attaform 0.15.1 → 0.16.0

package/dist/shared/{attaform.CRk8NhlD.mjs → attaform.BfMxsfmE.mjs}

@@ -1,5 +1,141 @@
-import { f as getOrAssignElementId, _ as __DEV__, h as REGISTER_OWNER_MARKER, j as enforceSensitiveCheck, d as createRegistry, l as attachRegistryToApp, g as getRegistryFromApp } from './attaform.a99dQV7Q.mjs';
-import { nextTick, warn, isRef } from 'vue';
+import { shallowReactive, getCurrentInstance, inject, shallowRef, onBeforeMount, onBeforeUpdate, onMounted, nextTick, warn, isRef } from 'vue';
+
+const __DEV__ = typeof process !== "undefined" && process.env["NODE_ENV"] !== "production";
+
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+class AttaformError extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = new.target.name;
+  }
+}
+class InvalidPathError extends AttaformError {
+}
+class InvalidUseFormConfigError extends AttaformError {
+  constructor() {
+    super(
+      "[attaform] useForm received an invalid configuration (a schema directly, no argument, or no `schema` field). Pass it as `useForm({ schema })` \u2014 the schema is one of several configuration options. See https://attaform.com/docs/api/use-form-return for the full configuration shape."
+    );
+  }
+}
+class SubmitErrorHandlerError extends AttaformError {
+}
+class RegistryNotInstalledError extends AttaformError {
+  constructor() {
+    super(
+      "[attaform] No registry attached to this Vue app. Component-level useForm / injectForm / useRegister auto-install the registry, but SSR helpers (renderAttaformState, hydrateAttaformState) run outside setup and require an explicit `app.use(createAttaform())` at server-render time. Add it to your SSR entry, before `renderToString`."
+    );
+  }
+}
+class OutsideSetupError extends AttaformError {
+  constructor() {
+    super(
+      "[attaform] useForm / injectForm called outside Vue setup(). Move into setup or mount a child component to trigger from an event."
+    );
+  }
+}
+class ReservedFormKeyError extends AttaformError {
+  constructor(key) {
+    super(
+      `[attaform] Form key "${key}" uses the reserved "__atta:" namespace. Use a different prefix \u2014 "__atta:" is for library-internal synthetic keys (anonymous useForm() calls without an explicit key).`
+    );
+  }
+}
+class SensitivePersistFieldError extends AttaformError {
+  constructor(path) {
+    const display = Array.isArray(path) ? path.join(".") : String(path);
+    super(
+      `[attaform] Refusing to persist "${display}" \u2014 this path matches a sensitive-name pattern (password / cvv / ssn / token / etc.). Storing sensitive data in client-side storage is a compliance risk (HIPAA / PII / PCI-DSS / SOC2). Fix: persist this server-side, OR pass \`acknowledgeSensitive: true\` to register() (or form.persist()) if the client-side persistence is intentional.`
+    );
+  }
+}
+class AnonPersistError extends AttaformError {
+  constructor(opts) {
+    super(formatAnonPersistMessage(opts));
+    __publicField(this, "schemaFields");
+    __publicField(this, "callSite");
+    __publicField(this, "cause");
+    this.schemaFields = opts.schemaFields;
+    this.callSite = opts.callSite;
+    this.cause = opts.cause;
+  }
+}
+function formatAnonPersistMessage(opts) {
+  const head = opts.cause === "no-key" ? `useForm({ persist: ... }) requires an explicit \`key:\`. Anonymous synthetic keys (\`__atta:anon:*\`) drift across mounts and can collide between unrelated forms \u2014 refusing to persist to a non-deterministic location.` : `register(_, { persist: true }) declared on a form whose useForm() options have no \`persist:\` configured. The opt-in is recorded but nothing would ever land in storage.`;
+  const fields = opts.schemaFields !== void 0 && opts.schemaFields.length > 0 ? ` Form fields: { ${opts.schemaFields.join(", ")} }.` : "";
