: e.siteId,
+				session: t
+			};
+			return Ae(r, t), Q(n, {
 				method: "POST",
 				credentials: e.credentials ?? "same-origin",
 				headers: { "Content-Type": "application/json" },
-				body: JSON.stringify({
-					handle: e.formHandle,
-					siteId: e.siteId,
-					session: t
-				})
+				body: JSON.stringify(r)
 			});
 		},
 		async setPage({ definition: t, session: n, values: r, currentPageId: i, targetPageId: a }) {
-			let o = X(e.endpoint, "/actions/formie/client/forms/page"), s = await R(t, r);
-			return Z(o, {
+			let o = Z(e.endpoint, "/actions/formie/client/forms/page"), s = await R(t, r), c = {
+				handle: e.formHandle,
+				siteId: e.siteId,
+				currentPageId: i,
+				targetPageId: a,
+				session: n,
+				values: s
+			};
+			return Ae(c, n), Q(o, {
 				method: "POST",
 				credentials: e.credentials ?? "same-origin",
 				headers: { "Content-Type": "application/json" },
-				body: JSON.stringify({
-					handle: e.formHandle,
-					siteId: e.siteId,
-					currentPageId: i,
-					targetPageId: a,
-					session: n,
-					values: s
-				})
+				body: JSON.stringify(c)
 			});
 		}
 	};
 }
 //#endregion
 //#region src/graphql.ts
-var Q = "\n    id\n    currentPageId\n    tokens\n    continuation\n", Me = `
+var $ = "\n    id\n    currentPageId\n    tokens\n    continuation\n", Ne = `
     success
     submissionUid
     currentPageId
@@ -3412,17 +3421,17 @@ var Q = "\n    id\n    currentPageId\n    tokens\n    continuation\n", Me = `
     paymentDecision
     keepSubmitLoading
     session {
-        ${Q}
+        ${$}
     }
     quizResult
 `;
-function Ne(e) {
+function Pe(e) {
 	if (e.startsWith("http://") || e.startsWith("https://")) return e;
 	let t = e.trim();
 	return !t || t === "/" ? "/api" : t;
 }
-async function $(e, t, n) {
-	let r = await fetch(Ne(e.endpoint), {
+async function Fe(e, t, n) {
+	let r = await fetch(Pe(e.endpoint), {
 		method: "POST",
 		credentials: e.credentials ?? "same-origin",
 		headers: {
@@ -3440,14 +3449,14 @@ async function $(e, t, n) {
 	if (!i.data) throw Error("GraphQL returned no data.");
 	return i.data;
 }
-async function Pe(e) {
-	let t = await $(e, `
+async function Ie(e) {
+	let t = await Fe(e, `
             query ClientForm($handle: String!, $siteId: Int) {
                 formieClientForm(handle: $handle, siteId: $siteId) {
                     schemaVersion
                     definition
                     session {
-                        ${Q}
+                        ${$}
                     }
                 }
             }
@@ -3458,15 +3467,15 @@ async function Pe(e) {
 	if (!t.formieClientForm) throw Error("No client form definition was returned.");
 	return t.formieClientForm;
 }
-function Fe(e) {
+function Le(e) {
 	return {
 		async submit({ definition: t, session: n, values: r, action: i }) {
-			let a = await R(t, r), o = await $(e, `
+			let a = await R(t, r), o = await Fe(e, `
                     mutation SubmitFormieClientForm(
                         $input: FormieClientSubmitInput!
                     ) {
                         submitFormieClientForm(input: $input) {
-                            ${Me}
+                            ${Ne}
                         }
                     }
                 `, { input: {
@@ -3480,12 +3489,12 @@ function Fe(e) {
 			return o.submitFormieClientForm;
 		},
 		async refreshSession({ session: t }) {
-			let n = await $(e, `
+			let n = await Fe(e, `
                     mutation RefreshFormieClientSession(
                         $input: FormieClientSessionRefreshInput!
                     ) {
                         refreshFormieClientSession(input: $input) {
-                            ${Q}
+                            ${$}
                         }
                     }
                 `, { input: {
@@ -3497,12 +3506,12 @@ function Fe(e) {
 			return n.refreshFormieClientSession;
 		},
 		async setPage({ definition: t, session: n, values: r, currentPageId: i, targetPageId: a }) {
-			let o = await R(t, r), s = await $(e, `
+			let o = await R(t, r), s = await Fe(e, `
                     mutation SetFormieClientPage(
                         $input: FormieClientSetPageInput!
