@zerotal/flow 1.11.2 → 1.13.0

package/CHANGELOG.md

@@ -11,6 +11,60 @@ change.
 
 ## [Unreleased]
 
+## [1.13.0] — 2026-08-31
+
+### Removed — **BREAKING**
+
+- **`Component.client(…)`.** Use the `` this.# Changelog — @zerotal/flow
+
+All notable changes to this package are documented here. The format is
+based on [Keep a Changelog](https://keepachangelog.com/); this package
+follows the Zerotal monorepo's unified versioning.
+
+**Maturity: `stable`** — matching this package's `maturity` field. The public API
+follows SemVer strictly: anything importable without an `@internal` marker keeps its
+shape for the rest of the 1.x line, and `api-surface.md` is diffed by CI on every
+change.
+
+…` `` tagged template.
+
+A security fix rather than an ergonomics change, which is why it did not wait for 2.0.
+`client()` took a **string** and queued it for evaluation in the browser, so the caller
+owned the escaping — and its own docblock had to warn _never interpolate unescaped user
+input_. A method whose documentation has to tell you not to hold it that way is a footgun
+with a label on. `# Changelog — @zerotal/flow
+
+All notable changes to this package are documented here. The format is
+based on [Keep a Changelog](https://keepachangelog.com/); this package
+follows the Zerotal monorepo's unified versioning.
+
+**Maturity: `stable`** — matching this package's `maturity` field. The public API
+follows SemVer strictly: anything importable without an `@internal` marker keeps its
+shape for the rest of the 1.x line, and `api-surface.md` is diffed by CI on every
+change.
+
+is a tagged template, so each `${…}` is encoded as a JS literal before
+it reaches the page and the caller cannot forget.
+
+`zt upgrade --to 1.13.0` rewrites a call whose argument is a single literal. One whose
+argument is a variable or a concatenation is **reported, not rewritten** — those are the
+ones the warning was about, and wrapping the finished string as `` # Changelog — @zerotal/flow
+
+All notable changes to this package are documented here. The format is
+based on [Keep a Changelog](https://keepachangelog.com/); this package
+follows the Zerotal monorepo's unified versioning.
+
+**Maturity: `stable`** — matching this package's `maturity` field. The public API
+follows SemVer strictly: anything importable without an `@internal` marker keeps its
+shape for the rest of the 1.x line, and `api-surface.md` is diffed by CI on every
+change.
+
+${expr}` `` would
+encode it as a string literal and stop running it as code.
+
+Removing it frees `client` as a property name on a component, as removing `title` did in
+1.7.3.
+
 ## [1.9.0] — 2026-08-29
 
 - **The component and flash types are documented.** Every built-in component exports the type of

package/api-surface.md

@@ -45,7 +45,6 @@ class Component = {
   cancelled: boolean
   child: <C extends Component>(ChildClass: new () => C, opts?: {    key?: string | number;    props?: Partial<C>;    lazy?: boolean;    defer?: boolean;    stream?: boolean;    slots?: Record<string, string>;}) => Promise<HtmlNode>
   clearDurable: () => void
-  client: (script: string) => void
   currentUrl: (options?: CurrentUrlOptions) => string
   dispatch: <K extends string>(name: K, ...args: K extends EventName ? EventArgs<FlowEvents[K]> : [payload?: Record<string, unknown>]) => void
   dispatchSelf: <K extends string>(name: K, ...args: K extends EventName ? EventArgs<FlowEvents[K]> : [payload?: Record<string, unknown>]) => void