+  const fix = opts.cause === "no-key" ? ` Fix: add \`key: '<stable-id>'\` to useForm().` : ` Fix: add \`persist: 'session'\` (or 'local') and \`key:\` to useForm(), or remove \`{ persist: true }\` from this register() call.`;
+  const where = opts.callSite !== void 0 ? ` ${opts.callSite}` : "";
+  return `[attaform] ${head}${fields}${fix}${where}`;
+}
+
+function detectSSR(options = {}) {
+  if (options.override !== void 0) return options.override;
+  return typeof window === "undefined" && typeof document === "undefined";
+}
+
+const kAttaformRegistry = Symbol.for("attaform:registry");
+const kFormContext = Symbol.for("attaform:form-context");
+const kFormInstanceId = Symbol.for("attaform:form-instance-id");
+function createRegistry(options = {}) {
+  const ssr = detectSSR(options);
+  const defaults = Object.freeze({ ...options.defaults ?? {} });
+  const forms = shallowReactive(/* @__PURE__ */ new Map());
+  const pendingHydration = shallowReactive(/* @__PURE__ */ new Map());
+  const consumers = /* @__PURE__ */ new Map();
+  const evicting = /* @__PURE__ */ new Set();
+  function trackConsumer(key) {
+    consumers.set(key, (consumers.get(key) ?? 0) + 1);
+    let disposed = false;
+    return () => {
+      if (disposed) return;
+      disposed = true;
+      const remaining = (consumers.get(key) ?? 1) - 1;
+      if (remaining <= 0) {
+        const state = forms.get(key);
+        consumers.delete(key);
+        forms.delete(key);
+        if (state !== void 0) {
+          evicting.add(state);
+          void state.awaitPendingWrites().catch(() => void 0).finally(() => {
+            evicting.delete(state);
+            state.dispose();
+          });
+        }
+      } else {
+        consumers.set(key, remaining);
+      }
+    };
+  }
+  async function shutdown() {
+    const states = [...forms.values(), ...evicting];
+    await Promise.allSettled(states.map((state) => state.awaitPendingWrites()));
+  }
+  return { forms, pendingHydration, ssr, defaults, trackConsumer, shutdown };
+}
+function useRegistry() {
+  const instance = getCurrentInstance();
+  if (instance === null) {
+    throw new OutsideSetupError();
+  }
+  const registry = inject(kAttaformRegistry, null);
+  if (registry === null) {
+    throw new RegistryNotInstalledError();
+  }
+  return registry;
+}
+function getRegistryFromApp(app) {
+  const registry = app._attaform;
+  if (registry === void 0) {
+    throw new RegistryNotInstalledError();
+  }
+  return registry;
+}
+function attachRegistryToApp(app, registry) {
+  app.provide(kAttaformRegistry, registry);
+  app._attaform = registry;
+}
 
 const isArray = Array.isArray;
 function isFunction(value) {
@@ -72,6 +208,267 @@ function invokeArrayFns(fns, ...args) {
   }
 }
 
+function captureUserCallSite() {
+  const raw = new Error().stack;
+  if (typeof raw !== "string") return void 0;
+  const lines = raw.split("\n");
+  for (let i = 1; i < lines.length; i++) {
+    const frame = lines[i];
+    if (frame === void 0) continue;
+    if (/attaform[/-]forms?/i.test(frame)) continue;
+    if (/\bforms\.[A-Za-z0-9_-]+\.m?js\b/.test(frame)) continue;
+    const trimmed = frame.trim();
+    if (trimmed.length === 0) continue;
+    return shortenSourceFrame(trimmed);
+  }
+  return void 0;
+}
+function shortenSourceFrame(frame) {
+  const match = /(?:^|\s|\()([^\s()]+):(\d+):\d+\)?$/.exec(frame);
+  if (match === null) return frame;
+  const [, urlOrPath, line] = match;
+  if (urlOrPath === void 0 || line === void 0) return frame;
+  let path = urlOrPath;
+  path = path.replace(/^[a-z]+:\/\/[^/]+\//i, "");
+  path = path.replace(/^_nuxt\//, "");
+  path = path.replace(/^\//, "");
+  return `(${path}:${line})`;
+}
+