                     ) {
                         setFormieClientPage(input: $input) {
-                            ${Q}
+                            ${$}
                         }
                     }
                 `, { input: {
@@ -3520,31 +3529,31 @@ function Fe(e) {
 }
 //#endregion
 //#region src/text.ts
-var Ie = (() => {
+var Re = (() => {
 	let e = Intl.Segmenter;
 	return e ? new e(void 0, { granularity: "grapheme" }) : null;
-})(), Le = /[\p{L}\p{N}\p{M}]+(?:['’._-][\p{L}\p{N}\p{M}]+)*/gu;
-function Re(e) {
-	return typeof DOMParser < "u" ? new DOMParser().parseFromString(e, "text/html").body.textContent || "" : e.replace(/<[^>]*>/g, " ");
-}
-function ze(e) {
-	return Re(e);
-}
+})(), ze = /[\p{L}\p{N}\p{M}]+(?:['’._-][\p{L}\p{N}\p{M}]+)*/gu;
 function Be(e) {
-	return ze(e).replace(/[\s\t\n\r]+/g, " ").trim();
+	return typeof DOMParser < "u" ? new DOMParser().parseFromString(e, "text/html").body.textContent || "" : e.replace(/<[^>]*>/g, " ");
 }
 function Ve(e) {
-	return Ie ? Array.from(Ie.segment(e)).length : Array.from(e).length;
+	return Be(e);
 }
 function He(e) {
-	return e.match(Le)?.length || 0;
+	return Ve(e).replace(/[\s\t\n\r]+/g, " ").trim();
 }
 function Ue(e) {
-	let t = ze(e), n = Be(e);
+	return Re ? Array.from(Re.segment(e)).length : Array.from(e).length;
+}
+function We(e) {
+	return e.match(ze)?.length || 0;
+}
+function Ge(e) {
+	let t = Ve(e), n = He(e);
 	return {
-		graphemeCount: Ve(t),
-		wordCount: He(n)
+		graphemeCount: Ue(t),
+		wordCount: We(n)
 	};
 }
 //#endregion
-export { ye as FRONTEND_CLIENT_EVENT_NAMES, v as allFields, Ee as coerceCalculationVariables, A as compositePartDefinitions, Ve as countGraphemes, ve as createFrontendFormInstance, Fe as createGraphqlFrontendTransport, ne as createRepeaterRowValue, je as createRestFrontendTransport, N as defaultValueForField, ke as evaluateCalculationExpression, h as evaluateConditionDefinition, P as fieldValueAsStrings, S as fieldValueContract, C as fieldValueStructure, g as finalizeConditionEvaluation, b as findFieldByHandle, y as findFieldById, De as formatCalculationValue, we as getCalculationFormula, Te as getCalculationVariableEntries, Ue as getTextLimitMetrics, He as getWordCount, O as isBooleanField, w as isCompositeField, te as isEmailField, E as isFileField, ee as isKnownFrontendFieldType, D as isMultiValueField, k as isNumericField, T as isRepeatableField, Ae as loadFrontendEnvelope, Pe as loadGraphqlFrontendEnvelope, Be as normalizeText, Oe as readCalculationVariableValue, M as repeaterFieldDefinitions, j as repeaterRowDefinitions, x as serializeFieldValues, R as serializeTransportFieldValues };
+export { ye as FRONTEND_CLIENT_EVENT_NAMES, v as allFields, Ee as coerceCalculationVariables, A as compositePartDefinitions, Ue as countGraphemes, ve as createFrontendFormInstance, Le as createGraphqlFrontendTransport, ne as createRepeaterRowValue, Me as createRestFrontendTransport, N as defaultValueForField, ke as evaluateCalculationExpression, h as evaluateConditionDefinition, P as fieldValueAsStrings, S as fieldValueContract, C as fieldValueStructure, g as finalizeConditionEvaluation, b as findFieldByHandle, y as findFieldById, De as formatCalculationValue, we as getCalculationFormula, Te as getCalculationVariableEntries, Ge as getTextLimitMetrics, We as getWordCount, O as isBooleanField, w as isCompositeField, te as isEmailField, E as isFileField, ee as isKnownFrontendFieldType, D as isMultiValueField, k as isNumericField, T as isRepeatableField, je as loadFrontendEnvelope, Ie as loadGraphqlFrontendEnvelope, He as normalizeText, Oe as readCalculationVariableValue, M as repeaterFieldDefinitions, j as repeaterRowDefinitions, x as serializeFieldValues, R as serializeTransportFieldValues };

package/dist/rest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rest.d.ts","sourceRoot":"","sources":["../src/rest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAER,oBAAoB,EAGpB,iBAAiB,EACpB,MAAM,SAAS,CAAC;AAGjB,MAAM,MAAM,4BAA4B,GAAG;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,kBAAkB,CAAC;CACpC,CAAC;AA8BF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAe/G;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,4BAA4B,GAAG,iBAAiB,CA0DpG"}
+{"version":3,"file":"rest.d.ts","sourceRoot":"","sources":["../src/rest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAER,oBAAoB,EAGpB,iBAAiB,EACpB,MAAM,SAAS,CAAC;AAGjB,MAAM,MAAM,4BAA4B,GAAG;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,kBAAkB,CAAC;CACpC,CAAC;AAwCF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAe/G;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,4BAA4B,GAAG,iBAAiB,CAmEpG"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verbb/formie-core",
-  "version": "1.0.9",
+  "version": "1.0.11",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",