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zerotal/flow",
-  "version": "1.11.2",
+  "version": "1.13.0",
   "license": "MIT",
   "maturity": "stable",
   "private": false,
@@ -47,15 +47,15 @@
     "@alpinejs/morph": "^3.14.9",
     "@alpinejs/persist": "^3.14.9",
     "@alpinejs/resize": "^3.14.9",
-    "@zerotal/client": "1.11.2",
-    "@zerotal/core": "1.11.2",
-    "@zerotal/orm": "1.11.2",
-    "@zerotal/validator": "1.11.2",
+    "@zerotal/client": "1.13.0",
+    "@zerotal/core": "1.13.0",
+    "@zerotal/orm": "1.13.0",
+    "@zerotal/validator": "1.13.0",
     "alpinejs": "^3.14.9",
     "typescript": "^5.8.0"
   },
   "devDependencies": {
-    "@zerotal/broadcasting": "1.11.2",
+    "@zerotal/broadcasting": "1.13.0",
     "@types/alpinejs": "^3.13.10",
     "@types/alpinejs__anchor": "^3.13.1",
     "@types/alpinejs__collapse": "^3.13.4",

package/src/Component.ts

@@ -554,7 +554,7 @@ export abstract class Component {
   _shouldRefresh = false;
 
   /**
-   * Raw JS expressions queued by this.client() during an action.
+   * Raw JS expressions queued by the `$` tagged template during an action.
    * Drained by _drainEffects() and forwarded to the client in the patch frame.
    * @internal
    */
@@ -1124,28 +1124,6 @@ export abstract class Component {
     this._shouldRefresh = true;
   }
 
-  /**
-   * Queue a raw JavaScript expression to be evaluated in the browser
-   * after the current action's DOM patch is applied.
-   *
-   * The expression runs in the Alpine context of the component root element:
-   * `$el`, `$refs`, and other Alpine magic properties are all available.
-   *
-   * Multiple calls are batched and executed in order after the single round trip.
-   *
-   * @example
-   * this.client(`$refs.titleInput.focus()`);
-   * this.client(`$el.querySelector('.toast').classList.add('visible')`);
-   *
-   * @security Never interpolate unescaped user input into the expression string. Prefer the
-   *           {@link $} tagged template, which encodes interpolated values for you.
-   * @deprecated Use the `$` tagged template: ``this.$`$refs.titleInput.focus()` ``.
-   * @category Actions
-   */
-  client(script: string): void {
-    this._clientScripts.push(script);
-  }
-
   /**
    * Run a client-side expression from a server action, interpolating values safely.
    *
@@ -1158,13 +1136,15 @@ export abstract class Component {
    * this.$`$el.dataset.count = ${this.items.length}`;
    * ```
    *
-   * That is the whole reason it replaces {@link client}. Building the expression by hand meant
-   * the caller owned the escaping, and a value containing a quote — a name, a search term —
-   * produced either a syntax error or something worse.
+   * That is the whole reason it replaced `client()`, removed in 1.13.0. Building the
+   * expression by hand meant the caller owned the escaping, and a value containing a quote —
+   * a name, a search term — produced either a syntax error or something worse. A method whose
+   * own documentation has to warn you not to interpolate into it is a footgun with a label on,
+   * so the label was replaced with an API that cannot be held the wrong way.
    *
-   * Runs in the component root's Alpine context after the action's DOM patch, exactly as
-   * {@link client} does: `$el`, `$refs` and the `$flow` magics are all in scope, and multiple
-   * calls execute in order after the single round trip.
+   * Runs in the component root's Alpine context after the action's DOM patch: `$el`, `$refs`
+   * and the `$flow` magics are all in scope, and multiple calls execute in order after the
+   * single round trip.
    *
    * @category Actions
    */

package/src/augment.ts

@@ -25,7 +25,7 @@ declare module "@zerotal/core" {
 
 /**
  * $flow — the client runtime object, available directly in JSX client expressions
- * (event handlers, attribute bindings, text children) and `this.client()` scripts.
+ * (event handlers, attribute bindings, text children) and `this.$` scripts.
  *
  * It is the single home for all client-only magics, so the component class itself stays
  * clean. The rule: `this.name` is always YOUR member (state/action); `$flow.name` is always a