+const REGISTER_OWNER_MARKER = Symbol.for("attaform:register-owner-marker");
+const warnedNoParentRV = __DEV__ ? /* @__PURE__ */ new WeakSet() : null;
+let warnedOutsideSetup = false;
+function makeRegisterValueProxy(capturedRegisterValue) {
+  return new Proxy({}, {
+    get(_target, prop) {
+      if (prop === "__v_isRef") return true;
+      if (prop === "value") return capturedRegisterValue.value;
+      const v = capturedRegisterValue.value;
+      if (v === void 0) return void 0;
+      return Reflect.get(v, prop);
+    },
+    has(_target, prop) {
+      if (prop === "__v_isRef" || prop === "value") return true;
+      const v = capturedRegisterValue.value;
+      if (v === void 0) return false;
+      return Reflect.has(v, prop);
+    },
+    ownKeys(_target) {
+      const v = capturedRegisterValue.value;
+      if (v === void 0) return [];
+      return Reflect.ownKeys(v);
+    },
+    getOwnPropertyDescriptor(_target, prop) {
+      const v = capturedRegisterValue.value;
+      if (v === void 0) return void 0;
+      const desc = Reflect.getOwnPropertyDescriptor(v, prop);
+      if (desc !== void 0) {
+        desc.configurable = true;
+      }
+      return desc;
+    }
+  });
+}
+function useRegister() {
+  const instance = getCurrentInstance();
+  if (instance === null) {
+    warnOutsideSetup();
+    return makeRegisterValueProxy(shallowRef(void 0));
+  }
+  ensureAttaformInstalled(instance.appContext.app);
+  const capturedRegisterValue = shallowRef(void 0);
+  const refreshAndStripBridgeAttrs = () => {
+    const rawAttrs = instance.attrs;
+    if ("registerValue" in rawAttrs) {
+      capturedRegisterValue.value = rawAttrs["registerValue"];
+      delete rawAttrs["registerValue"];
+    }
+    if ("value" in rawAttrs) delete rawAttrs["value"];
+  };
+  refreshAndStripBridgeAttrs();
+  onBeforeMount(refreshAndStripBridgeAttrs);
+  onBeforeUpdate(refreshAndStripBridgeAttrs);
+  onMounted(() => {
+    const el = instance.vnode.el;
+    if (el !== null && el !== void 0 && typeof el === "object") {
+      el[REGISTER_OWNER_MARKER] = true;
+    }
+    if (capturedRegisterValue.value === void 0) {
+      warnNoParentRV(instance);
+    }
+  });
+  return makeRegisterValueProxy(capturedRegisterValue);
+}
+function warnOutsideSetup() {
+  if (!__DEV__) return;
+  if (warnedOutsideSetup) return;
+  warnedOutsideSetup = true;
+  const frame = captureUserCallSite();
+  console.warn(
+    `[attaform] useRegister() called outside a component setup; returning an unbound RegisterValue proxy. Fix: call it inside <script setup> or a setup() function \u2014 not from an event handler or async callback.` + (frame !== void 0 ? ` ${frame}` : "")
+  );
+}
+function warnNoParentRV(instance) {
+  if (!__DEV__ || warnedNoParentRV === null) return;
+  if (warnedNoParentRV.has(instance)) return;
+  warnedNoParentRV.add(instance);
+  const frame = captureUserCallSite();
+  console.warn(
+    `[attaform] useRegister: no parent registerValue prop; RegisterValue fields will read as undefined. Pass v-register on the parent: \`<YourComponent v-register="form.register('field')" />\`.` + (frame !== void 0 ? ` ${frame}` : "")
+  );
+}
+
+const idGenerator = /* @__PURE__ */ (() => {
+  let counter = 0;
+  return () => `el-${++counter}`;
+})();
+const elementIds = /* @__PURE__ */ new WeakMap();
+function getOrAssignElementId(el) {
+  let id = elementIds.get(el);
+  if (id === void 0) {
+    id = idGenerator();
+    elementIds.set(el, id);
+  }
+  return id;
+}
+function createPersistOptInRegistry() {
+  const byPath = /* @__PURE__ */ new Map();
+  function add(elementId, path) {
+    const existing = byPath.get(path);
+    if (existing === void 0) {
+      byPath.set(path, /* @__PURE__ */ new Set([elementId]));
+      return;
+    }
+    existing.add(elementId);
+  }
+  function remove(elementId, path) {
+    const existing = byPath.get(path);
+    if (existing === void 0) return;
+    existing.delete(elementId);
+    if (existing.size === 0) byPath.delete(path);
+  }
+  function removeAllFor(elementId) {
+    for (const [path, ids] of byPath) {
+      if (!ids.delete(elementId)) continue;
+      if (ids.size === 0) byPath.delete(path);
+    }
+  }
+  function hasOptIn(elementId, path) {
+    return byPath.get(path)?.has(elementId) ?? false;
+  }
+  function hasAnyOptInForPath(path) {
+    const ids = byPath.get(path);
+    return ids !== void 0 && ids.size > 0;
+  }
+  function optedInPaths() {
+    return byPath.keys();
+  }
+  function isEmpty() {
+    return byPath.size === 0;
+  }
+  function clear() {
+    byPath.clear();
+  }
+  return {
+    add,
+    remove,
+    removeAllFor,
+    hasOptIn,
+    hasAnyOptInForPath,
+    optedInPaths,
+    isEmpty,
+    clear
+  };
+}
+
+const SENSITIVE_NAME_PATTERNS = [
+  // Passwords and PIN-like
+  /password/i,
+  /passwd/i,
+  /passwords/i,
+  /\bpwd\b/i,
+  /\bpin\b/i,
+  // Card / payment
+  /\bcvv\b/i,
+  /\bcvc\b/i,
+  /card[_\s-]?(?:number|num)/i,
+  /\bcard\b/i,
+  /\biban\b/i,
+  /routing[_\s-]?number/i,
+  /account[_\s-]?number/i,
+  // Government / identity
+  /\bssn\b/i,
+  /social[_\s-]?security/i,
+  /\bdob\b/i,
+  /date[_\s-]?of[_\s-]?birth/i,
+  /passport/i,
+  /driver[_\s-]?license/i,
+  // Tax IDs (US + international common variants)
+  /\btin\b/i,
+  /\bein\b/i,
+  /\bitin\b/i,
+  /tax[_\s-]?id/i,
+  // Tokens, secrets, API/auth credentials
+  /\btoken\b/i,
+  /\btokens\b/i,
+  /secret/i,
+  /secrets/i,
+  /api[_\s-]?key/i,
+  /api[_\s-]?secret/i,
+  /api[_\s-]?token/i,
+  /private[_\s-]?key/i,
+  /\bbearer\b/i,
+  /\boauth\b/i,
+  /auth[_\s-]?token/i,
+  /access[_\s-]?token/i,
+  /refresh[_\s-]?token/i,
+  /session[_\s-]?(?:id|key|token)/i,
+  // MFA / OTP
+  /\botp\b/i,
+  /one[_\s-]?time[_\s-]?(?:password|code)/i,
+  /mfa[_\s-]?(?:secret|seed|code|token)/i,
+  /two[_\s-]?factor[_\s-]?(?:code|token)/i,
+  /\b2fa[_\s-]?(?:code|token)?\b/i,
+  /recovery[_\s-]?code/i,
+  /backup[_\s-]?code/i
+];
+function segmentMatchesSensitive(segment) {
+  if (typeof segment !== "string") return false;
+  for (const pattern of SENSITIVE_NAME_PATTERNS) {
+    if (pattern.test(segment)) return true;
+  }
+  return false;
+}
+function isSensitivePath(path) {
+  if (typeof path !== "string") {
+    for (const segment of path) {
+      if (segmentMatchesSensitive(segment)) return true;
+    }
+    return false;
+  }
+  if (path.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(path);
+      if (Array.isArray(parsed)) {
+        for (const segment of parsed) {
+          if (segmentMatchesSensitive(segment)) return true;
+        }
+        return false;
+      }
+    } catch {
+    }
+  }
+  for (const segment of path.split(".")) {
+    if (segmentMatchesSensitive(segment)) return true;
+  }
+  return false;
+}
+function enforceSensitiveCheck(path, acknowledged) {
+  if (acknowledged) return;
+  if (!isSensitivePath(path)) return;
+  throw new SensitivePersistFieldError(path);
+}
+
 const assignKey = Symbol.for("attaform:assign-key");
 const listenersKey = Symbol.for("attaform:directive-listeners");
 function isRegisterValue(val) {
@@ -733,58 +1130,40 @@ function callModelHook(el, binding, vnode, prevVNode, hook) {
 }
 const vRegister = vRegisterDynamic;
 
+function installAttaformOnApp(app, options, source) {
+  if (app._attaform !== void 0) {
+    if (__DEV__ && source === "explicit") {
+      console.warn(
+        "[attaform] createAttaform() install was called twice on the same app; the second call is a no-op. Likely cause: registering the plugin via both the Nuxt module AND a manual `app.use(...)`."
+      );
+    }
+    return app._attaform;
+  }
+  const registry = createRegistry(options);
+  attachRegistryToApp(app, registry);
+  app.directive("register", vRegister);
+  if (options.devtools !== false && !registry.ssr) {
+    void (async () => {
+      try {
+        const { setupAttaformDevtools } = await import('../chunks/devtools.mjs');
+        await setupAttaformDevtools(app, registry);
+      } catch {
+      }
+    })();
+  }
+  return registry;
+}
+function ensureAttaformInstalled(app) {
+  return installAttaformOnApp(app, {}, "lazy");
+}
 function createAttaform(options = {}) {
   const plugin = {
     install(app) {
-      if (app._attaform !== void 0) {
-        if (__DEV__) {
-          console.warn(
-            "[attaform] createAttaform() install was called twice on the same app; the second call is a no-op. Likely cause: registering the plugin via both the Nuxt module AND a manual `app.use(...)`."
-          );
-        }
-        return;
-      }
-      const registry = createRegistry(options);
-      attachRegistryToApp(app, registry);
-      app.directive("register", vRegister);
-      if (options.devtools !== false && !registry.ssr) {
-        void (async () => {
-          try {
-            const { setupAttaformDevtools } = await import('../chunks/devtools.mjs');
-            await setupAttaformDevtools(app, registry);
-          } catch {
-          }
-        })();
-      }
+      installAttaformOnApp(app, options, "explicit");
     }
   };
   return plugin;
 }
 
-function renderAttaformState(app) {
-  const registry = getRegistryFromApp(app);
-  const forms = [];
-  for (const [key, state] of registry.forms) {
-    const transientList = Array.from(state.blankPaths);
-    forms.push([
-      key,
-      {
-        form: state.form.value,
-        schemaErrors: Array.from(state.schemaErrors.entries()),
-        userErrors: Array.from(state.userErrors.entries()),
-        fields: Array.from(state.fields.entries()),
-        ...transientList.length > 0 ? { blankPaths: transientList } : {}
-      }
-    ]);
-  }
-  return { forms };
-}
-function hydrateAttaformState(app, payload) {
-  const registry = getRegistryFromApp(app);
-  for (const [key, data] of payload.forms) {
-    registry.pendingHydration.set(key, data);
-  }
-}
-
-export { assignKey as a, createAttaform as c, hydrateAttaformState as h, isRegisterValue as i, renderAttaformState as r, vRegister as v };
-//# sourceMappingURL=attaform.CRk8NhlD.mjs.map
+export { AnonPersistError as A, InvalidPathError as I, OutsideSetupError as O, RegistryNotInstalledError as R, SensitivePersistFieldError as S, __DEV__ as _, AttaformError as a, InvalidUseFormConfigError as b, createAttaform as c, ReservedFormKeyError as d, SubmitErrorHandlerError as e, assignKey as f, getRegistryFromApp as g, createRegistry as h, isSensitivePath as i, isRegisterValue as j, kAttaformRegistry as k, useRegistry as l, captureUserCallSite as m, enforceSensitiveCheck as n, createPersistOptInRegistry as o, ensureAttaformInstalled as p, kFormContext as q, kFormInstanceId as r, segmentMatchesSensitive as s, useRegister as u, vRegister as v };
+//# sourceMappingURL=attaform.BfMxsfmE.mjs.map